id: design: server-side invariants — tick/session/gas/disk bounds, budget observability, platform exploit resistance

Part of the worlds design program: #5955. Statements S24–S27 of the 2026-11-04 brief.

Requirement (Drew, in substance)

Our side of the bargain is narrow, and it is the whole safety story:

Ticks, sessions, or gas stay below a certain amount. Budgets are platform-enforced, not author-promised.
The platform side is solid — it can't be exploited to do more than it's meant to. The capability ceiling is a security boundary, not a convention.
Users are aware of what could be done. Awareness (registry listing, permission prompts) is a load-bearing part of the model, not decoration.
Within those bounds — disk size and the rest — users can pull whatever libraries they want. No additional gatekeeping is implied by this design.

Design points to settle

The budget vocabulary: per-tick gas, per-session totals, per-world aggregate, disk quota per world / per user / per library cache. Which are hard kills, which are throttles, which are bills (see the compile-economics child of #5955)?
Observability: what does a world author / server admin see when a budget trips — and what does the user whose function tripped it see? (The brief's program framing names observability as a first-class axis.)
Exploit-resistance review surface: enumerate the platform functions as an attack surface; for each, what bounds it (path sandboxing, network egress rules, allocation limits). This is the checklist the "can't be exploited" claim will be audited against.
Failure containment: a world that blows its budget must not degrade co-resident worlds on the same server.

Done looks like

A design doc: the budget set with enforcement semantics, the observability surface for each budget, and the platform attack-surface checklist.

CODE-1628

Ruling — C2 capability posture, server-invariant implications (Drew, 2026-11-04 23:57 CST; primary record on #5958).

Correction to the program's earlier working interpretation: the brief does not supersede the shipped default. The completely isolated seccomp policy (no fs open, no sockets) remains the default and is a standing invariant for server design.

What changes is additive: an opt-in file+network capability tier is to be investigated/built, with these invariant-level constraints — capabilities off by default on servers; publishing of worlds using them is first-party only for now; the mechanism must be built so it could be enabled for anyone later, with general enablement gated on testing and refining how the platform wrangles and controls such capabilities. Invariant/bounds design here should cover containment for that tier when enabled, without weakening the default isolation.

🤖 Agent note · triaged — task 10331 (queue repo-health-code-pilot, lane code-f)

Scope verdict: this is a design-doc deliverable, not a code fix. id: design: server-side invariants — tick/session/gas/disk bounds, budget observability, platform exploit resistance #5962 (statements S24–S27 of the 2026-11-04 brief, child of program id: design program: worlds — advanced Roc libraries, capabilities, permissions, dynamic user functions, licensing (2026-11-04 brief) #5955) asks for a design doc: the budget set with enforcement semantics, the observability surface per budget, and the platform attack-surface checklist. Its four design points (budget vocabulary, observability, exploit-resistance surface, failure containment) are genuinely unsettled in the body — there is nothing to reproduce or patch yet.
Verified fresh at main 04f78696abfbdf6567f58e623d80520436f002fa (2026-11-05, this triage): the implementation surface the doc must ground in exists — pkgs/id/src/sandbox.rs (108,450 bytes) and pkgs/id/crates/id-core/src/world_caps.rs (79,834 bytes). No PR referencing id: design: server-side invariants — tick/session/gas/disk bounds, budget observability, platform exploit resistance #5962 exists (fresh PR search, all states). No held / user/owned / do-not-merge / do-not-auto-edit labels.
Binding input already on record: Drew's C2 capability-posture ruling (2026-11-04 23:57 CST, commented on this issue, primary record on id: design: capability model — requested vs discovered-used sets, registry listing, custom-compiled platforms #5958) — the completely isolated seccomp policy (no fs open, no sockets) remains the default and a standing invariant; any file+network tier is opt-in, off by default on servers, first-party-publishing only for now, and general enablement is gated on testing/refining capability control. The budget/invariant doc must treat the isolated default as an invariant to preserve, not an open question.
Ordering / dependencies: parent program id: design program: worlds — advanced Roc libraries, capabilities, permissions, dynamic user functions, licensing (2026-11-04 brief) #5955 is OPEN and actively claimed (queue/claimed, work/assigned at this check). Adjacent inputs: capability model id: design: capability model — requested vs discovered-used sets, registry listing, custom-compiled platforms #5958 (OPEN, carries the ruling's primary record), writer-set authority id: implement Writer-set view projection - view projection and discovery query (design doc) #5545, and the per-function gas/timeout research child of id: design program: worlds — advanced Roc libraries, capabilities, permissions, dynamic user functions, licensing (2026-11-04 brief) #5955 (its numbers feed the per-tick gas / per-session budget vocabulary — the doc's budget table should cite that research rather than invent values).
Next action (named, per the design rule): a design-authoring pass on this issue producing the doc in the issue's "Done looks like" shape — (1) budget set (per-tick gas, per-session totals, per-world aggregate, disk quotas) each classified hard-kill / throttle / bill with enforcement point in sandbox.rs / world_caps.rs terms, (2) observability surface for author, admin, and the user whose function tripped a budget, (3) attack-surface checklist enumerating platform functions with their bounds. This is design work, not a small_fix — no fix packet was enqueued from this triage, because a small_fix packet for an unwritten design would be a packet defect. The issue stays open as the design's home.

design(id): server-side invariants for #5962

Navigation Menu

Repository navigation

id: design: server-side invariants — tick/session/gas/disk bounds, budget observability, platform exploit resistance #5962

Requirement (Drew, in substance)

Design points to settle

Related

Done looks like

99 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

id: design: server-side invariants — tick/session/gas/disk bounds, budget observability, platform exploit resistance #5962

Description

Requirement (Drew, in substance)

Design points to settle

Related

Done looks like

Activity

developing-today commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

99 remaining items

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions