From 42698f42eec18d24a7378fcbe1ede73add902b71 Mon Sep 17 00:00:00 2001 From: tv Date: Sat, 7 Nov 2026 22:35:21 +0100 Subject: access: values sealed for their readers cs1.: a value encrypted with age to its readers' SSH keys, which no node decrypts. _continuum/access/sealed declares paths whose values must be sealed, for named readers or anyone; nodes check the recipients by age's key tags, at the API and on receipt. Auth plan M8, reworked: sealed values instead of containers, readers as users only (nodes hold no keys). --- docs/api.md | 8 ++++++++ 1 file changed, 8 insertions(+) (limited to 'docs/api.md') diff --git a/docs/api.md b/docs/api.md index 92289bf..7d7a563 100644 --- a/docs/api.md +++ b/docs/api.md @@ -302,6 +302,14 @@ and a read of one names its signer (`x-continuum-signed-by`). `?raw=true` shows they are stored, envelopes, which anyone can check; so do typed JSON and native reads, and streams (`/stream`). +## Sealed values + +A value may be sealed for its readers, encrypted with age to their SSH keys +([`access.md`](access.md), Values sealed for their readers): a string, +`cs1.`, that the API stores and shows as it is. Where the swarm declares +values sealed, a write leaving one there plain, or sealed for others than the declared +readers' keys, is `409`. + ## Protocol data `_continuum` holds what the nodes coordinate through: the swarm ID, the member registry, -- cgit v1.3.1