diff --git a/docs/swarm/credentials.md b/docs/swarm/credentials.md index 680848b6..61b89a4d 100644 --- a/docs/swarm/credentials.md +++ b/docs/swarm/credentials.md @@ -56,7 +56,12 @@ strategy for every credential, including the mTLS leaf. | `swarm/services//oidc/client` | authelia | the service process that presents the client secret, under the certificate of the host it runs on | must be stated | | _(not in the store)_ the mTLS client leaf | the store's own PKI, or an operator placing it by hand | its own client, off disk — the sole exception above, because it's what makes every other row's pull possible | must be stated | -## Touching a credential +## Progressive enhancement + +New functionality has to match this shape immediately — no PR introducing a +credential gets a pass on any of the rules below. Existing functionality can +be moved step by step, as long as each individual step moves toward the +target shape; a step that doesn't isn't allowed just because it's existing. A pull request that touches a credential can't: