docs(design): TIN-1556 keep Q1 open; record Q2–Q4 rulings - #575
docs(design): TIN-1556 keep Q1 open; record Q2–Q4 rulings#575Jesssullivan wants to merge 2 commits into
Conversation
Q1 rootful: identity is root_id (reaffirming TIN-2853); host paths are platform projections. Default Unix projection /tcfs/<root_id> (root-owned boundary, user-owned children, the ancestry shape B0 validation already accepts); ~/tcfs fallback projection; FileProvider/CFAPI mandated containers; ~/tcfs -> /tcfs symlink as same-OS compat bridge; legacy roots grandfathered until D1 re-adoption. Q2: 7-day remove retention. Q3: inspect-only driver defaults with per-root promotion. Q4: home-*-v1 stays inventory-and-shadow in B. Boundary provisioning (tmpfiles.d / synthetic.conf) is lab-rendered and deploy-gated behind the live freeze; this ruling changes design authority only, no live claim.
|
[authority hold — 2026-07-30] The Q1–Q4 design amendment is source-scoped to The displayed suite is not sanctioned merge authority. Every assigned job in runs |
Jesssullivan
changed the title
|
[source-integrity fence — corrected 2026-07-30] The only commit, Keep this head unmergeable. Repair requires a signed replacement commit plus fresh natural sanctioned CI after the runner-authority correction; no force-push, rerun, or new hosted run is authorized by this comment. Correction: an earlier version of this comment incorrectly applied a Lab-repository PR-title convention to tummycrypt. That claim was false here and the original title has been restored. |
Jesssullivan
changed the title
Jesssullivan
changed the title
1 participant
Corrects the TIN-1556 ADR record from the 2026-07-29 batched interview.
~/tcfsanswer to consider a rootful filesystem-native projection and did not make a final choice. The ADR now keepsroot_idas fleet-stable identity, preserves existing~/tcfsbindings, treats/tcfsas an opt-in Unix canary candidate rather than a default, names the multiuser/cache-migration/cwd proofs required before promotion, and keeps Q1 inside the R7 fence.--purge-state.inspect-onlydriver defaults with explicit per-root promotion.home-*-v1remains inventory-and-shadow-only in B.This is a design-authority correction only. It does not authorize a root projection, transcript rewrite, live rollout, deploy, activation, enrollment, reconcile, or TCFS runtime action.
Exact signed head:
1b760b36daa5e3d0dc0fdcbcec6e585eface1a60.CI authority hold: natural runs
30514794695,30514794724, and30514794733exposed the known TIN-2538 structural regression—jobs were assigned to GitHub-hostedubuntu-latest,macos-14, andwindows-latest. The runs were canceled as soon as runner metadata was inspected. Their partial successes are not durable proof. Keep this PR draft until exact-head validation executes exclusively through sanctioned GloriousFlywheel infrastructure.