Skip to content

docs(blueprint): correct four statements made stale by later rules #172

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
justinmerrell merged 1 commit into from
Oct 4, 2026
Merged

docs(blueprint): correct four statements made stale by later rules #172

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 11 additions & 10 deletions specifications/blueprint/v1/spec.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -805,6 +805,11 @@ many bindings name it, at `/spec/parameters/<name>/from` in the `parameters`
stage of the `resolution` phase, and an unavailable variable is deferred there
under this rule. No network lookup occurs during semantic validation.

A parameter carrying `from` or `hash`, like a generated one, is never
submitted. A submitted value for any of them is `ERR_PARAMETER_NOT_SUBMITTABLE` at
`/spec/parameters/<name>`, in the `resolution` phase. A connection is replaced
whole through acquisition instead ([§5.3](#atomic-connections)).

<a id="BP-PARAM-011"></a>**`BP-PARAM-011`**: A parameter whose `from` is in the
`deployment` namespace takes one fact about the person who created the
installation. The namespace defines exactly three paths, and any other is
Expand All @@ -827,11 +832,6 @@ anchor at `/spec/parameters/<name>/from` in the `parameters` stage of the
`resolution` phase, and a malformed fact is `ERR_INVALID_RESOLUTION_CONTEXT`
there.

A parameter carrying `from` or `hash`, like a generated one, is never
submitted. A submitted value for any of them is `ERR_PARAMETER_NOT_SUBMITTABLE` at
`/spec/parameters/<name>`, in the `resolution` phase. A connection is replaced
whole through acquisition instead ([§5.3](#atomic-connections)).

<a id="BP-RESOLVE-001"></a>**`BP-RESOLVE-001`**: Resolution completes these steps
before any workload starts: validate pinned contracts; select compute, storage
and exposure; allocate endpoint addresses; obtain submitted values, variables,
Expand Down Expand Up @@ -975,8 +975,8 @@ are released on incomplete or invalid resolution, including when only one of
several connection parameters fails.

Acquisition distinguishes NOT_ACQUIRED (INCOMPLETE), authoritative NOT_FOUND
(ERR_CONNECTION_NOT_FOUND), DENIED (ERR_CONNECTION_DENIED), INCOMPATIBLE
(ERR_CONNECTION_INCOMPATIBLE), and SELECTED. The synthetic context represents a
(`ERR_CONNECTION_NOT_FOUND`), DENIED (`ERR_CONNECTION_DENIED`), INCOMPATIBLE
(`ERR_CONNECTION_INCOMPATIBLE`), and SELECTED. The synthetic context represents a
SELECTED result with persisted: true and a selection containing identity,
version, installation, parameter, source reference/identity/version, kind
MANAGED or USER, costOwner, credential identity/rotation/value/permittedBaseURLs,
Expand All @@ -988,7 +988,7 @@ model and capabilities. Endpoints are absolute HTTPS URLs without user
information, query or fragment. Every view URL must belong to the credential's
permittedBaseURLs. Context is trusted acquisition evidence, not an authored
mechanism for granting permission. Offline evaluation performs no network or
credential issuance. Malformed evidence is ERR_INVALID_RESOLUTION_CONTEXT.
credential issuance. Malformed evidence is `ERR_INVALID_RESOLUTION_CONTEXT`.

<a id="BP-CONNECTION-003"></a>**`BP-CONNECTION-003`**: Persist the complete selection
and scoped credential before materialization. Retry and redeploy reuse the selected
Expand Down Expand Up @@ -1091,7 +1091,7 @@ Core and component diagnostics apply, with these additions:
| `ERR_MISSING_PARAMETER_VALUE` | `resolution` | Required submitted value is absent. |
| `ERR_VARIABLE_NOT_AUTHORIZED` | `resolution` | Installation cannot read the organization variable. |
| `ERR_DEPLOYMENT_FACT_UNAVAILABLE` | `resolution` | The platform knows it has no value for a deployment fact the installation reads. |
| `ERR_INVALID_RESOLUTION_CONTEXT` | `resolution` | Resolution context lacks a required identity or version. |
| `ERR_INVALID_RESOLUTION_CONTEXT` | `resolution` | Resolution context is malformed, or lacks a required identity or version. |
| `ERR_CONNECTION_NOT_FOUND` | `resolution` | Authorized acquisition confirms no selected default exists. |
| `ERR_CONNECTION_DENIED` | `resolution` | Acquisition denies permission to use the connection. |
| `ERR_CONNECTION_INCOMPATIBLE` | `resolution` | Selection cannot satisfy required protocol or capabilities. |
Expand Down Expand Up @@ -1125,7 +1125,8 @@ and cannot appear in diagnostics or exported resolution records.
A `PUBLIC` endpoint whose access is `OPEN` is reachable by anyone with its
address, and an identity header on one would be whatever the caller wrote. That
is why a component that reads the viewer identity properties cannot be deployed
without `viewerIdentity: HEADER` ([`BP-NODE-007`](#BP-NODE-007)), and why the
without the `viewerIdentity` mode those properties belong to
([`BP-NODE-007`](#BP-NODE-007)), and why the
platform refuses, rather than forwards, a request it cannot authorize
([`BP-ACCESS-002`](#BP-ACCESS-002)).

Expand Down
Loading