lazaret/docs/protocol/Lazaret.cfg

CONSTANTS
    D1 = d1
    S1 = s1
    S2 = s2
    R1 = r1
    R2 = r2
    R3 = r3
    ExactCmd = exactCmd
    PromptCmd = promptCmd
    ShellCmd = shellCmd
    EditedCmd = editedCmd
    Identities <- IdentitiesFixture
    SessionAnchors <- SessionAnchorsFixture
    Domains <- DomainsFixture
    Sessions <- SessionsFixture
    Requests <- RequestsFixture
    Commands <- CommandsFixture
    NoSession = NoSession
    NoRequest = NoRequest
    NoCommand = NoCommand
    NoApproval = NoApproval
    SessionDomain <- SessionDomainFixture
    SessionFingerprint <- SessionFingerprintFixture
    DomainFingerprint <- DomainFingerprintFixture
    DomainCoordinatorIdentity <- DomainCoordinatorIdentityFixture
    DomainSidecarIdentity <- DomainSidecarIdentityFixture
    DomainSandboxIdentity <- DomainSandboxIdentityFixture
    SessionCliIdentity <- SessionCliIdentityFixture
    SessionAnchorIdentity <- SessionAnchorIdentityFixture
    CoordinatorCertificateValid <- CoordinatorCertificateValidFixture
    SidecarCertificateValid <- SidecarCertificateValidFixture
    SandboxCertificateValid <- SandboxCertificateValidFixture
    CliCertificateValid <- CliCertificateValidFixture
    ConfigSafe <- ConfigSafeFixture
    SandboxIsolationSafe <- SandboxIsolationSafeFixture
    RequestSession <- RequestSessionFixture
    RequestCommand <- RequestCommandFixture
    RequestSandboxIdentity <- RequestSandboxIdentityFixture
    RequestCliIdentity <- RequestCliIdentityFixture
    RequestSessionAnchor <- RequestSessionAnchorFixture
    RequestCredentialValid <- RequestCredentialValidFixture
    RequestSignatureValid <- RequestSignatureValidFixture
    ApprovalCliIdentity <- ApprovalCliIdentityFixture
    ApprovalSessionAnchor <- ApprovalSessionAnchorFixture
    ApprovalSignatureValid <- ApprovalSignatureValidFixture
    ApprovalCommand <- ApprovalCommandFixture
    AutoRuleMatches <- AutoRuleMatchesFixture
    CommandRequiresShell <- CommandRequiresShellFixture
    CommandContentSafe <- CommandContentSafeFixture

SPECIFICATION Spec
\* Fully closed application states intentionally have no successor.
CHECK_DEADLOCK FALSE

INVARIANTS
    TypeOK
    ConfigurationConfinement
    SandboxNamespaceIsolation
    OrderedNetworkStartup
    PublishedDomainsReady
    DomainLockLifetime
    RuntimeCausalEdgeArmedBeforeSandbox
    RuntimeCausalEdgeOwnerPresent
    SandboxRunningImpliesCoordinatorPresent
    PublishedRuntimeAuthorityPresent
    SupervisorLeaseConsistency
    RuntimeResourceOwnership
    CoordinatorPhysicalConsistency
    NoVanishPresentRuntime
    OrderedLeaseTeardown
    DomainGenerationBounds
    DurableIntentBeforeSandboxReady
    DurableDecisionPublicationConsistent
    PathMismatchNotAdopted
    ExclusiveBootstrapOwnership
    TeardownNotJoinable
    RegisteredSessionsConnected
    AttachedSessionsValid
    AuthenticatedRequestsOnly
    RuntimeRoleIdentitySeparation
    RegisteredSessionIdentityUniqueness
    LiveRequestIdentityAuthorized
    DeveloperApprovalAuthenticated
    HostExecutionAuthorized
    AutoApprovalNoShell
    TerminalIsolation
    NoOrphanHostProcess
    StateAnchorOwnership
    FailedDomainIsolation
    OrderedFailureRecovery
    ResultDeliveryStateConsistent

PROPERTIES
    SessionEventuallyResolves
    RequestEventuallyResolves
    PromptEventuallyRestoresTerminal
    EmptyDomainEventuallyStops
    FailedDomainEventuallyRecovers
docs: reorganize specification and model application protocol 2026-06-29 00:40:52 +09:00			`CONSTANTS`
			`D1 = d1`
			`S1 = s1`
			`S2 = s2`
			`R1 = r1`
			`R2 = r2`
			`R3 = r3`
			`ExactCmd = exactCmd`
			`PromptCmd = promptCmd`
			`ShellCmd = shellCmd`
			`EditedCmd = editedCmd`
docs: formalize protocol identity and transition to regular-file escalation mailbox - Replaces stream/socket escalation with a sandboxed regular-file Escalation Mailbox to satisfy runsc isolation boundaries without exposing `host-uds=open`. - Expands the TLA+ protocol model with role-bound certificates, tuple authorization, and structured domain-failure recovery paths. - Adds physical integration journals for host terminfo injection, persistent /etc DNS shims, rootless Podman network topology, and static client delivery. - Establishes specification requirements for safe host-only State Anchor inspection and crash-consistent reset operations. 2026-06-30 02:31:56 +09:00			`Identities <- IdentitiesFixture`
			`SessionAnchors <- SessionAnchorsFixture`
docs: reorganize specification and model application protocol 2026-06-29 00:40:52 +09:00			`Domains <- DomainsFixture`
			`Sessions <- SessionsFixture`
			`Requests <- RequestsFixture`
			`Commands <- CommandsFixture`
			`NoSession = NoSession`
			`NoRequest = NoRequest`
			`NoCommand = NoCommand`
			`NoApproval = NoApproval`
			`SessionDomain <- SessionDomainFixture`
			`SessionFingerprint <- SessionFingerprintFixture`
			`DomainFingerprint <- DomainFingerprintFixture`
docs: formalize protocol identity and transition to regular-file escalation mailbox - Replaces stream/socket escalation with a sandboxed regular-file Escalation Mailbox to satisfy runsc isolation boundaries without exposing `host-uds=open`. - Expands the TLA+ protocol model with role-bound certificates, tuple authorization, and structured domain-failure recovery paths. - Adds physical integration journals for host terminfo injection, persistent /etc DNS shims, rootless Podman network topology, and static client delivery. - Establishes specification requirements for safe host-only State Anchor inspection and crash-consistent reset operations. 2026-06-30 02:31:56 +09:00			`DomainCoordinatorIdentity <- DomainCoordinatorIdentityFixture`
			`DomainSidecarIdentity <- DomainSidecarIdentityFixture`
			`DomainSandboxIdentity <- DomainSandboxIdentityFixture`
			`SessionCliIdentity <- SessionCliIdentityFixture`
			`SessionAnchorIdentity <- SessionAnchorIdentityFixture`
			`CoordinatorCertificateValid <- CoordinatorCertificateValidFixture`
			`SidecarCertificateValid <- SidecarCertificateValidFixture`
			`SandboxCertificateValid <- SandboxCertificateValidFixture`
			`CliCertificateValid <- CliCertificateValidFixture`
docs: reorganize specification and model application protocol 2026-06-29 00:40:52 +09:00			`ConfigSafe <- ConfigSafeFixture`
docs: reconcile sandbox policy and protocol results 2026-06-29 01:12:48 +09:00			`SandboxIsolationSafe <- SandboxIsolationSafeFixture`
docs: reorganize specification and model application protocol 2026-06-29 00:40:52 +09:00			`RequestSession <- RequestSessionFixture`
			`RequestCommand <- RequestCommandFixture`
docs: formalize protocol identity and transition to regular-file escalation mailbox - Replaces stream/socket escalation with a sandboxed regular-file Escalation Mailbox to satisfy runsc isolation boundaries without exposing `host-uds=open`. - Expands the TLA+ protocol model with role-bound certificates, tuple authorization, and structured domain-failure recovery paths. - Adds physical integration journals for host terminfo injection, persistent /etc DNS shims, rootless Podman network topology, and static client delivery. - Establishes specification requirements for safe host-only State Anchor inspection and crash-consistent reset operations. 2026-06-30 02:31:56 +09:00			`RequestSandboxIdentity <- RequestSandboxIdentityFixture`
			`RequestCliIdentity <- RequestCliIdentityFixture`
			`RequestSessionAnchor <- RequestSessionAnchorFixture`
			`RequestCredentialValid <- RequestCredentialValidFixture`
			`RequestSignatureValid <- RequestSignatureValidFixture`
			`ApprovalCliIdentity <- ApprovalCliIdentityFixture`
			`ApprovalSessionAnchor <- ApprovalSessionAnchorFixture`
			`ApprovalSignatureValid <- ApprovalSignatureValidFixture`
			`ApprovalCommand <- ApprovalCommandFixture`
docs: reorganize specification and model application protocol 2026-06-29 00:40:52 +09:00			`AutoRuleMatches <- AutoRuleMatchesFixture`
			`CommandRequiresShell <- CommandRequiresShellFixture`
docs: formalize protocol identity and transition to regular-file escalation mailbox - Replaces stream/socket escalation with a sandboxed regular-file Escalation Mailbox to satisfy runsc isolation boundaries without exposing `host-uds=open`. - Expands the TLA+ protocol model with role-bound certificates, tuple authorization, and structured domain-failure recovery paths. - Adds physical integration journals for host terminfo injection, persistent /etc DNS shims, rootless Podman network topology, and static client delivery. - Establishes specification requirements for safe host-only State Anchor inspection and crash-consistent reset operations. 2026-06-30 02:31:56 +09:00			`CommandContentSafe <- CommandContentSafeFixture`
docs: reorganize specification and model application protocol 2026-06-29 00:40:52 +09:00
			`SPECIFICATION Spec`
docs: formalize protocol identity and transition to regular-file escalation mailbox - Replaces stream/socket escalation with a sandboxed regular-file Escalation Mailbox to satisfy runsc isolation boundaries without exposing `host-uds=open`. - Expands the TLA+ protocol model with role-bound certificates, tuple authorization, and structured domain-failure recovery paths. - Adds physical integration journals for host terminfo injection, persistent /etc DNS shims, rootless Podman network topology, and static client delivery. - Establishes specification requirements for safe host-only State Anchor inspection and crash-consistent reset operations. 2026-06-30 02:31:56 +09:00			`\* Fully closed application states intentionally have no successor.`
docs: reorganize specification and model application protocol 2026-06-29 00:40:52 +09:00			`CHECK_DEADLOCK FALSE`

			`INVARIANTS`
			`TypeOK`
			`ConfigurationConfinement`
docs: reconcile sandbox policy and protocol results 2026-06-29 01:12:48 +09:00			`SandboxNamespaceIsolation`
docs: reorganize specification and model application protocol 2026-06-29 00:40:52 +09:00			`OrderedNetworkStartup`
			`PublishedDomainsReady`
docs: record tier 5.7 runtime coupling model 2026-07-09 20:54:28 +09:00			`DomainLockLifetime`
			`RuntimeCausalEdgeArmedBeforeSandbox`
			`RuntimeCausalEdgeOwnerPresent`
			`SandboxRunningImpliesCoordinatorPresent`
			`PublishedRuntimeAuthorityPresent`
protocol: align SC vocabulary and durable intent with sealed product language Add SessionCoordinatorPresent aliases, HC protocol-face naming, and abstract durable intent/path-mismatch refuse invariants for FM1/FM4/FM5. TLC green at 395837 generated / 110013 distinct / depth 49. 2026-07-10 00:53:19 +09:00			`SupervisorLeaseConsistency`
			`RuntimeResourceOwnership`
			`CoordinatorPhysicalConsistency`
			`NoVanishPresentRuntime`
			`OrderedLeaseTeardown`
			`DomainGenerationBounds`
			`DurableIntentBeforeSandboxReady`
			`DurableDecisionPublicationConsistent`
			`PathMismatchNotAdopted`
docs: formalize protocol identity and transition to regular-file escalation mailbox - Replaces stream/socket escalation with a sandboxed regular-file Escalation Mailbox to satisfy runsc isolation boundaries without exposing `host-uds=open`. - Expands the TLA+ protocol model with role-bound certificates, tuple authorization, and structured domain-failure recovery paths. - Adds physical integration journals for host terminfo injection, persistent /etc DNS shims, rootless Podman network topology, and static client delivery. - Establishes specification requirements for safe host-only State Anchor inspection and crash-consistent reset operations. 2026-06-30 02:31:56 +09:00			`ExclusiveBootstrapOwnership`
			`TeardownNotJoinable`
docs: reorganize specification and model application protocol 2026-06-29 00:40:52 +09:00			`RegisteredSessionsConnected`
			`AttachedSessionsValid`
			`AuthenticatedRequestsOnly`
docs: formalize protocol identity and transition to regular-file escalation mailbox - Replaces stream/socket escalation with a sandboxed regular-file Escalation Mailbox to satisfy runsc isolation boundaries without exposing `host-uds=open`. - Expands the TLA+ protocol model with role-bound certificates, tuple authorization, and structured domain-failure recovery paths. - Adds physical integration journals for host terminfo injection, persistent /etc DNS shims, rootless Podman network topology, and static client delivery. - Establishes specification requirements for safe host-only State Anchor inspection and crash-consistent reset operations. 2026-06-30 02:31:56 +09:00			`RuntimeRoleIdentitySeparation`
			`RegisteredSessionIdentityUniqueness`
			`LiveRequestIdentityAuthorized`
			`DeveloperApprovalAuthenticated`
docs: reorganize specification and model application protocol 2026-06-29 00:40:52 +09:00			`HostExecutionAuthorized`
			`AutoApprovalNoShell`
			`TerminalIsolation`
			`NoOrphanHostProcess`
			`StateAnchorOwnership`
docs: formalize protocol identity and transition to regular-file escalation mailbox - Replaces stream/socket escalation with a sandboxed regular-file Escalation Mailbox to satisfy runsc isolation boundaries without exposing `host-uds=open`. - Expands the TLA+ protocol model with role-bound certificates, tuple authorization, and structured domain-failure recovery paths. - Adds physical integration journals for host terminfo injection, persistent /etc DNS shims, rootless Podman network topology, and static client delivery. - Establishes specification requirements for safe host-only State Anchor inspection and crash-consistent reset operations. 2026-06-30 02:31:56 +09:00			`FailedDomainIsolation`
			`OrderedFailureRecovery`
docs: reconcile sandbox policy and protocol results 2026-06-29 01:12:48 +09:00			`ResultDeliveryStateConsistent`
docs: reorganize specification and model application protocol 2026-06-29 00:40:52 +09:00
			`PROPERTIES`
			`SessionEventuallyResolves`
			`RequestEventuallyResolves`
			`PromptEventuallyRestoresTerminal`
			`EmptyDomainEventuallyStops`
docs: formalize protocol identity and transition to regular-file escalation mailbox - Replaces stream/socket escalation with a sandboxed regular-file Escalation Mailbox to satisfy runsc isolation boundaries without exposing `host-uds=open`. - Expands the TLA+ protocol model with role-bound certificates, tuple authorization, and structured domain-failure recovery paths. - Adds physical integration journals for host terminfo injection, persistent /etc DNS shims, rootless Podman network topology, and static client delivery. - Establishes specification requirements for safe host-only State Anchor inspection and crash-consistent reset operations. 2026-06-30 02:31:56 +09:00			`FailedDomainEventuallyRecovers`