mesh-adminandClaude Opus 5.5
2abe1f95e8
ADR 0349 clauses 8 to 10: a value given at the controller's terminal, typed at a desk or issued by a provider's software enters the vault and opens there alone, and rotation is the vault's. Each comes in two steps from the controller, which reaches the desk and the provider: the vault makes a key for the one call and opens what was sealed to it. An ask is recorded in the vault's store before the prompt opens and bounded to one open per secret and three an hour. Also V1's review follow-ups: the tool layer passes an act through, a rolled record is said, the export's fingerprint and vault_status are tested, and an unproven by is kept beside the proven caller. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
137 lines
2.7 KiB
JSON
137 lines
2.7 KiB
JSON
{
|
|
"module": "mesh-vault",
|
|
"version": "1",
|
|
"provides": [
|
|
{
|
|
"name": "secret",
|
|
"scope": "mesh",
|
|
"identity": {
|
|
"in": "a vault entry"
|
|
}
|
|
}
|
|
],
|
|
"emits": [
|
|
"provisioned",
|
|
"rotated",
|
|
"secret-changed"
|
|
],
|
|
"receives": {
|
|
"secret": "${dir:grants}/mesh.json"
|
|
},
|
|
"grants": {
|
|
"secret": "${dir:grants}"
|
|
},
|
|
"keeps": "/var/lib/mesh-vault/root",
|
|
"data": {
|
|
"own": [
|
|
{
|
|
"id": "state",
|
|
"path": "${dir:state}",
|
|
"class": "valuable",
|
|
"why": "the vault's own keys"
|
|
},
|
|
{
|
|
"id": "ledger",
|
|
"path": "${dir:ledger}",
|
|
"class": "valuable",
|
|
"why": "every secret the vault keeps"
|
|
},
|
|
{
|
|
"id": "root",
|
|
"path": "${dir:root}",
|
|
"class": "valuable",
|
|
"why": "the vault's root material"
|
|
},
|
|
{
|
|
"id": "store",
|
|
"path": "${dir:store}",
|
|
"class": "valuable",
|
|
"why": "every secret the vault holds, sealed to its own key and to the operator key"
|
|
}
|
|
],
|
|
"consumers": {
|
|
"secret": {
|
|
"class": "valuable",
|
|
"in": "ledger",
|
|
"why": "a secret given to a consumer is kept nowhere else in the clear"
|
|
}
|
|
}
|
|
},
|
|
"resources": [
|
|
{
|
|
"id": "state",
|
|
"type": "directory",
|
|
"mode": "0700",
|
|
"place": "."
|
|
},
|
|
{
|
|
"id": "grants",
|
|
"type": "directory",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "ledger",
|
|
"type": "directory",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "root",
|
|
"type": "directory",
|
|
"mode": "0700"
|
|
},
|
|
{
|
|
"id": "store",
|
|
"type": "directory",
|
|
"mode": "0700"
|
|
}
|
|
],
|
|
"build": {
|
|
"artifacts": [
|
|
{
|
|
"name": "code",
|
|
"kind": "bundle",
|
|
"language": "go",
|
|
"system": "arch",
|
|
"from": "cmd/mesh-vault",
|
|
"binary": "mesh-vault",
|
|
"loads": [
|
|
"mesh-vault"
|
|
],
|
|
"env": {
|
|
"MESH_RECEIVES": "${dir:grants}/mesh.json",
|
|
"MESH_VAULT_LEDGER": "${dir:ledger}",
|
|
"MESH_VAULT_ROOT": "${dir:root}",
|
|
"MESH_VAULT_STORE": "${dir:store}",
|
|
"MESH_VAULT_STATE": "${dir:state}"
|
|
}
|
|
}
|
|
]
|
|
},
|
|
"tools": [
|
|
"secret_export",
|
|
"secret_holders",
|
|
"secret_verify",
|
|
"secret_handed",
|
|
"secret_asks",
|
|
"secret_vault_export",
|
|
"provisioner_retirement",
|
|
"provisioner_retire_approve",
|
|
"provisioner_retire_reject",
|
|
"provisioner_delete",
|
|
"vault_status"
|
|
],
|
|
"claims": [
|
|
{
|
|
"name": "mesh-vault",
|
|
"scope": "mesh",
|
|
"serves": [
|
|
"get",
|
|
"accept",
|
|
"secret-ask",
|
|
"issued",
|
|
"rotate"
|
|
]
|
|
}
|
|
]
|
|
}
|