Vord

Architecture Decision Record

0035. Internal service-to-service trust

Context

Vord's own planes — Vör (edge verification), Modgud (admission), the core, and Forseti — must authenticate each other. The threat model (architecture §12) mentioned mTLS in passing but no decision was recorded, leaving the internal trust fabric unspecified — the gap §12.8 tracks. For a security system, a spoofable internal service is a serious gap.

Decision

  1. Mutual TLS on the internal fabric, with SPIFFE / SPIRE workload identity — the same posture Wyrd uses. Each plane proves its identity to the others under a provider-operated CA; there are no unauthenticated internal calls. The fabric includes NATS and the projection-distribution path: the urgent-revocation channel (ADR-0005) is the highest-value spoof-or-suppress target inside the perimeter (a fake push, a suppressed revocation), so NATS connections carry the same mTLS/workload identity as plane-to-plane calls, and an edge's pull of JWKS/status-list projections is likewise mutually authenticated — the projections' content integrity is separately guaranteed by their signatures (ADR-0043), so the transport auth is defense in depth, not the sole guard.

  2. Least authority between planes. Vör holds only public material and presents a workload identity that grants it nothing on the core (it has no core credential to steal — reinforcing the edge-compromise blast radius of ADR-0027); its NATS credential is subscribe-only on the revocation subjects — a compromised edge can listen, never publish or suppress. Modgud and Forseti authenticate to the core for the writes/reads they are entitled to; the core authenticates its callers and authorizes per plane.

  3. Consistent with the substrate and trust model. It runs on the pluggable deployment substrate (ADR-0024) and the single-provider posture (isolation and fairness, mutual authentication — not cross-operator distrust), inherited from Wyrd's closed-federation framing.

Consequences

  • A compromised or spoofed internal service cannot impersonate a plane; lateral movement is bounded by workload identity and least authority.
  • The edge's bounded blast radius (ADR-0027) is reinforced at the network layer: even with a valid workload identity, Vör is authorized for nothing on the core.
  • The internal fabric is mutually authenticated and rotation-friendly (SPIRE-issued short-lived certs), with no long-lived shared secrets between planes.
  • The dev/single-binary profile (ADR-0024) runs without SPIRE behind the same seam — in-process planes need no workload-identity infrastructure, and the trust-fabric concretes are wired only in the multi-node profiles, so the walking skeleton stays dependency-free.
  • SPIRE is a new infrastructure dependency at a trust seam and is audited under the ADR-0008 rubric like every seam dependency (its row added there).
  • Builds on ADR-0024 and mirrors Wyrd's mTLS/SPIFFE; closes the §12.8 internal-trust gap.