Distribute recovery custody and harden RC identity

.github/workflows/tests.yml

@@ -151,7 +151,7 @@ jobs:
           "${RUNNER_TEMP}/dm020-wheel/bin/python" -m pip install mcp==2.0.0
           "${RUNNER_TEMP}/dm020-wheel/bin/python" -m pip install --no-deps dist/daimon_matrix-0.0.0-py3-none-any.whl
           "${RUNNER_TEMP}/dm020-wheel/bin/python" -c 'import importlib.metadata as m; import daimon_matrix; assert daimon_matrix.__version__ == "0.0.0"; assert m.requires("daimon-matrix") == ["cryptography==50.0.0", "mcp==2.0.0", "wasmtime==45.0.0"]'
-          "${RUNNER_TEMP}/dm020-wheel/bin/python" -c 'from daimon_matrix.identity import create_genesis, verify_genesis; roots=[bytes([n])*32 for n in (1,2,3)]; recovery=[bytes([n])*32 for n in (4,5,6)]; artifact=create_genesis(roots,2,recovery,2,created_at_ms=1); assert verify_genesis(artifact).being_ref.startswith("dm:being:v1:")'
+          "${RUNNER_TEMP}/dm020-wheel/bin/python" -c 'from daimon_matrix.identity import aggregate_genesis, create_genesis_holder_share, prepare_genesis, threshold_policy, verify_genesis; roots=[bytes([n])*32 for n in (1,2,3)]; recovery=[bytes([n])*32 for n in (4,5,6)]; prepared=prepare_genesis(threshold_policy(roots,2),threshold_policy(recovery,2),created_at_ms=1,nonce=bytes(32)); shares=[create_genesis_holder_share(prepared,seed,role=role) for role,seeds in (("root",roots),("recovery",recovery)) for seed in seeds]; artifact=aggregate_genesis(prepared,shares); assert verify_genesis(artifact).being_ref.startswith("dm:being:v1:")'
           "${RUNNER_TEMP}/dm020-wheel/bin/python" -c 'from daimon_matrix.ledger import Ledger; from daimon_matrix.weave import BeingManifest; assert Ledger and BeingManifest'
           "${RUNNER_TEMP}/dm020-wheel/bin/python" -c 'from daimon_matrix.collective_memory import create_source_manifest, create_publisher_manifest; assert create_source_manifest()["adapter_id"] != create_publisher_manifest()["adapter_id"]'
           "${RUNNER_TEMP}/dm020-wheel/bin/python" -c 'from daimon_matrix.sealed import PROFILE; from cryptography.hazmat.primitives.hpke import Suite; assert PROFILE.startswith("HPKE-X25519") and Suite'
@@ -164,7 +164,7 @@ jobs:
           "${RUNNER_TEMP}/dm020-wheel/bin/python" -W error::ResourceWarning -m unittest tests.test_dm035_publication.DM035PublicContractTests -q
           "${RUNNER_TEMP}/dm020-wheel/bin/python" -W error::ResourceWarning -m unittest tests.test_dm036_collective_memory.DM036ContractTests -q
           "${RUNNER_TEMP}/dm020-wheel/bin/daimon-matrixd" --help
-          "${RUNNER_TEMP}/dm020-wheel/bin/daimon-bootstrap" --help
+          "${RUNNER_TEMP}/dm020-wheel/bin/daimon-genesis" --help
           "${RUNNER_TEMP}/dm020-wheel/bin/daimon-rebirth" --help
           "${RUNNER_TEMP}/dm020-wheel/bin/daimon" --help
           "${RUNNER_TEMP}/dm020-wheel/bin/daimon-conformance" --help

docs/dm022-cluster-adaptation.md

@@ -49,10 +49,11 @@ validation and SQLite behavior; Cluster hosts the exact pinned package.
 10. A physical restart that changes incarnation uses DM-079's signed
     `dm.runtime.bundle/v2` authority history. Reusing V1, replacing the ledger,
     or merely changing `local_origin` is a downgrade/substitution and fails.
-11. DM-031 adds four separately capability-gated curator methods. Cluster's
-    existing exact five-method host capability stays unchanged. A future
-    projection host may opt into `resource-fence` claims only after pinning the
-    reviewed DM-031 Matrix artifact and supplying current fence/effect observers
+11. DM-031's four curator methods and Cluster's exact five status methods use
+    two separately keyed host profiles. The status profile is not the broader
+    operator `observe` profile and cannot claim or complete curator work. A
+    projection host may use `resource-fence` claims only after pinning the
+    reviewed Matrix artifact and supplying current fence/effect observers
     through the explicit runtime injection boundary; queue CAS never substitutes
     for Cluster's cross-host fence.
 

docs/dm024-hosted-runtime.md

@@ -50,8 +50,30 @@ sorted, exact native-peer HTTP(S) target and timeout. The endpoint is fixed at
 startup rather than accepted from a sync call. `we.sync.peer-pull` reuses the
 DM-023 request frozen by `scope.we.sync-plan`, performs the encrypted peer
 round trip inside the daemon's custody boundary and atomically imports one
-bounded page. The installed `daimon-bootstrap` ceremony and operational steps
-are documented in `docs/runbooks/operator-bootstrap.md`.
+bounded page. Distributed `daimon-genesis` provisioning and the explicitly
+synthetic single-store bootstrap fixture are documented in
+`docs/runbooks/operator-bootstrap.md`.
+
+V7 also carries one `runtime_label` and a content-addressed `runtime_id` derived
+from that label, the being root, the root-authorized local origin and its
+operational signing key. The published schema requires exactly one row for each
+of the ten disjoint operator roles plus two host-bound roles: an exact
+five-method status reader and an exact four-method curator worker. The host
+roles are not added to the operator partition and never receive the broader
+`observe` surface. Every row and owner-only V3 client config repeats the runtime
+binding; startup derives it again and rejects missing, duplicated, regrouped or
+cross-runtime capability material.
+The embodiment signing key named by the active root-authorized credential also
+signs a domain-separated hash of the exact twelve-row capability set and the
+runtime identity inputs. Startup verifies that signature, so copied capability
+material cannot be made acceptable merely by relabelling public row and client
+JSON.
+
+The two host clients live at `host-clients/status/` and
+`host-clients/curator/` inside the generated runtime material. Their descriptor,
+origin, runtime identity, placement and distinct key are validated at startup.
+Cluster may copy those two directories into separate host-local roots; Matrix
+does not synthesize a missing host client or fall back to a central credential.
 
 ## Local protocol
 

docs/dm030-memory-policy.md

@@ -89,6 +89,7 @@ may manufacture a policy decision, rewrite category/author, execute a review
 plan, or treat delivery as adoption.
 
 The Cluster matrix-host adapter remains pinned to an exact Matrix commit and its
-five-method host-control capability. Memory access belongs to a separately
-issued least-authority client capability; DM-030 does not silently expand the
-Cluster controller.
+dedicated five-method host-status capability. It does not receive the broader
+operator `observe` profile. Memory access belongs to a separately issued
+least-authority client capability; DM-030 does not silently expand the Cluster
+controller.

docs/dm078-fresh-host-rebirth.md

@@ -68,18 +68,29 @@ python -m daimon_matrix.operator_rebirth activate \
 ```
 
 Preparation is a one-shot, fsynced owner-only directory. It contains encrypted
-body custody, separately encrypted transitional transport custody, public
-operator/status capability descriptors, the target peer profile and the public
-request. Root activation is an owner-only public artifact. The target-only
-`activate` process reopens and revalidates its custody against the root-signed
-activation, emits a loadable V7 runtime with empty writable stores, and retains
-only hashes in its public receipt. Cluster still owns authenticated transfer,
-journaled installation, target start and peer update. Cluster H7/H8 now
+body custody, separately encrypted transitional transport custody, ten public
+least-authority operator descriptors, two dedicated host-bound descriptors, the target peer profile and the public
+request. Every operator role has an independent random key and custody slot;
+the default client is the non-mutating `observe` role and no descriptor spans
+the full service surface. Root activation is an owner-only public artifact. The
+target-only `activate` process reopens and revalidates its custody against the
+root-signed activation, emits a loadable V7 runtime with empty writable stores,
+and retains only hashes in its public receipt. Cluster still owns authenticated
+transfer, journaled installation, target start and peer update. Cluster H7/H8 now
 implement and remotely rehearse that boundary: installation is crash-resumable
 and activation-idempotent, then a foreground supervisor admits only the signed
 initial incarnation, supplies the password by inherited descriptor and
 authenticates status, `/me` and `/we` before reporting `running-ready`.
 
+Operator capabilities have a fixed 30-day lifetime. Preparation and activation
+receipts bind a reprovision instant seven days before hard expiry. Before that
+instant, repeat the split-custody rebirth ceremony to create a fresh
+root-authorized embodiment with a completely new twelve-key role set, cut over, and
+park or revoke the predecessor. Rebirth never regroups the roles and never
+copies capability keys. Expired or revoked descriptors are rejected at runtime
+load as well as at request authentication; in-place rotation of a live bundle,
+custody and plaintext client directories is intentionally unsupported.
+
 ## Only permitted manifest delta
 
 The enrollment validator accepts exactly one new active manifest row while
@@ -110,14 +121,44 @@ against the old control chain. The artifact must revoke the complete set of old
 active embodiment IDs and install a fresh root threshold. No operational body
 is active in that intermediate control state.
 
-Four descriptor-only commands keep the custody roles separate:
+The public distributed ceremony keeps every custody role separate. Repeat the
+holder/share commands once per required participant; the abbreviated paths
+below show one recovery holder and one replacement-root holder:
 
 ```bash
-daimon-rebirth recover \
+daimon-rebirth create-replacement-root-holder \
+  --authority /public/old-authority.json \
+  --password-fd 3 \
+  --output /holders/new-root-a 3</holders/new-root-a.password
+
+daimon-rebirth create-recovery-intent \
+  --authority /public/old-authority.json \
+  --holder-descriptor /holders/recovery-a/descriptor.json \
+  --holder-descriptor /holders/new-root-a/descriptor.json \
+  --threshold 2 \
+  --output /public/recovery-intent.json
+
+daimon-rebirth recovery-share \
+  --authority /public/old-authority.json \
+  --intent /public/recovery-intent.json \
+  --holder /holders/recovery-a \
+  --password-fd 3 \
+  --output /public/recovery-a.share.json 3</holders/recovery-a.password
+
+daimon-rebirth recovery-share \
+  --authority /public/old-authority.json \
+  --intent /public/recovery-intent.json \
+  --holder /holders/new-root-a \
+  --password-fd 3 \
+  --output /public/new-root-a.possession-share.json \
+  3</holders/new-root-a.password
+
+daimon-rebirth aggregate-recovery \
   --authority /public/old-authority.json \
-  --root-custody /offline/old-root-custody.json \
-  --current-password-fd 3 --replacement-password-fd 4 \
-  --output /offline/recovery 3</offline/old-password 4</offline/new-password
+  --intent /public/recovery-intent.json \
+  --share /public/recovery-a.share.json \
+  --share /public/new-root-a.possession-share.json \
+  --output /public/recovery-artifact.json
 
 daimon-rebirth prepare-recovery \
   --authority /public/old-authority.json \
@@ -126,13 +167,29 @@ daimon-rebirth prepare-recovery \
   --output /target/recovery-preparation \
   --password-fd 3 3</target/password
 
-daimon-rebirth authorize-recovery \
+daimon-rebirth create-recovery-authorization-intent \
+  --authority /public/old-authority.json \
+  --recovery /public/recovery-artifact.json \
+  --request /public/recovery-enrollment-request.json \
+  --output /public/recovery-authorization-intent.json
+
+daimon-rebirth recovery-authorization-share \
+  --authority /public/old-authority.json \
+  --recovery /public/recovery-artifact.json \
+  --request /public/recovery-enrollment-request.json \
+  --intent /public/recovery-authorization-intent.json \
+  --holder /holders/new-root-a \
+  --password-fd 3 \
+  --output /public/new-root-a.authorization-share.json \
+  3</holders/new-root-a.password
+
+daimon-rebirth aggregate-recovery-authorization \
   --authority /public/old-authority.json \
   --recovery /public/recovery-artifact.json \
   --request /public/recovery-enrollment-request.json \
-  --recovered-root-custody /offline/recovery/recovered-root-custody.json \
-  --root-password-fd 3 --output /public/recovery-activation.json \
-  3</offline/new-password
+  --intent /public/recovery-authorization-intent.json \
+  --share /public/new-root-a.authorization-share.json \
+  --output /public/recovery-activation.json
 
 daimon-rebirth activate-recovery \
   --base-runtime /public/old-runtime.json \
@@ -143,13 +200,14 @@ daimon-rebirth activate-recovery \
   --password-fd 3 3</target/password
 ```
 
-`recover` consumes offline custody containing the old root and recovery roles.
-Its replacement custody retains the recovery seeds and fresh replacement root
-seeds, but drops every old root seed. Target preparation happens only after the
-public recovery artifact verifies. The activation binds the recovery artifact,
-old and new control heads, old and successor manifests, the full revocation
-set, and the fresh body's credential, incarnation and peer principal. It is
-signed by the new root threshold.
+Each old recovery holder and each new root holder opens only its own package.
+The intent and both aggregators are keyless; no process or store owns a quorum
+of seeds. Target preparation happens only after the public recovery artifact
+verifies. The activation binds the recovery artifact, old and new control
+heads, old and successor manifests, the full revocation set, and the fresh
+body's credential, incarnation and peer principal. It is signed by independent
+shares from the new root threshold. The `synthetic-single-store-*` commands are
+fixtures only and are deliberately absent from this operational procedure.
 
 The recovered V7 bundle has only the fresh embodiment active and therefore may
 have an empty peer target list. Its `authority_history` carries a self-contained

docs/dm083-two-host-dogfood.md

@@ -36,8 +36,9 @@ that must be refreshed:
 3. Read-only host inventory found no current root-bound Matrix being on either
    host. The only remnants are matching all-zero historical fixture manifests
    in trash; they are not migration authority. Matrix therefore now owns the
-   fresh plural-being `daimon-bootstrap` ceremony instead of asking Cluster to
-   invent identity.
+   fresh plural-being distributed `daimon-genesis` ceremony instead of asking
+   Cluster to invent identity. The former one-process bootstrap is now exposed
+   only as `daimon-synthetic-bootstrap` and cannot prove separated custody.
 4. V6 configured only a local peer listener, forcing an operator to inject a
    remote URL outside the runtime contract. V7 adds exact per-embodiment peer
    targets and `we.sync.peer-pull`, so the ordinary CLI can execute the frozen
@@ -252,3 +253,15 @@ cross-being consent or semantic-delivery claim. Matrix PR #112 and Cluster PR
 #77 remain unmerged pending independent review. Fresh-host private custody,
 external participant consent and the final human cutover/archive decisions
 remain separate gates.
+
+## Release-candidate capability successor
+
+The historical five-method status client above is superseded for future
+provisioning. Current bootstrap and rebirth packages mint ten disjoint,
+independently keyed operator roles plus dedicated status and curator host roles.
+The status role has only the five methods Cluster needs; it does not inherit the
+broader `observe` profile. `observe` remains the default operator client and
+contains no mutation; every mutation family requires its own owner-only client directory.
+All role descriptors expire after 30 days and advertise a seven-day
+reprovisioning window. This changes no historical dogfood evidence and has not
+been deployed to those hosts.