@optimystic/db-p2p 0.13.5 → 0.14.1

package/dist/src/cohort-topic/change-bridge.js

@@ -0,0 +1,76 @@
+import { createLogger } from "../logger.js";
+const log = createLogger('cohort-change-bridge');
+/**
+ * The reactivity/matchmaking **origination point**: bridge the local single-node change-notifier
+ * primitive into the networked cohort-topic substrate.
+ *
+ * On EVERY commit landing on this node (via the catch-all {@link ChangeBridgeSource.onAnyCollectionChange}
+ * feed), if this node is a cohort member for the collection's reactivity topic, the bridge hands the
+ * `CollectionChangeEvent` plus the pass-through {@link CommitCert} to `service.onLocalCommit` —
+ * reactivity reuses the commit cert's threshold signature directly and never re-signs. A commit on a
+ * non-member node (no fan-out responsibility) or one for which no cert is retained (nothing
+ * authoritative to forward) is a no-op. A throwing downstream hook is isolated + logged so
+ * origination can never break the commit (matching the {@link IBlockChangeNotifier} listener contract).
+ *
+ * The returned value IS an {@link IBlockChangeNotifier}: it is what `network-transactor` takes as its
+ * `localChangeNotifier`, so per-collection {@link IBlockChangeNotifier.onCollectionChange} subscribers
+ * (e.g. the Quereus reactive-watch vtab) keep working — those subscriptions delegate straight to
+ * `source`. Origination runs independently on the catch-all feed.
+ *
+ * `makeCohortTopicChangeNotifier` discards the catch-all unsubscribe (node-lifetime by intent) for the
+ * unit tests; the node assembly uses {@link attachCohortChangeBridge}, which returns the teardown.
+ */
+export function makeCohortTopicChangeNotifier(deps) {
+    return buildCohortTopicChangeBridge(deps).notifier;
+}
+/**
+ * Shared wiring behind both entry points: subscribe the origination handler to the source's catch-all
+ * commit feed and build the decorating {@link IBlockChangeNotifier}. Returns the notifier plus the
+ * idempotent teardown for that catch-all subscription (the underlying `onAnyCollectionChange` unsub is
+ * itself idempotent), so the node assembly can release it on node stop alongside `host.stop()`.
+ */
+function buildCohortTopicChangeBridge(deps) {
+    const unsubscribe = deps.source.onAnyCollectionChange((event) => originate(deps, event));
+    const notifier = {
+        onCollectionChange: (collectionId, listener) => deps.source.onCollectionChange(collectionId, listener),
+    };
+    return { notifier, unsubscribe };
+}
+/** Run the membership gate, cert extraction, and origination hook for one change event, isolating throws. */
+function originate(deps, event) {
+    try {
+        if (!deps.selfIsCohortMember(event)) {
+            return; // not responsible for this topic's fan-out
+        }
+        const hook = deps.service.onLocalCommit;
+        if (!hook) {
+            return; // no reactivity/matchmaking consumer has attached an origination handler yet
+        }
+        const commitCert = deps.extractCommitCert(event);
+        if (!commitCert) {
+            return; // nothing authoritative to forward; never fabricate an unsigned cert (extractor logs why)
+        }
+        hook(event, commitCert);
+    }
+    catch (err) {
+        log('origination hook threw for collection=%s rev=%d: %o', event.collectionId, event.rev, err);
+    }
+}
+/**
+ * Wire the cohort-topic origination bridge as `node`'s `blockChangeNotifier` (the value the
+ * `NetworkTransactor` consumes as its `localChangeNotifier`). Call this from the node assembly once a
+ * {@link CohortTopicService} is running on the node, passing the node's `StorageRepo` as `source` and
+ * the membership + cert-extraction seams.
+ *
+ * Returns the installed `notifier` plus an idempotent `unsubscribe` that tears down the catch-all
+ * origination subscription — the node assembly calls it on node stop (alongside `host.stop()`) so the
+ * origination feed is released before the node's transports close. Tearing it down stops further
+ * origination but leaves the per-collection `onCollectionChange` delegation intact (those subscriptions
+ * live on the `source` `StorageRepo`, not on the bridge).
+ */
+export function attachCohortChangeBridge(node, deps) {
+    const bridge = buildCohortTopicChangeBridge(deps);
+    node.blockChangeNotifier = bridge.notifier;
+    return bridge;
+}
+//# sourceMappingURL=change-bridge.js.map

package/dist/src/cohort-topic/change-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"change-bridge.js","sourceRoot":"","sources":["../../../src/cohort-topic/change-bridge.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,MAAM,GAAG,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAC;AA4BjD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAAmC;IAChF,OAAO,4BAA4B,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,SAAS,4BAA4B,CAAC,IAAmC;IACxE,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACzF,MAAM,QAAQ,GAAyB;QACtC,kBAAkB,EAAE,CAAC,YAAY,EAAE,QAAQ,EAAgB,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,YAAY,EAAE,QAAQ,CAAC;KACpH,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AAClC,CAAC;AAED,6GAA6G;AAC7G,SAAS,SAAS,CAAC,IAAmC,EAAE,KAA4B;IACnF,IAAI,CAAC;QACJ,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO,CAAC,2CAA2C;QACpD,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,CAAC,6EAA6E;QACtF,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,OAAO,CAAC,0FAA0F;QACnG,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,qDAAqD,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChG,CAAC;AACF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CACvC,IAAoD,EACpD,IAAmC;IAEnC,MAAM,MAAM,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,mBAAmB,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC3C,OAAO,MAAM,CAAC;AACf,CAAC"}

package/dist/src/cohort-topic/cohort-gossip-driver.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Cohort-topic gossip-cadence driver helpers (host-side, gap 5).
+ *
+ * The {@link import("./host.js").CohortTopicHost} owns a single repeating timer; on each tick it drives
+ * every live `CoordEngine`'s gossip round. The per-round work this module factors out — assembling a
+ * `CohortGossipV1` and accumulating/draining the registration-record deltas the renewal `touch`/`evicted`
+ * hooks emit — is split here so it is unit-testable without the timer or libp2p.
+ *
+ * db-p2p (not db-core) owns the cadence because the round interval, the peer-key signature on the gossip
+ * envelope, and the per-coord inbound routing all live at the FRET/libp2p boundary; db-core supplies the
+ * pure substrate (`selfWillingnessBits`, `toCohortTopicSummary`, `toGossipRecord`, the bus merge).
+ */
+import { type CohortGossipV1, type CohortTopicSummary, type GossipRecordRefV1, type GossipRecordV1, type LoadBarometerState, type NodeProfile, type RegistrationRecord } from "@optimystic/db-core";
+/**
+ * Default gossip-round cadence in ms. There is no dedicated `gossip_round` constant in
+ * `docs/cohort-topic.md` §Configuration, so this is a derived, injectable default on the order of one
+ * round — a few seconds, aligned with the traffic window / ping cadence (`ping_interval = ttl/3` is
+ * 30 s Core, so a sub-round of that). The membership refresh (`T_membership_refresh`, 5 min) and the
+ * demotion hysteresis (`T_demote`, 5 min) are gated by elapsed-time **inside** their modules, so the
+ * driver can tick fast and let those modules decide when to act.
+ */
+export declare const DEFAULT_GOSSIP_INTERVAL_MS = 5000;
+/**
+ * Per-`CoordEngine` queue of registration-record deltas accumulated between gossip rounds. The renewal
+ * cohort side calls {@link PendingDeltas.touch} on every served ping/re-attach and
+ * {@link PendingDeltas.evicted} on every TTL sweep; the next round {@link PendingDeltas.drain}s the
+ * batch into the gossip frame and clears it — one broadcast per round rather than one per ping.
+ */
+export interface PendingDeltas {
+    /** Upsert a fresh/touched record (keyed by `(topicId, participantId)`; last write wins on `lastPing`). */
+    touch(rec: RegistrationRecord): void;
+    /** Queue an eviction ref and drop any pending record for the same key (a stale record can't also re-advertise). */
+    evicted(rec: RegistrationRecord): void;
+    /** True iff nothing is queued. */
+    isEmpty(): boolean;
+    /** Drain the queue into wire-shaped deltas, clearing it. */
+    drain(): {
+        records: GossipRecordV1[];
+        evicted: GossipRecordRefV1[];
+    };
+}
+/** Build an empty {@link PendingDeltas} queue. */
+export declare function createPendingDeltas(): PendingDeltas;
+/** Inputs to {@link buildCohortGossip} — the per-round signals already gathered by the engine. */
+export interface GossipFrameInputs {
+    /** This member's dialable id, base64url (the `fromMember` / view key). */
+    readonly fromMember: string;
+    /** This cohort's served coord, base64url (the inbound routing key). */
+    readonly coord: string;
+    /** This cohort's epoch, base64url. */
+    readonly cohortEpoch: string;
+    /** This node's tier profile (the `∧` half of the willingness vector). */
+    readonly profile: NodeProfile;
+    /** This member's load barometer (load buckets + the load-shed half of willingness). */
+    readonly barometer: LoadBarometerState;
+    /** Cohort-wide observation window (seconds) for the rate fields in `topicSummaries`. */
+    readonly windowSeconds: number;
+    /** Per-resident-topic summaries (own published counts), already frozen for this round. */
+    readonly topicSummaries: CohortTopicSummary[];
+    /** Drained fresh/touched record deltas for this round. */
+    readonly records: GossipRecordV1[];
+    /** Drained eviction refs for this round. */
+    readonly evicted: GossipRecordRefV1[];
+    /** Round timestamp, unix ms. */
+    readonly timestamp: number;
+}
+/**
+ * Assemble one round's {@link CohortGossipV1}, or `undefined` when this engine is **idle** — no resident
+ * topics and no pending deltas, so it has nothing for siblings and the host skips the broadcast (idle
+ * empty engines cost no gossip). `willingnessBits` is `profile ∧ load` ({@link selfWillingnessBits}); the
+ * `signature` slot is left empty for the host's peer-key signer to fill before broadcast.
+ */
+export declare function buildCohortGossip(i: GossipFrameInputs): CohortGossipV1 | undefined;
+//# sourceMappingURL=cohort-gossip-driver.d.ts.map

package/dist/src/cohort-topic/cohort-gossip-driver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cohort-gossip-driver.d.ts","sourceRoot":"","sources":["../../../src/cohort-topic/cohort-gossip-driver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAKN,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,OAAQ,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC7B,0GAA0G;IAC1G,KAAK,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACrC,mHAAmH;IACnH,OAAO,CAAC,GAAG,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACvC,kCAAkC;IAClC,OAAO,IAAI,OAAO,CAAC;IACnB,4DAA4D;IAC5D,KAAK,IAAI;QAAE,OAAO,EAAE,cAAc,EAAE,CAAC;QAAC,OAAO,EAAE,iBAAiB,EAAE,CAAA;KAAE,CAAC;CACrE;AAED,kDAAkD;AAClD,wBAAgB,mBAAmB,IAAI,aAAa,CAiCnD;AAED,kGAAkG;AAClG,MAAM,WAAW,iBAAiB;IACjC,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uEAAuE;IACvE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,sCAAsC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,uFAAuF;IACvF,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,wFAAwF;IACxF,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,0FAA0F;IAC1F,QAAQ,CAAC,cAAc,EAAE,kBAAkB,EAAE,CAAC;IAC9C,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC;IACnC,4CAA4C;IAC5C,QAAQ,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IACtC,gCAAgC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,iBAAiB,GAAG,cAAc,GAAG,SAAS,CAuBlF"}

package/dist/src/cohort-topic/cohort-gossip-driver.js

@@ -0,0 +1,87 @@
+/**
+ * Cohort-topic gossip-cadence driver helpers (host-side, gap 5).
+ *
+ * The {@link import("./host.js").CohortTopicHost} owns a single repeating timer; on each tick it drives
+ * every live `CoordEngine`'s gossip round. The per-round work this module factors out — assembling a
+ * `CohortGossipV1` and accumulating/draining the registration-record deltas the renewal `touch`/`evicted`
+ * hooks emit — is split here so it is unit-testable without the timer or libp2p.
+ *
+ * db-p2p (not db-core) owns the cadence because the round interval, the peer-key signature on the gossip
+ * envelope, and the per-coord inbound routing all live at the FRET/libp2p boundary; db-core supplies the
+ * pure substrate (`selfWillingnessBits`, `toCohortTopicSummary`, `toGossipRecord`, the bus merge).
+ */
+import { bytesToB64url, toGossipRecord, willingnessBitsHex, selfWillingnessBits, } from "@optimystic/db-core";
+/**
+ * Default gossip-round cadence in ms. There is no dedicated `gossip_round` constant in
+ * `docs/cohort-topic.md` §Configuration, so this is a derived, injectable default on the order of one
+ * round — a few seconds, aligned with the traffic window / ping cadence (`ping_interval = ttl/3` is
+ * 30 s Core, so a sub-round of that). The membership refresh (`T_membership_refresh`, 5 min) and the
+ * demotion hysteresis (`T_demote`, 5 min) are gated by elapsed-time **inside** their modules, so the
+ * driver can tick fast and let those modules decide when to act.
+ */
+export const DEFAULT_GOSSIP_INTERVAL_MS = 5_000;
+/** Build an empty {@link PendingDeltas} queue. */
+export function createPendingDeltas() {
+    const records = new Map();
+    const evicted = new Map();
+    const keyOf = (topicId, participantId) => `${bytesToB64url(topicId)}|${bytesToB64url(participantId)}`;
+    return {
+        touch(rec) {
+            const key = keyOf(rec.topicId, rec.participantId);
+            const held = records.get(key);
+            // Last-writer-wins on lastPing: never let an older touch shadow a newer one queued the same round.
+            if (held === undefined || rec.lastPing >= held.lastPing) {
+                records.set(key, rec);
+            }
+            evicted.delete(key); // a live touch supersedes a pending eviction (eviction-vs-late-touch)
+        },
+        evicted(rec) {
+            const key = keyOf(rec.topicId, rec.participantId);
+            evicted.set(key, { topicId: bytesToB64url(rec.topicId), participantId: bytesToB64url(rec.participantId) });
+            records.delete(key);
+        },
+        isEmpty() {
+            return records.size === 0 && evicted.size === 0;
+        },
+        drain() {
+            const out = {
+                records: [...records.values()].map(toGossipRecord),
+                evicted: [...evicted.values()],
+            };
+            records.clear();
+            evicted.clear();
+            return out;
+        },
+    };
+}
+/**
+ * Assemble one round's {@link CohortGossipV1}, or `undefined` when this engine is **idle** — no resident
+ * topics and no pending deltas, so it has nothing for siblings and the host skips the broadcast (idle
+ * empty engines cost no gossip). `willingnessBits` is `profile ∧ load` ({@link selfWillingnessBits}); the
+ * `signature` slot is left empty for the host's peer-key signer to fill before broadcast.
+ */
+export function buildCohortGossip(i) {
+    if (i.topicSummaries.length === 0 && i.records.length === 0 && i.evicted.length === 0) {
+        return undefined;
+    }
+    const g = {
+        v: 1,
+        fromMember: i.fromMember,
+        coord: i.coord,
+        cohortEpoch: i.cohortEpoch,
+        willingnessBits: willingnessBitsHex(selfWillingnessBits(i.profile, i.barometer)),
+        loadBuckets: i.barometer.loadBuckets(),
+        windowSeconds: i.windowSeconds,
+        topicSummaries: i.topicSummaries,
+        timestamp: i.timestamp,
+        signature: "",
+    };
+    if (i.records.length > 0) {
+        g.records = i.records;
+    }
+    if (i.evicted.length > 0) {
+        g.evicted = i.evicted;
+    }
+    return g;
+}
+//# sourceMappingURL=cohort-gossip-driver.js.map

package/dist/src/cohort-topic/cohort-gossip-driver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cohort-gossip-driver.js","sourceRoot":"","sources":["../../../src/cohort-topic/cohort-gossip-driver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACN,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,mBAAmB,GAQnB,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,CAAC;AAmBhD,kDAAkD;AAClD,MAAM,UAAU,mBAAmB;IAClC,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;IACtD,MAAM,OAAO,GAAG,IAAI,GAAG,EAA6B,CAAC;IACrD,MAAM,KAAK,GAAG,CAAC,OAAmB,EAAE,aAAyB,EAAU,EAAE,CACxE,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC;IAC7D,OAAO;QACN,KAAK,CAAC,GAAuB;YAC5B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;YAClD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC9B,mGAAmG;YACnG,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACzD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACvB,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,sEAAsE;QAC5F,CAAC;QACD,OAAO,CAAC,GAAuB;YAC9B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YAC3G,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,CAAC;QACD,OAAO;YACN,OAAO,OAAO,CAAC,IAAI,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC;QACjD,CAAC;QACD,KAAK;YACJ,MAAM,GAAG,GAAG;gBACX,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC;gBAClD,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;aAC9B,CAAC;YACF,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO,GAAG,CAAC;QACZ,CAAC;KACD,CAAC;AACH,CAAC;AA0BD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAoB;IACrD,IAAI,CAAC,CAAC,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvF,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,CAAC,GAAmB;QACzB,CAAC,EAAE,CAAC;QACJ,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,eAAe,EAAE,kBAAkB,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;QAChF,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;QACtC,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,cAAc,EAAE,CAAC,CAAC,cAAc;QAChC,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,SAAS,EAAE,EAAE;KACb,CAAC;IACF,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;IACvB,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;IACvB,CAAC;IACD,OAAO,CAAC,CAAC;AACV,CAAC"}

package/dist/src/cohort-topic/cohort-gossip-transport.d.ts

@@ -0,0 +1,42 @@
+import type { ICohortGossipTransport, PeerRef, RingCoord } from "@optimystic/db-core";
+import type { Libp2p } from "libp2p";
+/** Resolves the cohort owning a coord to its libp2p peer-id strings (FRET two-sided assembly). */
+export interface CohortPeerResolver {
+    /** Peer-id strings of the cohort owning `coord`, up to `wants` members. */
+    cohortPeers(coord: RingCoord, wants: number): string[];
+}
+export interface FretCohortGossipTransportOptions {
+    readonly gossipProtocol?: string;
+    /** Cohort fan-out for a broadcast. Default 16. */
+    readonly wants?: number;
+    /** This node's peer-id string — excluded from its own broadcasts. */
+    readonly selfPeerId: string;
+}
+/**
+ * FRET-backed {@link ICohortGossipTransport}: intra-cohort gossip over
+ * `/optimystic/cohort-topic/1.0.0/cohort-gossip`. `broadcast` fans a frame out to the FRET-assembled
+ * cohort for `coord` (fire-and-forget, self excluded); inbound frames arrive through the host's gossip
+ * protocol handler, which calls {@link deliver}. Subscribers registered via `onMessage` see every
+ * delivered frame.
+ */
+export declare class FretCohortGossipTransport implements ICohortGossipTransport {
+    private readonly node;
+    private readonly resolver;
+    private readonly handlers;
+    private readonly gossipProtocol;
+    private readonly wants;
+    private readonly selfPeerId;
+    constructor(node: Libp2p, resolver: CohortPeerResolver, options: FretCohortGossipTransportOptions);
+    broadcast(coord: RingCoord, msg: Uint8Array): void;
+    /**
+     * Fan `msg` out to the FRET-assembled cohort for `coord` over an arbitrary one-way `protocol` (self
+     * excluded, fire-and-forget). Reuses the cohort peer resolution so the `promote` protocol's
+     * promotion/demotion notice broadcast shares the gossip transport's wiring; a single unreachable
+     * member is recovered by the cohort's next convergence round, so per-peer failures are swallowed.
+     */
+    broadcastOver(protocol: string, coord: RingCoord, msg: Uint8Array): void;
+    onMessage(handler: (from: PeerRef, msg: Uint8Array) => void): () => void;
+    /** Feed an inbound gossip frame (called by the host's `/cohort-gossip` protocol handler). */
+    deliver(fromPeerId: string, msg: Uint8Array): void;
+}
+//# sourceMappingURL=cohort-gossip-transport.d.ts.map

package/dist/src/cohort-topic/cohort-gossip-transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cohort-gossip-transport.d.ts","sourceRoot":"","sources":["../../../src/cohort-topic/cohort-gossip-transport.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACtF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAMrC,kGAAkG;AAClG,MAAM,WAAW,kBAAkB;IAClC,2EAA2E;IAC3E,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CACvD;AAED,MAAM,WAAW,gCAAgC;IAChD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,kDAAkD;IAClD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,qEAAqE;IACrE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,qBAAa,yBAA0B,YAAW,sBAAsB;IAM3D,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAU,OAAO,CAAC,QAAQ,CAAC,QAAQ;IALpE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAuD;IAChF,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAEP,IAAI,EAAE,MAAM,EAAmB,QAAQ,EAAE,kBAAkB,EAAE,OAAO,EAAE,gCAAgC;IAMnI,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,GAAG,IAAI;IAIlD;;;;;OAKG;IACH,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,GAAG,IAAI;IAWxE,SAAS,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,KAAK,IAAI,GAAG,MAAM,IAAI;IAKxE,6FAA6F;IAC7F,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,IAAI;CAMlD"}

package/dist/src/cohort-topic/cohort-gossip-transport.js

@@ -0,0 +1,57 @@
+import { peerIdFromString } from "@libp2p/peer-id";
+import { peerIdToBytes } from "./peer-codec.js";
+import { sendOneWay } from "./stream-util.js";
+import { PROTOCOL_COHORT_GOSSIP } from "./protocols.js";
+/**
+ * FRET-backed {@link ICohortGossipTransport}: intra-cohort gossip over
+ * `/optimystic/cohort-topic/1.0.0/cohort-gossip`. `broadcast` fans a frame out to the FRET-assembled
+ * cohort for `coord` (fire-and-forget, self excluded); inbound frames arrive through the host's gossip
+ * protocol handler, which calls {@link deliver}. Subscribers registered via `onMessage` see every
+ * delivered frame.
+ */
+export class FretCohortGossipTransport {
+    node;
+    resolver;
+    handlers = new Set();
+    gossipProtocol;
+    wants;
+    selfPeerId;
+    constructor(node, resolver, options) {
+        this.node = node;
+        this.resolver = resolver;
+        this.gossipProtocol = options.gossipProtocol ?? PROTOCOL_COHORT_GOSSIP;
+        this.wants = options.wants ?? 16;
+        this.selfPeerId = options.selfPeerId;
+    }
+    broadcast(coord, msg) {
+        this.broadcastOver(this.gossipProtocol, coord, msg);
+    }
+    /**
+     * Fan `msg` out to the FRET-assembled cohort for `coord` over an arbitrary one-way `protocol` (self
+     * excluded, fire-and-forget). Reuses the cohort peer resolution so the `promote` protocol's
+     * promotion/demotion notice broadcast shares the gossip transport's wiring; a single unreachable
+     * member is recovered by the cohort's next convergence round, so per-peer failures are swallowed.
+     */
+    broadcastOver(protocol, coord, msg) {
+        for (const peerStr of this.resolver.cohortPeers(coord, this.wants)) {
+            if (peerStr === this.selfPeerId) {
+                continue;
+            }
+            void sendOneWay(this.node, peerIdFromString(peerStr), protocol, msg).catch(() => {
+                // Best-effort: a single unreachable member is recovered by the next round.
+            });
+        }
+    }
+    onMessage(handler) {
+        this.handlers.add(handler);
+        return () => this.handlers.delete(handler);
+    }
+    /** Feed an inbound gossip frame (called by the host's `/cohort-gossip` protocol handler). */
+    deliver(fromPeerId, msg) {
+        const from = { id: peerIdToBytes(fromPeerId) };
+        for (const handler of this.handlers) {
+            handler(from, msg);
+        }
+    }
+}
+//# sourceMappingURL=cohort-gossip-transport.js.map

package/dist/src/cohort-topic/cohort-gossip-transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cohort-gossip-transport.js","sourceRoot":"","sources":["../../../src/cohort-topic/cohort-gossip-transport.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAgBxD;;;;;;GAMG;AACH,MAAM,OAAO,yBAAyB;IAMR;IAA+B;IAL3C,QAAQ,GAAG,IAAI,GAAG,EAA4C,CAAC;IAC/D,cAAc,CAAS;IACvB,KAAK,CAAS;IACd,UAAU,CAAS;IAEpC,YAA6B,IAAY,EAAmB,QAA4B,EAAE,OAAyC;QAAtG,SAAI,GAAJ,IAAI,CAAQ;QAAmB,aAAQ,GAAR,QAAQ,CAAoB;QACvF,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,sBAAsB,CAAC;QACvE,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACtC,CAAC;IAED,SAAS,CAAC,KAAgB,EAAE,GAAe;QAC1C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IAED;;;;;OAKG;IACH,aAAa,CAAC,QAAgB,EAAE,KAAgB,EAAE,GAAe;QAChE,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACpE,IAAI,OAAO,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;gBACjC,SAAS;YACV,CAAC;YACD,KAAK,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC/E,2EAA2E;YAC5E,CAAC,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,SAAS,CAAC,OAAiD;QAC1D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3B,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,6FAA6F;IAC7F,OAAO,CAAC,UAAkB,EAAE,GAAe;QAC1C,MAAM,IAAI,GAAY,EAAE,EAAE,EAAE,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACpB,CAAC;IACF,CAAC;CACD"}

package/dist/src/cohort-topic/fret-trust-anchor.d.ts

@@ -0,0 +1,100 @@
+/**
+ * Cohort-topic substrate — the **FRET-ring direct trust anchor** (db-p2p side of `IMembershipTrustAnchor`).
+ *
+ * `cohort-topic-trust-anchor-core` added the db-core trust gate (`membership/verifier.ts`): a (re)fetched
+ * `MembershipCertV1` is believed only if it is self-consistent **and** anchored by a trust root, the
+ * injected direct anchor, or the attestation chain — else it falls to interim trust-on-first-use. db-core
+ * ships only `noAuthorityTrustAnchor` (every coord `"unknown"`), so until db-p2p binds a real anchor the
+ * gate stays at TOFU. This module binds the **direct anchor** to the one coord→keyset authority FRET
+ * exposes today.
+ *
+ * **What authority FRET offers.** p2p-fret 0.5.0 has **no transferable stabilization proof** — there is no
+ * membership-cert/attestation API and the cert's `fretAttestation` field is never populated. The only
+ * coord→keyset authority FRET offers is `assembleCohort(coord, wants)` — the ring's two-sided closest-`k`
+ * selection — which is **local**: it answers correctly only for coords the node's routing table actually
+ * covers (coords the node is near / serves). That is exactly the amplification-exposed `promote`-handler
+ * path (`verifyAndApplyNotice` verifies against `target.servedCoord`, a coord the node serves), so binding
+ * the anchor to `assembleCohort` rejects the forged-cert attack precisely where the core ticket calls it out.
+ *
+ * **The rule (`directAnchor(cert, tier)`):**
+ *
+ * - **Committed tiers (T0/T1)** route to the tx-log commit certificate, not the FRET ring, so this anchor
+ *   returns `"unknown"` for them — it composes with (does not fight) the future tx-log anchor.
+ * - **No local authority** — the node cannot cover the coord (cold/partitioned table, or a distant coord the
+ *   node is nowhere near, so `assembleCohort` does not yield a populated neighborhood the node is part of) →
+ *   `"unknown"`. The db-core gate then falls through to the chain / interim TOFU, so distant verification is
+ *   never broken or falsely rejected.
+ * - **Covered coord** — compare the cert's **signing quorum** (`cert.signers`, the `≥ minSigs` that actually
+ *   signed) against the ring-expected cohort, widened by a small {@link FretTrustAnchorOptions.churnSlack} to
+ *   tolerate stabilization skew (membership stabilizes slightly behind the live ring):
+ *   - every signer is in the slack-widened ring view → `"anchored"`;
+ *   - the quorum is **disjoint** from the ring view (the ring says a wholly different cohort owns this coord)
+ *     → `"rejected"` (a forgery — fatal even though it is internally self-consistent);
+ *   - partial overlap beyond the slack (genuinely ambiguous within churn tolerance) → `"unknown"` (do not
+ *     over-reject on transient skew; defer to the chain / TOFU).
+ *
+ * **Why anchoring on `signers` (not exact member-set equality) is sound and sufficient.** A forged cert
+ * must sign its threshold multisig with keys the adversary controls; those keys are not in the legitimate
+ * ring cohort, so a forged quorum is disjoint from `assembleCohort(coord)` → `"rejected"`. A legitimate
+ * cert's signers are real cohort members — present in the ring view (within slack) → `"anchored"`. The
+ * adversary cannot list real members as `signers` without their keys (the message multisig would not
+ * verify), so the quorum-subset test has teeth without demanding brittle full-set equality across churn.
+ *
+ * **db-core never imports FRET.** This adapter lives in db-p2p and depends only on the narrow
+ * {@link FretRingView} (satisfied by `FretService`), keeping the db-core trust gate transport-agnostic.
+ */
+import type { IMembershipTrustAnchor, MembershipCertV1, TrustAnchorVerdict } from "@optimystic/db-core";
+/**
+ * The minimal slice of `FretService` the trust anchor needs: the ring's local two-sided cohort assembly
+ * around a coord, plus an optional partition signal. `FretService` satisfies it directly; a test (and the
+ * mock-mesh harness facade) can supply a stub with just `assembleCohort`.
+ */
+export interface FretRingView {
+    /** Two-sided closest-`wants` selection around `coord` from the node's routing table (peer-id strings). */
+    assembleCohort(coord: Uint8Array, wants: number, exclude?: Set<string>): string[];
+    /** Optional: `true` when the node believes it is partitioned (table unreliable → never reject). */
+    detectPartition?(): boolean;
+}
+/** Configuration for a {@link FretTrustAnchor}. */
+export interface FretTrustAnchorOptions {
+    /**
+     * Requested cohort size — must match the host's `wantK`, so the ring view the anchor computes lines up
+     * with the cohort the cohort-side `cohortAround` published the cert over.
+     */
+    readonly k: number;
+    /** This node's own peer-id string — used for the coverage check (the node must be in the coord's cohort). */
+    readonly selfPeerId: string;
+    /**
+     * Stabilization-skew slack: the ring-expected cohort is widened to `k + churnSlack` members before the
+     * quorum-subset test, so a legit cert whose signing quorum lags the live ring by a rotation or two is
+     * still `"anchored"`. Kept small so a disjoint forged keyset cannot hide in the slack. Default
+     * {@link DEFAULT_CHURN_SLACK}.
+     */
+    readonly churnSlack?: number;
+    /**
+     * Highest tier whose membership is anchored in the tx-log commit certificate (T0/T1), for which this
+     * FRET-ring anchor has no authority and returns `"unknown"`. Mirrors the membership-source dispatch
+     * (`createMembershipSourceRouter` treats tier 0/1 as committed). Default {@link DEFAULT_MAX_NO_POW_TIER}.
+     */
+    readonly maxCommittedTier?: number;
+}
+/**
+ * Default stabilization-skew slack (`churn_slack ≈ 2`): a legit cert may lag the live ring by ~1–2 members
+ * (one rotates in, one rotates out) between stabilization and the verifier's table view; widening to
+ * `k + 2` admits that skew while still rejecting a wholly-disjoint forged keyset.
+ */
+export declare const DEFAULT_CHURN_SLACK = 2;
+/**
+ * The FRET-ring {@link IMembershipTrustAnchor}: judges a cert's `coord → keyset` binding against the
+ * node's local FRET cohort assembly. See the module header for the full rule.
+ */
+export declare class FretTrustAnchor implements IMembershipTrustAnchor {
+    private readonly fret;
+    private readonly k;
+    private readonly selfPeerId;
+    private readonly churnSlack;
+    private readonly maxCommittedTier;
+    constructor(fret: FretRingView, options: FretTrustAnchorOptions);
+    directAnchor(cert: MembershipCertV1, tier: number): TrustAnchorVerdict;
+}
+//# sourceMappingURL=fret-trust-anchor.d.ts.map

package/dist/src/cohort-topic/fret-trust-anchor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fret-trust-anchor.d.ts","sourceRoot":"","sources":["../../../src/cohort-topic/fret-trust-anchor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,gBAAgB,EAAa,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAInH;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC5B,0GAA0G;IAC1G,cAAc,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;IAClF,mGAAmG;IACnG,eAAe,CAAC,IAAI,OAAO,CAAC;CAC5B;AAED,mDAAmD;AACnD,MAAM,WAAW,sBAAsB;IACtC;;;OAGG;IACH,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,6GAA6G;IAC7G,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACnC;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAErC;;;GAGG;AACH,qBAAa,eAAgB,YAAW,sBAAsB;IAMjD,OAAO,CAAC,QAAQ,CAAC,IAAI;IALjC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;gBAEb,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,sBAAsB;IAOhF,YAAY,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,GAAG,kBAAkB;CA0CtE"}

package/dist/src/cohort-topic/fret-trust-anchor.js

@@ -0,0 +1,115 @@
+/**
+ * Cohort-topic substrate — the **FRET-ring direct trust anchor** (db-p2p side of `IMembershipTrustAnchor`).
+ *
+ * `cohort-topic-trust-anchor-core` added the db-core trust gate (`membership/verifier.ts`): a (re)fetched
+ * `MembershipCertV1` is believed only if it is self-consistent **and** anchored by a trust root, the
+ * injected direct anchor, or the attestation chain — else it falls to interim trust-on-first-use. db-core
+ * ships only `noAuthorityTrustAnchor` (every coord `"unknown"`), so until db-p2p binds a real anchor the
+ * gate stays at TOFU. This module binds the **direct anchor** to the one coord→keyset authority FRET
+ * exposes today.
+ *
+ * **What authority FRET offers.** p2p-fret 0.5.0 has **no transferable stabilization proof** — there is no
+ * membership-cert/attestation API and the cert's `fretAttestation` field is never populated. The only
+ * coord→keyset authority FRET offers is `assembleCohort(coord, wants)` — the ring's two-sided closest-`k`
+ * selection — which is **local**: it answers correctly only for coords the node's routing table actually
+ * covers (coords the node is near / serves). That is exactly the amplification-exposed `promote`-handler
+ * path (`verifyAndApplyNotice` verifies against `target.servedCoord`, a coord the node serves), so binding
+ * the anchor to `assembleCohort` rejects the forged-cert attack precisely where the core ticket calls it out.
+ *
+ * **The rule (`directAnchor(cert, tier)`):**
+ *
+ * - **Committed tiers (T0/T1)** route to the tx-log commit certificate, not the FRET ring, so this anchor
+ *   returns `"unknown"` for them — it composes with (does not fight) the future tx-log anchor.
+ * - **No local authority** — the node cannot cover the coord (cold/partitioned table, or a distant coord the
+ *   node is nowhere near, so `assembleCohort` does not yield a populated neighborhood the node is part of) →
+ *   `"unknown"`. The db-core gate then falls through to the chain / interim TOFU, so distant verification is
+ *   never broken or falsely rejected.
+ * - **Covered coord** — compare the cert's **signing quorum** (`cert.signers`, the `≥ minSigs` that actually
+ *   signed) against the ring-expected cohort, widened by a small {@link FretTrustAnchorOptions.churnSlack} to
+ *   tolerate stabilization skew (membership stabilizes slightly behind the live ring):
+ *   - every signer is in the slack-widened ring view → `"anchored"`;
+ *   - the quorum is **disjoint** from the ring view (the ring says a wholly different cohort owns this coord)
+ *     → `"rejected"` (a forgery — fatal even though it is internally self-consistent);
+ *   - partial overlap beyond the slack (genuinely ambiguous within churn tolerance) → `"unknown"` (do not
+ *     over-reject on transient skew; defer to the chain / TOFU).
+ *
+ * **Why anchoring on `signers` (not exact member-set equality) is sound and sufficient.** A forged cert
+ * must sign its threshold multisig with keys the adversary controls; those keys are not in the legitimate
+ * ring cohort, so a forged quorum is disjoint from `assembleCohort(coord)` → `"rejected"`. A legitimate
+ * cert's signers are real cohort members — present in the ring view (within slack) → `"anchored"`. The
+ * adversary cannot list real members as `signers` without their keys (the message multisig would not
+ * verify), so the quorum-subset test has teeth without demanding brittle full-set equality across churn.
+ *
+ * **db-core never imports FRET.** This adapter lives in db-p2p and depends only on the narrow
+ * {@link FretRingView} (satisfied by `FretService`), keeping the db-core trust gate transport-agnostic.
+ */
+import { b64urlToBytes, DEFAULT_MAX_NO_POW_TIER } from "@optimystic/db-core";
+import { bytesToPeerIdString } from "./peer-codec.js";
+/**
+ * Default stabilization-skew slack (`churn_slack ≈ 2`): a legit cert may lag the live ring by ~1–2 members
+ * (one rotates in, one rotates out) between stabilization and the verifier's table view; widening to
+ * `k + 2` admits that skew while still rejecting a wholly-disjoint forged keyset.
+ */
+export const DEFAULT_CHURN_SLACK = 2;
+/**
+ * The FRET-ring {@link IMembershipTrustAnchor}: judges a cert's `coord → keyset` binding against the
+ * node's local FRET cohort assembly. See the module header for the full rule.
+ */
+export class FretTrustAnchor {
+    fret;
+    k;
+    selfPeerId;
+    churnSlack;
+    maxCommittedTier;
+    constructor(fret, options) {
+        this.fret = fret;
+        this.k = options.k;
+        this.selfPeerId = options.selfPeerId;
+        this.churnSlack = options.churnSlack ?? DEFAULT_CHURN_SLACK;
+        this.maxCommittedTier = options.maxCommittedTier ?? DEFAULT_MAX_NO_POW_TIER;
+    }
+    directAnchor(cert, tier) {
+        // Committed tiers (T0/T1) are the tx-log anchor's job, not the FRET ring's — defer.
+        if (tier <= this.maxCommittedTier) {
+            return "unknown";
+        }
+        try {
+            // A partitioned table is unreliable: never reject a legit cert during a partition — defer to TOFU.
+            if (this.fret.detectPartition?.() === true) {
+                return "unknown";
+            }
+            const coord = b64urlToBytes(cert.cohortCoord);
+            const expected = this.fret.assembleCohort(coord, this.k);
+            // Coverage / local authority: a populated neighborhood the node is itself part of. A cold or
+            // partitioned table yields `< k`; a distant coord the node is nowhere near omits self. Either way
+            // the node cannot judge → `"unknown"` (no regression on coords nothing can anchor).
+            if (expected.length < this.k || !expected.includes(this.selfPeerId)) {
+                return "unknown";
+            }
+            const widened = new Set(this.fret.assembleCohort(coord, this.k + this.churnSlack));
+            // Decode the cert's signing quorum into FRET peer-id strings (the same form `assembleCohort` yields).
+            const signers = cert.signers.map((s) => bytesToPeerIdString(b64urlToBytes(s)));
+            if (signers.length === 0) {
+                return "unknown"; // nothing to judge (a self-consistent cert always has signers; defensive)
+            }
+            let inRing = 0;
+            for (const signer of signers) {
+                if (widened.has(signer)) {
+                    inRing++;
+                }
+            }
+            if (inRing === signers.length) {
+                return "anchored"; // the whole signing quorum is a subset of a reasonable ring view
+            }
+            if (inRing === 0) {
+                return "rejected"; // a wholly-disjoint quorum — the ring knows a different cohort owns this coord
+            }
+            return "unknown"; // partial overlap beyond the slack — ambiguous churn; defer rather than over-reject
+        }
+        catch {
+            // Any decode failure on attacker-supplied bytes → the ring cannot judge it. Total, never throws.
+            return "unknown";
+        }
+    }
+}
+//# sourceMappingURL=fret-trust-anchor.js.map

package/dist/src/cohort-topic/fret-trust-anchor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fret-trust-anchor.js","sourceRoot":"","sources":["../../../src/cohort-topic/fret-trust-anchor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAGH,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAsCtD;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC;;;GAGG;AACH,MAAM,OAAO,eAAe;IAME;IALZ,CAAC,CAAS;IACV,UAAU,CAAS;IACnB,UAAU,CAAS;IACnB,gBAAgB,CAAS;IAE1C,YAA6B,IAAkB,EAAE,OAA+B;QAAnD,SAAI,GAAJ,IAAI,CAAc;QAC9C,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;QACnB,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;QAC5D,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,uBAAuB,CAAC;IAC7E,CAAC;IAED,YAAY,CAAC,IAAsB,EAAE,IAAY;QAChD,oFAAoF;QACpF,IAAI,IAAI,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACnC,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,IAAI,CAAC;YACJ,mGAAmG;YACnG,IAAI,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,KAAK,IAAI,EAAE,CAAC;gBAC5C,OAAO,SAAS,CAAC;YAClB,CAAC;YACD,MAAM,KAAK,GAAc,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YACzD,6FAA6F;YAC7F,kGAAkG;YAClG,oFAAoF;YACpF,IAAI,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBACrE,OAAO,SAAS,CAAC;YAClB,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YACnF,sGAAsG;YACtG,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,OAAO,SAAS,CAAC,CAAC,0EAA0E;YAC7F,CAAC;YACD,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACzB,MAAM,EAAE,CAAC;gBACV,CAAC;YACF,CAAC;YACD,IAAI,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC/B,OAAO,UAAU,CAAC,CAAC,iEAAiE;YACrF,CAAC;YACD,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClB,OAAO,UAAU,CAAC,CAAC,+EAA+E;YACnG,CAAC;YACD,OAAO,SAAS,CAAC,CAAC,oFAAoF;QACvG,CAAC;QAAC,MAAM,CAAC;YACR,iGAAiG;YACjG,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;CACD"}