archy/docs/peer-request-correlation.md

EventId-correlated peer invitations — inactive source candidate

This document supersedes the older replay document only for the proposed paired implementation. R2's legacy suppression writer and its regression source remain unchanged. This is not a protocol/security approval, migration authorization or runtime qualification.

Implemented source contract

• Protected wire types are peer-request-event-v1 and peer-decision-event-v1. They deliberately do not reuse legacy discriminants: an older reader must not act on a new request while ignoring correlation fields. Legacy parsing remains available for explicit refusal; legacy sender APIs refuse with C01_MIGRATION_REQUIRED.
• A protected request carries {request:{from_did,version,name,message}}. A decision carries the entire original signed request Event as original_request and a tagged decision (accept with invite_code, reject/cancel with optional reason). The reference is that verified original EventId, not the decision's ID, arrival timestamp, or local UUID. These exact schema bytes are a review proposal, not coordinator-approved wire bytes.
• Original proof verification checks signature/EventId, encrypted-DM kind, exactly one recipient, signer/requester, local endpoint, actual decrypted protected request, and decision actor/direction. Reject/accept run recipient-to-requester; cancel runs requester-to-recipient. No custom cryptography; proof and correlation metadata remain inside existing encrypted envelopes.
• operation_id is a stable UUID provided by the client before RPC; new_request explicitly binds intent. Persist the full immutable command and exact signed event in the same atomic JSON document as the visible row BEFORE publish. Repeating an operation with changed recipient/payload/intent refuses. Retrying an identical still-live operation re-fsyncs and returns the same event bytes, not fresh encryption. A terminalized command returns an explicit terminal error rather than publishing again.
• C1 keeps distinct generations as separate UUID rows. Grouping by peer must not collapse protocol identity. Delayed A decisions locate only A, never the current row for the same peer B.
• Local terminal state and encrypted signed decision outbox commit together. Notification opt-out persists and excludes background delivery. Replies retry the exact signed envelope. Incoming approval claims the exact generation durably before restrict_discovery_invite / accept_invite / mesh effects. A partial/uncertain acceptance is visibly marked recovery-required; it is NOT automatically reexecuted, because the existing membership routine can replace nodes and append invite records. Cross-store acceptance reconciliation is an explicit remaining engineering exit.
• Early cancellation admits only a verified original request proof in the existing signed admission horizon. Its generation consumes a reserved slot without creating a visible pending row; subsequent arrival is suppressed. Known terminal updates do not require a new slot. Protected generations are not pruned or evicted in this candidate, preventing cancellation revival from speculative GC.

Explicit activation and migration boundary

require_activation() unconditionally returns C01_POLICY_PENDING; there is no environment/file switch, test bypass, or hidden production default. Connect/poll/approve/reject/cancel/retry/publication entrypoints are gated. Discovery and existing mesh/federation connectivity are not disabled. List-pending exposes migration/policy and acceptance-recovery status; mutation RPC errors are explicit. Frontend and shared dispatch/session/RBAC/CSRF sources are untouched.

This is not a claim that an unmodified old remote UI can render a new refusal. M1 requires coordinated upgraded clients/peers, a durable migration/rollback boundary, and visible frontend rendering before activation. Current frontend lacks stable operation-ID submission and the new status renderer. New discriminants prevent legacy action, but alone do not implement capability negotiation or remote error presentation. No ambiguous legacy decision is sent as a compatibility fallback.

Current adopted policy and incomplete implementation

The coordinator's C01-D4-COORDINATOR-ADOPTION.md now adopts the exact recommendations in c01-d4-security-disposition-v1/DISPOSITION.md only with mandatory D4-C1 through D4-C5. Older statements that numeric quotas, L1/L2 or retry policy await selection are superseded. This recovery does not implement those requirements merely by documenting them, and cannot be activated.

The source still reuses the old wall-clock admission check and ledger count ceilings. That is not the adopted clock/fence authority or the required independent known/unknown/byte/resource-reservation accounting. There is no protected GC, authenticated nonrenewable command deadline, qualified clock/rollback recovery, encrypted bounded snapshot/control store, aggregate pre-parse receive adapter, launcher downgrade fence, fair globally paced retry scheduler, or final-effect L2 revalidation. Existing claim_replies has no original-request cutoff; approval retry still uses receipt age. None of those behaviors is approved by the fail-closed activation gate.

Exact adopted parameters are bound by the coordinator adoption and disposition rather than duplicated as incomplete runtime defaults here. The original request horizon is L2 inclusive [c,c+2592000], future allowance zero; retention is through H+300. Same logical validated time and atomic nondecreasing watermark, non-ratcheting monotonic trajectory, final-effect expiry and unresolved-effect retention are mandatory. Unknown early cancel is independent of known generations. Resource-holding terminal outboxes retain their allocated slots. Commands cannot become new operations after GC. Transport limits are aggregate across relays and must precede allocation. Serialized snapshot/control ceilings and launcher-enforced downgrade refusal require concrete storage/transport/platform integration, not just constant declarations.

Migration consumer recovery

Recovery consumes lane44's fixed consumer contract. MIGRATION_REQUIRED and POLICY_PENDING now use the existing Not supported sanitizer prefix, ASCII text under its 200-byte truncation limit, and no known frontend transport-retry trigger words. This corrects synchronous error preservation without changing dispatch, auth/CSRF or frontend files. A Rust test targets the actual sanitizer, but is UNRUN. The offline RED/GREEN source-contract check is not Rust execution, mounted UI evidence, durable background refusal or actual old-peer interoperability.

Lane44's remaining application-error retry classifier, map pre-ack animation, operation-ID submission, status projection/readback and refresh ownership still require the frontend owner. Do not parse poll skipped as public migration messages or infer remote approval from relay delivery. Existing notification defaults and unrelated connectivity remain unchanged.

Evidence and test transition

Rust regression sources cover signed endpoint/proof rejection, delayed accept/reject/cancel A versus B, prepared-before-publish reload and exact retry, conflicting commands, early cancellation, first terminal wins, uncertainty after acceptance claim, capacity, no-notify and legacy/policy refusal. They have NOT been compiled or executed. Store reload / simulated lost completion are not process-death, power-loss or fsync fault-injection tests.

The two historical RPC transport tests and the historical legacy replay RPC test asserted legacy emission/automatic acceptance that M1 now prohibits. Their original bytes are retained in the packet baseline. Current sources assert visible refusal/no mutation; signed positive store/wire tests cover the new primitives. Positive managed-relay send/ack/timeout, peer-invite DID/trust integration and real RPC replay/crash tests must be ported and run after selected policy/activation admission. The unrelated metrics test and all R2 tests are unchanged. This transition does not inherit or replace the old transport qualification.

Independent exact protocol/storage/security review, native isolated tests, actual crash/reordering/mixed-version migration, packaged/multi-node/operator qualification remain required. Do not integrate this inactive candidate as finished C01.

Lane55 bounded D4 schema/caller successor (not activated)

The command operation key is now a canonical UUIDv7, not an arbitrary UUID. Its embedded Unix milliseconds, floored to integer seconds, are the immutable origin c. No retry parameter or current receipt time can replace that origin. H=c+2592000 and H+300 use checked arithmetic. The authenticated local connect RPC signs the request with created_at=c; encrypted RequestCommandBinding contains the exact operation key, explicit-new intent and c alongside the immutable request payload. Recipient remains the signed envelope recipient. No private command metadata is added to public Nostr tags. The original signed request EventId, never this UUID or a timestamp, remains decision identity.

Absent commands require new_request=true; identical retry resubmits that same immutable command, including its original true intent. Changed fields conflict. The key's original horizon is checked before looking up a binding, so absence following future safe GC cannot renew the same key. Changing the timestamp bits is a different operation key and needs explicit new intent. All command bindings are currently retained indefinitely; this patch introduces no GC. Client UUIDv7 creation/retry UI and migration negotiation remain unimplemented; UUIDv4 input refuses rather than being silently converted. This encoding needs independent exact-schema review, not renewed numeric-policy selection.

Known accounting uses authenticated remote keys (recipient for outbound, requester for inbound), 4096/256 combined known ceilings, 5 inbound plus 5 outbound live rows, and 1024 resource slots including every full terminal Generation. Unknown authenticated cancels use a separate 512/16 compact tuple pool with exact first terminal decision identity and a 2048-byte bound, never the known pool. Actual compact serialization is measured before correlation commits; pending slots reserve a maximum terminal event plus metadata. Raw event objects remain objects. Terminal state never lends its resource slot. Safe compaction/release is not implemented: even reconciled generations retain their proof/command resources and can cause earlier visible refusal. This conservative limitation must be resolved before activation, not called full D4-C1 completion.

Initial, manual-retry and background approvals share exact-row/original-horizon, nonempty-DID, removed-peer and existing-member eligibility. Explicit removal now holds the correlation decision guard. Incoming acceptance checks the removed DID and original horizon again immediately before calling accept_invite. Publication checks the original horizon after connecting. These are caller-boundary checks, not an atomic external-effect journal: accept_invite's internal asynchronous mutation boundary, every other membership/removal writer, partial effects and reconciliation remain open.

Clock use is still provisional wall time; sibling57 qualified time/fence integration is required before activation or GC. The actual protected encrypted store and bounded pre-parse transport remain sibling56/58 integration work. Legacy R2 persistence/suppression is unchanged. The accounting wrapper does not convert that plaintext pretty-JSON writer into a protected store. Exact maximum signed fixtures, pre-sign complete prospective reservation, frozen clocks, process-death/GC races and independent review are open. Rust test sources are UNRUN under this source-only admission. No full C01, build or runtime pass.