F8 Recipes and named adapters
- Area
- F — Extensibility
- Audience
- operator
- Kind
- feature
- Status
- accepted
- Maturity
- built
- Labels
- extensibility, verification, security
The feature in the specification · Read at
Requirements
A recipe MUST be an ordered sequence of calls supporting capture, substitution of earlier captures, branching on status or captured value, and bounded wait-and-retry.
A recipe MUST NOT support unbounded computation, a destination computed while running, or a call assembled out of a response.
- locked by
- 0.18.0 met
- recorded done
- lemonfibercrates/lemonfiber-plugin/src/refusing/recipes.rscrates/lemonfiber-plugin/src/refusing/recipes/whither.rscrates/lemonfiber-plugin/src/refusing/recipes/bounds.rscrates/lemonfiber-api/src/contract/stability/declared.rs
- cited by
- lemonfiber@3cb585e1c5lemonfiber@6409706002
Every value a recipe captures MUST carry its origin — a service in this stack, the credential store, the operator, or the response of an external host.
Every destination MUST be classified as a service in this stack or as an external host, and there MUST be no third classification.
A manifest MUST declare each permitted flow as a pair naming a captured value and a destination, and a flow with no declared pair MUST fail validation.
The flow check MUST be performed statically, before any of the recipe's calls is made.
- locked by
- 0.18.0 uncited
- recorded done
- lemonfibercrates/lemonfiber-plugin/src/refusing/recipes.rs
A pair carrying a value to an external host MUST be approved by the operator at rehearsal, named as that value and that destination, and MUST NOT be approved implicitly by approving the installation.
- locked by
- 0.18.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/plugin/recipes.rscrates/lemonfiber-core/src/app/plugins/offering.rscrates/lemonfiber-core/src/plugin/running/bounding.rscrates/lemonfiber-core/src/plugin/recipes/tests.rs::only_a_pair_to_a_host_outside_asks_for_approvalcrates/lemonfiber-core/src/plugin/recipes/tests.rs::every_pair_carries_its_origin_and_what_approving_it_is_written_ascrates/lemonfiber-core/src/app/plugins/offering/tests.rs::a_pair_not_approved_is_refused_by_namecrates/lemonfiber-core/src/app/plugins/offering/tests.rs::the_offer_standing_with_every_pair_approved_acts_and_a_rehearsal_does_notcrates/lemonfiber-core/src/plugin/running/tests/holding.rs::a_value_outside_without_its_approval_is_withheld
- cited by
- lemonfiber@00a691442f
A recipe MUST name an in-stack destination by its service id and an external destination by a DNS name, and a manifest containing an address literal, a network range or a bare host port MUST be refused.
A destination declared external that resolves to any address not out on the internet, as the plugin manifest contract classes addresses, MUST be refused at the call; the resolution MUST be checked on each call rather than once, every address it answers with MUST be checked, the call MUST connect only to the addresses checked, and no redirect MUST be followed.
A recipe MUST NOT reach any host, service or value the manifest has not declared.
- locked by
- 0.18.0 met
- recorded done
- lemonfibercrates/lemonfiber-plugin/src/refusing/recipes.rscrates/lemonfiber-plugin/src/refusing/recipes/whither.rscrates/lemonfiber-plugin/src/refusing/reaching.rscrates/lemonfiber-plugin/src/refusing/recipes/tests.rs::a_value_carried_to_a_destination_no_pair_declares_is_refusedcrates/lemonfiber-plugin/src/refusing/recipes/tests.rs::a_substitution_no_earlier_step_captures_is_refusedcrates/lemonfiber-plugin/src/refusing/reaching/tests.rs::a_value_captured_that_no_secret_declares_is_refused_naming_it_and_its_origincrates/lemonfiber-plugin/src/refusing/reaching/tests.rs::nothing_outside_a_recipe_can_name_where_it_is_goingcrates/lemonfiber-core/src/plugin/running/bounding/tests.rs::outside_a_value_needs_its_pair_and_its_approval
- cited by
- lemonfiber@00a691442f
A plugin MAY name one of a published, fixed set of lemonfiber-implemented adapters for flows recipes cannot express, and MUST NOT supply an adapter of its own.
Naming an adapter this lemonfiber does not implement MUST be refused, naming the adapter and the set that is available.
The set of adapters MUST be published rather than discovered.
A recipe MUST declare whether it runs on install or on demand, and a recipe declaring neither MUST run on install; an install recipe MUST run during an install and an update, after the plugin's proofs and the stack's checks hold and before the install is recorded, and a failure MUST put the install back and name each call that had already reached somewhere.
A demand recipe MUST run only when asked for by name, with its own rehearsal, offer and approvals, and an approval MUST NOT carry over from another act or another run; a demand recipe that fails MUST change no install record and MUST name each call that had already reached somewhere.
- locked by
- 0.18.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/app/plugins/demanding.rscrates/lemonfiber-core/src/app/plugins/kept.rscrates/lemonfiber-core/src/app/plugins/following.rscrates/lemonfiber-core/src/app/plugins/offering.rscrates/lemonfiber-api/src/actions/named/extending.rscrates/lemonfiber/src/cli/plugin.rscrates/lemonfiber/src/render/plugin/machine/demanded.rscrates/lemonfiber-core/src/app/plugins/tests/demanding.rs::a_demand_recipe_is_read_by_name_and_runs_only_on_its_own_offercrates/lemonfiber-core/src/app/plugins/tests/demanding.rs::an_approval_from_another_act_and_a_moved_offer_are_refusedcrates/lemonfiber-core/src/app/plugins/tests/demanding.rs::a_demand_recipe_that_does_not_hold_changes_no_install_recordcrates/lemonfiber-core/src/app/plugins/tests/demanding.rs::a_rehearsal_answering_the_offer_calls_nothing
- cited by
- lemonfiber@78b6a30871lemonfiber-web@ab6442ebe2
A value a recipe takes from the credential store for a service MUST be held to that service, and so MUST every value a recipe captures from a call that carried or read such a value, which no release frees; every other value a recipe captures from the answer of a service in this stack MUST be held to that service by its origin, whatever it holds; a pair, a call or a guard carrying or reading a held value for any other destination MUST fail validation, except a capture of that other kind carried there by a pair carrying a release, and a release on a pair that frees nothing — a credential-store value, a value captured from a call that carried or read one, an operator's input, an external host's answer, or a capture going back to its own service — MUST fail validation.
- locked by
- 0.18.0 met
- recorded done
- lemonfibercrates/lemonfiber-plugin/src/refusing/recipes/whither.rscrates/lemonfiber-plugin/src/refusing/recipes/whither/tests.rs::a_release_never_frees_what_a_credential_was_traded_forcrates/lemonfiber-plugin/src/refusing/recipes/whither/tests.rs::what_a_credential_is_traded_for_goes_back_only_to_its_service
- cited by
- lemonfiber@c8b5ffb198lemonfiber@6409706002
While a recipe runs, each value it holds MUST carry the destinations it may be sent to: a credential-store value and every value captured from a call that carried or read one its own service alone, any other capture from a service in this stack that service and each destination of a released pair the operator approved in this act, and any other value the destinations its pairs name; a call carrying a value to any other destination, or to a host outside the stack without the approval of its pair, MUST be refused before it is sent, under a code of its own, ending the recipe.
- locked by
- 0.18.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/plugin/running/bounding.rscrates/lemonfiber-core/src/plugin/running/bounding/tests.rs::an_answer_goes_elsewhere_only_by_an_approved_releasecrates/lemonfiber-core/src/plugin/running/bounding/tests.rs::no_approved_release_frees_what_a_credential_boughtcrates/lemonfiber-core/src/plugin/running/tests/holding.rs::a_value_traded_for_a_credential_is_withheld_from_anywhere_else
- cited by
- lemonfiber@c8b5ffb198
A release MUST be written on its [[recipe.pair]] as release, the sentence saying why the value is carried, and each released pair MUST be shown at install consent, and at every other act that carries it, as the value, the service it was read from, the destination and that sentence, and approved by the operator as itself; it MUST NOT be approved by approving the installation or another pair, and an act with a released pair not approved MUST NOT proceed.
The plugin reading MUST list, for each recipe of a plugin, every input it asks the operator for, with its name, the question it asks and whether it is a secret, so that a surface can collect each before the operator agrees; a value given for a secret input MUST NOT be shown back by any reading or answer.
- locked by
- 0.18.0 met
- recorded done
- lemonfibercrates/lemonfiber-core/src/plugin/recipes.rscrates/lemonfiber-core/src/app/plugins/offering.rscrates/lemonfiber/src/render/plugin/machine/answering.rscontract/web-api/defs/PluginRecipeInput.jsoncrates/lemonfiber-core/src/plugin/recipes/tests.rs::a_recipe_lists_what_it_asks_the_operator_for_and_nothing_the_store_answerscrates/lemonfiber/src/render/plugin/machine/answering/tests.rs::what_a_recipe_asks_for_is_said_and_a_secret_is_marked_as_one
- cited by
- lemonfiber@78b6a30871