# PLUGIN-HOST FALLBACKS -- Runtime Primitive Gap Register

**Purpose:** E-S03 primitives (Linux/BSD/Java) vs what the Claude Code / Cowork host provides. Unavailable primitive -> documented fallback applied BEFORE the Layer-3 tick loop starts. Never run silently-degraded. **Resolvers:** Phase 5 / 8 / 9-10.

---

## 1. WASI / WebAssembly for Retrieval Capabilities (I3)

**Assumed:** WASI tokens enforced by a WebAssembly runtime (WaVe verifies MemRead/MemWrite stay in-sandbox); Jif decentralized-label-model equivalent.

**Reality:** Claude Code / Cowork may not expose WASI. Assume not unless Phase 5/8 confirms.

**Fallback -- wrapper-enforced capability tokens.** Tokens issued at install from the Layer-2 catalog. Every retrieval surface is accessed ONLY through a wrapper that verifies owner-match + surface-match + expiration before dispatch. Direct engine/cache/index/store access bypasses the wrapper and is itself a capability-leak (integrity-breaking).

**Strength reduction:** Without WASI/Jif, the wrapper IS the trust boundary. IVR documents wrapper-as-boundary in its "primitive-availability" section. **Resolver:** Phase 5 + Phase 8.

---

## 2. inotify / auditd vs fsevents vs Hash-Poll (I1)

**Assumed:** Linux `inotify` OR `auditd` (`auditctl -w <path> -p war`) for real-time syscall-level observation.

**Reality:** macOS / Darwin lacks both; fsevents substitutes. Some hosts have neither.

**Fallback (tiered):**
- **Tier A (Linux):** inotify/auditd. Full real-time.
- **Tier B (macOS):** fsevents. Watchers over the union of all plugins' `owned_path_globs`. Coalesced events are treated as "one or more occurred"; re-read affected paths to extract actor context.
- **Tier C (no event API):** Hash-poll at documented period. Diff = I1 violation at next scan. Period is baseline-tracked; longer period weakens I1. Metadata-only flips may be invisible without supplementary attribute capture.

Active tier declared in the IVR. **Resolver:** Phase 8 runtime-environment audit.

---

## 3. Linux Kernel Namespaces vs In-Process Key-Prefix (I2)

**Assumed:** Linux namespaces (`CLONE_NEWNS|NEWPID|NEWNET`); verify via `lsns` / `readlink /proc/<pid>/ns/<type>`.

**Reality:** Plugins run in-process; kernel namespaces cannot partition in-process state.

**Fallback -- Meyer assertion at state-manager boundary.** Each plugin declares `owned_state_key_prefixes[]`. State-manager public read/write evaluates the I2 predicate BEFORE dispatching. Prefix-claim IS the namespace; assertion IS the enforcement.

**Notes:** State-manager MUST be the only path to state; direct-memory/alternate-path access silently bypasses. Evaluate-and-dispatch must be atomic (same critical section) so a racing bypass cannot slip between check and use. **Resolver:** Phase 5 state-manager interface spec.

---

## 4. Tick Semantics for Claude-Skill Execution Model

**Assumed:** Meyer "every agent tick" maps to a natural periodic execution boundary.

**Reality:** Claude-skill execution is message-driven; no periodic tick.

**Fallback -- tick = any of:** every Evaluator skill-invocation boundary; every state-manager read/write; every retrieval call; every filesystem event; configurable periodic I4 recompute (default: every run start + every install/upgrade).

Active tick-definition appears in IVR "primitive-availability". **Resolver:** Phase 6 (here) + Phase 7 orchestration hooks.

---

## 5. Chaos Experiment Authorization (Layer 5)

**Assumed:** Netflix ChAP traffic-diversion hooks staging failures in a controlled production subset.

**Reality:** No traffic-diversion primitives in the host.

**Fallback -- side-environment baseline mirror.** Chaos runs against a separate environment mirroring the Layer-2 baseline. Live cross-boundary writes are NOT executed in production by default. Live runs require: explicit operator-override in the run manifest; dedicated audit-log stream; pre-approved rollback; post-run independent baseline rebuild regardless of outcome. **Resolver:** Phase 9 / Phase 10.

---

## 6. Cross-Cutting Artifact Distinctness (placement-gap)

Frame Registry (E8) and Evaluator Search Ledger (E4) live under Evaluator paths per `LIBRARY_ARCHITECTURE.md` Section 4. Schema-distinctness is a Layer-1 check refusing any manifest causing schema/path overlap with RAM's Surprise Register or Search Ledger. Future forced sharing requires DECISION-LOG amendment, non-overlapping path roots, non-equivalent contents. **Resolver:** Phase 5 (achieved) + re-verify per install cycle.

---

## Declaration Discipline

Every Isolation Verification Report includes a "primitive-availability" section: per primitive, either "kernel-enforced" or "fallback-enforced" with declared tier. Absence of a primitive is NOT silent degradation; it is an explicit reported posture. Downstream components read the posture and apply their own degradation rules.
