jschoubben
87c6a56b81
novox/hq ADR 0024, gaps 1 and 2. The user's stated requirement, and the first thing here that no machine can answer: a hosted model is on nobody's node and is reached over the public internet, so the rule that refuses two ends sharing no private network must not apply to it. A licence is a named thing and the name is the operator's — *the personal account*, *the organisation's* — because the whole point is saying which one a given consumer uses, and an anonymous credential hanging off a provider cannot be said. Many to many, so deliberately not a claim: two machines sharing an account is ordinary rather than a collision. Gap 2 is the missing verb, *accept*: take a value somebody supplied, seal it to each holder, discard the plaintext. With the consequence stated rather than hidden — a holder recorded after the key was supplied has no key and the mesh cannot make one, so it is refused by name with the remedy, not silently handed an empty file. Refusal is felt, as the record warns: a mesh holding three ways to reach a model refuses every consumer that has not chosen. So the refusal names the candidates and the exact command. Being right is not the same as being usable. Gaps 3 and 4 — a consumer that is not a machine, and switching as a reaction rather than a declaration — remain gaps. Half-building them would put a conditional in the declaration language, which is what ADR 0024 says plainly to avoid. Its own context, with its own store and its own credential: a licence is a different aggregate from anything inventory owns, and it refers to nodes by name because that is what crossing a context boundary may carry.
42 lines
1.9 KiB
SQL
42 lines
1.9 KiB
SQL
-- A licence is a named thing, and the name is the operator's.
|
|
--
|
|
-- novox/hq ADR 0024. Not an anonymous credential hanging off a provider: *the personal account*,
|
|
-- *the organisation's account* are names a person uses, and the mesh has to use them too, because
|
|
-- the whole point is saying WHICH ONE a given consumer uses.
|
|
--
|
|
-- **Many to many.** One provider has several licences; one licence serves several consumers. So it
|
|
-- is deliberately not a claim — claims are for things only one holder may have, and two machines
|
|
-- sharing an account is the ordinary case rather than a collision.
|
|
|
|
create table licence (
|
|
-- The operator's name for it. The primary key, because that is what a person types and what a
|
|
-- consumer is pinned to.
|
|
name text primary key,
|
|
-- Which service it is for: anthropic, openai, a model the mesh runs itself.
|
|
provider text not null,
|
|
-- What a consumer needs to know that is not secret -- a base URL, a model name. The key is
|
|
-- never here.
|
|
serves jsonb not null default '{}'::jsonb,
|
|
added_at timestamptz not null default now()
|
|
);
|
|
|
|
-- Who holds it, and the key sealed to them.
|
|
--
|
|
-- **The node is a name, not a foreign key.** It lives in another context and this one may not join
|
|
-- across that boundary (novox/hq ADR 0008); a name is the published identifier and is what
|
|
-- crossing a context boundary is allowed to carry.
|
|
create table licence_holder (
|
|
licence text not null references licence(name) on delete cascade,
|
|
node text not null,
|
|
module text not null,
|
|
|
|
-- Sealed to that node's key. Null until a key has been supplied while this holder existed --
|
|
-- which is a real state and not an error: the mesh discarded the plaintext, so it cannot seal
|
|
-- to a holder that arrived afterwards, and saying so is better than delivering nothing.
|
|
sealed text,
|
|
node_key text,
|
|
|
|
added_at timestamptz not null default now(),
|
|
primary key (licence, node, module)
|
|
);
|