eric/narratio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 27 Wiki Activity

Reduce supported platform matrix

Browse Source
This commit is contained in:
Eric Rakestraw
2026-09-07 03:28:50 +00:00
parent 1558c9ccae
commit f8e3e651e6
26 changed files with 32 additions and 387 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
docs/operations.md
View File

@@ -550,18 +550,11 @@ converge on `0664`. Narratio explicitly applies these modes so a restrictive
caller umask does not remove group write or setgid. It does not change file or
directory ownership: the configured workspace's existing group is inherited.
Windows does not implement POSIX mode bits or setgid semantics. Configure the
workspace, spool, and cache locations with an ACL that grants the collaborating
group read/write access, and configure credential locations with an ACL limited
to the intended credential owner. Do not use POSIX mode displays as evidence of
Windows access control.
API keys are credentials, not ordinary workspace data. Store them outside the
shared workspace or in a separately restricted credential location; ordinary
workspace group access must never be treated as authorization to read keys.
On POSIX, provision a credential directory as `0700` and credential files as
`0600`; Narratio rejects group- or other-readable configured credential paths.
On Windows, restrict the directory and files with ACLs to the credential owner.
Provision a credential directory as `0700` and credential files as `0600`;
Narratio rejects group- or other-readable configured credential paths.
External adapter results are individually bounded before Narratio validates or
materializes them. These per-file limits do not reserve disk space: prevent hard