1.8 KiB
ADR 0016: Owner-Rooted Node Enrollment
Status
Accepted.
Context
Geth needs a practical device-management flow: initialize a mesh with an admin/owner identity, bind local daemon instances to named nodes/devices, list devices by name, grant resource capabilities, and revoke devices. This must not be a mutable device table because the project needs to evolve toward replicated local-first authorization.
Decision
Owner and node management is represented as signed keychain operations. geth init --admin-key <pub> --signing-key <key> --node-name <name> records
KeychainInit, AdminKeyAdd, UserAdd, DeviceAdd, NodeAdd, and
AgentBind operations. When owner setup options are used, both --admin-key
and --signing-key are required. Geth signs canonical keychain payloads with
OpenSSH using the geth.keychain.v1@geth.local namespace.
The active device list is the reduced keychain view, surfaced through geth node list. Renames and revocations are additional keychain operations. Resource
permissions remain resource-scoped auth operations and can be managed with
geth node grant and geth node revoke-grant.
geth keychain sync <node> pulls keychain operations and signatures over Iroh
from an imported peer. The receiver imports only operations with valid OpenSSH
signatures from currently trusted admin keys over the canonical keychain
payload. Discovery and peer cards still grant no trust by themselves.
Consequences
Node names are convenience labels over stable node IDs. Endpoint rotation should add or revoke endpoint bindings without replacing the node identity.
The current sync model is a pull-based signed operation log. It is not yet a Keyhive-style convergent authority, does not implement advanced group cryptography, and does not yet sign/verify replicated auth operations. Those are future roadmap items.