[DM-055] Cut over operational Weave to native encrypted Matrix peer transport

[nicoechaniz]

Outcome

Replace the transitional tribe-weave/v1 carrier with the native, root-bound Daimon Matrix peer transport and perform a reversible operational cutover after explicit human approval. Configured same-being embodiments must exchange encrypted typed /me scope requests/responses and /we.sync requests/deltas, while logical messages continue through the already-native DM-051/052/053 sealed-delivery route. No Tribe wire, directory, audience, key, database, history or runtime becomes Matrix authority or release dependency.

“Matrix” means daimon-matrix; Matrix.org is absent.

Ontology and roadmap correction

The previous short card said Matrix payloads would travel “through Tribe direct audiences.” That contradicted DM-050–054 and the V0 roadmap, which independently replaced Tribe identity, encryption, messages, routes, cursors and scopes and require removal of the standalone runtime dependency. DM-055 therefore activates the native successor wire dm.peer-envelope/v1; it does not wrap Matrix inside tribe-weave/v1.

Tribe Bridge may continue carrying ordinary human messages during the bounded canary. Those messages remain byte/protocol/runtime unchanged. New Matrix peer traffic no longer enters Tribe after cutover. DM-077 owns the later notice/archive action after V0.1.0 and explicit repository-owner approval.

Dependencies

• DM-050 no-copy provenance and absorption boundary.
• DM-051 root-bound recipient encryption.
• DM-052 logical messages, receipts, queues and cursors.
• DM-053 native local/direct/hub route semantics.
• DM-054 signed scopes and per-origin sync plans.
• Implementation PR merged and exact release evidence green.
• Human authorizes the named hosts, endpoints, maintenance window and rollback trigger for the live canary.

The implementation may be completed and reviewed while this card remains status:blocked; live network/service mutation must not occur before the final human gate.

Native encrypted peer contract

• dm.peer-envelope/v1 carries one canonical typed document to one exact active embodiment.
• Closed content types are scope request, scope response, sync request and sync delta. New types require a successor schema/review.
• Fresh CEK/nonces, ChaCha20-Poly1305 payload encryption, RFC 9180 HPKE Base X25519/HKDF-SHA256/ChaCha20-Poly1305 CEK wrapping and Ed25519 full-envelope signatures use separate domain strings.
• Every envelope binds being, manifest hash, sender body/embodiment/incarnation/current credential/transport principal/signing key, recipient embodiment/current credential/encryption key, issue/expiry, correlation, reply parent and content type.
• Receiver validates current root/control state, manifest, active origin, principal binding, signature, exact local recipient, canonical bytes and expiry before private-key use. Manifest mismatch, stale incarnation, wrong recipient and revoked sender/recipient fail closed.
• The carrier sees ciphertext and bounded routing metadata only. It cannot answer /me, select /we, serve/adopt sync, append a ledger, mint a receipt, issue presence, decide a relationship or acquire a Cluster fence.

Normative contract: specs/peer-transport-v1.md and schemas/transport/v1/peer-envelope.schema.json.

Runtime and crash contract

• Runtime bundle V3 adds an optional closed peer_transport section; V1/V2 remain loadable and peer transport is absent by default.
• Private X25519 material stays in owner-only encrypted DM-021 custody under a purpose-specific slot. Endpoints and process configuration cannot substitute identity.
• daimon-matrixd serves bounded POST /dm-peer/v1 concurrently with its owner-local AF_UNIX API only when V3 enables the peer endpoint.
• Emission freezes one randomized encrypted request in an owner-only durable outbox before network I/O. Exact retry sends byte-identical ciphertext.
• Ingress binds envelope ID to exact ciphertext hash and a bounded processing lease before handler execution. Exact replay returns the committed byte-identical response; changed bytes conflict.
• Response loss after remote completion retries the same request. Existing DM-054 scope and DM-023 sync idempotency remain the handler effect truth; transport ACK never means semantic adoption.
• /we.sync pull still imports events as known, preserves origin and performs no automatic adoption.

Implementation acceptance

• Closed schema/module/runtime V3/daemon endpoint are packaged and documented.
• Two root-bound embodiments complete encrypted scope request/response and paginated sync request/delta through the real protocol handlers.
• Real HTTP I/O observes no typed plaintext; a hub/broker is not needed for direct peer calls.
• Exact response-loss retry executes the remote handler once and returns byte-identical response bytes.
• Concurrent duplicate, lease takeover, request-ID conflict, crash-before-commit, restart and corrupted durable-state cases fail/recover deterministically.
• Tamper, noncanonical JSON, open fields, unknown content type/profile, wrong recipient/principal/key/body/incarnation/being/manifest, expiry, revocation and size-bound negatives fail closed.
• Existing DM-021/023/051/052/053/054 tests, full source suite, installed wheel, strict lint/types, reproducible builds, conformance and secret scans remain green.
• CI and explicit self-audit are the implementation review gate; no recursive external review request is required.

Operational canary acceptance

• Operator records exact Matrix commit/wheel, V3 bundle hashes, root/manifest/control head, two embodiment/incarnation/credential IDs, AnyVPN endpoints and rollback configuration without publishing secrets.
• Two installed daimon-matrixd processes on named hosts exchange /me and multi-page /we.sync; each response/event retains its actual origin and pull does not adopt.
• Restart/resume and one deliberate response-loss drill preserve outbox/inbox replay and ledger high-waters.
• Manifest mismatch and a bounded revocation drill produce zero accepted peer effect.
• An ordinary Tribe v1 human message still works unchanged during coexistence; no Matrix peer envelope appears in Tribe stores.
• Human explicitly approves cutover after reviewing receipts, then the native peer profile becomes the configured Weave path.

Rollback

Rollback disables the V3 peer profile/listener and returns to the exact prior transport configuration. Preserve peer outbox/exchange state for diagnosis. Never rewrite/delete Matrix ledgers, lower cursors/high-waters, translate envelopes, import Tribe rows, restore Tribe v0 or represent carrier ACK as semantic delivery. Ordinary Tribe messaging remains independent until DM-077.

Implementation paths

• src/daimon_matrix/peer_transport.py
• src/daimon_matrix/runtime.py
• src/daimon_matrix/daemon.py
• schemas/transport/v1/peer-envelope.schema.json
• schemas/hosted/v3/bundle.schema.json
• tests/test_dm055_peer_transport.py
• specs/peer-transport-v1.md
• docs/dm055-native-peer-cutover.md
• conformance registry, release invariants, packaging/CI and Kanban evidence

[nicoechaniz]

Implementation dependency completed by #103 / PR #104, merged as 669efa205d64d2575fdb12f491e6bbeee886b34a. CI is green across Python 3.11–3.14, packaging, Hermes contract, coordination and 76/76 conformance scenarios; installed artifact report is release-ready. The signed implementation claim was released cleanly. This card intentionally remains open, status:blocked, needs-human, and Todo: no live host or service was changed, and every checkbox under Operational canary acceptance still requires the explicit human-authorized two-host exercise.

[nicoechaniz]

DM-055 technical live canary — 2026-08-11

The operator authorized autonomous reversible testing on the unused Legion and daimonmatrix systems. The technical canary is complete; the final human cutover decision remains deliberately open.

Exact candidate pair:

• Matrix c7c6e236ff59596dd596e69fcd46efbe0446ea69 — PR Prepare DM-083 real two-host dogfood #112; full CI including Python 3.11–3.14, package, Hermes contract and deterministic conformance green: https://github.com/AlterMundi/daimon-matrix/actions/runs/31455597297
• Cluster 88e6965fdcf8f1fe89579c6578390c142ead8641 — Repin Matrix clock-stable peer retry candidate nicoechaniz/daimon-cluster#77; Python 3.11–3.14 CI green: https://github.com/nicoechaniz/daimon-cluster/actions/runs/31455894257
• predeploy restic snapshots: Legion 637de283, remote full boundary 6ba2f408; both repository checks succeeded
• local and remote installed metadata resolve to the exact Matrix Git commit; Cluster's installed host pin resolves to the exact downstream commit

Carrier evidence:

• encrypted /me: request 05500000-0000-4000-8000-000000000812, request hash 83eeea57c0950525959df9be70a2051f1976c89f959d75593d65f53a03443a8d, response hash 81296dd1d3470e956e0dc40bd79221f4422179945e732d8043370b87c3c2e8a0; remote origin and body snapshot verified
• three independently authored shareable observations crossed native encrypted sync in pages of one with more=true,true,false; both hosts converged to 9 known / 0 incomplete events and identical heads hash 5f4cb63000394fccd4e1d4f6ca6291511888397e1e9fea0b91c9fb8bdb51a975
• the rebuilt observer-local projection contains 7 entries: 6 pending, 1 previously reverted, 0 adopted; pull created no adoption

Post-commit response-loss evidence:

• first call returned peer_outcome_ambiguous; after a two-second clock advance and real local daemon restart, retry of sync request 05500000-0000-4000-8000-000000000811 completed with one inserted event and more=false
• both encrypted requests are 3,172 bytes and SHA-256 eee798eb7fcc83568ae63743a6bf231eb222a13d67a5f7e7ca573433a37c82b4
• both encrypted responses are 5,149 bytes and SHA-256 ba6b997eec397139a29fa0e81e7b3d53101748290d03fdaa08ca824c40beaf15
• the local outbox has one matching envelope 96779a84-3c7f-59c4-8355-25e97798ce04; the remote exchange has exactly one matching responded row with those request/response hashes
• the one-shot injector passed a separate one-effect self-test, secret scan and Ruff/compile gate; script SHA-256 06095367cc57c18e543d8fbb49f3d3b0638526f26e3bc365cac07965af40e200

Fail-closed and rollback evidence:

• an envelope validly signed under a distinct manifest (05500000-0000-4000-8000-000000000814, SHA-256 3a7adc208cbc3d0b28f8ae70a20abf521b1e9b2e1671563174065236a3b56093) was rejected with zero matching remote exchange rows
• the bounded revocation negative passed under the exact installed remote package and clusterd identity using isolated synthetic authority/custody; canonical authority history was not mutated
• a noncanonical temporary bundle was rejected before network I/O and automatically restored
• Legion twice exercised candidate→predecessor rollback during readiness-probe corrections, then returned to the candidate with integrity ok
• remote rollback executed end to end: 88e6965/c7c6e23 → 5d3892e/f0181f7 → 88e6965/c7c6e23; both directions reported Cluster health and Matrix integrity ok
• final direct bundles are restored, both Matrix services are active, Cluster is active, and no test proxy remains

Ordinary Tribe coexistence was already proven in the same authorized session: one new private Tribe v1 typed message crossed exactly once with its separate ACK/dedup evidence, while Matrix peer traffic remained outside Tribe storage. That receipt is #111 (comment).

No secret, endpoint, custody byte or private payload is published here. This evidence does not approve release, merge, production cutover, cross-being consent, fresh-host rebirth or Tribe archival.