fathom-keys.ts

config/fathom-keys.ts

1. /**
2. * Whose Fathom key the board reads, and what that key can see.
3. *
4. * Explicit lines, never a loop over the roster: the same rule as
5. * INBOX_READERS in config/inbox.ts, and for the same reason. A key here is
6. * read access to other people's meetings, so a new hire's meetings arrive when
7. * somebody writes their line and not before.
8. *
9. * Fathom keys are per user; there are no org-level keys. One key per person
10. * cannot make Fathom's own permissions do the gating on this account: every
11. * meeting reads `shared_with: no_teams`, Fathom's own words for "private to the
12. * recorder", yet keys return meetings other people recorded. Why it reads that
13. * way is not established (the account does have teams), and no reason is
14. * written here until one is observed (rule 1).
15. *
16. * So the board's own participant gate is the security boundary, not a second
17. * layer behind Fathom's. That is why the leakage tests in apps/dashboard/test/fathom-gating.test.ts assert
18. * against rendered HTML rather than against a view-model: the rendered page is
19. * the thing a person actually receives.
20. *
21. * What a key returns, measured rather than assumed: its owner's recordings
22. * plus a substantial share recorded by other people, all still reading
23. * `shared_with: no_teams`. So `shared_with` does not describe person-level
24. * visibility, and whatever mechanism does is not observed from here.
25. *
26. * What a key buys is coverage. The board sees the union of what its keys
27. * return, deduplicated by recording id, so people who hold no key still have
28. * meetings on the board. A key widens what the board can see; it never widens
29. * who may see it. That is the gate's job, and the gate does not care which key
30. * fetched a meeting.
31. *
32. * The lines still commented out are people who have not handed a key over.
33. * Some of their recordings arrive through the keys we do hold; whether all of
34. * them do cannot be known from here. A person showing zero meetings is
35. * therefore not proof they recorded none, and the pill says so. Uncommenting a line without the
36. * matching environment variable set changes nothing: collect() drops keys with
37. * no value.
38. *
39. * Adding a line is a decision about other people's meetings. Everything a key
40. * can see lands in the KV snapshot and in the briefing payload the model reads.
41. * The gate decides who is shown it; nothing un-collects it. Do not add a key
42. * that was not deliberately handed over for this.
43. */
44. export interface FathomKey {
45. /** Roster display name of the key's owner. Must match config/meridian-people.ts. */
46. owner: string
47. /** Environment variable holding the key. Process env only; no .env reader. */
48. secret: string
49. }
51. export const FATHOM_KEYS: FathomKey[] = [
52. { owner: 'Sam Whitaker', secret: 'FATHOM_KEY_SAM' },
53. { owner: 'Ines Carvalho', secret: 'FATHOM_KEY_INES' },
54. { owner: 'Theo Bassett', secret: 'FATHOM_KEY_THEO' },
55. // No key handed over yet. Some of their recordings reach the board through
56. // the three keys above; whether all of them do is not knowable from here.
57. // { owner: 'Rosa Galván', secret: 'FATHOM_KEY_ROSA' },
58. // { owner: 'Marco Ibáñez', secret: 'FATHOM_KEY_MARCO' },
59. // { owner: 'Rafael Montero', secret: 'FATHOM_KEY_RAFAEL' },
60. // { owner: 'Nora Lindqvist', secret: 'FATHOM_KEY_NORA' },
61. ]
63. /** How far back to sweep. Matches COMMITMENT_WINDOW_DAYS in fathom-people.ts. */
64. export const FATHOM_WINDOW_DAYS = 14