| 1 | { |
| 2 | "status": "Proposed private adapter component; no command or HTTP mounting", |
| 3 | "parents": [ |
| 4 | "Home startup6289db0 with Fable approval", |
| 5 | "Opened DB4770bc6", |
| 6 | "Operator/provisioner898fe219" |
| 7 | ], |
| 8 | "configuration": { |
| 9 | "source": "HOME_OPERATOR_COMMAND from the worker's immutable protected app environment; never argv or signed-request fields", |
| 10 | "wire": "UTF-8 JSON at most8192 bytes; duplicate, unknown and missing fields refuse", |
| 11 | "fields": [ |
| 12 | "version=1", |
| 13 | "account", |
| 14 | "app", |
| 15 | "host", |
| 16 | "role", |
| 17 | "origin", |
| 18 | "installation", |
| 19 | "registry", |
| 20 | "device", |
| 21 | "public_key", |
| 22 | "key_id", |
| 23 | "actions" |
| 24 | ], |
| 25 | "validation": "Shared route validators, existing NewVerifier role/origin/identity/key/action checks, and exact derived key ID match. No default, trust-on-first-input or key rotation by request.", |
| 26 | "origin_and_host": "Transport host names the deployment endpoint; signed origin is the canonical Home identity origin and can differ during preview/custom-host routing. Both are independently pinned from protected configuration and matched against their corresponding transport or signed fields; neither is derived from the other." |
| 27 | }, |
| 28 | "ordering": [ |
| 29 | "Parse protected configuration and build the existing signature verifier before database access.", |
| 30 | "Consume reviewed private startup transport; preserve /dev/null reservations on fd0/3/4 until the database baseline.", |
| 31 | "Match launch account/app/host against protected configuration; verify exact signed Home request using pinned role/origin/actions/installation/registry/device/key.", |
| 32 | "Only then construct the opened-DB connector for context path/device/inode, bounded by the earlier caller/launch deadline.", |
| 33 | "Keep platform request/attempt IDs distinct from the signed Home operation ID; retain exact private signed bytes for the existing transactional engine.", |
| 34 | "Final cleanup checks pinned database identity, closes the database and clears retained private byte buffers; any uncertain cleanup/deadline yields unavailable, never a successful result." |
| 35 | ], |
| 36 | "replay": "Expired authentic requests remain eligible for the existing engine's exact committed-result recovery. The adapter does not grant freshness or execute a mutation. The engine separately enforces freshness before a new operation.", |
| 37 | "tests": "Real inherited-descriptor subprocesses plus Linux inotify IN_OPEN prove wrong signer, signed scope, configuration and transport scope refuse before any database open. Actual pinned modernc connection accepts the valid path; wrong inode is opened only for identity refusal. Closed config tests cover every missing field, duplicates, unknown fields, trailing data and key mismatch. Real subprocess cleanup refuses a swapped database and expired caller deadline, refuses a second close, and parent checks original rows unchanged. Descriptor tests pair controlled and default Go runtime settings. Oversized valid JSON is refused.", |
| 38 | "remaining": [ |
| 39 | "Fable approval of configuration alignment and component", |
| 40 | "Final fixed command dispatch, role-specific key/sealer/owner resolver and schema checks", |
| 41 | "Native worker authentication, owner approval, lease/fence/checkpoint and resume workflow", |
| 42 | "Whole integration/canary validation before any live invocation" |
| 43 | ] |
| 44 | } |
| 45 | |
amadan