eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

specify selective disclosure and anchor policy
Some checks failed
CI / fmt, clippy, docs (push) Failing after 5s
Details
CI / test (ubuntu-latest) (push) Failing after 5s
Details
CI / iroh integration smoke tests (push) Failing after 5s
Details
CodeQL / Analyze Rust (push) Failing after 4s
Details
Security / RustSec cargo-audit (push) Failing after 5s
Details
CI / test (macos-latest) (push) Has been cancelled
Details
CI / test (windows-latest) (push) Has been cancelled
Details

Browse source
This commit is contained in:
Eric Wendland 2026-07-18 22:05:57 +02:00
commit 76eb785ee2
11 changed files with 834 additions and 387 deletions
Download patch file Download diff file Expand all files Collapse all files

21
docs/architecture.md
View file

@ -478,14 +478,19 @@ trust state; idempotent repeats leave the original bytes unchanged.
The portable signed-chain design is specified in
[`sshsigchain.md`](sshsigchain.md). Its reusable core has an explicit
out-of-band `(chain ID, profile, SSHSIG namespace, root public key)` trust
tuple, a strict sequence plus hash link, bounded fields, and a profile reducer
that authorizes each record from only the causally preceding state. Geth's
`geth.keychain.sshsigchain.v1` profile rejects timestamp validity windows as authorization
policy and treats key revocation as a causal record. The prior test-only static
workflow was removed rather than migrated. Iroh keychain sync remains the
current replicated local operation-log path while explicit SSHSIGCHAIN
production and import workflows are completed.
out-of-band `(chain ID, SSHSIG namespace, root public key)` trust tuple. Exact
parent hashes define causal order without a sequence counter. A mandatory,
public authority reducer owns devices, keys, proof-of-possession, revocation,
permission ceilings, delegation, and anchor policy; application profiles can
only attach salted payload commitments and cannot mutate trust. Disclosures do
not change link identity, and missing disclosures leave profile state
explicitly incomplete. Signed head claims, backend-neutral receipts, cached-head
rollback checks, and incomparable-history detection define the anchoring
boundary. Concrete Nostr, HTTP, blockchain, and transparency adapters stay
outside `geth-keychain` and do not select canonical history. The prior
test-only static workflow was removed rather than migrated. Iroh keychain sync
remains the current replicated local operation-log path while explicit
SSHSIGCHAIN production and import workflows are completed.
New devices can use the node enrollment flow instead of hand-editing keychain
state. `geth node enroll join` explicitly imports an owner admin public key as