Skip to main content

Core D1 original deadline propagation candidate

Status: architecture candidate only; not selected, implemented, qualified or an execution admission. CE1 approval does not approve D1. Existing frozen CE1 inputs remain unchanged. A different whole architecture review and complete original input packet are required before changing the private greeting or positive deadline producer.

Concrete current gap​

The current HTTP application starts a performance-clock deadline before authorization, computes remaining milliseconds, and passes that duration into the native context call. The native binding captures a steady-clock end before queuing its worker. The companion greeting retains only the original nonce and capability, and therefore cannot receive the initiator's original absolute end. A companion constructor using its own current time plus forty seconds would renew authority after authorization, queueing, image authentication and greeting IO. That is forbidden. The present command engine accepts an already-original Deadline reference; its production caller is unresolved and must not substitute a fresh end.

Proposed producer and private ABI​

D1 proposes a private same-image linked-binding deadline token captured synchronously at the original admission HTTP handler's first deadline decision, before authorization or admission body parsing. The source chooses the existing route's fixed deadline ceiling. The token retains the original native monotonic sample, checked absolute end, original request association and original Core admission owner. It is a one-use native object, not a caller timestamp, JavaScript number, public field, profile field, source approval or resource grant. Context consumes that same original token and retains its end through the worker queue. Main-thread request association checks precede queueing; workers receive only immutable native state and never dereference request/NAPI handles.

Clock/token acquisition failure is retained privately while the existing authenticated identity and service:configure checks run first. It must not replace an unauthenticated/permission denial with a native-resource error. After those checks succeed, missing original token/clock/owner denies the native route. Ordinary generic Node/Core auth behavior remains intact; no performance-clock or new duration fallback grants a native deadline.

Windows uses original QueryPerformanceCounter ticks and the original QueryPerformanceFrequency; Linux uses original CLOCK_MONOTONIC nanoseconds with a fixed frequency of 1000000000. Overflow, failed queries, backward samples, expired end or missing original request/owner association deny before further effect. No timeout is renewed on connect, command, reconnect or provider work. The original fixed maximum remains forty seconds; shorter existing route budgets remain shorter.

The checked tick allowance rounds down, never up. Windows conservatively removes one tick for the documented cross-thread/process ordering uncertainty and denies an allowance that cannot retain a positive checked interval. Neither a frequency conversion nor receiver sampling may extend the original end. Suspend/virtualization and the actual clock resolution must be assessed in the same original qualification; a monotonic API name alone does not prove the complete timing guarantee.

The proposed greeting is exactly the existing original nonce32 and capability32 followed by U64BE originalEndTick and U64BE clockFrequency. This is a private eighty-byte greeting under the same already authenticated original peers. The existing operation1..23 request/response fields, sequence and frame-MAC preimages remain byte-for-byte unchanged; provider domain/version/original-byte preimages remain unchanged. The companion stores the received absolute end once, compares the frequency with its independently queried source-selected clock, and rejects expiration. Each subsequent operation and native IO checks that same end. It cannot extend an end received in a prior greeting.

Clock-domain and original custody obligations​

Equal frequencies alone do not establish a clock domain. The selected native qualification must establish that the original Core and companion are on the same host and use the same monotonic domain. Windows requires the actual supported QPC implementation and original local peer/process association. Linux additionally requires actual original same-time-namespace association; namespace offsets cannot be ignored. A namespace identifier, requested enum or filename is not sufficient. Original native namespace/process object custody, the source-built clock implementation and independent measurements must be retained under CE1's existing original input authority and calibration associations. Missing or contradictory domain custody denies; no new privilege, actor, credential, profile capability or calibration outcome is invented.

The proposed Linux resolver uses only the source-derived PID associated with the already held original process object and retains its original proc-directory/time-namespace kernel object. It records actual fstat identity and native namespace-type query results, correlates the original process birth/lifetime around those operations and clock samples, and compares both genuine held time-namespace objects. It cannot accept a request path, requested namespace integer, readlink string or source label. These auxiliary original API bodies remain private native custody alongside the existing identity operation; no primitive enum is added. Whether the exact selected original process rights permit this resolver and whether its raw source evidence establishes the required race/lifetime predicate are explicit whole-review obligations. If those existing rights are insufficient, D1 remains unavailable and must not request or silently add a new privilege.

The original token, greeting buffer, peer objects, queue state, pending IO and every clock/capture/control object belong to the same finite native ownership proof. A token finalizer or logical timeout is not physical closure. A failed or expired attempt retains unresolved original IO/metadata until actual ended custody is established. D1 does not supply an allocator, authentic realm, qualified image, namespace object or runtime grant.

Primary API basis: Microsoft QPC guidance describes same-system counter consistency, boot-fixed frequency and cross-thread one-tick ambiguity. Linux time_namespaces(7) documents per-namespace monotonic offsets. These support investigating the proposed native ABI; they do not qualify the actual original machines, realm, process association or source image. Exact retained raw page bodies belong to the architecture input packet.

Linux namespaces(7) describes retained namespace descriptors and the PTRACE_MODE_READ_FSCREDS access check; ioctl_nsfs(2) identifies the namespace-type query. The same original process association and effective filesystem credentials must substantiate the selected read access. The proposal does not grant CAP_SYS_PTRACE or CAP_SYS_ADMIN, alter Yama, setns, unshare or modify offsets.

Required whole review and prospective original cases​

The complete review must include the actual current HTTP/NAPI producer, native application constructor, companion greeting and command engine, all23 commands and both MAC implementations, accepted CE1 decision/review and every transitive original association. It must assess the private ABI and actual original platform clock APIs and custody, rather than accepting a duration-only helper.

Prospective native cases include authorization/queue/authentication/greeting delays consuming the same end; expiry before and during IO; stale/reused/wrong-request token; overflow/backward/error clock observations; frequency mismatch; Linux differing time namespaces; spoofed peer; malformed/truncated/trailing eighty-byte greeting; command replay; provider latency; cancellation with live IO; and actual retained/closed memory and native object outcomes. No case has executed. No D1 producer or changed greeting is implemented in current product source.