desk: Bifrost half of the Fork Desk answer binding (ports, routes, per-call deciders) #40
2026-11-11
desk: request_id_conflict is the answer's alone; on read and list it is unavailable
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
desk: fork_too_large is a list-only 422; a body refusal on read or list is request_invalid
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-11-10
desk: notes are a decider's words; read and list strip them for everyone else
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
desk: a declared body length over the cap is refused on the header alone
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
desk: envelope names, decider bounds, a failing port is unavailable, hardening tests
The door context carries mind, authority, subject and deciders (fork-card.md M5). Deciders are 1 to 64 unique ids per Mind, refused at startup and again before any door call. A throwing credential port or account lookup answers 503 unavailable. Startup refuses two Minds sharing one socket. Behavioural tests for the per-Mind list, the body cap to the byte, Retry-After, audience case, no-store, cancellation and the stale-fork card read. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
desk: re-pin the vendored vectors to CultLib 89755b08
Existing rows are byte-identical; deciders_at_the_cap_of_64 is a new valid card row. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
desk: list and read routes on the same pipeline (H3b)
GET /api/desk/{mind}/forks and /forks/{fork_id}; the query is judged as
request_invalid before the Mind lookup. Every door call (answer, read, list)
carries the configured deciders; the vectors' 22 auth cases and 57 route cases
now replay for all three routes.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
desk: the answer route on credential and door ports (H3a)
POST /api/desk/{mind}/answers behind one pipeline: raw target, bearer, audience,
scope, Active membership, body shape, {mind} lookup, door. Mapped only when the
Desk section exists; a configured desk without its credential and door ports
stops startup. Stale_fork answers carry the current card read through the door.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
desk: pin decoding failures as misses in the {mind} resolver tests
Hand mutation showed strict UTF-8, non-ASCII refusal and bad-escape refusal were unobserved; a configured id that spells the failure now exposes each. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
desk: options, startup checks and the {mind} resolver (H2)
DeskOptions binds Minds as an ordinal array with sockets and per-Mind deciders, plus Operator/Stewards attribution. StartupConfigurationValidator refuses blank or repeated ids, relative sockets, non-lowercase-D account ids and an Operator listed as steward. DeskMindRoutes.Resolve percent-decodes the raw segment once (strict UTF-8) and compares ordinally; tests replay every mindRoutes vector segment. No route is mapped. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
desk: fork-desk documents, body shape judge and CultLib vectors (H1)
Records for the CultLib fork-card contract (answer_request, refusal, unavailable, card, desk_answer, answer_result), DeskBodyShape (cap, forbidden keys at any depth, closed keys, types and formats, UTF-8 byte note limit) and fork-card-vectors.json vendored from CultLib 6231ecad with a sha256 pin. Tests replay the vector arrays row by row. Nothing is mapped yet. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>