anuna-research/cbcl-router
1
0
Fork 0
Code Issues 3 Pull requests 2 Projects Packages Wiki Activity Actions

SPEC-012: unified signed-member protocol + cbcl-router/cbcl-chat consolidation #9

Open
anuna-02 wants to merge 41 commits from feat/spec-012-signed-member-protocol into main
pull from: feat/spec-012-signed-member-protocol
merge into: anuna-research:main
Conversation 0 Commits 41 Files changed 40 +5302 -169
anuna-02 commented 2026-06-05 22:44:25 +00:00 (Migrated from codeberg.org)
Copy link

SPEC-012 — Unified Signed-Member Protocol (cbcl-router)

In-repo implementation of slices 0–4 (spec v0.5.2), adversarially reviewed to convergence. 294 tests green natively (no Docker).

What landed

  • Slice-0 — Tier-1 gates: 3-round adversarial design review hardened the spec (signed envelope, exactly-once honesty, webhook provenance); OQ-001/OQ-002 resolved.
  • Slice-1 — signed-member wire: per-frame Ed25519 over a length-prefixed domain-separated envelope, connect proof-of-possession, identity≠authorization, crypto fuzz, OBS-001.
  • Slice-2 — dispatch + hard exactly-once: selection, canonical re-addressing (replaces the inject-thread byte-hack), lease/fencing + redispatch/sweep/cap/heartbeat, no-handler, OBS-002/003.
  • Slice-3 — signed HTTP ingress: RFC 9421 verify, single-use nonce replay defence, Idempotency-Key→(keyid,content-digest) binding, RFC 9457 Problem Details, rate-limit + headers, producer authorization, OBS-004.
  • Slice-4 — webhook ingestion (router-side): source config, constant-time HMAC, on-behalf mint + untrusted-external provenance, payload bounds.

Build

Native macOS/arm64 fixed via a rebar.config enacl override (drop hardcoded -arch x86_64, pkg-config libsodium, downgrade the OTP-28 clang function-pointer error to a warning). Linux/CI entries reproduced verbatim — CI untouched.

Review

8 adversarial review rounds (design ×3, slice-1, slice-2 ×2, final integration ×2). Notable blockers found + fixed: the bare-payload replay regression (→ signed envelope), the fence-omission exactly-once hole, the dispatch-time authz revocation gap, the missing lease heartbeat, and the HTTP-ingress producer-authorization gap. A final high-effort code review additionally caught + fixed a heartbeat sender-guard bug and a required-expires replay window. Full ledger in docs/decisions/.

Deferred / cross-repo (tracked)

  • EdDSA-JWT ingress alternative (surface reduction); idempotent dedup (→ SPEC-011).
  • Slices 5–6 (hub_core extraction, hark collapse) — cross-repo, gated.
  • Webhook HTTP door + channel fan (hub_core/chat); cowboy HTTP e2e + a demo.sh RFC 9421 signing client; confirm the inherited SPEC-001/SPEC-003 CON-006 envelope format.

⚠️ Tier-1 auth-core — a human security pass over the diff before merge is advised.

## SPEC-012 — Unified Signed-Member Protocol (cbcl-router) In-repo implementation of slices 0–4 (spec **v0.5.2**), adversarially reviewed to convergence. **294 tests green natively** (no Docker). ### What landed - **Slice-0 — Tier-1 gates:** 3-round adversarial design review hardened the spec (signed envelope, exactly-once honesty, webhook provenance); OQ-001/OQ-002 resolved. - **Slice-1 — signed-member wire:** per-frame Ed25519 over a length-prefixed domain-separated envelope, connect proof-of-possession, identity≠authorization, crypto fuzz, OBS-001. - **Slice-2 — dispatch + hard exactly-once:** selection, canonical re-addressing (replaces the `inject-thread` byte-hack), lease/fencing + redispatch/sweep/cap/heartbeat, no-handler, OBS-002/003. - **Slice-3 — signed HTTP ingress:** RFC 9421 verify, single-use nonce replay defence, `Idempotency-Key`→(keyid,content-digest) binding, RFC 9457 Problem Details, rate-limit + headers, producer authorization, OBS-004. - **Slice-4 — webhook ingestion (router-side):** source config, constant-time HMAC, on-behalf mint + `untrusted-external` provenance, payload bounds. ### Build Native macOS/arm64 fixed via a `rebar.config` enacl override (drop hardcoded `-arch x86_64`, pkg-config libsodium, downgrade the OTP-28 clang function-pointer error to a warning). Linux/CI entries reproduced verbatim — **CI untouched**. ### Review **8 adversarial review rounds** (design ×3, slice-1, slice-2 ×2, final integration ×2). Notable blockers found + fixed: the bare-payload replay regression (→ signed envelope), the fence-omission exactly-once hole, the dispatch-time authz revocation gap, the missing lease heartbeat, and the HTTP-ingress producer-authorization gap. A final high-effort code review additionally caught + fixed a heartbeat sender-guard bug and a required-`expires` replay window. Full ledger in `docs/decisions/`. ### Deferred / cross-repo (tracked) - EdDSA-JWT ingress alternative (surface reduction); idempotent dedup (→ SPEC-011). - Slices 5–6 (`hub_core` extraction, `hark` collapse) — **cross-repo**, gated. - Webhook HTTP door + channel fan (hub_core/chat); cowboy HTTP e2e + a `demo.sh` RFC 9421 signing client; confirm the inherited SPEC-001/SPEC-003 CON-006 envelope format. ⚠️ **Tier-1 auth-core** — a human security pass over the diff before merge is advised.
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin feat/spec-012-signed-member-protocol:feat/spec-012-signed-member-protocol
git switch feat/spec-012-signed-member-protocol

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff feat/spec-012-signed-member-protocol
git switch feat/spec-012-signed-member-protocol
git rebase main
git switch main
git merge --ff-only feat/spec-012-signed-member-protocol
git switch feat/spec-012-signed-member-protocol
git rebase main
git switch main
git merge --no-ff feat/spec-012-signed-member-protocol
git switch main
git merge --squash feat/spec-012-signed-member-protocol
git switch main
git merge --ff-only feat/spec-012-signed-member-protocol
git switch main
git merge feat/spec-012-signed-member-protocol
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
anuna-research/cbcl-router!9
No description provided.