cloudinit-bot
d09c6132b1
P2 complete. 8 docs/nomads/ pages: index, reach, stash, bearers, maps-pay, pacts, standing, window. Docs firewall green (scans new nomads pages), no regression. All pages cross-reference docs/shared/. ---ci--- project: oy phase: 2 milestone: v0.3 status: complete tag_base: v0.2.x phase_role: execution requirements: covered: [] partial: [REQ-027] ---/ci---
2.1 KiB
Window
A Window (REQ-015) is the primitive a Nomad uses to delegate a capability without delegating custody. It is scoped, time-limited, rate-limited, audited, and revocable. A Nomad opens a Window so a partner or a service can act on the Nomad's Stash within bounds the Nomad set — the partner never gets custody, and the Nomad can close the Window at any time.
The five parts of a Window
| Part | What it bounds |
|---|---|
| Scope | what the grantee can do (e.g., read Stash balance, spend up to N Grain on a specific service). |
| Duration | when the Window starts and ends (a start time and an end time). |
| Rate limit | how many actions per duration window (e.g., at most 10 reads per hour). |
| Audit log | an append-only log of every action the grantee took under the Window. |
| Revoke | the Nomad can revoke the Window at any time; revoke after expiry is a no-op. |
Why a Nomad opens one
A Nomad opens a Window for the same reason a Nomad uses Maps & Pay: to let a service do something on the Nomad's behalf without handing over the Stash. Common examples:
- A recurring service (e.g., a Care service) pulls a capped amount of Bread from the Stash each week, within a rate limit the Nomad set.
- A partner reads the Stash balance for a compliance check, scoped to read-only, time-limited to one hour.
- A Stand operator processes a Pass-Act on the Nomad's behalf inside a scoped, audited Window.
Lifecycle
A Window moves through a fixed lifecycle: Open → Active → Revoked or Expired. A Nomad can revoke at any point; revoking after expiry is a no-op (idempotent). The lifecycle is mission-locked: a partner cannot extend a Window past its end time — the Nomad must open a new one.
Self-service, by design
The Window is the self-service principle in code. The protocol records the Window on OY Chain; the partner holds only the capability, never the value. See Six Principles for the covenant, and Pacts for the contract shapes delivered through Windows.