cloudinit-bot
82ae6cf5a2
Milestone v0.3 complete. Feature type, tags v0.2.x. Two work-streams shipped under one feature milestone: (A) Bearers skeleton + tests (D-020 pattern, 7 x/* packages, zero ext deps): - x/bridge (NEW): BridgeStatus enum (4), BridgeRoute by-ID-string refs - x/exit (NEW): ExitStatus enum (5), ExitRoute, DEXSwap (opaque venue) - x/bearers (EXT): OYSATLink surveillance-resistant LOCKED, OYQRCode idempotent - x/partner (EXT): AnchorCredential (custody-provider-id empty in skeleton) - x/hub (NEW): HubService enum (3), LendingCouponCapBps=800 LOCAL const (A-304) - x/services (NEW): ServiceKind enum (4), window-id by-ID-string ref (A-307) - x/bond (EXT): GrowthBond, ClampGrowth G-012 underflow guard, secondary market All packages >=93.3% coverage. Both lexicon firewalls green. G-003 intact. (B) Documentation deliverable (REQ-027 complete, 26-page MkDocs Material site): - README.md + mkdocs.yml + docs/index.md - docs/shared/ (7 pages): Six Principles, Bread Scale, Storage Pools, Watchers/Mirror, Lexicon, Vision - docs/nomads/ (8 pages): Reach, Stash, Bearers, Maps-Pay, Pacts, Standing, Window - docs/freeholders/ (8 pages): Signals, Standing, Stands-Guilds, Councils-Voice, Bonds, Partner Spectrum, Anchor Preview - docs/reference/ (2 pages): Architecture, Components - REQ-028: lexicon firewall extended to docs/ + README.md (lexicon_meta_docs_test.go, 5 tests incl G-013 walk-coverage + G-014 shared self-test) Phases: P0 -> v0.2.0, P1 -> v0.2.1, P2 -> v0.2.2, P3 -> v0.2.3, P4 -> v0.2.4, P5 -> v0.2.5, P6 -> v0.2.6 (milestone release). Requirements covered: REQ-010, REQ-022, REQ-023, REQ-024, REQ-025, REQ-026 (skeleton), REQ-027, REQ-028 (complete). IDEATE-01..08 ratified and delivered. ---ci--- project: oy phase: 6 milestone: v0.3 status: complete tag_base: v0.2.x phase_role: final milestone_complete: true requirements: covered: [REQ-010, REQ-022, REQ-023, REQ-024, REQ-025, REQ-026, REQ-027, REQ-028] partial: [] ---/ci---
45 lines
2.1 KiB
Markdown
45 lines
2.1 KiB
Markdown
# Window
|
|
|
|
A **Window** (REQ-015) is the primitive a Nomad uses to delegate a
|
|
capability without delegating custody. It is scoped, time-limited,
|
|
rate-limited, audited, and revocable. A Nomad opens a Window so a partner
|
|
or a service can act on the Nomad's [Stash](stash.md) within bounds the
|
|
Nomad set — the partner never gets custody, and the Nomad can close the
|
|
Window at any time.
|
|
|
|
## The five parts of a Window
|
|
|
|
| Part | What it bounds |
|
|
|---|---|
|
|
| **Scope** | what the grantee can do (e.g., read Stash balance, spend up to N Grain on a specific service). |
|
|
| **Duration** | when the Window starts and ends (a start time and an end time). |
|
|
| **Rate limit** | how many actions per duration window (e.g., at most 10 reads per hour). |
|
|
| **Audit log** | an append-only log of every action the grantee took under the Window. |
|
|
| **Revoke** | the Nomad can revoke the Window at any time; revoke after expiry is a no-op. |
|
|
|
|
## Why a Nomad opens one
|
|
|
|
A Nomad opens a Window for the same reason a Nomad uses [Maps & Pay](maps-pay.md):
|
|
to let a service do something on the Nomad's behalf without handing over
|
|
the Stash. Common examples:
|
|
|
|
- A recurring service (e.g., a Care service) pulls a capped amount of
|
|
Bread from the Stash each week, within a rate limit the Nomad set.
|
|
- A partner reads the Stash balance for a compliance check, scoped to
|
|
read-only, time-limited to one hour.
|
|
- A Stand operator processes a Pass-Act on the Nomad's behalf inside a
|
|
scoped, audited Window.
|
|
|
|
## Lifecycle
|
|
|
|
A Window moves through a fixed lifecycle: **Open → Active → Revoked** or
|
|
**Expired**. A Nomad can revoke at any point; revoking after expiry is a
|
|
no-op (idempotent). The lifecycle is mission-locked: a partner cannot
|
|
extend a Window past its end time — the Nomad must open a new one.
|
|
|
|
## Self-service, by design
|
|
|
|
The Window is the self-service principle in code. The protocol records
|
|
the Window on OY Chain; the partner holds only the capability, never the
|
|
value. See [Six Principles](../shared/six-principles.md) for the covenant,
|
|
and [Pacts](pacts.md) for the contract shapes delivered through Windows. |