cloudinit-bot
d09c6132b1
P2 complete. 8 docs/nomads/ pages: index, reach, stash, bearers, maps-pay, pacts, standing, window. Docs firewall green (scans new nomads pages), no regression. All pages cross-reference docs/shared/. ---ci--- project: oy phase: 2 milestone: v0.3 status: complete tag_base: v0.2.x phase_role: execution requirements: covered: [] partial: [REQ-027] ---/ci---
45 lines
2.1 KiB
Markdown
45 lines
2.1 KiB
Markdown
# Window
|
|
|
|
A **Window** (REQ-015) is the primitive a Nomad uses to delegate a
|
|
capability without delegating custody. It is scoped, time-limited,
|
|
rate-limited, audited, and revocable. A Nomad opens a Window so a partner
|
|
or a service can act on the Nomad's [Stash](stash.md) within bounds the
|
|
Nomad set — the partner never gets custody, and the Nomad can close the
|
|
Window at any time.
|
|
|
|
## The five parts of a Window
|
|
|
|
| Part | What it bounds |
|
|
|---|---|
|
|
| **Scope** | what the grantee can do (e.g., read Stash balance, spend up to N Grain on a specific service). |
|
|
| **Duration** | when the Window starts and ends (a start time and an end time). |
|
|
| **Rate limit** | how many actions per duration window (e.g., at most 10 reads per hour). |
|
|
| **Audit log** | an append-only log of every action the grantee took under the Window. |
|
|
| **Revoke** | the Nomad can revoke the Window at any time; revoke after expiry is a no-op. |
|
|
|
|
## Why a Nomad opens one
|
|
|
|
A Nomad opens a Window for the same reason a Nomad uses [Maps & Pay](maps-pay.md):
|
|
to let a service do something on the Nomad's behalf without handing over
|
|
the Stash. Common examples:
|
|
|
|
- A recurring service (e.g., a Care service) pulls a capped amount of
|
|
Bread from the Stash each week, within a rate limit the Nomad set.
|
|
- A partner reads the Stash balance for a compliance check, scoped to
|
|
read-only, time-limited to one hour.
|
|
- A Stand operator processes a Pass-Act on the Nomad's behalf inside a
|
|
scoped, audited Window.
|
|
|
|
## Lifecycle
|
|
|
|
A Window moves through a fixed lifecycle: **Open → Active → Revoked** or
|
|
**Expired**. A Nomad can revoke at any point; revoking after expiry is a
|
|
no-op (idempotent). The lifecycle is mission-locked: a partner cannot
|
|
extend a Window past its end time — the Nomad must open a new one.
|
|
|
|
## Self-service, by design
|
|
|
|
The Window is the self-service principle in code. The protocol records
|
|
the Window on OY Chain; the partner holds only the capability, never the
|
|
value. See [Six Principles](../shared/six-principles.md) for the covenant,
|
|
and [Pacts](pacts.md) for the contract shapes delivered through Windows. |