Boundaries
| Path | Auth | Purpose |
|---|---|---|
GET /.herenow/data/agent_activity |
public | Suite relay list + certified map feed (demos) |
POST /.herenow/data/agent_activity |
Origin https://orbital-fusion.com + schema |
Suite / always-on emitter writes (no five tabs required) |
GET/DELETE https://here.now/api/v1/publishes/{slug}/data/… |
Bearer owner key | Privileged CEO/ops list · prune · ACL verify |
| Browser suite / relay | none (keys forbidden) | Never embed HERENOW_OWNER_KEY |
How CEO / ops authenticates
- Export
HERENOW_OWNER_KEY(orHERENOW_API_KEY), or place key at~/.herenow/credentialschmod 600. - Run owner script (slug default
lilac-comet-b7p4):
ops-log/scripts/owner-site-data-emit.sh agent_activity list ops-log/scripts/owner-site-data-emit.sh agent_activity privileged-read ops-log/scripts/owner-site-data-emit.sh agent_activity acl-verify PRUNE_DRY_RUN=1 ops-log/scripts/owner-site-data-emit.sh agent_activity prune ops-log/scripts/owner-site-data-emit.sh agent_activity world-smoke
Key resolution order: HERENOW_OWNER_KEY → HERENOW_API_KEY → ~/.herenow/credentials. Script never echoes the key.
Mitigations that stay on (Wave 4 + Parallel B + Wave 6)
- Origin allowlist for writes · incomplete body → 400 · bad Origin → 403
- Summary / coa_hint sanitize (paths, Bearer, api_key scrub)
- Rate limit on
agent_activity· field maxLength caps - Soft list TTL 48h (relay + engine) · owner prune for durable delete
- Cache-Control no-store on relay +
/.herenow/* - Always-on supervised emitter keeps working without five suite tabs
Explicit non-goals
- Do not flip
read=owneronagent_activity(would break browser map feed) - Do not put owner keys in page, relay, or localStorage
- Do not require five suite tabs for durable bus freshness