ARCH-04 — Workspace identity, verification, exclusion domains, and mutation safety #832

New Issue

2026-07-22T19:47:49-05:00

jcwalker3 commented

2026-07-22 19:47:49 -05:00

Candidate architecture requiring executable validation; not yet approved, production-ready, or certified.

Parent: #820. Epic, not an implementation leaf.

ARCH-04 overall safety model

Workspace identity is registered and project-scoped; verified status is DB-enforced to require a same-binding, clean, current-generation evidence row. [SCHEMA].
A stored status='verified' is never authoritative by itself: use-time rechecks join live node/evidence/supervisor/generation status. [SCHEMA] joins + [TRUSTED-SERVICE]/[RUNTIME-ADAPTER] physical reprobe.
Overlap/alias disjointness is proven by storage identity, not path strings; exclusion domains serialize verification. [SCHEMA] + [RUNTIME-ADAPTER] probe.
Global node/volume/domain identity authority is platform/supervisor, never project.admin; a project administrator may only attach eligible verified global identities.

Enforcement-label vocabulary

[SCHEMA] · [TRUSTED-SERVICE] · [RUNTIME-ADAPTER].

Children (resolved issue numbers)

#833 — Global nodes, volume incarnations, exclusion domains, and isolation proofs
#834 — Workspace configuration generations, immutable history, and current-evidence integrity
#835 — Atomic workspace probing, overlap exclusion, and action-time drift detection
#836 — Workspace, node, volume, and domain retirement with dependent-resource fencing

Definition of done (epic)

All four children merged with executable tests; acceptance matrix (#837) cross-references ARCH-04 invariants.

Known limitations / deferred

External filesystem drift with no DB row change cannot be caught by a trigger — the probing child (#835) defines the action-time reprobe contract. Depends on ARCH-01 evidence + supervisor authority.

**Candidate architecture requiring executable validation; not yet approved, production-ready, or certified.** Parent: #820. **Epic, not an implementation leaf.** ## ARCH-04 overall safety model - Workspace identity is registered and project-scoped; `verified` status is DB-enforced to require a same-binding, clean, current-generation evidence row. `[SCHEMA]`. - A stored `status='verified'` is never authoritative by itself: use-time rechecks join live node/evidence/supervisor/generation status. `[SCHEMA]` joins + `[TRUSTED-SERVICE]`/`[RUNTIME-ADAPTER]` physical reprobe. - Overlap/alias disjointness is proven by storage identity, not path strings; exclusion domains serialize verification. `[SCHEMA]` + `[RUNTIME-ADAPTER]` probe. - Global node/volume/domain identity authority is platform/supervisor, never project.admin; a project administrator may only attach eligible verified global identities. ## Enforcement-label vocabulary `[SCHEMA]` · `[TRUSTED-SERVICE]` · `[RUNTIME-ADAPTER]`. ## Children (resolved issue numbers) - [ ] #833 — Global nodes, volume incarnations, exclusion domains, and isolation proofs - [ ] #834 — Workspace configuration generations, immutable history, and current-evidence integrity - [ ] #835 — Atomic workspace probing, overlap exclusion, and action-time drift detection - [ ] #836 — Workspace, node, volume, and domain retirement with dependent-resource fencing ## Definition of done (epic) All four children merged with executable tests; acceptance matrix (#837) cross-references ARCH-04 invariants. ## Known limitations / deferred External filesystem drift with no DB row change cannot be caught by a trigger — the probing child (#835) defines the action-time reprobe contract. Depends on ARCH-01 evidence + supervisor authority.

jcwalker3 referenced this issue

2026-07-22 19:48:33 -05:00

ARCH-04 — Global nodes, volume incarnations, exclusion domains, and isolation proofs #833

jcwalker3 referenced this issue

2026-07-22 19:49:27 -05:00

ARCH-04 — Workspace configuration generations, immutable history, and current-evidence integrity #834

jcwalker3 referenced this issue

2026-07-22 19:50:06 -05:00

ARCH-04 — Atomic workspace probing, overlap exclusion, and action-time drift detection #835

jcwalker3 referenced this issue

2026-07-22 19:50:43 -05:00

ARCH-04 — Workspace, node, volume, and domain retirement with dependent-resource fencing #836