Reserve a slot name before its principal exists, and adopt it on retry #32

New issue

Closed

opened 2026-09-03 18:23:54 +00:00 by larandar · 0 comments

larandar commented

2026-09-03 18:23:54 +00:00

Owner

Proposal

Make a pool slot's name the thing that exists first, so a retry can never turn one slot into two principals.

Delivery class

agent-unit — reservation and adoption logic with capture-double tests over the Kanidm adapter.

Design

The name is reserved before creation, in the form swarm-alpha-drone-<word>-<word>-<word>-<word>. The UUID the directory returns is pinned to that name and slot with no rename pass.

The ordering is the whole requirement. A create-then-name flow has a window in which a principal exists under a name nothing reserved, and a retry across that window is exactly how a slot acquires a second principal — the failure mode is not the crash, it is the silent duplicate that survives it. Reserving first makes the retry's question answerable: is there already a principal for this reservation?

A retry therefore adopts a principal whose name and slot metadata match. A mismatch is a collision, and a collision is denied or re-reserved — never resolved by creating another principal.

Tasks

Reserve the four-word name before any principal is created.
Pin the returned UUID to name and slot without a rename pass.
Adopt on retry when name and slot metadata match.
Deny or re-reserve on mismatch; never create a second principal for a slot.

Specification Delta

Requirement: a name is reserved before a principal exists

Scenario: provisioning is retried mid-flight

GIVEN a reserved name whose principal creation may already have succeeded
WHEN provisioning retries
THEN it adopts the principal matching that name and slot
AND no second principal is created for the slot
AND a mismatched collision is denied or re-reserved

OpenSpec

OpenSpec 30

Structural parent

Vedanta#30

## Proposal Make a pool slot's name the thing that exists first, so a retry can never turn one slot into two principals. ## Delivery class `agent-unit` — reservation and adoption logic with capture-double tests over the Kanidm adapter. ## Design The name is reserved before creation, in the form `swarm-alpha-drone-<word>-<word>-<word>-<word>`. The UUID the directory returns is pinned to that name and slot with no rename pass. The ordering is the whole requirement. A create-then-name flow has a window in which a principal exists under a name nothing reserved, and a retry across that window is exactly how a slot acquires a second principal — the failure mode is not the crash, it is the silent duplicate that survives it. Reserving first makes the retry's question answerable: *is there already a principal for this reservation?* A retry therefore **adopts** a principal whose name and slot metadata match. A mismatch is a collision, and a collision is **denied or re-reserved** — never resolved by creating another principal. ## Tasks - [ ] Reserve the four-word name before any principal is created. - [ ] Pin the returned UUID to name and slot without a rename pass. - [ ] Adopt on retry when name and slot metadata match. - [ ] Deny or re-reserve on mismatch; never create a second principal for a slot. ## Specification Delta ### Requirement: a name is reserved before a principal exists #### Scenario: provisioning is retried mid-flight - **GIVEN** a reserved name whose principal creation may already have succeeded - **WHEN** provisioning retries - **THEN** it adopts the principal matching that name and slot - **AND** no second principal is created for the slot - **AND** a mismatched collision is denied or re-reserved ## OpenSpec [OpenSpec 30](https://jo.et0.pw/Ting/Vedanta/wiki/OpenSpec-30-agent-identity-pool-lifecycle) ## Structural parent [Vedanta#30](https://jo.et0.pw/Ting/Vedanta/issues/30)

larandar referenced this issue

2026-09-03 18:24:07 +00:00

Provision ten pool principals, each with one immutable grant and nothing else #33

larandar added the

Kind/Feature

Kind/Security

labels

2026-09-03 18:25:18 +00:00

larandar added a new dependency

2026-09-03 18:25:27 +00:00

#30 Session: pool bring-up — ten pinned principals and their grants, ratified before activation

larandar added a new dependency