Create ephemeral trust anchors, publish an exact-profile Unix control socket, and persist generation-authorized mTLS session registration through the Domain Store.
Replace the old spikes/ ignore with scratchpad (development-scratchpad repo)
and keep docs/journal ignored. Combines the parallel local and origin tips
that both only adjusted these .gitignore entries.
Promote Host Coordinator + Runtime Supervisor + attached runsc as the product
architecture in the specification, and extend the TLA+ model with generation-scoped
identities, multi-role durable intent, network readiness, prepared-lower lease, and
connectivity-helper ownership. TLC-checked; trim product prose that the model now owns.
Add a TLC-checked invariant requiring any Host Coordinator process record to belong to a non-absent, lock-held Domain. Include the invariant in the aggregate safety operator and remove journal-only markers from protocol model comments so the model remains grounded in product vocabulary.
Add SessionCoordinatorPresent aliases, HC protocol-face naming, and abstract
durable intent/path-mismatch refuse invariants for FM1/FM4/FM5. TLC green at
395837 generated / 110013 distinct / depth 49.
Journal content now lives in development-journal/lazaret. docs/journal
is a local symlink and is gitignored so narrative work stays out of
project history going forward.
- Replaces stream/socket escalation with a sandboxed regular-file Escalation Mailbox to satisfy runsc isolation boundaries without exposing `host-uds=open`.
- Expands the TLA+ protocol model with role-bound certificates, tuple authorization, and structured domain-failure recovery paths.
- Adds physical integration journals for host terminfo injection, persistent /etc DNS shims, rootless Podman network topology, and static client delivery.
- Establishes specification requirements for safe host-only State Anchor inspection and crash-consistent reset operations.
