From 6341b3b3dd40cc447ecac072bfb61f6c38a68912 Mon Sep 17 00:00:00 2001 From: Robert Allan James Date: Wed, 26 Aug 2026 06:17:56 -0400 Subject: [PATCH] FABRIC-3.md: decide EXPIRE's design questions -- defer to Phase 8 Decided directly on request, no code written. "ACLs -> EXPIRE" isn't wrong in spirit but was aimed at the wrong unit: acl_ttl-hits-zero always renews (never revokes), so it can't carry EXPIRE's residency-ending meaning. The unit that actually has a real lifetime and should be revoked is a zuse superuser session (Phase 8, not yet built) -- authenticate, hold elevated privilege for a bounded time, then actually drop back to non-zuse. Resolves to: admit the session (not a per-word ACL entry, which would be redundant with item 4.1's existing word patrons) as the Stadium patron, once Phase 8 exists. Not in scope now -- there is no session to admit regardless of any other choice, and building Stadium's missing generic ttl-decrement/reap mechanism ahead of its only real consumer would be speculative infrastructure, the same shape of premature build the no-stubs standard exists to prevent, just inverted. EXPIRE stays explicitly deferred until Phase 8 lands, with a concrete trigger for revisiting it -- not abandoned, not left ambiguous. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01CXjAPTEKrgY2Mrk25KoLDn --- FABRIC-3.md | 30 ++++++++++++++++++++++++++---- 1 file changed, 26 insertions(+), 4 deletions(-) diff --git a/FABRIC-3.md b/FABRIC-3.md index 6a03c97..436016a 100644 --- a/FABRIC-3.md +++ b/FABRIC-3.md @@ -413,8 +413,9 @@ other three become honest, explicit punch-list items instead of being touched sp `COOL identity=1` at a second channel eviction — conservation intact throughout. Clean zero-warning compile and clean boot on all three architectures for both fixes. - [ ] `EXPIRE` (ACL) — confirmed genuinely unscoped (2026-08-26), not a case of stale - documentation like `DELIVER` turned out to be. Two findings, then four open questions that - need a real decision before any code: + documentation like `DELIVER` turned out to be. Two findings below, then four open questions + — **decided directly on request (2026-08-26)**, decision recorded after the questions, no + code written (a decision isn't a green light to build, per this session's own convention): **Finding 1 — `acl_ttl` and Stadium's `ttl` are different things wearing the same name.** `DictEntry.acl_ttl` (`vm_core.c:756`) is a per-word countdown that batches how often @@ -445,8 +446,29 @@ other three become honest, explicit punch-list items instead of being touched sp 4. What should the reap action actually *do*, given current ACL policy never revokes — would `EXPIRE` force an `ACL-RECHECK`, or something else entirely? - Current read: this fits more naturally after Phase 8's session/identity work lands than as a - word-scoped patron today. Stays open until these are decided. + **Decision:** + 1. Not at the per-word level. `acl_ttl`-hits-zero always renews, never revokes — forcing + `EXPIRE`'s residency-ending tag onto it would misuse the tag. But "ACLs → EXPIRE" isn't + wrong in spirit, just aimed at the wrong unit: the one place in this system where + something ACL-related genuinely has a lifetime and should be revoked is a **zuse + superuser session** (Phase 8, not yet built) — authenticate, hold elevated privilege for + a bounded time, then actually drop back to non-zuse. That's a real residency-ending + event; per-word recheck isn't. + 2. A zuse session, not a per-word ACL entry — a session is the thing with a genuine + start/lifetime/end. A word already has its own patron via item 4.1; a second one for ACL + purposes would be redundant bookkeeping, not a new concept. + 3. **Not in scope now.** This is the decision that actually resolves the item: Phase 8 + doesn't exist yet, so there is no session to admit as a patron regardless of any other + choice made here. Building the generic ttl-decrement/reap mechanism now, with nothing + real to feed it, would be speculative infrastructure ahead of its only consumer — close + in spirit to what the no-stubs standard exists to prevent, just inverted (a real + mechanism with no real caller, instead of a fake mechanism with a real caller). + 4. Revoke the session's elevated privilege and drop the console back to its non-zuse state — + a real action, unlike `DELIVER`/`COOL`, which needed none. + + **`EXPIRE` stays explicitly deferred until Phase 8 (PKI/zuse session minting) lands** — not + abandoned, not left ambiguous: revisit it as part of that work, admitting the session itself + (not a word) as the patron, once there is something real for it to represent. - [x] Fixed (2026-08-26): `ONTOLOGY.md` §IX's "words (dictionary, warehouse-resident today, not yet migrated)" line was stale — corrected to state words are fully migrated and live via `stadium_word_dispatch()`. Doc-only, no build/boot verification needed.