Rechazo de una capability (SCT) en el daemon (dec-0119 §8).
packages/api-contracts/src/bus/nats.tsPágina generada desde
packages/api-contracts/src/bus/nats.ts + packages/api-contracts/src/bus/routes.ts. No se edita a mano:bun run docs:genla regenera ybun run docs:checkfalla si difiere.
evt.security.capabilityRejected · v2
Rechazo de una capability (SCT) en el daemon (dec-0119 §8). Lo publica el
daemon Zig directamente (spire-zig, NATS core) desde el sink de su
spire.cap.Authority; nunca lleva el token.
| Campo | Valor |
|---|---|
| Familia | evt |
| Versión | 2 |
| Tope del payload | 1024 bytes |
| Contrato | SecurityCapabilityRejected en packages/api-contracts/src/bus/nats.ts |
BUS_ROUTES)Deny-by-default: un emisor fuera de la allowlist se deniega y se audita (dec-0119 §4).
| Atiende | Transporte | Emisores admitidos | Rate (por emisor) |
|---|---|---|---|
styx-ops | nats | media-daemon | 64/s, ráfaga 128 |
identity-svc | nats | media-daemon | 64/s, ráfaga 128 |
{
"type": "object",
"required": [
"reason",
"op",
"ts_ms",
"count",
"dropped"
],
"properties": {
"reason": {
"type": "string",
"pattern": "^[A-Za-z]{1,32}$"
},
"op": {
"type": "string",
"pattern": "^[a-z]{1,16}$"
},
"scope": {
"anyOf": [
{
"type": "string",
"const": "read"
},
{
"type": "string",
"const": "publish"
},
{
"type": "string",
"const": "ingest"
},
{
"type": "string",
"const": "control"
}
]
},
"sid": {
"type": "string",
"pattern": "^[0-9a-f]{32}$"
},
"actor": {
"type": "string",
"pattern": "^[0-9a-f]{32}$"
},
"jti": {
"type": "string",
"pattern": "^[0-9a-f]{32}$"
},
"ts_ms": {
"type": "integer"
},
"count": {
"type": "integer",
"minimum": 1
},
"dropped": {
"type": "integer",
"minimum": 0
}
}
}