dckcandClaude Opus 5.5
8d8900d84d
createVat (POST / on the admin socket) makes a vat with newUniqueId and returns its id, which addresses it only there. A vat is reachable only where it is mounted: ?mount=<labels> on each start, as ?egress= is granted; absent means none. The ingress reads a request's labels from its query string, plus a Toybox-Labels header for secret ones (a URL ends up in logs and Referers). It routes to the vat whose mount labels the request carries, every one: stricter than Flower's no-conflict match, since an ingress client holds no constrained handle and a label it omits must not match. Registration keeps Flower's rule, so a mount must conflict with every other and no request can carry two. The app keeps the whole path and sees its connection labels in Toybox-Connection-Labels. A vat from before ids lives at idFromName(name). PUT /by-name/<name> reaches it on the admin socket; it stays unreachable from outside until mounted. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>