From 273b2895a10770cd5d64376a859bc8fc73642143 Mon Sep 17 00:00:00 2001 From: atlas Date: Fri, 18 Sep 2026 15:17:58 +0200 Subject: [PATCH] docs: reword two vale-flagged 'is not' phrasings in credentials.md Microsoft.Contractions wants 'isn't' over 'is not'; reworded the mTLS-leaf-exception sentence to match without changing its meaning. Refs #4137 --- docs/swarm/credentials.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/swarm/credentials.md b/docs/swarm/credentials.md index 7a7dd9cc..1d4b8c9d 100644 --- a/docs/swarm/credentials.md +++ b/docs/swarm/credentials.md @@ -57,8 +57,8 @@ strategy for every credential, including the mTLS leaf. | `swarm/services//oidc/client` | authelia | the service process that presents the client secret, under the certificate of the host it runs on | must be stated | | _(not in the store)_ a hive's mTLS leaf | the store's own PKI, or an operator placing it by hand | its own client, off disk — the exception above, because it's what makes every other row's pull possible | must be stated | -**An agent's mTLS leaf is in the store; a hive's is not, and the difference -is not an inconsistency.** The rule the exception protects is that nothing +**An agent's mTLS leaf is in the store; a hive's isn't, and the difference +isn't an inconsistency.** The rule the exception protects is that nothing can fetch from the store the credential it would need in order to fetch. A hive's leaf is that credential, so it can only come off disk. An agent's is read by the _hive_, which already holds one — so publishing it costs nothing