1.5 KiB
Raw output - bindspace capability design
The human corrected the layer-C design around local network-stack realization. They established that bindspace state should be both structured and a scoped capability; namespace entry belongs in subactor bootstrap; maddrs can describe source or destination network paths while namespace selection augments them orthogonally; random address and teardown behavior depend on operation role and ownership.
They directed comparison with the prototype on github/ns_aware and requested these decisions be preserved in the plan.
git diff HEAD~1..HEAD -- ai/tpt-backends/03_wg_tunnel_bindspace.md ai/tpt-backends/00_shared_backend_contract.md
Reworked layer C around serializable BindspaceSpec, stable BindspaceIdentity, and scoped non-serializable BindspaceHandle concepts. Namespace FDs pin identity and lifetime; parent/supervisor provisioning transfers entry capability through spawn; the child enters before runtime, channels, listeners, sockets, or worker threads and then drops authority. Listen/dial roles and owned/borrowed teardown are explicit, while maddrs remain role-neutral network-path declarations.
The shared backend contract now separates transport-level .bindspace selectors from process namespace lifecycle. Added tests/risks for FD identity, bootstrap ordering, privilege drop, role ownership, and shared-resource teardown.