design: faithful sessions & network subsystems (LOGINOUT consolidation + DECnet NETACP) [rd vms-515] - #1068
Closed
baron-3dl wants to merge 1 commit into
Closed
design: faithful sessions & network subsystems (LOGINOUT consolidation + DECnet NETACP) [rd vms-515]#1068baron-3dl wants to merge 1 commit into
baron-3dl wants to merge 1 commit into
Conversation
…n + DECnet NETACP) The ratified design record (rd vms-515; roadmap epics vms-43b login-consolidation + vms-ec9 DECnet-NETACP), from a 4-disposition adversarial-design forum grounded in code. Course-corrects two faithfulness findings an operator-caught login LARP exposed: - ONE authenticator: LOGINOUT.EXE, reached by every path (console/SSH/SET HOST) via $CREPRC — no Linux fork/execl/pty above the VMS layer; LOGINOUT installed with privilege so it re-personas post-auth (dissolving the "network daemon must forge identity" attack). Kills vmssshd's C reimplementation + the CTERM no-auth hole. Net code reduction. - DECnet reframed to NETACP (a privileged DETACHED process, NOT kernel-resident) + an executive device/dispatch face (_NET:/EWA0:/RTAn:/object-table, $GETDVI- visible), the userspace wire engine (PR #1057 codecs) demoted to its datalink per vms-a1c. Faithful line drawn at the device face, not the wire. - RTAn:/TNAn:/FTAn: as real-but-cheap executive terminal devices (OPA0:-shape), not a new QIO subsystem. Carries the 9 adversary attacks → disposition, the 5 executive-substance ratification gates (incl. the anti-LARP tell: $GETDVI RTA0: cross-process or it is a LARP), the P0 clean-room oracle-capture prerequisite, and the P0-P5 phased plan for /swarm-plan decomposition. Doc only — no product code. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T4csyFSMUsS8k1D2MgMxk2
Contributor
Author
|
Superseded by #1248 (work/vms-515-design-ratified). The DECnet lane — subsystem authority — reconciled this design record against the live NETACP implementation and ruled it NOT obsolete but GOVERNING: the architecture (NETACP as privileged RUN/DETACHED $CREPRC, network-object-table dispatch, PR#1057 codecs demoted to NETACP datalink, A2/A8 wire-isolation dispositions) matches how NETACP was actually built and is now largely implemented on main. Landing #1068 verbatim was wrong only because its 2026-09-02 'hold all code / PR#1057 held' framing is now false (the code landed). #1248 preserves the original 213 lines verbatim + a corrected status + a §8 implementation map tying each design element to its landed code. Closing this in favor of #1248. |
baron-3dl
added a commit
that referenced
this pull request
Sep 15, 2026
…reality (#1248) Freshens PR #1068's clean-room design record (Faithful Sessions & Network Subsystems — LOGINOUT consolidation + DECnet NETACP) onto current main and reconciles it: the 2026-09-02 draft was written as a ratify-before-coding target with all code held, but the DECnet lane has since BUILT the subsystem to this design and it is on main. Landing it verbatim would ship a stale "hold all code / PR #1057 held" framing that is now false. Preserves the original 213-line record verbatim (the governing architecture, the §4 A2/A8 dispositions, the §7 ratification gates) and adds: - a corrected Status header (RATIFIED BY IMPLEMENTATION, reconciled 2026-09-15); - a note on the superseded draft blockquote; - §8, an implementation map tying each design element to the landed code: $CREPRC-LOGINOUT session primitive, RTAn: executive device (P2), the _NET: device face + object table (§3.3), wire-parse isolation A2/A8 (decnet$wire-isolation), SSH->$CREPRC(LOGINOUT) (#1229), the CTERM credential decoder + object-42 auth (P4), the oracle-pinned CTERM semantics (A4/A9), and the a1-0/a1-1 + a1-2 broker (rd vms-22c) as the ACP-served _NET: $QIO transport the record left for later (extends, does not contradict, §3.2). Supersedes PR #1068 (its branch is 179 behind and carries the stale framing). rd vms-515. Claude-Session: https://claude.ai/code/session_01M6uDPQagdhE9HJNM8mNctk Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The ratified design record for the "faithful sessions & network subsystems" reframe (rd vms-515; roadmap epics vms-43b login-consolidation + vms-ec9 DECnet-NETACP). Doc only — no product code. Produced by a 4-disposition adversarial-design forum (adversary/creative/systems/purist), grounded in the actual code.
Origin: an operator-caught login LARP (a broken
vmsdcl --logindefault) exposed that OVMX has no single VMS-authentic login subsystem, and that "decnetd" drifted into a Linux daemon.Core of the design:
$CREPRC. Nofork/execl/ptyabove the VMS layer (the operator's ruling); LOGINOUT installed with privilege so it re-personas post-auth, which also dissolves the adversary's worst attack (a network daemon needing to forge identity). Kills vmssshd's C reimplementation + the CTERM no-auth hole. Net code reduction._NET:/EWA0:/RTAn:/object-table,$GETDVI-visible), the userspace wire engine (PR DECnet Phase IV lane: live NSP link + NCP config + CTERM $SET HOST + first real-VAX adjacency #1057 codecs) demoted to its datalink per vms-a1c. Faithful line at the device face, not the wire.Includes the 9 adversary attacks → dispositions, the 5 executive-substance ratification gates (incl. the anti-LARP tell:
$GETDVI RTA0:cross-process or it's a LARP), the P0 clean-room oracle-capture prerequisite (real VAX↔VAX SET HOST), and the P0–P5 phased plan for/swarm-plandecomposition — to be reconciled with the existing login/loginout branches, not duplicated.🤖 Generated with Claude Code