Bounded admission pipeline review v1

Proposed local driver profile · 5 September 2026 · not implemented network behavior

An independent virtual-time model now exercises these proposed rules; see docs/DRIVER_MODEL_V1.md. The production driver remains unimplemented.

State and acknowledgements

bounded transport frame
    -> bounded volatile preverification
    -> current policy / descriptor validation
    -> bounded commit scheduling
    -> single ledger writer
    -> sync succeeds
    -> durable receipt or quarantine acknowledgement

Each stage owns a bounded resource until it transfers ownership or rejects the request. Queue acceptance and successful signatures are not admission. A caller MUST NOT treat a queued or checked response as durable permission. Retention, retrieval, and attention remain separate decisions after admission.

The initial driver experiment should use preloaded descriptor fixtures. Missing descriptors fail without implicit network fetches. Full Beacon canonical encoding and a bounded descriptor-exchange profile remain prerequisites to public ingress; this document does not introduce another public wire format.

Initial experiment budgets

Use explicit fixed limits in the first deterministic driver simulation, then measure before changing them. These values are test parameters, not Core constants:

• At most 32 established transport sessions and 4 concurrent handshakes. Source IDs are node-assigned session handles. Untrusted payload identities never create scheduling accounts. Authentication alone does not establish identity scarcity.
• At most one incoming frame per session, 884 payload bytes, and 32 KiB aggregate payload buffering. Reject an oversized declaration before allocation. The receiver must also cap transport/header overhead and kernel socket buffers.
• A five-second monotonic deadline for completing an input frame. Close an expired or oversized stream; do not accumulate partial frames or retry buffers.
• Preverification: 32 active sources, 4 jobs per source, 128 total, five-second age. Reserve 32 verification credits each 100 ms, with a burst ceiling of 32 and no accumulated idle credit. Invalid signatures consume budget. This bounds queue signature attempts, not elapsed CPU; handshake and downstream work need their own limits, included in the experiment's accounting.
• Commit scheduling: 16 ordinary pending decisions and 16 pending local-conflict decisions, with one in-flight writer operation and no unbounded completion queue. Responses are at most 128 bytes, at most one pending response per session; close a session that misses a five-second output deadline.

The current library queue implements count/age limits and per-call credits only. The timed driver, session/framing limits, commit queues, and output deadlines above are proposed, not existing enforcement. The simulator must track payload bytes, metadata, retained capacity, active tasks, signature attempts, and in-flight writes separately. Configured counts are not a measured process-memory bound.

Scheduling verified local conflict evidence

Only cryptographically verified, current evidence matching a locally accepted slot may enter the reserved commit lane. The untrusted claimed slot or issuer is not sufficient. Deduplicate pending local evidence by credential/slot; a pending commit is not a committed tombstone and must not receive a durable acknowledgement.

Alternate reserved and ordinary lanes while both have work, allowing either lane to borrow service when the other is empty. No new task is spawned when the writer is busy. A full lane refuses additional work without evicting committed state or silently moving it to an unbounded retry list. Retrying callers must use the same claim/evidence identity; duplicates do not create another allocation.

Reserved service protects already verified local evidence against ordinary commit backlog. It cannot guarantee access through saturated sessions or preverification, nor can it guarantee service when its own bounded lane is full. Invalid frames claiming a local slot receive no privileged queue access. A sender retrying valid evidence still requires eventual delivery and capacity assumptions.

Both ordinary admissions and evidence MUST be revalidated at commit time using current time, policy, accounting, and ledger health. Evidence verified before an epoch change cannot be committed under a new epoch. Existing ledger validation performs this check and repeats signature verification; budget that work rather than inventing an implicit verification-cache exemption.

Disk failures, stalls, and recovery

Serialize mutations through one writer. A new receipt is acknowledged only after its journal sync succeeds. A local-conflict acknowledgement follows the same rule. An append or sync error makes the handle uncertain: stop its writes and serving of receipts, release it, and reopen under the expected policy before resuming.

A writer deadline does not cancel an operating-system fsync. Do not start another writer, reopen the same live handle, or spawn replacement workers while a timed-out operation may still write. Stop taking work for that ledger; report an uncertain result if a response can be sent safely. Recovery waits for the operation to end or for a controlled process restart. No liveness guarantee holds for an indefinitely stalled filesystem.

Recovery may find a complete unacknowledged record or discard an incomplete tail. It must sync recovered state before issuing an idempotent success. A lost response after commit never rolls back the allocation. A restart loses volatile queue work; only ledger records provide durable evidence. Whole-directory rollback and loss of all durable copies remain outside the local durability guarantee.

Rollover syncs the candidate header before rename and the directory after rename. A pre-rename failure leaves the old ledger intact, still subject to its expiry. An error after rename poisons the handle. Recovery must inspect the persisted policy; it must not guess that either the old or new epoch committed from the error alone.

Executable gate before transport integration

Build a deterministic driver simulator with these parameters and explicit virtual time. Test slow input/output, session churn, invalid signatures, both commit lanes full, expiration while queued, epoch change between verification and commit, lost acknowledgements, stalled fsync, sync errors, and restart. Assert all configured resource bounds and no acknowledgement before successful commit.

Publish ordinary/local-evidence refusal rates and attack-first newcomer starvation. A model of the driver is separate from conformance of an actual transport. Do not enable public admission until implementation traces refine the model and the open wire/descriptor, handshake, and recovery questions have been reviewed.