access: what a node holds alone by `_continuum/local/<node ID>/<name>`

Setting a node's log filter took `write` on `_continuum`, all of the protocol data:
whoever could change one node's logging could change the swarm's members, remakes and
users too. Now what a node holds alone has paths of its own for capabilities, under
`_continuum/local/<node ID>/`: `log` (`/admin/log`), `config` (`/admin/config`) and
`debug` (`/debug`, always `write`), `read` to look and `write` to act
(`api::access::needed`, which takes the node's ID). So `_continuum/local/<node ID>` is
everything on one node, `_continuum/local/*/log` the log filter on every node, and
holders of `_continuum` keep it all.

Nothing is stored there: the store refuses writes under `_continuum/local`, and the
rules refuse a change touching it, as for epoch metadata. The quarantine stays with
`_continuum`: its entries are everyone's writes, which a node-local capability
mustn't show.

1 files changed, 4 insertions, 0 deletions

diff --git a/src/document/meta.rs b/src/document/meta.rs
index 691cf40..e040ba0 100644
--- a/src/document/meta.rs
+++ b/src/document/meta.rs
@@ -21,6 +21,9 @@
 //! * `access/userSigned`: the paths whose values their users sign (`access::envelope`).
 //! * `banned/<pk>`: banned nodes (`access::bans`).
 //! * `logouts/<name>`: when a user's tokens were last revoked (`access::registry`).
+//! * `local/<pk>/<name>`: never stored, and never writable: what a node holds alone
+//!   (its log filter, its configuration, its debug endpoints), named for capabilities
+//!   (`api::access::needed`).
 
 /// The key every protocol path starts with.
 pub(crate) const ROOT: &str = "_continuum";
@@ -38,6 +41,7 @@ pub(crate) const USERS: &str = "users";
 pub(crate) const ACCESS: &str = "access";
 pub(crate) const BANNED: &str = "banned";
 pub(crate) const LOGOUTS: &str = "logouts";
+pub(crate) const LOCAL: &str = "local";
 
 /// The store path `_continuum/<parts…>`.
 pub(crate) fn path(parts: &[&str]) -> Vec<String> {