Mailbox grant wire types (GER-1965/1966/1967) - #44
Merged
Conversation
Pin swift-cbor at the same revision CoreAppLogic uses, and add a small DeterministicCbor seam establishing the conventions new wire types must follow: short string map keys (swift-cbor's Codable surface only ever produces/accepts string keys — it silently drops non-string keys on decode rather than erroring, so integer keys are wire-incompatible by construction), the archive-companion pattern, and riding a CBOR blob inside a positional container as a plain Data field. Also hoists the hex-fixture decode helper out of AgentHelloDualOfferTests into shared test support, for reuse by new wire-pinning tests.
MailboxGrant {authKey, serviceHost, expiration} — the authenticated
mailbox address, replacing ProtocolAddress in new carriage. address and
putTag(nonce:bodyDigest:) are HMAC-SHA256 derivations matching
germ-service's deriveMailboxAddress/computePutTag byte-for-byte (KATs
cross-validated against test/mailbox-hmac.spec.ts). TypedKeyMaterial's
existing .hmacSha256 case and validated symmetric-key initializer already
covered what the issue asked for; nothing to add there.
Also adds the transitional ProtocolAddress <-> MailboxGrant bridge: a
grant's authKey (32 raw bytes) and a legacy crypto.randomUUID() address
(36 chars, 27 decoded bytes) never collide by length, so a grant can ride
the existing identifier field on wire-shape-frozen surfaces without any
arity change — see AgentUpdateV2's commit for where this applies.
AgentUpdateV2 {version, isAppClip, grants} — grants only, no legacy
addresses field — carried by a new CommProposal.agentUpdateV2 case (tag
6, appended so existing tags 1-5 keep their values). Follows the
pqCardUpgrade precedent exactly: a new ProposalType tag drops the whole
message on a peer that doesn't recognize it, so this is emitted only to
a peer observed >= AgentUpdate.mailboxGrantVersion (2.4.0, next after
pqCapableVersion). Readers ship before writers; the emission gate itself
lives in the app.
mailboxGrantVersion/supportsMailboxGrants mirror pqCapableVersion/
isPQCapable exactly. Below the gate, addresses keeps riding the classic
.sameAgent triple, byte-for-byte unchanged (pinned).
The PQ establishment surfaces (PQAppWelcome/PQAnchorWelcome/handoffs)
don't need a wire change at all: they're already live, fixed-arity
structs, but they already carry AgentUpdate.addresses (directly or via
an embedded AgentUpdate), and the ProtocolAddress <-> MailboxGrant bridge
means those addresses can already be grants. Once a peer clears the
gate, the steady-state conversation upgrades to real agentUpdateV2
proposals; the bridge is only ever the transitional carriage.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Client side of mailbox v2, in three commits:
149 tests green, including CBOR wire-pinning fixtures hand-verified at introduction. Pairs with germ-network/germ-service#29 (server-side string-key rename).
🤖 Generated with Claude Code