From b4b897b5f887783d39220a81207841dc8aaf3290 Mon Sep 17 00:00:00 2001 From: Dan Enman Date: Mon, 14 Sep 2026 20:47:57 -0300 Subject: [PATCH 1/3] docs: name dwn-rs-agent as Rust agent/runtime owner --- enbox/architecture.md | 2 +- enbox/package-map.md | 9 +++++++-- glossary.md | 6 ++++++ 3 files changed, 14 insertions(+), 3 deletions(-) diff --git a/enbox/architecture.md b/enbox/architecture.md index 2bcaac0..3a56fd5 100644 --- a/enbox/architecture.md +++ b/enbox/architecture.md @@ -54,7 +54,7 @@ Replication feeds messages back through the same admission semantics rather than - **DWN engine**: message parsing, validation, authorization, Records/Protocols/Messages handlers. - **Stores**: durable messages, data, feed metadata, resumable tasks. - **Identity/signatures**: DID resolution and JWS verification. -- **Agent/runtime**: link planning, sync orchestration, session state, remote transport. +- **Agent/runtime**: link planning, sync orchestration, session state, remote transport. Rust owner: `dwn-rs-agent` (agent identity/vault, `auth` registration/connect); reference: `@enbox/agent` with `@enbox/auth` above it. - **Encryption control**: record envelope primitives plus higher-level key-distribution/control records. - **Transport/topology**: JSON-RPC/HTTP/WS, endpoint discovery, forwarding, proxying. diff --git a/enbox/package-map.md b/enbox/package-map.md index 0e7ff44..92006ba 100644 --- a/enbox/package-map.md +++ b/enbox/package-map.md @@ -34,13 +34,17 @@ crates/ events/ filters/ handlers/ - identity/ interfaces/ permissions/ runtime/ stores/ sync/ + dwn-rs-agent/ + agent/ (identity, vault key lifecycle, secret-store traits) + auth/ (tenant registration/setup, legacy connect/delegate helpers) + sqlite secret-store backend (feature `sqlite`) + dwn-rs-stores/ sqlite-backed stores native node assembly @@ -65,7 +69,8 @@ handlers/ - `handlers/records/common.rs` currently carries substantial shared Records validation/admission logic. - `permissions/mod.rs` carries a large portion of Permission Grant authorization. -- store traits live in core; SQLite implementations live in `dwn-rs-stores`. +- store traits live in core; SQLite implementations live in `dwn-rs-stores`. Exception: agent secret/key backend traits (`SecretStore` and related seams) live in `dwn-rs-agent`; the `agent_secrets` schema stays in the `dwn-rs-stores` migration. +- Agent identity, tenant registration/setup, and connect helpers live in `dwn-rs-agent` (`agent/`, `auth/`); `dwn-rs-core` no longer carries `identity/`. - durable feed ownership belongs to the message store; the event-log adapter observes that feed rather than maintaining a second authoritative history. - sync orchestration should move toward the durable-feed model owned by `MessagesQuery`/`MessagesSubscribe`, not legacy `MessagesSync`/`StateIndex`. diff --git a/glossary.md b/glossary.md index cf3c73c..68cfb09 100644 --- a/glossary.md +++ b/glossary.md @@ -1,5 +1,11 @@ # Glossary +## Agent (runtime) +The Enbox user-agent: the DID, key manager, and secret store acting for one user. Rust owner: `dwn-rs-agent`. Distinct from a delegated agent principal. + +## Delegated agent (principal) +A software/AI principal acting under a permission grant. Described by protocol and permission types, not by the agent runtime crate. + ## Author The semantic principal on whose behalf a DWN message acts. With author delegation, the Author can differ from the cryptographic Signer. From 9489195376269e92b0103afe8aa5bed21d012d46 Mon Sep 17 00:00:00 2001 From: Dan Enman Date: Mon, 14 Sep 2026 20:52:11 -0300 Subject: [PATCH 2/3] docs: record agent-to-stores direction and secret-schema revisit --- enbox/package-map.md | 1 + 1 file changed, 1 insertion(+) diff --git a/enbox/package-map.md b/enbox/package-map.md index 92006ba..ec3f3ff 100644 --- a/enbox/package-map.md +++ b/enbox/package-map.md @@ -71,6 +71,7 @@ handlers/ - `permissions/mod.rs` carries a large portion of Permission Grant authorization. - store traits live in core; SQLite implementations live in `dwn-rs-stores`. Exception: agent secret/key backend traits (`SecretStore` and related seams) live in `dwn-rs-agent`; the `agent_secrets` schema stays in the `dwn-rs-stores` migration. - Agent identity, tenant registration/setup, and connect helpers live in `dwn-rs-agent` (`agent/`, `auth/`); `dwn-rs-core` no longer carries `identity/`. +- Dependency direction is `dwn-rs-agent` → `dwn-rs-stores`, never the reverse; this is load-bearing for vault and DWN-backed-store work, where secret-schema and file ownership get revisited. - durable feed ownership belongs to the message store; the event-log adapter observes that feed rather than maintaining a second authoritative history. - sync orchestration should move toward the durable-feed model owned by `MessagesQuery`/`MessagesSubscribe`, not legacy `MessagesSync`/`StateIndex`. From bec99943b05a9cf65daac6c0d82873b708eca584 Mon Sep 17 00:00:00 2001 From: Dan Enman Date: Mon, 14 Sep 2026 20:54:13 -0300 Subject: [PATCH 3/3] docs: keep secret-schema placement observational pending vault work --- enbox/package-map.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/enbox/package-map.md b/enbox/package-map.md index ec3f3ff..cf84115 100644 --- a/enbox/package-map.md +++ b/enbox/package-map.md @@ -69,7 +69,7 @@ handlers/ - `handlers/records/common.rs` currently carries substantial shared Records validation/admission logic. - `permissions/mod.rs` carries a large portion of Permission Grant authorization. -- store traits live in core; SQLite implementations live in `dwn-rs-stores`. Exception: agent secret/key backend traits (`SecretStore` and related seams) live in `dwn-rs-agent`; the `agent_secrets` schema stays in the `dwn-rs-stores` migration. +- store traits live in core; SQLite implementations live in `dwn-rs-stores`. Exception: agent secret/key backend traits (`SecretStore` and related seams) live in `dwn-rs-agent`; the `agent_secrets` schema is currently defined by the `dwn-rs-stores` migration. - Agent identity, tenant registration/setup, and connect helpers live in `dwn-rs-agent` (`agent/`, `auth/`); `dwn-rs-core` no longer carries `identity/`. - Dependency direction is `dwn-rs-agent` → `dwn-rs-stores`, never the reverse; this is load-bearing for vault and DWN-backed-store work, where secret-schema and file ownership get revisited. - durable feed ownership belongs to the message store; the event-log adapter observes that feed rather than maintaining a second authoritative history.