60 lines
2.7 KiB
Markdown
60 lines
2.7 KiB
Markdown
# ADR-0017: Defer cache access policy to the deployment
|
|
|
|
**Status:** Accepted
|
|
**Date:** 2026-09-11
|
|
|
|
## Context
|
|
|
|
Canonical chunk plans and invocation checkpoints are reconstructible cache
|
|
state. They may include source-derived content, so access and retention matter,
|
|
but Notarius cannot determine whether a deployment needs a private cache or a
|
|
cache shared by a trusted group. The current application-enforced `0700` and
|
|
`0600` modes prevent ordinary Unix provisioning from making that choice.
|
|
|
|
[ADR-0005](0005-cache-canonical-chunk-plans-by-source.md) governs canonical
|
|
chunk-plan reuse, while [ADR-0006](0006-separate-output-cache-and-debug-state.md)
|
|
established the output, cache, and debug separation refined by
|
|
[ADR-0007](0007-separate-checkpoint-recording-from-reuse.md). None of those
|
|
decisions requires Notarius to own exact cache access modes.
|
|
|
|
## Decision
|
|
|
|
Deployments own cache access policy through provisioned directories, process
|
|
umask, setgid inheritance, and default ACLs. Notarius requests conventional
|
|
maximum creation modes for cache entries and leaves the kernel to select their
|
|
effective permissions.
|
|
|
|
Notarius continues to own confined paths, symlink rejection, validation,
|
|
atomic publication, cleanup, and recovery. Those correctness boundaries are
|
|
independent from deciding which accounts may access cache state.
|
|
|
|
Source-derived cache contents can be sensitive. Operators own their access and
|
|
retention policy, while API credentials remain outside cache payloads under the
|
|
existing secret boundary. Existing cache inode modes are not migrated
|
|
automatically.
|
|
|
|
This decision does not supersede ADR-0005, ADR-0006, or ADR-0007.
|
|
|
|
## Alternatives considered
|
|
|
|
- Continue enforcing private `0700` directory and `0600` file modes. This
|
|
makes one deployment choice for every operator and prevents trusted-group
|
|
provisioning.
|
|
- Add configurable Notarius permission modes or a private/group cache setting.
|
|
This preserves application ownership of a deployment concern and expands the
|
|
public configuration surface without a durable policy reason.
|
|
- Recursively converge existing cache ownership, modes, or ACLs. This would
|
|
make upgrades mutate operator-managed state and cannot safely infer an
|
|
intended policy.
|
|
|
|
## Consequences
|
|
|
|
Operators can use a restrictive umask for private cache state or provision a
|
|
setgid/default-ACL cache root for trusted-group access. They must deliberately
|
|
recreate or administratively migrate pre-existing cache trees when their
|
|
existing modes do not match the desired deployment policy.
|
|
|
|
Notarius does not add user or group management, ACL mutation, permission
|
|
configuration, or recursive cache migration. Output and debug permission
|
|
contracts remain separate from this decision.
|