loom/externals
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

the lock holds visibility, and it says public or not-public

Browse Source 
The field shipped in loomctl, so this document was describing a three-column
format that no longer exists.

Access is checked once at fetch and the copy is durable, so an adoption's
legitimacy rested on the relative visibility of two repositories — a fact
recorded nowhere and changeable by a checkbox a year later by somebody who never
saw the adoption.

The design is loom-cli's. Record public or not-public and never private, because
an anonymous request cannot tell two repositories private to different people
apart, and that is exactly the case where private into private widens access.
One request per run rather than per document, since only your own visibility must
be current. Re-check a source only when the alarm would fire, since a stored
visibility decays in both directions.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
jeffry
2026-09-08 09:51:49 -04:00
co-authored by Claude Opus 5
parent 544f895920
commit 9f46b4652a
2 changed files with 58 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.loom/published/externals.md
+21
View File
@@ -62,6 +62,7 @@ what to decide are not.**
- **where it was fetched from** — *resolved, as above*
- **the publisher's `ETag`** — *verbatim*
- **the visibility the source could be read at, when it was fetched**
**It is committed**, because the thing it locks is committed, and *a lock that
travels separately from what it locks is the drift this is meant to prevent.*
@@ -71,6 +72,26 @@ travels separately from what it locks is the drift this is meant to prevent.*
> asserts your copy is the one being served, which is the thing you were going to
> check.
### Why visibility is in the lock and not left to the moment
**Access is checked once and the copy is durable.** *A token gets you the read;
nothing revisits it afterwards.* **So the adoption's legitimacy rests on the
relative visibility of two repositories — and that is changeable by a checkbox, a
year later, by somebody who never saw the adoption.**
> **Record `public` or `not-public`. Never `private`.** *An anonymous request can
> tell you a repository is not public. It cannot tell two repositories private to
> **different people** apart* — **which is exactly the case where private into
> private genuinely widens access.** *Record the word you can verify.*
**Checking it costs one request per run, not one per document**, *because the only
thing that must be current is **your own** visibility.* **Re-check a source only
when the alarm would fire** — *you are public, it was recorded not-public* — *and
if it has since gone public, update the lock and say nothing.*
*A stored visibility decays in both directions, which is why the alarm re-checks
rather than trusting the record.*
## Freshness is a conditional request
**Locked on the publisher's `ETag`, verbatim — never a hash you compute.** *A