diff options
Diffstat (limited to 'docs/MESHBAY_DESIGN.md')
| -rw-r--r-- | docs/MESHBAY_DESIGN.md | 24 |
1 files changed, 23 insertions, 1 deletions
diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md index 73f6b42..67f0bff 100644 --- a/docs/MESHBAY_DESIGN.md +++ b/docs/MESHBAY_DESIGN.md @@ -1952,7 +1952,9 @@ There is no folder-browsing protocol and this does not add one. under. **One identifier per application, everywhere.** 3. **`<name>-app-settings.js`** if it has anything to configure. Do not import the settings page — that is the cycle in §9.1. -4. **Add the key to the node's allow-list.** +4. **Add the key to the node's allow-list**, and — if the application keeps + directories — to `NodeDaemon.APP_DIR_KEYS`, the one list a group's context is + built from. Nothing else on the node may name an application. 5. **i18n:** at minimum a tab label key **in all ten catalogues**. A settings key added to the client must be added ten times; write the table and generate the insert. @@ -1971,6 +1973,26 @@ There is no folder-browsing protocol and this does not add one. No protocol change, no hub change, no daemon change. Steps 4 and 7 are the only node-side and test-side touches, and both are allow-lists. +> **A list of application names is only ever kept in one place, and everything +> downstream is derived from it.** There were three. The daemon built a group's +> context from one; the handshake ack was assembled from a copy that had already +> lost an entry — the reference application's, so the one application that exists +> to prove a new one needs no special-casing was the single one whose directories +> never reached a client; and the client shell named three applications by hand +> while the live-update path beside it was already generic. +> +> The fix that holds is **removing the copies, not syncing them**: the ack emits +> whatever `<app>_directories` the context carries, and the shell reads the ack's +> own keys. Neither can drift, because neither has anything of its own to drift +> from. +> +> **Where the one list lives matters too.** It is on the daemon, which is what +> wires a group's context; the roster, the operator ops, the config and the root +> set must name no application at all, and a test holds them to it. That is the +> property the reference application exists to demonstrate, and it is the reason +> a first attempt at this fix — moving the list to the roster, where the +> directory *storage* lives — was wrong and was caught. + **A reference application exists in the tree behind a development flag.** Every other test of this architecture reads source for the *absence* of application names, which proves nobody wrote a special case — not that a new application works. |