mesh-adminandClaude Opus 5.5
71c611b768
The vault was read-only TypeScript and held no secret the mesh uses (hq ADR 0349 §7, §11; ADR 0113 §1, §2, §22). It now keeps each secret in its own store, sealed to its own key and to the operator key, answers the seat's verb get sealed to the asker's key and only to an allowed asker (nobody yet: V4 and P3 bring the rule), raises secret-changed without a value, and takes no private key. The custody ledger and its three tools carry over unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
126 lines
2.4 KiB
JSON
126 lines
2.4 KiB
JSON
{
|
|
"module": "mesh-vault",
|
|
"version": "1",
|
|
"provides": [
|
|
{
|
|
"name": "secret",
|
|
"scope": "mesh",
|
|
"identity": {
|
|
"in": "a vault entry"
|
|
}
|
|
}
|
|
],
|
|
"emits": [
|
|
"provisioned",
|
|
"rotated",
|
|
"deprovisioned",
|
|
"secret-changed"
|
|
],
|
|
"receives": {
|
|
"secret": "${dir:grants}/mesh.json"
|
|
},
|
|
"grants": {
|
|
"secret": "${dir:grants}"
|
|
},
|
|
"keeps": "/var/lib/mesh-vault/root",
|
|
"data": {
|
|
"own": [
|
|
{
|
|
"id": "state",
|
|
"path": "${dir:state}",
|
|
"class": "valuable",
|
|
"why": "the vault's own keys"
|
|
},
|
|
{
|
|
"id": "ledger",
|
|
"path": "${dir:ledger}",
|
|
"class": "valuable",
|
|
"why": "every secret the vault keeps"
|
|
},
|
|
{
|
|
"id": "root",
|
|
"path": "${dir:root}",
|
|
"class": "valuable",
|
|
"why": "the vault's root material"
|
|
},
|
|
{
|
|
"id": "store",
|
|
"path": "${dir:store}",
|
|
"class": "valuable",
|
|
"why": "every secret the vault holds, sealed to its own key and to the operator key"
|
|
}
|
|
],
|
|
"consumers": {
|
|
"secret": {
|
|
"class": "valuable",
|
|
"in": "ledger",
|
|
"why": "a secret given to a consumer is kept nowhere else in the clear"
|
|
}
|
|
}
|
|
},
|
|
"resources": [
|
|
{
|
|
"id": "state",
|
|
"type": "directory",
|
|
"mode": "0700",
|
|
"place": "."
|
|
},
|
|
{
|
|
"id": "grants",
|
|
"type": "directory",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "ledger",
|
|
"type": "directory",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "root",
|
|
"type": "directory",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "store",
|
|
"type": "directory",
|
|
"mode": "0700"
|
|
}
|
|
],
|
|
"build": {
|
|
"artifacts": [
|
|
{
|
|
"name": "code",
|
|
"kind": "bundle",
|
|
"language": "go",
|
|
"system": "arch",
|
|
"from": "cmd/mesh-vault",
|
|
"binary": "mesh-vault",
|
|
"loads": [
|
|
"mesh-vault"
|
|
],
|
|
"env": {
|
|
"MESH_RECEIVES": "${dir:grants}/mesh.json",
|
|
"MESH_VAULT_LEDGER": "${dir:ledger}",
|
|
"MESH_VAULT_ROOT": "${dir:root}",
|
|
"MESH_VAULT_STORE": "${dir:store}",
|
|
"MESH_VAULT_STATE": "${dir:state}"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"tools": [
|
|
"secret_export",
|
|
"secret_holders",
|
|
"secret_verify"
|
|
],
|
|
"claims": [
|
|
{
|
|
"name": "mesh-vault",
|
|
"scope": "mesh",
|
|
"serves": [
|
|
"get"
|
|
]
|
|
}
|
|
]
|
|
}
|