Return a slot on ordinary completion without destroying its principal #36

New issue

Closed

opened 2026-09-03 18:24:55 +00:00 by larandar · 0 comments

larandar commented

2026-09-03 18:24:55 +00:00

Owner

Proposal

End a session cleanly: revoke what it held, rotate, advance the generation, and give the same slot back to the pool with its durable principal intact.

Delivery class

agent-unit — the completion sequence with capture doubles, including partial-failure cases.

Design

Ordinary completion revokes the session capability, its leases, and its resource tokens; rotates the checkout credential; advances the generation; and returns the same worker-<UUID> slot to the pool.

The principal survives, and that is the requirement rather than an implementation detail. Deletion, suppression, tombstoning and recreation are reserved for compromise or irrecoverable retirement — a different path with different authority. A completion that destroyed the principal would make the pool disposable-identity-per-session by another name, which is exactly what the pooled model exists to avoid: a persona that looks longer-lived than any one container.

Generation advance is what makes the return observable. The generation is the correlation handle a later reader uses to tell one occupancy from the next, so it advances on return whether or not anything else about the slot changed.

Ordering matters under partial failure: a slot returned to the pool before its capability is revoked is a slot that can be allocated while its predecessor still holds authority. Revoke first, return last, and leave a partial failure visible and retryable rather than half-returned.

Tasks

Revoke the session capability, leases, and resource tokens.
Rotate the checkout credential and advance the generation.
Return the same UUID to the pool; prove the principal is neither deleted, suppressed, nor tombstoned.
Prove a later session inherits no lease, token, or authority from the completed one.
Prove a partial failure leaves the slot unreturned and retryable, never half-returned.

Specification Delta

Requirement: the principal survives ordinary completion

Scenario: a session ends normally

GIVEN a drone session completing without compromise
WHEN return runs
THEN the session capability, leases, and resource tokens are revoked
AND the durable principal is neither deleted, suppressed, nor tombstoned

Requirement: a returned slot carries nothing forward

Scenario: a slot is reused by a later session

GIVEN a slot returned by ordinary completion
WHEN it is allocated again
THEN no lease, token, or authority from the previous session remains valid

Scenario: return fails partway

GIVEN a completion whose revocation succeeded and rotation did not
WHEN the failure is observed
THEN the slot is not available for allocation
AND the completion remains retryable

OpenSpec

OpenSpec 30 — this is the record OpenSpec 61 amendment 0.1.2 specifies directly.

Structural parent

Vedanta#31

## Proposal End a session cleanly: revoke what it held, rotate, advance the generation, and give the same slot back to the pool with its durable principal intact. ## Delivery class `agent-unit` — the completion sequence with capture doubles, including partial-failure cases. ## Design Ordinary completion revokes the session capability, its leases, and its resource tokens; rotates the checkout credential; advances the generation; and returns the same `worker-<UUID>` slot to the pool. **The principal survives, and that is the requirement rather than an implementation detail.** Deletion, suppression, tombstoning and recreation are reserved for compromise or irrecoverable retirement — a different path with different authority. A completion that destroyed the principal would make the pool disposable-identity-per-session by another name, which is exactly what the pooled model exists to avoid: a persona that looks longer-lived than any one container. Generation advance is what makes the return observable. The generation is the correlation handle a later reader uses to tell one occupancy from the next, so it advances on return whether or not anything else about the slot changed. Ordering matters under partial failure: a slot returned to the pool before its capability is revoked is a slot that can be allocated while its predecessor still holds authority. Revoke first, return last, and leave a partial failure visible and retryable rather than half-returned. ## Tasks - [ ] Revoke the session capability, leases, and resource tokens. - [ ] Rotate the checkout credential and advance the generation. - [ ] Return the same UUID to the pool; prove the principal is neither deleted, suppressed, nor tombstoned. - [ ] Prove a later session inherits no lease, token, or authority from the completed one. - [ ] Prove a partial failure leaves the slot unreturned and retryable, never half-returned. ## Specification Delta ### Requirement: the principal survives ordinary completion #### Scenario: a session ends normally - **GIVEN** a drone session completing without compromise - **WHEN** return runs - **THEN** the session capability, leases, and resource tokens are revoked - **AND** the durable principal is neither deleted, suppressed, nor tombstoned ### Requirement: a returned slot carries nothing forward #### Scenario: a slot is reused by a later session - **GIVEN** a slot returned by ordinary completion - **WHEN** it is allocated again - **THEN** no lease, token, or authority from the previous session remains valid #### Scenario: return fails partway - **GIVEN** a completion whose revocation succeeded and rotation did not - **WHEN** the failure is observed - **THEN** the slot is not available for allocation - **AND** the completion remains retryable ## OpenSpec [OpenSpec 30](https://jo.et0.pw/Ting/Vedanta/wiki/OpenSpec-30-agent-identity-pool-lifecycle) — this is the record OpenSpec 61 amendment 0.1.2 specifies directly. ## Structural parent [Vedanta#31](https://jo.et0.pw/Ting/Vedanta/issues/31)

~~larandar referenced this issue 2026-09-03 18:25:13 +00:00~~

Free a slot only on explicit release — never by inference #37

larandar added the

Kind/Feature

Kind/Security

labels

2026-09-03 18:25:23 +00:00

larandar added a new dependency

2026-09-03 18:25:31 +00:00

#31 Session: pool checkout and return — the steady-state slot cycle

larandar referenced this issue from a commit

2026-09-03 22:28:11 +00:00