access: values sealed for their readers

cs1.<age file>: a value encrypted with age to its readers' SSH keys,
which no node decrypts. _continuum/access/sealed declares paths whose
values must be sealed, for named readers or anyone; nodes check the
recipients by age's key tags, at the API and on receipt.

Auth plan M8, reworked: sealed values instead of containers, readers
as users only (nodes hold no keys).

1 files changed, 1 insertions, 0 deletions

diff --git a/src/access/mod.rs b/src/access/mod.rs
index 73ae7c9..2a0077e 100644
--- a/src/access/mod.rs
+++ b/src/access/mod.rs
@@ -20,6 +20,7 @@ pub(crate) mod policy;
 pub(crate) mod registry;
 pub(crate) mod rules;
 pub(crate) mod screen;
+pub(crate) mod sealed;
 pub(crate) mod sshsig;
 pub(crate) mod token;