What the stack does when nobody is watching

Status: Accepted · Audience: Operator · Area: N — Companion

---

Purpose

A media stack is mostly unattended. It reaches out to other people’s servers, it uses a line somebody else in the house is also using, it decides what is worth waking a person for, and it runs things that must outlive a terminal.

All four are decisions with consequences, all four are the operator’s to make, and none of them has a surface away from the machine.

N4 owns notifications arriving — what a push may contain, and that the app raises none of its own (N4-R11). This owns choosing what the stack tells anybody about in the first place, which is a different decision made at a different time.

Behaviour

What lemonfiber sends is not what the services send

The contract keeps these apart: connections the product makes on the operator’s behalf, and connections the installed services make on their own. That distinction is the whole of the privacy answer, and an app that merged them into one list would be taking responsibility for other people’s software or disclaiming its own.

Each is shown as what it is.

What lemonfiber sends for a plugin is a list of its own

An installed plugin adds a third kind: a request lemonfiber makes on the plugin’s behalf (G8 G8-R15). It is not lemonfiber’s own, because lemonfiber has no reason of its own to make it, and not a service’s, because no service made it. Folded into either list it would answer the wrong question, so it is a third list, On a plugin’s behalf, and each entry names the plugin that declared it, what the request is for, and where it goes, as the name the manifest gave (N20 N20-R3).

Every outbound connection carries what turns it off

The contract names a switch for each connection lemonfiber makes. A privacy screen that lists what leaves the machine without saying how to stop it is a disclosure, not a control.

Where a connection has a cost to turning it off, that cost is stated with it.

Capacity that was measured is not capacity that was claimed

The line’s capacity is either what somebody declared or what the stack observed, and the contract says which. An operator deciding a cap on a declared figure is deciding on a guess, and has a right to know that is what they are doing.

Whether it goes through the tunnel is part of the answer

Traffic through the VPN and traffic beside it are different facts about the household, and the contract distinguishes them. So does this.

A cap does one of three things, and the app says which

Reaching a monthly cap pauses, throttles, or continues. These produce completely different evenings, and you have reached your cap without which one is not an answer.

An alert preset is a decision about being woken

What the stack tells somebody about is a preset with a meaning and a set of exceptions the operator has made. Both are shown: a preset name alone does not say what will happen at three in the morning, and the exceptions are what the operator has already decided they do not want.

A rehearsed alert is not an alert

Alerts can be rehearsed, and a rehearsal is labelled on the same terms as everywhere else (N6-R1). Somebody who believes they received a real alert because the app did not say otherwise has been misled about their own stack.

A long-running command says what it guarantees and what is missing

Some guarantees are made by something that has to keep running, and both the guarantee and what is absent are carried. An operator away from the machine checking whether the thing that stops the stack writing to a vanished disk is actually running is asking a reasonable question, and it is answerable.

States

Edge cases

• A service making a connection lemonfiber did not ask for. Shown under theirs, and not presented as the product’s doing.
• A request lemonfiber makes for a plugin. Shown under On a plugin’s behalf, naming the plugin, and counted in neither of the other two lists.
• An observed capacity that has only been observed once. The source is said; the app does not present it as established.
• A cap with no monthly figure set. Distinguished from a cap of zero.
• A long-running command that is defined but not running. That is the state the operator most needs and is shown as its own answer, not as absent.

Acceptance criteria

Related

• N1 — connecting, parity, and what the app may claim
• N4 — notifications arriving on the device
• N6 — what a rehearsal may not look like
• G8 — the privacy stance this renders
• N20 — what a plugin may send, agreed to as itself
• B5 — what the stack tells somebody about
• B10 — guarantees made by something that keeps running
• D10 — the line, and what uses it