#50 - Allow a principal to take a provisioned seat — the queen-seat half of allocation (ruling D2b) - Ting/Vedanta

larandar commented

2026-09-05 21:27:07 +00:00

Owner

Proposal

Implement the runtime seat-taking effect: a private, validated Vedanta command that allows a principal to take a provisioned seat (swarm-alpha/queen for swarm X), records the tenure, releases it on handover, and serves the active tenure to OpenBao.

Why

Ruling D2b (Larandar, 2026-09-05, in-session): "provisioning makes the SEAT available, and Vedanta CAN ALLOW a principal to take the seat." The drone-slot half of allocation exists (src/checkout.rs, Session #31). The queen-seat half exists nowhere: no command takes a seat, no ledger records a tenure, and GET /v1/lifecycle/projection/{grant} (Session #47) answers active_queen_tenures: [] by construction, so OpenBao's SeatTenure stage denies every drone lease. That is the correct fail-closed state and it is why this Deliverable gates the pilot.

Design

A second signed private command kind beside LifecycleCommand: SeatCommand { operation_id, action: take|release, seat (assignment id), holder (principal ref), tenure_grant (GrantRef), authorization_generation, forge_actor, valid_until }, same envelope, signature, peer and freshness rules as private_api, validated against the deployed seat grant projection (the seat's own AssignmentGrant, canonical assignment-grant.seat.example.yaml).
Handover order is the contract's: release of the former tenure is journaled and effective before a take of a distinct successor tenure is accepted; a seat with an active tenure refuses a second take; the no-holder interval denies.
A durable tenure ledger under /var/lib/vedanta/ (append-only, like the operations journal), identifiers only.
Service::active_tenures(seat) reads the ledger; the projection route serves it as active_queen_tenures.
No credential is minted by a seat command; taking a seat is authority state, not a token.

Tasks

Define SeatCommand and its validation order (peer, signature, window, freshness, seat grant active + digest, holder is an eligible principal, generation, no concurrent holder).
Tenure ledger: write-ahead, replay-safe, take/release.
Serve active_queen_tenures from the ledger.
Negative tests: second take while held, take before release in handover, stale generation, unratified seat grant, stranger peer.
Reflect the amended contract wording once Ting/contracts#10 is ratified.

Specification Delta

Requirement: exactly one holder, and none between tenures

Scenario: handover from queen A to queen B

GIVEN A holds swarm-alpha/queen
WHEN A's tenure is released and B's take is validated
THEN OpenBao resolves zero holders between the two acts and exactly B afterwards
AND A's tenure grant is not edited or transferred

Structural parent

#46 (D2b); sibling of #47. Contract delta: Ting/contracts#10.

Provenance

Filed by the queen session of the 2026-09-05 delivery run (Claude Code, harness ba993052).

## Proposal Implement the runtime seat-taking effect: a private, validated Vedanta command that allows a principal to take a provisioned seat (`swarm-alpha/queen` for swarm X), records the tenure, releases it on handover, and serves the active tenure to OpenBao. ### Why Ruling D2b (Larandar, 2026-09-05, in-session): *"provisioning makes the SEAT available, and Vedanta CAN ALLOW a principal to take the seat."* The drone-slot half of allocation exists (`src/checkout.rs`, Session #31). The queen-seat half exists nowhere: no command takes a seat, no ledger records a tenure, and `GET /v1/lifecycle/projection/{grant}` (Session #47) answers `active_queen_tenures: []` by construction, so OpenBao's `SeatTenure` stage denies every drone lease. That is the correct fail-closed state and it is why this Deliverable gates the pilot. ## Design - A second signed private command kind beside `LifecycleCommand`: `SeatCommand { operation_id, action: take|release, seat (assignment id), holder (principal ref), tenure_grant (GrantRef), authorization_generation, forge_actor, valid_until }`, same envelope, signature, peer and freshness rules as `private_api`, validated against the deployed **seat grant** projection (the seat's own `AssignmentGrant`, canonical `assignment-grant.seat.example.yaml`). - Handover order is the contract's: `release` of the former tenure is journaled and effective before a `take` of a distinct successor tenure is accepted; a seat with an active tenure refuses a second `take`; the no-holder interval denies. - A durable tenure ledger under `/var/lib/vedanta/` (append-only, like the operations journal), identifiers only. - `Service::active_tenures(seat)` reads the ledger; the projection route serves it as `active_queen_tenures`. - No credential is minted by a seat command; taking a seat is authority state, not a token. ## Tasks - [ ] Define `SeatCommand` and its validation order (peer, signature, window, freshness, seat grant active + digest, holder is an eligible principal, generation, no concurrent holder). - [ ] Tenure ledger: write-ahead, replay-safe, `take`/`release`. - [ ] Serve `active_queen_tenures` from the ledger. - [ ] Negative tests: second `take` while held, `take` before `release` in handover, stale generation, unratified seat grant, stranger peer. - [ ] Reflect the amended contract wording once Ting/contracts#10 is ratified. ## Specification Delta ### Requirement: exactly one holder, and none between tenures #### Scenario: handover from queen A to queen B - **GIVEN** A holds `swarm-alpha/queen` - **WHEN** A's tenure is released and B's `take` is validated - **THEN** OpenBao resolves zero holders between the two acts and exactly B afterwards - **AND** A's tenure grant is not edited or transferred ## Structural parent [#46](https://jo.et0.pw/Ting/Vedanta/issues/46) (D2b); sibling of [#47](https://jo.et0.pw/Ting/Vedanta/issues/47). Contract delta: [Ting/contracts#10](https://jo.et0.pw/Ting/contracts/issues/10). ## Provenance Filed by the queen session of the 2026-09-05 delivery run (Claude Code, harness ba993052).

larandar added the

Kind/Feature

Kind/Security

labels

2026-09-05 21:31:14 +00:00

larandar referenced this issue from a commit

2026-09-06 02:19:45 +00:00

projection route: the active tenures beside the grant, empty until seats can be taken

larandar referenced this issue from a commit

2026-09-06 02:19:45 +00:00

projection: the file names the seat, never its holder — the tenure is joined at runtime

larandar referenced this issue