A Mac Outside the Fleet

A Family Mac That Runs No Delta

Delta's fleet is every family Mac but one. The registry puts Dad's managed Macs in the maintenance group and Pippa's home Mac in fanout_excluded; Delta runs on both groups. It never runs on the household group, which is Mom's Mac. That machine has a standing rule older than Delta: no background service of any kind runs there. No LaunchAgent, no daemon, no scheduler. Whatever reaches that Mac has to reach it without installing anything that stays.

And something does have to reach it. Soul Vault, the family's memory store, serves Pippa's vault to every Mac that needs her, and that includes a read-only client on Mom's Mac. So Delta has to answer a family Mac that is not part of Delta, never offers anything back, and cannot be trusted with everything the fleet shares with itself.

Known by Name, Admitted by Policy

The first instinct is to treat the household's Mac as a stranger and punch a special hole for it. That is roughly what the documents first said: "refused as an unknown node". On 2026-11-10 a real refusal from the live fleet showed something more precise. The gateway had identified Mom's Mac perfectly well: the registry lists it, the tailnet roster names it, lesson 1's lookup returned its label. The refusal came one layer up, from a share: "(the household's Mac) may not read cwkSoulVault/store for cwkSoulVault". The documents were corrected the same day (Coop 1110-47), with no code changed, because the code already had the right shape.

That shape is the cleanest idea in the track. Identity and permission are separate layers. The gateway answers one question for every caller (which Mac is this?) and never decides access. The share decides access from its own policy, which names fleet labels, ledger roles, registry groups or member apps:

Share	Readers	The household's Mac
`home`	`{"fleet": true}`	refused: the fleet never includes the household group
`cwkSoulVault/store`	`{"fleet": true}`	refused, the error seen on 2026-11-10
`cwkSoulVault/household`	`{"groups": ["household"]}`	admitted, read-only, Pippa's vault and the shared vault only

"fleet": true is computed live: the two fleet groups minus anything in household, so no edit to a share can quietly let Mom's Mac into the home share. The one share that answers it says so by naming its group out loud, and it serves a narrow scoped view: committed bytes of two vaults, no write requests, no other soul. The same pattern serves the two Windows GPU boxes in the vault_reader group (Coop 1110-45): outside the fleet, running no Delta, readers of one scoped share and nothing else.

How a Mac Without Delta Asks

An app on a fleet Mac asks its own Delta on loopback. The household's Mac has no Delta to ask, so its client uses the path kit_delta keeps for exactly one situation: when the local Delta does not answer, a read falls back to the peer's gateway directly, over the tailnet, labelled tailnet-direct. No cache, no ticket, no local token: the gateway identifies the caller from its tailnet address, exactly as in lesson 1, and the share's policy does the rest. On a fleet Mac this path is the fallback for a Delta that is restarting. On Mom's Mac it is the only path, and it needs nothing installed beyond the client library itself.

Writes never take it. A write call (Track 7) goes only through the caller's own Delta, because the local Delta and its token are what vouch for the Mac and the account that ask. With no local Delta, kit_delta fails a write with local_delta_down before anything is sent. But that is the client's rule, and a client is not a boundary: the gateway would accept a POST /v1/call from any Mac the roster names, whatever library sent it. The refusal that holds is the owner's. The household share's class is not writable (ScopedStoreShare.writable() returns False), so _require_write refuses the call before the share's code is asked anything, and the class's own call() refuses as well. A Mac that runs no Delta can read what it was given and change nothing, because the share says so, which is precisely the standing it should have.

The Track in One Table

Every credential in Delta now has a place:

Route	Proof of the caller	Where that proof came from
tailnet	source address	WireGuard's key binding; the registry gives it a name
Thunderbolt	ticket	minted over the tailnet
shared LAN	ticket inside pinned TLS	ticket and fingerprint both learned over the tailnet
loopback	local token	a `0600` file only Delta's account can read

Invariant 3 is the rule underneath all four rows: identity and tickets only on the tailnet. Nothing in the table was copied from one Mac to another, nothing rides in a URL, and SSH appears nowhere in it. That is what "without copied secrets" meant.

Code

The fleet that never includes the household, the policy that names groups, and the direct read (trimmed excerpt)·python

# delta/config.py, delta/shares.py and kit_delta.py (trimmed excerpt)

FLEET_GROUPS = ("maintenance", "fanout_excluded")
NEVER_GROUP = "household"


def fleet_labels() -> tuple:
    never = set(family.fleet_labels(NEVER_GROUP))
    labels = []
    for group in FLEET_GROUPS:
        for label in family.fleet_labels(group):
            if label not in never and label not in labels:
                labels.append(label)
    return tuple(labels)


class Policy:
    """Who may: fleet labels, ledger roles, fleet groups, or the Macs hosting members."""

    def labels(self) -> set:
        found = set(self.spec["labels"])
        if self.fleet:                       # every Mac in Delta's fleet group, read live
            found.update(config.fleet_labels())
        for group in self.spec["groups"]:
            found.update(family.fleet_labels(group))
        ...
        return found


class Delta:                                 # kit_delta, the app's client
    def _direct(self, peer: str, path: str, headers: dict, timeout: float):
        """This Mac's Delta is down: ask the peer's Delta over the tailnet (no cache)."""
        host = family.fleet_host(peer)
        port = _per_machine_port("gateway")
        conn = http.client.HTTPConnection(host, port, timeout=timeout)
        try:
            conn.request("GET", path, headers=dict(headers, **{"X-Delta-App": self.app}))
            resp = conn.getresponse()
            return resp.status, {k.lower(): v for k, v in resp.getheaders()}, resp.read()
        finally:
            conn.close()

A policy matrix you can run: which caller reads which share·python

#!/usr/bin/env python3
"""Who may read which share: Delta's Policy rule over a toy registry (stdlib only)."""

REGISTRY_GROUPS = {
    "maintenance": ["workbench", "service-host", "laptop"],
    "fanout_excluded": ["pippa-home"],
    "household": ["household-mac"],
    "vault_reader": ["gpu-box-1", "gpu-box-2"],
}
NEVER_GROUP = "household"


def fleet() -> set:
    """Delta's fleet: the maintenance and fanout_excluded groups, never the household."""
    never = set(REGISTRY_GROUPS[NEVER_GROUP])
    return {m for g in ("maintenance", "fanout_excluded") for m in REGISTRY_GROUPS[g]} - never


def allows(policy: dict, label: str) -> bool:
    found = set(policy.get("labels", []))
    if policy.get("fleet"):
        found |= fleet()
    for group in policy.get("groups", []):
        found |= set(REGISTRY_GROUPS.get(group, []))
    return label in found


SHARES = {
    "home": {"fleet": True},
    "cwkSoulVault/store": {"fleet": True},
    "cwkSoulVault/household": {"groups": ["household"]},
    "cwkSoulVault/vault-reader": {"groups": ["vault_reader"]},
}

callers = ["laptop", "pippa-home", "household-mac", "gpu-box-1", "a-phone"]
print(f"{'caller':<14}" + "".join(f"{s.split('/')[-1]:>14}" for s in SHARES))
for caller in callers:
    row = "".join(f"{('read' if allows(p, caller) else '-'):>14}" for p in SHARES.values())
    print(f"{caller:<14}{row}")

Exercise

Run the policy matrix above. Then add a share of your own that a laptop may read but not the service host, using only labels, and a second one that every fleet Mac and the household's Mac may both read. Finally add a writers policy to cwkSoulVault/household that names the household group, and explain in two sentences why Delta would still refuse its writes, and which layer does the refusing.

Hint

The second share needs {"fleet": true, "groups": ["household"]}. For the last part, look at what can_write asks before it ever reads writers, and what the household share's class answers. local_delta_down is the kit's rule; a caller that skips the kit still meets the share.