ADR 0006 — System access is a token handed to a module at wiring time

ADR 0006 — System access is a token handed to a module at wiring time An architecture diagram generated by Archify. System access is a token handed at wiring · api.SystemToken() in Routes · minted only under kit/ · Architecture component System access is a token handed at wiring api.SystemToken() in Routes · minted only under kit/ tenancy.SystemToken · syscap.NewSystemToken · a closed interface · nil is the only forgery · the mechanism tenancy.SystemToken · syscap.NewSystemToken a closed interface · nil is the only forgery (*API).SystemToken() in Module.Routes · handed where the manifest is read · no other door · the mechanism (*API).SystemToken() in Module.Routes handed where the manifest is read · no other door db.RunSystem · db.Detached · never widens a tenant tx · Detached opens a second · the mechanism db.RunSystem · db.Detached never widens a tenant tx · Detached opens a second grep -rn 'SystemToken()' modules/ · a grep and a review, not a privilege · kept true by grep -rn 'SystemToken()' modules/ a grep and a review, not a privilege Rejected: exported mint, Deps field, route kind · free to mint · nothing to mint with · evades the gate · Architecture component Rejected: exported mint, Deps field, route kind free to mint · nothing to mint with · evades the gate modules/tenant control-plane routes · OperatorPermission · a system tx per handler · Architecture component modules/tenant control-plane routes OperatorPermission · a system tx per handler kit/app.Bootstrap · the first write, with no tenant to do it in · Architecture component kit/app.Bootstrap the first write, with no tenant to do it in is handed by spent in checked by instead of mints bootstrapToken on db.Detached the mechanism kept true by Legend Backend Security External

Context

  • • Before E3 only kernel code opened a system transaction: host resolution, the outbox relay, the job that walks the tenants
  • • A tenant is a row that belongs to no tenant, so a module needed the capability, and the question was which door it comes through

Consequences

  • • The modules that cross tenants are one grep; a handler holds no ambient authority; a control-plane write commits on its own
  • • Hand-written routes, not a rest.Spec; the token is not the authorization — httpx.OperatorPermission is, refused before any roles table

Evidence

  • • grep -rn 'SystemToken()' modules/ apps/, and go test ./modules/tenant/... -run TestATenantTransactionSeesOnlyItsOwnRow
  • • go test ./modules/auth/... -run TestASessionFromAnotherTenantIsNotASessionHere; not claimed: that a module cannot reach the token after Routes