From 80a925018c45a0bb998d118c0920ce1ae4f4d447 Mon Sep 17 00:00:00 2001 From: giles Date: Sun, 7 Jun 2026 05:12:22 +0000 Subject: [PATCH] =?UTF-8?q?radar:=20pass=2018=20=E2=80=94=20W1=20re-test:?= =?UTF-8?q?=20events=205th=20federation=20consumer=20(agenda=20merge,=20ru?= =?UTF-8?q?ntime-list=20trust=20like=20mod);=20inject-fed-sx=20seam=20now?= =?UTF-8?q?=205/5?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 4.8 (1M context) --- plans/abstractions.md | 32 ++++++++++++++++++++++---------- 1 file changed, 22 insertions(+), 10 deletions(-) diff --git a/plans/abstractions.md b/plans/abstractions.md index 51665fe9..aaa53d86 100644 --- a/plans/abstractions.md +++ b/plans/abstractions.md @@ -12,6 +12,12 @@ Anything short → _Watching_ (what's missing) or _Rejected_ (why). ## Last scan +- **Date:** 2026-06-07 (radar loop, pass 18) +- **Pass 18 — W1 gate re-test.** events shipped Phase 4 federation (5th consumer): a 5th + divergent merge (sorted agenda + `:origin` provenance), trust-gate = runtime list + membership (shares mod's mechanism, not acl's). Reinforces W1's "theme not shape" — but + the **inject-fed-sx-transport seam is now 5/5**, strengthening "all are fed-sx + consumers-in-waiting." Trust sub-pattern refined: mod+events (runtime set) vs acl (rule). - **Date:** 2026-06-07 (radar loop, pass 17) - **Pass 17 — filename census declared EXHAUSTED** (see the Census-status table above). Examined the last unswept ≥2 recurrences (schema/engine = acl⇄mod substrate twins; @@ -191,21 +197,27 @@ one merged file copied N times. Correct one-liner: | search (`fed.sx:8`) | inverted indices | relabel DocId `peer*1000+local` + union posting lists | none | none (pure merge fn) | | mod (`fed.sx:11-14,99`) | moderation decisions | advisory-list vs applied-list; bind iff `mod/trusted?` | **yes — runtime list** `mod/trusted? peer scope` | mock outbox / `fed-send!` | | acl (`federation.sx:43,56`) | Datalog delegate facts | pull facts, gate by `trust`/`level_covers` rule, re-saturate | **yes — Datalog rule** at query time | `transport` dict | + | events (`federation.sx`) | calendar agendas | fold trusted peers' agendas into one sorted agenda + `:origin` provenance | **yes — runtime list** `ev/trusts?` (peer-id ∈ trust-set) | injected behind `ev/peer-agenda` | -- **The ONLY real commonality is the injection seam**, not extractable code: every one - says "the real transport is `fed-sx`'s job; inject `send-fn`/`fetch-fn`/`transport`/ - outbox and mock it in tests." That is an architectural *convention the fleet already - follows*, and the trust gate (where present) is implemented two incompatible ways - (runtime list vs declarative rule). No shared merge, no shared trust mechanism. +- **The ONLY real commonality is the injection seam** (now 5/5, pass 18), not extractable + code: every one says "the real transport is `fed-sx`'s job; inject `send-fn`/`fetch-fn`/ + `transport`/`peer-agenda` and mock it in tests." That is an architectural *convention the + fleet already follows*. The merge op diverges 5 ways (dedupe / index-union / advisory / + fact-saturation / agenda-sort). The trust gate, where present, splits: **mod + events use + a runtime trust-set membership check; acl uses a declarative Datalog rule** — so even the + trust sub-pattern is 2-of-3, and the membership check is a trivial one-liner (below the + extraction threshold). No shared merge, no single shared trust mechanism. - **Disposition:** do NOT extract a shared "federation lib." When `fed-sx` ships its real transport, these 4 become its *consumers* (wiring `send-fn`/`fetch-fn`/`transport` to it) — that work belongs to each subsystem's loop + the `fed-sx` loop, not a cross-cutting extraction. Stop re-proposing on the shared name. Home: `fed-sx`. -- **Narrower sub-claim (mod note, pass 6):** mod asserts the *fed trust/outbox* shape - specifically shares between mod+acl. Radar evidence above shows the **trust gate** - mechanism diverges (mod runtime-list vs acl Datalog-rule); the **outbox/propagation - envelope** may share, but that's 2 consumers (mod, acl) on different substrates → - Watching. Resolve at the architecture-merge point if it survives to a 3rd consumer. +- **Narrower sub-claim (mod note, pass 6; refined pass 18):** mod asserts the *fed + trust/outbox* shape shares between mod+acl. Radar evidence refines this: the trust gate + splits by mechanism, not by subsystem pair — **mod + events** both use a runtime + trust-set membership check (`mod/trusted?`, `ev/trusts?`), while **acl** uses a Datalog + rule. So a "trust-set membership" helper has 2 consumers (mod, events) — but it's a + one-line `member?` and the merge it gates diverges, so still not worth extracting. + Resolve at the architecture-merge point if a heavier shared trust-set surface emerges. ### W2 · Per-viewer visibility / permission filter - **2 shipped consumers, same shape** — `filter `: