Expand description
Fleet access-control records: people, the external accounts bound to them, role grants, per-channel configuration, one-time link tokens, and the audit trail. See ADR 0022, amended for channel configuration by ADR 0023. One-time link tokens store only a hash of their secret.
These are typed views only. gonzalo stores the records but never evaluates
the roles in them; consumers such as Ariel read them and decide, including
the two-key rule effective = min(person_role, channel_ceiling). A person is
never resolved by email or handle, so nothing here offers that lookup.
Structs§
- Audit
Entry - Who did what, to what, when, and with what result.
- Channel
Config - Per-chat-channel configuration, keyed by provider, tenant and channel (ariel ADR 0009; gonzalo ADR 0023). It belongs to no person: who changed it is recorded in the audit trail and in gonzalo’s author stamp.
- Consumption
- Who redeemed a token, into which binding, and when.
- Empty
Follow Set Follows::Workspaceswas given no workspace names.- Identity
Binding - Ties one external account to a person.
- Link
Secret - The secret half of a link token: 32 random bytes the caller generates.
- Link
Secret Error - A link secret that isn’t 64 lowercase hex characters.
- Link
Token - A one-time, expiring token that lets a person claim an account.
- Person
- A human with fleet roles, keyed by an opaque person id the minting consumer generates.
- Role
Grant - A person’s role for one scope. One record per
(person, scope); revoking is a delete. - Verified
Email - An email address as asserted by an authenticator.
Enums§
- Audit
Result - The outcome an audit entry records.
- Authenticator
- The system that authenticated an external account.
- Binding
Origin - How an account came to be bound to a person.
- Fleet
Actor - Who did something: a person, an account not yet linked to one, or a service.
- Fleet
KeyError - Why a fleet record key could not be built.
- Fleet
Role - A fleet role, ordered
Viewer < Operator < Admin. Defaults toViewer, the least privileged, so an omitted ceiling grants nothing extra (ADR 0023). - Follows
- Which workspaces a channel follows (ariel ADR 0009; gonzalo ADR 0023).
- Grant
Scope - Where a role grant or link token applies.
- Notify
Preset - How much a channel hears. A preset only narrows the consumer’s default pacing; it can never add event kinds (ariel ADR 0007/0009).
- Redeem
Error - Why a link token could not be redeemed.
Constants§
- AUDIT_
ENTRIES_ COLLECTION - CHANNELS_
COLLECTION - FLEET_
AUDIT_ NAMESPACE - Namespace for audit entries, kept apart so daemon auth (ADR 0015) can scope audit access separately.
- FLEET_
NAMESPACE - Namespace for people, bindings, grants, channel configs and link tokens.
- IDENTITY_
BINDINGS_ COLLECTION - LINK_
TOKENS_ COLLECTION - PEOPLE_
COLLECTION - ROLE_
GRANTS_ COLLECTION