|
26 | 26 | "A Context Session has exactly schemaVersion 1, kind context-session, lineageRef, sequence, priorSessionDigest, executionBinding, changeBinding, contextBinding, materialization, resolution, acceptanceAuthority, and sessionDigest: executionBinding contains executionRef and workSpecificationDigest; changeBinding contains changeId, primaryModuleRef, compilationDigest, and governanceBaselineDigest; contextBinding contains contextCapsuleDigest, readScopeDigest, invariant writeScopeDigest, and invariant materializationPlanDigest; materialization contains sourceBinding with repositoryIdentityDigest, gitContentDigest, trackedPathFactsDigest, pathSetDigest, manifestDigest, and productDigest plus only ordered pathRef, byteLength, and contentDigest manifest entries; resolution is null initially or contains contextExpansionRequestDigest, requestedPathRefs, controllerDecision, compiler-derived disposition, proposalSourceBinding, neutral self-digested contextImpact, and newlyDisclosedPathRefs; acceptanceAuthority is always false and sessionDigest seals every preceding field.", |
27 | 27 | "lineageRef is exactly canonicalDigest({ executionBinding, changeBinding, contextBinding }); initial Session sequence is zero, priorSessionDigest is null, and its ledger compare-and-swap expects null. Every successor preserves the same lineageRef and entire contextBinding, sets sequence to prior sequence plus one and priorSessionDigest to the current Session digest, and calls compare-and-swap with that current digest as expectedSessionDigest.", |
28 | 28 | "Source bodies live only in bounded process-lifetime content-addressed blob state and opaque source or delivery products; Context Session Create, controller, delivery, Repository Source, and Project Model ownership products never enter ordinary input or Context Session, Worker Execution, Change, Store, HTTP, CLI, or Profile records, and every returned source byte is defensively copied.", |
29 | | - "The closed resolution input contains only schemaVersion 1, kind context-expansion-resolution, one canonical Worker Context Expansion Request, and controllerDecision grant or deny; Worker Interface validation proves the request's canonical self-declared execution, Work Specification, priorRecordDigest, Capsule, and capability bindings, but Context Kernel does not observe whether that Worker Record is current, settle it, or use it as resolution authority, while the current controller product alone binds the prior Context Session.", |
| 29 | + "The closed resolution input contains only schemaVersion 1, kind context-expansion-resolution, one canonical Worker Context Expansion Request, and controllerDecision grant or deny. Before invoking Worker Interface validation, Context Kernel performs one bounded descriptor-based deep scan that rejects nested, revoked, or ordinary proxies, accessors, cycles, non-canonical containers, and over-limit values without executing caller code. Worker Interface validation then proves the request's canonical self-declared execution, Work Specification, priorRecordDigest, Capsule, and capability bindings, but Context Kernel does not observe whether that Worker Record is current, settle it, or use it as resolution authority, while the current controller product alone binds the prior Context Session.", |
| 30 | + "Each controller product privately carries the canonical Work Specification capability-profile digest, its expansionRequests limit, and a bounded inherited set of successfully settled Context Expansion Request digests. An exact settled request replay fails before source projection, while a distinct canonical request digest for fully disclosed paths alone may compile as redundant. Granted, denied, and redundant resolutions each consume one expansion slot only after successful lineage compare-and-swap; rejected input and blob, source, compiler, or ledger failure consume neither the controller nor its request budget.", |
30 | 31 | "Every granted, denied, or compiler-derived redundant resolution preserves the prior contextBinding including materializationPlanDigest and requires through options the current controller product and a live Repository Source Product whose exact canonical UTF-8-byte-sorted full proposal pathRefs are prior materialization union original requested paths; proposalSourceBinding contains exactly repositoryIdentityDigest, gitContentDigest, trackedPathFactsDigest, pathSetDigest, manifestDigest, and productDigest, its repositoryIdentityDigest, gitContentDigest, and trackedPathFactsDigest must respectively equal the prior materialization sourceBinding fields, every prior manifest entry must remain byteLength- and contentDigest-identical, contextImpact.primaryModuleRef must equal changeBinding.primaryModuleRef, and contextImpact.repositorySourceBinding must be field-for-field equal to proposalSourceBinding. Context Kernel derives the exact set relation before calling Project Model: a fully already-disclosed original request is redundant and becomes a canonical empty Impact disclosure delta, a disjoint original request becomes its exact Impact disclosure delta and may be granted or denied, and mixed already-disclosed and new paths fail closed; Project Model alone derives every structural fact in the neutral Context Impact from that normalized delta, the exact Change-bound primaryModuleRef, and the full proposal projection.", |
31 | 32 | "The controller holder may choose only grant or deny; disposition, redundancy, successor scope, full source selection, materialization, neutral Context Impact, and lineage are compiler-derived from frozen inputs, and no Worker or caller may supply classifications, a successor, or its own grant.", |
32 | | - "The default blobStore and sessionLedger are bounded process-lifetime implementations. blobStore.commitBatch([{ contentDigest, bytes }]) is atomic, treats an existing identical digest and byte sequence as idempotent, and fails on a digest collision or partial write; blobStore.read(contentDigest) returns a defensive copy only after revalidating its digest. sessionLedger.compareAndSwap({ lineageRef, expectedSessionDigest, successorSession }) returns exactly { committed, currentSessionDigest }; a throw, malformed result, or committed false is a failed compare-and-swap and cannot rotate products or disclose bytes.", |
| 33 | + "The default blobStore and sessionLedger are bounded process-lifetime implementations. blobStore.commitBatch([{ contentDigest, bytes }]) is atomic, treats an existing identical digest and byte sequence as idempotent, and fails on a digest collision or partial write; blobStore.read(contentDigest) returns a defensive copy only after revalidating its digest. Every default Context Kernel instance uses one process-shared atomic ledger registry namespaced first by the projected physical repositoryIdentityDigest and then by lineageRef, so aliases of one repository contend while distinct clones cannot collide; replay of an already current identical successor is a conflict, not idempotent success. sessionLedger.compareAndSwap({ lineageRef, expectedSessionDigest, successorSession }) returns exactly { committed, currentSessionDigest }; a throw, malformed result, or committed false is a failed compare-and-swap and cannot rotate products or disclose bytes. A caller-injected ledger is responsible for equivalent sharing across every Context Kernel instance that may serve the same repository.", |
33 | 34 | "Initial creation and granted expansion call blobStore.commitBatch before sessionLedger.compareAndSwap; an initial blob or ledger failure produces no Session, controller, or delivery, while an expansion failure leaves the prior Session and controller current and produces no successor or delivery. A grant reads and commits only its newly disclosed byte delta, adopts the exact full-proposal projection as successor materialization, and only after successful compare-and-swap consumes the prior controller and mints the successor controller and delivery; a completed blob commit followed by failed compare-and-swap may leave only unreachable content-addressed blob residue. Denied and redundant resolutions only project their body-free full-proposal source, never read requested bytes or commit new blobs, compare-and-swap successors whose materialization is field-for-field identical to the prior materialization, and never return a new delivery product.", |
34 | 35 | "The Change Kernel-issued Context Session Create Product, Context Kernel-issued controller and delivery products, Assurance Runtime-issued Repository Source Product, and Project Model-issued ownership product are distinct frozen zero-own-key process-local capabilities whose authority cannot be serialized, cloned, proxied, reconstructed from their ordinary projections, or substituted across issuer instances or kinds. Session creation and every successful resolution return one new opaque controller product bound to the exact Context Kernel instance and current Session; resolution rejects forged, serialized, proxied, cloned, cross-instance, wrong-kind, stale, or consumed controller products. Create and grant additionally return a distinct opaque delivery product bound to the exact complete current manifest, while deny and redundant return no delivery; delivery reads reject forged, serialized, proxied, cloned, cross-instance, wrong-kind, or unknown-path products and return defensive byte copies.", |
35 | 36 | "Context Kernel does not settle or resume a Worker Execution Record; Adapter adoption of a successor Context belongs to LGT-023 and must not create a Worker Execution to Context Kernel dependency cycle.", |
|
0 commit comments