2fbf31b2

Fix delegate docs: access.conf still gates the collab-refs clip

a73x 2026-08-18 17:49

Commit message

Fix delegate docs: access.conf still gates the collab-refs clip

The Delegates subsection claimed access.conf is never consulted for
delegates; it is — the exec-level check (session.rs:796-805) and the
update hook (hook.rs:154-169) both evaluate access.conf against the
person's name, so a delegate's rights are the intersection of the
person's grants and the refs/collab/* ceiling, not the ceiling alone.
Also demote the lone h4 in the file to the README's established
bold-lead-in convention for Governance sub-topics, matching "How this
interacts with server.toml."

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

README.md

Old		New
@@ -454,10 +454,9 @@ A principal's name is the basename of its key file, directories ignored —
454	`laptop/alex.pub` and `desktop/alex.pub` are both `alex`, which is how one person	454	`laptop/alex.pub` and `desktop/alex.pub` are both `alex`, which is how one person
455	adds a second machine.	455	adds a second machine.
456		456
457	#### Delegates	457	Delegates. A key in `keydir/` is a person. A certificate is a
458		458	delegate of the person it names, and may write `refs/collab/*` and
459	A key in `keydir/` is a person. A certificate is a delegate of the person	459	nothing else.
460	it names, and may write `refs/collab/*` and nothing else.
461		460
462	`cadir/` mirrors `keydir/`, but answers the other question — not "which keys	461	`cadir/` mirrors `keydir/`, but answers the other question — not "which keys
463	are this person" but "which CAs may mint delegates of them":	462	are this person" but "which CAs may mint delegates of them":
@@ -476,11 +475,13 @@ $ ssh-keygen -s mint -I claude-a -n alex -V +10m agent_key.pub
476		475
477	The cert's principal must name an enrolled person and its CA must be enrolled	476	The cert's principal must name an enrolled person and its CA must be enrolled
478	for that name — `cadir/` lends identity, it never creates it. `access.conf`	477	for that name — `cadir/` lends identity, it never creates it. `access.conf`
479	is never consulted about delegates and cannot widen them: no rule grants a	478	never mentions delegates — the person holds the grants and the certificate
480	certificate a branch, a release, or a repository creation. The same CA key	479	borrows them, clipped to `refs/collab/*`. No rule can widen that clip: none
481	enrolled under two names is allowed (unlike `keydir/`, where one key under two	480	grants a certificate a branch, a release, or a repository creation. The same
482	names is an authorization coin-flip): a certificate names its principal, so	481	CA key enrolled under two names is allowed (unlike `keydir/`, where one key
483	the lookup runs the other way, and a shared CA is two explicit opt-ins.	482	under two names is an authorization coin-flip): a certificate names its
		483	principal, so the lookup runs the other way, and a shared CA is two explicit
		484	opt-ins.
484		485
485	Revocation is the roster: remove `cadir/mint/alex.pub` and the delegates it	486	Revocation is the roster: remove `cadir/mint/alex.pub` and the delegates it
486	minted die on their next command; remove the person's keys and their	487	minted die on their next command; remove the person's keys and their