Auditable architecture · Unit 3 of 8

Surfaces and their doors

An enabled surface projects operations through a set of capabilities. If one of those capabilities has no provider, the surface has an open door and the runtime would expose it half-wired: that is MILPA_SURFACE_REQUIREMENT_UNMET. The fixes are to install the provider or to disable the surface until one exists.

Intermediate to senior30 min

By the end, you'll be able to

Tell the enabled surface that demands apart from the not-enabled one that demands nothing
Locate the adapter as the bridge that projects a contract to a door

Understand

A surface the host has not enabled demands nothing. When a contract wants to project through it, nothing is broken — the projection simply will not happen — but the mismatch is surfaced (MILPA_SURFACE_NOT_ENABLED) so it is a choice, not an accident: enable the surface if the projection is wanted, or ignore the notice if you left it off on purpose.

Between the contract and the door sits an adapter: coa, MCP and HTTP are adapters of the same handler. If the adapter a contract expects is not installed (MILPA_ADAPTER_MISSING), the contract cannot be projected where the host wants it; reimplementing the domain inside the door is exactly what the adapter model avoids.

See

Open The atom and its doors

An Operation declared once is projected to coa, MCP and HTTP through adapters; the artifact makes the doors visible along with what each one guarantees.

Open artifact

Do

Run the practice in your checkout and keep the output as evidence.

Walk the three doors

Verify

Show that you can apply the unit. Progress only advances once you pass the assessment.

Criteria assessed

Explain why an enabled surface demands its capabilities while a not-enabled one demands nothing.
Place the missing adapter as a projection failure, not a domain failure.

Graded assessment

Solve the 3 scenarios. This unit requires 3 of 3 correct answers.

0 attempts

Question 1 of 3The host enables the mcp surface, which projects operations through the tool-registry capability — and no provider offers it. What should the resolver do?

Report MILPA_SURFACE_REQUIREMENT_UNMET: the surface has an open door and the runtime would expose it half-wired.Ignore the absence: surfaces only add capabilities, they never demand them.Silently disable the surface and continue booting as if it had never been enabled.

Question 2 of 3A contract wants to project through the http surface, which the host did NOT enable. What is the correct reading of the report?

It's a block equivalent to a required capability with no provider.MILPA_SURFACE_NOT_ENABLED: nothing is broken — the projection simply will not happen — but the mismatch is surfaced so it is a choice, not an accident.The resolver enables the surface automatically, because a contract is asking for it.

Question 3 of 3A contract expects the adapter that bridges it to a surface and that adapter is not installed (MILPA_ADAPTER_MISSING). Someone proposes reimplementing the handler inside the door. What is the correct assessment?

Acceptable: each surface should carry its own implementation of the domain so it doesn't depend on adapters.Unnecessary: if the adapter is missing, the projection happens directly against the handler.Incorrect: without the adapter the contract cannot be projected where the host wants it, and the fix is to install the package or plugin that supplies it — not to duplicate the domain at the door.

Grading validates answers in this browser; it doesn't certify identity.

Primary sources

Content verified: 2026-07-12

By the end, you'll be able to

1Understand

2See

3Do

4Verify

Primary sources

Understand

See

Do

Verify