Design — not yet available. This page describes a design that is under owner review. No deployment uses it today. The one exception is humanBaseline, described under Permissions as data, which is live in the manifest.

Distributed init is the planned way for a process to start in any process topology, find the kernel, and receive everything it needs to run. Today a deployment hands each service a long list of environment settings. The design replaces that list with one join.

Kernel join

A process would start with two inputs only: its workload identity, which the cluster provides, and the kernel address. It would then call the kernel to join. The kernel would verify the identity, map it to an installation and a component, and answer with a boot bundle:

  • the deployment id, told by the kernel and never inferred by the process
  • derived names for namespaces, prefixes and mounts
  • the providers the deployment uses
  • the settings the component declared, with their resolved values
  • credential references, never secret values
  • a registry lease
  • the peers the component depends on

A missing required value would fail the join once and name every missing item together, instead of causing one crash per missing variable. Processes could start in any order. A required peer that is absent at boot gets a bounded wait, then a failure that names it. A peer that is only needed later is watched, and the process reports not-ready until the peer appears.

If the kernel is down, running processes keep working. New processes cannot join until it is back.

Runtime registration

The join is also how a process registers itself, renews its lease and learns its peers. Biome authors see nothing new: there is no manifest field and no API to call. The service SDK's bootstrap does the join and passes in settings, credentials and peers. Credentials reach your code as providers, so a later change to rotation needs no change in biome code.

The registration contract, kernel:join@1, has landed in the SDK and the kernel server. Pieces of the design are still open.

Permissions as data

Default permissions would ship next to the code that needs them and be imported as rows an admin can change and reset. A default that an admin has changed is never overwritten by a restart or an upgrade.

One part is live today: org-role defaults come only from each biome's humanBaseline in the manifest's authorization contribution. Service seeds and receiver audiences have not landed.

Status

  • No deployment sets the kernel address, so no deployment uses the join.
  • The join contract exists in code. Switching it on in a deployment is a separate step that has not happened.
  • The rest of the design awaits owner review and may change.