openspec 30: v0.1.2 — recovery, because an empty memory is not an empty pool
The package specified freeing a slot per transition and said nothing about the
initial state. A cycle that restarts while drones hold slots takes no transition
and infers nothing — it simply never knew — so the guarantee has to hold over
startup too, or it does not hold at all. The failure it let through is the one
the design exists to prevent: one identity handed to two live drones.
Occupancy becomes durable, written before the hand-out and cleared after the
credential is dead. Ordering errs toward held in both directions: a crash leaves
a slot recorded as held for an occupancy that may never have gone live, which
costs one slot out of ten and is recoverable by release, where the opposite
ordering leaves a live drone holding a slot nothing remembers.
A refusal is not a crash and is compensated immediately — nothing was handed out
and nothing is live. An interrupted process cannot reach that compensation,
which is why the write comes first.
Unreadable state denies rather than defaulting: not knowing what is held and
knowing nothing is held are different answers.
openspec 30: v0.1.1 — a slot is freed by explicit release and nothing else
Ting/Ting#2 Q2 answered provisionally: the liveness mechanism stays undefined
until incidents show what evidence is actually available. Rather than carry that
as a gap, the package takes the shape needing no mechanism — nothing infers
liveness, so nothing can infer it wrongly, and the contract's negative-liveness
requirement is satisfied conservatively rather than approximately.
Names the failure this chooses: a drone dying without releasing holds its slot,
ten of those exhaust the pool and stop the swarm. Loud, bounded, recoverable,
and it produces the incident record the eventual mechanism will be designed
against — where a wrong automatic release fails silently into two live drones
sharing one identity.
No acceptance is blocked any more, so the delivery decomposition now names all
six Deliverables.
openspec: the agent identity pool lifecycle package (Ting/Ting#2, Vedanta#30/#31)
Projects from delivered OpenSpec 61 v0.1.4 rather than amending it, per the
freeholder ruling on Ting/Ting#2 Q1. Carries the ratified reconciliation's
concrete lifecycle: ten UUID-pinned principals, reserve-before-create naming,
adopt-on-retry, one immutable grant per slot, checkout under a new grant with
the occupancy stamp, and ordinary completion that preserves the worker.
States the two things a reader would otherwise get wrong. The occupancy value is
alias `custom_metadata`, not a claim — a kanidm claim map is `valuesByGroup` and
has no per-allocation hook. And the contract's existing `assignment_id` is the
queen's tenure assignment, shared by every drone under her, so it cannot be
reused for occupancy: a path built on it looks isolated and is not.
Allocation carries no acceptance yet. The negative-liveness source is Q2 and the
freeholder deferred it; bring-up and the return half are unaffected.
