Devices and agents
Last updated
There is no login, no password and no account record on a Weald relay. Identity is possession of a device private key, held in the operating system keychain.
A coding agent holds no workspace keys. It acts under a delegation issued by a device, and that delegation can only narrow the device's authority.
Devices
A person with two Macs enrolls twice, and each enrollment is its own device with its own key. A device authenticates by signing a challenge, and later authorization is checked against that connection.
The first device enrolled in a workspace is its permanent trust root. The last remaining admin cannot be revoked, because nobody could repair a workspace with no admin.
Agents
An agent is not a member. It reaches a workspace through the local app, under a workspace-scoped delegation certificate with a mandatory expiry.
| Rule | Detail |
|---|---|
| Attenuation only | A delegation can narrow the issuing device's capabilities and can never widen them |
| Mandatory expiry | Twenty-four hours for an interactive agent, seven days for a long-running one |
| Undelegatable | Admitting members, revoking members and admin authority can never be delegated |
| Clock checked | Expiry is checked against local time and observed relay time, with a warning on skew |
| One prompt | The first connection asks a human, naming workspace, groups, capabilities, read scope and expiry |
Renewing inside the same scope never re-prompts. Widening always re-prompts, so the first prompt stays worth reading.
What a signature attributes
Every write carries the device that made it and the delegation it was made under. A change made by an agent is attributable to the agent, the device that authorized it and the window it was authorized for.
This makes agent work reviewable after the fact. It is also why a delegation cannot outlive its expiry.
Recovery
Each workspace has a twenty-four word recovery phrase, generated on device, holding admin authority and rotating when used. There is no escrow, no operator reset and no support path.
The same design keeps the relay blind. No key in this system can recover a workspace, so nobody can be compelled to use one.
Documents
The identity, authentication and group documents in Membership carry the normative rules. The glossary defines the words this page uses in the narrower sense Weald uses them.