mosaicstack/stack
25
0
Fork 1
Code Issues 344 Pull Requests 13 Actions Packages Projects Releases 15 Wiki Activity

guides: add SEAT-IDENTITY and FLEET-COMMS; harden CODE-REVIEW evidence rules #1313

Merged
jason.woltje merged 5 commits from fred/guides-seat-identity-fleet-comms into next 2026-08-19 15:44:58 +00:00
Conversation 3 Commits 5 Files Changed 5
+2 -1
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit a3c50d91ca - Show all commits
packages/mosaic/framework/guides/SEAT-IDENTITY.md
+2 -1
View File
@@ -95,7 +95,8 @@ is not how a system finds a credential; the helper resolving the right store is.
1. Create `~/.mosaic/fleet/agents/<seat>/secrets/` mode 700. 1. Create `~/.mosaic/fleet/agents/<seat>/secrets/` mode 700.
2. Write `.principal` (the Gitea login) and `.scopes` (the granted scopes), mode 600. 2. Write `.principal` (the Gitea login) and `.scopes` (the granted scopes), mode 600.
3. Jason mints the token into the seat slot, mode 600. Agents do not mint their own. 3. The estate operator mints the token into the seat slot, mode 600. Agents do not mint their
own, and do not ask another agent to mint one for them.
4. Symlink the framework store entry to the seat slot. 4. Symlink the framework store entry to the seat slot.
5. Verify with an authenticated `GET /user` and confirm the returned login is the seat, **not the 5. Verify with an authenticated `GET /user` and confirm the returned login is the seat, **not the
minting account**. Record the date in `ENTITY.md`. Never record the value. minting account**. Record the date in `ENTITY.md`. Never record the value.