Research: monitor-claim Queen death to dormant-token invalidation #13
Labels
No labels
Compat/Breaking
Kind/Bug
Kind/Documentation
Kind/Enhancement
Kind/Feature
Kind/Security
Kind/Testing
Meta/Campaign
Meta/Epic
Meta/Session
Priority/Critical
Priority/High
Priority/Low
Priority/Medium
Reviewed/Confirmed
Reviewed/Curated
Reviewed/Duplicate
Reviewed/Invalid
Reviewed/Won't Fix
Scope/Campaign
Status/Abandoned
Status/Blocked
Status/Conflicted
Status/In Progress
Status/In Review
Status/Need Grooming
Status/Need More Info
Status/Ready
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
Ting/Vedanta#13
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Proposal
Define and prove the monitor-claim path that transitions a workflow to dormant when its Queen process dies, then triggers invalidation of that workflow’s agent JWTs. This is separate from #8’s Kanidm service-account token lifecycle and from #12’s OpenBao plugin.
Design
monitorclaim. It has no authority to mint, rotate, read, or broadly invalidate credentials.Owner ruling (2026-09-03), Q3 — the invalidation plane. A Queen death reaches the ratified resource-lease plane only: OpenBao leases and the exact downstream resource-token IDs those leases name. The separate principal-authentication JWT plane is out of scope for this record, and adding it requires an explicit ruling naming its issuer, its signing key, and its revocation boundary. Until that ruling exists, no dormancy path may invalidate a principal-auth JWT, and a monitor event that appears to demand one is a contract error rather than a wider grant.
Tasks
Specification Delta
Requirement: a Queen death enters dormancy without granting token administration
monitorclaimRequirement: dormancy does not reach the principal-authentication plane
Requirement: normal closure remains Queen authority
Grooming state: Q3 ratified; the record still needs its probe and the research recast.
Evidence: The checked Vordr runtime has an in-process Queen fleet, a drone-birth sentinel, and explicit operator restart, but no VM-level Queen monitor, monitor-claim signer, dormant-workflow store, or Queen-death route. Ratified OpenSpec 61 v0.1.4 makes OpenBao the workload-facing lease authority and Vedanta the private exact resource-token effector.
Frontier
Q3 — invalidation plane. Ratified (Larandar, 2026-09-03): this record stays on the ratified resource-lease plane — OpenBao leases plus the exact downstream resource-token IDs they name. The principal-authentication JWT plane is excluded; adding it requires an explicit ruling naming issuer, signing key, and revocation boundary. Recorded in Design, with a new Specification Delta requirement and a task proving no dormancy path reaches that plane.
Q4 — deferred. Dormant-state/control-plane ownership is chosen only if Q1 leaves multiple concrete implementations.
Investigation
Q1 — probe, not an owner question. Identify the actual Queen runtime/process boundary, authoritative death signal, monitor identity/key source, output schema, and evidence landing place. Include the vordr#93 late-observer false-positive regression.
Q2 — deferred. The dormancy handoff cannot be chosen until Q1 yields concrete boundaries.
Proposal
Recast this issue as a bounded research probe with declared result columns and closing-comment landing; derive isolated implementation leaves only after the probe. Accept if no authoritative monitor boundary already exists; reject if a deployed monitor contract is found. Status/Need More Info lifted — no owner question remains. Status/Need Grooming stands until the probe runs and the record is recast.
larandar referenced this issue2026-08-30 12:05:14 +00:00
larandar referenced this issue2026-09-03 18:25:13 +00:00
Q1 probe result — 2026-09-04
Source:
swarm/vordrat000b1bb, static read of the tree. No running system was inspected, and nothing here rests on a live observation.The finding that moves this record
There is no Queen process, so there is nothing to observe dying.
queen.Queenis a Go interface — "the live set of drones and the thing that conducts them". It has no process, no PID, no supervisor, no exit status.os/execappears in exactly four files (harness/preset.go,kitten/cmd/vordr/main.go,kitten/tui/tui.go,zmx/cli.go), and every one of them spawns a drone or the frontend itself. Nothing spawns a queen.A queen lives inside whatever process hosts it, and the package doc names the reference host: "Nothing in the core imports queen — only a frontend may, and the kitten is the reference one." So "the Queen died" is not an event about a queen at all. It is the kitten exiting, taking every queen and every in-process drone reference with it.
This record's design — "a VM-level liveness monitor observes process death" and emits "an authenticated Queen-death event" — has no referent in the deployed runtime. It is not unbuilt; it is describing a boundary that does not exist.
What the sentinel actually is
warden.Sentinelis a drone-birth sentinel, not a death monitor, and its subject is a drone rather than a queen. It counts printable bytes in a drone's PTY output within a 15-second grace and reportsStatusErrorif none arrive.Its reasoning is worth reading before anyone proposes reusing it: "a drone wedged at birth is not silent" — zmx with
fishemits sixty-two bytes of terminal negotiation and not one printable character, forever. So "has it produced output" answers yes for a drone that will never start, and the sentinel asks "has it produced anything a human would see" instead.The vordr#93 late-observer regression is handled, and is drone-scoped.
Arm()re-checks under the lock rather than trusting the select, because a deadline and a disarm can become ready in the same instant andselectpicks at random: "A drone torn down exactly as its grace expires must not be reported dead, and 'almost never' is not the same as 'never' across a fleet." Nothing about it generalises to queens — it observes a PTY that a queen does not have.Result columns
monitorclaimSentinel.Arm, for drones onlyWhat this leaves
Q3 was already ratified — the invalidation plane stops at OpenBao leases and exact resource-token IDs. That ruling stands and is unaffected.
Q1 and Q2 are answered in the negative, which changes the record rather than completing it. This is no longer a Deliverable waiting on a probe; it is a proposal that a monitor boundary should exist. Building it means deciding what hosts a queen, whether that host has an identity, and what would sign an event — none of which vordr answers today, and none of which is Vedanta's to decide alone.
➡️ Recast as a design question for the runtime owner, or close as superseded. The
Status/Need Groominglabel stands either way; what it needs is not more grooming of this text but a ruling on whether the estate wants a queen-death boundary at all, given that a queen is currently a variable inside a TUI.Correction to the probe above — 2026-09-04
Freeholder correction: vordr is a spike. Its current shape is not the final state.
The observations in the previous comment stand as observations —
queen.Queenis an in-process interface today,os/execspawns only drones and the frontend, and there is no monitor identity or event schema in that tree. What does not stand is what I concluded from them.The error. I wrote that this record "describes a boundary that does not exist" and recommended recasting it as a design question or closing it as superseded. That converts "the spike has not built this" into "the architecture does not have this", which the evidence does not support. A spike is a thing built to answer a founding question, not a statement about what the runtime will hold; absence in it is absence of a decision, not a decision against.
What the probe actually established, restated honestly:
warden.Sentinel's scope is genuinely drone-birth rather than queen-death, and the vordr#93 late-observer fix is genuinely drone-scoped. Those hold regardless of what the runtime becomes, and are the reusable part.What this changes for the record. Q1 asked for the deployed monitor boundary so this design could be specified against it. The correct answer is not yet determined, not does not exist — so this stays a Deliverable waiting on a prerequisite, exactly as it was, rather than becoming a proposal to be argued down.
The recommendation in the previous comment is withdrawn. Q3's ratified ruling is untouched by any of this: the invalidation plane stops at OpenBao leases and exact resource-token IDs, whatever ends up observing a death.
➡️ Q1 stays open and stays a probe. It reruns against the runtime that succeeds the spike, and the useful thing this pass produced is the shape of the question — what hosts a queen, does that host have an identity, what signs the event — rather than an answer to it.
Second correction — the probe examined an unestablished artifact, 2026-09-04
Freeholder: "I don't know that I ever ran a swarm from vordr successfully, where I ran a few with claude."
This goes further than the correction above it, and it invalidates the probe's premise rather than its conclusion.
Q1 asks for the actual Queen runtime and process boundary. I read
swarm/vordrand reported its internals as the answer, without ever establishing that vordr is what runs swarms. It may never have run one successfully. The swarms that have actually run were Claude-driven.So the probe answered "what shape does vordr have" when the question was "what runs a swarm". Everything in my first comment's result table is a description of an artifact whose relevance to this record is unestablished — including the parts I stated most confidently.
This is the second pass to make the same mistake. The 2026-08-26 grooming record on this issue opens "The checked Vordr runtime has an in-process Queen fleet, a drone-birth sentinel, and explicit operator restart" — reading vordr as the runtime, exactly as I did. Two passes have now treated a spike as the deployed system because it is the repository that looks like one.
What survives. Only the vordr-internal observations, and only as facts about vordr: the sentinel is drone-birth scoped and counts printable bytes rather than bytes; its late-observer fix re-checks under lock. Useful engineering, no bearing on this record.
What Q1 still needs, and now needs first: which runtime actually runs a swarm today? Until that is named, there is no tree to inspect for a process boundary, a death signal, or a monitor identity — and any answer produced by reading a repository nobody confirmed is running is a guess with citations.
➡️ Q1 stays open, with its first step corrected: name the runtime before probing one. Q3's ratified ruling is unaffected — it constrains what a death may invalidate, whatever turns out to observe one.