From 8523e9c67e375747147a0b05ec191ad81ce2e318 Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Sat, 7 Nov 2026 22:35:21 +0100
Subject: signatures: changes signed by their node

Every node signs the changes it commits with its node key, an Ed25519
signature over the change's hash, kept beside the document. One
signature on an actor's latest change vouches for its earlier ones.
Protocol data and paths listed in _continuum/access/signed are signed,
and writes with ?signed=true.

Auth plan M5.
---
 docs/openapi.yaml | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

(limited to 'docs/openapi.yaml')

diff --git a/docs/openapi.yaml b/docs/openapi.yaml
index ffd22dd..2e131fb 100644
--- a/docs/openapi.yaml
+++ b/docs/openapi.yaml
@@ -153,6 +153,7 @@ paths:
           schema:
             type: boolean
             default: true
+        - $ref: '#/components/parameters/signed'
       requestBody:
         required: true
         content:
@@ -230,6 +231,7 @@ paths:
             type: string
             enum: [rfc3339, unix, unix-ms, http-date]
             default: rfc3339
+        - $ref: '#/components/parameters/signed'
       requestBody:
         required: false
         content:
@@ -290,6 +292,7 @@ paths:
           schema:
             type: boolean
             default: false
+        - $ref: '#/components/parameters/signed'
       responses:
         '204':
           description: Deleted.
@@ -1598,6 +1601,17 @@ components:
       description: A token from `POST /auth/login` on any node of the swarm (docs/access.md, Tokens).
 
   parameters:
+    signed:
+      name: signed
+      in: query
+      description: |
+        Whether this node signs the change with its node key, whatever its path. A
+        change is signed anyway where it touches protocol data (`_continuum`) or a path
+        listed in `_continuum/access/signed`; one left unsigned is vouched for by this
+        node's next signed change (`api.md`, Signed changes).
+      schema:
+        type: boolean
+        default: false
     key:
       name: key
       in: path
-- 
cgit v1.3.1