Ting/Vedanta
Watch
2
0
Fork
You've already forked Vedanta
 0
Code Issues 8 Pull requests Projects Releases Packages Wiki Activity Actions

Session: Vedanta backend completion for the live lifecycle proof #49

New issue
Open
opened 2026-09-05 20:25:07 +00:00 by larandar · 0 comments
larandar commented 2026-09-05 20:25:07 +00:00
Owner
Copy link

Proposal

Why

Vedanta#20 closed 2026-09-03 with the lease contract, private command ABI, both mutation adapters, and lost-response semantics proven against capture doubles only (its closure comment says so plainly). A 2026-09-05 gap analysis of fastlane 02fa9ad against the ratified contracts.identity.openbao-lease-backend spec (store 1d8f945, 16 requirements) found the remaining distance to the live lifecycle: one requirement unimplemented (queen handover), nine partial, and six normative divergences. This Session completes the backend to the point where the production proof (flake-ops#435/#154) can exercise it — capture-double-completable work only; live-environment acts stay operator-gated elsewhere.

Scope

Everything below is library code proven against capture doubles. No live Kanidm/Forgejo/OpenBao contact, no deployment, no service wiring beyond what tests exercise.

Design

Projects from contracts.identity.openbao-lease-backend (spec + design) and the canonical acceptance spec (forge-lifecycle references, Gates 3A, 5, 6, 7). Structural parent: Ting/Ting#60. Continues Vedanta#20 (closed; not reopened — this is new scope found in review, per the no-bounce doctrine).

Two divergences are resolved by the ratified spec's own text (queen ruling, disclosed provenance, Vedanta run 2026-09-05):

  • Replay returns state: spec 130–132 ("Repeating an unfinished operation MUST return state … a completed one MUST return non-secret state") governs; private_api.rs's OperationReplay denial changes to routing replays to Journal::status.
  • Scope comparison is subset, not exact: effective visibility is an intersection (Amendment 0.1.3); a narrower ask must pass. Vedanta's exact-equality check (private_api.rs:566-573) converges to the plugin's subset semantics (issue.rs:290-296).

The pool-ownership question (D1 of the gap memo: PoolDirectory creates principals while the transcribed contract assigns creation to providers) is excluded pending the freeholder's ruling — no production PoolDirectory adapter in this Session.

Tasks

  • Production MutationAdapter: ValidatedCommand → kanidm/forgejo calls (mint/rotate/invalidate incl. Forge token delete-with-verification), double-tested.
  • Cross-half integration: plugin IssueService/LeaseService exercised against the real Validator+Journal (catches the unfilled invalidation command, lease.rs:310-343).
  • Replay-returns-state per spec (above), with tests.
  • Pilot timing completion: T-10min renewal trigger, enforced 5-min predecessor-overlap bound, expiry-triggered exact Forgejo deletion, expired-lease denial in read/rotate.
  • Queen handover machine (Gate 3A / H01–H05): revoke-before-activate, no-holder interval denial, successor manageability of existing leases, selective revocation by successor visibility, no blanket cascade.
  • Pool-reuse linkage: lease RevocationPending ⇒ worker ineligible; deletion-verified step before a slot frees.
  • Lifecycle-event model: full correlation field set (queen/grant/resource), serializer that refuses credential values with alertable failure, native Forge event join (fix the kanidm_event_id naming).
  • Durable recording of unauthenticated denials (validation-failure audit).
  • Reference WrapStore with one-shot/consume/expiry semantics proven against a double.
  • Reconciliation sweep driver: committed-state fetch behind a port (select/compensate already exist in reconcile.rs).
  • OpenBao plugin protocol skeleton (backend registration, storage adapters, mock-storage tests).

Specification Delta

None — this Session implements the existing ratified spec; it amends nothing. Any discovered need to change normative wording returns to the freeholder as a decision, not a code edit.

Provenance

Filed by the 2026-09-05 Vedanta lifecycle run (queen seat, DSH session aaa849b2) under vedanta-implementation-plan.md §2. Evidence: gap-analysis memo against store 1d8f945 and Vedanta 02fa9ad (run journal ~/.agents/vedanta-run-2026-09-05/).

## Proposal ### Why Vedanta#20 closed 2026-09-03 with the lease contract, private command ABI, both mutation adapters, and lost-response semantics **proven against capture doubles only** (its closure comment says so plainly). A 2026-09-05 gap analysis of fastlane `02fa9ad` against the ratified `contracts.identity.openbao-lease-backend` spec (store `1d8f945`, 16 requirements) found the remaining distance to the live lifecycle: one requirement unimplemented (queen handover), nine partial, and six normative divergences. This Session completes the backend to the point where the production proof (flake-ops#435/#154) can exercise it — capture-double-completable work only; live-environment acts stay operator-gated elsewhere. ### Scope Everything below is library code proven against capture doubles. No live Kanidm/Forgejo/OpenBao contact, no deployment, no service wiring beyond what tests exercise. ## Design Projects from [`contracts.identity.openbao-lease-backend`](https://jo.et0.pw/Ting/contracts/wiki/contracts.identity.openbao-lease-backend.-) (spec + design) and the canonical acceptance spec (`forge-lifecycle` references, Gates 3A, 5, 6, 7). Structural parent: [Ting/Ting#60](https://jo.et0.pw/Ting/Ting/issues/60). Continues Vedanta#20 (closed; not reopened — this is new scope found in review, per the no-bounce doctrine). Two divergences are resolved by the ratified spec's own text (queen ruling, disclosed provenance, Vedanta run 2026-09-05): - **Replay returns state**: spec 130–132 ("Repeating an unfinished operation MUST return state … a completed one MUST return non-secret state") governs; `private_api.rs`'s `OperationReplay` denial changes to routing replays to `Journal::status`. - **Scope comparison is subset, not exact**: effective visibility is an *intersection* (Amendment 0.1.3); a narrower ask must pass. Vedanta's exact-equality check (`private_api.rs:566-573`) converges to the plugin's subset semantics (`issue.rs:290-296`). The pool-ownership question (D1 of the gap memo: `PoolDirectory` creates principals while the transcribed contract assigns creation to providers) is **excluded** pending the freeholder's ruling — no production `PoolDirectory` adapter in this Session. ## Tasks - [ ] Production `MutationAdapter`: `ValidatedCommand` → kanidm/forgejo calls (mint/rotate/invalidate incl. Forge token delete-with-verification), double-tested. - [ ] Cross-half integration: plugin `IssueService`/`LeaseService` exercised against the real `Validator`+`Journal` (catches the unfilled invalidation command, `lease.rs:310-343`). - [ ] Replay-returns-state per spec (above), with tests. - [ ] Pilot timing completion: T-10min renewal trigger, enforced 5-min predecessor-overlap bound, expiry-triggered exact Forgejo deletion, expired-lease denial in `read`/`rotate`. - [ ] Queen handover machine (Gate 3A / H01–H05): revoke-before-activate, no-holder interval denial, successor manageability of existing leases, selective revocation by successor visibility, no blanket cascade. - [ ] Pool-reuse linkage: lease `RevocationPending` ⇒ worker ineligible; deletion-verified step before a slot frees. - [ ] Lifecycle-event model: full correlation field set (queen/grant/resource), serializer that refuses credential values with alertable failure, native Forge event join (fix the `kanidm_event_id` naming). - [ ] Durable recording of unauthenticated denials (validation-failure audit). - [ ] Reference `WrapStore` with one-shot/consume/expiry semantics proven against a double. - [ ] Reconciliation sweep driver: committed-state fetch behind a port (select/compensate already exist in `reconcile.rs`). - [ ] OpenBao plugin protocol skeleton (backend registration, storage adapters, mock-storage tests). ## Specification Delta None — this Session implements the existing ratified spec; it amends nothing. Any discovered need to change normative wording returns to the freeholder as a decision, not a code edit. ## Provenance Filed by the 2026-09-05 Vedanta lifecycle run (queen seat, DSH session aaa849b2) under vedanta-implementation-plan.md §2. Evidence: gap-analysis memo against store `1d8f945` and Vedanta `02fa9ad` (run journal `~/.agents/vedanta-run-2026-09-05/`).
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
fastlane
main
tango/2-bootstrap
No results found.
Labels
Clear labels
  
Compat/Breaking
Breaking change that won't be backward compatible

  
Kind/Bug
Something is not working

  
Kind/Documentation
Documentation changes

  
Kind/Enhancement
Improve existing functionality

  
Kind/Feature
New functionality

  
Kind/Security
This is security issue

  
Kind/Testing
Issue or pull request related to testing

  
Meta/Campaign
Campaign grouping node; dependencies name its direct Epics

  
Meta/Epic
Epic grouping node; dependencies name its direct Sessions

  
Meta/Session
Session delivery bundle; dependencies name its direct leaf issues

  
Priority/Critical
The priority is critical

  
Priority/High
The priority is high

  
Priority/Low
The priority is low

  
Priority/Medium
The priority is medium

  
Reviewed/Confirmed
Issue has been confirmed

  
Reviewed/Curated
PR LABEL: merge by rebase/ff to preserve the commit line; absence means squash. Set by the AUTHOR. (Curation itself is a duty on every PR — the label only picks the merge style.)

  
Reviewed/Duplicate
This issue or pull request already exists

  
Reviewed/Invalid
Invalid issue

  
Reviewed/Won't Fix
This issue won't be fixed

  
Scope/Campaign
Umbrella issue grouping a coherent multi-issue campaign.

  
Status/Abandoned
Somebody has started to work on this but abandoned work

  
Status/Blocked
Something is blocking this issue or pull request

  
Status/Conflicted
STATE: steward rebase failed; work returned to its agent, with evidence.

  
Status/In Progress
STATE: claimed, workspace active. Exactly one assignee, or none when idle.

  
Status/In Review
STATE: PR open against fastlane. Set by steward (PR webhook).

  
Status/Need Grooming
Issue body and comments do not yet conform to the Deliverable record; grooming required.

  
Status/Need More Info
Feedback is required to reproduce issue or to continue work

  
Status/Ready
Ready for execution; no known blocker prevents useful work from starting.

No labels
Compat/Breaking
Kind/Bug
Kind/Documentation
Kind/Enhancement
Kind/Feature
Kind/Security
Kind/Testing
Meta/Campaign
Meta/Epic
Meta/Session
Priority/Critical
Priority/High
Priority/Low
Priority/Medium
Reviewed/Confirmed
Reviewed/Curated
Reviewed/Duplicate
Reviewed/Invalid
Reviewed/Won't Fix
Scope/Campaign
Status/Abandoned
Status/Blocked
Status/Conflicted
Status/In Progress
Status/In Review
Status/Need Grooming
Status/Need More Info
Status/Ready
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Blocks
#46 Session: pool manager steady-state checkout/return
Ting/Vedanta
Reference
Ting/Vedanta#49
No description provided.