Expand description
Persistent operator secret store for per-Seed tokens.
One file per Seed under a private directory (0700), each file 0600,
written atomically (temp file, fsync, rename). Tokens survive daemon
restarts and never expire on their own; a new pairing replaces them.
Reads refuse a symlink, a non-regular file or a file other users can
read, so a token planted or exposed by someone else is not used.
The operator default is <runtime dir>/secrets/workload.seed/, where the
runtime dir is $WEFTOS_RUNTIME_DIR or ~/.clawft (the same root the
chain uses), so probe and test daemons never read the operator’s tokens.
Structs§
- File
Credentials - File-backed
SeedCredentials.
Constants§
- SEED_
SECRETS_ SUBDIR - Sub-path of the runtime dir that holds Seed tokens.