NAC3 v2.5 -- RFC V24-04 demo

Snapshot versioning + optimistic concurrency control

Three primitives in cheap-to-expensive order: plugin_version (per-plugin monotonic), tree_version (global monotonic, escape hatch), and element_state_hash (128-bit SHA-256 truncated content hash). Every mutating verb honours expected_plugin_version / expected_tree_version / expected_element_state_hash and rejects with NacError('snapshot_stale', ...) when the snapshot the agent planned against has been invalidated. STRICT_VERSIONING defaults true in 2.5 alpha.4.

actions

data-nac-plugin="counter" data-nac-plugin-id="counter-main"
tree_version: -- counter plugin_version: -- counter.input hash: -- STRICT: --
events + invoke results + provenance