docs/adr: 0028 sketch — content-addressed artifacts (read by CID, write by append + bind) - #381
Open
hartsock wants to merge 2 commits into
Open
docs/adr: 0028 sketch — content-addressed artifacts (read by CID, write by append + bind)#381hartsock wants to merge 2 commits into
hartsock wants to merge 2 commits into
Conversation
…te by append + bind) WHAT: a Proposed/sketch ADR deciding how content identity enters Bridle's fs authority and evidence: CIDs as exact scope tokens (never a new Caveats axis, never bearer authority); reads of immutable artifacts as fs_read on a harness-owned <store>/<cid> so the existing Landlock fence enforces the CID rule at Kernel grade; trees as the content-addressable crate's DAG shapes with containment = DAG closure; writes as append(store) + bind(ref -> CID) performed by the harness under fs_write on the ref path; evidence binding input/action/fence/output CIDs (closes two ASM-CID hops); named residuals. WHY: the exact-token meet is semantically empty for path scopes and a path grant approves a location, not the bytes; content identity fixes both for immutable inputs and outputs, and Jupyter (newt#1730) is value -> action -> value shaped. Identity policy for raw artifacts is deferred to content-addressable#84 so this does not become a fifth hash convention. Verified inputs recorded in the ADR: Landlock rules are inode-keyed; no kernel content enforcement on the reference host; hash-then-reread is racy. Co-authored-by: Claude <noreply@anthropic.com>
…tentId, typed-bytes identity, #84-first sequencing) WHAT: replace the deferred 'codec decided elsewhere' language with the resolved contract: RawContentId for artifacts, ContentId for records, VerifiedCid for foreign identities; ArtifactRef<RawContentId> compared as typed normalized CID bytes (never text, never bare digest); Raw(X) != Content(X) as a proof vector; alternatives + sequencing updated (#84 lands before any grant carries an artifact id). WHY: #84 was resolved decisively on 2026-08-16; the ADR should consume the identity contract, not restate an open question. Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Proposed/sketch ADR deciding how content identity enters Bridle's fs authority and evidence — architecture-before-implementation, no code.
Caveatsaxis, never bearer authority ("a CID identifies, it never authorizes").fs_readon a harness-owned<store>/<cid>; the existing Landlock fence enforces it at Kernel grade because rules are inode-keyed and the child holds nofs_writeon the store. The path rule is the CID rule — zero protocol change.content-addressablecrate's DAG shapes (feat(shell): wire the Landlock fs_write L3 boundary into the engine (#35) #53); containment = DAG leaf closure.append(store) + bind(ref → CID), performed by the harness underfs_writeon the ref path;fs_writenever targets a CID; working trees stay path-shaped.AdmittedFenceId, output CIDs — closes two ASM-CID hops.Identity policy for raw artifacts (codec / text / algorithm) is deliberately deferred to hartsock/content-addressable#84 so this does not become the workspace's fifth hash convention.
Worked example: Jupyter as a hermetic action (
execute(notebook: CID) → CID), motivated by newt-agent#1730.Test plan
Docs only.
just check-security(internal-specifics + docs-accuracy) and the full pre-push hook passed locally. Proof obligations for the eventual implementation are listed in the ADR under ADR 0023 tiers.Not for merge without human review — it is a design decision.