From f2713486a5169834987d3c9e8d1dee2100155b8b Mon Sep 17 00:00:00 2001 From: atlas Date: Wed, 2 Sep 2026 22:33:48 +0200 Subject: [PATCH] docs: the repo map gains the crate this branch adds /knowledge/doc-standards.md lists "file added -> CLAUDE.md ## Repo map" under always-update, and "CLAUDE.md after a file rename" under most-commonly-missed. This branch added a workspace member and I missed it; a scheduled nudge to re-read the hive rules is what caught it, not a gate. The entry leads with the BAO_ vs VAULT_ env mismatch because that is the part a reader cannot derive from the crate name: vaultrs' own defaults look for VAULT_ADDR / VAULT_CLIENT_CERT / VAULT_CLIENT_KEY, no unit in this tree sets those, and falling through to them produces a client with no identity whose only symptom is a TLS handshake failure. Measured while doing it: 6 of 28 workspace members were absent from the map. Five predate this branch (hive-jobq-metrics, swarm-authelia-bridge, swarm-authelia-bridge-sock, swarm-nats-auth, swarm-queue-client) and are deliberately left alone here rather than widening this PR. Refs #3726 --- CLAUDE.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/CLAUDE.md b/CLAUDE.md index 4d6990f9..fb26720c 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -147,6 +147,14 @@ hand-maintained per-file tree drifts out of sync with the code. unix socket the gateway's nginx proxies to — ⚠️ **the socket's directory is its access control**; the constraint that governs it is in the crate's README, and a unit test pins the path. +- **`swarm-secret-client/`** — client for the swarm's secret store, over + `vaultrs`. Owns the *agreements* both ends of the store must share rather + than the HTTP: the path a credential lives at, the field its bytes are in, + and the translation from this deployment's environment into a logged-in + client. ⚠️ Reads the **`BAO_`** env spellings explicitly — `vaultrs`'s own + defaults look for `VAULT_ADDR`/`VAULT_CLIENT_CERT`/`VAULT_CLIENT_KEY`, which + no unit in this tree sets, so falling through to them yields a client with + **no identity** and a TLS handshake failure that names no cause. - **`swarmctl/`** — swarm-level operator CLI, installed by the swarm-controller module on the host that runs the daemon. Runs as **root and acts directly** — no socket, no HTTP route, no priv helper;