ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity
lazaret/docs/protocol/Lazaret.cfg

117 lines
4.1 KiB
INI
Raw Normal View History

docs: reorganize specification and model application protocol
2026-06-29 00:40:52 +09:00
CONSTANTS
D1 = d1
S1 = s1
S2 = s2
R1 = r1
R2 = r2
R3 = r3
ExactCmd = exactCmd
PromptCmd = promptCmd
ShellCmd = shellCmd
EditedCmd = editedCmd
docs: formalize protocol identity and transition to regular-file escalation mailbox - Replaces stream/socket escalation with a sandboxed regular-file Escalation Mailbox to satisfy runsc isolation boundaries without exposing `host-uds=open`. - Expands the TLA+ protocol model with role-bound certificates, tuple authorization, and structured domain-failure recovery paths. - Adds physical integration journals for host terminfo injection, persistent /etc DNS shims, rootless Podman network topology, and static client delivery. - Establishes specification requirements for safe host-only State Anchor inspection and crash-consistent reset operations.
2026-06-30 02:31:56 +09:00
Identities <- IdentitiesFixture
SessionAnchors <- SessionAnchorsFixture
docs: reorganize specification and model application protocol
2026-06-29 00:40:52 +09:00
Domains <- DomainsFixture
Sessions <- SessionsFixture
Requests <- RequestsFixture
Commands <- CommandsFixture
NoSession = NoSession
NoRequest = NoRequest
NoCommand = NoCommand
NoApproval = NoApproval
SessionDomain <- SessionDomainFixture
SessionFingerprint <- SessionFingerprintFixture
DomainFingerprint <- DomainFingerprintFixture
docs: formalize protocol identity and transition to regular-file escalation mailbox - Replaces stream/socket escalation with a sandboxed regular-file Escalation Mailbox to satisfy runsc isolation boundaries without exposing `host-uds=open`. - Expands the TLA+ protocol model with role-bound certificates, tuple authorization, and structured domain-failure recovery paths. - Adds physical integration journals for host terminfo injection, persistent /etc DNS shims, rootless Podman network topology, and static client delivery. - Establishes specification requirements for safe host-only State Anchor inspection and crash-consistent reset operations.
2026-06-30 02:31:56 +09:00
DomainCoordinatorIdentity <- DomainCoordinatorIdentityFixture
DomainSidecarIdentity <- DomainSidecarIdentityFixture
DomainSandboxIdentity <- DomainSandboxIdentityFixture
SessionCliIdentity <- SessionCliIdentityFixture
SessionAnchorIdentity <- SessionAnchorIdentityFixture
CoordinatorCertificateValid <- CoordinatorCertificateValidFixture
SidecarCertificateValid <- SidecarCertificateValidFixture
SandboxCertificateValid <- SandboxCertificateValidFixture
CliCertificateValid <- CliCertificateValidFixture
docs: reorganize specification and model application protocol
2026-06-29 00:40:52 +09:00
ConfigSafe <- ConfigSafeFixture
docs: reconcile sandbox policy and protocol results
2026-06-29 01:12:48 +09:00
SandboxIsolationSafe <- SandboxIsolationSafeFixture
docs: reorganize specification and model application protocol
2026-06-29 00:40:52 +09:00
RequestSession <- RequestSessionFixture
RequestCommand <- RequestCommandFixture
docs: formalize protocol identity and transition to regular-file escalation mailbox - Replaces stream/socket escalation with a sandboxed regular-file Escalation Mailbox to satisfy runsc isolation boundaries without exposing `host-uds=open`. - Expands the TLA+ protocol model with role-bound certificates, tuple authorization, and structured domain-failure recovery paths. - Adds physical integration journals for host terminfo injection, persistent /etc DNS shims, rootless Podman network topology, and static client delivery. - Establishes specification requirements for safe host-only State Anchor inspection and crash-consistent reset operations.
2026-06-30 02:31:56 +09:00
RequestSandboxIdentity <- RequestSandboxIdentityFixture
RequestCliIdentity <- RequestCliIdentityFixture
RequestSessionAnchor <- RequestSessionAnchorFixture
RequestCredentialValid <- RequestCredentialValidFixture
RequestSignatureValid <- RequestSignatureValidFixture
ApprovalCliIdentity <- ApprovalCliIdentityFixture
ApprovalSessionAnchor <- ApprovalSessionAnchorFixture
ApprovalSignatureValid <- ApprovalSignatureValidFixture
ApprovalCommand <- ApprovalCommandFixture
docs: reorganize specification and model application protocol
2026-06-29 00:40:52 +09:00
AutoRuleMatches <- AutoRuleMatchesFixture
CommandRequiresShell <- CommandRequiresShellFixture
docs: formalize protocol identity and transition to regular-file escalation mailbox - Replaces stream/socket escalation with a sandboxed regular-file Escalation Mailbox to satisfy runsc isolation boundaries without exposing `host-uds=open`. - Expands the TLA+ protocol model with role-bound certificates, tuple authorization, and structured domain-failure recovery paths. - Adds physical integration journals for host terminfo injection, persistent /etc DNS shims, rootless Podman network topology, and static client delivery. - Establishes specification requirements for safe host-only State Anchor inspection and crash-consistent reset operations.
2026-06-30 02:31:56 +09:00
CommandContentSafe <- CommandContentSafeFixture
Model terminal interaction authority and bounded verification
2026-08-02 14:02:32 +09:00
TerminalEventPlan <- TerminalNoEventPlanFixture
TerminalAuthorityPlan <- TerminalNoAuthorityPlanFixture
TerminalAdministrativeAuthorityValid <-
TerminalNoAdministrativeAuthorityValidFixture
Model terminal presentation ownership and restoration
2026-08-20 02:10:44 +09:00
TerminalPresentationPlan <- TerminalNoPresentationPlanFixture
Model terminal interaction authority and bounded verification
2026-08-02 14:02:32 +09:00
TerminalRoutingFault = "Correct"
docs: reorganize specification and model application protocol
2026-06-29 00:40:52 +09:00
SPECIFICATION Spec
docs: formalize protocol identity and transition to regular-file escalation mailbox - Replaces stream/socket escalation with a sandboxed regular-file Escalation Mailbox to satisfy runsc isolation boundaries without exposing `host-uds=open`. - Expands the TLA+ protocol model with role-bound certificates, tuple authorization, and structured domain-failure recovery paths. - Adds physical integration journals for host terminfo injection, persistent /etc DNS shims, rootless Podman network topology, and static client delivery. - Establishes specification requirements for safe host-only State Anchor inspection and crash-consistent reset operations.
2026-06-30 02:31:56 +09:00
\* Fully closed application states intentionally have no successor.
docs: reorganize specification and model application protocol
2026-06-29 00:40:52 +09:00
CHECK_DEADLOCK FALSE
INVARIANTS
TypeOK
Model actor-attributed terminal recovery
2026-07-29 00:39:06 +09:00
SessionTerminalPhysicalConsistency
docs: reorganize specification and model application protocol
2026-06-29 00:40:52 +09:00
ConfigurationConfinement
docs: reconcile sandbox policy and protocol results
2026-06-29 01:12:48 +09:00
SandboxNamespaceIsolation
docs: reorganize specification and model application protocol
2026-06-29 00:40:52 +09:00
OrderedNetworkStartup
PublishedDomainsReady
docs: record tier 5.7 runtime coupling model
2026-07-09 20:54:28 +09:00
DomainLockLifetime
RuntimeCausalEdgeArmedBeforeSandbox
RuntimeCausalEdgeOwnerPresent
SandboxRunningImpliesCoordinatorPresent
PublishedRuntimeAuthorityPresent
protocol: align SC vocabulary and durable intent with sealed product language Add SessionCoordinatorPresent aliases, HC protocol-face naming, and abstract durable intent/path-mismatch refuse invariants for FM1/FM4/FM5. TLC green at 395837 generated / 110013 distinct / depth 49.
2026-07-10 00:53:19 +09:00
SupervisorLeaseConsistency
RuntimeResourceOwnership
CoordinatorPhysicalConsistency
Check host coordinator domain ownership Add a TLC-checked invariant requiring any Host Coordinator process record to belong to a non-absent, lock-held Domain. Include the invariant in the aggregate safety operator and remove journal-only markers from protocol model comments so the model remains grounded in product vocabulary.
2026-07-10 01:42:26 +09:00
HostCoordinatorRequiresDomainOwnership
protocol: align SC vocabulary and durable intent with sealed product language Add SessionCoordinatorPresent aliases, HC protocol-face naming, and abstract durable intent/path-mismatch refuse invariants for FM1/FM4/FM5. TLC green at 395837 generated / 110013 distinct / depth 49.
2026-07-10 00:53:19 +09:00
NoVanishPresentRuntime
OrderedLeaseTeardown
DomainGenerationBounds
DurableIntentBeforeSandboxReady
DurableDecisionPublicationConsistent
PathMismatchNotAdopted
docs: formalize protocol identity and transition to regular-file escalation mailbox - Replaces stream/socket escalation with a sandboxed regular-file Escalation Mailbox to satisfy runsc isolation boundaries without exposing `host-uds=open`. - Expands the TLA+ protocol model with role-bound certificates, tuple authorization, and structured domain-failure recovery paths. - Adds physical integration journals for host terminfo injection, persistent /etc DNS shims, rootless Podman network topology, and static client delivery. - Establishes specification requirements for safe host-only State Anchor inspection and crash-consistent reset operations.
2026-06-30 02:31:56 +09:00
ExclusiveBootstrapOwnership
TeardownNotJoinable
docs: reorganize specification and model application protocol
2026-06-29 00:40:52 +09:00
RegisteredSessionsConnected
AttachedSessionsValid
AuthenticatedRequestsOnly
docs: formalize protocol identity and transition to regular-file escalation mailbox - Replaces stream/socket escalation with a sandboxed regular-file Escalation Mailbox to satisfy runsc isolation boundaries without exposing `host-uds=open`. - Expands the TLA+ protocol model with role-bound certificates, tuple authorization, and structured domain-failure recovery paths. - Adds physical integration journals for host terminfo injection, persistent /etc DNS shims, rootless Podman network topology, and static client delivery. - Establishes specification requirements for safe host-only State Anchor inspection and crash-consistent reset operations.
2026-06-30 02:31:56 +09:00
RuntimeRoleIdentitySeparation
RegisteredSessionIdentityUniqueness
LiveRequestIdentityAuthorized
DeveloperApprovalAuthenticated
docs: reorganize specification and model application protocol
2026-06-29 00:40:52 +09:00
HostExecutionAuthorized
AutoApprovalNoShell
TerminalIsolation
Model terminal presentation ownership and restoration
2026-08-20 02:10:44 +09:00
TerminalPresentationIsolation
Model terminal interaction authority and bounded verification
2026-08-02 14:02:32 +09:00
TerminalInteractionAuthoritySeparated
LocalTerminationAvailableWhileTransportBlocked
docs: reorganize specification and model application protocol
2026-06-29 00:40:52 +09:00
NoOrphanHostProcess
StateAnchorOwnership
docs: formalize protocol identity and transition to regular-file escalation mailbox - Replaces stream/socket escalation with a sandboxed regular-file Escalation Mailbox to satisfy runsc isolation boundaries without exposing `host-uds=open`. - Expands the TLA+ protocol model with role-bound certificates, tuple authorization, and structured domain-failure recovery paths. - Adds physical integration journals for host terminfo injection, persistent /etc DNS shims, rootless Podman network topology, and static client delivery. - Establishes specification requirements for safe host-only State Anchor inspection and crash-consistent reset operations.
2026-06-30 02:31:56 +09:00
FailedDomainIsolation
OrderedFailureRecovery
docs: reconcile sandbox policy and protocol results
2026-06-29 01:12:48 +09:00
ResultDeliveryStateConsistent
Select multi-process SC architecture and align protocol model Promote Host Coordinator + Runtime Supervisor + attached runsc as the product architecture in the specification, and extend the TLA+ model with generation-scoped identities, multi-role durable intent, network readiness, prepared-lower lease, and connectivity-helper ownership. TLC-checked; trim product prose that the model now owns.
2026-07-10 02:37:48 +09:00
MultiRoleDurableIntent
Refine rootless and network readiness contracts Correct the caller-configured user-namespace topology, bind modeled network readiness to the live sandbox and helper, and keep physical canary, topology, encoding, and capability predicates in compact specification tables below the model boundary.
2026-07-19 19:52:41 +09:00
NetworkReadinessBoundToSandbox
Select multi-process SC architecture and align protocol model Promote Host Coordinator + Runtime Supervisor + attached runsc as the product architecture in the specification, and extend the TLA+ model with generation-scoped identities, multi-role durable intent, network readiness, prepared-lower lease, and connectivity-helper ownership. TLC-checked; trim product prose that the model now owns.
2026-07-10 02:37:48 +09:00
GenerationScopedIdentitiesDistinct
HelperUnderSupervisor
PreparedLowerLeaseBeforeMount
NetworkReadyBeforePublish
docs: reorganize specification and model application protocol
2026-06-29 00:40:52 +09:00
PROPERTIES
SessionEventuallyResolves
RequestEventuallyResolves
PromptEventuallyRestoresTerminal
EmptyDomainEventuallyStops
docs: formalize protocol identity and transition to regular-file escalation mailbox - Replaces stream/socket escalation with a sandboxed regular-file Escalation Mailbox to satisfy runsc isolation boundaries without exposing `host-uds=open`. - Expands the TLA+ protocol model with role-bound certificates, tuple authorization, and structured domain-failure recovery paths. - Adds physical integration journals for host terminfo injection, persistent /etc DNS shims, rootless Podman network topology, and static client delivery. - Establishes specification requirements for safe host-only State Anchor inspection and crash-consistent reset operations.
2026-06-30 02:31:56 +09:00
FailedDomainEventuallyRecovers
Separate lease-loss release and finalize session terminals
2026-07-12 01:27:19 +09:00
LeaseLossUnmountRetainsPreparedLowerLease
Model actor-attributed terminal recovery
2026-07-29 00:39:06 +09:00
PreIdentityExitEventuallyCleansAfterRuntimeAbsence
Copy permalink