dtoro
18cb79caf9
- seeds/ontology.yaml: 59 entity types (5 abstract, is-a hierarchy), 46 relationship types with cardinality, 6 lifecycles with terminal states and named precondition checks - seeds/inventory.yaml: 110 entities / 142 relationships translated from legacy inventory.yaml (fleet, services, ingress, storage, governance, archaeology); thin spots marked for backfill - seeds/policy.yaml: 4 risk classes, 27 approval rules (hierarchy-aware, per-entity overrides), autonomy kill-switch off (cold start) - api/openapi.yaml: full v1 REST contract (40 paths), RFC 9457 errors, cursor pagination, idempotency, ETag/If-Match, scopes; redocly-clean - docs/adr/0001-0010: initial architecture decision records - scripts/validate-seeds.py: Phase 0 gate — hierarchy, lifecycles, endpoints, cardinality, policy cross-refs (0 errors) - plan: layer CHECK gains 'meta' (root type), cardinality gains 'many-to-one' Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
28 lines
1.2 KiB
Markdown
28 lines
1.2 KiB
Markdown
# ADR 0007 — Threat model and trust zones
|
|
|
|
Status: accepted (2026-07-07) · Plan: rev 3, Security model section
|
|
|
|
## Context
|
|
The control plane can restart services and (eventually) mutate config
|
|
fleet-wide. Compromise of any one container must not equal compromise of
|
|
the fleet.
|
|
|
|
## Decision
|
|
Trust zones as Docker networks: net-front (Caddy→api only), net-data
|
|
(Postgres), net-ops (SSH egress, actuator only). Hermes holds no SSH keys;
|
|
the actuator uses a restricted key (command=/from= in authorized_keys)
|
|
until the /executions gateway fully brokers actions. Caddy is an explicit
|
|
trust root but the API independently validates OIDC JWTs — network origin
|
|
is defense-in-depth, never the auth (this enables the LAN break-glass API
|
|
binding; the Hermes gateway remains mesh-only). Policy changes are
|
|
dual-controlled with before/after hash auditing and a startup
|
|
hash-vs-known-good check. Approval tokens are single-use HMAC, hashed at
|
|
rest, TTL-bound.
|
|
|
|
## Consequences
|
|
- Documented residual risks: plaintext LAN break-glass hop (emergency use),
|
|
Postgres as shared dependency of all roles, macOS host itself unmanaged
|
|
by the OS.
|
|
- Rotation cadences: actuator SSH key 6mo, machine tokens 90d, webhook
|
|
HMAC 1y — scheduler raises expiry signals 2 weeks ahead.
|