Repository navigation
ftwcloudd: hold a signed copy of each home in memory (FTW Cloud C2) - #1
Merged
Merged
Conversation
The first version of FTW Cloud (srcfl/ftw ADR 0008, step C2): - /v1/box takes one uplink per home. The service checks that the box signed hello over this TLS session's exporter value, answers with a hello_ok signed by the service key, and accepts only messages signed by that box's key. The home id is a hash of the key. - store.For(principal) is the only way to a home. Each home's newest message of each class is kept in memory as the exact bytes the box sent; readings go an hour after the box does and never reach disk. - The registry (SQLite, secure_delete) holds the home id, the box key, the signed roster and tombstones. bye with purge deletes the home and returns a signed receipt, again if the first one was lost. - The downlink is a closed set of five types; what a box can sign is fuzzed. /source serves the running source. A test checks that no route reads a home. - /v1/app (C3) and /v1/now (C5) are marked and answer 501. The wire format comes from github.com/srcfl/ftw/go/protocol, pinned to a commit; CI checks that nothing else from srcfl/ftw is imported. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
The first version of FTW Cloud's service,
ftwcloudd. It is milestone C2 in ADR 0008 (srcfl/ftw#1589).A box whose owner turned FTW Cloud on dials out over one WebSocket and streams a box-signed, readable copy of its state. The service verifies every signature and the box's device roster, and keeps each home in memory behind
store.For(principal). It reads and never controls: the downlink is a closed set of messages, covered by a fuzz test, and an import check keeps control code out of the binary.Paired PRs
go/protocol/cloudwirewith golden vectors, the uplink ininternal/cloudlink, and the grant routes, off by default.Evidence
Run end to end on a laptop: a Core built from #1595 with simulated drivers, against a local
ftwcloudd./api/cloud/previewshows.down.Tests, the race detector, fuzzing, the import check and the Docker build all pass. Dev-only inspection code builds only with
-tags ftwclouddev; the Dockerfile builds without tags.Deliberate differences from the design
ftwclouddterminates TLS itself, sodeploy/has one container.AGPL-3.0-only. The commits have no DCO sign-off; Fredrik signs off his own work.
🤖 Generated with Claude Code