cloudinit-bot
82ae6cf5a2
Milestone v0.3 complete. Feature type, tags v0.2.x. Two work-streams shipped under one feature milestone: (A) Bearers skeleton + tests (D-020 pattern, 7 x/* packages, zero ext deps): - x/bridge (NEW): BridgeStatus enum (4), BridgeRoute by-ID-string refs - x/exit (NEW): ExitStatus enum (5), ExitRoute, DEXSwap (opaque venue) - x/bearers (EXT): OYSATLink surveillance-resistant LOCKED, OYQRCode idempotent - x/partner (EXT): AnchorCredential (custody-provider-id empty in skeleton) - x/hub (NEW): HubService enum (3), LendingCouponCapBps=800 LOCAL const (A-304) - x/services (NEW): ServiceKind enum (4), window-id by-ID-string ref (A-307) - x/bond (EXT): GrowthBond, ClampGrowth G-012 underflow guard, secondary market All packages >=93.3% coverage. Both lexicon firewalls green. G-003 intact. (B) Documentation deliverable (REQ-027 complete, 26-page MkDocs Material site): - README.md + mkdocs.yml + docs/index.md - docs/shared/ (7 pages): Six Principles, Bread Scale, Storage Pools, Watchers/Mirror, Lexicon, Vision - docs/nomads/ (8 pages): Reach, Stash, Bearers, Maps-Pay, Pacts, Standing, Window - docs/freeholders/ (8 pages): Signals, Standing, Stands-Guilds, Councils-Voice, Bonds, Partner Spectrum, Anchor Preview - docs/reference/ (2 pages): Architecture, Components - REQ-028: lexicon firewall extended to docs/ + README.md (lexicon_meta_docs_test.go, 5 tests incl G-013 walk-coverage + G-014 shared self-test) Phases: P0 -> v0.2.0, P1 -> v0.2.1, P2 -> v0.2.2, P3 -> v0.2.3, P4 -> v0.2.4, P5 -> v0.2.5, P6 -> v0.2.6 (milestone release). Requirements covered: REQ-010, REQ-022, REQ-023, REQ-024, REQ-025, REQ-026 (skeleton), REQ-027, REQ-028 (complete). IDEATE-01..08 ratified and delivered. ---ci--- project: oy phase: 6 milestone: v0.3 status: complete tag_base: v0.2.x phase_role: final milestone_complete: true requirements: covered: [REQ-010, REQ-022, REQ-023, REQ-024, REQ-025, REQ-026, REQ-027, REQ-028] partial: [] ---/ci---
2.1 KiB
Window
A Window (REQ-015) is the primitive a Nomad uses to delegate a capability without delegating custody. It is scoped, time-limited, rate-limited, audited, and revocable. A Nomad opens a Window so a partner or a service can act on the Nomad's Stash within bounds the Nomad set — the partner never gets custody, and the Nomad can close the Window at any time.
The five parts of a Window
| Part | What it bounds |
|---|---|
| Scope | what the grantee can do (e.g., read Stash balance, spend up to N Grain on a specific service). |
| Duration | when the Window starts and ends (a start time and an end time). |
| Rate limit | how many actions per duration window (e.g., at most 10 reads per hour). |
| Audit log | an append-only log of every action the grantee took under the Window. |
| Revoke | the Nomad can revoke the Window at any time; revoke after expiry is a no-op. |
Why a Nomad opens one
A Nomad opens a Window for the same reason a Nomad uses Maps & Pay: to let a service do something on the Nomad's behalf without handing over the Stash. Common examples:
- A recurring service (e.g., a Care service) pulls a capped amount of Bread from the Stash each week, within a rate limit the Nomad set.
- A partner reads the Stash balance for a compliance check, scoped to read-only, time-limited to one hour.
- A Stand operator processes a Pass-Act on the Nomad's behalf inside a scoped, audited Window.
Lifecycle
A Window moves through a fixed lifecycle: Open → Active → Revoked or Expired. A Nomad can revoke at any point; revoking after expiry is a no-op (idempotent). The lifecycle is mission-locked: a partner cannot extend a Window past its end time — the Nomad must open a new one.
Self-service, by design
The Window is the self-service principle in code. The protocol records the Window on OY Chain; the partner holds only the capability, never the value. See Six Principles for the covenant, and Pacts for the contract shapes delivered through Windows.