Corpus bearer keys become share=true and group-readable (clan-rag, 0440)
so an interactive admin on a trusted-root machine can present them. New
roles.admin (dedicated tag, decoupled from client/desktop) grants a named
user into the clan-rag group and publishes /etc/clan-rag/keys.json
(corpus->keyfile), read from the co-located server's instances.
CLIs attach the token as a bearer: resolve_instance_key picks it up from
CLAN_RAG_INSTANCE_KEY, _FILE, or the per-corpus keys map, mirroring the
API-URL corpus resolution so the right key reaches the right corpus.
Gate is anchored on the age/sops-admin set (who can decrypt the var) plus
root on each deploy target, NOT the auth export's admins group; group/mode
is only plumbing, since deployed clan vars are plaintext at rest.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
eyduhandClaude Opus 4.8
7276286711