Repository navigation
Add a migration-only SPI to restore a member's own Update proposal - #109
Merged
Merged
Conversation
🦋 Changeset detectedLatest commit: 66ba6c4 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
A migrated consumer may have a member's outstanding Update proposal
only as {proposal, sender, ref}, without the signed framing bytes
ProposalStore.insert normally requires to re-verify. Group.insertMigratedOwnUpdate
(@_spi(Migration)) restores it under strict, narrower checks in place
of that framing signature: the proposal must be for the local
membership that proposed it, current epoch and group, the leaf's own
signature and §7.3 validity policy must hold, and that membership's
own retained pendingUpdate must both name this exact encryption key
for the current epoch and, by an HPKE seal/open round trip, prove the
paired secret genuinely opens what it seals to that key — a name
match alone (e.g. from a snapshot restore, which also stamps
pendingUpdate without cross-checking secret against public key) is
not proof of possession. The store-level write refuses to overwrite
an existing entry, verified or migrated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
germ-mark
force-pushed
the
llm/migrated-own-update-proposal
branch
from
September 23, 2026 14:59
a15c0a3 to
66ba6c4
Compare
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
Group.insertMigratedOwnUpdate, behind@_spi(Migration): a narrow way to restore a member's own outstanding Update proposal when it was carried over from another implementation without the signed framing bytes thatProposalStore.insertrequires. Without it, a peer that commits such a proposal by reference after migration leaves the migrated member unable to process that commit.Every non-SPI path still requires a verified proposal. Before storing, the SPI checks:
currentMemberRoster(); the receive path is unchanged);It never overwrites an existing entry. A mis-paired ref never mis-applies: the commit fails closed. The docs say it must only ever be fed the member's own local archive data, never network input.
Tests: a happy path, including after a snapshot round-trip; one isolated rejection per check (removing any one check makes that test's insert succeed); swapped-ref, overwrite and multi-membership scoping cases.
🤖 Generated with Claude Code