canister coord://offchain/genie/program/coord_sign@v1/188e4074dcde5e5f · v1 · artifact root 0x188e4074dcde5e5fe55874c94ab3af4d6cd510a4d84eb6b55194d5d117c74917 · previous none (first version) · superroot at publish not sealed yet
sealed cases that reached it: 0 — sealed cases that reached this word (the store counts, never reads)
coord sign (a .genie program) in the studio: 14 symptoms, 12 fixes
// _COORD_SIGN_v1_ (owner 2026-10-27: "one signer queue with full trace and monitoring for all the signatures that need to go out; then 116 // only coord streams those — coord sign vs coord stream"). The three machines of the off-box signer (docs/ONE-VAULT.md Part IV): one sign request // from received to its one end, a requester (a box unit, a tenant vault, a user) from registered to retired, and a signing vault (one // purpose's key) from enrolled to retired. The runtime (taifoon-agents coord-sign/, a Lambda in mbp eu-central-1) measures the facts — // the admission verdict, the purpose's rules, the mode, the hold, the ack — and walks THESE machines: from each state the first move whose // `when` holds is taken, so the order of the moves is their precedence. Every number (budgets, holds, ttl, caps) is lang/gen/sign.json's. // Only the `checked -> signed` move signs, behind its guards, as the signer role; nothing on box 116 can take it. genie coord_sign v1 about "The off-box signer: every signature asked by box 116 is admitted, checked against its purpose's rules, signed or refused, delivered on the pipe and traced" use product coord.sign use guard sign-admitted sign-known-requester sign-fresh sign-rules sign-armed sign-owner-go owner-arm agent sign_request is "one signature asked of the off-box signer, from received to its one end" states received admitted throttled checked held refused shadowed released delivered acked lost expired start received final acked refused throttled shadowed expired failed refused throttled expired on lane coord-sign read GET /v1/pipe/inbox/:who as inbox // admission first: a flood is bounded before any rule runs and before KMS is asked (budgets, probation, the shield) move received -> throttled when admission.ok == false move received -> admitted guard sign-admitted sign-known-requester sign-fresh effect read // the mode, then the purpose's rules (its fence), from the signer's own state and the chain move admitted -> refused when sign.mode in "killed,enrolled,retired" move admitted -> refused when rules.ok == false move admitted -> checked guard sign-rules effect read // a hold (probation's first of a kind, a destination hold) waits; shadow decides and never signs move checked -> held when hold.active == true move checked -> shadowed when sign.mode == "shadow" move checked -> refused when sign.mode in "killed,enrolled,retired" move checked -> refused when rules.ok == false move checked -> refused when kms.failed == true move checked -> released act signer signs kms GenerateMac(bytes) Sign(bytes32) guard sign-armed sign-rules sign-known-requester effect act meter coord.sign move held -> expired when ttl.left <= 0 move held -> checked when hold.active == false guard sign-rules // the result goes back on the pipe into the requester's inbox; an unacked result is re-sent once move released -> delivered when sent == true op POST /v1/pipe/send effect record move delivered -> acked when ack.seen == true move delivered -> lost when ack.late == true move lost -> delivered when resend.done == true op POST /v1/pipe/send effect record move lost -> expired when sends >= 2 refuse no_facts "a request is walked with its facts (admission.ok, mode, rules.ok, hold.active, kms.failed, ttl.left, sent, ack.seen, ack.late, resend.done, sends)" say received "A sign request arrived in the signer's inbox" say admitted "Admitted: a known requester inside its budgets, signed by its request key, fresh" say throttled "Throttled: a budget, the shield or a lockout refused it before any rule ran" say checked "Checked: every rule of the purpose passed, from the signer's own state" say held "Held: a hold applies; the rules are checked again when it ends" say refused "Refused: the mode, a rule or KMS refused it; the guard is named" say shadowed "Shadowed: the purpose is in shadow; it would have been signed, and was not" say released "Signed by KMS as the signer role" say delivered "The result is in the requester's inbox" say acked "The requester acked the result" say lost "No ack within the ttl; the result is re-sent once" say expired "Expired: the ttl passed before the end" next received admitted "The admission layers run in the register's order; the first that refuses names the code" next admitted checked "The purpose's rules are its fence; a rule that cannot be checked off the box is attribution only" next checked released "Only an armed purpose signs; shadow decides and traces" agent requester is "a box unit, a tenant vault or a user that may ask the signer, from registered to retired" states registered probation active suspended retired start registered final retired on event sign.admitted move * -> retired when register.dropped == true guard owner-arm move registered -> probation when requests.admitted > 0 move probation -> suspended when lockout.s >= lockout.max_s move probation -> active when age.days >= probation.days and refusals.rule == 0 move active -> suspended when lockout.s >= lockout.max_s move suspended -> probation when owner.reinstated == true guard owner-arm refuse no_facts "a requester is walked with its facts (register.dropped, requests.admitted, lockout.s, age.days, refusals.rule, owner.reinstated)" say registered "Registered: the register names it, it has not asked yet" say probation "Probation: a tenth of its purpose's budget, its first request of each purpose held" say active "Active: its full budget; admitted under the shield" say suspended "Suspended: a lockout reached its maximum; the owner reinstates it" say retired "Retired by the register" next registered probation "Its first admitted request starts probation" next probation active "Seven days with no rule refusal and it graduates" next suspended probation "The owner reinstates it into probation, never straight to active" agent signing_vault is "one purpose's signing key at the signer, from enrolled to retired" states enrolled shadow armed killed retired start enrolled final retired on event sign.mode move enrolled -> shadow when owner.mode in "shadow,armed" move shadow -> killed when kill == true move armed -> killed when kill == true move shadow -> armed when owner.mode == "armed" guard owner-arm sign-owner-go move armed -> shadow when owner.mode == "shadow" guard owner-arm move killed -> shadow when kill == false and owner.mode == "shadow" guard owner-arm move shadow -> retired when register.dropped == true guard owner-arm move killed -> retired when register.dropped == true guard owner-arm refuse no_facts "a signing vault is walked with its facts (owner.mode, kill, register.dropped)" say enrolled "Enrolled: in the register, not deployed" say shadow "Shadow: requests are decided and traced, never signed" say armed "Armed: the purpose signs what its rules admit" say killed "Killed: nothing is signed; the role's tag for the purpose is stripped" say retired "Retired by the register" next shadow armed "The owner arms it; a money purpose needs the owner's go in the register" next killed shadow "A kill lifts into shadow, never straight to armed" knowledge symptom "a sign request is throttled" caused_by "a budget of the requester, the purpose or the whole signer is spent, or the purpose is shielded" fixed_by "wait for the bucket to refill; a requester in probation has a tenth of the budget for seven days" symptom "a checkpoint is refused by sign-extends-only" caused_by "the records do not hash forward from the signer's stored head: a fork, a rollback or a gap" fixed_by "nothing on the box can fix it: the owner reads the trace and the ledger; it pages at once" symptom "a request ends shadowed" caused_by "the purpose is in shadow" fixed_by "the owner arms it with deploy.sh mode <purpose> armed" policy "box 116 holds no AWS credential for signing; it streams sign requests and the off-box signer decides" policy "a money purpose is armed only with the owner's go recorded in the register"