admin/LithosAnanake
1
0
Fork 0
Code Issues Pull Requests Actions 15 Packages Projects Releases Wiki Activity

§H.12 steps 10-11: creator-ceiling enforcement, birth-time ACL snapshot

Browse Source 
dictionary_snapshot_acl_from_parent(child, parent): walks the child's
dictionary, copies acl_allow/acl_mode/acl_pinned/acl_ttl from the
parent's matching word (by name, via vm_find_word() -- FIND's own
lookup, not modified) onto the child's entry. One-time snapshot at
birth, no live sync, matching H.3's decided rationale (a program
developed against one ACL set must not have it silently changed by
later parent changes).

Called once, after dict_hash/parity logging rather than before -- the
snapshot depends on the parent's current ACL state, which can vary
run-to-run once Zuse elevations exist, so applying it earlier would
break the "same capsule twice produces the same dict hash" determinism
invariant.

Verified 3-arch boot to ok> (amd64/aarch64/riscv64).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Robert Allan James
2026-09-03 06:44:58 -04:00
co-authored by Claude Opus 5
parent ed86a759e1
commit a268abe925
10 changed files with 27624 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
FABRIC-3.md
+15 -5
View File
@@ -4024,11 +4024,21 @@ work, not new invention.
which also exercises 8 and 9 unchanged.
**Phase 4 — Creator-ceiling enforcement (H.3, birth-time snapshot)**
- [ ] **10.** `dictionary_snapshot_acl_from_parent(child, parent)`: for each word also present
in the parent's dictionary, copy `acl_allow`/`acl_mode`/`acl_pinned`/`acl_ttl` into the
child's matching entry.
- [ ] **11.** Call it once, right after a child's dictionary finishes loading in
`capsule_birth.c`.
- [x] **10. DONE 2026-09-03.** `dictionary_snapshot_acl_from_parent(child, parent)` added as a
static helper in `capsule_birth.c`: walks `child->latest`'s link chain, looks up each name
in `parent` via `vm_find_word()` (the same C-level lookup `FIND` itself uses — not a
modification to `FIND`, per the standing "never modify `FIND`" rule), copies
`acl_allow`/`acl_mode`/`acl_pinned`/`acl_ttl` onto the child's matching entry when found.
Baby-specific words the parent doesn't have are left untouched — nothing to cap them
against.
- [x] **11. DONE 2026-09-03.** Called once via `vm_find_entry_ptr(parent)` (the same internal
registry lookup `capsule_birth_mama()` already uses for Hera's own entry) to get the
parent's live `VM*`, right after `dict_hash`/parity logging — deliberately *after*, not
before: the snapshot depends on the parent's *current* ACL state, which can vary run-to-run
once Zuse-granted elevations exist, so applying it before the hash would make
`birth_dict_hash` no longer a pure function of capsule content, breaking the "same capsule
booted twice produces the same dict hash" determinism invariant this codebase relies on
elsewhere. Verified 3-arch boot to `ok>` (amd64/aarch64/riscv64).
**Phase 5 — `BMAPFMT` (§F.4/§H.6, independent, can run any time)**
- [ ] **12.** Edit `blk_meta_t` in `include/block_subsystem.h`: replace the old 4 ownership