alknet

Files

glm-5.2 6a7d4b9755 docs(architecture): add ADR-014 secret material flow, remove vault ops from call protocol

Resolve the contradiction between ADR-008's "capability source" model
and operation-registry.md showing vault operations on the wire. ADR-014
establishes: vault is assembly-layer only, capabilities carry outbound
credentials (distinct from inbound identity), call protocol carries no
secret material, adapters take credential sources not static tokens.

- Add ADR-014 (Secret Material Flow and Capability Injection)
- Remove vault/derive, vault/unlock, vault/decrypt from call protocol
  registration examples and all spec examples
- Add Capabilities field to OperationContext, propagate through
  LocalOperationEnv nested calls
- Add Capability Injection section to operation-registry.md
- Add no-secret-material wire constraint to call-protocol.md
- Add streaming subscribe example (LLM chat with Vercel UI chunks)
- Add Security Model section to overview.md (identity vs capabilities)
- Trim WASM treatment from ~20 lines to a design-constraint note
- Add OQ-16 (resolved: no vault ops on wire), update OQ-08, OQ-15
- Update ADR-003, ADR-008, ADR-013 to remove stale "via call protocol"
  vault references

2026-06-18 03:16:45 +00:00

001-alpn-protocol-dispatch.md

docs(architecture): add Phase 0 architecture specs for ALPN-as-service model

2026-06-15 22:14:58 +00:00

002-protocol-handler-trait.md

docs(architecture): resolve one-way doors, clean up Phase 0 specs

2026-06-16 10:43:31 +00:00

003-crate-decomposition.md

docs(architecture): add ADR-014 secret material flow, remove vault ops from call protocol

2026-06-18 03:16:45 +00:00

004-auth-as-shared-core.md

docs(architecture): spec alknet-core with per-crate subdocs, ADR-010/011