shoney.arickathil
57b4b56eae
- done/ (11): 1, 2, 3, 4, 6, 7, 7b, 9, 9b, 15, 16 — landed iterations (9/9b remainders live in the post-12 drain list, not in the files) - refine/ (8): 9c, 9d, 9e, 9f, 9g, 11, 13, 14 — everything marked "no spec yet / brainstorm before planning" - root keeps: 00-story (index), 05 (partial, plan 8 open), 8/10/12 (specs or plans exist), 17 (parked, spec+plan approved), 18 (next) - every cross-reference re-pathed and VERIFIED resolving: board, specs, plans, employee-list README, story table, intra-story links (moved files' relative links deepened one level; done/7b's 9e pointer now crosses to refine/) - pre-existing dead link noted, not touched: refine/11-fibers.md points at docs/plan/exploration/fibers/00-fibers.md which does not exist (predates the move) Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2.4 KiB
employee-list — program B: attach, authenticate, read
Status: target workload — does not compile on today's toolchain. Written ahead of iterations 9c (cross-program tables) and 9d (keypair attach auth), the way every acceptance sample here precedes its features. It also leans on 9/9b (the employee sample it attaches to must run first).
Two programs, one database, one writer:
employee (A) employee-list (B)
owns WO_DATA + WAL no database of its own
[share] listen = unix:...sock [connect.employee] ipc = unix:...sock
[[share.clients]] public_key = <A's fingerprint, pinned>
public_key = <B's fingerprint> project = ../employee (shapes)
rights = "read"
▲ │
└── every statement executes here ◄───┘ (typed, over the wire)
The manifests are the design: A grants, B pins. A's [share] names B's
public-key fingerprint with rights (read here); B's [connect.employee]
names A's IPC string AND A's fingerprint, so neither side talks to an
impostor. Fingerprints are printed by each program's --identity after
first boot (keys are generated into WO_DATA, never written into a toml)
and pasted — the PASTE-…-HERE placeholders mark exactly where. The
connect-section name is the code's namespace: [connect.employee] is why
the source says employee.Employee.
| Mode | What it proves |
|---|---|
employee-list list |
typed reads over the wire, e.dept.name ref navigation executing inside A |
employee-list report |
byte-identical output to A's own report — attach + GroupBy compose, the wire changes nothing |
employee-list staff <dept> |
unique-name index probe + staff backlink scan, both in A |
employee-list probe-write |
the rights matrix: registered read-only, so the insert traps with access-denied (caught, DENIED …, exit 4) and A's row count is unchanged |
The 9d acceptance drives the rest from the outside: wrong key, no key, same-uid-wrong-key, impostor socket, handshake replay, key rotation — see the iteration's criteria; this sample is the workload they run against.