Skip to content
Wayglass

Trust boundaries

There are three places, and credentials are kept as far apart as they can be. Only the Worker holds Cloudflare credentials. Your machine holds a Wayglass key, and for a few minutes at a time a token for one Artifacts repo.

Trust boundaries between your machine, the Worker and ArtifactsYour machineWorker (Cloudflare)Artifacts (Cloudflare)HTTPShashbindingfork, mintgit pushwayglass CLIor another clientWayglass keyagent key or admin keyRepo tokenone repo, minutes, env onlyWorkerchecks every requestRegistry DOkey hashes onlyCloudflare credsbindings andWorker secretsTrunk repowrite: 300 s, only to landIntent forkwrite: 900 s fork token
Works liveBuilt, not verified liveStubbedPlannedSelect a box to see its status.

Where credentials live

Section titled “Where credentials live”
Credential Lives Scope Lifetime
Cloudflare access Only the Worker: Artifacts through Workers bindings, plus Worker secrets (the admin key, the account id, and an optional Queues-only API token for event subscriptions) The Worker’s own account Until rotated
Admin key Worker secret; the copy on the operator’s machine in ~/.config/wayglass/credentials.yaml Everything, including minting agent keys; its caller names itself Until rotated
Agent key (wgk_...) The agent’s machine; the Worker keeps only a SHA-256 in the Registry Durable Object Every project on that Worker, always acting as the one name it is bound to Until revoked
Fork token Git environment variables of the agent that declared the intent Write, one fork 900 s; replaced and revoked on each push
Land token Git environment variables during wayglass land Write, the trunk 300 s; revoked once the land is verified or aborted
Trunk read token Git environment variables during wayglass doctor Read, the trunk 60 s

What crosses each boundary

Section titled “What crosses each boundary”
  • Your machine to the Worker: HTTPS requests carrying a Wayglass key. The Worker answers with data, and when a repo operation needs it, a token for exactly one repo. It never sends a Cloudflare API token.
  • Your machine to Artifacts: git over HTTPS with a repo token in an http.extraHeader, set through GIT_CONFIG_COUNT/GIT_CONFIG_KEY_n/GIT_CONFIG_VALUE_n so it is not in the URL, in argv or in .git/config. A fork token is refused by the trunk.
  • Worker to Artifacts: Workers binding calls (create, fork, mint and revoke tokens, read commits, trees and blobs). The Worker reads the diff itself; it does not trust a diff, tags or a commit hash from a client.
  • Artifacts to the Worker: push events through the artifacts-events queue.

Limits

Section titled “Limits”

These hold today and are listed in the security model:

  • The admin key names itself, so whoever holds it can act under any agent name. Agent keys are not scoped to one project and have no short-lived exchange yet.
  • Artifacts has no branch protection. The Worker detects a trunk push that was not an approved land after the fact; it cannot stop one.