shoney.arickathil
296efb52ed
- story 02: `status: done`, `review_pending` (forks 1–7 auto-approved for
autonomy); progress rows 6a ✅, 6b ➡ databasev2 5 Phase A, 7 `a310496`;
5c/5d rows cite the `dev` hashes (the pre-merge ones were unreachable);
task 6a's Given/When/Then met; Info records the seven forks (sentinel over
`:memory:`, its rules, the refusal contract, startup-only, the budget
leaves for 5, library-owned tables bind consumers, the v8 table bit);
History keeps the first cut that refused every class-bearing program
- database/src/CODE-LOGIC.md: "Startup refusal + WO_EPHEMERAL" — contract,
hatch, table bit, measured blast radius, deferred items, proof; the
dispatcher paragraph no longer says a failed commit un-applies the row
(fatal since databasev2 4 part A; WO_T_IO unreachable from a write path)
- residency spec + plan: task 6 items annotated with the 2026-09-09
decisions; the byte budget marked moved to databasev2 5
- README, seven example READMEs and four guides carry the one-line rule
(durable default refuses without WO_DATA; WO_EPHEMERAL=1; durable:
false); shop's RAM-only command sets the sentinel
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
(cherry picked from commit 2c3531998124042fe736388e8b926abda3841194)
|
||
|---|---|---|
| .. | ||
| main.wo | ||
| README.md | ||
| wo.toml | ||
employee-list — program B: attach, authenticate, read
Status: target workload — does not compile on today's toolchain. Written ahead of iterations 9 (cross-program tables) and 10 (keypair attach auth), the way every acceptance sample here precedes its features. It also leans on 9/9b (the employee sample it attaches to must run first).
Two programs, one database, one writer:
employee (A) employee-list (B)
owns WO_DATA + WAL no database of its own
[share] listen = unix:...sock [connect.employee] ipc = unix:...sock
[[share.clients]] public_key = <A's fingerprint, pinned>
public_key = <B's fingerprint> project = ../employee (shapes)
rights = "read"
▲ │
└── every statement executes here ◄───┘ (typed, over the wire)
The manifests are the design: A grants, B pins. A's [share] names B's
public-key fingerprint with rights (read here); B's [connect.employee]
names A's IPC string AND A's fingerprint, so neither side talks to an
impostor. Fingerprints are printed by each program's --identity after
first boot (keys are generated into WO_DATA, never written into a toml)
and pasted — the PASTE-…-HERE placeholders mark exactly where. The
connect-section name is the code's namespace: [connect.employee] is why
the source says employee.Employee.
B declares the shapes but stores nothing, so it runs under WO_EPHEMERAL=1: a
program with any durable table (the default) refuses to start without
WO_DATA; WO_EPHEMERAL=1 opts into a RAM-only run, @table(durable: false)
opts a table out.
| Mode | What it proves |
|---|---|
employee-list list |
typed reads over the wire, e.dept.name ref navigation executing inside A |
employee-list report |
byte-identical output to A's own report — attach + GroupBy compose, the wire changes nothing |
employee-list staff <dept> |
unique-name index probe + staff backlink scan, both in A |
employee-list probe-write |
the rights matrix: registered read-only, so the insert traps with access-denied (caught, DENIED …, exit 4) and A's row count is unchanged |
The 21 acceptance drives the rest from the outside: wrong key, no key, same-uid-wrong-key, impostor socket, handshake replay, key rotation — see the iteration's criteria; this sample is the workload they run against.