Session: host the private lifecycle service, and retire pool bring-up from Vedanta (ruling D2)

larandar commented

2026-09-05 20:18:23 +00:00

Owner

Proposal

Make the tested library a running private effector, and remove the pool bring-up authority Vedanta was ruled not to hold.

Why

#20 closed with the private command contract, journal, both native adapters, and the OpenBao-side flows written and tested against capture doubles — and nothing serving them. vedanta serve mounts only jostoph-rs's evaluate router; private_api, operations, kanidm, forgejo, and reconcile are library modules no process instantiates. The delivery run for Ting/Ting#60 (2026-09-05) found this as the first Vedanta delta.

The same run surfaced a boundary mismatch hidden by doubles: PR #38 (src/pool.rs, Session #30) reserves names, creates principals, pins UUIDs and renders grants. The ratified contracts.identity.openbao-lease-backend requirement the-realized-drone-pool-is-read-only-input-to-vedanta forbids exactly that, and the freeholder ruled it on 2026-09-05: "Vedanta MUST NOT, this is a provider job" (ruling D2). Pool realization belongs to flake-ops#427 over nixops4-providers#27. Slot allocation (src/checkout.rs, Session #31) provisionally stays — see #46.

Session review boundary

One PR, one verdict: the private lifecycle service is reachable only by OpenBao's identity and performs no mutation outside the validated command path; and no pool-creation authority remains in the binary.

Design

A second listener, private by construction (unix socket or loopback bound address chosen by module.nix, never the webhook port), serving the signed-envelope command surface src/private_api.rs already validates. Peer identity comes from the transport (socket peer credentials or a deployed mTLS/service identity), never from the payload.
The deployed grant projection is read-only input: loaded from a path the deployment renders (flake-ops#432's seam), verified against grant ID/version/digest, never written.
operations journal on a durable path owned by services.vedanta.user; journal failure denies (audit_unavailable) before any adapter call.
Adapters constructed from DOTENV_FILE credentials exactly as the mint CLI does; credential values transit once in the successful result and are never journaled.
src/pool.rs bring-up (reserve / create-or-adopt / grant rendering / ratification ledger) is deleted with the ruling in the commit body. Tests that document the contract the provider must satisfy are moved to prose in the flake-ops#427 record, not kept as dead code.

Tasks

Serve private_api on a private listener with transport-derived peer identity.
Load and verify the deployed projection from the rendered path; deny on digest mismatch.
Wire operations journal and both adapters into the served path; prove audit_unavailable precedes mutation.
Extend module.nix with the private listener, journal path, and projection path options.
Retire src/pool.rs bring-up per ruling D2; leave src/checkout.rs pending #46 / D2b.
Update CONTEXT.md and AGENTS.md perimeter to say what runs, not only what is written.

Specification Delta

Requirement: the tested contract is the running contract

Scenario: OpenBao's identity submits a valid signed command

GIVEN the deployed projection and a reachable journal
WHEN the command arrives on the private listener from OpenBao's service identity
THEN it is validated, journaled, effected through the native adapter, and answered once with the credential
AND the same command from any other peer is denied before the journal

Requirement: no pool-creation authority remains

Scenario: the binary is audited for principal creation paths

WHEN every code path that can create a principal is enumerated
THEN only mint-agent / mint-service remain, and no swarm-alpha slot creation exists

OpenSpec

Projects from the shared store: contracts.identity.openbao-lease-backend (vedanta-accepts-only-authenticated-signed-openbao-commands, the-realized-drone-pool-is-read-only-input-to-vedanta, local-write-ahead-audit-precedes-mutation). Its own package: to be authored in Ting/contracts as a delta of OpenSpec 20.

Structural parent

Ting/Ting#60; continues #20.

Provenance

Filed by the queen session of the 2026-09-05 delivery run (Claude Code, harness ba993052), freeholder present and steering; ruling D2 attributed to Larandar in-session.

## Proposal Make the tested library a running private effector, and remove the pool bring-up authority Vedanta was ruled not to hold. ### Why [#20](https://jo.et0.pw/Ting/Vedanta/issues/20) closed with the private command contract, journal, both native adapters, and the OpenBao-side flows written and tested against capture doubles — and nothing serving them. `vedanta serve` mounts only jostoph-rs's evaluate router; `private_api`, `operations`, `kanidm`, `forgejo`, and `reconcile` are library modules no process instantiates. The delivery run for [Ting/Ting#60](https://jo.et0.pw/Ting/Ting/issues/60) (2026-09-05) found this as the first Vedanta delta. The same run surfaced a boundary mismatch hidden by doubles: PR #38 (`src/pool.rs`, Session #30) reserves names, creates principals, pins UUIDs and renders grants. The ratified `contracts.identity.openbao-lease-backend` requirement `the-realized-drone-pool-is-read-only-input-to-vedanta` forbids exactly that, and the freeholder ruled it on 2026-09-05: *"Vedanta MUST NOT, this is a provider job"* (ruling D2). Pool realization belongs to [flake-ops#427](https://jo.et0.pw/lar.ad/flake-ops/issues/427) over [nixops4-providers#27](https://jo.et0.pw/lar.ad/nixops4-providers/issues/27). Slot allocation (`src/checkout.rs`, Session #31) provisionally stays — see #46. ## Session review boundary One PR, one verdict: the private lifecycle service is reachable only by OpenBao's identity and performs no mutation outside the validated command path; and no pool-creation authority remains in the binary. ## Design - A second listener, private by construction (unix socket or loopback bound address chosen by `module.nix`, never the webhook port), serving the signed-envelope command surface `src/private_api.rs` already validates. Peer identity comes from the transport (socket peer credentials or a deployed mTLS/service identity), never from the payload. - The deployed grant projection is read-only input: loaded from a path the deployment renders (flake-ops#432's seam), verified against grant ID/version/digest, never written. - `operations` journal on a durable path owned by `services.vedanta.user`; journal failure denies (`audit_unavailable`) before any adapter call. - Adapters constructed from `DOTENV_FILE` credentials exactly as the mint CLI does; credential values transit once in the successful result and are never journaled. - `src/pool.rs` bring-up (reserve / create-or-adopt / grant rendering / ratification ledger) is deleted with the ruling in the commit body. Tests that document the *contract* the provider must satisfy are moved to prose in the flake-ops#427 record, not kept as dead code. ## Tasks - [ ] Serve `private_api` on a private listener with transport-derived peer identity. - [ ] Load and verify the deployed projection from the rendered path; deny on digest mismatch. - [ ] Wire `operations` journal and both adapters into the served path; prove `audit_unavailable` precedes mutation. - [ ] Extend `module.nix` with the private listener, journal path, and projection path options. - [ ] Retire `src/pool.rs` bring-up per ruling D2; leave `src/checkout.rs` pending #46 / D2b. - [ ] Update `CONTEXT.md` and `AGENTS.md` perimeter to say what runs, not only what is written. ## Specification Delta ### Requirement: the tested contract is the running contract #### Scenario: OpenBao's identity submits a valid signed command - **GIVEN** the deployed projection and a reachable journal - **WHEN** the command arrives on the private listener from OpenBao's service identity - **THEN** it is validated, journaled, effected through the native adapter, and answered once with the credential - **AND** the same command from any other peer is denied before the journal ### Requirement: no pool-creation authority remains #### Scenario: the binary is audited for principal creation paths - **WHEN** every code path that can create a principal is enumerated - **THEN** only `mint-agent` / `mint-service` remain, and no `swarm-alpha` slot creation exists ## OpenSpec Projects from the shared store: `contracts.identity.openbao-lease-backend` (`vedanta-accepts-only-authenticated-signed-openbao-commands`, `the-realized-drone-pool-is-read-only-input-to-vedanta`, `local-write-ahead-audit-precedes-mutation`). Its own package: to be authored in `Ting/contracts` as a delta of OpenSpec 20. ## Structural parent [Ting/Ting#60](https://jo.et0.pw/Ting/Ting/issues/60); continues [#20](https://jo.et0.pw/Ting/Vedanta/issues/20). ## Provenance Filed by the queen session of the 2026-09-05 delivery run (Claude Code, harness ba993052), freeholder present and steering; ruling D2 attributed to Larandar in-session.

larandar added the

Kind/Feature

Kind/Security

Meta/Session

labels

2026-09-05 20:19:03 +00:00

larandar referenced this issue

2026-09-05 20:21:49 +00:00

Session: the OpenBao plugin speaks OpenBao's plugin protocol, in Rust (ruling D1) #48

larandar referenced this issue

2026-09-05 21:22:48 +00:00

Session: pool manager steady-state checkout/return #46