stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity

Repair live watchlist frontdoor routing

Browse Source
This commit is contained in:
master
2026-03-10 00:25:34 +02:00
parent 359fafa9da
commit ac544c0064
11 changed files with 474 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
docs/modules/attestor/architecture.md
View File

@@ -927,11 +927,13 @@ The Attestor provides proactive monitoring for signing identities appearing in t
### Scope Hierarchy
| Scope | Visibility | Who Can Create |
|-------|------------|----------------|
| `tenant` | Owning tenant only | Tenant admins |
| `global` | All tenants | Platform admins |
| `system` | All tenants (read-only) | System bootstrap |
| Scope | Visibility | Who Can Create |
|-------|------------|----------------|
| `tenant` | Owning tenant only | Operators with `trust:write` |
| `global` | All tenants | Platform admins with `trust:admin` |
| `system` | All tenants (read-only) | System bootstrap |
Authorization for the live watchlist surface follows the canonical trust scope family (`trust:read`, `trust:write`, `trust:admin`). The service still accepts legacy `watchlist:*` aliases for backward compatibility, but new clients and UI sessions should rely on the trust scopes.
### Event Flow

6
docs/modules/attestor/guides/identity-watchlist.md
View File

@@ -52,10 +52,12 @@ A watchlist entry defines an identity pattern to monitor and alert configuration
| Scope | Description | Who Can Create |
|-------|-------------|----------------|
| `tenant` | Visible only to owning tenant | Any user with `watchlist:write` |
| `global` | Shared across all tenants | Administrators only |
| `tenant` | Visible only to owning tenant | Any user with `trust:write` |
| `global` | Shared across all tenants | Administrators with `trust:admin` |
| `system` | System-managed entries | System only |
Console and frontdoor watchlist flows use the canonical trust scope family: `trust:read`, `trust:write`, and `trust:admin`. Legacy `watchlist:*` aliases remain accepted for older clients, but new integrations should use the trust scopes.
## CLI Usage
### Adding a Watchlist Entry