Requirements
Services MUST declare what they can do as named capabilities, and stack wiring MUST ask for capabilities rather than naming services.
- locked by
- 0.16.0 met
- recorded done
- lemonfibercontract/web-api/index.jsoncontract/web-api-surface/index.jsoncrates/lemonfiber-core/src/app.rscrates/lemonfiber-core/src/app/command.rs
- recorded partial
- lemonfiber-media-stackstack.tomlscripts/wiring_rules.py
- cited by
- lemonfiber@eb40fb4d4alemonfiber-media-stack@72395ca4ed
The core capability vocabulary MUST be published, versioned and owned by lemonfiber.
- locked by
- 0.16.0 met
- recorded done
- lemonfibercontract/capability-vocabulary.json
- cited by
- lemonfiber@553353f26e
Every core capability MUST carry a stated contract and probes that demonstrate it.
A plugin MUST NOT declare a capability in the core vocabulary's namespace, and MUST be able to declare namespaced capabilities of its own.
- locked by
- 0.16.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/filling.rscrates/lemonfiber-core/src/lib.rscrates/lemonfiber-core/src/plugin.rscrates/lemonfiber-core/src/plugin/claimed.rs
- recorded partial
- lemonfiber-media-stackscripts/manifest_rules.pyscripts/test_validate_manifest.py::a capability in a plugin's namespace on a bundled service
- cited by
- lemonfiber@86c7285321lemonfiber-media-stack@8b1efe682a
- F4-R5withdrawn
Withdrawn — carried to F9-R1 and F9-R2 when the bundled declarations became their own feature. The number is not reused.
- locked by
- no version locks it yet
A service claiming a capability whose probes fail MUST NOT be installed or wired to.
A capability whose probes cannot be run MUST be reported as unproven and MUST NOT be treated as satisfied.
Where more than one installed candidate claims the same capability, lemonfiber MUST refuse and name every claimant and the collision, and MUST NOT resolve it by install order, precedence or recency.
A capability that something asks for and nothing fills MUST be reported explicitly, naming what asked for it.
Substituting one service for another MUST be expressible as a change of which service fills a capability, and MUST be journalled as a change.
A substitution that would leave a capability unfilled MUST state so before it is applied.
Wiring to a specific service by name MUST remain possible for the operator, MUST be shown as a by-name wiring, and MUST NOT be introducible by a plugin.
- locked by
- 0.16.0 met
- recorded done
- lemonfibercontract/web-api/index.jsoncontract/web-api-surface/index.jsoncrates/lemonfiber-core/src/app.rscrates/lemonfiber-core/src/app/command.rs
- recorded partial
- lemonfiber-media-stackscripts/wiring_rules.pyscripts/test_validate_manifest.py::does not say why
- cited by
- lemonfiber@eb40fb4d4alemonfiber-media-stack@72395ca4edlemonfiber-web@aa3b7765fb
What a service can do MUST NOT share a name with the kernel capabilities a container is granted; the two MUST be distinguishable without knowing which document is being read.
- locked by
- 0.16.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/filling.rscrates/lemonfiber-core/src/lib.rscrates/lemonfiber-core/src/plugin.rscrates/lemonfiber-core/src/plugin/claimed.rs
- cited by
- lemonfiber@86c7285321lemonfiber@0e8ae82b74lemonfiber-media-stack@4288cebf60lemonfiber-media-stack@1d8e02ebe9
Extending the set of things a service may declare MUST NOT require a closed enumeration in first-party source to be edited, and an unrecognised declaration MUST be refused by name rather than by parse failure.
- locked by
- 0.16.0 met
- recorded done
- lemonfibercontract/capability-vocabulary.json
- cited by
- lemonfiber@3ec56ad9e7lemonfiber-media-stack@db1ea82a32
The points at which a plugin may extend lemonfiber itself MUST be published, versioned and owned by lemonfiber, and a manifest declaring at a point this lemonfiber does not publish MUST be refused by naming that point and the ones that exist, rather than by parse failure.
- locked by
- 0.16.0 met
- recorded done
- lemonfibercontract/extension-points.jsoncontract/plugin-manifest.schema.json
- cited by
- lemonfiber@553353f26e
A contribution MUST be declared in the declaring plugin's own namespace, MUST NOT be declarable in the namespace of anything bundled, and MUST be attributed to that plugin wherever it appears.
A plugin MUST NOT replace, re-order or suppress a bundled check or the remedy it carries, and a contribution that would MUST be refused naming what it collided with. Standing in for something bundled MUST remain an operator's recorded choice rather than a manifest's assertion.
The core capability vocabulary MUST be published as a single artefact carrying every capability's name, contract and probes, MUST carry its own generation, and MUST be readable non-interactively without a network, a catalogue or a running stack.
- locked by
- 0.16.0 met
- recorded done
- lemonfibercontract/capability-vocabulary.json
- cited by
- lemonfiber@553353f26elemonfiber-media-stack@8b1efe682a
A capability name MUST NOT be reused, and one a published generation carried and a later one does not MUST be refused by naming the generation it was removed in rather than as unknown.
- locked by
- 0.16.0 met
- recorded done
- lemonfibercontract/capability-vocabulary.json
- cited by
- lemonfiber@553353f26e
The extension points MUST be published as a single artefact carrying every point's register, the shape of a row in it, and the identities its bundled rows already hold, and MUST carry its own generation.
- locked by
- 0.16.0 met
- recorded done
- lemonfibercontract/extension-points.jsoncontract/plugin-manifest.schema.json
- cited by
- lemonfiber@553353f26e
A contribution MUST name the extension point it is made at, and one naming a point this lemonfiber does not publish MUST be refused by naming that point and listing those that exist.
- locked by
- 0.16.0 met
- recorded done
- lemonfibercontract/extension-points.jsoncontract/plugin-manifest.schema.json
- cited by
- lemonfiber@553353f26e
A contribution's identity MUST be namespaced with the declaring plugin's id, and one naming an identity a published extension point records as bundled MUST be refused naming both.
- locked by
- 0.16.0 met
- recorded done
- lemonfibercontract/extension-points.jsoncontract/plugin-manifest.schema.json
- cited by
- lemonfiber@553353f26e
A name MUST NOT appear both in the core capability vocabulary and in the set of capabilities a manifest may require of lemonfiber, and the two sets MUST be published as separate artefacts.
- locked by
- 0.16.0 met
- recorded done
- lemonfibercontract/capability-vocabulary.json
- cited by
- lemonfiber@553353f26e
What a capability's probe must show MUST be declared by the vocabulary and where it is asked MUST be declared by the claimant; a probe requiring a credential MUST be reported as unproven when run with none, and MUST NOT be reported as failed.
- locked by
- 0.16.0 met
- recorded done
- lemonfibercontract/capability-vocabulary.json
- cited by
- lemonfiber@553353f26e
A capability's probe MUST be satisfiable by a service holding none of the operator's own data, and a binding asserting a count above zero MUST be refused. A contributed check MUST NOT be held to either, because a check reports on a running stack rather than gating an install.
What the stack wires to what MUST be served as a read of the web API answering with the wiring envelope the command answers with, carrying how each link was settled — a contest with every claimant, a choice with whose it was and what it was chosen over — and every capability something asks for and nothing fills (F4-R8, F4-R9, ARCH-R47).
Choosing which service fills a capability, including one that stands contested, MUST be an action of the web API taking the capability, the service and the reason the command takes and answering with the substitution envelope the command answers with; the choice MUST be recorded and journalled as the command records it, and MUST be read back as the operator's (F4-R10, F4-R29, ARCH-R48).
Choosing which service fills a capability MUST be rehearsable over the web API, MUST write nothing when rehearsed, and MUST answer with what fills the capability now, what would fill it and what the change would leave unfilled (F4-R11).
Choosing which service fills a capability MUST take an optional reason, alike at the command line and as the web API action (ARCH-R48); a reason given MUST be recorded with the choice and read back as the choice's why wherever the choice is read, and a choice given none MUST be read back with none.
Rehearsing a choice of which service fills a capability MUST answer with an offer naming what it read; the choice MUST take that offer as its yes, alike at the command line and over the web API (ARCH-R48), MUST build it again from the wiring as it stands when it runs, and MUST be refused, naming what moved, where the two differ (ADR-0031).