Help
Weles runs on a host that does not hold the vault.
Which vault serves Weles is Skarbiec's choice, not a file Weles names, and the API launcher starts only as the workload identity its unit declares.
No vault file is named#
Weles reads and writes its records (trajectory accounts, proxies, service credentials, email-domain status, subscriptions) through the Skarbiec program Stado attests for the host. It names no vault file: the API launcher clears SKARBIEC_VAULT_FILE, and the helpers pass one on only when the caller set it. Skarbiec then chooses the vault itself: the vault Stado declares for the host, or the fleet owner it forwards to.
Naming the account's ~/.stado vault file turned that forwarding off, so Weles had to stand on whichever host held the file. Without it, Weles runs on any host Skarbiec can reach its owner from.
The workload identity comes from the unit#
Secret acquisition signs as a workload. The launcher reads that identity from SKARBIEC_WORKLOAD_ID, which the service unit declares, and refuses to start without it: "SKARBIEC_WORKLOAD_ID is not set: the service unit names the workload Skarbiec's registry knows Weles by". It never signs as a name of its own, which the registry might not hold.
Proxy rows#
A proxy row holds what its Skarbiec item declares. An item without a fields or context object is refused by name. An attribute the item does not declare is absent from the row, and the caller decides what that means: the upstream probe skips a row without an endpoint or credentials.
A refused or failed upstream probe leaves none of the scraped balance usable. The note names the probe's own error, or the status and reason the proxy answered.