1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
{
"lexicon": 1,
"id": "com.publicdomainrelay.temp.compute.events.guest.secrets",
"description": "The requester's secrets bundle for the guest, sealed to the guest's latest compute.events.guest.publicKey with tag secrets; sent as the payload of a market.event. Requester-authored only: the bidder forwards it to the guest's subscription and never opens the ciphertext. The explicit fallback only: the requester's getSecrets route, after a workload identity exchange, is the primary path. A requester sends one only when its spec.secretsFallback is Sealed and the guest posted a compute.events.guest.secretsRequested.",
"defs": {
"main": {
"type": "record",
"key": "any",
"record": {
"type": "object",
"required": ["ciphertext", "createdAt"],
"properties": {
"ciphertext": {
"type": "string",
"maxLength": 65536,
"description": "The bundle, age armored ciphertext. The plaintext is the JSON array the getSecrets route serves: [{\"path\": <absolute path>, \"value\": <file content>, \"mode\": <optional octal file mode, at most 0600>}]. No record names the key it is sealed to; the guest opens every secrets event with its identity and keeps the ones that open."
},
"createdAt": { "type": "string", "format": "datetime" },
"signatures": { "type": "ref", "ref": "network.attested.signature#signatures" }
}
}
}
}
}
