HOSTWATCHInfrastructure control plane

Distributed compute / Security and privacy

Narrow credentials,
explicit boundaries.

A compute network adds two kinds of credentials to Hostwatch and keeps both narrow: a machine’s, which can only lease and report its own work, and a network key’s, which can only submit work to its network.

Credentials

  • Join codes are one-use, expire after 15 minutes, an hour or a day, and are stored only as hashes. A code joins one machine to one network.
  • Machine credentials (hwm_…) are issued once, kept by the worker in a file readable only by its user, and stored by Hostwatch as hashes. They lease jobs addressed to that machine or its network, renew and report them, and read the files of the jobs the machine serves — nothing in the dashboard, no other machine’s work.
  • Network keys (hwk_…) are shown once and stored as hashes. They submit jobs to their network (or the community pool), list its machines and read the organization’s job files. They cannot change settings or sign in.
  • Removing a machine or revoking a key takes effect on the next request.

Isolation

  • Machines, networks, keys, jobs and files belong to one organization, and every dashboard request is checked against the signed-in member’s organization and role.
  • A key reaches only its own network’s machines; a job addressed to another network’s machine is refused, and so is one of a kind the machine does not take.
  • Files of a job are stored under the submitting organization. A machine reaches them only while it serves, or has served that day, that organization’s jobs, and writes its results there.
  • In the community pool, machines are listed by node name; owners see that their machine served the pool, not for whom.

What passes where

Hostwatch carries the queue: job descriptions, their small files (up to 4 MiB each and 256 MiB per organization, removed after a week), settings and heartbeats with each machine’s cores, memory, platform and the address it advertises. The computation — hidden states between the coordinator and the stages, and the weights a machine fetches — flows directly between the machines and never through Hostwatch. Stages accept only the coordinator’s address and refuse work that does not fit the memory lent.

Audit and limits

Joins, settings changes, removals, keys, codes and cancellations are written to the organization’s audit trail. An organization connects up to 64 machines, keeps up to 32 keys and 16 networks, and queues up to 128 jobs at once.

Reporting

Report a security issue to Hostwatch security. Please include the time, the network and the machine’s node name, never a credential.