Architecture program — role-delivery-reliability control plane #820

New Issue

2026-07-22T19:38:51-05:00

jcwalker3 commented

2026-07-22 19:38:51 -05:00

Candidate architecture requiring executable validation; not yet approved, production-ready, or certified.

Purpose

Parent tracking issue for the ARCH-01, ARCH-02, and ARCH-04 implementation program: an executable control-plane security architecture whose schema-level claims must be compiled and tested, not asserted in prose.

Program principles (binding on every child)

Schema claims must be compiled and tested. [SCHEMA] enforcement is only credited once the migration executes against a fresh database and the negative/raw-write tests fail closed.
Trusted-service and runtime-adapter contracts must be exercised through tests, not documented and left unexecuted.
SQLite and PostgreSQL behavior must be distinguished. A property proven on SQLite does not imply PostgreSQL parity; each backend is a separate acceptance target.
Direct table access and raw-write bypass attempts are part of acceptance testing. Every invariant labelled [SCHEMA] must have a raw-write test proving the bypass fails.
No architecture component becomes a production security boundary until its readiness checks pass. Subsystems land disabled by default.
Each child is implemented in a bounded PR. Do not place the whole architecture in one PR.
Separation of duties: the author of a PR may not review, approve, or merge it.

Enforcement-label vocabulary (used across all children)

[SCHEMA] — enforced by DB key / CHECK / FK / partial index / trigger.
[TRUSTED-SERVICE] — enforced by the service transaction boundary and authenticated request context, not the database.
[RUNTIME-ADAPTER] — enforced by an external adapter contract (e.g. remote store signature verification) that no schema can perform.

Threat/failure model (program-wide)

Stale daemon executing pre-gate code; a caller asserting another principal's identity in an actor column; a stale/leaked connection context; raw writes bypassing service routines; concurrent installs / merges / grant revocations racing; replayed issuer proofs; workspace filesystem drift after a clean probe; cross-project resource disclosure; byte-distinct Git refs aliased to one identity.

Child checklist (resolved issue numbers)

ARCH-01

#821 — ARCH-01 epic (authority, identity, evidence, platform bootstrap)
#822 — ARCH-01 Foundation Slice A — atomic install + authority kernel (first implementation leaf; status:ready)
#823 — ARCH-01 bootstrap grant succession
#824 — ARCH-01 principal equivalence
#825 — ARCH-01 typed evidence subjects
#826 — ARCH-01 issuer proofs + store generations
#827 — ARCH-01 PostgreSQL service boundary

ARCH-02

#828 — ARCH-02 epic (canonical resources, transport identity, authorized lookup)
#829 — ARCH-02 transport identity + reconciliation
#830 — ARCH-02 canonical resources + byte-safe Git refs
#831 — ARCH-02 authorized project lookup

ARCH-04

#832 — ARCH-04 epic (workspace identity, verification, exclusion domains, mutation safety)
#833 — ARCH-04 global object identities + isolation proofs
#834 — ARCH-04 workspace config generations + current-evidence integrity
#835 — ARCH-04 atomic physical probing + drift detection
#836 — ARCH-04 workspace lifecycle + fencing

Traceability

#837 — architecture acceptance matrix (invariant/test/evidence/backend)

Dependency spine: #822 → {#823, #824, #825 → #826, #827} · #828 → #829 → #830 → #831 · #832 → #833 → #834 → #835 → #836 · #837 ← all. First bounded implementation PR: #822 (SQLite-first).

Definition of done (program)

Every child implemented behind a bounded PR with executable tests; the acceptance matrix (#837) cross-references every normative invariant to a numbered AC, a named test, an enforcement layer, an audit event, and backend coverage; no component enabled as a production security boundary until its readiness checks pass.

Known limitations / deferred

Remote store-signature verification is [RUNTIME-ADAPTER] and cannot be schema-enforced. PostgreSQL parity is a distinct program of work (#827 for ARCH-01; ARCH-02/04 parity per child). This program does not itself authorize enabling any subsystem in production.

**Candidate architecture requiring executable validation; not yet approved, production-ready, or certified.** ## Purpose Parent tracking issue for the ARCH-01, ARCH-02, and ARCH-04 implementation program: an executable control-plane security architecture whose schema-level claims must be **compiled and tested**, not asserted in prose. ## Program principles (binding on every child) - **Schema claims must be compiled and tested.** `[SCHEMA]` enforcement is only credited once the migration executes against a fresh database and the negative/raw-write tests fail closed. - **Trusted-service and runtime-adapter contracts must be exercised through tests**, not documented and left unexecuted. - **SQLite and PostgreSQL behavior must be distinguished.** A property proven on SQLite does not imply PostgreSQL parity; each backend is a separate acceptance target. - **Direct table access and raw-write bypass attempts are part of acceptance testing.** Every invariant labelled `[SCHEMA]` must have a raw-write test proving the bypass fails. - **No architecture component becomes a production security boundary until its readiness checks pass.** Subsystems land disabled by default. - **Each child is implemented in a bounded PR.** Do not place the whole architecture in one PR. - **Separation of duties:** the author of a PR may not review, approve, or merge it. ## Enforcement-label vocabulary (used across all children) - `[SCHEMA]` — enforced by DB key / CHECK / FK / partial index / trigger. - `[TRUSTED-SERVICE]` — enforced by the service transaction boundary and authenticated request context, not the database. - `[RUNTIME-ADAPTER]` — enforced by an external adapter contract (e.g. remote store signature verification) that no schema can perform. ## Threat/failure model (program-wide) Stale daemon executing pre-gate code; a caller asserting another principal's identity in an actor column; a stale/leaked connection context; raw writes bypassing service routines; concurrent installs / merges / grant revocations racing; replayed issuer proofs; workspace filesystem drift after a clean probe; cross-project resource disclosure; byte-distinct Git refs aliased to one identity. ## Child checklist (resolved issue numbers) **ARCH-01** - [ ] #821 — ARCH-01 epic (authority, identity, evidence, platform bootstrap) - [ ] #822 — ARCH-01 Foundation Slice A — atomic install + authority kernel **(first implementation leaf; status:ready)** - [ ] #823 — ARCH-01 bootstrap grant succession - [ ] #824 — ARCH-01 principal equivalence - [ ] #825 — ARCH-01 typed evidence subjects - [ ] #826 — ARCH-01 issuer proofs + store generations - [ ] #827 — ARCH-01 PostgreSQL service boundary **ARCH-02** - [ ] #828 — ARCH-02 epic (canonical resources, transport identity, authorized lookup) - [ ] #829 — ARCH-02 transport identity + reconciliation - [ ] #830 — ARCH-02 canonical resources + byte-safe Git refs - [ ] #831 — ARCH-02 authorized project lookup **ARCH-04** - [ ] #832 — ARCH-04 epic (workspace identity, verification, exclusion domains, mutation safety) - [ ] #833 — ARCH-04 global object identities + isolation proofs - [ ] #834 — ARCH-04 workspace config generations + current-evidence integrity - [ ] #835 — ARCH-04 atomic physical probing + drift detection - [ ] #836 — ARCH-04 workspace lifecycle + fencing **Traceability** - [ ] #837 — architecture acceptance matrix (invariant/test/evidence/backend) Dependency spine: #822 → {#823, #824, #825 → #826, #827} · #828 → #829 → #830 → #831 · #832 → #833 → #834 → #835 → #836 · #837 ← all. **First bounded implementation PR: #822 (SQLite-first).** ## Definition of done (program) Every child implemented behind a bounded PR with executable tests; the acceptance matrix (#837) cross-references every normative invariant to a numbered AC, a named test, an enforcement layer, an audit event, and backend coverage; no component enabled as a production security boundary until its readiness checks pass. ## Known limitations / deferred Remote store-signature verification is `[RUNTIME-ADAPTER]` and cannot be schema-enforced. PostgreSQL parity is a distinct program of work (#827 for ARCH-01; ARCH-02/04 parity per child). This program does not itself authorize enabling any subsystem in production.