flowchart TD
U(["User / Operator"])
subgraph CANARY["Steelmoth VPS · canary — this host (on the tailnet)"]
direction TB
subgraph UAUTH["① User authentication"]
direction TB
HNX["host nginx · TLS (Tailscale cert)<br/>app.steelmoth.ai → dashboard"]
DASH["Dashboard · next-auth"]
MW["middleware.ts · session gate"]
SESS["session · owner identity<br/>core.owner_identity"]
RLS["per-owner scope · row-level security"]
HNX --> DASH --> MW --> SESS --> RLS
end
subgraph HOP["② Dashboard → Runtime · internal hop"]
direction TB
HOPC["internal hop credential<br/>STEELMOTH_RUNTIME_INTERNAL_HOP_CREDENTIAL_HASH<br/>trusted-proxy header"]
API["stm-runtime-api · the brain"]
HOPC --> API
end
subgraph SEC["③ Secret / token resolution · credentials.py"]
direction TB
AVTOK["Agent Vault session token<br/>mounted /etc/agent-vault"]
CRED["secret resolver<br/>per-process cache ≤ 60s<br/>STEELMOTH_SECRET_BROKER_BASE_URL"]
MLS["memlink-scope signer · HMAC<br/>alias resolved via broker"]
AVTOK -->|bearer| CRED
CRED --> MLS
end
subgraph OA["④ OAuth start (Google) · operator + client"]
direction TB
OASTART["OAuth start · identity_provider / web_chat auth<br/>state HMAC · google-oauth-state-hmac-secret"]
OACB["callback handler"]
OASTART --> OACB
end
end
subgraph PRONTERA["Prontera VPS · separate host — Agent Vault (off this VPS)"]
direction TB
PNX["nginx · TLS<br/>prontera.sole-augmented.ts.net/secrets"]
PAUTH["validate Bearer token<br/>+ X-Agent-Vault-Client-Vault binding"]
PBROKER["Agent Vault secret broker<br/>resolve alias → secret · GET-only<br/>AGENT_VAULT_SECRET_BROKER_ALIASES_JSON"]
PEXCH["Model-2 OAuth exchanger<br/>code → tokens → write vault · ADR 0105/0155"]
subgraph PV["Agent Vault — per-vault slots"]
direction TB
VST[("staging · system secrets")]
VMK[("client-mark · operator OAuth refresh")]
VC1[("client slot 1 · empty")]
VC2[("client slot 2 · empty")]
VST ~~~ VMK ~~~ VC1 ~~~ VC2
end
PNX --> PAUTH --> PBROKER
PBROKER --> VST
PEXCH --> VMK
end
GOOGLE["Google · OAuth consent + token endpoint"]
RELAY["public callback relay · ADR 0155<br/>(clients off-tailnet)"]
U -->|HTTPS| HNX
RLS -->|authorized request| HOPC
API --> CRED
CRED -. "GET alias · Authorization: Bearer + X-Client-Vault (tailnet HTTPS)" .-> PNX
PBROKER -. "secret value · token / key" .-> CRED
RLS --> OASTART
OASTART -. redirect .-> GOOGLE
GOOGLE -. "consent → auth code" .-> RELAY
RELAY -. code .-> PEXCH
PEXCH -. refresh token .-> VMK
CRED -. "read Gmail token (alias)" .-> PNX
AUTHDB[("DB · this VPS · core.owner_identity · core.telegram_dashboard_connection · core.vault_lookup_audit<br/>steelmoth.clients · access_requests · provider_accounts · provider_grants (OAuth ref → vault) · next-auth session = JWT (no table)")]
SESS -. owner identity .-> AUTHDB
OACB -. provider_grants · opaque_credential_ref .-> AUTHDB
style AUTHDB fill:#ffffff,stroke:#7c5cff,stroke-width:1px,color:#27272a
style CANARY fill:#eff8ff,stroke:#0369a1,stroke-width:3px,color:#0369a1
style PRONTERA fill:#f1f5f9,stroke:#475569,stroke-width:3px,color:#475569
style UAUTH fill:#eff8ff,stroke:#0369a1,stroke-width:1px,color:#0369a1
style HOP fill:#f1f5f9,stroke:#475569,stroke-width:1px,color:#475569
style SEC fill:#fffaf0,stroke:#b45309,stroke-width:1px,color:#b45309
style OA fill:#fff7ed,stroke:#c2570c,stroke-width:1px,color:#c2570c
style PV fill:#f4f1ff,stroke:#7c5cff,stroke-width:1px,color:#7c5cff
classDef authN fill:#ffffff,stroke:#0369a1,color:#27272a,stroke-width:1px
classDef secN fill:#ffffff,stroke:#b45309,color:#27272a,stroke-width:1px
classDef oaN fill:#ffffff,stroke:#c2570c,color:#27272a,stroke-width:1px
classDef vN fill:#ffffff,stroke:#7c5cff,color:#27272a,stroke-width:1px
classDef brkN fill:#ffffff,stroke:#475569,color:#27272a,stroke-width:1px
class HNX,DASH,MW,SESS,RLS,HOPC,API authN
class AVTOK,CRED,MLS secN
class OASTART,OACB,GOOGLE,RELAY,PEXCH oaN
class VST,VMK,VC1,VC2 vN
class PNX,PAUTH,PBROKER brkN
