jerry/buzz
1
0
Fork 0
mirror of https://github.com/block/buzz.git synced 2026-10-28 21:11:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs(beehive): record first-enrollment authority scope and checkpoint evidence

Browse Source 
Signed-off-by: Logan Johnson <loganj@squareup.com>
This commit is contained in:
Logan Johnson
2026-09-16 09:28:51 -04:00
parent 8c15d7d736
commit c6795ccc5f
1 changed files with 77 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

77
beehive/UX_NAVIGATION_CHECKPOINT.md
View File

@@ -408,3 +408,80 @@ Git behavior and use `git commit -s` for DCO; absent GPG configuration is not a
blocker and no Git configuration is changed. This checkpoints the reviewed
surviving directory/registration/runtime delta, not completed first enrollment.
The 46-test evidence above remains scoped to that partial implementation.
## 0605ceff — committed partial delta; first-enrollment authority decision
The reviewed 17-file surviving delta is committed as
`8c15d7d736653ce52220209f7552b60dd9d7d259` using the existing `git commit -s`
workflow. Global and effective author/committer are Logan Johnson
`<loganj@squareup.com>`; no Git configuration changed. This is **not a completed
first-use candidate**. Both installed `176497874` exports remain untouched.
Fresh evidence in `/Users/loganj/.buzz/artifacts/beehive-ux-0605ceff/`:
`checkpoint-focused.log` **46/46 passed**, `checkpoint-typecheck.log` strict
TypeScript passed. The focused list is exactly the reproduction list above.
The unassigned-agent test still documents refusal, not acceptance. No full suite,
new PTY, renderer, native, production credential/relay/provider or installed
service operations were run. Prior failed evidence and suite qualification stand.
### Concrete scope question raised in the work discussion
Must conflicting first enrollment converge across **independent authenticated
controllers and independently empty hosts**, or only within one retained local
installation/controller history? `VISION_REMOTE_AGENTS.md` says Start “from this
machine or another” converges to one live instance. The current implementation
has no shared first-enrollment decision:
- `assignment.ts:createGenesis` makes a random public root; `handoff.ts` validates
lineage relative to that root, not uniqueness across roots.
- `host.ts:loadSlotState` pins a root in one journal. `host.lock`, revisions and
operation fingerprints serialize/replay one installation only.
- `host-catalog.ts:HostOffers` authenticates infrastructure routes, explicitly not
placement. Empty offers/inventory cannot prove an agent lacks a retained holder.
- `intents.ts:managementClient` persists before sending, but its signer/relay-scoped
journal is local to one controller root, not shared across controllers.
- `credential-slots.ts` provisions supplied roots and refuses retained/partial
replacement. Those callers currently own the external bootstrap decision.
Counterexample to a local-only automatic implementation: C1 signs first Start
for agent A on empty H1; C2 independently signs first Start for A on empty H2.
Each host has the matching owner/key and can win its own exclusive file write.
Distinct roots both validate, and even a deterministic root ID cannot make
`initialHost=H1` and `initialHost=H2` agree. Host-local receipts, directory checks,
or a controller-local enrollment file cannot resolve this race. No such unsafe
root-minting path was added in this run.
If cross-controller convergence is required, select a shared first-write bootstrap
authority scoped to relay/owner/agent, with atomic absent-to-pinned-root semantics
and exact read-back. Ordinary last-writer-wins publication is insufficient. Its
role should end at pinning the one initial root/host; the existing assignment/grant
chain remains the sole subsequent placement authority. If the guarantee is
intentionally local-scoped, record that narrower product contract explicitly
before shipping a local enrollment implementation. This is a scope/trust-root
question, not a claim that authenticated Start cannot authorize enrollment.
### Remaining implementation, once that scope is settled
1. Extend the existing explicit Start continuation to capture an unassigned exact
owned directory key and exact local infrastructure target. Registration keeps
custody/read-back and runtime metadata separate from assignment authority.
2. Pin/recover the initial root through the approved bootstrap authority before
host activation. Persist the exact authenticated intent before network effects;
conflicting identity/root/target requests refuse rather than reset history.
3. Integrate the activation transaction in `host()` under its existing lock and
private authenticated receive boundary. Serialize enrollment; retain an inert
recoverable prefix before journal/manifest activation; validate exact inventory
bytes before live admission. Extract the existing per-entry hydration closure
rather than restart the host or add an outside manifest mutator. Host close must
abort/drain enrollment before enumerating slot teardown.
4. Return a durable enrollment result before the continuation sends ordinary
revision-fenced Start. Cancellation may leave registered or assigned/stopped
state but cannot launch late. Replay cannot mint another root or repeat a run.
5. Replace the existing unassigned refusal test and extend the same private-relay
walkthrough, not a pre-provisioned substitute. Cover duplicate/conflicting
attempts, each persistence prefix/retry, cancellation and an existing running
sibling. Retain Save -> active unchanged -> Stop -> next Start coverage.
Authenticated Move and Desktop parity remain mapped in “Precise subsequent work”
above; no allowlists or provider/harness contracts were changed here. Larry owns
scope resolution, subsequent dispatch and independent final UX acceptance.