Opened per t274 rev-4 (§5b thread 1, approved) so this stops living only in running-state prose.
The ruling trail: t263 ruled server-side per-user access filtering "becomes mandatory before any second real user connects"; t264 recorded it "still open". Verified t274: no access.go (or equivalent) exists anywhere in this repo — internal/kernel/ holds interfaces, liveness, log_lock*, log_store*, mem_store, runtime, store, sweep only; no branch among 22 local / 49 remote heads addresses it; no prior issue.
Current state: the t260 kernel-auth model is bearer-on-write / reads-open (--auth-token-file, writeGate in internal/transport/server.go). That gates writing, not seeing — any holder of the URL reads the full fold. Single-user today, so accepted; the moment a second real user (or a partner-scoped principal, e.g. the family/kinship lanes in ffs0#183) connects, per-user read filtering is a precondition, not a feature.
Shape (from the t259 derivation, to be designed, not assumed): urn:moos:derivation:zappa.t259-access-law (status: open) sketches access as a law over the WF02 governs spine + group membership closure — i.e., filtering is a fold-derived view per principal, not an ACL sidecar. The MTDC-rewrite lane will want the same law expressed in its type system, so whatever lands here should stay small and derivable.
Not scheduled for the t274 round (rev-4 §5b#1) — candidate first kernel-lane item after the A18 perf pass. Owner: kernel lane (Wolfram gated on the participation gate; John Lydon fallback).
authored-by: agent:claude-cowork.hp-z440 / session:sam.z440-cowork-workspace / t274-rev4-execution
🤖 Generated with Claude Code
Opened per t274 rev-4 (§5b thread 1, approved) so this stops living only in running-state prose.
The ruling trail: t263 ruled server-side per-user access filtering "becomes mandatory before any second real user connects"; t264 recorded it "still open". Verified t274: no
access.go(or equivalent) exists anywhere in this repo —internal/kernel/holds interfaces, liveness, log_lock*, log_store*, mem_store, runtime, store, sweep only; no branch among 22 local / 49 remote heads addresses it; no prior issue.Current state: the t260 kernel-auth model is bearer-on-write / reads-open (
--auth-token-file,writeGateininternal/transport/server.go). That gates writing, not seeing — any holder of the URL reads the full fold. Single-user today, so accepted; the moment a second real user (or a partner-scoped principal, e.g. the family/kinship lanes in ffs0#183) connects, per-user read filtering is a precondition, not a feature.Shape (from the t259 derivation, to be designed, not assumed):
urn:moos:derivation:zappa.t259-access-law(status: open) sketches access as a law over the WF02governsspine + group membership closure — i.e., filtering is a fold-derived view per principal, not an ACL sidecar. The MTDC-rewrite lane will want the same law expressed in its type system, so whatever lands here should stay small and derivable.Not scheduled for the t274 round (rev-4 §5b#1) — candidate first kernel-lane item after the A18 perf pass. Owner: kernel lane (Wolfram gated on the participation gate; John Lydon fallback).
authored-by: agent:claude-cowork.hp-z440 / session:sam.z440-cowork-workspace / t274-rev4-execution
🤖 Generated with Claude Code