@smartmemory/stratum 0.3.3 → 0.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli/guard.js +63 -6
- package/dist/cli/guard.js.map +1 -1
- package/dist/cli/learn.js +226 -0
- package/dist/cli/learn.js.map +1 -0
- package/dist/cli/query_gate.js +2 -1
- package/dist/cli/query_gate.js.map +1 -1
- package/dist/cli/stratum.js +5 -2
- package/dist/cli/stratum.js.map +1 -1
- package/dist/connectors/background.js +58 -10
- package/dist/connectors/background.js.map +1 -1
- package/dist/connectors/base.js +16 -0
- package/dist/connectors/base.js.map +1 -1
- package/dist/connectors/cancellation.js +119 -0
- package/dist/connectors/cancellation.js.map +1 -0
- package/dist/connectors/claude-bg-worker.js +9 -1
- package/dist/connectors/claude-bg-worker.js.map +1 -1
- package/dist/connectors/claude.js +179 -86
- package/dist/connectors/claude.js.map +1 -1
- package/dist/connectors/codex.js +289 -61
- package/dist/connectors/codex.js.map +1 -1
- package/dist/connectors/runner.js +44 -3
- package/dist/connectors/runner.js.map +1 -1
- package/dist/contracts/events.json +34 -1
- package/dist/contracts/guard-signers.allowed +36 -0
- package/dist/contracts/mcp-surface.json +1097 -104
- package/dist/engine/checkpoint.js +8 -1
- package/dist/engine/checkpoint.js.map +1 -1
- package/dist/engine/engine.js +508 -42
- package/dist/engine/engine.js.map +1 -1
- package/dist/engine/evaluate.js +61 -0
- package/dist/engine/evaluate.js.map +1 -0
- package/dist/engine/ledger.js +12 -0
- package/dist/engine/ledger.js.map +1 -1
- package/dist/engine/receipts.js +91 -0
- package/dist/engine/receipts.js.map +1 -0
- package/dist/engine/state.js +51 -1
- package/dist/engine/state.js.map +1 -1
- package/dist/guard/authorization.js +71 -0
- package/dist/guard/authorization.js.map +1 -0
- package/dist/guard/descriptors.js +248 -0
- package/dist/guard/descriptors.js.map +1 -0
- package/dist/guard/errors.js +12 -0
- package/dist/guard/errors.js.map +1 -1
- package/dist/guard/evidence.js +24 -3
- package/dist/guard/evidence.js.map +1 -1
- package/dist/guard/sshsig.js +264 -0
- package/dist/guard/sshsig.js.map +1 -0
- package/dist/guard/store.js +13 -0
- package/dist/guard/store.js.map +1 -1
- package/dist/guard/transition.js +484 -33
- package/dist/guard/transition.js.map +1 -1
- package/dist/guard/trust.js +78 -0
- package/dist/guard/trust.js.map +1 -0
- package/dist/ir/schema.js +8 -1
- package/dist/ir/schema.js.map +1 -1
- package/dist/ir/validate.js +3 -1
- package/dist/ir/validate.js.map +1 -1
- package/dist/judge/judged.js +1 -1
- package/dist/judge/pricing.js +1 -0
- package/dist/judge/pricing.js.map +1 -1
- package/dist/learn/apply.js +600 -0
- package/dist/learn/apply.js.map +1 -0
- package/dist/learn/candidate.js +186 -0
- package/dist/learn/candidate.js.map +1 -0
- package/dist/learn/classify.js +181 -0
- package/dist/learn/classify.js.map +1 -0
- package/dist/learn/harvest.js +138 -0
- package/dist/learn/harvest.js.map +1 -0
- package/dist/learn/smartmemory_egress.js +330 -0
- package/dist/learn/smartmemory_egress.js.map +1 -0
- package/dist/mcp/server.js +155 -24
- package/dist/mcp/server.js.map +1 -1
- package/dist/policy/bundle.js +195 -0
- package/dist/policy/bundle.js.map +1 -0
- package/dist/policy/events.js +51 -0
- package/dist/policy/events.js.map +1 -0
- package/dist/policy/smartmemory_client.js +332 -0
- package/dist/policy/smartmemory_client.js.map +1 -0
- package/dist/policy/types.js +2 -0
- package/dist/policy/types.js.map +1 -0
- package/package.json +3 -2
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../src/connectors/runner.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAsB,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,cAAc,EAAqB,MAAM,YAAY,CAAC;AAE/D,sFAAsF;AACtF,uFAAuF;AACvF,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAC1D,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAS,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../src/connectors/runner.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAsB,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,cAAc,EAAqB,MAAM,YAAY,CAAC;AAE/D,sFAAsF;AACtF,uFAAuF;AACvF,MAAM,YAAY,GAAG,IAAI,GAAG,CAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAC1D,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAS,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC;AA6B9E,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,OAAwB,EACxB,aAAiC,EAAE;IAEnC,mFAAmF;IACnF,oFAAoF;IACpF,mEAAmE;IACnE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,iBAAiB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAC9E,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,KAAK,CACb,uBAAuB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,4CAA4C,CACvG,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,8EAA8E;IAC9E,sEAAsE;IACtE,gEAAgE;IAChE,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,mFAAmF;YACnF,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;IACjC,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,gFAAgF;QAChF,6EAA6E;QAC7E,8EAA8E;QAC9E,wEAAwE;QACxE,8EAA8E;QAC9E,kDAAkD;QAClD,OAAO,kBAAkB,CAAC;YACxB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG;YACH,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,UAAU,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChG,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvG,6EAA6E;YAC7E,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnH,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjF,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QAC9B,OAAO,IAAI,cAAc,CAAC;YACxB,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9F,GAAG;YACH,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,UAAU,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,eAAe,CAAC;QACzB,GAAG;QACH,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9F,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,UAAU,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AACzB,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,qBAAqB,CAAC,OAA8G;IAClJ,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YAClH,MAAM,IAAI,KAAK,CAAC,yFAAyF,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5G,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACxG,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC;YACrE,IAAI,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM;mBACzF,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;mBACpH,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9G,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
{
|
|
2
|
-
"events":
|
|
2
|
+
"events": 2,
|
|
3
3
|
"shapeLanguage": "Each kind maps to the full event payload shape minus the implicit {at: string, type: string}. Leaf types: number|string|boolean|object|array|null|any, unions with '|', optional keys end in '?', nested objects are declared inline. Undeclared keys are contract violations.",
|
|
4
4
|
"kinds": {
|
|
5
5
|
"planned": {},
|
|
@@ -60,6 +60,39 @@
|
|
|
60
60
|
"fanout_merge": {
|
|
61
61
|
"stepId": "string",
|
|
62
62
|
"detail": { "itemIndex": "number", "success": "boolean", "reason?": "string" }
|
|
63
|
+
},
|
|
64
|
+
"usage_debit": {
|
|
65
|
+
"stepId?": "string",
|
|
66
|
+
"detail": {
|
|
67
|
+
"seq": "number",
|
|
68
|
+
"dispatchId": "string",
|
|
69
|
+
"source": "string",
|
|
70
|
+
"amount": "object",
|
|
71
|
+
"model": "string",
|
|
72
|
+
"effort?": "string",
|
|
73
|
+
"durationMs": "number",
|
|
74
|
+
"epoch?": "number",
|
|
75
|
+
"attempt?": "number",
|
|
76
|
+
"item?": { "itemIndex": "number", "stage": "number", "generation": "number" },
|
|
77
|
+
"split?": { "input": "number", "output": "number", "cacheRead?": "number", "cacheCreation?": "number" },
|
|
78
|
+
"usdSource?": "string",
|
|
79
|
+
"reportedAt?": "string"
|
|
80
|
+
}
|
|
81
|
+
},
|
|
82
|
+
"step_reset": {
|
|
83
|
+
"stepId": "string",
|
|
84
|
+
"detail": {
|
|
85
|
+
"reason": "string",
|
|
86
|
+
"reset": { "$array": { "stepId": "string", "fromEpoch": "number", "toEpoch": "number" } },
|
|
87
|
+
"subflowsDropped": { "$array": "string" }
|
|
88
|
+
}
|
|
89
|
+
},
|
|
90
|
+
"checkpoint_reverted": {
|
|
91
|
+
"detail": {
|
|
92
|
+
"label": "string",
|
|
93
|
+
"receiptsAtRevert": "number",
|
|
94
|
+
"stepsRestored": { "$array": "string" }
|
|
95
|
+
}
|
|
63
96
|
}
|
|
64
97
|
}
|
|
65
98
|
}
|
|
@@ -0,0 +1,36 @@
|
|
|
1
|
+
# Guard authorization trust root.
|
|
2
|
+
#
|
|
3
|
+
# Public keys permitted to sign guard authorization artifacts (upgrade
|
|
4
|
+
# descriptors, and any future signed authorization). OpenSSH `allowed_signers`
|
|
5
|
+
# format, restricted to a strict subset:
|
|
6
|
+
#
|
|
7
|
+
# <principal[,principal...]> ssh-ed25519 <base64> [comment]
|
|
8
|
+
#
|
|
9
|
+
# Option lists (cert-authority, namespaces=, valid-before=) are REFUSED, not
|
|
10
|
+
# ignored — a restriction written here must never be silently dropped.
|
|
11
|
+
#
|
|
12
|
+
# THIS FILE IS THE TRUST ROOT. It is read from the installed source tree, never
|
|
13
|
+
# from an environment variable, so changing who may authorize a guard policy
|
|
14
|
+
# change requires editing a committed file. That is deliberate: an environment
|
|
15
|
+
# variable can be set silently by whatever process happens to be running, while
|
|
16
|
+
# a change here shows up in `git status` and in review.
|
|
17
|
+
#
|
|
18
|
+
# Empty by default. There is no default trust: until a key is added, the signed
|
|
19
|
+
# authorization paths report themselves unavailable rather than falling back to
|
|
20
|
+
# something weaker.
|
|
21
|
+
#
|
|
22
|
+
# To enrol a signer:
|
|
23
|
+
# 1. On the operator's machine, create a signing key whose passphrase exists
|
|
24
|
+
# only in the operator's head, and never add it to ssh-agent (an agent that
|
|
25
|
+
# can reach the agent socket can use the key without knowing the passphrase):
|
|
26
|
+
# ssh-keygen -t ed25519 -f ~/.stratum/guard-signing -C "<who>"
|
|
27
|
+
# 2. Append the PUBLIC half here with a principal name:
|
|
28
|
+
# echo "<who> $(cat ~/.stratum/guard-signing.pub)" >> ts/contracts/guard-signers.allowed
|
|
29
|
+
# 3. Commit it. The private half never leaves the operator's machine and is
|
|
30
|
+
# useless to anything that does not know the passphrase.
|
|
31
|
+
#
|
|
32
|
+
# To sign a descriptor file:
|
|
33
|
+
# ssh-keygen -Y sign -f ~/.stratum/guard-signing \
|
|
34
|
+
# -n stratum-guard-descriptors /path/to/guard-upgrades.json
|
|
35
|
+
# (writes /path/to/guard-upgrades.json.sig; you will be prompted for the
|
|
36
|
+
# passphrase, which is the point)
|