From bd64a8590d6668ac4bbce548017ec7226b586245 Mon Sep 17 00:00:00 2001 From: atlas Date: Wed, 9 Sep 2026 18:16:36 +0200 Subject: [PATCH] docs/security: use contractions, so vale's Microsoft style is clean MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The section this branch adds was the only source of `Microsoft.Contractions` errors in the file — 9 of them, and vale over the pre-change bytes still reports exactly those 9, so the count is attributable rather than inferred from a repo-wide total that was already red. One of the nine is not a contraction: vale reads `it is` in "Narrowing it is tracked in ..." as a subject-verb pair, but it is `it` (the object of narrowing) plus `is tracked`. Rephrased so the sentence leads with the issue instead, which drops the false hit and the passive-voice warning together. --- docs/trust-boundary/security.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/trust-boundary/security.md b/docs/trust-boundary/security.md index 790aadd6..ef6c7a75 100644 --- a/docs/trust-boundary/security.md +++ b/docs/trust-boundary/security.md @@ -45,25 +45,25 @@ matrix **identities** — the public handles (`name`, `user_id` `@user:server`, peers can find and address one another on a shared matrix instance. Only the public handle crosses that boundary; the token never does. -### The swarm secret store is not a boundary between hives +### The swarm secret store isn't a boundary between hives A hive reads its agents' credentials out of the swarm's secret store with its own certificate. **Every hive's policy grants read on every agent's credentials**, not only on the agents it hosts — so a compromised hive can read the matrix token of an agent running on a different hive. -That is deliberate and it is the interim state, not the intent. An agent's -credential path does not name the hive hosting it (agents move between hives), +That's deliberate and it's the interim state, not the intent. An agent's +credential path doesn't name the hive hosting it (agents move between hives), so a per-hive grant has to be an enumeration the controller re-emits whenever the roster changes — and an enumeration that can drift or land out of order -advertises a boundary it does not actually hold. A wide grant that says what it +advertises a boundary it doesn't actually hold. A wide grant that says what it is beats a narrow one that only looks narrow. -What still holds: the grant is **read-only** (a hive cannot write an agent's -credential, so it cannot hand itself an agent's identity), and it is scoped to +What still holds: the grant is **read-only** (a hive can't write an agent's +credential, so it can't hand itself an agent's identity), and it's scoped to the agent-credential prefix — nothing else in the store is reachable with it. -Narrowing it is tracked in **#4137**, with the two candidate directions: scope +**#4137** tracks narrowing it, with the two candidate directions: scope the grant per hive (and pay for the re-emission), or give each agent container its own store identity so credentials never pass through a hive at all.