From 0168a545c5d3b52d2d2996725998538caa359300 Mon Sep 17 00:00:00 2001 From: jochen Date: Wed, 4 Nov 2026 00:12:24 +0100 Subject: [PATCH] Design 51: cite ADR 0617 for the unnumbered-first image and hold; narrow hold to what the sweep keeps, never an image Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig --- .../51-the-registries-keep-what-is-named.md | 28 +++++++++++-------- 1 file changed, 17 insertions(+), 11 deletions(-) diff --git a/03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md b/03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md index d60c9c78..902fc58f 100644 --- a/03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md +++ b/03-DESIGN/01-to-be/51-the-registries-keep-what-is-named.md @@ -15,6 +15,7 @@ decisions: - "ADR 0612" - "ADR 0614" - "ADR 0613" + - "ADR 0617" - "ADR 0606" - "ADR 0607" - "ADR 0610" @@ -72,8 +73,8 @@ named, without a holder, until a build module publishes cargo packages. **One contract, a seat definition** (design 26, *A seat's definition*). Verbs: `publish`, `publish-part` (ADR 0611), `versions`, `remove` (a tagged version; the holder itself refuses `remove` of a version with no tag, but for the retention removal below), and -on `container-image-registry` `mirror` and `tags`; the two seats `distribution` holds add `hold`, for the artifact -sweep. The five seats this milestone changes, these four and `mesh-broker`, are defined whole, their contracts moved +on `container-image-registry` `mirror` and `tags`; the two seats `distribution` holds add `hold` and its release, +with the events `held` and `released`, for the artifact sweep (ADR 0617 §2). The five seats this milestone changes, these four and `mesh-broker`, are defined whole, their contracts moved into `mesh-contracts` (ADR 0613 §1; design 26). Events: `published`, `refused` (added to ADR 0605 §2's two, additively) and `removed`, each carrying the name, version, kind, tag, digest, fingerprint, commit and holder, and `refused` its reason; each seat's events are its own family, `.events`, kept seven days. A holder stores @@ -83,8 +84,9 @@ under the version it is given and counts nothing. form ADR 0363 gives a restricted family: `publish` and `publish-part` the build modules, and a part only from the proved caller that opened its transfer; `mirror` mesh-build-image; `remove` the builder, for a tagged version, and the holder of the artifact sweep, for an untagged bundle, archive or copied base with the reason retention (ADR 0610 §3); -`hold` (on the two seats `distribution` holds: keep one held thing from removal, and let it go again) the holder of -the artifact sweep alone. Every removal, whoever asked it, emits `removed` with its reason. +`hold` (on the two seats `distribution` holds: keep one untagged bundle, archive or copied base that the artifact +sweep's rules keep from removal by retention, and let it go again; never an image of its own) the module that runs +the artifact sweep alone (ADR 0617 §2). Every removal, whoever asked it, emits `removed` with its reason. Declaring `invokes` alone grants nothing. The holder checks the caller identity the tool runner proved and stamps on the request (design 25 § 12.4), never a name in the request's body, and answers any other caller with a refusal naming the verb. @@ -192,10 +194,12 @@ the verb. pseudo-version a consumer requires (the indexer's tool `indexer_requirements`). The builder numbers nothing for that name until all three answered (ADR 0606 §3), and writes a finding naming the silent one meanwhile, cleared once all three answer. Today that gives Go `v0.1.14` and npm `0.1.18`; a name with none starts at `0.1.0`. -- **An unknown floor does not stall the build of an image, bundle or archive.** The floor of `distribution`'s own +- **An unknown floor does not stall the build of an image, bundle or archive** (ADR 0617 §1 for an image). The floor of `distribution`'s own names is `distribution`'s `versions`, which only its new build serves, and the same holds for the forge module and the builder: waiting would never end. So a trunk build of an image, bundle or archive whose floor is not yet known - is built unnumbered and published by its digest (as a bundle or archive is from every done key, ADR 0605 §3). That + is claimed with no number, so none travels in its build request, built unnumbered and published by its digest (as a + bundle or archive is from every done key, ADR 0605 §3; an image so by ADR 0617 §1). Such fingerprints are numbered + in merge order once the floor answers (ADR 0606 §1). That publish is what wakes the floor: the builder hears the holder's `published` on its durable consumer of `.events` and asks the floor again then, never on a timer; once all three answer it numbers the build and emits `numbered`, which the build module consumes to call `publish` with the version and the held digest, which stores @@ -240,9 +244,9 @@ The retention of *The package registry* below, and the artifact sweep, keep work removal emits `removed` and the builder marks its entry, so `versions` never says `published` for bytes that are gone. With the store's write side closed, the artifact sweep (seat `mesh-artifact-sweep`, held by artifact-store-tools) no longer deletes or holds by writing to the store: it calls `remove` on the seat that holds the thing, with the reason -retention, and `hold` to keep a kept archive from removal, both granted to its holder alone by `distribution`'s -caller list; its rules of what is kept (*The artifact store* below) stand, and it reads both reference forms. -`distribution` keeps what is held in its own state `holds` (bus state, template state), emits `held` and `released` +retention, and `hold` to keep an untagged bundle, archive or copied base its rules keep from removal by retention, +which then skips it (ADR 0617 §2), both granted to its module alone by `distribution`'s caller list; its rules of what is kept (*The artifact store* below) stand, and it reads both reference forms. +`distribution` keeps the holds in its own state `holds` (bus state, template state), emits `held` and `released` on the seat's `.events`, and its tool `registry_holds` lists what is held, since when and for whom, and releases one by hand. A `remove` or `hold` the holder refuses to the sweep writes the sweep's finding, naming the thing and the reason, cleared by its next run with no refusal. @@ -346,7 +350,7 @@ answers (a holder down whole is its module's own health check's); `registry_inco - **Holder, added for the milestone.** A write to the store's port from any account but `distribution`'s process is refused, and a read from a node's container runtime is answered; the artifact sweep's `remove` with the reason retention removes an untagged bundle and emits `removed`, and the same call from another caller is refused; `hold` - keeps an archive from removal, emits `held` and is listed by `registry_holds`, which releases it with `released`; a + keeps an archive from retention's removal, a `hold` of an image or from another caller is refused, emits `held` and is listed by `registry_holds`, which releases it with `released`; a refused sweep `remove` writes the sweep's finding and its next clean run clears it; the forge bridge says a branch-deleted kind for the forge module's `forge.delete`, a `forge.delete` from another account is refused by the bus, and an existing consumer of `forge` ignores the new kind; with the program stopped a read fails and the @@ -358,7 +362,9 @@ answers (a holder down whole is its module's own health check's); `registry_inco it, and the build module, hearing `numbered`, publishes the version with the held digest; a package's trunk build waits; a second trunk build of a package's revision held `published` keeps its version and publishes nothing, while one numbered but refused is published by its second build under the same version; with `bridge_tags` - silenced (a floor source other than the publish target) the floor finding is written and cleared once it answers. + silenced (a floor source other than the publish target) the floor finding is written and cleared once it answers; + with the image's own seat silent at the claim of `distribution`'s own image, the image is still built, published by + its digest, and numbered once its new build answers (ADR 0617 *How it is checked*). - **Checker.** A changed build module invoking a verb no running holder serves is not run, and the verdict names the modules composed from their manifests instead, and the verb. - **Vault.** Reverting the milestone's merge mints the build modules' credentials again; the bootstrap's one-off