jschoubben
e3934e4449
Closes the last open question about what the substrate contains. 0006 left an identity provider conditional — substrate only if the control plane delegated authentication — and said the decision had not been taken. It is now: it delegates to nothing. The conditional was never about machines. A node proves itself with a keypair it generated over a broker account issued at enrolment, and declarations are verified by signature; none of that involves an identity provider. It was only ever about whether a person signing in to a mesh surface would be authenticated by something else. So the substrate is three — a relational store, a message bus, an image registry — and with 0028 having removed the object store, no member is conditional and every one is there for the same reason. It does not settle how a person signs in to a surface, deliberately. What is settled is that whatever answers that is not something which must exist before the mesh does, so it can be decided late or replaced — which being substrate would have prevented.
73 lines
3.4 KiB
Markdown
73 lines
3.4 KiB
Markdown
---
|
|
topic: the tiers
|
|
status: accepted
|
|
date: 2026-08-31
|
|
deciders: jochen
|
|
reconstructed: false
|
|
extends: 02-DECISIONS/0006-the-substrate-and-the-control-plane.md
|
|
---
|
|
|
|
# 31. The control plane authenticates nobody, so identity is a module
|
|
|
|
## Context
|
|
|
|
[ADR 0006](0006-the-substrate-and-the-control-plane.md) left one member of the substrate
|
|
conditional, and said exactly why:
|
|
|
|
| role | product | |
|
|
|---|---|---|
|
|
| identity provider | — | **conditional**: substrate only if the control plane delegates authentication, which is undecided |
|
|
|
|
[`07-the-substrate.md`](../03-DESIGN/01-to-be/07-the-substrate.md) carried it as an open question —
|
|
*whether identity is the fifth* — noting it followed from a decision nobody had taken.
|
|
|
|
**The decision is taken: the control plane does not delegate authentication.** There is no mesh
|
|
identity provider.
|
|
|
|
**Nothing in the mesh's own machinery ever needed one.** A node proves itself with a keypair it
|
|
generated, over a broker account issued at enrolment
|
|
([ADR 0004](0004-a-node-and-how-it-joins.md)). Declarations are verified by signature. None of
|
|
that touches an identity provider, and the conditional was never about machines — it was only ever
|
|
about whether a *person* signing in to a mesh surface would be authenticated by something else.
|
|
|
|
## Decision
|
|
|
|
**Identity is a module**, like the mail system and the forge. It runs *on* the mesh, not *of* it
|
|
([ADR 0001](0001-mesh-brokers-nodes-host-agents-think.md)) — a provider other modules require,
|
|
which is the ordinary shape and needs nothing new to express.
|
|
|
|
**So the substrate is three, and no longer conditional**: a relational store, a message bus, and
|
|
an image registry. Together with
|
|
[ADR 0028](0028-the-substrate-supplies-the-control-plane-and-nothing-else.md), which removed the
|
|
object store, the list is settled and every member is there for the same reason — the control
|
|
plane needs it and cannot ask itself for it.
|
|
|
|
**A mesh that wants no identity provider runs none.** That is now expressible, and was not while
|
|
it sat in the substrate as a maybe.
|
|
|
|
## Consequences
|
|
|
|
**The last open question about substrate membership is closed.** Both halves of ADR 0006's test
|
|
now have an answer for every candidate, and the answer for identity is *the control plane does not
|
|
need it*.
|
|
|
|
**It does not settle how a person signs in to a mesh surface**, and that is deliberately left
|
|
open. What is settled is that whatever answers it is not part of what must exist before the mesh
|
|
does — so it can be decided late, changed, or replaced, which is precisely what being substrate
|
|
would have prevented.
|
|
|
|
**It becomes a real test of the module graph.** An identity provider is a module that *other
|
|
modules require* — the object store already consumes it — so it exercises the provider chain more
|
|
seriously than anything ported so far, where the provider was written alongside its consumer.
|
|
|
|
**Ordering follows from it rather than from preference.** Anything requiring identity has to move
|
|
after it, which is a dependency the graph can state rather than something a person has to
|
|
remember.
|
|
|
|
## References
|
|
|
|
- [ADR 0006](0006-the-substrate-and-the-control-plane.md) — the conditional this closes
|
|
- [ADR 0028](0028-the-substrate-supplies-the-control-plane-and-nothing-else.md) — the other member
|
|
removed, and the test applied properly
|
|
- [ADR 0004](0004-a-node-and-how-it-joins.md) — how a node proves itself, which needs none of this
|