WIP mirror: universal Flow runtime (judge) - #179
Draft
roninjin10 wants to merge 2 commits into
Draft
Conversation
…ement FlowWire is the transport-neutral execution contract: one serializable Request in, one serializable Response out, over the same Flow definitions and FlowEngine as every other projection. The engine never interprets authority itself — it exposes the EnvelopeInterpreter seam and fails closed when a request names an envelope no interpreter can read. CapabilityEnvelope is the serializable authority that rides along: versioned, fail-closed on decode, and monotone, because apply is CapabilitySet.attenuate. A request can therefore only narrow what its executing host already allows. Declared capability requirements are patterns, not exact capabilities: parsePattern reads action:glob (and the conservative `*` shorthand), and CapabilitySet.allowsPattern proves an intersected authority contains a whole requirement. resourceSubsumes now accepts `*` the same way matches does, so the two predicates cannot disagree about the same glob. CapabilityEnvelope.interpreter is the single decoder-to-attenuator every placement installs, and patternsOf is the single reading of a declaration's capability strings, so no placement can grow its own dialect of either.
An omitted envelope means "run with whatever this host holds", which is only safe while every caller of the transport is already trusted with that ceiling. `FlowWire.serve`/`serveHttp` now take `requireEnvelope`: the flows that refuse an unenveloped request, checked before the payload decodes, so a caller cannot learn whether its payload was well-formed without first stating its authority. `EnvelopeRejected` gains the `missing` code alongside `unsupported` and `uninterpretable`, so an absent envelope is legible as an authority refusal — 403 over HTTP — rather than a flow that ran and failed. Flows not named keep the ambient-authority default, which is what a pure flow wants. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This draft PR is a mirror of local Smithers worktree progress.
Do not merge this PR on GitHub. The synthesized result will be reviewed, merged in a clean local clone, pushed to main, and this mirror will be closed.