Step Thirteen — Freeze windows, compat vows

We add the next layer of ritual. The phone‑native gateway now quarantines breaking schema changes, enforces compatibility vows in the client token, and signs the schema manifest so you can publish it publicly but verify it locally. Contracts, not hope.

✅ Fresh artifacts

solveforce_phone_thirteen.py — Download
SHA‑256: bb7312492e1a688786c436acf0bd28f113bd110c25be40e28bcbd72df1097098
Schema policy example — Download
SHA‑256: 11e32153ba7b3044649c497887953282196ca84a1447c3674c6f945fd91191d1

This file layers on top of Step Twelve. You can run Twelve and Thirteen side‑by‑side on different ports to compare.

What’s new (precise and enforceable)

Schema freeze windows: none | notify | quarantine

When the gateway detects a breaking diff for a plugin, it starts a freeze window.
notify: emits schema_frozen events but does not block reads.
quarantine: blocks reads/history/SSE for that plugin with 423 Locked until the window expires or an admin unfreezes.
Configure globally via CLI or per‑plugin with a file.

CLI flags

--schema-freeze-mode quarantine        # none|notify|quarantine
--schema-freeze-sec 3600               # default duration (seconds)
--schema-policy-file /sdcard/solveforce/solveforce_schema_policy_example.json

Example policy JSON

{
  "freeze_mode": "quarantine",
  "freeze_sec_default": 3600,
  "plugins": { "battery": { "freeze_sec": 900 }, "net": { "freeze_sec": 1800 } }
}

Admin controls

# Unfreeze all (GET or POST):
/admin/unfreeze?plugin=all&token=ADMIN123

# Unfreeze one:
 /admin/unfreeze?plugin=battery&token=ADMIN123

# Manually freeze a plugin for N seconds:
 /admin/freeze?plugin=net&sec=600&token=ADMIN123

New endpoints:

GET /schema_freeze → current freeze config and state.

SSE signals:

event: schema_frozen when a freeze starts.
event: schema_frozen (notice) sent if an event would have streamed but was blocked.

Metrics:

solveforce_schema_freeze_events_total{plugin}
solveforce_schema_freeze_blocks_total{plugin}

2) Compat vows in tokens: `schema_compat = any | additive_only`

Tokens can now declare they will only cross additive transitions.

If a plugin’s latest change was breaking, and the client tries to ACK by pinning the new signature, the gateway rejects with 412 Precondition Failed:

{
  "error": "compat_block",
  "plugin": "battery",
  "compat": "breaking",
  "advice": "request a token with schema_compat=any or wait for compatible schema"
}

Add to mint:

GET /admin/mint?token=ADMIN123&sub=reader&roles=reader&dur=86400 \
    &schema_mode=ack&schema_compat=additive_only

Metric:

solveforce_schema_compat_blocks_total{plugin}

3) Signed schema manifest (`/schema_signed`)

Publish your schema inventory, but make it tamper‑evident.

Supply a secret file (random bytes) to sign with HMAC‑SHA256:

head -c 32 /dev/urandom > /sdcard/solveforce/schema.key
python solveforce_phone_thirteen.py ... \
  --schema-signing-secret-file /sdcard/solveforce/schema.key

Fetch:

GET /schema_signed
{
  "ts": "2025-08-19T12:34:56Z",
  "alg": "HS256",
  "kid": "<first16of-sha256-secret>",
  "manifest": { "battery": { "sig": "..." }, "net": { "sig": "..." } },
  "sig": "<base64url(hmac_sha256(payload))>"
}

Verification sketch (pseudo):

payload = {"ts": ts, "alg": "HS256", "manifest": manifest}
canon = json.dumps(payload, sort_keys=True, separators=(",",":")).encode()
calc  = hmac.new(secret, canon, hashlib.sha256).digest()
assert b64url(calc) == sig

If you omit the secret, the endpoint returns "alg":"none" (unsigned) so you can still automate pin distribution in dev.

Interplay of the gates (truth table)

When you call /read or /history or consume /events, the gateway checks in order:

Freeze (server policy): if quarantine and plugin frozen → 423 Locked.
ACK (client policy): if token requires schema_mode=ack and no pin for current sig → 428 Precondition Required with need_pin.
Compat vow (client policy): if schema_compat=additive_only and latest diff is breaking → 412 Precondition Failed.

Only then do rate limits and role/policy checks apply.

Termux (Android) — quick test script

Start (quarantine + signed schema):

python solveforce_phone_thirteen.py \
  --host 0.0.0.0 --port 8080 \
  --plugins-dir ~/solveforce/plugins \
  --auth-mode protected \
  --auth-token READER1:reader \
  --allow-admin --admin-token ADMIN123 \
  --schema-freeze-mode quarantine \
  --schema-freeze-sec 1800 \
  --schema-policy-file /sdcard/solveforce/solveforce_schema_policy_example.json \
  --schema-signing-secret-file /sdcard/solveforce/schema.key

Probe freeze + ACK flow:

# Check signatures
curl 'http://127.0.0.1:8080/schema?access_token=READER1'

# Try read with ACK token but missing pins -> 428
# (Use your signed S1 token from Step 12/11 mint endpoint)
curl -i -H 'Authorization: Bearer S1....' 'http://127.0.0.1:8080/read?plugin=battery'

# Pin it (if not frozen) -> 200 or 412 if additive_only and last diff was breaking
curl -H 'Authorization: Bearer S1....' \
     -H 'X-Schema-Pins: battery=<SIG>' \
     'http://127.0.0.1:8080/read?plugin=battery'

# See freeze state
curl 'http://127.0.0.1:8080/schema_freeze?access_token=READER1'

WordPress — Step Thirteen (drop‑in)

Step Thirteen — Quarantine the breaking, vow the compat, and sign the map

Freeze windowsWhen a plugin’s payload shape breaks, we freeze it. In notify mode, we warn; in quarantine, we lock reads with 423 until the window ends or an admin unfreezes.
Compat vowsClient tokens can declare schema_compat=additive_only. The gateway will reject ACKs across breaking transitions with 412—no accidental foot‑guns.
Signed manifest/schema_signed returns the plugin→signature map along with an HS256 signature (keyed by your device secret). Publish it openly; verify it locally.
Events & metricsschema_frozen SSE events, plus counters for freeze starts/blocks and compat blocks.

Why this matters: Production wants lineage. Data contracts must change, but they should change with ceremony—signed, quarantined, and explicitly accepted.

Integrity (publish these on your site)

sha256sum solveforce_phone_thirteen.py
# bb7312492e1a688786c436acf0bd28f113bd110c25be40e28bcbd72df1097098

sha256sum solveforce_schema_policy_example.json
# 11e32153ba7b3044649c497887953282196ca84a1447c3674c6f945fd91191d1

Logos Codex alignment (recursive notes)

Recursionschema → diff → freeze → SSE notice → human action → signed manifest → ACK → new schema…
Harmonycompat vows keep instruments in tune; freezes prevent dissonance from leaking into the chorus.
Traditionwe honor the old contract until the new one is ratified.

If you want Step Fourteen, we’ll:

add time‑boxed freeze overrides per client (lease tokens),
export diff summaries into Prometheus as labeled counters per path, and
support Ed25519 signing for /schema_signed (detached .sig artifact for offline verification).

Key terms in plain language

Open a term for a concise explanation of language used on this page.

VoIP

Voice over Internet Protocol carries phone calls over an IP network instead of a traditional analog phone line. Call quality depends on network stability, latency, and traffic management.

Unified Communications (UCaaS)

A cloud-based combination of business calling, messaging, meetings, presence, and collaboration tools managed as one communications service.

SIP Trunking

A service that connects a business phone system to the public telephone network using Internet Protocol, replacing or supplementing traditional phone lines.

Bandwidth

The amount of data a connection can carry in a given time, usually measured in Mbps or Gbps. More bandwidth supports more users, devices, and simultaneous applications.

Latency

The time it takes data to travel between two points. Lower latency improves voice, video meetings, cloud applications, gaming, and other real-time services.

Service-Level Agreement (SLA)

A provider’s written commitment covering service targets such as availability, response time, repair time, and sometimes financial credits when commitments are missed.