feat(identity): fleet-identity crate — RoleTier + HomelabPrincipal + RoleTier→Caveats + dollar-budget#1
Open
hartsock wants to merge 1 commit into
Open
feat(identity): fleet-identity crate — RoleTier + HomelabPrincipal + RoleTier→Caveats + dollar-budget#1hartsock wants to merge 1 commit into
hartsock wants to merge 1 commit into
Conversation
…leTier→Caveats + dollar-budget axis
WHAT: First code for nessie-identity — the shared identity crate (workspace member
crates/nessie-identity). It lifts the published `agent-mesh-protocol` attenuation-
only capability lattice (UserKey/AgentKey/CertChain/Caveats — the SAME types
newt-identity uses; the lattice is not reinvented) and adds the homelab layer:
- RoleTier {Admin, Adult, Kid} (from/to the three AD groups) + HomelabPrincipal
{ad_sid, upn, role, uid, gid}.
- DollarBudget axis (Unlimited | Cents), mirroring CountBound's lattice — the spend
ceiling agent-mesh Caveats does not yet carry.
- RoleCaveats = base Caveats ⊕ DollarBudget, one attenuation-only meet-semilattice
(top/leq/meet reduce to the per-axis ops).
- The RoleTier → RoleCaveats projection: Admin ≈ ⊤; Adult = family + own-home
storage; Kid = its own kid volume ONLY — SEPARATION not subtraction (disjoint
from the family tree), no exec, deny-all net by default, capped calls + small
budget.
- verify::{run_within_role, enforce}: enforce a verified agent-mesh token against a
principal's role, with an honest note that the budget axis is enforced-but-not-
yet-signed (a follow-up in this epic).
Tests: 15 unit + 4 proptests (lattice laws — meet ⊑ both operands; commutativity;
reflexivity; meet never amplifies) + 1 doctest, all green. fmt + clippy -D warnings
clean. Adds rust-toolchain.toml (1.88.0) and ci.yml (fmt/clippy/test, checkout@v5).
WHY: Realizes architecture doc 01 §4/§8 + roadmap P2 — the machine/agent token
plane nothing off-the-shelf provides (the justification for building nessie-identity
at all). First epic of the Nessie Identity build. Privacy-clean: placeholder realm
EXAMPLE.LAN, generic /srv roots — the repo internal-specifics linter and the
pr-pre-review scan both pass.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KTY7YoRQKNyxWCN4VpEPRA
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
First code for
nessie-identity(roadmap P2 / architecture doc 01 §4/§8): theshared identity crate — the machine/agent token plane nothing off-the-shelf
provides. It lifts the published
agent-mesh-protocolattenuation-only lattice(the same
UserKey/AgentKey/CertChain/Caveatsnewt-identityuses — notreinvented) and adds the homelab layer.
What's here
RoleTier {Admin, Adult, Kid}(from/to the three AD groups) +HomelabPrincipal {ad_sid, upn, role, uid, gid}.DollarBudgetaxis (Unlimited | Cents), mirroringCountBound's lattice — the spend ceiling agent-meshCaveatsdoes not yet carry.RoleCaveats= baseCaveats⊕DollarBudget, one attenuation-only meet-semilattice.RoleTier → RoleCaveatsprojection: Admin ≈ ⊤; Adult = family + own-home; Kid = its own volume only.verify::{run_within_role, enforce}— enforce a verified token against a principal's role.Test plan
meet ⊑ both, commutativity, reflexivity, meet never amplifies) + 1 doctest — all green.cargo fmt --check,cargo clippy --all-targets -- -D warningsclean. Addsrust-toolchain.toml(1.88.0) +ci.yml.pr-pre-reviewscan both pass (placeholder realmEXAMPLE.LAN, generic/srvroots).Decisions to review (this is the per-epic review checkpoint)
Kidis deliberately not⊑ Adulton the filesystem axis (both are⊑ Admin = ⊤). Tests assert this directly. ← please confirm this is the intended semantics.Caveatshas no budget field, soenforce()checks the budget at the nessie-identity layer, not cryptographically. The honesty note says so inverify.rs. Binding the budget into the signed envelope is the next PR in this epic (options: extendagent-mesh-protocolCaveatsupstream, or an envelope convention). ← want it signed now, or as the follow-up?DEFAULT_ADULT_BUDGET$50,DEFAULT_KID_BUDGET$2,DEFAULT_KID_MAX_CALLS200; Kidexec/net= deny-all). Tests assert relationships (kid ⊑ adult, kid finite), not the magic numbers.Deferred to later epics (not this PR)
nessie-identitydservice, AD→principal resolution wiring, the budget-signing follow-up, the revocation/generation gate (test-plan review C3).Part of the Nessie Identity build (P2). Paused here for your review per the epic cadence.
🤖 Generated with Claude Code