Adopt ACL / no-remote-actions when the fleet lands #48

New issue

Open

opened 2026-07-18 10:07:21 +00:00 by p13marc · 1 comment

p13marc commented

2026-07-18 10:07:21 +00:00

(Migrated from github.com)

Part of the keyspace-v2 migration epic. Derived from docs/keyspace-v2-assessment.md §5 / §9; RFC 09 §3. Deferred — adopt when the fleet lands.

A tool that can apply netem to a production host wants per-key no-remote-actions more than a telemetry sensor ever did: "dangerous procedures deniable per-key, because the key IS the target" (09 §3). The console gets put/delete egress only; even a service origin is refused ingress-put so it cannot tombstone any host's keys.

Prerequisite: G6's resource-in-procedure-path keys (@rpc/tc/config/{ns}/{if}/set), delivered in C1 — Zenoh ACL matches keyexpr inclusion and cannot match selector parameters, so "Alice may shape eth1 but not the management NIC" is only expressible when the interface is a key chunk, not a ?if= parameter.

Scope when picked up:

per-host actuation authority (host X may act only as itself),
per-interface deny rules for management NICs,
no-remote-actions on the write procedures.

Defer until the fleet deployment is real.

Refs: RFC 09 §3, assessment §5, §9, G6.

Part of the keyspace-v2 migration epic. Derived from `docs/keyspace-v2-assessment.md` §5 / §9; RFC 09 §3. **Deferred — adopt when the fleet lands.** A tool that can apply `netem` to a production host wants per-key `no-remote-actions` more than a telemetry sensor ever did: *"dangerous procedures deniable per-key, because the key IS the target"* (09 §3). The console gets `put`/`delete` **egress only**; even a service origin is refused ingress-put so it cannot tombstone any host's keys. **Prerequisite:** G6's resource-in-procedure-path keys (`@rpc/tc/config/{ns}/{if}/set`), delivered in C1 — Zenoh ACL matches keyexpr inclusion and cannot match selector parameters, so "Alice may shape eth1 but not the management NIC" is only expressible when the interface is a key chunk, not a `?if=` parameter. Scope when picked up: - per-host actuation authority (host X may act only as itself), - per-interface deny rules for management NICs, - `no-remote-actions` on the write procedures. Defer until the fleet deployment is real. Refs: RFC 09 §3, assessment §5, §9, G6.

p13marc commented

2026-07-18 10:08:13 +00:00

(Migrated from github.com)

Part of #49 (keyspace-v2 migration epic).