This board states two kinds of facts:
- Implementation facts — true of the
ArcBlock/arctree and its tests at documentation time. - Operational facts — true of a named
arcCLI release after commands were actually run in an isolated directory.
Do not upgrade an implementation fact into an operational recipe without a re-run.
Baseline for this revision
| Axis | Value |
|---|---|
| Site board | docs/identity-data-spaces |
| CLI verified | arc 2.0.0-beta.28 (arc --version) for the implementation facts on this board; the operational recipe was re-captured on 2.0.0-beta.42, whose arc space command surface differs |
| Operational capture | Isolated --root-path + fixture --user-did (see Inspect local spaces, re-run on 2.0.0-beta.42) |
| Source tree | ArcBlock/arc (read-only reference at documentation time) |
| Primary source areas | providers/basic/did-space/, providers/basic/members/, services/shared/src/caller.ts, runtimes/node/src/daemon/auth/, packages/aos/src/session/ |
Evidence hierarchy
| Rank | Source | Can support |
|---|---|---|
| 1 | Current source + target-version tests + real local run | “Supported now” |
| 2 | Package README for the same package | Scope explanation; still re-run commands |
| 3 | Merged PR | That a change landed; re-check for later drift |
| 4 | Architecture draft / planning / historical product page | Intent and lineage only |
Re-verify checklist
Run these steps when the CLI version, provider package, or session overlay behavior changes.
A. CLI identity
arc --version
arc space --help
arc did --helpRecord the version string on every operational page you refresh.
B. Isolated space recipe
Repeat the recipe on Inspect local spaces with a fresh empty --root-path:
liston empty rootsyncinto thesystemanduserfragment directories (read the destination back withpathfirst — the scope directory is derived from the user DID)treeandpathfor both scopesrmand re-tree- Failure cases: missing app, invalid scope on
tree, missingpathargument
Replace pasted outputs with the new capture. Do not keep old timings or byte sizes if they changed.
C. Source anchors (read-only)
Confirm these still match the prose:
| Claim | Look at |
|---|---|
| Caller mapping + membership flags | services/shared/src/caller.ts |
| Node auth setup | runtimes/node/src/daemon/auth/index.ts |
| Role fail-closed | packages/aos/src/session/role-level.ts |
| Session overlays | packages/aos/src/session/session-user-afs.ts |
| DID Space roles + local provider | providers/basic/did-space/src/local.ts |
| Transport op stripping | providers/basic/did-space/src/client.ts |
| Isolation tests | runtimes/node/test/daemon/two-user-space-isolation.test.ts, scope-user-space-overlay.test.ts |
D. What not to re-assert without new E2E
- Complete instance DID provisioning lifecycle
- VC trust gate as a default public contract
- Remote
sync(anhttps://<host>end) against a specific production server - Historical DID Connect admin UI as the ARC-stable surface
- Anonymous public share as the default data plane
Drift handling
| Symptom | Action |
|---|---|
| CLI output differs only in timing/size | Update the paste; keep the procedure |
| Subcommand flags change | Update local-inspection and link to arc-cli reference |
| Session overlay semantics change | Update session-views + isolation table; cite new tests |
| Package rename | Update did-space page imports and evidence table |
| Architecture draft conflicts with code | Prefer code; note the draft as archaeology only |