eyduhandClaude Opus 4.8
7276286711
Corpus bearer keys become share=true and group-readable (clan-rag, 0440) so an interactive admin on a trusted-root machine can present them. New roles.admin (dedicated tag, decoupled from client/desktop) grants a named user into the clan-rag group and publishes /etc/clan-rag/keys.json (corpus->keyfile), read from the co-located server's instances. CLIs attach the token as a bearer: resolve_instance_key picks it up from CLAN_RAG_INSTANCE_KEY, _FILE, or the per-corpus keys map, mirroring the API-URL corpus resolution so the right key reaches the right corpus. Gate is anchored on the age/sops-admin set (who can decrypt the var) plus root on each deploy target, NOT the auth export's admins group; group/mode is only plumbing, since deployed clan vars are plaintext at rest. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>