Sylvain Duchesne
0d52c82ba9
Le reste du dossier docs/ était déjà en anglais ; ces trois fichiers avaient été rédigés en français par erreur. Traduction fidèle, sans changement de fond : mêmes sections, mêmes tableaux, mêmes blocs de code. Le retour à la ligne dur à 78 colonnes est levé (une ligne par paragraphe, convention du projet). Marqueurs épistémiques préservés et rendus aussi visibles : VERIFIED / INFERRED / CORRECTED / DIRECTION / GAP. Les citations verbatim de commentaires amont restent intactes. Deux incohérences de FOND signalées par la traduction et corrigées ici — elles étaient invisibles tant qu'on lisait chaque section isolément : - readcap-and-nuri-model, section « Caveats / gaps » : elle listait encore le fetch keyless comme hypothèse INFÉRÉE à confirmer, alors que le bloc CORRIGÉ du §4bis la déclare fausse et non constructible. Contradiction interne née de ma correction partielle. Conservée barrée plutôt que supprimée : l'hypothèse est intuitive et se reformera sinon. - incident write-loss : l'intro affirmait en fait établi que « l'écriture n'atteint jamais durablement le broker », alors que la réserve épistémique plus bas dit explicitement que l'alternative (perte d'écriture vs réhydratation à froid) n'est pas tranchée. L'intro ne rapporte plus que le symptôme observé. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014GbGgNEHRejVKoREvFuDFg
3.0 KiB
Vision & principles of the @ng-eventually/client polyfill
Purpose
A stand-in faithful in SHAPE to NextGraph's future primitives. Single objective: that consumers (Festipod) be coded against the CORRECT mental model — the one of finished NextGraph — and have NOTHING to rewrite when NextGraph provides the real primitives.
What the polyfill is NOT
A security layer. The shared wallet (everyone shares the same keys) plus the absence of real crypto make the emulation infinitely less secure than a wallet-per-user — it is a dev/staging vehicle, not a goal. Insecurity is ACCEPTED. An attacker who bypasses the emulation is not our problem.
The only criterion: shape-fidelity, with RIGOR
The exposed surfaces must match the exact SHAPE of the future primitives, even where enforcement is simulated. The failure mode to avoid: exposing the wrong shape → the consumer codes against a model that will not exist → rewrite. The ACL inversion of ReadCaps was exactly that defect (an ACL where the real thing is key possession) — a lack of rigor.
Simulating crypto to PREVENT shortcuts
Without a minimum of crypto simulation, damaging shortcuts get taken (reading the plaintext, falling back on ACLs). The polyfill therefore simulates the final mechanism, enough to hold this invariant:
A
did(bare id, WITHOUT a ReadCap) and a NURI (WITH a ReadCap) are treated GENUINELY differently: the former does NOT allow reading the data; the latter is SUFFICIENT and REQUIRED.
Concretely: a document's data is stored encrypted (per-doc symmetric encryption, however lightweight); the ReadCap = the key; without it, decrypting/reading is impossible. No ACL, no plaintext accessible "on the side". Obtaining read access = holding the key, exactly as in the target model.
Shape consequences (to respect everywhere)
- Everything is keys and URLs. There is no notion of membership, role, or authorization list in the model: only symmetric and asymmetric cryptography, URIs, and who holds which key. Any exposed shape that looks like an ACL, a
member, arole, or apermissionis a wrong shape, whatever scaffolding one may otherwise read in the current state of NextGraph. - Reading = possession of the read key (ReadCap =
{id, key}). A bare id (adidwithout a ReadCap) does not read. - Writing = possession of the write key — a key distinct from the read key, hence a distinct axis, but possession too.
- Sharing a cap = sealing it to a recipient (durable delivery, at share time — NOT an ACL re-declared every session).
- Revocation = re-key (new key; former holders keep the old state). Non-retroactive.
- Cap-less reference (naming/pointing without reading) distinct from the cap-bearing reference.
See readcap-and-nuri-model.md (the real model, verified in nextgraph-rs) and briefs/2026-07-20-caps-emulation-alignment.md (the alignment effort).