sockets: a socket is a name bound to a program, apart from spaces

[losfair]

Rationale

A socket was a file: the activated <space>/<path> was at once the program's location, the socket's name, and (because it sat under f:<space>/) its authorization boundary. One eBPF object serving two sockets meant two copies at two paths, each deployed separately.

This change separates the three. A program is an ordinary file in a space. A socket is a name in a namespace of this node's own, bound by a local activation to a program path, carrying its own --scope, --config, --max-streams, note, map and statistics. Many sockets may name one program.

synch socket activate git      --program code/bin/gateway.o --scope code --config upstream=git.internal
synch socket activate docs/git --program code/bin/gateway.o --scope docs
synch socket connect nas@cluster.example.com:git
synch socket ls nas@cluster.example.com:

The design is docs/SOCKET-PROGRAMS.md (status now implemented); docs/SOCKETS.md §2–§4, §9–§11 and docs/TREE-WRITES.md §2 are amended to describe the built thing.

What changes

• Nothing socket-shaped enters the tree. The scanner no longer consults the activation table and never emits EntryKind::Socket; the variant stays so old records decode, and every reader treats it as a file with content. The verified Lean core is untouched.
• Scope replaces authorization by position. A rooted member may open any socket; a delegate only one whose scope names a space it holds. Default is members only. New RefuseCode::OutOfScope, appended; SpaceNotDelegated stays for variant numbering, no longer emitted.
• Wire frames change in place under sync/sock/1 (no version bump, per discussion): the first frame is SockRequest { Open, List }, SockOpen carries socket: String, SockOpened::Ok gains program_path, and List answers with the in-scope sockets so synch socket ls <origin>: gives the discovery synch ls used to. An un-upgraded peer fails at the frame decode, before any policy runs.
• Deployment fan-out. A content change at a program path clears every dependent socket's map and logs once per socket, from the scanner and from API-source commits.
• The tree-write refusal for activated paths is removed with no replacement. A program's sy_put_* write to a program path is a deployment like any other write. activate and ls -l instead show which activated program's manifest carries a tree-write grant covering the path.
• Store migration v29 drops every existing activation and creates the new socket_activations (name PK, program_space, program_path, scope, config, max_streams, note, activated_at) empty. A name and a scope are grants; the migration does not infer them from a path. One warn line per dropped row names the synch socket activate <name> --program <space>/<path> that serves the program again. Every old <space>/<path> spelling is a legal name, so the old address can be restored by hand.
• Control protocol v6: SocketActivate { target: name, program, scope }, name-addressed deactivate/ps/log, SocketLs.origin for the remote form. synch_socket_* MCP tools follow; a --space-confined MCP server is refused for name-addressed socket tools and scoped to the program's space for activate.
• Bound: 256 activations per node replaces 64 per space. Sockets can now be activated over API-only sources.

Judgment calls worth a look: members-only default for scope; List includes in-scope sockets whose program is unpublished (empty root, printed unpublished); NotASocket is kept for a directory/symlink at a program path.

Commands run

cargo fmt --all --check
cargo clippy --workspace --all-targets -- -D warnings
cargo test -p synch-core -p synch-store -p synch-net -p synch-sock
cargo test -p synch-engine --test sockets --test tree_writes
cargo test -p synch-cli

All green (store 305, net 65, sock 99 + 36 invoke + 17 examples, engine sockets 20 + tree_writes 5, cli 81 + 8 + 30 + 16). The engine stress suite and ignored synch-mpt tests were not run.

Platform and migration impact

• Databases migrate automatically at open (v29). Every existing socket activation is dropped; the daemon log names each one with the command to re-activate it. Operators must re-activate their sockets, choosing a name and a scope.
• Peers must upgrade before activating: an old caller's Open no longer decodes on a new callee and vice versa.
• Control clients and daemons on different sides of v6 refuse each other.
• apps/Hecatia had only registry strings and a comment updated; it was not built here (no Swift toolchain).

🤖 Generated with Claude Code

https://claude.ai/code/session_01RDXGRrMsUDV32dJwaV8xqc