groundinglab

Technical · Raw markdown

Admission gate

Source: pcoc at commit aaa8946. Assumes: the sign-in wire (Sign-in wire) and the split between verifier and policy (Verifier and policy).

Signed origin CORS origins
What the client puts in the sign-in body and what the Gate checks byte for byte (SPEC §15.1). Which browser Origin headers may call the Gate (allowed_origins / extra_origins).
Reference Gate: fixed to https://groundinglab.io in wire.rs ORIGIN. No setting. Separate. Empty defaults mean loopback only.
  1. What it is. The Gate is groundinglab's admission service: it applies one relying party's policy to verifier measurements. Service admission-service, crate pcoc-admission 0.4.1, tag gate-v0.4.1, built on ref-rust-v2.0.5. It applies Part B to the measurements of linked_measure (src/verifier.rs) and adds no Part A rule. v2.0 only.
  2. Policy identity. This Gate's policy is gl-admit-v1; yours may differ. gl-admit-v1 sets min_leg_rate 0.25 and min_waypoints 6: one relying party's chosen settings, not part of the measurement. A new number needs a new id, and startup checks {log_dir}/policy-bind.json. When the policy refuses an object, the refusal carries one reason_code and a class.
  3. Build. cargo build --locked --release and cargo test --locked in services/admission-gate (standalone, own Cargo.lock). Pinned vectors are in tests/vectors with SHA256SUMS.
  4. Configure. One TOML (--config or GATE_CONFIG); unknown keys are an error. Keys: bind 127.0.0.1:8787; index_url, default https://index.groundinglab.io, which is opt-in, so point it at your own pcoc-index; index_timeout_secs 5; log_dir gate-log-v2; max_object_bytes 2097152; job_retention_secs 3600; max_jobs 256; max_concurrent 2; bind_threads 6; rate_per_min 12; client_ip_header; allowed_origins (empty in code, so loopback only; the shipped gate.toml sets https://groundinglab.io and https://www.groundinglab.io); extra_origins; leg_rate_floor; policy_id; min_leg_rate; min_waypoints. (source: services/admission-gate/deploy/gate.toml) allowed_origins and extra_origins are browser CORS settings for the caller's HTTP Origin. They are separate from the signed origin, which is the site's own origin. The reference Gate currently fixes the signed origin to https://groundinglab.io with no setting for it; see Sign-in wire. The signed origin is one constant (wire.rs ORIGIN); CORS does not change it.
  5. Deploy. A system user pcoc, /etc/pcoc-admission/gate.toml, /var/lib/pcoc-admission, the unit pcoc-admission.service, behind your own reverse proxy (loopback by default). (source: services/admission-gate/deploy/DEPLOY.md)
  6. Routes. As in Sign-in wire, beat 7; /v1/admit and the legacy routes return 404.
  7. Log. GET /latest.json (404 until the first line), /log/{day}.jsonl (NDJSON) and /log/{day}/{seq} (one line), hash-chained. It starts empty and refuses a non-v2.0 chain. Entries are one relying party's decisions, not conformance (STATUS.md).
  8. Health and operations. GET /v1/health gives version, commit, spec, spec_kind and config. It hides log_dir and config_path, and doesn't fetch the index. The Gate holds no key or secret. Durable state is log_dir only (chain.jsonl, objects/, latest.json, policy-bind.json); back it up and keep the same log_dir across upgrades. Sign-in result rows and verify jobs are in memory and don't survive a restart.

Checked against pcoc aaa8946. Raw markdown.