atlas
87174863ca
swarm-bao: grant the controller read on the agent credential prefix ...
mint_and_verify reads the queue credential back before writing it, so a
re-run keeps the value a live agent already authenticates with. that read
is read_optional, which maps only a 404 to absence — so with create/update
alone every mint aborted on a 403 at its first store read.
read on the same paths the stanza already grants create and update, and
nothing else: no list, no delete, no patch.
2026-09-23 18:55:02 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
module-eval: assert the severity table once, not once per tier
2026-09-20 14:23:56 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
agent: fetch this agent's own swarm-queue credential from the store
2026-09-21 20:44:52 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
swarm-bao: grant the controller read on the agent credential prefix
2026-09-23 18:55:02 +02:00
module-eval: name the grafana helper the refusal readers are shaped after
2026-09-23 10:11:42 +02:00
nix: the store's own collector scrapes its metrics listener
2026-09-21 17:19:52 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
swarm-bao: give each hive-cert consumer its own bao identity
2026-09-23 10:11:42 +02:00
swarm-bao: give the store's collector an explicit self-telemetry port
2026-09-23 18:04:33 +02:00
module-eval: assert the severity table once, not once per tier
2026-09-20 14:23:56 +02:00
module-eval: assert the severity table once, not once per tier
2026-09-20 14:23:56 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
swarm-bao: give each hive-cert consumer its own bao identity
2026-09-23 10:11:42 +02:00
nix: address the swarm IdP by its domain, not by who runs it
2026-09-21 18:14:28 +02:00
nix: the store's own collector scrapes its metrics listener
2026-09-21 17:19:52 +02:00
swarm-bao: give each hive-cert consumer its own bao identity
2026-09-23 10:11:42 +02:00
swarm-bao: refuse a remote reader that named seven of the eight leaves
2026-09-23 10:11:42 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
87174863ca