From 9d3432d2fe148aedf04d2f4e1df5b2b48f7aae2d Mon Sep 17 00:00:00 2001 From: sammiller Date: Wed, 28 Oct 2026 17:40:15 +0800 Subject: [PATCH 1/2] plan: apply the owner's decision on hosted subscriptions and self-hosted mode AF-CTR-02 adds the explicit, fail-closed center mode; AF-CTR-03 adds feature availability (the entitlement resolver port moves here from AF-CTR-09, catalogue configuration with development fixtures distinct from production settings, audited operator grants, official-hosted gates with essential operations ungated, the self-hosted default with operator limits); AF-CTR-04/05/07 apply the gate after authentication and authorization; AF-CLD-03 builds on it. H-07 is partly decided and stays open for prices, trials, node limits and traffic allowances; no production sales are activated. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01H6Cf6pFe7uHMuN6zEgDLmW --- acceptance-register.md | 2 +- delivery-graph.json | 47 +++++++++++++++++++++++++++--------------- ledger/ledger.jsonl | 1 + 3 files changed, 32 insertions(+), 18 deletions(-) diff --git a/acceptance-register.md b/acceptance-register.md index ec0033b..bb05c74 100644 --- a/acceptance-register.md +++ b/acceptance-register.md @@ -50,7 +50,7 @@ Real-world validation that cannot run at development stage, and the human prereq | H-04 | Signing custody: Authenticode certificate, ES256 release manifest key, apt GPG key, Android upload key | AF-AND-03 (release readiness), AR-04 | Nothing at development stage (test keys); production releases and AR-04 | Development, including AF-DIST-01, uses test keys that are never shipped | | H-05 | Domains and DNS: `arcforges.com`, `releases.`, `relay.`, `status.` | AF-PROD-01 (publishing the site and profiles; relay and status endpoints), AR-13 | AF-PROD-01 only | Development uses the local stack, and implementation tasks deploy dark. Request it when AF-ACC-01 starts | | H-06 | Cloudflare account settings: Containers enabled, budget alerts configured | AF-PROD-01, AR-09 | AF-PROD-01 only | The coordinator never changes account or security settings. Dark deploys need no flagship Containers. Request it when AF-ACC-01 starts | -| H-07 | Prices, currencies, trials and introductory offers; since 2026-10-28 also the plan contents under center access: which center features are gated and the limits per plan, such as nodes or devices per account and the free configuration, and whether self-hosted centers apply a catalogue ([AD-0021](https://github.com/ArcForges/ArcForges-Design/blob/main/docs/decisions/AD-0021-central-access-go-center.md), Open questions) | AF-COM-01, AF-CLD-07, AF-PROD-01 (commerce surface), AR-05, AR-06 | Nothing at development stage (`commerce.sales_open=false` until decided); `complete`, not delivery, of AF-PROD-01 (commerce stays off without it); the production activation steps of AF-PROD-01 for the center surfaces wait for the plan contents | Until decided, `commerce.sales_open=false` | +| H-07 | Prices, currencies, trials and introductory offers; since 2026-10-28 also the plan contents under center access: which center features are gated and the limits per plan, such as nodes or devices per account and the free configuration, and whether self-hosted centers apply a catalogue ([AD-0021](https://github.com/ArcForges/ArcForges-Design/blob/main/docs/decisions/AD-0021-central-access-go-center.md), Open questions). *Partly decided 2026-10-28 (AD-0021 §13a):* the official hosted center's center-mediated services are subscription services with no permanent free hosted-node allowance, essential operations stay ungated, and self-hosted centers need no official subscription; **still open:** exact prices, trials, node limits and traffic allowances (and currencies and introductory offers) | AF-COM-01, AF-CLD-07, AF-PROD-01 (commerce surface), AR-05, AR-06 | Nothing at development stage (`commerce.sales_open=false` until decided); `complete`, not delivery, of AF-PROD-01 (commerce stays off without it); the production activation steps of AF-PROD-01 for the center surfaces wait for the plan contents | Until decided, `commerce.sales_open=false` | | H-08 | Support response targets | AF-OPS-01 | Nothing (the default proposal applies) | Default proposal: Pro first response in 2 business days | | H-09 | Monthly cloud cost ceiling | AF-OPS-01 (default budgets in development), AF-PROD-01, AR-09 | AF-PROD-01 (the production daily budgets are derived from it); nothing at development stage | `31 × (daily budgets + residual daily worst case)` stays within it (Design 14 §7.4) | | H-10 | Legal texts: terms, privacy policy, refund policy, subprocessor list | AF-PROD-01 (publishing the public site; commerce needs the published legal pages) | `complete`, not delivery, of AF-PROD-01 (the public site and commerce stay off without it) | Production publication refuses placeholder text; AF-WEB-01 merges dark without them | diff --git a/delivery-graph.json b/delivery-graph.json index 6d2485b..03a3be8 100644 --- a/delivery-graph.json +++ b/delivery-graph.json @@ -1851,7 +1851,8 @@ "Structural cost bounds of the hosted deployment recorded and enforced in configuration: Container max_instances, instance type and idle sleepAfter, Worker cpu_ms limits, PostgreSQL connection budgets; the always-on instance worst case while nodes are connected stated for AF-PLAT-01's budgets", "Observability: structured logs with correlation IDs and no secret, command line, output or file content; metrics for requests, database pools, migrations and the node channel; health and readiness with PostgreSQL reachability; alert conditions documented for AF-OPS-01", "Go path coverage in the external-PR hosted workflows (CodeQL for Go, the Go checks, dependency review) and the required statuses", - "The repository provisioning script for the center's resources (the PostgreSQL database and roles, the R2 bucket with its lifecycle rules, the Queue), exercised against the acceptance environment and run against production only by AF-PROD-01 with the owner's approval (H-20)" + "The repository provisioning script for the center's resources (the PostgreSQL database and roles, the R2 bucket with its lifecycle rules, the Queue), exercised against the acceptance environment and run against production only by AF-PROD-01 with the owner's approval (H-20)", + "Center mode as explicit configuration (ArcForges-Design AD-0021 section 13a): official-hosted or self-hosted; a missing or invalid mode refuses to start, and official-hosted mode without a valid plan configuration enables no gated feature" ], "out_of_scope": [ "Account, node and MCP endpoints (AF-CTR-03 onward)", @@ -1867,7 +1868,8 @@ "requirements": [ "R-CTR-003", "R-CTR-009", - "R-CTR-014" + "R-CTR-014", + "R-CTR-017" ], "deliverables": [ "Go center binary", @@ -1885,7 +1887,8 @@ "A self-hosted center starts against a local PostgreSQL with a configured base URL, and no official endpoint is compiled into a code path", "The engineering record lists the maintained Go repositories inspected (files and exact commits), the practices adopted and the practices rejected with reasons", "The choice of driver, query and migration tooling is evaluated against the business requirements and recorded with its rejected alternatives", - "External-PR hosted CI runs the Go checks and CodeQL for Go; the required statuses still gate every PR" + "External-PR hosted CI runs the Go checks and CodeQL for Go; the required statuses still gate every PR", + "The center refuses to start without an explicit valid mode; official-hosted mode with missing or invalid plan configuration starts with every gated feature unavailable" ], "verification": { "author": [ @@ -1997,7 +2000,8 @@ "Sessions: cookie sessions with CSRF and Origin checks; native-bearer sessions with refresh rotation and reuse detection that revokes the family; scopes account, mobile.limited, node, push, automation and agent (agent grants issued by AF-CTR-07)", "Step-up; session listing and revocation; DeviceService List, Rename and Revoke, revoking the device's node credential and agent grants", "Center-served pages without external assets and with a strict content security policy: sign-in, passkey registration, bootstrap, sessions and devices", - "Rate limits per IP prefix and account (AD-0011 section 7); audit of sign-in, session and device events" + "Rate limits per IP prefix and account (AD-0011 section 7); audit of sign-in, session and device events", + "Feature availability (ArcForges-Design AD-0021 section 13a): port the entitlement resolver, snapshots and grants from C# to Go and PostgreSQL with parity tests replaying the C# test vectors; the plan catalogue as configuration, with development fixtures (tests and the acceptance environment's attributable test identities) distinct from production settings, which stay unset until the owner decides prices, trials, node limits and traffic allowances (H-07); audited operator grants requiring a HUMAN step-up; official-hosted mode gates center-mediated node connectivity, execution, monitoring and control, and MCP access behind an active subscription entitlement, with no permanent free hosted-node allowance, while sign-in, account, billing, security and recovery stay ungated; self-hosted mode needs no official subscription and applies a built-in default enabling the available self-hostable capabilities, with optional operator-configured feature and resource limits; the gate runs after authentication, device ownership, authorization, AGENT/HUMAN separation and audit, never instead of them" ], "out_of_scope": [ "Recovery, deletion, export and security activity (AF-ID-02)", @@ -2018,7 +2022,8 @@ "R-OPS-001", "R-OPS-002", "R-SEC-002", - "R-CTR-008" + "R-CTR-008", + "R-CTR-017" ], "deliverables": [ "Identity and device endpoints", @@ -2030,7 +2035,10 @@ "Refresh-token reuse revokes the session family (real PostgreSQL)", "Account A's session cannot list, rename or revoke account B's sessions or devices", "mobile.limited sessions are refused for medium and high actions until step-up (T-19)", - "Revoking a device refuses its node credential on the next call" + "Revoking a device refuses its node credential on the next call", + "In official-hosted mode an account without an entitlement signs in and manages its account, security and recovery, and is refused every gated feature; missing or invalid plan configuration enables nothing gated", + "In self-hosted mode the built-in default enables the self-hostable capabilities without any official subscription, and an operator-configured limit is enforced", + "The Go entitlement resolver passes every C# test vector; development fixtures cannot be loaded in production configuration" ], "verification": { "author": [ @@ -2159,7 +2167,7 @@ ], "objective": "Associate a node installation with an account on a configured center through the browser (PKCE loopback) or a device code, keep the node credential in the OS secret store with refresh, and handle revocation.", "scope": [ - "Center: NodeEnrollmentService BeginNodeSignIn, GetNodeSignInFlow, ApproveNodeSignIn, CompleteNodeSignIn, StartDeviceAuthorization, PollDeviceAuthorization, LookupDeviceCode, ApproveDeviceCode, RefreshNodeSession and ReportNodeInfo; fleet schema tables for nodes, sign-in flows and device authorizations; one device and installation per node; center pages /connect and /activate", + "Center: NodeEnrollmentService BeginNodeSignIn, GetNodeSignInFlow, ApproveNodeSignIn, CompleteNodeSignIn, StartDeviceAuthorization, PollDeviceAuthorization, LookupDeviceCode, ApproveDeviceCode, RefreshNodeSession and ReportNodeInfo; fleet schema tables for nodes, sign-in flows and device authorizations; one device and installation per node; enrollment is an account and device operation that needs no subscription, while the node's connectivity is gated (AF-CTR-05); center pages /connect and /activate", "Node: the center setting (official default, overridable, persisted); a CloudLink component storing the node credential through DesktopPlatform Security.Secrets (Windows Credential Manager; Linux Secret Service or the 0600 file reported as FILE_PERMISSIONS_ONLY), refreshing before expiry and turning revocation into the signed-out state; AccountService on the local endpoint (GetAccountStatus, BeginSignIn, GetSignInFlow, CancelSignIn, SignOut)", "CLI: arcforges center set , arcforges login [--device-code], arcforges logout, arcforges account status", "Linux secret-store tests use the isolated backend; real OS secret-store integration only on the isolated host H-23", @@ -2321,7 +2329,7 @@ "objective": "Keep each signed-in node connected to its center over an outbound WebSocket carrying relay.v1 Protobuf frames, and let authorized callers submit, wait for, read the output of, list and cancel tasks on an explicitly selected node through the center, without duplicate execution or silent loss.", "scope": [ "Contracts (additive v1): relay.v1 call and result frames (call ID, deadline, method, payload, ArcError), each call signed by the center with the ES256 command-signing key (key ID, target node, caller principal and origin, command ID, method, request digest, expiry of at most 5 minutes) and each result signed with the node key (AD-0021 section 10); fleet.v1 routed task methods naming node_id and carrying command IDs", - "Center: the node hub (authenticated upgrade with the node credential, one connection per node, heartbeats, backpressure, bounded in-flight calls), routing with deadlines, receipts for idempotency, routing records without specifications or output, audit, node presence; FleetService ListNodes, GetNode, RenameNode and RevokeNode; the Worker passes the node WebSocket upgrade through a registered route with its admission policy", + "Center: the node hub (authenticated upgrade with the node credential, then the feature-availability gate for center-mediated connectivity, one connection per node, heartbeats, backpressure, bounded in-flight calls), routing with deadlines, receipts for idempotency, routing records without specifications or output, audit, node presence; FleetService ListNodes, GetNode, RenameNode and RevokeNode; the Worker passes the node WebSocket upgrade through a registered route with its admission policy", "Node: outbound connection with jittered backoff and credential refresh; verification of the center's signature, target and expiry (±120 s skew) against the center keys received at enrollment and refresh, before policy; dispatch to the existing TaskService with the origin and caller identity the center verified (HUMAN through a client, AGENT through MCP); the local policy for center-routed callers; deduplication by command ID; output by offset", "CLI: arcforges run [--node ] -- through the center (default: this node), tasks, wait, output and cancel through the center; arcforges run --local stays a labelled diagnostic, bounded as AD-0021 section 5 states: the node's local TaskService.SubmitTask accepts ordinary submissions only from local callers of HUMAN origin (AGENT and SCRIPT origins refused), and records such tasks as local-diagnostic", "Failure behaviour of AD-0021 section 11: offline node refusal, center restart, network loss, retry after an uncertain submission, revocation closing the channel" @@ -2354,7 +2362,8 @@ "R-CTR-007", "R-CTR-008", "R-CTR-012", - "R-CTR-013" + "R-CTR-013", + "R-CTR-017" ], "deliverables": [ "Node hub and routing", @@ -2370,7 +2379,8 @@ "The center database holds no command line, environment or output after the suite (inspection test)", "Forged, altered, retargeted or expired calls are refused by the node before any effect, and a call delivered after its expiry is never executed late (T-11)", "A center-routed cancel of a nonterminal ADOPTED task is denied as process.terminate before any stop, leaves the adopted process running and is audited as denied on the real center-to-node path; neither origin, confirmation nor approval overrides the deny (MR-08, carried from AF-CLD-05)", - "A local SubmitTask of AGENT or SCRIPT origin is refused with the documented error; a HUMAN --local submission runs and its task record is marked local-diagnostic" + "A local SubmitTask of AGENT or SCRIPT origin is refused with the documented error; a HUMAN --local submission runs and its task record is marked local-diagnostic", + "In official-hosted mode a caller without an active entitlement is refused the gated operation after authentication and authorization, and the refusal is audited; in self-hosted mode the default applies without any official subscription" ], "verification": { "author": [ @@ -2632,7 +2642,8 @@ "R-CTR-004", "R-CTR-005", "R-CTR-008", - "R-CTR-012" + "R-CTR-012", + "R-CTR-017" ], "deliverables": [ "Center MCP endpoint", @@ -2644,7 +2655,8 @@ "A session survives a dropped connection; a grant scoped to device A cannot reach device B; a revoked grant is refused on the next call", "AGENT callers cannot approve requests or reach HUMAN-only operations", "No tool call exceeds its bounded wait", - "Conformance suites pass for every MCP protocol revision the server supports (at least the current official revision and 2025-11-25), with output schemas validated for every tool" + "Conformance suites pass for every MCP protocol revision the server supports (at least the current official revision and 2025-11-25), with output schemas validated for every tool", + "In official-hosted mode a caller without an active entitlement is refused the gated operation after authentication and authorization, and the refusal is audited; in self-hosted mode the default applies without any official subscription" ], "verification": { "author": [ @@ -2822,7 +2834,7 @@ "objective": "Complete the server migration: port the implemented retained domain logic and the schemas of the flagship modules to the Go center on PostgreSQL, account for every retained-inactive module, inspect and retain the proof D1 data, and retire the C# center's active paths once the exit criteria of AD-0021 section 15 hold.", "scope": [ "Migration inventory: every C#, D1 and Worker behaviour (production, proof, retained), its owner, the Go and PostgreSQL implementation or disposition, transition strategy and evidence", - "Port the entitlement resolver, snapshots and grants with parity tests replaying the C# test vectors; PostgreSQL schemas for entitlement, commerce, notification, support, audit and configuration", + "PostgreSQL schemas for commerce, notification, support, audit and configuration (the entitlement resolver, snapshots and grants are ported by AF-CTR-03)", "Retained-inactive modules (Chat, Task, Agent, Sync, Resource, Search, Scope, PackageCatalog, Policy, Workspace, TrustSafety) and the proof-only harness: recorded disposition, sources kept at the retirement commit as history", "Proof D1 database: row counts and an export through the protected workflow, retained, never deleted", "Remove the C# host from the image and candidate after the exit criteria hold; retire .NET server controls with recorded dispositions; the proof environment runs the Go center as the acceptance environment" @@ -2848,7 +2860,7 @@ ], "acceptance": [ "The inventory has a disposition and evidence for every server behaviour", - "The Go entitlement resolver passes every C# test vector", + "The retained flagship schemas exist on PostgreSQL with their constraints", "The deployed image contains only the Go center; rollback to the previous image is documented with its compatibility conditions", "The proof D1 data is exported, counted and retained", "Proof D1 business rows, if any, are transformed, backfilled and reconciled into PostgreSQL with counts and checksums; otherwise the inspection records that no business rows exist" @@ -5645,7 +5657,7 @@ ], "objective": "On the Go center and PostgreSQL (ArcForges-Design AD-0021): Gate cloud features (remote access and push) with entitlement snapshots and signed tokens that work offline for 14 days; node-local execution never consults entitlements; no price, allowance or limit is decided here (AD-0021 section 13).", "scope": [ - "EntitlementService endpoints (GetSnapshot, Check, ListGrants) and the flagship plan catalogue", + "EntitlementService endpoints (GetSnapshot, Check, ListGrants) over the feature-availability gate and resolver delivered by AF-CTR-03; production plan-catalogue values only from the owner's decisions (H-07)", "RefreshEntitlementToken and GetEntitlementKeys (IssueNodeCertificate stays reserved for roadmap RM-01 and is not served)", "Node-side verification, offline grace, cloud-feature degradation rules and on-demand refresh triggers", "The entitlement-token signing key through the center's key handling (AF-CTR-02)" @@ -5664,7 +5676,8 @@ "requirements": [ "R-CLOUD-001", "R-COM-004", - "R-CTR-008" + "R-CTR-008", + "R-CTR-017" ], "deliverables": [ "Entitlement enforcement" @@ -6311,7 +6324,7 @@ } ], "size": "L", - "notes": "Cloudflare only through repository scripts; workers.dev and previews stay off. Merging deploys dark through the guarded main-push deploy: flagship surfaces stay disabled in production until AF-PROD-01 (Design 10 section 8), so no production prerequisite blocks the merge.", + "notes": "Cloudflare only through repository scripts; workers.dev and previews stay off. Merging deploys dark through the guarded main-push deploy: flagship surfaces stay disabled in production until AF-PROD-01 (Design 10 section 8), so no production prerequisite blocks the merge. Since the owner's decision of 2026-10-28 (ArcForges-Design AD-0021 section 13a) Paddle subscriptions grant the official hosted center's center-mediated services; production sales stay off until H-07's prices, trials, node limits and traffic allowances are decided.", "blocked_by": [], "evidence": { "prs": [], diff --git a/ledger/ledger.jsonl b/ledger/ledger.jsonl index 70bb5fe..3489071 100644 --- a/ledger/ledger.jsonl +++ b/ledger/ledger.jsonl @@ -160,3 +160,4 @@ {"at": "2026-10-28T08:04:57Z", "task": "PLAN", "kind": "plan", "text": "Graph revised for ArcForges-Design AD-0021 (central access through a configured center, a Go center on Neon/PostgreSQL, LAN out of current delivery; Design PR #39): milestone MC added after M3 with AF-CTR-01..AF-CTR-11 (serial; real dependencies only); AF-LAN-01/02/03, AF-CLD-01, AF-CLD-05, AF-ID-01 and AF-MCP-01 superseded with successors named; AF-CLD-04 re-scoped to fleet watch, node telemetry and channel controls on the Go center; AF-PLAT-01, AF-ID-02, AF-CLD-02 (now phone pairing), AF-WEB-01, AF-WEB-02, AF-CLD-03, AF-SUP-01, AF-CLD-06, AF-WEB-03, AF-COM-01, AF-CLD-07, AF-AND-01, AF-AND-02, AF-OPS-01, AF-AI-01, AF-AI-02, AF-WS-01, AF-STOR-01, AF-DIAG-01, AF-DESK-01, AF-DESK-02, AF-ACC-01 and AF-PROD-01 re-targeted with corrected dependencies and the center MCP tools of their node APIs; AR-03 superseded, AR-23 added, H-07 widened to plan contents under center access; roadmap RM-19 (LAN distribution) accepted, EX-28 (per-account Durable Object hub) exploratory, RM-01 and RM-05 dropped. Serial delivery, the single active task, delegation limits, review and merge gates are unchanged. The findings of the independent review of #39/#72 are addressed in this revision."} {"at": "2026-10-28T08:08:10Z", "task": "PLAN", "kind": "note", "text": "Implementation authorized by the user on 2026-10-28: AF-CTR-01, AF-CTR-02, AF-CTR-03, AF-CTR-04, AF-CTR-05, AF-CTR-06, AF-CTR-07, AF-CTR-08, AF-CTR-09, AF-CTR-10, AF-CTR-11 (11 tasks; sequence rows 15–25). Source: the owner's self-contained migration execution prompt of 2026-10-28 (local copy C:\\MyFile\\Projects\\ArcForges\\ArcForges-Claude-Migration.md), which supplies the migration scope instead of pasted rows (ArcForges-Design AD-0021; Plan #72). For this migration only, documentation updates may progress alongside the active implementation task; Plan delivery stays serial (one active task, one delegate at a time, independent review, merge gates unchanged). The prompt does not authorize other backlog or roadmap items."} {"at": "2026-10-28T08:08:10Z", "task": "AF-CTR-01", "kind": "started", "text": "Go contract bindings (Contracts): generation from the single .proto source with pinned protoc-gen-go and protoc-gen-connect-go, drift check, Go/C# fixture compatibility, publication as go/v with the NuGet cohort, Go controls and Dependabot gomod; worktree task/af-ctr-01 from Contracts origin/main 3891c6b."} +{"at": "2026-10-28T09:37:53Z", "task": "PLAN", "kind": "plan", "text": "Owner decision of 2026-10-28 on hosted subscriptions and self-hosted mode (ArcForges-Design AD-0021 §13a): AF-CTR-02 adds the explicit, fail-closed center mode; AF-CTR-03 adds feature availability (entitlement resolver port moved from AF-CTR-09, catalogue configuration with development fixtures distinct from production settings, audited operator grants, official-hosted gates with essential operations ungated, self-hosted built-in default with operator limits); AF-CTR-04, AF-CTR-05 and AF-CTR-07 apply the gate after authentication and authorization; AF-CLD-03 builds its endpoints on it; H-07 partly decided, still open for prices, trials, node limits and traffic allowances; no production sales activated."} From c9d5e6a82f022476c8bc26b43459466416588b8a Mon Sep 17 00:00:00 2001 From: sammiller Date: Wed, 28 Oct 2026 17:50:33 +0800 Subject: [PATCH 2/2] plan: review follow-ups for the subscription and self-hosted decision Bound operator grants (account, features, reason, expiry; no catalogue-wide grants in production), name the feature keys, limit AF-CTR-03's essential-operation acceptance to what it delivers, and add subscription-less acceptance to AF-ID-02 (recovery and account lifecycle), AF-COM-01 (buying a subscription) and AF-CLD-04 (monitoring gate); the lapse rule in AF-CTR-05. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01H6Cf6pFe7uHMuN6zEgDLmW --- delivery-graph.json | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-) diff --git a/delivery-graph.json b/delivery-graph.json index 03a3be8..51c09a6 100644 --- a/delivery-graph.json +++ b/delivery-graph.json @@ -2001,7 +2001,7 @@ "Step-up; session listing and revocation; DeviceService List, Rename and Revoke, revoking the device's node credential and agent grants", "Center-served pages without external assets and with a strict content security policy: sign-in, passkey registration, bootstrap, sessions and devices", "Rate limits per IP prefix and account (AD-0011 section 7); audit of sign-in, session and device events", - "Feature availability (ArcForges-Design AD-0021 section 13a): port the entitlement resolver, snapshots and grants from C# to Go and PostgreSQL with parity tests replaying the C# test vectors; the plan catalogue as configuration, with development fixtures (tests and the acceptance environment's attributable test identities) distinct from production settings, which stay unset until the owner decides prices, trials, node limits and traffic allowances (H-07); audited operator grants requiring a HUMAN step-up; official-hosted mode gates center-mediated node connectivity, execution, monitoring and control, and MCP access behind an active subscription entitlement, with no permanent free hosted-node allowance, while sign-in, account, billing, security and recovery stay ungated; self-hosted mode needs no official subscription and applies a built-in default enabling the available self-hostable capabilities, with optional operator-configured feature and resource limits; the gate runs after authentication, device ownership, authorization, AGENT/HUMAN separation and audit, never instead of them" + "Feature availability (ArcForges-Design AD-0021 section 13a): port the entitlement resolver, snapshots and grants from C# to Go and PostgreSQL with parity tests replaying the C# test vectors; the plan catalogue as configuration, with development fixtures (tests and the acceptance environment's attributable test identities) distinct from production settings, which stay unset until the owner decides prices, trials, node limits and traffic allowances (H-07); audited operator grants requiring a HUMAN step-up, each naming its account, features, reason and expiry, with catalogue-wide or unbounded grants refused in production configuration; the feature keys center.nodes, center.execute, remote.view, remote.control, center.mcp and push (AD-0021 section 13a); official-hosted mode gates center-mediated node connectivity, execution, monitoring and control, and MCP access behind an active subscription entitlement, with no permanent free hosted-node allowance, while sign-in, account, billing, security and recovery stay ungated; self-hosted mode needs no official subscription and applies a built-in default enabling the available self-hostable capabilities, with optional operator-configured feature and resource limits; the gate runs after authentication, device ownership, authorization, AGENT/HUMAN separation and audit, never instead of them" ], "out_of_scope": [ "Recovery, deletion, export and security activity (AF-ID-02)", @@ -2036,9 +2036,10 @@ "Account A's session cannot list, rename or revoke account B's sessions or devices", "mobile.limited sessions are refused for medium and high actions until step-up (T-19)", "Revoking a device refuses its node credential on the next call", - "In official-hosted mode an account without an entitlement signs in and manages its account, security and recovery, and is refused every gated feature; missing or invalid plan configuration enables nothing gated", + "In official-hosted mode an account without an entitlement signs in and manages its sessions, devices and security settings (the essential operations this task delivers), and is refused every gated feature; missing or invalid plan configuration enables nothing gated", "In self-hosted mode the built-in default enables the self-hostable capabilities without any official subscription, and an operator-configured limit is enforced", - "The Go entitlement resolver passes every C# test vector; development fixtures cannot be loaded in production configuration" + "The Go entitlement resolver passes every C# test vector; development fixtures cannot be loaded in production configuration", + "An operator grant without a reason or an expiry, or a catalogue-wide grant in production configuration, is refused and audited" ], "verification": { "author": [ @@ -2329,7 +2330,7 @@ "objective": "Keep each signed-in node connected to its center over an outbound WebSocket carrying relay.v1 Protobuf frames, and let authorized callers submit, wait for, read the output of, list and cancel tasks on an explicitly selected node through the center, without duplicate execution or silent loss.", "scope": [ "Contracts (additive v1): relay.v1 call and result frames (call ID, deadline, method, payload, ArcError), each call signed by the center with the ES256 command-signing key (key ID, target node, caller principal and origin, command ID, method, request digest, expiry of at most 5 minutes) and each result signed with the node key (AD-0021 section 10); fleet.v1 routed task methods naming node_id and carrying command IDs", - "Center: the node hub (authenticated upgrade with the node credential, then the feature-availability gate for center-mediated connectivity, one connection per node, heartbeats, backpressure, bounded in-flight calls), routing with deadlines, receipts for idempotency, routing records without specifications or output, audit, node presence; FleetService ListNodes, GetNode, RenameNode and RevokeNode; the Worker passes the node WebSocket upgrade through a registered route with its admission policy", + "Center: the node hub (authenticated upgrade with the node credential, then the feature-availability gate for center-mediated connectivity (center.nodes; a lapsed subscription closes the connection at the next entitlement check), one connection per node, heartbeats, backpressure, bounded in-flight calls), routing with deadlines, receipts for idempotency, routing records without specifications or output, audit, node presence; FleetService ListNodes, GetNode, RenameNode and RevokeNode; the Worker passes the node WebSocket upgrade through a registered route with its admission policy", "Node: outbound connection with jittered backoff and credential refresh; verification of the center's signature, target and expiry (±120 s skew) against the center keys received at enrollment and refresh, before policy; dispatch to the existing TaskService with the origin and caller identity the center verified (HUMAN through a client, AGENT through MCP); the local policy for center-routed callers; deduplication by command ID; output by offset", "CLI: arcforges run [--node ] -- through the center (default: this node), tasks, wait, output and cancel through the center; arcforges run --local stays a labelled diagnostic, bounded as AD-0021 section 5 states: the node's local TaskService.SubmitTask accepts ordinary submissions only from local callers of HUMAN origin (AGENT and SCRIPT origins refused), and records such tasks as local-diagnostic", "Failure behaviour of AD-0021 section 11: offline node refusal, center restart, network loss, retry after an uncertain submission, revocation closing the channel" @@ -5394,7 +5395,8 @@ "requirements": [ "R-OPS-001", "R-OPS-004", - "R-AUTH-004" + "R-AUTH-004", + "R-CTR-017" ], "deliverables": [ "Account lifecycle" @@ -5402,7 +5404,8 @@ "acceptance": [ "Deletion purges every table on the retention schedule", "Device revocation cascades", - "Export contains the account's data" + "Export contains the account's data", + "In official-hosted mode recovery, deletion, export and security activity are available to an account without a subscription (R-CTR-017)" ], "verification": { "author": [ @@ -5915,7 +5918,8 @@ "R-OPS-002", "R-OPS-003", "R-COM-003", - "R-CLOUD-007" + "R-CLOUD-007", + "R-CTR-017" ], "deliverables": [ "Relay" @@ -5924,7 +5928,8 @@ "Closed loop against a local Go center with a real node: snapshot, deltas, resume, reset, grant refresh, close codes", "No command lines or output leave the node by default", "A kill switch degrades to summaries; ladder step 2 closes existing connections with 4429 and nodes back off", - "Summaries carry every field the node knows that W-40, W-41 and A-03 to A-05 show; information no client reports is labelled unknown (R-CLOUD-007)" + "Summaries carry every field the node knows that W-40, W-41 and A-03 to A-05 show; information no client reports is labelled unknown (R-CLOUD-007)", + "In official-hosted mode monitoring is gated by remote.view after authentication and authorization, and self-hosted mode applies its default (R-CTR-017)" ], "verification": { "author": [ @@ -6280,7 +6285,8 @@ "docs/decisions/AD-0021-central-access-go-center.md" ], "requirements": [ - "R-COM-001" + "R-COM-001", + "R-CTR-017" ], "deliverables": [ "Web commerce" @@ -6288,7 +6294,8 @@ "acceptance": [ "FakePaddle closed loops for every lifecycle state, including payment failure and refund", "Webhook replays are deduplicated", - "sales_open=false shows Coming soon" + "sales_open=false shows Coming soon", + "In official-hosted mode an account without a subscription can read the catalogue, start a checkout and manage billing (R-CTR-017)" ], "verification": { "author": [