From c2b162a9e8da8f5ab849c1849586d87353348078 Mon Sep 17 00:00:00 2001 From: jochen Date: Mon, 2 Nov 2026 19:58:01 +0100 Subject: [PATCH] =?UTF-8?q?Design=2055:=20readers=20by=20grant,=20the=20ta?= =?UTF-8?q?ke-over=20refused=20while=20an=20Approve=20waits,=20the=20grant?= =?UTF-8?q?s=20part's=20own=20test,=20=C2=A730=20for=20nesting,=20the=20gl?= =?UTF-8?q?ossary's=20word=20in=20the=20review=20table?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- 03-DESIGN/01-to-be/55-the-knowledge-base.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/03-DESIGN/01-to-be/55-the-knowledge-base.md b/03-DESIGN/01-to-be/55-the-knowledge-base.md index 4a260e4e..101eab27 100644 --- a/03-DESIGN/01-to-be/55-the-knowledge-base.md +++ b/03-DESIGN/01-to-be/55-the-knowledge-base.md @@ -592,10 +592,10 @@ milestones and nothing of how a delivery runs; it only listens for the announcem | An answer stays within its bound | the module's test over the full import of `main` at a recorded commit: every `ask`, `get` and `holds` of a fixed question list | | A record written in this repository meanwhile writes its clauses | `records.py`, check `clauses`, on every hq pull request, until the records left this repository (issue 426); since then `records.py`, check `no-records`, refuses any record written here | | Live | the acceptance sentence, asked from a session outside this repository | -| A record is kept in the bus's forms, a section once by its digest, and read only as announced | one integration test that starts the module whole against a real bus server: a record of three sections and a second version changing one give one head, two version messages and four objects; a reader the manifest does not name is refused | +| A record is kept in the bus's forms, a section once by its digest, and read only as announced | one integration test that starts the module whole against a real bus server: a record of three sections and a second version changing one give one head, two version messages and four objects; a module with no `grant` in `readers` is refused the streams and the object bucket | | Search answers from the index as it did from the store | a unit test over a fixed set of records and a fixed question list; the integration test restarts the module and asks again | -| A draft is written by section and has one author, and a take-over tells the previous one | unit tests of each verb of § 4, of a refusal naming the author, and of `take-over` emitting `taken-over` | -| A stream that keeps its history, and an object bucket of a module's own | in the integration test: a history stream at its cap refuses a new message and keeps its oldest, its condition raised at 75 percent and cleared below; an object no version or draft names is removed after a day, one still named is kept; unit tests of registration refusing a name already taken | +| A draft is written by section and has one author, and a take-over tells the previous one | unit tests of each verb of § 4, of a refusal naming the author, and of `take-over` emitting `taken-over`; a take-over refused while the operator's Approve is waited for | +| A stream that keeps its history, and an object bucket of a module's own | in the integration test: a history stream at its cap refuses a new message and keeps its oldest; an object no version or draft names is removed after a day, one still named is kept; unit tests of registration refusing a name already taken | | A long record is judged whole, one part at a time | unit tests: the frame never passes 16 KiB and says what it cut, with twenty clauses of 2000 bytes and a 40 KiB Context; every question stays under 60 KiB with a 40 KiB section and that frame, and the head part with 40 KiB of clauses; a section over 40 KiB is refused saying split it; an unchanged section keeps its review, a changed frame asks it again | **The fifth slice's tests, one per failure path** (ADR 0592; the review by architectural domain's testing ruling). Unit tests are @@ -614,7 +614,7 @@ table-driven; one integration test starts the module whole against the real bus | a named digest has no object | unit: health unhealthy, naming it; the integrity tool restores it from given text | | a body does not hash to its name | unit: the read refuses it, naming the digest | | a full object bucket | integration: a write refused naming the cap; health unhealthy | -| a full history stream | integration: `submit` refused with the head unchanged; the condition at 75 percent raised and cleared | +| a full history stream | integration: `submit` refused with the head unchanged | | a judge timeout for one part | unit: that part stays asked and the version proposed, saying which; the others keep their verdicts | | a restart with parts asked | integration: the parts in `asked` are collected again and judged | | `reviewed` once per version | unit: one `reviewed` after the last `part-reviewed`, carrying every verdict | @@ -623,6 +623,7 @@ table-driven; one integration test starts the module whole against the real bus | the move's check | unit: a changed review, a missing finding and a missing ask, each named | | writes during the switch | unit: every writing verb refused with its reason; reading verbs answer | | an older judge | the indexer's judge test (release sdk1): a manifest with `objects` or `retention: history` refused by a judge that does not know them, accepted by one that does | +| the grants part's forms | the grants part's test (release sdk1), against a real bus server: an object bucket and a history stream created for their module; a read-only grant on that one bucket for a module named in `readers`, removed at the next composition once withdrawn; the condition at 75 percent raised and cleared below | | a reference | unit: "record › title › row" resolves to the section; a nested title is refused | | a form-only version | unit: accepted when only names and links changed and each target resolves; refused otherwise | | an unproven caller | unit: `open`, `write`, `submit`, `propose` and `take-over` refuse it | @@ -685,7 +686,7 @@ clause instead); and the rules of how-we-build, which are not decision records. The fifth slice was reviewed by architectural domain on 2026-11-02 (four reviewers, two architectural domains each; the knowledge base's own review of ADR 0592's fourth version beside), and the lead ruled on every finding. What was found, and what answers it: -| Aspect | Found | Answered by | +| Architectural domain | Found | Answered by | |---|---|---| | security | unproven callers could write or take over; an Approve did not bind the sections shown; readers were named outside ADR 0363's grant (the knowledge base's review of version 6); a proposal waiting on the operator could be taken over; readers' grants and a body's match with its name were unsaid; a draft had no bound | ADR 0592 §4, §8, §9, §17, §19, §20, §21; § 2.1, § 4 | | seams | asked parts lived only in memory; told marks and reservations had no form on the bus; the judge's ticket is polled; who creates buckets and grants was unsaid; the judge is a module's tool, not a seat | ADR 0592 §2, §7, §16, §23; § 1, § 5 (the judge's seat a note on issue 1956), § 8.1 | @@ -697,4 +698,4 @@ review of ADR 0592's fourth version beside), and the lead ruled on every finding | tools | unnamed objects, missing bodies, form-only versions, asked parts and told marks had no tool | ADR 0592 §32; § 1.1 (the tools table) | The knowledge base's review of the fourth version found that the reference form read as nested sections: ADR 0592 -§24 and § 2.2 say sections never nest. +§30 and § 2.2 say sections never nest.