nervur 0.17.0 → 0.18.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +30 -31
- package/package.json +2 -6
- package/GETTING_STARTED.md +0 -138
- package/protocol/SPEC.md +0 -1843
- package/protocol/vectors/arithmetic.json +0 -117
- package/protocol/vectors/door.json +0 -345
- package/protocol/vectors/framing.json +0 -92
- package/protocol/vectors/wire.json +0 -48
- package/quo-kit.md +0 -652
package/protocol/SPEC.md
DELETED
|
@@ -1,1843 +0,0 @@
|
|
|
1
|
-
# SPEC
|
|
2
|
-
|
|
3
|
-
This is the truth of Quo, and the whole context. It assumes nothing from any
|
|
4
|
-
other document. It is the protocol and nothing else: what any ward anywhere
|
|
5
|
-
must do, in any language, for its bytes to be Quo. A sentence is here only
|
|
6
|
-
because a ward written in another language needs it to interoperate with
|
|
7
|
-
ours. What one kit chose, and another kit may refuse, is that kit's paper and
|
|
8
|
-
never this one.
|
|
9
|
-
|
|
10
|
-
It carries no version and keeps no history. There is no 1.0.0 yet, so there
|
|
11
|
-
is nobody holding an older Quo to be compatible with, and no changelog to
|
|
12
|
-
write. This file is rewritten in place to say what the tree says, and when
|
|
13
|
-
the two disagree the fix is to move one of them, the same day. Where the tree
|
|
14
|
-
is behind a decision, the chapter "Where the tree stands" says so; that
|
|
15
|
-
chapter is the one place a gap is allowed to be named instead of closed.
|
|
16
|
-
Before 1.0.0 there is no compatibility promise: this document may still
|
|
17
|
-
move under anyone holding it. At 1.0.0 it is frozen once, and versioning
|
|
18
|
-
starts to mean something.
|
|
19
|
-
|
|
20
|
-
## What Quo is
|
|
21
|
-
|
|
22
|
-
Quo is a protocol that lets an object ask another object and get an answer,
|
|
23
|
-
without knowing whether that other object is in the same process, on the same
|
|
24
|
-
device, or on another planet. It works on any device and in any language that
|
|
25
|
-
can run code. It is three words, two of which are beings, and two edges.
|
|
26
|
-
Nothing else is Quo.
|
|
27
|
-
|
|
28
|
-
- **Harbor.** The program a device runs to boot wards. Owns the wire and the
|
|
29
|
-
operating system. Not a being. Nobody outside its device.
|
|
30
|
-
- **Ward.** One process of its harbor. A being plus ward functions. Keeps
|
|
31
|
-
beings and judges its door.
|
|
32
|
-
- **Being.** One ordinary object, one voice.
|
|
33
|
-
|
|
34
|
-
Each word names both the interface and the thing. There is no fourth word.
|
|
35
|
-
|
|
36
|
-
```
|
|
37
|
-
device A device B
|
|
38
|
-
harbor A harbor B
|
|
39
|
-
map: pk -> door | reach map: pk -> door | reach
|
|
40
|
-
ward W1 (pk1) ward W3 (pk3)
|
|
41
|
-
being b1 being b4
|
|
42
|
-
standings: [shop, bank] occupants: [cust7]
|
|
43
|
-
occupants: [owner] being b5 public
|
|
44
|
-
being b2
|
|
45
|
-
ward W2 (pk2)
|
|
46
|
-
being b3
|
|
47
|
-
```
|
|
48
|
-
|
|
49
|
-
- A ward is named outward by one public key, its pk, derived from its seed.
|
|
50
|
-
That pk routes and nothing else. A being has no pk and no address. She has
|
|
51
|
-
relations, named by ids that never leave her ward.
|
|
52
|
-
- A **standing** is a pointer a being holds to another being, through which
|
|
53
|
-
she asks. An **occupant** is a being she invited, whom her ward names when
|
|
54
|
-
she asks.
|
|
55
|
-
- Every relation has two keys, one minted by each side for that relation
|
|
56
|
-
alone. Underneath every id her ward keeps the far ward's pk, the key she
|
|
57
|
-
is known by in that relation, and the key the far side is known by. She
|
|
58
|
-
never sees them.
|
|
59
|
-
- The harbor routes by ward pk only. Its own pks map to doors, one per ward
|
|
60
|
-
it booted. Foreign pks map to whatever the device calls a reach. How a
|
|
61
|
-
harbor fills the foreign half is its own directory, and Quo says nothing
|
|
62
|
-
about it.
|
|
63
|
-
- b1 asking b3 and b1 asking b4 are the same act inside the ward. The first
|
|
64
|
-
never leaves harbor A. The second does. b1 cannot tell, and should not. b1
|
|
65
|
-
asking b2 never leaves the ward at all.
|
|
66
|
-
- The ward routes one thing: its own pk. Every other ward pk goes into one
|
|
67
|
-
call the harbor gave it, and what comes back is bytes or nothing.
|
|
68
|
-
|
|
69
|
-
The rule that closes every chapter: whatever does not fit one of the lines in
|
|
70
|
-
this document is not Quo's.
|
|
71
|
-
|
|
72
|
-
## The two edges
|
|
73
|
-
|
|
74
|
-
Quo has two edges, harbor to ward and ward to being. At each an object
|
|
75
|
-
crosses once, at birth, and calls cross for the rest of the ward's life.
|
|
76
|
-
Nothing crosses either of them but what is written here.
|
|
77
|
-
|
|
78
|
-
### Harbor to ward
|
|
79
|
-
|
|
80
|
-
The harbor passes the **ground**, once, at birth, and receives two pointers.
|
|
81
|
-
The ground is nine things, and a kit gathers them however its
|
|
82
|
-
language gathers things. What each one is, is Quo's; how they are held
|
|
83
|
-
together is not.
|
|
84
|
-
|
|
85
|
-
1. **The seed.** The ward derives its pk from it and from nothing else.
|
|
86
|
-
Thirty-two bytes are the seed; anything else, text or bytes of another
|
|
87
|
-
length, is SHA-256'd to thirty-two bytes first.
|
|
88
|
-
2. **The partition.** The ward's files, as values, opaque to the harbor.
|
|
89
|
-
3. **Instantiate.** A class name and a stance in, the being or nothing out.
|
|
90
|
-
A name the harbor does not hold is nothing, and the boot that named it
|
|
91
|
-
fails.
|
|
92
|
-
4. **Carry.** A ward pk and bytes in, bytes or nothing out. Nothing means no
|
|
93
|
-
door was reached, and a throw is read the same way.
|
|
94
|
-
5. **Random.** A count in, that many bytes of entropy out. Every key a ward
|
|
95
|
-
mints is drawn from it.
|
|
96
|
-
6. **Wrote.** The ward says it after every write to its partition, and after
|
|
97
|
-
nothing else, naming the row. It is told, and nothing comes back from it.
|
|
98
|
-
A harbor that keeps the partition saves in the order it was told. A
|
|
99
|
-
harbor that keeps nothing needs it not at all.
|
|
100
|
-
7. **Keep.** Whether what was written is kept. The ward asks it once, at the
|
|
101
|
-
end of an arrival, after the being has answered and before the reply is
|
|
102
|
-
sealed, and no in makes that arrival a failed ask. It is the only thing
|
|
103
|
-
the ward learns about storage, and it learns it as yes or no and never as
|
|
104
|
-
a reason. A harbor that keeps nothing needs it not at all, and a ward
|
|
105
|
-
never asked answers as though no store could ever say no.
|
|
106
|
-
8. **Calling.** A call of this ward's has begun, and what comes back says it
|
|
107
|
-
has ended. The ward says it, because the ward is the one that knows where
|
|
108
|
-
a call begins: a being reaching another being is one relation and two
|
|
109
|
-
halves, and she writes her side before the bytes go out and again when
|
|
110
|
-
they come back. Between the two her rows are half of a call, and a harbor
|
|
111
|
-
may write them down but may not take them as a point to put a refused ward
|
|
112
|
-
back to. Calls nest, a call that threw ends like any other, and a harbor
|
|
113
|
-
that keeps nothing needs it not at all.
|
|
114
|
-
9. **Lend.** What the device lends this ward's beings, by name. One call: a
|
|
115
|
-
name and a taker in, whether it was taken out. The harbor's root mints an
|
|
116
|
-
invitation on a being of its own ward, for this ward alone, and hands it
|
|
117
|
-
to the taker, which knocks and takes it and answers whether it did. A
|
|
118
|
-
taker that would not take is one the harbor unmints for, so nothing
|
|
119
|
-
half-lives. No is every kind of no. A harbor that lends nothing needs it
|
|
120
|
-
not at all.
|
|
121
|
-
|
|
122
|
-
Nine things, and nothing else is ever passed: a harbor that needs a tenth
|
|
123
|
-
has found a gap in Quo or a leak into the ward. `lend` is the whole of what
|
|
124
|
-
a device offers, and it offers it as a relation and never as an object: the
|
|
125
|
-
things a device can do are beings, booted by the harbor in a ward of its
|
|
126
|
-
own, and a being reaches one by holding a standing at her, exactly as she
|
|
127
|
-
reaches a being on another planet. The name is the harbor's namespace and no
|
|
128
|
-
word of the ward, which ward may ask for which name is decided where the
|
|
129
|
-
ground is built, and a stranger's ward is lent nothing. A harbor never mints:
|
|
130
|
-
it holds the ask pointer of the ward it booted, so it is that ward's root,
|
|
131
|
-
and the root may invite on any being of its ward. What comes back is a value
|
|
132
|
-
the ward carries to her, as an invitation is carried anywhere.
|
|
133
|
-
|
|
134
|
-
Returned:
|
|
135
|
-
|
|
136
|
-
- **The door.** One call: sealed bytes in, sealed bytes out, and one bit
|
|
137
|
-
beside them, `heard`: whether a key this door holds spoke. Always bytes:
|
|
138
|
-
when the ask did not open, the reply is silence sealed to whatever ephemeral
|
|
139
|
-
pk the bytes carried, and noise when they carried none. The bit is all a
|
|
140
|
-
harbor learns from an arrival, never a reason: a pk that only ever brings
|
|
141
|
-
strangers' bytes is the harbor's to rate or refuse, and what a bound key
|
|
142
|
-
hears is sealed to its own lid.
|
|
143
|
-
- **The ask.** One call: method and args in, a value or silence out. A value,
|
|
144
|
-
not an object: what a being answers is held to the value rule and nothing
|
|
145
|
-
narrower, so a string, a number and an array are all answers.
|
|
146
|
-
In-process and unsealed. This is the one unsealed ask in Quo, and the only
|
|
147
|
-
way a ward is piloted. Judgment, catching, and the return table are not
|
|
148
|
-
skipped: a throw inside is silence, and an unreached shape is silence.
|
|
149
|
-
|
|
150
|
-
The harbor learns the ward's pk the way anyone learns anything: it asks. The
|
|
151
|
-
empty ask on the ask pointer answers with the ward's describe, and the pk is
|
|
152
|
-
in its notes.
|
|
153
|
-
|
|
154
|
-
### Ward to being
|
|
155
|
-
|
|
156
|
-
The ward passes one object, once, at birth, and receives one object, on
|
|
157
|
-
which it calls one method.
|
|
158
|
-
|
|
159
|
-
```
|
|
160
|
-
in the stance at birth, once, for life
|
|
161
|
-
the asker at every ask
|
|
162
|
-
out her answer(asker, method?, args?) -> object | silence the one method the ward calls
|
|
163
|
-
```
|
|
164
|
-
|
|
165
|
-
The stance is her cells, her standings to ask, the calls to invite,
|
|
166
|
-
knock, take and remove, boot, and lend. The ward builds it and hands it
|
|
167
|
-
to the harbor's instantiate with a class name, and receives her. No method is
|
|
168
|
-
the empty ask, and what she answers to it is her blueprint.
|
|
169
|
-
|
|
170
|
-
The stance, as every being in every language receives it. Nothing more is
|
|
171
|
-
ever offered, and nothing here may be missing.
|
|
172
|
-
|
|
173
|
-
```
|
|
174
|
-
stance
|
|
175
|
-
cells her state. values only.
|
|
176
|
-
|
|
177
|
-
occupants.invite(id, notes?) -> invitation | null awaitable: a key is minted
|
|
178
|
-
occupants.remove(id) -> nothing
|
|
179
|
-
|
|
180
|
-
standings.knock(invitation, method?, args?, wanted?) -> object | silence | word
|
|
181
|
-
standings.take(id, invitation) -> id | null awaitable: it waits for the relation
|
|
182
|
-
standings[id] -> standing | undefined
|
|
183
|
-
standings[id].ask(method?, args?, wanted?) -> object | silence | word
|
|
184
|
-
standings.remove(id) -> nothing
|
|
185
|
-
|
|
186
|
-
boot(class, key, id?) -> key | null a new being of her ward, by class name.
|
|
187
|
-
with an id, her standing to her under it
|
|
188
|
-
|
|
189
|
-
lend(name, id) -> id | null a standing at what this device lends,
|
|
190
|
-
by the harbor's name for it. awaitable:
|
|
191
|
-
the ward knocks and takes it for her
|
|
192
|
-
|
|
193
|
-
wanted = { time? } what this one ask may spend, in milliseconds. optional,
|
|
194
|
-
and so is saying anything at all
|
|
195
|
-
```
|
|
196
|
-
|
|
197
|
-
Return table.
|
|
198
|
-
|
|
199
|
-
| call | returns | when |
|
|
200
|
-
| ------------------- | ---------- | ------------------------------------------------------------------------------------------------------------ |
|
|
201
|
-
| invite(id, notes?) | invitation | she minted a fresh id; the occupant record exists from now, with those notes on it |
|
|
202
|
-
| | null | the id already names a record, occupant or standing, or is a reserved word, or the notes are not values |
|
|
203
|
-
| remove(id) | nothing | always. removing what is not there is nothing |
|
|
204
|
-
| knock(inv, m, a, w) | object | the far being answered |
|
|
205
|
-
| | silence | no ward claims the invitation, or another consumed it, or the far being chose silence |
|
|
206
|
-
| | word | why not, when the far door or her own ward can say: removed, absent, unannounced, repeated, |
|
|
207
|
-
| | | threw, unreached, late, invitation. see "Silence, the words, error" |
|
|
208
|
-
| take(id, inv) | id | she knocked with this invitation and was answered, and the id is fresh |
|
|
209
|
-
| | null | no answered knock on this invitation, or the id already names a record, or is a reserved word |
|
|
210
|
-
| standings[id] | standing | the record exists |
|
|
211
|
-
| | undefined | it does not. not an error |
|
|
212
|
-
| ask(m, a, w) | object | she answered |
|
|
213
|
-
| | silence | she chose to say nothing, or bytes came back that are not Quo's |
|
|
214
|
-
| | word | why not: removed, absent, repeated, threw, unreached, late, dropped |
|
|
215
|
-
| boot(cls, key, id?) | key | she exists from now, with fresh cells, and a restart finds her; with an id, her maker holds her standing |
|
|
216
|
-
| | null | the key is already booted, the harbor holds no such class, the class threw at birth, the id is one the maker |
|
|
217
|
-
| | | already holds or a reserved word, or the relation was refused; nothing of the being made is left |
|
|
218
|
-
| lend(name, id) | id | this device lends that name to her ward, and she holds a standing at it under the id she gave |
|
|
219
|
-
| | null | it lends no such name here, the id already names a record or is a reserved word, or the relation was |
|
|
220
|
-
| | | refused; nothing is left behind |
|
|
221
|
-
|
|
222
|
-
A being may make, and only the owner reaches into another. Boot touches
|
|
223
|
-
nobody else: the being made has empty cells and no relation but the one her
|
|
224
|
-
maker named, and every other is invited and taken like any other. That one is
|
|
225
|
-
made the way all of them are, and it is the whole of what making gives: the
|
|
226
|
-
being made mints an occupant for her maker under the maker's own key, so she
|
|
227
|
-
knows who made her by that name and by nothing else, and her maker knocks
|
|
228
|
-
with it and takes the standing under the id she gave. Naming no id makes no
|
|
229
|
-
relation at all, and a being made that way is reachable by the owner alone. A
|
|
230
|
-
relation that could not be made is a boot that made nobody: the being made
|
|
231
|
-
goes out again, and nobody saw her, since she is a moment old and named to
|
|
232
|
-
no one yet. What the owner has that the maker does not is every ask that
|
|
233
|
-
reaches into a being from outside: public, invite and knock for her, remove,
|
|
234
|
-
unboot. Who may ask her to boot is her gate, as who may ask her anything is.
|
|
235
|
-
|
|
236
|
-
Lend is boot's shape for what the device already has. What a device can do
|
|
237
|
-
is beings, in a ward its harbor booted and roots, and `lend` is how a being
|
|
238
|
-
of another ward comes to hold a standing at one: her ward asks the ground
|
|
239
|
-
for the name, the harbor's root mints an invitation on that being, and her
|
|
240
|
-
ward knocks with it and takes it under the id she gave. She is handed the
|
|
241
|
-
id and nothing else, exactly as her maker is handed a key. From then on it
|
|
242
|
-
is an ordinary standing, counted and rotated, removable by her, and told
|
|
243
|
-
`removed` when the far being drops her.
|
|
244
|
-
|
|
245
|
-
Boot's shape includes what boot does when it fails. A being made whose
|
|
246
|
-
relation could not be made is unmade, because she is her maker's ward's own
|
|
247
|
-
and that ward may take her out again. The being lent is not: she stands in
|
|
248
|
-
the harbor's ward, which no other ward may reach into. So the two halves are
|
|
249
|
-
one call rather than two, and the ward's half runs inside the harbor's: the
|
|
250
|
-
harbor mints, hands the invitation to her ward to knock and take, and hears
|
|
251
|
-
whether it was taken. A knock refused, a take that lost the id to another
|
|
252
|
-
line of hers, a ward gone in between: each answers no, and the root that
|
|
253
|
-
minted removes the occupant it made. Nothing half-lives on either side of
|
|
254
|
-
the seam, and a refused lend costs the box nothing, which is what the table
|
|
255
|
-
above promises.
|
|
256
|
-
|
|
257
|
-
The invitation never reaches her, and that is the difference between this
|
|
258
|
-
relation and every other one she holds. Her own invitations are hers to
|
|
259
|
-
give away, because giving one away is giving her own relation away. This
|
|
260
|
-
one is not hers: it is the device's, minted for her ward alone, and a value
|
|
261
|
-
she could copy is a capability she could hand to anyone. So she never sees
|
|
262
|
-
it. A being who wants to lend her device access to another lends it in the
|
|
263
|
-
open, by offering an ask of her own that forwards to her standing, where her
|
|
264
|
-
gate reads who is asking and she can stop.
|
|
265
|
-
|
|
266
|
-
Null is every kind of no, and she cannot tell them apart because there is
|
|
267
|
-
nothing she would do differently: this harbor lends nothing, or nothing of
|
|
268
|
-
that name, or nothing of that name to her ward, or what was minted could not
|
|
269
|
-
be taken. What a device has is not hers to enumerate.
|
|
270
|
-
|
|
271
|
-
The ground is the harbor's, so `lend` reaches the box she is running on and
|
|
272
|
-
no other. A ward that moved box is handed the new harbor's ground, and a
|
|
273
|
-
standing she woke up holding names a being on the box she left, which is
|
|
274
|
-
what a standing means and is why it is not a bug. A being who wants the box
|
|
275
|
-
she is on asks for it again at every birth, which she cannot tell from a
|
|
276
|
-
restart and does not need to.
|
|
277
|
-
|
|
278
|
-
Lend is one direction, and the other one is not a second mechanism. A being
|
|
279
|
-
who wants to be woken invites, hands that invitation to whoever will wake
|
|
280
|
-
her inside an ask, and is woken as the occupant she named. A tick, a
|
|
281
|
-
delivery, a push and a stranger's ask are one act at her door, told apart by
|
|
282
|
-
the id her ward puts on them and by nothing else. Nothing reaches her that
|
|
283
|
-
she did not invite, and nothing wakes her that does not hold a standing at
|
|
284
|
-
her.
|
|
285
|
-
|
|
286
|
-
Ask, knock, invite, take, boot and lend are awaitable. Async where the
|
|
287
|
-
language has it, blocking where it does not. Every ask she makes is a new
|
|
288
|
-
call.
|
|
289
|
-
|
|
290
|
-
The asker has three shapes and no fourth, and nothing else ever reaches her.
|
|
291
|
-
|
|
292
|
-
- `{ id }`: her own id for the occupant at the door, the one she minted when
|
|
293
|
-
she invited her.
|
|
294
|
-
- `{}`: she is the public being of her ward, and that is how she knows.
|
|
295
|
-
- `{ id: 'OWNER' }`: the arrival came on the ward's ask pointer, from her
|
|
296
|
-
owner.
|
|
297
|
-
|
|
298
|
-
`OWNER` and `PUBLIC` are reserved words: invite and take refuse them, so no
|
|
299
|
-
occupant can ever wear either name. A kit reserves more, because a relation
|
|
300
|
-
is written in two places, the ward's keys and her record, and a name either
|
|
301
|
-
of them cannot hold is a relation half made and a throw where the table above
|
|
302
|
-
promises a null. Which names those are is that kit's, since an id never
|
|
303
|
-
crosses a door and no far ward can tell. Where the refusal happens is Quo's:
|
|
304
|
-
at the mint and at the take, where every other refusal is, and never at the
|
|
305
|
-
write.
|
|
306
|
-
|
|
307
|
-
## Silence, the words, error
|
|
308
|
-
|
|
309
|
-
Three kinds of answer to "no object came back", and only three. Everything in
|
|
310
|
-
Quo that can go wrong ends in one of them, and a being who knows the three
|
|
311
|
-
never needs a fourth.
|
|
312
|
-
|
|
313
|
-
```
|
|
314
|
-
error an object. hers. { error: ... }, or any shape her output schema declares.
|
|
315
|
-
silence the ward's silence. bytes came back, or would have, and said nothing.
|
|
316
|
-
it is what a stranger hears, and what she hears when
|
|
317
|
-
the far being chose to say nothing.
|
|
318
|
-
a word the ward's word. one of nine, said only to someone the ward can name,
|
|
319
|
-
and never to a stranger: why no object came.
|
|
320
|
-
```
|
|
321
|
-
|
|
322
|
-
- An **error** is an ordinary answer. Quo never reads it, never makes it,
|
|
323
|
-
and never treats it apart from any other object. The owner's asks answer
|
|
324
|
-
error objects for what they refuse, and they are hers to read like any
|
|
325
|
-
object.
|
|
326
|
-
- **Silence** names no reason, by law. It is what the door says to bytes it
|
|
327
|
-
cannot admit, so that a stranger learns nothing, and what a being says
|
|
328
|
-
when she chooses to say nothing. It is not blindly retryable: the far
|
|
329
|
-
being may have done the work and the answer was lost.
|
|
330
|
-
- **A word** names the reason. It is said to a key the door has bound, sealed
|
|
331
|
-
to that key's lid, or by her own ward to her, in process. Nobody else ever
|
|
332
|
-
hears one. A word is not an object: it carries nothing but its name, a
|
|
333
|
-
being cannot make one, and one that comes out of a being is read as her
|
|
334
|
-
having thrown.
|
|
335
|
-
|
|
336
|
-
The nine words, and who says them:
|
|
337
|
-
|
|
338
|
-
```
|
|
339
|
-
the door, to a key it has bound, on the wire as { quo: word }
|
|
340
|
-
removed the relation this key spoke for was removed by the being who invited it
|
|
341
|
-
absent the being who invited it did not come back this run; her cells wait
|
|
342
|
-
unannounced the knock announced no key of her own, so it bound nothing
|
|
343
|
-
repeated the number was already honoured, or is at or below the span
|
|
344
|
-
threw she threw, or answered a shape that is not hers to make
|
|
345
|
-
|
|
346
|
-
her own ward, to her, and never on the wire
|
|
347
|
-
unreached no far door was reached. nothing is known to have been delivered.
|
|
348
|
-
late the wait ran out. the far door may have heard and be working still.
|
|
349
|
-
invitation the invitation is not one. nothing was sent.
|
|
350
|
-
dropped she dropped the standing, and asked on what she held. nothing was sent.
|
|
351
|
-
```
|
|
352
|
-
|
|
353
|
-
- **Unreached** is safe to retry: nothing is known to have been delivered.
|
|
354
|
-
In one case the far ward heard and died before it could answer, and the
|
|
355
|
-
wire says nothing about it; asking again asks under the next number and
|
|
356
|
-
is heard, so the retry is safe all the same. See Closed.
|
|
357
|
-
- **Late** is not unreached, and the difference is the whole reason there are
|
|
358
|
-
two words: a bound that expired promises nothing about delivery.
|
|
359
|
-
- **Removed**, **absent**, **unannounced** and **repeated** are refusals: the
|
|
360
|
-
ask reached no being and nothing was written. They are said only because
|
|
361
|
-
the key that asked has already proven who it is, so a reason to it is an
|
|
362
|
-
oracle to nobody. **Threw** is a choice: she was reached, and the number is
|
|
363
|
-
spent.
|
|
364
|
-
|
|
365
|
-
Who says what. A being says objects and silence, never a word: the shape is
|
|
366
|
-
the ward's, and a ward that sees one come out of a being answers `threw`. A
|
|
367
|
-
ward says all three to its own being, and on the wire objects, silence and
|
|
368
|
-
the five door words, each sealed to the lid of the key that asked; the four
|
|
369
|
-
ward words never cross, they are her own ward's and are said in process. A
|
|
370
|
-
harbor says nothing at all; it returns bytes or nothing, and does not know
|
|
371
|
-
any of these words. What it learns from an arrival is one bit, `heard`,
|
|
372
|
-
beside the bytes the door hands it: whether a key the door holds spoke. The
|
|
373
|
-
owner hears objects: a silence a being met is `{ error: 'silence' }` and a
|
|
374
|
-
word is `{ error: word }`, because the owner is piloting and an object is
|
|
375
|
-
what a shell can print. The ask pointer answers the value silence only when
|
|
376
|
-
the ward itself threw.
|
|
377
|
-
|
|
378
|
-
### What her ward says to her
|
|
379
|
-
|
|
380
|
-
Before or after the wire, her own ward answers on its own in five cases,
|
|
381
|
-
and each says what it is.
|
|
382
|
-
|
|
383
|
-
```
|
|
384
|
-
S1 the invitation is not one a shape that is not a ward pk, a heir with no secret, a secret with no heir.
|
|
385
|
-
nothing is sent. the word is `invitation`.
|
|
386
|
-
S2 the standing is gone she held a standing, dropped it, and asked on what she held.
|
|
387
|
-
nothing is sent. an ask issued while it stood is answered. the word is `dropped`.
|
|
388
|
-
S3 the wait ran out the ask's time was spent and no reply was read.
|
|
389
|
-
what comes back late is not read. the number is spent.
|
|
390
|
-
an ask still waiting at its lane when the wait ran out is never sent. the word is `late`.
|
|
391
|
-
S4 the reply is not one bytes came back over the size, or that do not open, or are not signed by the ward they
|
|
392
|
-
were sent to, or are none of the three reply shapes. the number is spent.
|
|
393
|
-
not Quo's bytes: silence.
|
|
394
|
-
S5 the far door answered silence, or a word, exactly as the door said it.
|
|
395
|
-
```
|
|
396
|
-
|
|
397
|
-
And unreached in two: `U1` the args are not one object of values, or could
|
|
398
|
-
not be sealed, or the method is neither a word nor absent, so nothing left.
|
|
399
|
-
That last is the same rule and the same reason: a payload is written as JSON,
|
|
400
|
-
which drops a field it cannot write, so a method that is not a word would
|
|
401
|
-
arrive as no method at all, and no method at all is the empty ask. She would
|
|
402
|
-
have asked for work, been handed a blueprint, and spent a number on it. What
|
|
403
|
-
a ward cannot send it does not send;
|
|
404
|
-
`U2` the harbor returned nothing, or threw, so no door was reached. The number is
|
|
405
|
-
taken all the same, and the gap it leaves in the count is harmless: the door
|
|
406
|
-
honours any number above its mark.
|
|
407
|
-
|
|
408
|
-
S4 is strict, and strict is a price paid on purpose. A reply carries `seen`
|
|
409
|
-
always, and a reply whose `seen` is neither a digest nor null is none of the
|
|
410
|
-
three shapes, so an answer a far being really gave is read as silence and the
|
|
411
|
-
number is spent with it. The alternative is to read the object and drop the
|
|
412
|
-
field, and then two kits disagree about whether an answer arrived: one hands
|
|
413
|
-
her an object, the other hands her silence, and silence is not blindly
|
|
414
|
-
retryable. That is the one disagreement Quo cannot afford, and it is worth
|
|
415
|
-
losing an answer from a kit that writes one field wrong. A kit that writes it
|
|
416
|
-
wrong is a kit the vectors catch before it ever speaks to anyone.
|
|
417
|
-
|
|
418
|
-
### What the door says
|
|
419
|
-
|
|
420
|
-
The door judges thirteen cases, in this order, and the first case met is
|
|
421
|
-
the answer. The first seven are strangers: bytes the door cannot admit, met
|
|
422
|
-
with one silence whatever the case, and nothing written. The next three are
|
|
423
|
-
refusals to a key the door has bound: still nothing written, but a word,
|
|
424
|
-
because the asker has proven who it is. The last three are choices: the ask
|
|
425
|
-
reached her, so the number is spent and the keys are rotated, and what she
|
|
426
|
-
wrote in her cells is hers.
|
|
427
|
-
|
|
428
|
-
```
|
|
429
|
-
strangers: silence, nothing written, heard false
|
|
430
|
-
D1 the box does not open wrong padlock, garbage, too short, over the size. the reply is sealed to the lid if
|
|
431
|
-
the bytes carried one, and is noise otherwise. a lid that will not
|
|
432
|
-
take a seal, a small-order point, is no lid: noise.
|
|
433
|
-
D2 the payload is malformed by or next not 64 lowercase hex, method not a string, args present and
|
|
434
|
-
not one object of values, seq not a whole number from one, time not a
|
|
435
|
-
whole number above zero, hops not a whole number or at zero.
|
|
436
|
-
D3 for nobody, and nobody is home no public being on this ward.
|
|
437
|
-
D4 for nobody, signature fails the payload names a key it was not signed with.
|
|
438
|
-
D5 the heir is not held never minted here, and not one she removed either.
|
|
439
|
-
D6 the key is not admitted not the key held for the heir, and not the key it announced. a
|
|
440
|
-
forged key, an unannounced key, a heir already spent. a heir she
|
|
441
|
-
removed, under a key that was not the one she removed.
|
|
442
|
-
D7 signature fails under an admitted key, or under the key held for a heir she removed.
|
|
443
|
-
refusals to a bound key: a word, nothing written, heard true
|
|
444
|
-
D8 she is not there `removed`: the occupant record is gone, and this is the key it was
|
|
445
|
-
bound to when it went. `absent`: the being did not come back this run.
|
|
446
|
-
D9 a knock announces nothing `unannounced`: the heir is fresh and next is null, or is the heir
|
|
447
|
-
itself, which is no key of her own. it binds nothing.
|
|
448
|
-
D10 the number is refused `repeated`: already honoured, or at or below the span.
|
|
449
|
-
choices: the number spent, the keys rotated, heard true
|
|
450
|
-
D11 she threw `threw`
|
|
451
|
-
D12 she answered silence on a named ask, or on the empty ask. nothing at all is silence too.
|
|
452
|
-
D13 she answered a non-value `threw`: a word, a Date, a cycle, a NaN, none is hers to make.
|
|
453
|
-
```
|
|
454
|
-
|
|
455
|
-
The signature is verified before anything is written and before any word is
|
|
456
|
-
said, so a stranger cannot burn a number she could not sign for and cannot
|
|
457
|
-
hear a word she could not sign for. The public being is asked by strangers
|
|
458
|
-
only, and a stranger hears silence for whatever she then does: her choices
|
|
459
|
-
are hers, and her insides are not a stranger's to read.
|
|
460
|
-
|
|
461
|
-
A removed relation leaves the door one thing: the keys it held for that
|
|
462
|
-
heir when the id went, kept apart from the heirs under `gone` in the
|
|
463
|
-
partition, bounded, oldest out. That is what lets the door say `removed` to
|
|
464
|
-
the one party who can sign as those keys, and silence to everyone else.
|
|
465
|
-
Nothing else survives a removal.
|
|
466
|
-
|
|
467
|
-
### The law of one silence
|
|
468
|
-
|
|
469
|
-
1. Every stranger's case is one reply: `{ silence: true }`, sealed to the
|
|
470
|
-
lid the ask came with, signed by the ward key. Same bytes, same length.
|
|
471
|
-
A stranger cannot tell one refusal from another, nor any of them from a
|
|
472
|
-
being who chose to say nothing.
|
|
473
|
-
The door equalizes the bytes and not the time it took to write them, and
|
|
474
|
-
the seven cases are not alike in time: two of them verify a signature and
|
|
475
|
-
five refuse before they would. A heir pk rides in the clear, so whoever
|
|
476
|
-
holds a copy of an invitation can time a knock signed with nothing and
|
|
477
|
-
learn whether that invitation is still unspent. What that buys them is
|
|
478
|
-
what knocking with the invitation would have told them anyway, and
|
|
479
|
-
knocking spends it, which is why the door does not pay for a signature it
|
|
480
|
-
has no reason to check. What is equal is what the door says and what it
|
|
481
|
-
writes, and those are the two a stranger could otherwise use. A word, to a
|
|
482
|
-
key the door has bound, is another length, and may be: whoever hears it
|
|
483
|
-
has already proven who they are.
|
|
484
|
-
2. A refusal writes nothing. No number, no key, no heir, no cell, no bind.
|
|
485
|
-
The same bytes presented again meet the same refusal, and a stranger who
|
|
486
|
-
knocks a thousand times leaves no mark. This holds for the three
|
|
487
|
-
refusals a bound key hears just the same: a word costs nothing.
|
|
488
|
-
3. A choice writes what a heard ask writes. The number is spent and the keys
|
|
489
|
-
rotate, so the relation goes on: the next ask on it is answered, and a
|
|
490
|
-
silence or a `threw` never kills a standing.
|
|
491
|
-
4. Silence and a word leave the caller's record as it was. A silent named
|
|
492
|
-
answer leaves `seen` untouched; a silent empty ask leaves `blueprint` and
|
|
493
|
-
`digest` untouched; a word moves neither, and her keys do not rotate on
|
|
494
|
-
one.
|
|
495
|
-
5. Her ward never confuses her. Silence, a word and unreached are told apart
|
|
496
|
-
always, and by nothing else: silence is bytes the far ward wrote and
|
|
497
|
-
chose to say nothing with; a word is a reason, from the far door or her
|
|
498
|
-
own ward; unreached is the wire's nothing. A ward never answers nothing,
|
|
499
|
-
so that nothing always means unreached.
|
|
500
|
-
6. Nobody enforces what a being does with silence or a word. Each is one
|
|
501
|
-
value she compares against, and a ward hands them to her unchanged.
|
|
502
|
-
|
|
503
|
-
## Words and values
|
|
504
|
-
|
|
505
|
-
### Values
|
|
506
|
-
|
|
507
|
-
Everything that crosses an edge is I-JSON (RFC 7493): args, answer,
|
|
508
|
-
blueprint, invitation, and whatever she caches from them. Strings are valid
|
|
509
|
-
Unicode, which is text and not code units: a surrogate stands in a pair or it
|
|
510
|
-
is no string, since a lone one is a character nobody has and no encoding on a
|
|
511
|
-
wire can carry. No duplicate keys. Numbers must be representable as IEEE
|
|
512
|
-
doubles, so integers are exact up to 2^53, and minus zero is not one of them:
|
|
513
|
-
JSON writes it as zero and reads it back as zero, so a harbor keeping objects
|
|
514
|
-
would hand her a sign a harbor writing bytes would not. Larger integers and
|
|
515
|
-
exact decimals travel as strings, with a schema format saying so. Bytes are
|
|
516
|
-
base64 strings. Nothing else is a value: no dates, no references, no
|
|
517
|
-
functions, no native types. An id or a standing is never a value.
|
|
518
|
-
|
|
519
|
-
The two above are the shape of every rule here: a value is a value when every
|
|
520
|
-
harbor and every kit gives back what was put in. Anything a harbor keeping
|
|
521
|
-
objects would preserve and a harbor writing JSON would lose is refused where
|
|
522
|
-
it is written, because the alternative is a harbor that lies to her about
|
|
523
|
-
which harbor she is standing in.
|
|
524
|
-
|
|
525
|
-
Args are held to the same rule before they are sealed: an ask whose args
|
|
526
|
-
are not one object of values is unreached, because nothing left. Her answer
|
|
527
|
-
is held to it at the door: a shape that is not a value is `threw` to a bound
|
|
528
|
-
key and silence to a stranger, so nothing crosses altered. Cells hold values and
|
|
529
|
-
refuse anything else at the moment of writing, in her own frame: a Map, a
|
|
530
|
-
Date, a NaN, a cyclic object, a function, an object that is not a plain one.
|
|
531
|
-
The refusal is a throw where she wrote it, which her ward turns into the
|
|
532
|
-
silence it turns every throw into. She has not answered, and
|
|
533
|
-
nothing was written down that a harbor would later have to lie about. This
|
|
534
|
-
holds all the way down: a container read through her cells is part of her
|
|
535
|
-
cells.
|
|
536
|
-
|
|
537
|
-
### Silence and the words
|
|
538
|
-
|
|
539
|
-
Two of the three kinds of "no object came back". The chapter "Silence, the
|
|
540
|
-
words, error" is the whole of them; here only the values. Silence is one
|
|
541
|
-
distinguished value. Null is an answer. A word is a second kind of
|
|
542
|
-
distinguished value, her ward's own, nine of them, `unreached` among them.
|
|
543
|
-
None is an object, and none carries anything but its name. A kit spells each
|
|
544
|
-
however its language spells one value standing for neither an object nor an
|
|
545
|
-
absence, and the spelling is owed to nobody outside that kit.
|
|
546
|
-
|
|
547
|
-
### Blueprint, schema, digest
|
|
548
|
-
|
|
549
|
-
Nothing here is Quo's invention. Four standards, adopted whole, so that two
|
|
550
|
-
wards in two languages always read one blueprint the same way.
|
|
551
|
-
|
|
552
|
-
```
|
|
553
|
-
blueprint
|
|
554
|
-
asks list of { name, description?, input: schema, output?: schema }
|
|
555
|
-
notes any JSON value
|
|
556
|
-
```
|
|
557
|
-
|
|
558
|
-
The blueprint is the shape of an MCP tool list, plus notes. The schema is
|
|
559
|
-
JSON Schema draft 2020-12, the one MCP uses; typed languages generate from
|
|
560
|
-
it, untyped languages ignore it, and Quo writes none of it. Args are one JSON
|
|
561
|
-
object with named fields, as MCP passes arguments.
|
|
562
|
-
|
|
563
|
-
The digest is SHA-256, as hex, over the JCS (RFC 8785) canonical
|
|
564
|
-
serialization of the blueprint. Same bytes from every language. This is law:
|
|
565
|
-
two wards in two languages always hash one blueprint to one digest. A ward
|
|
566
|
-
that cannot do this is not a ward. Because only values reach a digest, a key
|
|
567
|
-
holding what is not a value is dropped before hashing and an array slot
|
|
568
|
-
holding one is null, which is what crossing an edge does to them anyway.
|
|
569
|
-
|
|
570
|
-
Two places in RFC 8785 are where languages part, and a kit is held to both by
|
|
571
|
-
`vectors/framing.json`. Keys sort by **UTF-16 code unit**, not by code point
|
|
572
|
-
and not by byte, so an astral character sorts before one in the surrogate
|
|
573
|
-
range: `U+1F600` comes before `U+FB33`, which is the reverse of what a
|
|
574
|
-
language sorting code points gives. Numbers are written as ECMAScript writes
|
|
575
|
-
them, `1e+21` and `1e-7` and `0.3333333333333333`, with a negative zero
|
|
576
|
-
written `0`. A kit that reproduces every ASCII vector and neither of these
|
|
577
|
-
hashes one blueprint to two digests, and every standing between the two wards
|
|
578
|
-
refreshes on every ask.
|
|
579
|
-
|
|
580
|
-
Capability and state are two axes, never mixed.
|
|
581
|
-
|
|
582
|
-
```
|
|
583
|
-
capability what she can be asked. blueprint. changes rarely.
|
|
584
|
-
hashed into the digest. learned by the empty ask.
|
|
585
|
-
state what she answers. answers only. may change every ask.
|
|
586
|
-
never hashed. never in the blueprint.
|
|
587
|
-
```
|
|
588
|
-
|
|
589
|
-
A digest change means one thing: her interface changed and the cached
|
|
590
|
-
blueprint is wrong. Notes in the blueprint are about the interface. A being
|
|
591
|
-
that puts state there makes every standing refresh for nothing, and that cost
|
|
592
|
-
is hers.
|
|
593
|
-
|
|
594
|
-
What follows: a being's describe is an MCP tool list with no translation.
|
|
595
|
-
Whoever holds a ward's ask can put an MCP server in front of any being of
|
|
596
|
-
it, and a being's class may wrap an MCP server; neither is a ward function.
|
|
597
|
-
Models are occupants like anyone else. What stays Quo's: silence, unreached,
|
|
598
|
-
ids, invitations, knock and take, the digest rule. MCP is the description
|
|
599
|
-
and value layer. Quo is the relation layer.
|
|
600
|
-
|
|
601
|
-
### Ids
|
|
602
|
-
|
|
603
|
-
An id is minted by the being, bound by the ward, permanent, and never crosses
|
|
604
|
-
the door. Her id for you and your id for her are unrelated. One id names one
|
|
605
|
-
record, and standings and occupants are one namespace: invite refuses an id a
|
|
606
|
-
standing holds, take refuses an id an occupant holds.
|
|
607
|
-
|
|
608
|
-
Two words are the ward's and no being may mint them: `OWNER` and `PUBLIC`,
|
|
609
|
-
the reserved askers of the ward-to-being edge. The ward speaks at every
|
|
610
|
-
being's door as `{ id: 'OWNER' }` when it runs her describe for its owner,
|
|
611
|
-
and an occupant wearing that name would be two parties with one face.
|
|
612
|
-
`PUBLIC` guards nothing today, because a public asker is `{}` and carries no
|
|
613
|
-
id, and it is claimed now while claiming it is free.
|
|
614
|
-
|
|
615
|
-
A kit refuses more names than those two, wherever its own spelling of the
|
|
616
|
-
stance would collide with an id: a standing under a name that spelling has
|
|
617
|
-
already taken would be unreachable, and invite and take refuse it like the
|
|
618
|
-
ward's words. Which names collide is that kit's, because an id never crosses
|
|
619
|
-
a door and a kit that spells the stance another way has no collision to
|
|
620
|
-
refuse.
|
|
621
|
-
|
|
622
|
-
### Cells
|
|
623
|
-
|
|
624
|
-
Cells are I-JSON values. The ward may persist them. A restart is silent: she
|
|
625
|
-
is constructed again with the same cells. Three keys at their root are the
|
|
626
|
-
ward's, `standings`, `occupants` and `class`, and a write of hers to them is
|
|
627
|
-
refused where she wrote it, like a non-value. A value nested past sixty-four
|
|
628
|
-
levels is refused the same way, and that bound is Quo's because a far ward
|
|
629
|
-
reads what a near one wrote: a kit with a deeper stack still refuses at
|
|
630
|
-
sixty-four, or two kits disagree about which blueprint is a value. A kit
|
|
631
|
-
refuses beside it whatever its own runtime writes one way and reads another,
|
|
632
|
-
and those are its own.
|
|
633
|
-
|
|
634
|
-
```
|
|
635
|
-
cells
|
|
636
|
-
standings: { id: { id, digest, blueprint, seen } } ward writes all four
|
|
637
|
-
occupants: { id: { id, notes } } ward writes id, she writes notes
|
|
638
|
-
class ward writes it at boot, so a restart finds her
|
|
639
|
-
anything else hers
|
|
640
|
-
```
|
|
641
|
-
|
|
642
|
-
- `digest` is the hash of the blueprint she last fetched by the empty ask.
|
|
643
|
-
It is over what came back, whatever that was.
|
|
644
|
-
- `blueprint` is that blueprint, and only if it is one. A far describe is
|
|
645
|
-
somebody else's code and may answer any value at all; the ward reads it as
|
|
646
|
-
a blueprint before writing it as one, a list of asks with a name and an
|
|
647
|
-
input each, and writes `null` when it is not. A side walks `asks` by name,
|
|
648
|
-
and a side that broke on a far ward's answer would be one kit made wrong
|
|
649
|
-
by another. The answer itself still goes to whoever asked, unread.
|
|
650
|
-
- `seen` is the digest her ward last saw arrive with an answer. A silent
|
|
651
|
-
refresh leaves it untouched.
|
|
652
|
-
- `notes` is hers. Quo never reads it. Tier, expiry, kinship between an
|
|
653
|
-
occupant and a standing that are the same far being: all hers. `invite`
|
|
654
|
-
may seed it, which is how an inviter says the terms it mints under, and
|
|
655
|
-
after that it is written by nobody but her. The owner's `invite` passes
|
|
656
|
-
what it was given straight through; the ward reads none of it. What is
|
|
657
|
-
seeded is values and is kept as a copy, all the way down: notes that were
|
|
658
|
-
not values would be a record no harbor could write back, and notes shared
|
|
659
|
-
with whoever seeded them would be a hand inside her cells that writes
|
|
660
|
-
without the ward being told, so a restart would bring back something she
|
|
661
|
-
never read. Notes that are not values are no invitation.
|
|
662
|
-
|
|
663
|
-
## Relations
|
|
664
|
-
|
|
665
|
-
### How a relation is born
|
|
666
|
-
|
|
667
|
-
There is one way in and one way back.
|
|
668
|
-
|
|
669
|
-
1. She wants B as an occupant. She mints an id, in her own time, and asks
|
|
670
|
-
her ward for an invitation for it. The occupant record exists from that
|
|
671
|
-
moment. The invitation is a value: it goes by mail, paper, or inside the
|
|
672
|
-
args of some other ask. Quo does not care how.
|
|
673
|
-
2. B consumes it by knocking: an ask carrying the invitation. B's ward
|
|
674
|
-
seals it and hands it to its harbor's carry, and her ward, which
|
|
675
|
-
recognises its own seal, and binds the
|
|
676
|
-
arrival to the id she minted. From now on every ask from B arrives as
|
|
677
|
-
that id. The first such ask is how she learns the invitation was
|
|
678
|
-
consumed. Whether it is still welcome is hers: expiry, one use, anything,
|
|
679
|
-
lives in her notes.
|
|
680
|
-
3. If she answered, B may take her as a standing, minting B's own id for
|
|
681
|
-
her. That is the only moment a standing is born. Take binds B's side
|
|
682
|
-
only; the knock bound hers. Take before a knock, or after a silent one,
|
|
683
|
-
births nothing. B may also knock, say hello, and never call again. She
|
|
684
|
-
keeps B as an occupant until she decides otherwise. She never learns that
|
|
685
|
-
B walked away.
|
|
686
|
-
4. B wants her to reach back? B mints an id, makes an invitation, and puts
|
|
687
|
-
it in the args. She knocks it and takes B if she wants. Two invitations,
|
|
688
|
-
two relations, each chosen by its owner.
|
|
689
|
-
|
|
690
|
-
She is always the initiator. Nobody becomes her occupant unless she invited
|
|
691
|
-
them. Nobody becomes her standing unless she knocked and chose to take, or
|
|
692
|
-
her owner knocked for her.
|
|
693
|
-
|
|
694
|
-
### What take does
|
|
695
|
-
|
|
696
|
-
Take consumes. Until take the relation lives in a knock record, under the far
|
|
697
|
-
ward and the heir; from take it lives in the standing, under her id, and
|
|
698
|
-
never in both. Take copies the keys and the count the knock left, deletes the
|
|
699
|
-
knock record, and the invitation is spent for her: knocking it again is an
|
|
700
|
-
ask on the standing, and taking it again births nothing.
|
|
701
|
-
|
|
702
|
-
Take waits, because a relation has one line of keys and one count, and every
|
|
703
|
-
word spoken for it goes in order. Taken out of that order it would read
|
|
704
|
-
between a knock's send and its answer, and the standing would be born holding
|
|
705
|
-
a number the far door has already honoured and a key it has already rotated
|
|
706
|
-
past. So take goes in the line with the rest.
|
|
707
|
-
|
|
708
|
-
### One relation, one lane
|
|
709
|
-
|
|
710
|
-
Every send on one relation waits for the one before it. The rotation is a
|
|
711
|
-
conversation: a send reads the key that speaks now, announces the next, and
|
|
712
|
-
moves once the far door has answered, and two sends interleaving on one
|
|
713
|
-
relation would read each other's half-written keys. Lanes are per relation:
|
|
714
|
-
beings still ask concurrently, and a slow relation never holds up another.
|
|
715
|
-
Before take the lane is the invitation's; after take it is the standing's,
|
|
716
|
-
and a knock on a taken invitation joins the standing's lane.
|
|
717
|
-
|
|
718
|
-
The keys an ask sends under are read when she calls, not when the lane
|
|
719
|
-
reaches her: an ask issued while the standing stood is answered even if she
|
|
720
|
-
drops it in the next line. An ask on a standing she has already dropped is
|
|
721
|
-
the word `dropped`, and nothing is sent. A knock on the invitation it was
|
|
722
|
-
born on, after take and a drop, is a knock as a heir the far door has already
|
|
723
|
-
spent, so bytes leave and the door's silence comes back: after take the
|
|
724
|
-
invitation names the standing and nothing else, so it is exactly as alive as
|
|
725
|
-
the standing is.
|
|
726
|
-
|
|
727
|
-
A lane is released by the bound and by nothing else. An ask that never comes
|
|
728
|
-
back holds its relation's lane, and every later ask on that relation waits
|
|
729
|
-
behind it, so the bound ends an occupancy and not only a wait. A kit that
|
|
730
|
-
bounds where a being is waiting, and not where the lane is held, has a
|
|
731
|
-
relation that one quiet far side closes for good.
|
|
732
|
-
|
|
733
|
-
### The public being
|
|
734
|
-
|
|
735
|
-
A ward may have one public being, and no more. She is an ordinary being,
|
|
736
|
-
booted by the owner and then marked public by the owner's `public` ask.
|
|
737
|
-
Arrivals for no heir reach her. Her
|
|
738
|
-
asker is `{}`: she is asked by anyone, and she can tell. She may hold
|
|
739
|
-
standings. She may invite, and an occupant of hers arrives named while
|
|
740
|
-
strangers still arrive as `{}`. A ward without a public being answers
|
|
741
|
-
arrivals for no heir with silence.
|
|
742
|
-
|
|
743
|
-
An invitation to her is `{ ward }` alone. One with a secret and no heir is
|
|
744
|
-
not an invitation. She may be taken as a standing on that invitation, and
|
|
745
|
-
such a standing has no heir and never rotates.
|
|
746
|
-
|
|
747
|
-
The signature is checked here for no property, and the check is kept anyway.
|
|
748
|
-
Whoever asks chose that key a moment ago, the box is already authenticated to
|
|
749
|
-
the ward's padlock, and the door binds nothing, so nothing is proven by it and
|
|
750
|
-
nothing would be lost by dropping it. It stays because the payload has one
|
|
751
|
-
shape and the door has one path: `by`, `next` and `seq` are required of her
|
|
752
|
-
ask as of every other, and honoured by nobody. A kit author who goes looking
|
|
753
|
-
for the property behind this signature will not find one, and is not missing
|
|
754
|
-
anything.
|
|
755
|
-
|
|
756
|
-
She is reached without a heir, so the door keeps nothing for whoever asked:
|
|
757
|
-
no key it vouched for, and no count. The bit beside her reply is `heard`
|
|
758
|
-
false, as it is for every stranger: no key this door holds spoke. She is the
|
|
759
|
-
one place a stranger is answered by design, so she is the one place the
|
|
760
|
-
harbor's rating must still see a stranger arrive. A harbor that saves before
|
|
761
|
-
its reply goes out follows the ward writing, never the bit, since a public
|
|
762
|
-
being writes in her cells like anyone. The signature is still checked, under
|
|
763
|
-
whatever key signed. Once-only delivery does not reach her: the same sealed
|
|
764
|
-
bytes presented twice are delivered twice, and the number the payload carries
|
|
765
|
-
is required and honoured by nobody. A count per voice would be memory a
|
|
766
|
-
stranger chooses the size of, which is the thing the span exists to refuse.
|
|
767
|
-
|
|
768
|
-
So her answer must be safe to repeat. This is her obligation, not a gap at
|
|
769
|
-
the door. Anything that must happen once lives behind an invitation, where
|
|
770
|
-
there is a heir and a count.
|
|
771
|
-
|
|
772
|
-
Nothing else about her is different. Her cells, her standings and what she
|
|
773
|
-
keeps are hers, exactly as they are for every being, and Quo has no say in
|
|
774
|
-
them: she may hold a board every stranger plays on, a catalogue, a queue, or
|
|
775
|
-
nothing at all. She is an ordinary being who chose to describe herself to
|
|
776
|
-
strangers and to answer them, and that choice is the whole of what makes her
|
|
777
|
-
public. A stranger who keeps knocking is the harbor's, never hers and never
|
|
778
|
-
the door's.
|
|
779
|
-
|
|
780
|
-
### How a relation crosses wards
|
|
781
|
-
|
|
782
|
-
1. She mints an id. Her ward mints a heir for it, keeps the pk, and hands
|
|
783
|
-
her an invitation: her ward's pk, the heir pk, the heir secret. A value.
|
|
784
|
-
It goes anywhere. Rotation one.
|
|
785
|
-
2. The invitation is consumed by an ask at some ward, and that ask names a
|
|
786
|
-
being there. Either B holds it, because a standing put it in her args,
|
|
787
|
-
and B knocks. Or an owner holds it, because it came by mail, and the
|
|
788
|
-
owner's ask knocks for a being of theirs, new or existing. There is no
|
|
789
|
-
third way, because a relation cannot end in thin air.
|
|
790
|
-
3. B's ward mints her own key, signs the knock with the heir secret,
|
|
791
|
-
announces her key inside, seals the box to her ward's padlock, and
|
|
792
|
-
hands it to carry for the ward pk. No relation between the two wards is needed,
|
|
793
|
-
ever. Her ward opens its own box, admits the heir, verifies, binds the
|
|
794
|
-
id to B's key, and hands her the arrival as the id she minted. The heir
|
|
795
|
-
is spent. Rotation two.
|
|
796
|
-
4. B's ward remembers the knock was answered, and lets B take. From then on
|
|
797
|
-
every ask from B on that standing is signed by her current key, announces
|
|
798
|
-
her next, and is sealed to the same padlock. Every answer rotates her.
|
|
799
|
-
5. Same ward: her ward recognises its own pk and delivers without the
|
|
800
|
-
harbor. Same harbor: the harbor finds the pk in its own map and calls the
|
|
801
|
-
other door. Two harbors: the wire. The ward's code has one branch between
|
|
802
|
-
these, and the being has none. A same-ward knock is sealed, signed, and
|
|
803
|
-
judged exactly like a far one.
|
|
804
|
-
|
|
805
|
-
## The door
|
|
806
|
-
|
|
807
|
-
### Keys
|
|
808
|
-
|
|
809
|
-
One 32-byte seed is one key. A being's key signs and never seals. The ward's
|
|
810
|
-
key does both: an Ed25519 pair to sign replies, an X25519 padlock every ask
|
|
811
|
-
is sealed to. Beings never own a padlock.
|
|
812
|
-
|
|
813
|
-
- **The ward key** comes from the seed. Its pk on the wire is the signing pk
|
|
814
|
-
then the padlock, 128 hex, and it routes. Two curves, and each secret is
|
|
815
|
-
HKDF-SHA-256 of the seed under its own label, `quo-ward-sign` and
|
|
816
|
-
`quo-ward-seal`, empty salt, 32 bytes out. Fed the seed straight the two
|
|
817
|
-
scalars would still differ, because Ed25519 hashes what it is given and
|
|
818
|
-
X25519 clamps it raw, but that is an accident of the two designs and no
|
|
819
|
-
separation: one secret would be doing two jobs with nothing said about it,
|
|
820
|
-
and a second kit would have to reproduce a construction nobody named. A
|
|
821
|
-
seed handed in as bytes of the key length is the seed; anything else, text
|
|
822
|
-
or bytes of another length, is SHA-256 first, so a thirty-two character
|
|
823
|
-
name is a name and not a key for being the right size.
|
|
824
|
-
`vectors/framing.json` pins it.
|
|
825
|
-
- **The heir** is the key the inviting ward mints at invite, for one id. It
|
|
826
|
-
keeps the heir's pk beside the id and gives the secret away. The
|
|
827
|
-
invitation IS the heir: ward pk, heir pk, heir secret. Rotation one: the
|
|
828
|
-
occupant already has a key, and the inviter chose it.
|
|
829
|
-
- **Her own key** is what the knocker mints at knock. She signs the knock
|
|
830
|
-
with the heir and announces her own key in it. The door binds the id to
|
|
831
|
-
her key and the heir dies as it speaks. Rotation two: from now on she
|
|
832
|
-
signs with a key the inviter never held. A knock that announces nothing,
|
|
833
|
-
or announces the heir itself, binds nothing.
|
|
834
|
-
- **Next.** Every ask she sends announces the key she will sign with next.
|
|
835
|
-
The door holds two pks for her: the one that may speak now, and the one
|
|
836
|
-
it vouched for. Whichever speaks first wins, and the other dies. There is
|
|
837
|
-
no rotate call: every honoured ask rotates, and a lost reply strands
|
|
838
|
-
nobody. Her side moves to the announced key only when an answer came back
|
|
839
|
-
that was not silence; the door has already moved, and admits both.
|
|
840
|
-
|
|
841
|
-
The knock is the one place where both sides cannot be brought back into
|
|
842
|
-
agreement by that rule alone. If the reply to the first knock is lost, the
|
|
843
|
-
door has spent the heir and rotated to the key she announced, and she does
|
|
844
|
-
not know it: knocking as the heir again would be refused for good. She cannot
|
|
845
|
-
learn which case she is in, so she asks, and the asking tells her. She sends
|
|
846
|
-
under her own key first. If the door heard, that is the key it admits and she
|
|
847
|
-
is answered. If it did not, the key means nothing there and the ask is
|
|
848
|
-
refused; a refusal at a door writes nothing, so the heir is untouched and she
|
|
849
|
-
knocks as the heir, as she would have. One extra round trip, in the one case
|
|
850
|
-
where a reply was lost. It gives a stranger nothing: whoever holds the
|
|
851
|
-
invitation could always knock as the heir, and her own key is admitted only
|
|
852
|
-
where the door already bound it to her.
|
|
853
|
-
|
|
854
|
-
Three keys per relation over its life, one rule at the door: the key I hold
|
|
855
|
-
for you may speak, and so may the key it announced last time, and each
|
|
856
|
-
number once.
|
|
857
|
-
|
|
858
|
-
A send that announces nothing leaves the spare standing. Every ask announces
|
|
859
|
-
its next but a public one, which holds no heir and is one key for life, so
|
|
860
|
-
this is a foreign kit's send and not this one's; and a caller who skipped an
|
|
861
|
-
announcement still holds the key she announced before it. The door forgets no
|
|
862
|
-
key it vouched for until another replaces it, and forgetting one here would
|
|
863
|
-
meet that key with silence at the next ask and kill a healthy relation over a
|
|
864
|
-
field. On a fresh heir the rule is the other one: nothing announced is
|
|
865
|
-
`unannounced`, because there the announcement is what binds.
|
|
866
|
-
|
|
867
|
-
Every key in a relation was minted by one side and its secret never left
|
|
868
|
-
that side, except the heir, which the inviter gives away and which dies the
|
|
869
|
-
first time it speaks. No key serves two relations. No key outlives its
|
|
870
|
-
relation. A ward keeps a bounded list of the pks a being's side minted, and
|
|
871
|
-
how long it is, is that ward's own: nothing in Quo reads the list, so a
|
|
872
|
-
shorter one costs a shorter trail for whoever is looking at the ward, and a
|
|
873
|
-
kit that keeps none holds the same ward.
|
|
874
|
-
|
|
875
|
-
### The count
|
|
876
|
-
|
|
877
|
-
Every ask she sends carries the next number in one unbroken count for that
|
|
878
|
-
relation, starting at one, and the door honours each number once. The number
|
|
879
|
-
rides inside the signed payload, so bytes caught on the road carry the number
|
|
880
|
-
they were sent under: they cannot be renumbered without breaking her
|
|
881
|
-
signature, and they are refused as themselves. A caller who means to ask
|
|
882
|
-
again asks again, under the next number, and is heard. Retry and
|
|
883
|
-
fire-and-forget stay hers to build; only the accident and the interception
|
|
884
|
-
are refused.
|
|
885
|
-
|
|
886
|
-
The door keeps the highest number honoured and which numbers below it are
|
|
887
|
-
spent, out to a span of sixty-four, because a door that remembered every
|
|
888
|
-
number ever seen would be a door with unbounded memory. A number above the
|
|
889
|
-
mark is honoured and moves it; a number inside the span is honoured once; a
|
|
890
|
-
number at or below the span is refused. The mark and the spent list are in
|
|
891
|
-
the partition, because a door that forgets what it honoured honours it again
|
|
892
|
-
after a restart.
|
|
893
|
-
|
|
894
|
-
Her side keeps the number it spoke under whether or not a reply came back. A
|
|
895
|
-
reply lost on the way back is a door that has already honoured the number,
|
|
896
|
-
and offering it twice would silence the relation for good. The count carries
|
|
897
|
-
over from the knock into the standing at take.
|
|
898
|
-
|
|
899
|
-
### The allowance
|
|
900
|
-
|
|
901
|
-
Every ask carries what it may still spend: **time**, in milliseconds. It
|
|
902
|
-
rides inside the signed payload, so a budget caught on the road cannot be
|
|
903
|
-
widened by whoever caught it.
|
|
904
|
-
|
|
905
|
-
A being who says nothing gets her ward's default and never thinks about it.
|
|
906
|
-
A being who wants to say so passes a third argument. What she is given is
|
|
907
|
-
what she asked for held to what her ward allows: a number that is not a
|
|
908
|
-
positive whole number falls to the default rather than refusing her, and one
|
|
909
|
-
above the ceiling is the ceiling, silently, because the ceiling is not hers
|
|
910
|
-
to know. Budget is granted by a ward, never minted by a being. How wide the
|
|
911
|
-
default and the ceiling are is the ward's own, and no far door can tell one
|
|
912
|
-
ward's from another's.
|
|
913
|
-
|
|
914
|
-
They are two numbers and not one, because the third argument is for both
|
|
915
|
-
directions. A being who knows her own work asks for less on the ask she wants
|
|
916
|
-
back quickly, and for more on the one she knows is slow. A ceiling equal to
|
|
917
|
-
the default would leave her only the narrowing half, and would give the ward
|
|
918
|
-
no way to allow one long piece of work without making every ask that
|
|
919
|
-
patient.
|
|
920
|
-
|
|
921
|
-
The sender's wait has an end, and time is the only thing the ward measures:
|
|
922
|
-
no count of doors, no count of bytes, no count of tries. The
|
|
923
|
-
bound covers the whole of an ask, from the moment she calls: a relation that
|
|
924
|
-
comes back round on itself is stopped at its own lane, before a byte is
|
|
925
|
-
sealed, and a bound that watched only the wire would never see it. This is
|
|
926
|
-
what makes three answers three. A wait that does not end is not an object,
|
|
927
|
-
not silence and not unreached, and before the allowance a cycle of legal asks
|
|
928
|
-
could produce one: A asks B, B answering asks A back, A answering asks B on
|
|
929
|
-
the relation the first ask still holds. Now the innermost wait gives up, the
|
|
930
|
-
word `late` unwinds outward, and the ask ends.
|
|
931
|
-
|
|
932
|
-
**A wait that ran out is the word `late`, never silence and never
|
|
933
|
-
unreached.** Unreached promises nothing was delivered and is safe to ask
|
|
934
|
-
again. A bound that expired knows no such thing: the far door may have heard
|
|
935
|
-
and be working still. What comes back late is not read.
|
|
936
|
-
|
|
937
|
-
The harbor keeps a patience of its own, and the two never read each other.
|
|
938
|
-
What a harbor hands back as nothing came back is unreached, and unreached
|
|
939
|
-
says nothing was delivered: a harbor may answer it only where it knows the
|
|
940
|
-
bytes never arrived, no reach for that pk, a socket that would not open, a
|
|
941
|
-
link that is down. A harbor that sent them and then gave up knows no such
|
|
942
|
-
thing, and must not answer at all; the ward's bound will ring, and that is
|
|
943
|
-
`late`, which promises nothing. A harbor that throws has answered nothing
|
|
944
|
-
in a louder voice, and the ward reads it as nothing: unreached. So a harbor
|
|
945
|
-
may hold a shorter patience than the ward for its own reasons, a socket it
|
|
946
|
-
wants back or a queue it will not grow, and whichever ends first ends the
|
|
947
|
-
ask.
|
|
948
|
-
|
|
949
|
-
The receiving door reads the allowance before anything is done under it. A
|
|
950
|
-
payload whose time is not a whole number above zero is malformed, D2, and
|
|
951
|
-
is refused as one. Nothing is spent and nothing rotates, because nothing
|
|
952
|
-
was heard.
|
|
953
|
-
|
|
954
|
-
Each ask is bounded on its own. The time an arriving call has left does not
|
|
955
|
-
bound the asks a being makes while answering it, and an ask carries no count
|
|
956
|
-
of doors; see Closed. Every wait still ends.
|
|
957
|
-
|
|
958
|
-
### Judgment
|
|
959
|
-
|
|
960
|
-
Every arrival is judged by the door, and named by it or falls silent.
|
|
961
|
-
|
|
962
|
-
1. Open the box with the ward's padlock. Read whether it is for a heir or
|
|
963
|
-
for nobody. Parse the payload and refuse any field of the wrong shape.
|
|
964
|
-
2. For nobody: find the public being, verify the signature under the key the
|
|
965
|
-
payload names, and dispatch as `{}`. Nothing is written.
|
|
966
|
-
3. For a heir: admit the signer if it is the key held for that heir or the
|
|
967
|
-
key that key announced, or the key held when she removed the id. Verify
|
|
968
|
-
the signature. Read admission again, since the door judges arrivals
|
|
969
|
-
concurrently and a knock that raced this one may have spent the heir
|
|
970
|
-
while the signature was checked. Only then say anything or write
|
|
971
|
-
anything: a removed
|
|
972
|
-
relation is `removed`, a being not back this run is `absent`, a knock
|
|
973
|
-
with no key is `unannounced`, a number already honoured is `repeated`,
|
|
974
|
-
and none of those writes. Else spend the number and settle the keys, so
|
|
975
|
-
a stranger cannot burn a number she could not sign for, and the same
|
|
976
|
-
bytes twice rotate nothing. Dispatch as `{ id }`.
|
|
977
|
-
4. Catch every throw and answer `threw` to a bound key, silence at the
|
|
978
|
-
public being. Treat a word coming out of a being as a throw.
|
|
979
|
-
5. On every answered named ask, run her describe for that asker in process,
|
|
980
|
-
hash it, and put the digest next to the object in the reply. One trip. A
|
|
981
|
-
describe that throws or falls silent costs the digest and nothing else.
|
|
982
|
-
On the empty ask the reply carries no digest; her side hashes what came.
|
|
983
|
-
6. Answer by the same call the ask came in on.
|
|
984
|
-
|
|
985
|
-
A stranger is bytes the ward cannot admit, and every way of being one is
|
|
986
|
-
listed, with a number, under "Silence, the words, error". The public being
|
|
987
|
-
is the one door a stranger may walk through, and only because she chose it.
|
|
988
|
-
|
|
989
|
-
### Inner and outer
|
|
990
|
-
|
|
991
|
-
Inner: being keys, ids, cells, stances, doors, the bind table, every secret,
|
|
992
|
-
every method, every arg, every answer. Nothing inner is ever readable in the
|
|
993
|
-
bytes, and a kit proves it by reading every byte string that crossed.
|
|
994
|
-
|
|
995
|
-
Outer: ward pks, heir pks, ephemeral pks, ciphertext. That is the whole of
|
|
996
|
-
what the wire sees. The one value a being holds that is outer is the
|
|
997
|
-
invitation, which she carries opaque and never opens.
|
|
998
|
-
|
|
999
|
-
A far ward binds a heir to a pk, never to a being. Two far beings that talk
|
|
1000
|
-
to two beings of mine see two heirs and one ward pk, and two relations that
|
|
1001
|
-
share no key learn nothing from each other.
|
|
1002
|
-
|
|
1003
|
-
### The wire
|
|
1004
|
-
|
|
1005
|
-
Five algorithms, named once and never negotiated: Ed25519 signs, X25519
|
|
1006
|
-
agrees, SHA-256 hashes, AES-256-GCM encrypts, and the key and nonce it
|
|
1007
|
-
encrypts under are derived together by HKDF-SHA-256 under an empty salt and
|
|
1008
|
-
the label `quo-seal`. That
|
|
1009
|
-
label is the message cipher's and no other: HKDF appears twice in Quo,
|
|
1010
|
-
here from an agreement and again at the ward key from a seed, and the three
|
|
1011
|
-
labels, `quo-seal`, `quo-ward-sign`, `quo-ward-seal`, are three so that two
|
|
1012
|
-
derivations never answer to one name. The
|
|
1013
|
-
ephemeral pk is the additional authenticated data of every box. A small-order
|
|
1014
|
-
public key verifies nothing; an all-zero agreement is refused. SHA-256,
|
|
1015
|
-
AES-GCM and HKDF are everywhere; the two curves are recent, and a terrain
|
|
1016
|
-
without them is a terrain no ward runs on. `vectors/arithmetic.json` and
|
|
1017
|
-
`vectors/framing.json` hold fixed inputs and outputs so a kit in another
|
|
1018
|
-
language proves it agrees on the bytes.
|
|
1019
|
-
|
|
1020
|
-
```
|
|
1021
|
-
ask on the wire box = ephemeral X25519 pk (32) || AES-GCM( payload || signature (64) )
|
|
1022
|
-
sealed to the ward padlock. nothing rides outside it.
|
|
1023
|
-
payload = JSON { to, by, next, seq, time, hops?, method?, args? }
|
|
1024
|
-
signed by `by`. to, by, next: 64 lowercase hex. to, next may be null.
|
|
1025
|
-
to names the heir, or null for the public being. seq is a whole
|
|
1026
|
-
number from one. args, when present, is one object of values.
|
|
1027
|
-
hops is reserved: a whole number, never below zero,
|
|
1028
|
-
refused at zero, and nothing sets it.
|
|
1029
|
-
reply on the wire box = ephemeral X25519 pk (32) || AES-GCM( reply || signature (64) )
|
|
1030
|
-
sealed to the ask's ephemeral pk, signed by the ward key
|
|
1031
|
-
reply = JSON { object, seen } | { silence: true } | { quo: word }
|
|
1032
|
-
seen is always present: the digest, 64 hex, on a named ask that
|
|
1033
|
-
had one, and null otherwise, the empty ask included.
|
|
1034
|
-
word: removed | absent | unannounced | repeated | threw. only to a key the door bound.
|
|
1035
|
-
```
|
|
1036
|
-
|
|
1037
|
-
Nothing rides outside the box, and `to` is the reason to say so. A heir is
|
|
1038
|
-
the one name in a relation that never rotates, while the keys under it
|
|
1039
|
-
rotate on every ask. Outside the box it would be a handle on that relation
|
|
1040
|
-
that never changes: an intermediary carrying the bytes could tell one
|
|
1041
|
-
relation from another and follow it for as long as it lasts, and so could
|
|
1042
|
-
anyone who ever saw the invitation, which carries that same heir. What
|
|
1043
|
-
carries an ask to a ward is the ward pk, which a harbor holds itself and
|
|
1044
|
-
never reads from these bytes, so the door loses nothing by opening every ask
|
|
1045
|
-
with its own padlock and reading `to` after. What an intermediary still
|
|
1046
|
-
learns is the ward it is carrying to, and that is the price of being
|
|
1047
|
-
reachable.
|
|
1048
|
-
|
|
1049
|
-
The sender keeps the ephemeral secret of the box until the reply comes and
|
|
1050
|
-
opens the reply with it. A reply that does not open, or is not signed by the
|
|
1051
|
-
ward it was sent to, is silence. Unreached never crosses: the wire's nothing
|
|
1052
|
-
is it.
|
|
1053
|
-
|
|
1054
|
-
There is one size, and it is on the bytes: a door refuses the bytes of an ask
|
|
1055
|
-
above **one mebibyte**, and a sender refuses the bytes of a reply above the
|
|
1056
|
-
same, each before anything is opened. Refusing them is bytes that said
|
|
1057
|
-
nothing, which is already silence, so it is D1 at the door and S4 at the
|
|
1058
|
-
sender, and there is no tenth word and no case of its own. The number is one
|
|
1059
|
-
because breadth costs bytes: an ask with a thousand args, a blueprint with a
|
|
1060
|
-
thousand asks and a reply with a million-element list are all one box that is
|
|
1061
|
-
too big, and a second number for any of them would be a second thing two kits
|
|
1062
|
-
must agree on for nothing. What a being holds in her cells is not this
|
|
1063
|
-
number's business and not Quo's: only what crosses is bounded. One mebibyte
|
|
1064
|
-
because an ask is a message and not a file, and what is larger is asked for
|
|
1065
|
-
in pieces, by a being who knows how her own work divides.
|
|
1066
|
-
|
|
1067
|
-
The hand to a kit in another language is two things, and they are of two
|
|
1068
|
-
kinds. `vectors/` is the byte-level hand: fixed inputs and outputs for
|
|
1069
|
-
everything a stranger can observe, in four areas. `arithmetic.json` is the
|
|
1070
|
-
primitives the seal rests on. `framing.json` is the ward pk, the digest, the
|
|
1071
|
-
signed body, the sealed shapes, the invitation and the knock.
|
|
1072
|
-
`wire.json` is the frames on a socket and the one request a door takes.
|
|
1073
|
-
`door.json` is the door's thirteen cases, each one an arrival: the bytes that
|
|
1074
|
-
come in, the bytes that go out, what those bytes open to where a hand holds
|
|
1075
|
-
the lid, and the partition's digest before and after, so `nothing written`
|
|
1076
|
-
is a value a kit checks and never a sentence it reads. A kit reproduces them
|
|
1077
|
-
or it is not this protocol. The conformance suite is the behavioural hand,
|
|
1078
|
-
and it is a checklist and not a harness: one ward is one runtime and one
|
|
1079
|
-
language, so the beings a suite is shown with run only in the ward its kit
|
|
1080
|
-
wrote, and a kit ports the suite and its beings and reads them beside its
|
|
1081
|
-
own. No kit
|
|
1082
|
-
drives a foreign ward through its door, and nothing is owed
|
|
1083
|
-
here before 1.0.0 that does: the door's thirteen cases and the vectors are
|
|
1084
|
-
what two kits meet on, and the suite is what each proves alone.
|
|
1085
|
-
|
|
1086
|
-
### Vector mode
|
|
1087
|
-
|
|
1088
|
-
`door.json` is replayed against a running kit by a program that holds no
|
|
1089
|
-
key and seals nothing: the verifier. It can, because every byte in those
|
|
1090
|
-
records that a stranger cannot compute is a byte of entropy, and the
|
|
1091
|
-
entropy is fixed. A kit **stands in vector mode** so that the verifier can
|
|
1092
|
-
put it in the state of one record, send that record's ask, and read the
|
|
1093
|
-
bytes and the digests that come back. The mode is a harness beside the
|
|
1094
|
-
door and never a change to the door: what the door does to an ask in
|
|
1095
|
-
vector mode is what it does to every ask.
|
|
1096
|
-
|
|
1097
|
-
A kit in vector mode stands at one URL and answers the request reach
|
|
1098
|
-
there, `POST <url>/<pk>` with the sealed bytes as the body, exactly as any
|
|
1099
|
-
listener does. Beside it, and only in this mode, it answers two more:
|
|
1100
|
-
|
|
1101
|
-
```
|
|
1102
|
-
POST <url>/stand body { case, name } one record of door.json, by its two names
|
|
1103
|
-
200 { ward, before, ask } the pk of the ward whose door judges,
|
|
1104
|
-
that ward's partition digest at the arrival,
|
|
1105
|
-
and the ask the kit's own hand seals for it
|
|
1106
|
-
GET <url>/digest 200 { after } the same ward's digest now
|
|
1107
|
-
```
|
|
1108
|
-
|
|
1109
|
-
`stand` builds the record's world from nothing, every time: the stream
|
|
1110
|
-
reset to the seed the vectors name, two harbors linked as a wire, the wards
|
|
1111
|
-
on the seeds A, B and P, the beings booted and the first relation taken,
|
|
1112
|
-
then that record's own setup up to the arrival, drawing from the stream
|
|
1113
|
-
every byte the setup draws, the hand's included. So after `stand` the
|
|
1114
|
-
stream sits exactly where the door will draw the reply's ephemeral key and
|
|
1115
|
-
nonce from, and the reply is the record's reply or the kit is not this
|
|
1116
|
-
protocol. `ask` is returned because the kit's hand sealed it on the way,
|
|
1117
|
-
and a hand that seals the record's own bytes is proven before its door
|
|
1118
|
-
is. `digest` reads the ward the last `stand` chose, and before any `stand`
|
|
1119
|
-
both answer nothing delivered.
|
|
1120
|
-
|
|
1121
|
-
The verifier's round on one record is four steps and no key: `stand`, and
|
|
1122
|
-
`before` and `ask` are the record's; the record's `ask` posted to `<url>/<ward>`,
|
|
1123
|
-
and the body is the record's `reply` byte for byte; `digest`, and `after` is
|
|
1124
|
-
the record's; and `wrote` is whether the two digests differ. What it does
|
|
1125
|
-
not check is what a stranger cannot see: `opens` needs the hand's secret
|
|
1126
|
-
and `heard` is the door's word to its harbor, and both are the kit's own
|
|
1127
|
-
tests to keep. A record is replayed on its own and in any order, since
|
|
1128
|
-
each `stand` is a fresh world.
|
|
1129
|
-
|
|
1130
|
-
A tab is a verifier too, and a tab runs in a stranger's origin, so a kit in
|
|
1131
|
-
vector mode answers every origin: `access-control-allow-origin: *` on all
|
|
1132
|
-
three routes, and an `OPTIONS` answered with the methods and the headers
|
|
1133
|
-
the reach and the harness use. A kit that answers only its own origin
|
|
1134
|
-
passes from a shell and fails from every browser, which is a fault in the
|
|
1135
|
-
stand and says nothing about the door.
|
|
1136
|
-
|
|
1137
|
-
The mode is stood by a hand and never by a harbor a world runs on. Its
|
|
1138
|
-
entropy is a written-down stream, so a ward in it is a ward whose every key
|
|
1139
|
-
is known, and a harness that resets a partition on request is a harbor
|
|
1140
|
-
that keeps nothing. Nothing in the mode is reachable from a harbor that is
|
|
1141
|
-
not in it, and a kit that leaves the harness routes answering in an
|
|
1142
|
-
ordinary harbor has shipped a door anyone can reset.
|
|
1143
|
-
|
|
1144
|
-
## The ward
|
|
1145
|
-
|
|
1146
|
-
### What a ward is
|
|
1147
|
-
|
|
1148
|
-
One process of its harbor. A being plus ward functions. It has one voice, the
|
|
1149
|
-
door, and every arrival at that door is judged by it and named by it or falls
|
|
1150
|
-
silent. It keeps every being it booted, builds every stance, mints every
|
|
1151
|
-
key, seals every ask that leaves, and unseals every one that arrives. Its
|
|
1152
|
-
beings trust it blindly. It trusts its harbor the same way.
|
|
1153
|
-
|
|
1154
|
-
Only a ward moves. A being has no address of her own and never leaves the
|
|
1155
|
-
ward that booted her: her peers hold a standing at a ward pk, and what they
|
|
1156
|
-
trust is that ward's word about an id, never the being under it. So which
|
|
1157
|
-
beings share a ward is settled when they are booted, and a ward migrates
|
|
1158
|
-
whole, with everyone in it, or not at all. To move one being would be to ask
|
|
1159
|
-
every peer to trust a ward they never accepted, and asking that is what an
|
|
1160
|
-
invitation is.
|
|
1161
|
-
|
|
1162
|
-
Its ward is itself. It boots itself as the first being in its own map, under
|
|
1163
|
-
its own pk, and its own stance is built by the same code that builds every
|
|
1164
|
-
being's. Its cells are its partition, all the way down.
|
|
1165
|
-
|
|
1166
|
-
It owns nothing durable. It is three things, all in the harbor's hands:
|
|
1167
|
-
its seed, its partition, and the classes its beings are made of. The
|
|
1168
|
-
partition names each class and the harbor holds the bodies, so a ward is
|
|
1169
|
-
whole only where all three are, and a harbor that keeps one remembers where
|
|
1170
|
-
the other two came from. It writes as it runs and says so after every
|
|
1171
|
-
write, naming the row. That word is told and nothing comes back: it never
|
|
1172
|
-
decides what is kept, when, or in what order. It asks one question, once,
|
|
1173
|
-
at the end of an
|
|
1174
|
-
arrival, after the being has answered and before the answer is sealed:
|
|
1175
|
-
whether what was written is kept. That is the last moment anything can
|
|
1176
|
-
still be said, because a reply sealed to an asker's lid cannot be unsaid
|
|
1177
|
-
and only the ward can seal. A no is that arrival's own failure, said with
|
|
1178
|
-
the words a failed ask already has, and never a reason: what is wrong with
|
|
1179
|
-
this device is not the far side's to hear. A harbor that keeps nothing is
|
|
1180
|
-
asked nothing. Between one run and the next, a ward is nothing at all.
|
|
1181
|
-
|
|
1182
|
-
One ward is one runtime and one language, and every being in it shares both.
|
|
1183
|
-
A harbor that wants two languages starts two wards at least. A ward names no
|
|
1184
|
-
runtime: what it stands on is the language and whatever the terrain hands it,
|
|
1185
|
-
and a kit that named one would be a ward that runs in one place.
|
|
1186
|
-
|
|
1187
|
-
What a ward owes outward is its door, and the door is named here byte for
|
|
1188
|
-
byte. A kit proves the rest to itself, with a suite written in its own terms
|
|
1189
|
-
against the stance: which runtime it runs on, what it must open up to be
|
|
1190
|
-
tested, and how a chapter it cannot stand is skipped are that kit's own, and
|
|
1191
|
-
no second kit meets any of the three.
|
|
1192
|
-
|
|
1193
|
-
### The partition
|
|
1194
|
-
|
|
1195
|
-
Everything durable a ward has is here, every secret included, and nothing
|
|
1196
|
-
here is ever in a being's cells. Values only, so the harbor may persist it as
|
|
1197
|
-
it likes: as this process's objects, as a row, as a line of JSON on a disk. A
|
|
1198
|
-
reboot from its JSON is the same ward. A harbor that keeps it copies it
|
|
1199
|
-
through JSON and by no deeper copy its language offers: what the ward hands
|
|
1200
|
-
out is already values, behind the cells guard, and a copy that carries more
|
|
1201
|
-
than JSON does would carry a shape a reboot cannot give back.
|
|
1202
|
-
|
|
1203
|
-
```
|
|
1204
|
-
partition
|
|
1205
|
-
version 'pre-1.0.0'
|
|
1206
|
-
beings key -> her cells, with class
|
|
1207
|
-
bind key -> her bind table
|
|
1208
|
-
standings id -> { ward, heir | null, current, next, seq } her keys for a standing
|
|
1209
|
-
occupants id -> heir pk
|
|
1210
|
-
knocks <ward>:<heir> | public:<ward> -> { current, next, spoke, sent, seq } before take
|
|
1211
|
-
spoke: bytes came back once. sent: bytes went out once, answered or not
|
|
1212
|
-
bounded, oldest out, and one that answered outlives one that never did
|
|
1213
|
-
answered <ward>:<heir> | public:<ward> -> true knocked and answered
|
|
1214
|
-
minted the pks her side minted, bounded. nothing in the ward reads it: it is there to
|
|
1215
|
-
be looked at, and a kit that keeps the list empty holds the same ward
|
|
1216
|
-
heirs heir pk -> { being, id, current, announced, fresh, mark, spent } the door's view of every occupant
|
|
1217
|
-
gone heir pk -> { current, announced } the keys held when an id was removed, bounded, oldest out,
|
|
1218
|
-
so their holder hears `removed` and nobody else a thing
|
|
1219
|
-
public the one public being's key, or null
|
|
1220
|
-
```
|
|
1221
|
-
|
|
1222
|
-
A knock record is filed under the ward and the heir together, never the heir
|
|
1223
|
-
alone: an invitation carries the heir to whoever it is for, and anyone
|
|
1224
|
-
holding one could quote that heir back inside an invitation naming a ward of
|
|
1225
|
-
their own.
|
|
1226
|
-
|
|
1227
|
-
Only take ends a knock record, so the list is bounded like `gone`: past the
|
|
1228
|
-
count the oldest go, and one that was answered outlives one that never was,
|
|
1229
|
-
since an answered knock is a relation she may still take. A being who knocks
|
|
1230
|
-
without ever taking keeps a fixed number of keys behind her, not one per
|
|
1231
|
-
invitation she ever met.
|
|
1232
|
-
|
|
1233
|
-
How long each of the three bounded lists is, is the ward's own, and each says
|
|
1234
|
-
what a reader loses when it bites. A `gone` record past the count is a
|
|
1235
|
-
removed relation whose holder hears silence where she would have heard
|
|
1236
|
-
`removed`, which is what every stranger hears and tells her nothing she can
|
|
1237
|
-
act on. A knock record past the count is an invitation she cannot take, and
|
|
1238
|
-
she knocks again with it or asks for another. The `minted` list is looked at
|
|
1239
|
-
and never read, so its oldest entry going costs a name for a key already
|
|
1240
|
-
dead. None of the three is observable to a far ward as a number: a far side
|
|
1241
|
-
sees only that some old thing is unknown here, which is what it sees from a
|
|
1242
|
-
ward that booted onto a fresh partition.
|
|
1243
|
-
|
|
1244
|
-
The version is one value and it does not move until 1.0.0. There is nobody
|
|
1245
|
-
holding a partition of another shape to tell apart: if the shape changes, a
|
|
1246
|
-
partition is thrown away, not migrated and not counted. A ward opening a
|
|
1247
|
-
version it cannot read throws at birth and does not boot. Birth is where a
|
|
1248
|
-
ward is allowed to be loud; silence is the door's word, for asks that were
|
|
1249
|
-
made, and no ask has been made yet.
|
|
1250
|
-
|
|
1251
|
-
The version says which shape, and the ward reads the shape as well, once, at
|
|
1252
|
-
birth: every field above that the ward, the door or the heirs later act on
|
|
1253
|
-
without looking again. A partition this ward wrote is that shape by
|
|
1254
|
-
construction. One adopted from elsewhere was written by a hand, another kit,
|
|
1255
|
-
or a file that was cut short, and a `spent` that is not a list or a `mark`
|
|
1256
|
-
that is not a number is a door that honours every number, or one that
|
|
1257
|
-
rejects where it promised a word. A ward that meets one throws at birth with
|
|
1258
|
-
the path that failed, which names what is wrong to whoever is holding the
|
|
1259
|
-
file. A being's own cells are read no further than the two records the ward
|
|
1260
|
-
keeps in them: what she puts in her own is hers, of any shape JSON carries.
|
|
1261
|
-
|
|
1262
|
-
What a ward can read is a list, `READS`, and today it has one member. The
|
|
1263
|
-
list and the step that carries an older partition forward exist before
|
|
1264
|
-
1.0.0 because after it there is nowhere to put them. A partition holds every
|
|
1265
|
-
secret and every relation a world has: the first shape change after the
|
|
1266
|
-
freeze cannot be answered by throwing it away, and a ward that meets a shape
|
|
1267
|
-
it has no step for refuses to boot with all of it still inside. Throwing a
|
|
1268
|
-
partition away is what a version means before 1.0.0, and carrying it forward
|
|
1269
|
-
is what it means after; the seam is cut now so the second is possible.
|
|
1270
|
-
|
|
1271
|
-
### Restart
|
|
1272
|
-
|
|
1273
|
-
A restart is silent because the ward cannot tell rebirth from birth. Every
|
|
1274
|
-
being whose cells record a class is constructed again, unasked, with the
|
|
1275
|
-
same cells; relations and keys are intact on both sides; a knock answered
|
|
1276
|
-
before the restart can be taken after it; a door that restarts still refuses
|
|
1277
|
-
what it already honoured.
|
|
1278
|
-
|
|
1279
|
-
A constructor that throws on a restart takes only herself down: she is
|
|
1280
|
-
absent this run, no door, so `absent` at her door to the keys she bound and
|
|
1281
|
-
silence to strangers, and her cells sit untouched waiting for the run that
|
|
1282
|
-
can read them. The ward is up and so is everyone
|
|
1283
|
-
else. Her row is hers while she is absent: the owner sees her as absent, no
|
|
1284
|
-
class boots under her key, and the owner may unboot her. A class the harbor
|
|
1285
|
-
does not hold this run is the same absence, and so is a
|
|
1286
|
-
class the harbor holds at a body the cells were not written for: which body
|
|
1287
|
-
a ward reboots on is the harbor's decision, and a ward cannot tell an old
|
|
1288
|
-
one from a new one. Loss of the partition is loss of every relation,
|
|
1289
|
-
announced to nobody.
|
|
1290
|
-
|
|
1291
|
-
### The owner
|
|
1292
|
-
|
|
1293
|
-
The owner is a role, not an identity, and it has a root. The root owner is
|
|
1294
|
-
whoever holds the ward's ask pointer. The harbor hands that pointer to one
|
|
1295
|
-
holder, by the device's rules: a shell, a UI, a socket only the device's
|
|
1296
|
-
user can read. Lose the pointer, lose the root; there is no recovery inside
|
|
1297
|
-
Quo.
|
|
1298
|
-
|
|
1299
|
-
Every other owner is an occupant of the ward itself. The ward is a being of
|
|
1300
|
-
its own map, and the root may invite on it like on any being; whoever knocks
|
|
1301
|
-
with that invitation is an owner, reached through the door, named by the id
|
|
1302
|
-
the root chose, counted and rotated like any relation, and removed like any
|
|
1303
|
-
occupant. That is how a ward is piloted from another device: the piloting
|
|
1304
|
-
ward holds a standing at it, and every owner ask is a sealed ask. Only the
|
|
1305
|
-
root may invite on the ward: an owner at the door asking to is refused, so
|
|
1306
|
-
a carried key pilots and never hands piloting on. Ownership moves by the
|
|
1307
|
-
root inviting one owner and removing another, and a migrated ward carries
|
|
1308
|
-
its owners in its bind table, so the harbor that receives it does not
|
|
1309
|
-
become one.
|
|
1310
|
-
|
|
1311
|
-
The root is not an occupant. It holds no heir, no key, no invitation. The
|
|
1312
|
-
ward names every arrival on the ask `{ id: 'OWNER' }`, the third asker of the
|
|
1313
|
-
ward-to-being edge, and answers it as such; an owner at the door arrives as
|
|
1314
|
-
her id. What an owner can do is reach into a being from outside, which no
|
|
1315
|
-
being can: mark the public being, place a relation into a being of the
|
|
1316
|
-
ward, take one out of her, take her out of the ward, and ask her. Boot it
|
|
1317
|
-
shares with every being of the ward. The ward is a being to her owner: the
|
|
1318
|
-
empty ask is her describe,
|
|
1319
|
-
and each ask in it carries a description and an input naming its fields, as
|
|
1320
|
-
a being's asks do, so that a side renders the owner's asks the way it
|
|
1321
|
-
renders anyone's and holds no list of its own.
|
|
1322
|
-
|
|
1323
|
-
```
|
|
1324
|
-
ask() -> { asks: [boot, public, invite, knock, remove, unboot, ask],
|
|
1325
|
-
notes: { pk, beings: { key: { class, public, digest, absent? } } } }
|
|
1326
|
-
ask('boot', { key, class }) -> { booted: key } | { error }
|
|
1327
|
-
ask('public', { key }) -> { public: key } | { error }
|
|
1328
|
-
ask('invite', { being, id, notes? }) -> invitation | null | { error }
|
|
1329
|
-
ask('knock', { being | { boot: class, key },
|
|
1330
|
-
id, invitation, method?, args?, wanted? })
|
|
1331
|
-
-> { taken: id | null, answer } | { error: 'silence' | 'unreached' | ... }
|
|
1332
|
-
ask('remove', { being, id }) -> { removed: id } | { error }
|
|
1333
|
-
ask('unboot', { being }) -> { unbooted: key, removed: [id, ...] } | { error }
|
|
1334
|
-
ask('ask', { being?, method?, args?, wanted? })
|
|
1335
|
-
-> her object | { error: 'silence' | 'threw' | 'late' | ... }
|
|
1336
|
-
anything else -> { error: 'unknown ask' }
|
|
1337
|
-
```
|
|
1338
|
-
|
|
1339
|
-
- The owner is a caller like any other: `wanted` says what its knock or its
|
|
1340
|
-
ask may spend, and saying nothing is the ward's default, exactly as for a
|
|
1341
|
-
being.
|
|
1342
|
-
- The describe runs every being's own describe as `OWNER` and hashes it; a
|
|
1343
|
-
being that throws or falls silent there shows a null digest. A being
|
|
1344
|
-
absent this run is listed with a null digest and `absent: true`.
|
|
1345
|
-
- Boot refuses a key that has a row in the partition, booted this run or
|
|
1346
|
-
absent, and a class the harbor does not know; a boot that made nobody
|
|
1347
|
-
leaves the partition as it found it. A throw at birth is that boot's
|
|
1348
|
-
error, `{ error: 'threw at birth' }`, and nothing half-lives; a being's
|
|
1349
|
-
own boot answers null for it.
|
|
1350
|
-
- Public marks a being already booted as the ward's one public being. It
|
|
1351
|
-
refuses a key not booted, the ward's own pk, and a second public being
|
|
1352
|
-
while one stands, since marking a second would leave the first holding
|
|
1353
|
-
every relation she had, reachable by nobody at the bare pk and told by
|
|
1354
|
-
nobody she was replaced. Marking the one already public again is
|
|
1355
|
-
answered, and changes nothing. A public being absent this run is
|
|
1356
|
-
reachable by nobody already, so the mark may move to another. A null key
|
|
1357
|
-
takes the mark off: the being stays booted with every relation she holds,
|
|
1358
|
-
and the ward answers arrivals for no heir with silence as one that never
|
|
1359
|
-
had a public being does. Retiring her is not destroying her, and the mark
|
|
1360
|
-
is free for another.
|
|
1361
|
-
- Invite on the ward's own pk mints an owner, and only the root may ask it:
|
|
1362
|
-
from the door it is answered as an invite on nobody. The ward has
|
|
1363
|
-
occupants, its owners, and no standings: a knock for the ward itself is a
|
|
1364
|
-
knock for nobody, because the ward asks nobody anything.
|
|
1365
|
-
- The owner's knock is a being's knock made for her. The ward knocks under a
|
|
1366
|
-
key it mints for her, and if answered, takes under the id the owner gave
|
|
1367
|
-
and writes the standing into her cells. She finds it there. Her owner
|
|
1368
|
-
chose her class and her cells at boot; her owner may choose a relation for
|
|
1369
|
-
her too. The boot form names a being new or existing: a key already booted
|
|
1370
|
-
is a being of theirs, not a class that failed.
|
|
1371
|
-
- **Unboot is the inverse of boot, and the only way a being leaves a ward.**
|
|
1372
|
-
Every relation she holds goes with her, by the same calls she would have
|
|
1373
|
-
used herself, so an occupant of hers hears `removed` from the keys her door
|
|
1374
|
-
kept rather than meeting a being who is not there; the owner is told which
|
|
1375
|
-
ids went. Her cells and her bind table go too, because a row naming a being
|
|
1376
|
-
no door holds would boot her again on the next restart. If she was the
|
|
1377
|
-
public being the mark goes with her, and the ward answers arrivals for no
|
|
1378
|
-
heir with silence as one that never had a public being does. The ward
|
|
1379
|
-
itself is refused, for the reason knock is: it would be a ward deleting
|
|
1380
|
-
itself from inside its own map, leaving its owners bound to a door that is
|
|
1381
|
-
gone. An absent being is unbooted the same way: she has no stance to speak
|
|
1382
|
-
for her, so the ward closes her heirs itself, and her occupants hear
|
|
1383
|
-
`removed`.
|
|
1384
|
-
- The owner's remove is the mirror of its knock: a relation out of a being,
|
|
1385
|
-
by id, and the id may be an occupant or a standing, since the two share
|
|
1386
|
-
one namespace. The being's own remove says nothing; the owner hears
|
|
1387
|
-
objects, so this one says what it removed, and that there was nothing when
|
|
1388
|
-
there was nothing. Remove on the ward's own pk unseats an owner, and only
|
|
1389
|
-
the root may ask it, for the reason only the root may invite one: from the
|
|
1390
|
-
door it is answered as a remove on nobody. Ownership moves by the root
|
|
1391
|
-
alone.
|
|
1392
|
-
- **The owner's ask is the third asker of the ward-to-being edge, filled in
|
|
1393
|
-
by the ward.** It reaches into a being and asks her, which is strictly less
|
|
1394
|
-
than unboot, and it is the only way to that asker: nothing outside the
|
|
1395
|
-
ward names `OWNER`. She is judged as any arrival is, the three choices and
|
|
1396
|
-
no others, and the wait is bounded like any other. She hears `threw` for a
|
|
1397
|
-
throw, a word out of her, or a shape that is not hers to make, and the
|
|
1398
|
-
owner hears each as an object. With no being named it is the public being,
|
|
1399
|
-
asked as nobody, and unbound: a stranger's view, so a throw of hers is
|
|
1400
|
-
silence, and a device serving her to strangers hears what a stranger hears
|
|
1401
|
-
and no more. The ward itself is refused, and so is a name no being holds.
|
|
1402
|
-
|
|
1403
|
-
The door is a ward function. It is not the ward's answer: it judges before
|
|
1404
|
-
anything is named, and a being's answer only ever receives named askers. The
|
|
1405
|
-
ask is the ward's answer, with the asker filled in as owner. Ward functions
|
|
1406
|
-
are on the object, and no stance and no standing reaches them.
|
|
1407
|
-
|
|
1408
|
-
### Responsibilities, and not
|
|
1409
|
-
|
|
1410
|
-
The ward:
|
|
1411
|
-
|
|
1412
|
-
- Derives its pk from its seed and names itself outward by that and nothing
|
|
1413
|
-
else. Mints every other key from the ground's random, one per side of one
|
|
1414
|
-
relation.
|
|
1415
|
-
- Instantiates beings when the owner or a being of the ward asks, by class
|
|
1416
|
-
name. It builds the stance, names the class, and receives the object from
|
|
1417
|
-
the harbor's instantiate call. It never sees a class body, its own
|
|
1418
|
-
included.
|
|
1419
|
-
- Keeps, per being, the cells, the standings and the occupants, in the
|
|
1420
|
-
partition, and outside her cells the bind table. Never reads notes.
|
|
1421
|
-
- Mints a heir for every id a being mints, keeps its pk beside the id, and
|
|
1422
|
-
hands her the invitation. Names every arrival signed by the key it holds
|
|
1423
|
-
for that heir by the id she minted.
|
|
1424
|
-
- Seals every ask that leaves to the far ward's padlock, signed by the
|
|
1425
|
-
standing's own key, announcing its next, carrying its count and its
|
|
1426
|
-
allowance. Delivers to its own pk without the harbor. Hands every other
|
|
1427
|
-
ward pk to carry. Bounds the wait.
|
|
1428
|
-
- Tells its own being the truth about her asks: an answer with its digest
|
|
1429
|
-
written to seen, silence when bytes came back and said nothing, unreached
|
|
1430
|
-
when nothing came back.
|
|
1431
|
-
- Runs her answers concurrently and never serializes her. Two different asks
|
|
1432
|
-
may both be inside her answer at once, one paused, one running. Her cells
|
|
1433
|
-
are hers to guard between one line and the next.
|
|
1434
|
-
|
|
1435
|
-
Not stressed with:
|
|
1436
|
-
|
|
1437
|
-
- Where any pk lives. Sockets, URLs, DNS, containers, planets. It knows pks
|
|
1438
|
-
and nothing under them. The wire, retries, or the directory.
|
|
1439
|
-
- Storage. It writes into its partition and does not know what medium that
|
|
1440
|
-
is, whether it persists, or when.
|
|
1441
|
-
- Defending against its harbor. A ward that distrusts its harbor has no
|
|
1442
|
-
move, so Quo gives it none. The harbor vouches, the ward trusts. A being
|
|
1443
|
-
trusts her ward, a ward trusts its harbor, a harbor trusts its device. A
|
|
1444
|
-
broken vouch is total and silent.
|
|
1445
|
-
- Deciding who may be an occupant. She invites; it binds and names.
|
|
1446
|
-
- Restarting a crashed being, retrying a silent ask, or noticing that a
|
|
1447
|
-
standing walked away. A being learns about a standing by asking it, and
|
|
1448
|
-
from nothing else. There is no estate. The far being is sovereign: she may
|
|
1449
|
-
fall silent on the ask after the knock, and nobody is told.
|
|
1450
|
-
- Blacklists, rate limits, and what to do with a pk that keeps knocking with
|
|
1451
|
-
garbage. The door says `heard` or not beside every reply; the rest is the
|
|
1452
|
-
harbor's.
|
|
1453
|
-
|
|
1454
|
-
## The harbor
|
|
1455
|
-
|
|
1456
|
-
A harbor is what a device already has, offered to Quo: processes, storage, a
|
|
1457
|
-
network, entropy, a clock. It fits into a device carved up by its owner,
|
|
1458
|
-
users, containers, mounts, profiles, and asks for none of them. It judges
|
|
1459
|
-
nothing, holds no id, chooses no class, and is nobody outside its device.
|
|
1460
|
-
|
|
1461
|
-
It makes every being of every ward it serves, because `instantiate` is in
|
|
1462
|
-
the ground and the ward calls it, and it keeps what it made. That is not
|
|
1463
|
-
knowing a being. It has her object and knows nothing about her: not what she
|
|
1464
|
-
answers, not who her occupants are, not which of her cells is a secret. It
|
|
1465
|
-
never reads a partition to decide anything, and it never hands one out
|
|
1466
|
-
except as the values a store keeps.
|
|
1467
|
-
|
|
1468
|
-
The harbor:
|
|
1469
|
-
|
|
1470
|
-
- Boots wards as processes, one seed each, and keeps each ward's partition:
|
|
1471
|
-
saves it when the ward says it wrote, one save at a time per ward and in
|
|
1472
|
-
the order it was told, so a being driven in process is kept the way one
|
|
1473
|
-
reached through a door is. When the ward asks whether what it wrote is
|
|
1474
|
-
kept, the harbor answers before the reply is sealed, and a save that
|
|
1475
|
-
failed is that arrival's failure: a door that said yes to what was never
|
|
1476
|
-
kept is the worse fault, because everything written to that being
|
|
1477
|
-
afterwards is lost and every door keeps answering success. The failure
|
|
1478
|
-
carries no reason. The door says what it says of any ask that did not
|
|
1479
|
-
take, and a full disk is not a reason the far side may hear. A harbor
|
|
1480
|
-
that keeps nothing is asked nothing and answers nothing.
|
|
1481
|
-
- Stands a ward whose save was refused at what is kept, in memory and in the
|
|
1482
|
-
store together, so that a being's memory never runs ahead of the device and
|
|
1483
|
-
a reload finds no half-done row. When it does that, and what its store owes
|
|
1484
|
-
it to make the two agree, are the harbor's own: no ward and no far ward can
|
|
1485
|
-
tell one device's answer from another's.
|
|
1486
|
-
- Puts back what a being wrote, and never what her relations are standing on:
|
|
1487
|
-
her cells, and neither the keys she speaks under nor the door's heirs. A
|
|
1488
|
-
relation cannot be put back, only broken. Her keys rotate when a reply
|
|
1489
|
-
opens and the far door's when it honours, so the two move at different
|
|
1490
|
-
moments and neither side holds the seed of a key it has moved past; stand
|
|
1491
|
-
either one at an earlier moment and it speaks under a key the other will
|
|
1492
|
-
not admit, with no way back. The count needs no such care, because a door
|
|
1493
|
-
honours any unseen number inside its span and a caller's count climbs at
|
|
1494
|
-
every attempt, so two counts find each other again on their own. What this
|
|
1495
|
-
costs is that a being's keys may stand ahead of what the device kept, which
|
|
1496
|
-
a restart can undo; ahead of the device is survivable and behind the far
|
|
1497
|
-
side is not.
|
|
1498
|
-
- Holds the class bodies for its wards, and remembers for each ward where
|
|
1499
|
-
its bodies came from, so that a restart is on the same bodies unless the
|
|
1500
|
-
harbor decides otherwise. Constructs a being when a ward names a class
|
|
1501
|
-
through the ground's instantiate, and never chooses a class itself. A
|
|
1502
|
-
name it does not hold is null, and that boot fails. Whose code a ward
|
|
1503
|
-
runs is no concern of the harbor: a ward of its owner's and a ward whose
|
|
1504
|
-
bodies came from a stranger are hosted the same way.
|
|
1505
|
-
- Passes every ward the ground, once, at birth. Receives a door and an ask.
|
|
1506
|
-
Hands the ask to exactly one holder, by the device's own rules. That
|
|
1507
|
-
holder is the ward's owner.
|
|
1508
|
-
- Boots a ward of its own, when the device has anything to lend, and keeps
|
|
1509
|
-
its ask pointer rather than handing it out, so it is that ward's root.
|
|
1510
|
-
What the device can do lives there as beings, and `lend` mints an
|
|
1511
|
-
invitation on one for a ward that asks, hands it to that ward to knock and
|
|
1512
|
-
take, and removes what it minted where the ward did not take it. Which ward
|
|
1513
|
-
may ask for which name is the harbor's own, and a stranger's ward is lent
|
|
1514
|
-
nothing. Nothing else about that ward is special: it has a seed, a
|
|
1515
|
-
partition, a door and beings, and every ask that reaches one of them is
|
|
1516
|
-
sealed, counted and judged like any other. Those beings are where a world's
|
|
1517
|
-
time comes from. A being runs only while she is answering, so every ask in
|
|
1518
|
-
Quo is asked by a being or by an owner, and a world in which nobody holds a
|
|
1519
|
-
clock, a line or a socket is a world where nothing happens that nobody
|
|
1520
|
-
asked for. What a device has, one of its beings holds, and she begins
|
|
1521
|
-
holding it at birth like anything else she does with her constructor.
|
|
1522
|
-
- Hands its own device's code the beings it made for a ward, by key, and the
|
|
1523
|
-
keys it has. This is not a path around a door. The object is already in
|
|
1524
|
-
that process, made there a moment ago by the harbor itself, and reaching
|
|
1525
|
-
it is the device's own code calling its own object, the same reach a being
|
|
1526
|
-
has on one she booted herself. Nothing of it crosses an edge, so there is
|
|
1527
|
-
no door it could have passed instead. A key with no object is a being who
|
|
1528
|
-
is not here this run. What the device does not get is the partition: it
|
|
1529
|
-
holds every seed the ward has, and a side that wants to know which beings
|
|
1530
|
-
there are, or which one is public, asks the ward through the ask pointer,
|
|
1531
|
-
which is the only thing that answers for a ward anyway.
|
|
1532
|
-
- Keeps the map of ward pk to door for its own wards, and ward pk to reach
|
|
1533
|
-
for foreign ones. Learns its own wards' pks by asking them. Learns foreign
|
|
1534
|
-
pks however it likes.
|
|
1535
|
-
- Carries bytes to one ward pk and returns what came back, or nothing.
|
|
1536
|
-
Copies bytes across, never references, even between two of its own
|
|
1537
|
-
doors. Nothing means the bytes never arrived: no reach for that pk, a
|
|
1538
|
-
socket that would not open, a link that is down. Once it has sent them it
|
|
1539
|
-
never answers nothing on its own patience; it waits, and the ward's bound
|
|
1540
|
-
ends the ask.
|
|
1541
|
-
- Receives bytes from the wire for a ward pk it holds, hands them to that
|
|
1542
|
-
one door, and returns what the door returned. Beside the bytes the door
|
|
1543
|
-
says whether a key it holds spoke; the harbor may count that per pk and
|
|
1544
|
-
act on it, and learns nothing more.
|
|
1545
|
-
- Vouches: the seed stays secret, the partition is reached by this ward
|
|
1546
|
-
alone, the ask reaches its root owner alone, the device is the harbor's
|
|
1547
|
-
to defend. How is the device's business. Custody is this vouch: two
|
|
1548
|
-
harbors booting one seed over one partition are two wards with one pk,
|
|
1549
|
-
diverging in silence, and a harbor refuses to boot a ward another running
|
|
1550
|
-
harbor holds, by whatever lease its device offers.
|
|
1551
|
-
|
|
1552
|
-
Not stressed with:
|
|
1553
|
-
|
|
1554
|
-
- Reading, altering, caching, or retrying bytes. It does not know the word
|
|
1555
|
-
silence, and it never answers on a ward's behalf.
|
|
1556
|
-
- Fanning out, broadcasting, or forwarding to a pk other than the one it was
|
|
1557
|
-
given. One pk is one ward is one door.
|
|
1558
|
-
- Choosing a class, deciding an id, reading the keys inside a relation,
|
|
1559
|
-
minting an invitation on a ward it does not root, or acting on anything a
|
|
1560
|
-
partition contains.
|
|
1561
|
-
- Judging anything. A ward judges its door. The harbor delivers to it.
|
|
1562
|
-
- Speaking Quo. It is nobody's occupant and holds no standing anywhere. The
|
|
1563
|
-
harbor is not a ward and is nobody's.
|
|
1564
|
-
|
|
1565
|
-
What a harbor on a device keeps is a ward's three parts under one name: the
|
|
1566
|
-
seed, the partition, and where the class bodies come from. Where it keeps
|
|
1567
|
-
them, what it asks of whatever keeps them, and what else it writes down
|
|
1568
|
-
beside them are the harbor's own, and nothing outside that device can tell
|
|
1569
|
-
one answer from another. A disk, a tab, an edge object and a process's own
|
|
1570
|
-
memory each hold a ward, and a ward cannot tell which of them it woke up in.
|
|
1571
|
-
|
|
1572
|
-
Carrying bytes to a pk off the device is a **reach**: carry bytes to a pk,
|
|
1573
|
-
get bytes back or nothing. Two kinds, and no third:
|
|
1574
|
-
a **request**, one URL, the bytes posted to it with the pk as the last
|
|
1575
|
-
segment and the reply as the answer, listener to listener; and a
|
|
1576
|
-
**socket**, one held line used in
|
|
1577
|
-
both directions, opened by whichever side can dial, with a frame id
|
|
1578
|
-
matching each reply to its ask and one text frame in which a side announces
|
|
1579
|
-
the ward pks it holds. The framing on a socket is binary: an ask is a kind
|
|
1580
|
-
byte, a four-byte id, the 64-byte pk and the bytes; a reply is the kind, the
|
|
1581
|
-
id and the bytes; and nothing delivered is the kind and the id alone. A kit
|
|
1582
|
-
holds either end of a line and never a listener: who accepts a socket is the
|
|
1583
|
-
terrain's business. A reach reads nothing; a
|
|
1584
|
-
harbor opens no box but its own probe's.
|
|
1585
|
-
Nothing comes back only where the reach knows nothing was delivered: no such
|
|
1586
|
-
pk at the far end, a connection that would not open or closed before it
|
|
1587
|
-
opened, a line already gone, a status from a request that says the listener
|
|
1588
|
-
did not take the bytes, refused on their face or with nobody behind the
|
|
1589
|
-
gateway. A
|
|
1590
|
-
reach that sent the bytes and lost the line after answers nothing at all,
|
|
1591
|
-
and the ward's bound ends the ask. The frames are pinned in
|
|
1592
|
-
`vectors/wire.json`, and every reach of every kind answers alike.
|
|
1593
|
-
|
|
1594
|
-
A reach also carries the **wire suite**: which frames these are, and which
|
|
1595
|
-
five algorithms seal what they travel with. It is one number, it is not
|
|
1596
|
-
negotiated, and today it is 1. It rides where a line is opened and never on
|
|
1597
|
-
an ask: in the text frame a socket announces itself with, and as the header
|
|
1598
|
-
`quo-suite` on a request. So an ask is still bytes from the first one, with
|
|
1599
|
-
nothing in front of them to say what they are, and a line still learns
|
|
1600
|
-
before it carries anything whether the far side speaks what this side
|
|
1601
|
-
speaks. A side meeting a suite it does not know carries nothing for it and
|
|
1602
|
-
closes, naming the refusal on the way out with close code 4001; a
|
|
1603
|
-
request door meeting one answers nothing delivered. How long a side refused
|
|
1604
|
-
that way waits before asking again is its own, and a suite does not become
|
|
1605
|
-
speakable by asking sooner. Absent is this suite,
|
|
1606
|
-
because a caller older than the header is this one. Present and different is
|
|
1607
|
-
refused as it is written: the number is compared as it was sent, so a suite
|
|
1608
|
-
is one spelling and not a family of them.
|
|
1609
|
-
|
|
1610
|
-
This is the only place a second suite could ever be told from the first.
|
|
1611
|
-
The five algorithms are named once and never negotiated, which is right: a
|
|
1612
|
-
choice offered on the wire is a choice a stranger can push. But named once
|
|
1613
|
-
is not the same as unnameable, and a kit that must one day seal differently
|
|
1614
|
-
has to be able to say so to a kit that cannot, or the day it arrives every
|
|
1615
|
-
world stops answering at once and none of them can say why. A silence names
|
|
1616
|
-
no reason, by law. This number is the reason, said before the silence.
|
|
1617
|
-
|
|
1618
|
-
A harbor boots every ward it keeps, holds the map of ward pk to door for
|
|
1619
|
-
its own wards and the **directory**, pk to reach, for foreign ones,
|
|
1620
|
-
carries bytes to a pk and delivers bytes from the wire to one door. The
|
|
1621
|
-
directory is filled
|
|
1622
|
-
four ways, in this order: its own doors; a socket a dialer holds to it,
|
|
1623
|
-
bound once the door behind the dialer's claim has proved it, and unbound
|
|
1624
|
-
when the line closes; the claims of a listener this harbor dialed, proven
|
|
1625
|
-
the same way and reached through that line; and a hint, a pk at a URL. A
|
|
1626
|
-
hint never displaces a reach proven at a door. An
|
|
1627
|
-
announce names at most sixty-four pks, proven a few at a time, and is the
|
|
1628
|
-
newest word: a proof still in flight from an earlier announce on the same
|
|
1629
|
-
line binds nothing when it lands. A side announces when its line opens and
|
|
1630
|
-
again whenever the pks it holds change, so a ward booted, adopted or
|
|
1631
|
-
dropped is reachable on a line already in hand.
|
|
1632
|
-
|
|
1633
|
-
An announce is a claim, and a claim binds nothing until proven: anyone who
|
|
1634
|
-
can reach a listener could otherwise name a pk that is not theirs and take
|
|
1635
|
-
its reachability, the one thing a rendezvous exists to give. The proof is
|
|
1636
|
-
the door as it already is. The harbor mints a lid and sends it down the
|
|
1637
|
-
line with noise after it, an ask for the claimed pk; that is a box that
|
|
1638
|
-
does not open, D1, and the door answers it with silence sealed to the lid
|
|
1639
|
-
and signed by the ward key. Only the holder of that seed writes that reply,
|
|
1640
|
-
the lid is fresh so nothing replays, and a box that does not open writes
|
|
1641
|
-
nothing at the ward. Each claimed pk is proven on its own, both ways: the
|
|
1642
|
-
listener proves the dialer's claims and the dialer the listener's. What a
|
|
1643
|
-
relay that genuinely reaches a ward elsewhere can still do is forward the
|
|
1644
|
-
probe and pass, and then it is a rendezvous for that ward like any other,
|
|
1645
|
-
able to drop and nothing more. This is the one box a harbor ever opens,
|
|
1646
|
-
the one it sealed itself, and it reads nothing from it but that it is the
|
|
1647
|
-
silence a door owes such a box, signed by the claimed key. One rule makes a
|
|
1648
|
-
**rendezvous** of
|
|
1649
|
-
any listener: bytes that arrive from the wire go to an own door or to a
|
|
1650
|
-
socket this harbor holds for that pk, and never onward by request. So a
|
|
1651
|
-
harbor that cannot be dialed is reached through one it dialed, by
|
|
1652
|
-
anyone who holds a hint that its pk is there. How many listeners a harbor
|
|
1653
|
-
dials, how long it waits before dialing again, what it does when the device
|
|
1654
|
-
it runs on wakes from sleep, and in what order it tries the lines it holds
|
|
1655
|
-
are its own and are no part of this document. A rendezvous is a listener and
|
|
1656
|
-
nothing more, so a ward is never reachable through one place by anything but
|
|
1657
|
-
its own choice.
|
|
1658
|
-
|
|
1659
|
-
A ward is born by minting a seed under a name,
|
|
1660
|
-
leaves by being dropped, the partition written first, and arrives by
|
|
1661
|
-
being adopted, same seed, same pk. Adopting is the one path a partition
|
|
1662
|
-
written elsewhere takes, so it is where the ward's shape check is met: one
|
|
1663
|
-
that will not boot is not adopted, and the
|
|
1664
|
-
only copy is the one the caller is still holding.
|
|
1665
|
-
|
|
1666
|
-
## The being
|
|
1667
|
-
|
|
1668
|
-
### What a being is
|
|
1669
|
-
|
|
1670
|
-
One ordinary object, in one language, with one voice. She has state, she can
|
|
1671
|
-
ask other beings, and other beings can ask her. She does not know where any
|
|
1672
|
-
of them are, and she cannot find out. She never touches a key, a wire, or a
|
|
1673
|
-
class. Her ward does all of that, and she trusts it blindly: what the ward
|
|
1674
|
-
names is true.
|
|
1675
|
-
|
|
1676
|
-
She asks her standings by method and args and gets back an object, silence,
|
|
1677
|
-
or a word. She invites whom she wants, in her own time, and removes them
|
|
1678
|
-
when she decides. She knocks with invitations she was given and takes the
|
|
1679
|
-
ones she wants. She answers every ask her ward brings her with an object or
|
|
1680
|
-
silence; an error is an ordinary object, and she never throws outward. She
|
|
1681
|
-
describes herself, per asker, by answering the empty ask.
|
|
1682
|
-
|
|
1683
|
-
Not stressed with: where anyone lives; crypto, keys, wire, storage, clocks,
|
|
1684
|
-
or the harbor; strangers, because nobody her ward cannot name reaches her;
|
|
1685
|
-
whether an occupant is a person, a model or a program.
|
|
1686
|
-
|
|
1687
|
-
### Her obligations
|
|
1688
|
-
|
|
1689
|
-
1. Args are one object. A throw is the word `threw` outside, to whoever the
|
|
1690
|
-
door has bound, and silence to a stranger: the ward is in the middle of
|
|
1691
|
-
every call and catches, always, in every language. An error is an object
|
|
1692
|
-
her output schema declares.
|
|
1693
|
-
2. No lifecycle. Construction with the stance is birth. A restart is silent.
|
|
1694
|
-
3. The empty ask is hers. Who gets what blueprint is her decision. She obeys
|
|
1695
|
-
the shape, never a content. The empty ask must be safe to repeat: her
|
|
1696
|
-
ward may ask it at any time, and it changes nothing. Nobody enforces
|
|
1697
|
-
this, in any language. It is her obligation alone.
|
|
1698
|
-
4. A standing's digest arrives with every answer, as seen. She compares it
|
|
1699
|
-
to digest and refreshes by the empty ask if she wants. The digest is of
|
|
1700
|
-
what she told you, not of who she is: one being, many askers, many
|
|
1701
|
-
digests, all true.
|
|
1702
|
-
5. An occupant has no digest. She can only be observed, never asked. To
|
|
1703
|
-
reach an occupant, hold a standing at her: she gave you one, or she did
|
|
1704
|
-
not.
|
|
1705
|
-
6. Her cells are hers to guard between one line and the next. Quo does not
|
|
1706
|
-
serialize her, because that would narrow what can be built.
|
|
1707
|
-
7. A call is delivered once. Her ward, and the far ward, never let the same
|
|
1708
|
-
call reach a being twice by accident. A repeat is intentional. What she
|
|
1709
|
-
asks is always a new call. The one exception is the public being, who is
|
|
1710
|
-
reached with no heir and no count: the same bytes reach her twice, and
|
|
1711
|
-
her answer must be safe to repeat.
|
|
1712
|
-
8. A being may make a being of her own ward, by class name and under a key
|
|
1713
|
-
she chooses, and holds no relation to her until one is invited and taken
|
|
1714
|
-
like any other; the ward builds the stance and the harbor holds the
|
|
1715
|
-
class, so she never touches either. Only the owner reaches into a being
|
|
1716
|
-
from outside.
|
|
1717
|
-
9. Whatever her ward cannot name is not hers to worry about: what the ward
|
|
1718
|
-
does with an arrival it cannot name is the ward's.
|
|
1719
|
-
|
|
1720
|
-
### The raw shape
|
|
1721
|
-
|
|
1722
|
-
A being is anything her language can construct with the stance and ask with
|
|
1723
|
-
`answer`. She needs no import from any kit, and a kit that could only make
|
|
1724
|
-
beings out of a base class of its own would be a kit standing between a
|
|
1725
|
-
being and her ward.
|
|
1726
|
-
|
|
1727
|
-
## Where the tree stands
|
|
1728
|
-
|
|
1729
|
-
The only place this document may name a gap between itself and the tree.
|
|
1730
|
-
Each line is a debt to close, not a note to keep.
|
|
1731
|
-
|
|
1732
|
-
None today.
|
|
1733
|
-
|
|
1734
|
-
## Open
|
|
1735
|
-
|
|
1736
|
-
Named, not decided. Nothing is here today: every question this document ever
|
|
1737
|
-
named is decided under Closed, and the slot each one needed is already cut,
|
|
1738
|
-
because a slot costs two lines before 1.0.0 and a partition or a payload
|
|
1739
|
-
shape after it.
|
|
1740
|
-
|
|
1741
|
-
### Closed
|
|
1742
|
-
|
|
1743
|
-
Decided here, so that the answer is not rediscovered:
|
|
1744
|
-
|
|
1745
|
-
- **Delivered, then died, is refused on repeat.** The far ward receives and
|
|
1746
|
-
crashes, the wire says nothing, and the near ward calls it unreached.
|
|
1747
|
-
No ward retries on its own, so a caller who asks again asks
|
|
1748
|
-
under the next number and is heard. A repeated number is refused by every
|
|
1749
|
-
door of this version, D10, and that is the whole answer: a repeated number
|
|
1750
|
-
is only ever seen by the one door it was sent to, so a kit that one day
|
|
1751
|
-
answers it from what the door already said interoperates with one that
|
|
1752
|
-
refuses, the way one ward's ceiling never meets another's. The slot for the
|
|
1753
|
-
reply that kit would keep is a field on the heir, and it costs two lines to
|
|
1754
|
-
cut now and a partition shape to cut after 1.0.0.
|
|
1755
|
-
- **Hops is the door's half, and that half is whole.** An ask carries no
|
|
1756
|
-
count of doors, so a chain of relays is bounded by time alone. `hops` is a
|
|
1757
|
-
field of the ask, a whole number and never below zero, and a door refuses
|
|
1758
|
-
an ask that arrives at zero; nothing sets it and nothing decrements it. It
|
|
1759
|
-
is refused now because a count only bounds a chain if every door on it
|
|
1760
|
-
refuses, and a door written after the count was invented cannot make the
|
|
1761
|
-
doors before it enforce anything. The other half, a being's onward asks
|
|
1762
|
-
inheriting a door's remaining time and a count, needs the ward to know
|
|
1763
|
-
which arrival an onward ask belongs to, and it cannot learn that without
|
|
1764
|
-
naming a runtime. If a relay chain ever needs it, the way in is a field on
|
|
1765
|
-
the stance's `ask`, beside `wanted`, that a being who never sends it never
|
|
1766
|
-
has to know about: an addition on the ward-to-being edge, and no byte on
|
|
1767
|
-
the wire moves.
|
|
1768
|
-
- **An invitation carries no hint.** It is `ward`, and for a heir `heir` and
|
|
1769
|
-
`secret`, and nothing else. Where a ward lives is the harbor's to know and
|
|
1770
|
-
a relation's to not: a hint inside the value would put a route inside a
|
|
1771
|
-
capability that beings hand around opaquely, and it would go stale while
|
|
1772
|
-
the invitation stayed good. A link is the invitation next to a hint, two
|
|
1773
|
-
values travelling together, and the hint goes to the directory while the
|
|
1774
|
-
being receives the invitation as it receives every invitation.
|
|
1775
|
-
- **The owner does not set the allowance default or ceiling.** They are the
|
|
1776
|
-
ward's own policy, never negotiated and never on the wire, and a far door
|
|
1777
|
-
cannot tell one ward's ceiling from another's. A being who wants less than
|
|
1778
|
-
the default says so with `wanted` on the ask, which is the whole of what a
|
|
1779
|
-
being needs. An owner who wants another ceiling is asking for a different
|
|
1780
|
-
ward.
|
|
1781
|
-
- **A leaked seed is a taken ward, and there is no succession.** The seed has
|
|
1782
|
-
one custodian, the harbor, which vouches that it stays secret; a being
|
|
1783
|
-
never touches it and no byte on the wire carries it. So it is lost only
|
|
1784
|
-
where that vouch broke, and a broken vouch is total and silent. It is not
|
|
1785
|
-
lost alone: a harbor keeps the seed and the partition under one name, and
|
|
1786
|
-
the partition holds every relation's keys, so there is no event where the
|
|
1787
|
-
address is taken and the relations are not. Nothing is left to succeed to.
|
|
1788
|
-
A succession signed by the key that speaks now is signed as well by
|
|
1789
|
-
whoever took it, and one that could not be forged would have to be
|
|
1790
|
-
committed to in advance, in the invitation, which carries nothing. The
|
|
1791
|
-
answer is a new ward, and every peer invited again as anyone is invited.
|
|
1792
|
-
Lose the seed, lose the ward; there is no recovery inside Quo, and that is
|
|
1793
|
-
the same sentence the root owner already hears.
|
|
1794
|
-
|
|
1795
|
-
## Glossary
|
|
1796
|
-
|
|
1797
|
-
- **being**: one ordinary object with one voice. Asks, answers, decides.
|
|
1798
|
-
- **stance**: the one object her ward hands her at birth. Cells and calls.
|
|
1799
|
-
- **cells**: her state. I-JSON values. Three keys are the ward's.
|
|
1800
|
-
- **standing**: a pointer she holds to another being, through which she asks.
|
|
1801
|
-
- **occupant**: a being she invited, whom her ward names when she asks.
|
|
1802
|
-
- **id**: her own permanent name for one relation. Never crosses the door.
|
|
1803
|
-
- **invitation**: a value her ward makes for an id she minted: its pk, a heir
|
|
1804
|
-
pk, the heir secret. Or a ward pk alone, for its public being. Opaque to
|
|
1805
|
-
her. Travels anywhere.
|
|
1806
|
-
- **heir**: the key her ward mints at invite for one id, and gives away.
|
|
1807
|
-
Names the id outward. Dies the first time it speaks.
|
|
1808
|
-
- **next**: the key a standing announces on every ask, and signs with on the
|
|
1809
|
-
next one.
|
|
1810
|
-
- **count**: the number every ask carries for its relation. Honoured once.
|
|
1811
|
-
- **allowance**: the time an ask may still spend. Inside the seal.
|
|
1812
|
-
- **owner**: the root, whoever holds a ward's unsealed ask; and every
|
|
1813
|
-
occupant of the ward itself, whom only the root invites and only the root
|
|
1814
|
-
removes. A role, not an identity.
|
|
1815
|
-
- **invite**: mint an id and get its invitation.
|
|
1816
|
-
- **knock**: an ask carrying an invitation. Binds the far side to the id.
|
|
1817
|
-
- **take**: keep an answered knock as a standing, under her own id.
|
|
1818
|
-
- **ask**: method and args to a standing. Object, silence, or a word back.
|
|
1819
|
-
- **answer**: her one function. Object or silence out.
|
|
1820
|
-
- **the empty ask**: ask with no method. Her answer to it is her blueprint.
|
|
1821
|
-
- **blueprint**: her interface as she chooses to show it to one asker.
|
|
1822
|
-
- **digest**: SHA-256 over the JCS of a blueprint. Per relation.
|
|
1823
|
-
- **seen**: the digest her ward last saw arrive with an answer.
|
|
1824
|
-
- **silence**: the far side said nothing, or the door would not admit the
|
|
1825
|
-
bytes. Names no reason. Not retryable blindly.
|
|
1826
|
-
- **word**: the ward's reason, said only to a key the door has bound or by
|
|
1827
|
-
her own ward to her. Nine: removed, absent, unannounced, repeated, threw,
|
|
1828
|
-
unreached, late, invitation, dropped.
|
|
1829
|
-
- **unreached**: the word for no far door reached. Retryable.
|
|
1830
|
-
- **notes**: hers, inside every occupant record. Quo never reads it.
|
|
1831
|
-
- **partition**: the ward's files. Everything durable, every secret.
|
|
1832
|
-
- **size**: one mebibyte, on the bytes of an ask and on the bytes of a reply.
|
|
1833
|
-
Read before anything is opened. Over it is silence, and never a word.
|
|
1834
|
-
- **lid**: the ephemeral X25519 pk an ask carries in front of its box. The
|
|
1835
|
-
reply is sealed to it and to nothing else. One per ask, never reused.
|
|
1836
|
-
- **edge**: one of the two seams of Quo, harbor to ward and ward to being.
|
|
1837
|
-
An object crosses once at birth, calls cross for the rest of the ward's
|
|
1838
|
-
life, and nothing else crosses.
|
|
1839
|
-
- **ground**: the one object a harbor passes a ward. Nine things.
|
|
1840
|
-
- **lend**: a standing at one of the harbor's own beings, by the name that
|
|
1841
|
-
harbor knows it under. The ward knocks and takes it for her; she is handed
|
|
1842
|
-
the id and never the invitation.
|
|
1843
|
-
- **door**: the ward's one voice outward. Sealed bytes in, sealed bytes out.
|