Repository navigation
docs: Domain Configuration Apps — config and secrets live in the app that owns their domain - #5823
Conversation
…that owns their domain
The design for policy domain-config-apps: AI, Databases, Sign-in, Email, Payments and
Integrations each get a fleet app on the control instance (/Hosting/{X}/Deployment/{id}:
the record's block bound to the record, the domain's vault objects write-only, Apply files a
governed Reconcile), and instance-scope settings stay in each instance's Admin app under the
same domain names. The Deployment record page links to the apps and loses its secret dialog
and panels as each domain lands. Includes the inventory of every entry point today and where
it moves, the gates, how a change reaches the portal, and the build order (AI first).
Also: register the policy, list the page in the topic map, and point SecretsWriteOnlyEntry's
"Where each GUI lives" at the domain apps (its "owed, not on main" sentence was stale since
#5791), with the platform master key named as belonging to no app.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Resolve the documented cross-page contradictions and incomplete ownership guidance before approval.
Review effort: Lite
Findings: 1
Open (1)
What changed in this PR
Documents domain-owned configuration and secret management across fleet and instance scopes.
Changes:
- Adds the Domain Configuration Apps architecture page.
- Registers the policy and topic-map entry.
- Updates secret ownership and GUI guidance.
Several documentation consistency issues remain across ownership, scope, inventory, and synchronization guidance.
| File | Summary |
|---|---|
src/MeshWeaver.Documentation/Data/Architecture/SecretsWriteOnlyEntry.md |
Updates secret GUI locations and ownership. |
src/MeshWeaver.Documentation/Data/Architecture/PolicyNotProse.md |
Registers the domain configuration policy. |
src/MeshWeaver.Documentation/Data/Architecture/DomainConfigurationApps.md |
Adds the domain-app design and migration inventory. |
src/MeshWeaver.Documentation/Data/Architecture.md |
Adds the new architecture topic. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| The key that signs a deployment's self-update hand-over is generated where it is used: on the target | ||
| instance, in its Admin app's **Control lane** tab (InstanceSecrets `Hosting:ControlInbox:Secret`, | ||
| live, no restart). The control instance only has to VERIFY signatures, so it holds the same value | ||
| under the per-sender slot `Hosting:PlatformWebhookSecret:{id}`. The Integrations app's | ||
| **Announcement key** section is a `WriteOnlySecretSection` over that slot: an admin pastes the key |
There was a problem hiding this comment.
Agreed: two shipped procedures must not disagree. Fixed in f47f8ee. The section now opens with a Target design, not yet the procedure note. It says that until MeshWeaver.Plugins#2435 lands, operators follow Self-Update Announcement Key, where the control instance issues the key. It also says the change set that moves the flow will rewrite that page and the Instance Secrets summary. I did not rewrite those pages here, because the flow they describe is still the one that is implemented.
Test Results (shard 5)0 tests 0 ✅ 0s ⏱️ Results for commit f47f8ee. ♻️ This comment has been updated with latest results. |
Test Results (shard 2)649 tests - 115 649 ✅ + 76 31s ⏱️ - 6m 36s Results for commit f47f8ee. ± Comparison against base commit f78fcf6. This pull request removes 780 and adds 649 tests. Note that renamed tests count towards both.♻️ This comment has been updated with latest results. |
Test Results 2 files - 15 2 suites - 15 3m 46s ⏱️ - 33m 8s Results for commit f47f8ee. ± Comparison against base commit f78fcf6. This pull request removes 8803 tests.♻️ This comment has been updated with latest results. |
…target design; the shipped procedure stays SelfUpdateAnnouncementKey until Plugins#2435 Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
What
The design for policy
domain-config-apps(the maintainer asked that configuration and secrets move out of ad-hoc GUIs and into domain apps: an AI app for all AI providers and keys, a DB app for databases, and so on).New page:
Doc/Architecture/DomainConfigurationApps/Hosting/{Ai,Databases,SignIn,Email,Payments,Integrations}/Deployment/{id}. Instance scope is what an instance changes about itself live; it stays in that instance's Admin app under the same domain names.subPath, no/datacopy). The domain's vault objects, shown write-only (SecretInventorySectionover the governedSetSecrets/ lifecycle / status actions). An Apply that files a governedReconcile.Also in this PR:
SecretsWriteOnlyEntry→ "Where each GUI lives" now points at the domain apps. Its "owed, not yet on main" sentence was stale since feat(secrets): write-only secret entry in the portal — InstanceSecrets, the secret control, and client-b's announcement key without a vault act #5791. The platform master keyAi:KeyProtection:MasterKeyis now named as belonging to no app, because replacing it makes everyenc:value unreadable.Docs only. No code, no catalog keys.
Verification
dotnet build test/MeshWeaver.Documentation.Test -c Release -warnaserror: 0 warnings, 0 errors.DocumentationLinkIntegrityTestandArchitectureTopicMapTest: 5 of 5 passed.Mirror-sync: none — no catalog key added or changed.
Pairs-with: none — docs only, no public surface removed.
🤖 Generated with Claude Code