Initial public ModelForge release

2026-09-01 21:30:16 +02:00
commit 7082ab955a
490 changed files with 104252 additions and 0 deletions
@@ -0,0 +1,12 @@
+# Service Authentication
+
+Service clients are separate from Node Agent identities and operator administration. Creation
+returns an `mfsvc_…` bearer secret once. Only SHA-256, a non-secret prefix, timestamps, expiry,
+status, rate/concurrency policy and explicit capability scopes are stored. Secrets are absent from
+audit events and ordinary logs.
+
+Gateway authentication rejects missing, malformed, unknown, revoked or expired credentials,
+disabled clients and missing capability scope. Each client has a sliding one-minute request limit
+and a concurrent-request limit. Credential creation and revocation are audited. The frontend keeps
+the one-time value in memory only and never reloads plaintext.
+