diff options
Diffstat (limited to 'docs/FOG-ARCHITECTURE.md')
| -rw-r--r-- | docs/FOG-ARCHITECTURE.md | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/docs/FOG-ARCHITECTURE.md b/docs/FOG-ARCHITECTURE.md index 9060c7c..c6ae166 100644 --- a/docs/FOG-ARCHITECTURE.md +++ b/docs/FOG-ARCHITECTURE.md @@ -224,6 +224,13 @@ It MUST NOT: modules over shared messaging and storage protocol libraries. They are not independent network daemons in the initial architecture. +The rootless Podman `network=none` Composer remains a functional fixture, not +a claim-bearing endpoint profile. A non-active Ephemeral Composer may keep +bounded runtime state only in RAM for one-shot drops and explicitly +non-resumable sessions. Continuing mailbox and conversation state requires a +Persistent Composer vault. The MicroVM and Portable profiles retain their +separate host and physical assumptions. + Threats addressed: `TM-ENDPOINT-01`, `TM-ENDPOINT-02`, `TM-ENDPOINT-03`, `TM-APP-01`, `TM-CRYPTO-01`, `TM-PKI-02`. @@ -678,6 +685,18 @@ to a stable global username. It MUST NOT become a durable provider mailbox. Exact queueing, polling, retransmission, acknowledgment, and SURB behavior is defined by the packet, wire, messaging, and storage specifications. +The Composer MAY prepare a bounded batch of future opaque polling operations +that the relay transmits later according to the authenticated schedule. The +relay cannot derive replacement capability state, invent semantic polling +operations, or decrypt returned storage results. When the prepared batch is +exhausted, only a later Composer export can replenish it. + +FOG retrieval is therefore asynchronous. `fog-drop` is one cryptographic +digital dead drop; `fog-mailbox` and `fog-im` operate over sequences of +rotating capability-addressed dead drops. Replica persistence, relay receipt, +Composer authenticated commit, and human reading are distinct events. No core +component promises real-time delivery. + Empty reads, hits, misses, replies, retries, and acknowledgments MUST fit the same declared external traffic classes. A relay MUST continue its configured cover and retrieval schedule independently of whether the Composer has a real |