| 1 | { |
| 2 | "status": "Revision3 proposed; incorporates Fable revision2 REQUEST_CHANGES. Codec implementation in progress; no runtime worker, live credential, or deployed IAM boundary.", |
| 3 | "parents": "Maintenance protocol5f18cdd / platform117; Fable investigations worker-identity-design and worker-identity-design-r2 are proposals, not approvals", |
| 4 | "scope": "Initial shared/root platform boxes only, exactly one eligible enrolled box for the target region/pool. Customer fleet targets and ambiguous multi-box placement refuse. Do not distribute deployment decryption keys to customer machines.", |
| 5 | "isolation_prerequisite": "Require observed isolated-exec probe ready, box layout_mode nested, and every activator-managed route nested. Foreign/external routes refuse until their supervisor identity and isolation are proven. Apply this gate to both worker and console hosts: flat same-UID tenants can also read console signing/decryption material. Re-evaluate before each bearer use or private-input decryption; an unavailable observation or layout downgrade holds execution. Platform126 owns these runtime/layout checks; no competing implementation or unchecked feature boolean.", |
| 6 | "identity": "Dedicated maintenance workers, not customer fleets. Reuse canonical per-box token-hash/label conventions only; never put worker credentials in fleet_boxes or human/service auth. Therefore existing fleet tunnel/store/placement doors cannot confer worker authority and need no platform-kind extension. Customer fleets remain unsupported.", |
| 7 | "authoritative_storage": "Deployment store only; SQLite never supplies authority or monotonic generation. Admission remains disabled until an actual IAM boundary prevents worker credentials from overwriting/deleting authoritative control records. Non-console host roles require explicit Deny PutObject/DeleteObject for control/maintenance/workers/* and control/maintenance/assignments/*; candidate writes use separate control/maintenance/candidates/*. Console writer identity must be distinct from every admitted worker instance profile; do not admit a worker on the console host while they share write credentials. Root signatures authenticate records but cannot prevent rollback/ETag ABA by an authorized store writer. Verify old signed-record replay fails using the deployed worker principal. Broader guard-write permissions under control/maintenance/hosts require review before live activation; no claim of revocation safety from signatures alone.", |
| 8 | "head": { |
| 9 | "key": "control/maintenance/workers/<logical-label>/head.json", |
| 10 | "wire": "Closed bounded root-signed control record using existing release signed-wrapper/signature mechanics, disjoint required kind/schema. Contains deployment origin, ops account, logical label, physical box identity digest, generation, revision, token hash, status(active/revoking/detached), placement, candidate identity/digest, and at most8 registered immutable assignment references. New internal v1 encoding requires exact typed canonical field order/escaping and explicit required fields; insignificant whitespace is accepted. No change to existing release readers.", |
| 11 | "updates": "Create-only first admission. Every update uses exact head ETag CAS. Generation advances only on explicit owner re-admission and refuses overflow. Assignment registration CAS requires active head and matching generation. Revoking/detached head cannot register assignments or authenticate new requests.", |
| 12 | "label": "OwnerBox is stable logical box label, preserving guard rules. Inventory-friendly labels collide in status.Label; candidate also binds physical box identity digest. Initial collision refuses; physical replacement requires explicit owner re-admit selecting current head and expected old identity, new candidate and generation. Never silently reinterpret a label.", |
| 13 | "owner": "Every admit/detach/read administrative door requires current human ops owner through actual apiSystemOwner. Human/service CLI tokens cannot authenticate worker publication. Authenticated worker endpoint derives deployment/box/generation from verified head and bearer, never body strings." |
| 14 | }, |
| 15 | "assignment_state": { |
| 16 | "key": "control/maintenance/assignments/<assignment-id>/state.json", |
| 17 | "purpose": "One authoritative typed server-internal CAS record per immutable assignment, covering preflight, compatibility intermediate, execution outcome and resume publication. Their accepted references live in this record so each publication and revocation contend on THE SAME object, independent of console count.", |
| 18 | "wire": "Bounded closed root-signed server-internal control record with immutable assignment digest/scope/enrollment generation, monotonic revision, disabled flag, and fixed optional accepted preflight/compatibility/execution/resume references. Require console root signature before accepting any state/ref. Type validators enforce approved protocol per-kind field/phase rules. No generic object key/write/signing API and no offline worker receipt format; CLI continues using authenticated server responses and opaque references.", |
| 19 | "create": "Create immutable assignment and initial state, then CAS active worker head to register its exact reference. Until registered, state grants no execution/publication authority. Failed registration leaves inert orphan. Immutable assignment binds record/account/app/host/request/attempt/placement/worker generation; owner approval later binds exact preflight and assignment. Assignment IDs must derive deterministically from the immutable request/attempt or be durably retained before registration, so retries cannot consume new open slots. Immediately before owner approval lineage CAS/guard creation, re-read enabled assignment state and active matching registered head. A subsequent revocation race keeps the guard denied and is reconciled; approval never bypasses the disabled state.", |
| 20 | "publish": "Authenticate current head and registered assignment; read enabled assignment-state snapshot. Recompute/verify approved request/record/artifact/environment/input/recipient/worker-evidence bindings, persist encrypted private payload and immutable receipt create-only. CAS accepted reference into the SAME enabled assignment state using its ETag. This CAS is the acceptance point. CAS conflict requires fresh validation; never retry against a disabled snapshot. Identical publication-ID retry is idempotent; changed bytes conflict. Accepted result does not grant serving resume. Every change increments revision with checked overflow. An identical accepted reference is an idempotent read only; it must not write the same bytes or perform a no-op CAS. No accepted slot may be replaced.", |
| 21 | "projections": "Guard advances and public status/result projections happen only from accepted authoritative assignment-state refs. A projection alone is never accepted provenance. Missing/delayed projection is unavailable or pending until deterministic reconciliation. Current request/attempt checks prevent old accepted refs from entering a newer operation. Compatibility intermediate and final resume refs remain distinct as approved protocol requires; neither can be replaced with a terminal guard CAS alone. Status and result doors read the verified signed assignment state directly; guard projections cannot invent or erase accepted outcomes.", |
| 22 | "close": "An explicit idempotent reconciliation loop closes terminal/refused assignments, expired five-minute preflight assignments, and assignments whose 24-hour private payload has expired. First CAS state to disabled preserving all accepted references, reconcile any accepted terminal outcome, then CAS remove its exact reference from head.open. Never remove first. Re-read on every conflict, retaining other concurrent registrations. Reclaim all8 slots without losing crash recovery. Accepted resume requires the full existing resume evidence/lease conditions, not just a stored reference." |
| 23 | }, |
| 24 | "revocation": [ |
| 25 | "CAS head active->revoking, retaining exact open references and generation; this closes new registration/authentication. This starts revocation but does NOT claim all in-flight publication is yet cancelled.", |
| 26 | "For each registered assignment, CAS its authoritative state to disabled while preserving accepted refs. Publication and disable CAS share the same object: whichever wins is ordered first. A publisher authenticated before head revoking can still win until that assignment disable CAS; this is an in-flight accepted historical result, never a claim that head change immediately stopped it.", |
| 27 | "After disabling an assignment, re-read its signed authoritative state. If an execution acceptance won before disable, reconcile the matching guard to that actual accepted terminal outcome and evidence, even if the guard projection was delayed. Do not label that accepted outcome Ambiguous merely because revocation reached the guard first. If no accepted terminal result exists, preserve denial and use only the approved failure/ambiguous edges. Accepted resume must meet full existing resume conditions. Stale/absent guards cannot authorize changing another attempt; reconciliation handles a matching guard created after disable. No guard transition proves process stop or releases a lease.", |
| 28 | "Worker coordinator continuously checks assignment/enrollment validity and cancels active supervisor on revocation, uses checked tree termination and retains fence on uncertainty. Fresh owner recovery/resume still requires proven stop, retained lease and checkpoint/checker path; no automatic un-fence or mutation retry.", |
| 29 | "Only after all registered assignment states are disabled and matching deny projections reconciled, CAS head revoking->detached and clear open refs. Before then status remains revoking. Any console can idempotently resume a crashed revocation from retained head/open refs, without a process-local lock or second-console assumption." |
| 30 | ], |
| 31 | "bootstrap": "After observed isolation gate, worker durably creates once a random32-byte token in privatefile.CreateExclusiveDurable storage with protected parent, checked fsync and no replacement on restart. Candidate contains only hash, random candidate ID, physical identity/label and placement; publish through supported agent control-store path. Signed console-origin discovery uses reviewed existing root release signing wrapper, explicit kind, canonical HTTPS origin and persisted monotonic discovery watermark. Ops-owner workers admit selects exact candidate via supported CLI/API; no operator SSH/SSM step. Conflicting candidate/label refuses. Explicit detach/re-admit controls rotation; no self-reactivation. Candidate publication uses only the isolated candidate prefix, never worker head/assignment write credentials. Root-keyless consoles refuse all mutation doors.", |
| 32 | "assignment_and_execution": { |
| 33 | "owner_box": "Use stable logical box label (existing valid 1-32-character name), not fleet/label or fleet name. Existing guard continuity keeps OwnerBox fixed; replacing physical hardware under the same logical label requires explicit owner re-enrollment and a new credential generation. Changing logical label for an existing guard is unsupported until a reviewed guard migration.", |
| 34 | "immutable": "Server creates assignment bound to deployment origin, dedicated worker kind/ops account, logical box label, enrollment generation and token-hash identity, app/account/host, request/attempt, record identity/revision and exact placement observation. Request body copies do not select principal or assignment.", |
| 35 | "placement": "Region/pool metadata only establishes eligibility. Target refuses unless exactly one active enrolled shared/root worker matches authoritative deployment placement and current inventory. No first-claim selection. Owner approval binds assignment digest. Serving authority additionally requires global guard/projection, proven local stop and continuously retained per-host lease; enrollment never proves stop or lease ownership.", |
| 36 | "stop": "Use reviewed FenceAndStop and retained lease/executor evidence; missing activator entry is not stop evidence. No remote stop or inference from elapsed lease TTL. Checked quiescence must precede execution." |
| 37 | }, |
| 38 | "new_tests": [ |
| 39 | "two consoles publishing and disabling the same assignment in every CAS order", |
| 40 | "head revocation crash before assignment disable permits only already-inflight race until disable and never reports completed revocation", |
| 41 | "preflight/compatibility/execution/resume all use same authoritative state acceptance", |
| 42 | "missing head registration/orphan assignment denied", |
| 43 | "publication after assignment removed denied by closed state", |
| 44 | "all8 assignment refs retained/re-driven across revocation crash", |
| 45 | "projection lag cannot turn unaccepted receipt into success", |
| 46 | "wrong generation/box/attempt/recipient publication denied", |
| 47 | "signed control type confusion rejected", |
| 48 | "flat-layout/host-PID-visible tenant denies worker credential activation", |
| 49 | "candidate physical identity collision and explicit replacement rules", |
| 50 | "accepted terminal outcome survives revocation during projection lag", |
| 51 | "terminal/refused/expired reconciliation reclaims all8 open slots across crashes", |
| 52 | "registration retry retains one deterministic assignment identity", |
| 53 | "deployed worker IAM rejects replay of old signed head and enabled assignment", |
| 54 | "foreign/external route and console flat layout deny admission and decryption", |
| 55 | "layout revert refused with active/revoking head or retained worker token", |
| 56 | "revision overflow and identical-reference retry perform no state rewrite" |
| 57 | ], |
| 58 | "review_request": "Review revision3 corrections and the typed signed-record codec. Runtime admission remains gated on deployed IAM and platform126 isolation. No merge/deploy claim until full Fable approval and exact gates.", |
| 59 | "revert_interlock": "Platform126 integration must refuse layout revert for a box with active/revoking worker head. The box-side revert pass also refuses while a durable worker token exists. Console layout downgrade is refused while console worker-control signing/private-input capability is enabled. These are required admission/rollout interlocks, not optional diagnostics; old binaries unable to enforce them are ineligible." |
| 60 | } |
| 61 | |
amadan