Topology credential boundary

The topology authority queues credential issue and revocation, but it never exposes a generic root API. Each eligible host runs two independent programs:

• little-compute-credential-worker is a capability-free, non-root database worker. Its PostgreSQL login maps to exactly one inventory recordId and credentialBrokerId through session_user. It can call the worker RPCs but has no table or sequence privilege.
• little-compute-credential-dispatcher is a root, socket-activated, one-connection process. It has no database client or secret. It authenticates the worker with Linux SO_PEERCRED, rechecks local identity, and invokes only digest-pinned assets through inherited file descriptors.

The bridge is a protected AF_UNIX socket carrying bounded canonical JSON. A wrong peer, route, machine, physical host, stable Podman configuration, or package identity fails before mutation.

Install

Apply topology-authority migration 3, create one NOINHERIT NOBYPASSRLS login per host, grant only schema/type usage and the six credential_worker_* functions, then map the login in little_compute_topology_authority.credential_worker_principals. Never reuse an API or migration login and never grant host workers direct table access.

Install these shipped assets:

• the worker and dispatcher CLIs;
• credential_broker_v1.py, observe-podman-service-v1.py, and credential_dispatcher_peer_v1.py;
• the worker service, dispatcher socket/template service, and tmpfiles examples;
• credential-worker.env.example with the public host route; and
• a root-owned mode-0400 worker database URL loaded with LoadCredential=.

Run the tmpfiles entry before starting the socket. It creates the socket parent as root:little-compute-credential-worker mode 0750; setting only SocketGroup= is not enough to make an automatically created parent directory traversable.

The database transport is either a protected Unix socket beneath /run or TLS 1.3 with sslmode=verify-full, an exact DNS sslservername, and an explicit root-owned CA. Routing/startup and alternate-credential parameters such as hostaddr, options, sslcert, and sslkey are rejected.

With the host Podman service active, pin the local boundary:

little-compute-credential-dispatcher provision \
  --credential-broker-id broker-host-a \
  --node-record-id host-a \
  --physical-host-digest sha256:REPLACE \
  --worker-uid "$(id -u little-compute-credential-worker)" \
  --worker-gid "$(getent group little-compute-credential-worker | cut -d: -f3)" \
  --observer-uid "$(id -u little-compute-observer)"

Provisioning records the machine ID, credential-independent service configuration digest, and exact Node/Python/helper/broker/observer/systemctl content. Immutable package hard links are allowed, while root ownership, protected ancestors, non-writable mode, opened-inode identity, and SHA-256 pins remain mandatory.

Verify all units with systemd-analyze verify and inspect both services with systemd-analyze security. Enable the dispatcher socket before the worker. The worker has an empty capability set; the short-lived dispatcher retains only CAP_SYS_PTRACE, a private network, and no PostgreSQL credential. Both units have finite memory, process, and file-descriptor ceilings with kill-on-OOM; each dispatcher connection also has a three-minute runtime limit.

Fencing and recovery

Revocation is claimed before issuance. Worker RPCs use database time, SKIP LOCKED, a random token digest, renewable lease, and monotonic fence. The database derives routing from the authenticated login, so a caller cannot select another host. A cross-host renew, completion, failure, or metric request is denied.

The root dispatcher revalidates its peer, local configuration, and every opened path immediately before mutation. After issue it proves the live Podman socket/process instance, run, generation, source, expiry, receipt, and public keys. Host operations are byte-exact on retry, so a crash after host commit but before PostgreSQL commit is recoverable without weakening the fence.

Monitor the authority's broker-work metrics. Treat dead letters, overdue revocations, and repeated dispatcher failures as alerts. Fix the cause and retry the exact work ID; never edit queue rows, leases, identity files, or host broker state manually.

The complete role/grant SQL and transport examples are in qualification/topology-authority/credential-worker.md in the source tree.