From e212e3841d717d700329c527a6a8aa9b17811460 Mon Sep 17 00:00:00 2001 From: jochen Date: Wed, 21 Oct 2026 01:54:01 +0200 Subject: [PATCH] Follow the scanning record's settled shape in design 60: a file under the home folder, the certificate as health --- 03-DESIGN/01-to-be/60-the-brother-module.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/03-DESIGN/01-to-be/60-the-brother-module.md b/03-DESIGN/01-to-be/60-the-brother-module.md index cce1aee1..0c1b00da 100644 --- a/03-DESIGN/01-to-be/60-the-brother-module.md +++ b/03-DESIGN/01-to-be/60-the-brother-module.md @@ -99,7 +99,7 @@ is the evidence. ## 3. Printing A caller prints in one call: `printer.print` takes a kept scan by its key, a document it has uploaded, or a file -on the machine the tool runs on, which the verb uploads and prints in the same call (the file: ADR NNNN, proposed); +under the operator's home folder, which the verb uploads and prints in the same call (the file: ADR NNNN, proposed); with the copies, the sides and the paper. The device process fetches the document from the bucket and sends it to the printer in a format the printer itself lists as accepted, read before the job; a document in another format is refused with the printer's list (ADR 0468 §5). A document larger than one bus message travels in parts, each under the bus's @@ -166,7 +166,10 @@ Configure changes the device's pages and never the module's config (ADR 0474, pr ## 6. Health -The tool side's health is whether the scanner answers; the device process's is its unit. A certificate the device +The device process's health is its unit. The module's health, as ADR NNNN proposes, compares the certificates the +printer serves, without a login, with the pinned one, and is unhealthy, naming the new fingerprint, when the printer +serves one that is not pinned; a printer that does not answer is healthy with a note, and with no printer address set +the module waits for that setting. Until that is accepted, a changed certificate shows only when a verb is refused. A certificate the device serves that is not pinned is refused, and the refusal names the served and the pinned fingerprint. A device serves a new certificate after a reset, a firmware update or a certificate's renewal, so a refusal is either that or another machine answering in its place; only the operator can tell which, and pins the new fingerprint as a config @@ -175,8 +178,6 @@ missing page and expects the error. ## 7. Still open -- **A certificate change said before a call fails.** Today a changed certificate shows only when a verb is refused; - the module should raise it as its condition, naming both fingerprints. No decision holds it yet. - **Files off the bus.** Documents cross the bus in parts, as proposed (ADR 0468 §3). ADR 0468 is to be revised so that a document travels through a signed link to the bucket instead, and only its key crosses the bus. - **Restart is not built yet.** `printer.restart` is decided (ADR 0467 §5) and follows `printer.configure`.