admin/LithosAnanake
1
0
Fork 0
Code Issues Pull Requests Actions 16 Packages Projects Releases Wiki Activity

§H.12 step 20: CH-REQUEST initiator-only gate (MY-CH-ID)

Browse Source 
Added VARIABLE MY-CH-ID to messaging.4th (fail-closed -1 default) and
set it per-VM in hermes/init.4th and artemis/init.4th. CH-REQUEST now
refuses if the caller-supplied 'from' doesn't match the calling VM's
own id, closing a real spoofing gap found while implementing this.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QgooKd5hJNtTYqB6CyK5f9
This commit is contained in:
Robert Allan James
2026-09-03 12:09:29 -04:00
co-authored by Claude Sonnet 5
parent 7d53344875
commit cb6e079a73
12 changed files with 27708 additions and 95 deletions
Download Patch File Download Diff File Expand all files Collapse all files
FABRIC-3.md
+16 -2
View File
@@ -4140,8 +4140,22 @@ work, not new invention.
to `ok>` (amd64/aarch64/riscv64), each run in the foreground.
**Phase 7 — Message card gate + `ELEVATE-REQUEST` (H.8)**
- [ ] **20.** Add the initiator-only ACL gate at `CH-REQUEST`'s entry point
(default-permissive baseline, real hook point established).
- [x] **20. DONE 2026-09-03.** Found a real gap before writing this: `CH-REQUEST`'s `from`
parameter is a small numeric messaging "member id" (0/1/2 = Hera/Hermes/Artemis, per
`VM-NAMES-INIT`), but no canonical "this is my own id" fact existed anywhere — each VM's
init capsule just hardcoded numbers ad hoc for `CH-ADD-MBR`. Added `VARIABLE MY-CH-ID`
(`capsules/common/messaging.4th`, defaults to `-1` sentinel in `MSG-CD-INIT`, meaning
fail-closed until a VM sets its own), each VM's own init capsule sets it right after
`MSG-CD-INIT` (`1 MY-CH-ID !` in `hermes/init.4th`, `2 MY-CH-ID !` in `artemis/init.4th`
— Hera doesn't currently load `messaging.4th` at all, so nothing to set there). `CH-REQUEST`
now refuses (drops the whole stack frame) unless the caller-supplied `from` matches
`MY-CH-ID @` — stops a session from posting a commune request while claiming to be a
different VM. Passed `mkcapsule --lint` cleanly (caught and fixed two real violations along
the way: comment lines over the 64-char limit, and `MSG-CD-INIT` exceeding the 16-content-
line cap after the addition — merged two init lines onto one). Verified 3-arch boot to `ok>`
(amd64/aarch64/riscv64, each in the foreground); confirmed via the amd64 log that both
Hermes's and Artemis's `PARITY:BIRTH` still succeed (their init capsules, including the new
lines, compile and run cleanly).
- [ ] **21.** Define `ELEVATE-REQUEST` and a minimal real handler checking the eligibility
list, granting via `ACL-ALLOW!`/`ACL-TTL!` on match.
- [ ] **22.** Add the FORTH entrypoint a session actually calls to send one.