Implement triad process architecture - #135
Draft
josh-richardson wants to merge 169 commits into
Draft
Conversation
Related-Broker: 6e3985b Related-Signer: 5c09a6a
Related-Signer: 5c09a6a Related-Broker: ac7ef23
Related-Broker: ac7ef23 Related-Signer: 2fe667a
Related broker: 0bf0e81 Related signer: 2fe667a
Protocol 0bd5a9c; Signer 94170be; Broker 88cde7c.
Route Machine custody preparation through the authenticated Broker client, retire secret-bearing CLI and IPC surfaces, remove production Machine ceremony ownership, and fail closed for legacy signing and policy paths.\n\nCounterparts: bloom-broker 7715f62; bloom-signer efc9d5d.
Persist owner-readable ceremony projections, use the shared status/cancel/result surface, and implement Option A policy update prepare and receipt-only commit without adding RPC methods. The legacy direct policy-signing command remains absent.\n\nCompatible with Broker checkpoint 634ebbc and Signer checkpoint 89c691e.
Move durable ceremony and Option A policy orchestration onto the production bloom-machine binary, reconcile every structured and raw ceremony response before output, and enforce a keyless production dependency graph.\n\nCompatible with Broker checkpoint 634ebbc and Signer checkpoint 89c691e.
Restore the PrivateKeySigner import for legacy transaction test helpers while keeping it absent from production builds.
Related Broker checkpoint: 634ebbc Related Signer checkpoint: 89c691e Policy update and other generic custody workflows now require SUCCEEDED while wallet registration alone retains COMPLETED, per section 13.6.
Bind confirm, replace, and cancel signing to the exact unsigned transaction preimage, durable approval identity, and installer provenance catalog. Recover ambiguous completed signing operations by status before consulting exhausted approvals. Cross-repo context: bloom-broker 1a6a5b1; bloom-signer bcc607b.
Implement Option A policy custody from the canonical VFS projection. Persist operation identity before prepare, reconcile shared ceremony state across restart and response loss, and permit commit only through the completed custody receipt. Broker: 3b18a99 Signer: bcc607b
Moves real-chain confirm and replacement coverage onto the payload-bearing Machine-to-Broker contract, verifies the retired owner-session hash-only route fails closed without broadcast, and rejects the wrong effective UID before application authentication. Replacement ceremonies now supersede only completed prior exact-operation projections. This is partial W8 evidence; distinct-principal packaging remains a separate release gate.\n\nBroker boundary and revocation: f8c9900\nSigner boundary: 9995be8
Removes every ignored-test attribute. Local integration tests now run by default; credential, mount, and live-network tests self-skip behind explicit environment gates when their external prerequisite is absent. No test is hidden from cargo test discovery.
Add bounded listener diagnostics, launchd handover/retry conformance, non-transitive macOS sandbox groups, and fail-closed packaging sources for AC-31. Broker listener implementation and cross-UID evidence: bloom-broker 79a9e6a. Signer process-boundary baseline: bloom-signer 9995be8.
Provision per-login Broker and Signer principals through systemd-owned named sockets, non-transitive ACL groups, private state roots, hardened services, and explicit AWS KMS egress rendering. Add static and privileged UID-isolation evidence while keeping host mutation confined to disposable Linux CI.
Pin platform-managed time sources, enforce synchronized OS readings, preserve suspend-aware monotonic anchors, and document the audited operator repair contract. Broker baseline: 79a9e6a. Signer baseline: 9995be8.
Select principal-private checkpoint roots on Linux and macOS, verify pinned peer journal-head signatures, and reject rollback, conflicts, tamper, symlinks, and noncanonical storage. Broker baseline: 7f20472. Signer baseline: 41cf596.
# Conflicts: # QUICKSTART.md # crates/bloom-proto/src/config.rs
* fix(macos): harden enrollment and activation startup * fix(vfs): scope projection refresh to serve lifecycle * fix(dev): support triad VFS without NFS mount * fix: address triad lifecycle review findings * docs: design services-only triad launcher * feat(dev): run triad services without Machine * docs: explain split triad development loop
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Why
The triad architecture moves authorization and custody out of the Machine process, removes direct/hash-only signing paths, and makes process, protocol, replay, audit, packaging, and operating-system isolation boundaries testable.
Validation
Local validation passed after merging the current default branch:
cargo fmt --all -- --checkcargo check --workspace --all-targets --lockedcargo clippy --workspace --all-targets --locked -- -D warningscargo test --workspace --lockedThe non-privileged Linux W0 and macOS listener-retry CI lanes pass. The production
macos-unix-principalsclaim remains deliberately disabled until the privileged destructive W0 workflow runs after this workflow is available on the default branch and its conformance evidence is recorded.Checklist
docs/architecture/) updated if contracts or behavior changeddocs/architecture/Sealed Approvals.md