From 897986d6d720c9dbe172650cb777391983406b41 Mon Sep 17 00:00:00 2001 From: Skippy The Magnificent Date: Mon, 2 Nov 2026 13:39:51 -0600 Subject: [PATCH 1/2] docs(marvel): record the fileshare-3 ruling and its read bound in the cp design Adds section 9a to the cp design: Desk card fileshare-3 (option 3, a marvel verb run by the daemon on a schedule) and the bound the operator confirmed. The verb reads only paths named in the owner-written policy file marvel cannot write, turns off when that file is missing, unreadable or daemon-writable, and is generic. The publish set and any mirror are left out. --- docs/design/marvel-cp.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/docs/design/marvel-cp.md b/docs/design/marvel-cp.md index f8e3c133..153267b7 100644 --- a/docs/design/marvel-cp.md +++ b/docs/design/marvel-cp.md @@ -136,6 +136,19 @@ The operator ruled all four on 2026-11-01 (Desk, 23:54Z to 23:57Z), relayed by d - R3. Whether the new `file` key scope is wanted, or `admin` alone suffices until the principal model (aae-orc-bs3x). Ruled: option 1, add the `file` scope (A4). - R4. The size cap and ceiling (I3). Ruled: option 3, not the recommendation (1 MiB by default, raisable to 16 MiB). In the ruling's words: "no cp-specific cap, and the existing transport limits (the 24 MiB request bound and the 32 MiB reply bound) set the ceiling, so a file over the limit fails at the transport." I3, I5, I6, A3 and section 10 are written to it. On 2026-11-02 director ruled that refusing, before any read, a `file.get` that could not fit the existing reply bound matches option 3 (I3); the operator may override. +## 9a. A scheduled publish verb, and the bound on its reads + +**Why this is written here.** The jail in section 3 and the policy in section 6 limit what cp itself can read and write. A scheduled publish verb, run by the daemon with no one at the keyboard, would read files on its own. If its reach were left to its own configuration, it could be built to read anything that configuration names, and the containment cp was ruled on would not hold for it. This section records the ruling and its bound so a later build has to meet them. + +**The ruling.** Desk card fileshare-3, 2026-11-02: option 3, "marvel verb, run by the daemon on a schedule." The card named its cost as "as option 2, and it publishes with no owner at the keyboard". Option 2's cost was that marvel gains read reach outside the cp jail. The operator confirmed the bound below on 2026-11-02. + +- P1. The scheduled verb reads only paths named in the owner's policy file, the one marvel cannot write (A1, A3). Nothing outside those paths is read or packed. +- P2. A missing, unreadable or daemon-writable policy file turns the verb off, by the same checks and with the same refusal that A1 and A2 apply to cp. There is no built-in default list of paths. +- P3. The verb is generic. It takes the paths the owner lists, as `` entries, and knows nothing of the layout of any other component. No path belonging to another component is built into it (ADR-005, component independence). +- P4. The policy is read on each scheduled run, before anything else, as A1 reads it for each cp call. Removing the file or setting `enabled = false` (A6) stops the next run. This follows from P2 and A6. + +**Not decided here.** Which paths the owner lists is the owner's to name, not this section's. The publish set and any one-way mirror are separate items, recorded elsewhere; a mirror needs its own design note. This section names no real directory and sets no publish set. + ## 10. Out of scope Directories, recursion, streaming, resumable transfer, files over the transport limits (I3), seat-to-seat copies on one host that need no daemon, any write to a company root or installer store, distributing casts or company versions, any content inspection, and any change to how `marvel work` resolves a workspace root. From 8c80a3db3e332a3ebbb77ac214bb14aabe7bc4a9 Mon Sep 17 00:00:00 2001 From: Skippy The Magnificent Date: Mon, 2 Nov 2026 13:53:57 -0600 Subject: [PATCH 2/2] docs(marvel): give the publish verb's read paths their own policy entry Review of the section 9a draft found that P1 cited A3 for the verb's read paths, but A3 names only the jail and its prefixes. P1 now says the policy file gains a per-workspace entry for the verb's read paths, separate from the jail and under the same A1 checks. --- docs/design/marvel-cp.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/design/marvel-cp.md b/docs/design/marvel-cp.md index 153267b7..c0168d9b 100644 --- a/docs/design/marvel-cp.md +++ b/docs/design/marvel-cp.md @@ -142,7 +142,7 @@ The operator ruled all four on 2026-11-01 (Desk, 23:54Z to 23:57Z), relayed by d **The ruling.** Desk card fileshare-3, 2026-11-02: option 3, "marvel verb, run by the daemon on a schedule." The card named its cost as "as option 2, and it publishes with no owner at the keyboard". Option 2's cost was that marvel gains read reach outside the cp jail. The operator confirmed the bound below on 2026-11-02. -- P1. The scheduled verb reads only paths named in the owner's policy file, the one marvel cannot write (A1, A3). Nothing outside those paths is read or packed. +- P1. The owner's policy file, the one marvel cannot write, gains a per-workspace entry naming the verb's read paths, separate from the jail and its prefixes (A3) and under the same A1 checks. The paths are named there and nowhere else. The scheduled verb reads only those paths; nothing outside them is read or packed. - P2. A missing, unreadable or daemon-writable policy file turns the verb off, by the same checks and with the same refusal that A1 and A2 apply to cp. There is no built-in default list of paths. - P3. The verb is generic. It takes the paths the owner lists, as `` entries, and knows nothing of the layout of any other component. No path belonging to another component is built into it (ADR-005, component independence). - P4. The policy is read on each scheduled run, before anything else, as A1 reads it for each cp call. Removing the file or setting `enabled = false` (A6) stops the next run. This follows from P2 and A6.