2026-08-19 15:44:58 +00:00
1 changed files with 2 additions and 1 deletions
@@ -95,7 +95,8 @@ is not how a system finds a credential; the helper resolving the right store is.

 1. Create `~/.mosaic/fleet/agents/<seat>/secrets/` mode 700.
 2. Write `.principal` (the Gitea login) and `.scopes` (the granted scopes), mode 600.
-3. Jason mints the token into the seat slot, mode 600. Agents do not mint their own.
+3. The estate operator mints the token into the seat slot, mode 600. Agents do not mint their
+   own, and do not ask another agent to mint one for them.
 4. Symlink the framework store entry to the seat slot.
 5. Verify with an authenticated `GET /user` and confirm the returned login is the seat, **not the
   minting account**. Record the date in `ENTITY.md`. Never record the value.