vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

docs/security: use contractions, so vale's Microsoft style is clean

Browse source 
The section this branch adds was the only source of `Microsoft.Contractions`
errors in the file — 9 of them, and vale over the pre-change bytes still
reports exactly those 9, so the count is attributable rather than inferred
from a repo-wide total that was already red.

One of the nine is not a contraction: vale reads `it is` in "Narrowing it is
tracked in ..." as a subject-verb pair, but it is `it` (the object of
narrowing) plus `is tracked`. Rephrased so the sentence leads with the issue
instead, which drops the false hit and the passive-voice warning together.
This commit is contained in:
atlas 2026-09-09 18:16:36 +02:00 • committed by mara
commit bd64a8590d
1 changed files with 7 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

14
docs/trust-boundary/security.md
View file

@ -45,25 +45,25 @@ matrix **identities** — the public handles (`name`, `user_id` `@user:server`,
peers can find and address one another on a shared matrix instance. Only the
public handle crosses that boundary; the token never does.
### The swarm secret store is not a boundary between hives
### The swarm secret store isn't a boundary between hives
A hive reads its agents' credentials out of the swarm's secret store with its
own certificate. **Every hive's policy grants read on every agent's
credentials**, not only on the agents it hosts — so a compromised hive can read
the matrix token of an agent running on a different hive.
That is deliberate and it is the interim state, not the intent. An agent's
credential path does not name the hive hosting it (agents move between hives),
That's deliberate and it's the interim state, not the intent. An agent's
credential path doesn't name the hive hosting it (agents move between hives),
so a per-hive grant has to be an enumeration the controller re-emits whenever
the roster changes — and an enumeration that can drift or land out of order
advertises a boundary it does not actually hold. A wide grant that says what it
advertises a boundary it doesn't actually hold. A wide grant that says what it
is beats a narrow one that only looks narrow.
What still holds: the grant is **read-only** (a hive cannot write an agent's
credential, so it cannot hand itself an agent's identity), and it is scoped to
What still holds: the grant is **read-only** (a hive can't write an agent's
credential, so it can't hand itself an agent's identity), and it's scoped to
the agent-credential prefix — nothing else in the store is reachable with it.
Narrowing it is tracked in **#4137**, with the two candidate directions: scope
**#4137** tracks narrowing it, with the two candidate directions: scope
the grant per hive (and pay for the re-emission), or give each agent container
its own store identity so credentials never pass through a hive at all.