feat(record): lifecycle witnessing, filing intake, witness relay, member witnesses#11
Merged
NetworkTheoryAppliedResearchInstitute merged 3 commits intoJul 13, 2026
Conversation
…fold Executes the Merkle-now decision (Jodson, 2026-07-12), the stack plan's highest-rework item, inside the only cheap window it will ever have: no durable logs, no external consumers, no live witnesses. - Head is now the RFC-6962 Merkle tree head over leaf IDs (leaves keep drops/leaf/v0; interior nodes carry drops/node/v1 — the 0x00/0x01 discipline in canon-domain form, so leaves never replay as nodes). - Inclusion proofs are audit paths: ~log2(size) hashes however large the log grows. This is the open-problem-8 floor made real — an entry-level phone verifies its covenant in a million-entry log with ~20 hashes. - Consistency proofs are RFC-6962 subproofs; Log.ProveConsistency serves the witness's extension evidence, and Witness.Countersign consumes the proof instead of raw leaves. - LogID moves to its own drops/logid/v1 tag (the chain-fold arity is gone); checkpoint and witness payloads bump to v1. Entry/leaf/content stay v0 — byte-identical derivations keep their tags. - Exhaustive property suite: every leaf of every tree size to 33, every consistency pair to 33, tamper/truncation/padding/replay rejection, and the Log-level tie-in over a real appended log. The un-checkpointed-order residual is unchanged (exactly CT's), and the witness amnesia residual is unchanged; neither is papered over. Signed-off-by: Jodson Graves <info@ntari.org>
…ber witnesses The Part-IV plumbing, built as code with every stand-in labeled: - Lifecycle log: a second per-operator Merkle log (domain-disjoint from the dialog log at every derivation) whose leaves are claim transitions — file -> adjudicate -> resolve -> seal, monotonic per claim, filed-first, seal-only-after-resolve (a clock never force-seals; dwell is a readable fact, never a verdict). Checkpointed and countersigned by the same witness machinery via the new VerifyAs/CountersignAs generic bindings. - Filing intake: FilingCommitment (hash, type, timestamp, exchange ref — PII discipline at its hardest) + FilingReceipt, the witness's ONE write. Receipts carry an explicit independence label: the consumer API's in-process intake is operator-run and says so (independent=false), the stand-in until real intake witnesses run. - Consumer API: dispute filing now lodges the commitment at the intake BEFORE the registry acts (the operator-absent-at-birth ordering, kept in miniature); every dispute transition appends to the lifecycle log; new surfaces for lifecycle checkpoints/claims, drops inclusion proofs (member-verifiable offline, ~log2(n) hashes), and the consistency proofs witnesses need. - internal/relay: the witness relay — caches, relays, serves, fans out filings; decides nothing (which witnesses count, which checkpoint is official, and settlement all stay with readers); bypassable by design and tested as such. - internal/witnesskit + cmd/witnessd: membership-as-witnessing (the problem-8 lever). Any member runs a witness: poll, verify (log identity re-derived, never taken on the relay's word), countersign, host the one filing write. cmd/witness-relay is the thin relay shell. - Hermetic federation test: two member witnesses federate over the relay, the stand-in label DROPS, a forked checkpoint gathers no honest countersignature (refused by witnesses, not the relay), and filing fan-out yields two verifying, operator-independent receipts. Named residuals, unchanged and unhidden: witness amnesia (restart = trust-on-first-checkpoint), single-operator in-process intake labeling, and no adjudicator key in cloudyd (no ruling transitions producible). Signed-off-by: Jodson Graves <info@ntari.org>
This was referenced Jul 13, 2026
NetworkTheoryAppliedResearchInstitute
changed the base branch from
feat/drops-merkle
to
main
July 13, 2026 11:35
Signed-off-by: Jodson Graves <info@ntari.org> # Conflicts: # internal/record/verify.go # internal/record/witness.go
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Transplant of local 36a02eb onto the stack (temp-file debris stripped). The Record keystone build: lifecycle witnessing (file→adjudicate→resolve→seal, monotonic, the clock never force-seals), filing intake (the one witness write, independence-labeled receipts), witness relay (decides nothing, bypassable, tested as such), witnesskit + cmd/witnessd (membership-as-witnessing), and the hermetic federation test where the stand-in label actually drops at 2 member witnesses and a fork gathers no honest countersignature.
Stacked on #10; merge after it.