From 89723793fe948bf1fd9130290bc090564cb032bf Mon Sep 17 00:00:00 2001 From: Robert Allan James Date: Wed, 26 Aug 2026 03:07:18 -0400 Subject: [PATCH] FABRIC-3.md: full EXPIRE scoping -- two findings, four open design questions Investigated on request. acl_ttl (DictEntry, per-word ACL-RECHECK amortization) and StadiumPatronHeader.ttl (residency countdown) are different mechanisms wearing the same name -- ACL-RECHECK always renews (allow=1, fresh ttl), never revokes, so it doesn't resemble a reap event at all. Separately, StadiumPatronHeader.ttl is completely inert across the whole codebase: every candidate constructor sets it to 0, nothing ever reads or decrements it -- the generic TTL-expiry mechanism EXPIRE would fire from doesn't exist in Stadium's own engine yet, a gap one level deeper than "ACL isn't wired to Stadium." Recorded four open questions that need a real decision before any code: whether "ACL patron" is even the right model, what unit would be admitted (redundant per-word vs. a session-scoped patron once Phase 8 PKI/zuse work lands), whether building Stadium's missing generic ttl-reap mechanism is in scope here, and what the reap action should actually do given ACL policy never revokes today. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01CXjAPTEKrgY2Mrk25KoLDn --- FABRIC-3.md | 40 ++++++++++++++++++++++++++++++++++------ 1 file changed, 34 insertions(+), 6 deletions(-) diff --git a/FABRIC-3.md b/FABRIC-3.md index e6f270a..fd5540c 100644 --- a/FABRIC-3.md +++ b/FABRIC-3.md @@ -409,12 +409,40 @@ other three become honest, explicit punch-list items instead of being touched sp printing `(stub)` — out of scope for this pass, noted in `stadium.c`'s own comment. Clean zero-warning compile and clean boot with conservation intact on all three architectures. - [ ] `EXPIRE` (ACL) — confirmed genuinely unscoped (2026-08-26), not a case of stale - documentation like `DELIVER` turned out to be: zero mentions of Stadium anywhere in - `ACL.4th`, `acl_recheck()`, or the ACL design doc. `DictEntry.acl_ttl` (per-word ACL - recheck) is a completely separate mechanism from `StadiumPatronHeader.ttl` (unused by every - caller today, always set to 0). Needs real design decisions before any code: would an - ACL-guarded word be admitted as its own Stadium patron, keyed how, and what would "expire" - mean as a reap action (revoke a permission? reset `acl_ttl`?). Stays open until decided. + documentation like `DELIVER` turned out to be. Two findings, then four open questions that + need a real decision before any code: + + **Finding 1 — `acl_ttl` and Stadium's `ttl` are different things wearing the same name.** + `DictEntry.acl_ttl` (`vm_core.c:756`) is a per-word countdown that batches how often + `ACL-RECHECK` runs — when it hits 0, `acl_recheck()` calls the FORTH word `ACL-RECHECK` + (`ACL.4th:50`), which **always renews**: STRICT mode sets `allow=1, ttl=0` (recheck every + time); TTL mode computes a fresh heat-based TTL and sets `allow=1`. Denial isn't a live path + anywhere in current policy. This is a *renewal* cycle, not a *residency-ending* event — + nothing about it resembles "leaving the Stadium floor." + + **Finding 2 — `StadiumPatronHeader.ttl` is completely inert.** Every candidate constructor + across the whole codebase (`stadium.c`, `stadium_words.c`, `stadium_blocks.c`, Hermes's + `MSG-ALLOC`/`CH-ALLOC`) sets `candidate.ttl = 0`, and nothing anywhere ever reads, + decrements, or reaps on it. The generic TTL-expiry *mechanism* `EXPIRE` would need to fire + from doesn't exist in Stadium's own engine at all — a gap one level deeper than "ACL isn't + wired to Stadium." + + **Open questions:** + 1. Is "ACL patron" even the right model, or was `FABRIC.md`'s original "ACLs → EXPIRE" + mapping a category mismatch from the start — conflating `acl_ttl`'s recheck-amortization + counter with Stadium's residency `ttl`? + 2. If it is the right model: what gets admitted as a patron? One per ACL-guarded word would + be redundant with the word's own patron cell item 4.1 already tracks. A different unit + (e.g. per zuse session) might fit better once PKI/session auth lands (Phase 8, still + open per `.claude/CLAUDE.md`'s ACL section). + 3. Building this for real means building Stadium's generic ttl-decrement/reap-on-zero + mechanism first — nothing to hook `EXPIRE` into today. Is that in scope here, or its own + separate item? + 4. What should the reap action actually *do*, given current ACL policy never revokes — would + `EXPIRE` force an `ACL-RECHECK`, or something else entirely? + + Current read: this fits more naturally after Phase 8's session/identity work lands than as a + word-scoped patron today. Stays open until these are decided. - [x] Fixed (2026-08-26): `ONTOLOGY.md` §IX's "words (dictionary, warehouse-resident today, not yet migrated)" line was stale — corrected to state words are fully migrated and live via `stadium_word_dispatch()`. Doc-only, no build/boot verification needed.