@quo-systems/quo 0.1.0

package/src/harbor/store.ts

@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: Apache-2.0
+// The store: keeping wards by name. A ward is three things and the store
+// keeps all three under one name: the seed, the partition and the ward
+// record, which says where the class bodies come from and which being is
+// the user's. Plus the directory's hints, which are the harbor's and
+// survive a restart. The store reads nothing it keeps; the partition is
+// values the ward wrote, and the seed is bytes only the ward derives from.
+// Every terrain has one: files on a disk, IndexedDB in a tab, an object's
+// storage on the edge; the memory store below is the library's own, for a
+// harbor core with no device under it. `src/conformance/store.ts` is what
+// every one of them passes.
+export type WardRecord = { pk: string; code: string; user: string };
+export type Kept = { seed: Uint8Array; partition: Record<string, unknown>; record: WardRecord };
+
+export type Store = {
+  list(): Promise<string[]>;
+  load(name: string): Promise<Kept | undefined>;
+  // Keep all three under the name; a name already kept is refused.
+  put(name: string, kept: Kept): Promise<void>;
+  // The partition back, after a call; the record back, after a boot learned
+  // the pk. A name not kept is nothing, on both.
+  save(name: string, partition: Record<string, unknown>): Promise<void>;
+  record(name: string, record: WardRecord): Promise<void>;
+  // Take a ward out: the first move of a migration. What was kept comes back.
+  take(name: string): Promise<Kept | undefined>;
+  hints(): Promise<Record<string, string>>;
+  hint(pk: string, url: string): Promise<void>;
+};
+
+// The partition is values only, and the ward hands it out through a guard,
+// so a store takes a copy of the values the way a file would: through JSON.
+export const values = (p: Record<string, unknown>): Record<string, unknown> => JSON.parse(JSON.stringify(p)) as Record<string, unknown>;
+
+// The store as a map, one process, nothing kept past it.
+export class MemoryStore implements Store {
+  readonly rows = new Map<string, Kept>();
+  readonly reach = new Map<string, string>();
+
+  async list(): Promise<string[]> {
+    return [...this.rows.keys()];
+  }
+  async load(name: string): Promise<Kept | undefined> {
+    const row = this.rows.get(name);
+    return row && { seed: new Uint8Array(row.seed), partition: values(row.partition), record: { ...row.record } };
+  }
+  async put(name: string, kept: Kept): Promise<void> {
+    if (this.rows.has(name)) throw new Error(`ward ${name} already exists here`);
+    this.rows.set(name, { seed: new Uint8Array(kept.seed), partition: values(kept.partition), record: { ...kept.record } });
+  }
+  async save(name: string, partition: Record<string, unknown>): Promise<void> {
+    const row = this.rows.get(name);
+    if (row) row.partition = values(partition);
+  }
+  async record(name: string, record: WardRecord): Promise<void> {
+    const row = this.rows.get(name);
+    if (row) row.record = { ...record };
+  }
+  async take(name: string): Promise<Kept | undefined> {
+    const kept = await this.load(name);
+    this.rows.delete(name);
+    return kept;
+  }
+  async hints(): Promise<Record<string, string>> {
+    return Object.fromEntries(this.reach);
+  }
+  async hint(pk: string, url: string): Promise<void> {
+    this.reach.set(pk, url);
+  }
+}

package/src/ward/allowance.ts

@@ -0,0 +1,74 @@
+// SPDX-License-Identifier: Apache-2.0
+// The allowance. Every ask carries, in its signed body, the time it may still
+// spend, in milliseconds. A being who says nothing gets her ward's default and
+// never thinks about it; one who wants to say so passes a third argument, and
+// is held to the ward's ceiling. The door reads it before anything is done
+// under it and refuses a budget already gone, as one silence like every other
+// refusal there. The sender bounds the whole of her ask to the same number,
+// and a wait that ran out is silence, never unreached.
+//
+// Each ask is bounded on its own. The time an arriving call has left does not
+// bound the asks a being makes while answering it: attributing her onward ask
+// to the arrival that caused it needs a context the ward cannot get without
+// naming a runtime, and the ward names none. Every wait still ends.
+
+// What a being may ask for is Wanted, and it belongs to the stance, where she
+// reads it. This file holds only what the ward does with it.
+import type { Wanted } from '../being/types.ts';
+
+// A budget, as it crosses a door. Time in milliseconds.
+export type Allowance = { time: number };
+
+// How wide the default is, and how wide she may ask for, are the ward's own —
+// wider is more patient, and no peer can tell the difference except by being
+// refused. A being who never learns the third parameter exists writes correct
+// code forever under these. They are two numbers because the third argument
+// goes both ways: less for the ask she wants back quickly, more for the one
+// she knows is slow.
+export const DEFAULT: Allowance = { time: 30_000 };
+export const CEILING: Allowance = { time: 300_000 };
+
+// What she asked for, held to what her ward allows. A being cannot mint budget
+// nobody granted her: asking for a minute where the ward gives thirty seconds
+// is thirty seconds, silently, because the ceiling is not hers to know.
+// Asking for nothing at all is the default, which is the whole point.
+export function allow(wanted: Wanted | undefined, ceiling: Allowance = CEILING, base: Allowance = DEFAULT): Allowance {
+  const whole = (n: unknown, fallback: number) => (typeof n === 'number' && Number.isFinite(n) && n > 0 ? Math.floor(n) : fallback);
+  return { time: Math.min(whole(wanted?.time, base.time), ceiling.time) };
+}
+
+// Whether a budget has anything left to spend. A door reads this on arrival.
+export const spent = (a: Allowance): boolean => !(a.time > 0);
+
+// What a wait that ran out comes back as. Its own value, held by nobody
+// outside the ward, so no answer from any door can be mistaken for it.
+export const LATE = Symbol('late');
+
+// A wait with an end. This is the one thing the ward times, and it covers the
+// whole of an ask, not only the wire: a relation that comes back round is
+// stopped at its own lane, before a single byte is sealed, and a bound that
+// only watched the wire would never see it. A timer is the only way to stop
+// waiting and every language that runs Quo has one; no runtime is named here.
+//
+// `rang` is called the moment the bell rings, before anyone waiting on the
+// wait is told: whoever holds work that has not started yet reads it and does
+// not start it. What comes back late is not read, and what has not left yet
+// does not leave.
+export async function within<T>(ms: number, work: Promise<T>, rang?: () => void): Promise<T | typeof LATE> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const bell = new Promise<typeof LATE>((ring) => {
+    timer = setTimeout(() => {
+      rang?.();
+      ring(LATE);
+    }, ms);
+  });
+  try {
+    return await Promise.race([work, bell]);
+  } finally {
+    clearTimeout(timer);
+    void work.then(
+      () => {},
+      () => {},
+    ); // whatever it was, it is nobody's answer now
+  }
+}

package/src/ward/arithmetic.ts

@@ -0,0 +1,161 @@
+// SPDX-License-Identifier: Apache-2.0
+// Four algorithms, named once and never negotiated: Ed25519 signs, X25519
+// agrees, SHA-256 hashes, AES-256-GCM encrypts with the key derived through
+// HKDF-SHA-256 under a fixed label. All four live in `crypto.subtle`, so this
+// takes no package and runs the same in a browser tab as on a server -- on
+// any terrain that carries them. SHA-256, AES-GCM and HKDF are everywhere;
+// the two curves are recent, and a terrain without them is a terrain no ward
+// runs on. `test/floor.test.ts` names the floor and probes for it. Subtle is
+// asynchronous, so everything here is.
+//
+// Ported from an earlier kit's arithmetic. Same bytes, same vectors.
+// `crypto.subtle` is read at every use and never captured at load. A browser
+// on a plain http:// origin has `crypto` without `subtle`, and a terrain may
+// install one after this module is first imported; a reference taken here
+// would turn either into an unreadable failure deep inside a key import.
+const subtle = (): SubtleCrypto => {
+  const s = globalThis.crypto?.subtle;
+  if (!s) throw new Error('this terrain has no crypto.subtle: a ward needs a secure context');
+  return s;
+};
+
+export const KEY = 32;
+export const SIGNATURE = 64;
+export const NONCE = 12;
+export const TAG = 16;
+const SEAL_INFO = new TextEncoder().encode('quo-seal');
+const SEAL_SALT = new Uint8Array(0);
+
+// A 32-byte secret plus a fixed prefix is the whole PKCS#8 wrapping for both curves.
+const ED_SECRET = unhex('302e020100300506032b657004220420');
+const X_SECRET = unhex('302e020100300506032b656e04220420');
+const ED = { name: 'Ed25519' };
+const X = { name: 'X25519' };
+
+const HEX = Array.from({ length: 256 }, (_, at) => at.toString(16).padStart(2, '0'));
+export function hex(bytes: Uint8Array | ArrayBuffer): string {
+  let out = '';
+  for (const byte of new Uint8Array(bytes)) out += HEX[byte];
+  return out;
+}
+export function unhex(text: string): Uint8Array {
+  const out = new Uint8Array(text.length / 2);
+  for (let at = 0; at < out.length; at += 1) out[at] = parseInt(text.slice(at * 2, at * 2 + 2), 16);
+  return out;
+}
+export function concat(parts: Uint8Array[]): Uint8Array {
+  const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+  let at = 0;
+  for (const part of parts) {
+    out.set(part, at);
+    at += part.length;
+  }
+  return out;
+}
+export function sameBytes(a: Uint8Array, b: Uint8Array): boolean {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let at = 0; at < a.length; at += 1) diff |= a[at] ^ b[at];
+  return diff === 0;
+}
+
+// The eight small-order points. A public key among them verifies nothing.
+const SMALL_ORDER = [
+  '0100000000000000000000000000000000000000000000000000000000000000',
+  'ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f',
+  '0000000000000000000000000000000000000000000000000000000000000000',
+  '0000000000000000000000000000000000000000000000000000000000000080',
+  '26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05',
+  'c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a',
+  '26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc85',
+  'c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa',
+].map(unhex);
+export const smallOrder = (pk: Uint8Array): boolean => SMALL_ORDER.some((p) => sameBytes(p, pk));
+
+const key32 = (value: Uint8Array, what: string): Uint8Array => {
+  if (!(value instanceof Uint8Array) || value.length !== KEY) throw new Error(`${what} is not a 32-byte key`);
+  return value;
+};
+const pkcs8 = (prefix: Uint8Array, value: Uint8Array, what: string) => concat([prefix, key32(value, what)]);
+const secretKey = (alg: { name: string }, prefix: Uint8Array, value: Uint8Array, what: string, uses: KeyUsage[]) =>
+  subtle().importKey('pkcs8', pkcs8(prefix, value, what) as BufferSource, alg, true, uses);
+const publicKey = (alg: { name: string }, value: Uint8Array, what: string, uses: KeyUsage[]) =>
+  subtle().importKey('raw', key32(value, what) as BufferSource, alg, true, uses);
+
+// Subtle exports the public half of a private key only through a JWK, where `x` is the 32 raw bytes in base64url.
+async function rawPublic(secret: CryptoKey): Promise<Uint8Array> {
+  const jwk = await subtle().exportKey('jwk', secret);
+  const binary = atob(jwk.x!.replaceAll('-', '+').replaceAll('_', '/'));
+  const out = new Uint8Array(binary.length);
+  for (let at = 0; at < binary.length; at += 1) out[at] = binary.charCodeAt(at);
+  return out;
+}
+
+export async function sha256(...parts: Uint8Array[]): Promise<Uint8Array> {
+  return new Uint8Array(await subtle().digest('SHA-256', concat(parts) as BufferSource));
+}
+
+export type Pair = { secret: Uint8Array; pk: Uint8Array };
+export async function signingPair(seed: Uint8Array): Promise<Pair> {
+  const secret = await secretKey(ED, ED_SECRET, seed, 'seed', ['sign']);
+  return { secret: Uint8Array.from(seed), pk: await rawPublic(secret) };
+}
+export async function sealingPair(seed: Uint8Array): Promise<Pair> {
+  const secret = await secretKey(X, X_SECRET, seed, 'seed', ['deriveBits']);
+  return { secret: Uint8Array.from(seed), pk: await rawPublic(secret) };
+}
+
+export async function sign(message: Uint8Array, secret: Uint8Array): Promise<Uint8Array> {
+  const key = await secretKey(ED, ED_SECRET, secret, 'secret', ['sign']);
+  return new Uint8Array(await subtle().sign(ED, key, message as BufferSource));
+}
+export async function verify(message: Uint8Array, signature: Uint8Array, pk: Uint8Array): Promise<boolean> {
+  if (!(signature instanceof Uint8Array) || signature.length !== SIGNATURE) return false;
+  if (!(pk instanceof Uint8Array) || pk.length !== KEY || smallOrder(pk)) return false;
+  try {
+    return await subtle().verify(ED, await publicKey(ED, pk, 'pk', ['verify']), signature as BufferSource, message as BufferSource);
+  } catch {
+    return false;
+  }
+}
+
+export async function agree(secret: Uint8Array, peerPk: Uint8Array): Promise<Uint8Array> {
+  const key = await secretKey(X, X_SECRET, secret, 'secret', ['deriveBits']);
+  const peer = await publicKey(X, peerPk, 'padlock', []);
+  const shared = new Uint8Array(await subtle().deriveBits({ name: X.name, public: peer }, key, KEY * 8));
+  if (shared.every((b) => b === 0)) throw new Error('dead agreement'); // a padlock that was not a real key
+  return shared;
+}
+
+// One HKDF-SHA-256 yields the AES key and the nonce together. The nonce needs
+// no randomness of its own: the key it pairs with is fresh on every message.
+async function cipherKey(shared: Uint8Array, use: KeyUsage) {
+  const material = await subtle().importKey('raw', shared as BufferSource, 'HKDF', false, ['deriveBits']);
+  const out = new Uint8Array(await subtle().deriveBits({ name: 'HKDF', hash: 'SHA-256', salt: SEAL_SALT, info: SEAL_INFO }, material, (KEY + NONCE) * 8));
+  return { key: await subtle().importKey('raw', out.subarray(0, KEY) as BufferSource, 'AES-GCM', false, [use]), nonce: out.subarray(KEY) };
+}
+// The additional authenticated data is the ephemeral public key: the one thing outside the seal, bound to it.
+export async function encrypt(shared: Uint8Array, plaintext: Uint8Array, aad: Uint8Array): Promise<Uint8Array> {
+  const { key, nonce } = await cipherKey(shared, 'encrypt');
+  return new Uint8Array(await subtle().encrypt({ name: 'AES-GCM', iv: nonce, additionalData: key32(aad, 'aad') as BufferSource, tagLength: TAG * 8 }, key, plaintext as BufferSource));
+}
+export async function decrypt(shared: Uint8Array, ciphertext: Uint8Array, aad: Uint8Array): Promise<Uint8Array> {
+  if (ciphertext.length < TAG) throw new Error('short input');
+  const { key, nonce } = await cipherKey(shared, 'decrypt');
+  return new Uint8Array(await subtle().decrypt({ name: 'AES-GCM', iv: nonce, additionalData: key32(aad, 'aad') as BufferSource, tagLength: TAG * 8 }, key, ciphertext as BufferSource));
+}
+
+// A box: an ephemeral X25519 pk outside, one ciphertext sealed to the
+// padlock. The answer to a box is a box sealed to that ephemeral pk, so the
+// sender keeps the ephemeral secret until the answer comes.
+export async function box(inside: Uint8Array, padlock: Uint8Array, seed: Uint8Array): Promise<{ bytes: Uint8Array; ephemeral: Pair }> {
+  const ephemeral = await sealingPair(seed);
+  const shared = await agree(ephemeral.secret, padlock);
+  return { bytes: concat([ephemeral.pk, await encrypt(shared, inside, ephemeral.pk)]), ephemeral };
+}
+export async function unbox(bytes: Uint8Array, padlockSecret: Uint8Array): Promise<Uint8Array> {
+  if (bytes.length <= KEY) throw new Error('short input');
+  const ephemeralPk = bytes.subarray(0, KEY);
+  const shared = await agree(padlockSecret, ephemeralPk);
+  return decrypt(shared, bytes.subarray(KEY), ephemeralPk);
+}

package/src/ward/cells.ts

@@ -0,0 +1,90 @@
+// SPDX-License-Identifier: Apache-2.0
+// Cells hold values, and nothing else. The partition promises a harbor it may
+// persist a being's cells as it likes: as this process's objects, as a row, as
+// a line of JSON on a disk. That promise is only worth what the cells honour.
+//
+// Nothing checked it. A being could write a Map, a Date, an undefined, a NaN.
+// In a memory harbor the object survives, because there is nowhere for it to
+// go and come back from. Through any harbor that keeps values it silently
+// becomes {}, or a string, or absent, or null — and she is never told which
+// harbor she is standing in. That is the memory harbor lying to her, which is
+// the one thing it must never do.
+//
+// So the cells refuse the write. Loud, where she wrote it, in her own frame:
+// a being holds three answers and a throw is not one of them, so this throw
+// lands inside her method and the door turns it into the silence it already
+// turns every throw into. She has not answered, and nothing was written down
+// that a harbor would have to lie about later.
+import type { Cells, Json } from '../being/types.ts';
+
+// I-JSON, all the way down. A number that JSON cannot write is not a number
+// a harbor can keep, and a key on the prototype is not a key she wrote.
+function fault(v: unknown, path: string, seen: Set<object>): string | null {
+  if (v === null || typeof v === 'boolean' || typeof v === 'string') return null;
+  if (typeof v === 'number') return Number.isFinite(v) ? null : `${path} is ${String(v)}, which no harbor can write down`;
+  if (typeof v !== 'object') return `${path} is a ${typeof v}, which is not a value`;
+  if (seen.has(v)) return `${path} refers back to itself`;
+  seen.add(v);
+  try {
+    if (Array.isArray(v)) {
+      for (let i = 0; i < v.length; i += 1) {
+        const f = fault(v[i], `${path}[${i}]`, seen);
+        if (f) return f;
+      }
+      return null;
+    }
+    const proto = Object.getPrototypeOf(v);
+    if (proto !== Object.prototype && proto !== null) return `${path} is a ${(v).constructor?.name ?? 'object'}, which is not a value`;
+    for (const k of Object.keys(v)) {
+      const f = fault((v as Record<string, unknown>)[k], `${path}.${k}`, seen);
+      if (f) return f;
+    }
+    return null;
+  } finally {
+    seen.delete(v);
+  }
+}
+
+export const cellFault = (v: unknown, path: string): string | null => fault(v, path, new Set());
+
+// The guard is one proxy at the root and one for every container read through
+// it, so a write nested three deep is refused the same way a write at the top
+// is. Wrappers are remembered, so reading the same array twice is the same
+// object twice and a being may still compare what she holds.
+const wrapped = new WeakMap<object, object>();
+const guards = new WeakSet();
+
+function guard<T extends object>(target: T, path: string): T {
+  if (guards.has(target)) return target;
+  const had = wrapped.get(target);
+  if (had) return had as T;
+  const p = new Proxy(target, {
+    get(t, k, r) {
+      const v = Reflect.get(t, k, r);
+      // A container reached through her cells is part of her cells.
+      return v !== null && typeof v === 'object' && !ArrayBuffer.isView(v) ? guard(v as object, `${path}.${String(k)}`) : v;
+    },
+    set(t, k, v, r) {
+      if (typeof k === 'string') {
+        const f = cellFault(v, `${path}.${k}`);
+        if (f) throw new TypeError(`cells hold values: ${f}`);
+      }
+      return Reflect.set(t, k, v, r);
+    },
+    defineProperty(t, k, d) {
+      if (typeof k === 'string' && 'value' in d) {
+        const f = cellFault(d.value, `${path}.${k}`);
+        if (f) throw new TypeError(`cells hold values: ${f}`);
+      }
+      return Reflect.defineProperty(t, k, d);
+    },
+  });
+  wrapped.set(target, p);
+  guards.add(p);
+  return p;
+}
+
+// Her cells, guarded. Called once per being at boot; the guarded object is
+// what goes into the partition and what the stance hands her, so there is no
+// second door onto the same cells.
+export const guardCells = (cells: Cells): Cells => guard(cells as unknown as Record<string, Json>, 'cells') as unknown as Cells;

package/src/ward/door.ts

@@ -0,0 +1,102 @@
+// SPDX-License-Identifier: Apache-2.0
+// Judgment at the door. Sealed bytes in, sealed bytes out. Every failure is
+// one silence, sealed to whoever asked so that a stranger learns nothing,
+// not even which case they hit. What passes is named and dispatched to her
+// answer, and her digest for that asker rides back with the object.
+import { isSilence, isUnreached } from '../being/silence.ts';
+import { digest } from '../being/digest.ts';
+import type { Asker, BeingLike, JsonObject } from '../being/types.ts';
+import { at } from './partition.ts';
+import type { Heirs } from './heirs.ts';
+import { openAsk, sealReply, verifyAsk, type ReplyPayload, type WardKey } from './seal.ts';
+import { spent } from './allowance.ts';
+import { KEY, sealingPair } from './arithmetic.ts';
+
+export type Door = { key: string; being: BeingLike; cells: { occupants: Record<string, unknown> } };
+const SILENCE: ReplyPayload = { silence: true };
+
+// One arrival at one being, already named. Catches every throw.
+export async function arrive(door: Door, asker: Asker, method: string | undefined, args: JsonObject): Promise<ReplyPayload> {
+  let out: Awaited<ReturnType<BeingLike['answer']>>;
+  try {
+    out = await door.being.answer(asker, method, args);
+  } catch {
+    return SILENCE; // she threw where she was asked. there is no answer.
+  }
+  // Nothing at all is not an answer either: a method that forgot to return
+  // has said nothing, and nothing is silence, never a value that JSON drops
+  // on the way out and the far side reads back as a fourth word.
+  if (out === undefined || isSilence(out) || isUnreached(out)) return SILENCE;
+  if (method === undefined) return { object: out, seen: null };
+  // The digest rides along, it is not the answer. She has already answered:
+  // a describe that will not run costs the digest, and nothing else.
+  return { object: out, seen: await seen(door, asker) };
+}
+
+async function seen(door: Door, asker: Asker): Promise<string | null> {
+  try {
+    const bp = await door.being.answer(asker);
+    return isSilence(bp) || isUnreached(bp) ? null : await digest(bp);
+  } catch {
+    return null;
+  }
+}
+
+export function makeDoor(key: WardKey, heirs: Heirs, doors: Map<string, Door>, publicKey: () => string | null, random: (n: number) => Uint8Array) {
+  const judge = async (bytes: Uint8Array): Promise<{ reply: ReplyPayload; ephemeralPk: Uint8Array } | null> => {
+    const a = await openAsk(bytes, key.padlock);
+    if (!a) return null; // it did not open. there is nobody to answer.
+    const { to, payload, ephemeralPk } = a;
+    // The allowance, read before anything is done under it. A budget already
+    // gone is one silence like every other refusal here: a stranger learns
+    // nothing, not even that what she ran out of was time. Nothing is spent
+    // and nothing rotates, because nothing was heard.
+    if (spent({ time: payload.time })) return { reply: SILENCE, ephemeralPk };
+    // An ask with no doors left is one silence like a budget already gone.
+    // Nothing sets hops and nothing decrements it yet; this door refuses zero
+    // so that a relay chain invented later meets doors that already stop it.
+    if (payload.hops === 0) return { reply: SILENCE, ephemeralPk };
+    const args = payload.args ?? {};
+    if (to === null) {
+      const pk = publicKey();
+      const pub = pk !== null ? doors.get(pk) : undefined;
+      if (!pub || !(await verifyAsk(a, payload.by))) return { reply: SILENCE, ephemeralPk };
+      return { reply: await arrive(pub, {}, payload.method, args), ephemeralPk };
+    }
+    const h = heirs.admits(to, payload.by);
+    if (!h) return { reply: SILENCE, ephemeralPk };
+    const door = doors.get(h.being);
+    if (!door || !at(door.cells.occupants, h.id)) return { reply: SILENCE, ephemeralPk }; // she removed it, or she is gone
+    if (!(await verifyAsk(a, payload.by))) return { reply: SILENCE, ephemeralPk };
+    // Once only, and only now: the number is spent after the signature, so a
+    // stranger cannot burn a number she could not sign for, and together with
+    // the keys, so the same bytes twice rotate nothing and refusal writes nothing.
+    if (!heirs.honour(h, payload.by, payload.next, payload.seq)) return { reply: SILENCE, ephemeralPk };
+    return { reply: await arrive(door, { id: h.id }, payload.method, args), ephemeralPk };
+  };
+
+  // The door itself. Always answers bytes. When the ask did not open, the
+  // reply is sealed to the ephemeral pk on its lid, which is all a stranger
+  // holds, and says silence.
+  //
+  // A lid that is not a key -- a small-order point, of which the two curves
+  // have several each -- makes a dead agreement, and the seal refuses it. The
+  // door never throws: that reply is noise, sealed to a key nobody holds.
+  return async function door(bytes: Uint8Array): Promise<Uint8Array> {
+    const out = await judge(bytes);
+    const reply = out?.reply ?? SILENCE;
+    try {
+      return await sealReply(reply, out?.ephemeralPk ?? lid(bytes, random), key.sign, random(32));
+    } catch {
+      return sealReply(reply, (await sealingPair(random(32))).pk, key.sign, random(32));
+    }
+  };
+}
+
+// The ephemeral pk on an ask that would not open, if the bytes are long
+// enough to carry one. Otherwise a fresh key nobody holds: the reply is
+// bytes, and it is noise.
+function lid(bytes: Uint8Array, random: (n: number) => Uint8Array): Uint8Array {
+  if (bytes instanceof Uint8Array && bytes.length >= KEY) return bytes.subarray(0, KEY);
+  return random(KEY);
+}

package/src/ward/ground.ts

@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: Apache-2.0
+// The ground. The one object a harbor passes a ward at birth. Five things,
+// never a sixth. Everything a runtime differs on arrives here, which is
+// why the ward itself knows no runtime.
+import type { Stance, BeingLike } from '../being/types.ts';
+
+export type Ground = {
+  seed: string | Uint8Array; // the ward derives its pk from it and nothing else
+  memory: Record<string, unknown>; // the partition. the ward's files. opaque to the harbor
+  instantiate(className: string, stance: Stance): BeingLike | null; // the code half
+  // Sealed bytes to a ward pk. What comes back, or undefined.
+  //
+  // undefined is a promise, not a shrug: no door was reached, and nothing was
+  // delivered. The ward hands it to a being as unreached, which is the one
+  // answer that says asking again is safe, so a harbor may only return it
+  // when it knows the bytes never arrived — no reach for that pk, a socket
+  // that would not open, a link that is down.
+  //
+  // A harbor that sent the bytes and then gave up waiting knows no such
+  // thing: the far door may have heard and be working still. It must not
+  // answer at all in that case. The ward bounds every ask itself, and an
+  // answer that never comes is silence, which promises nothing. So a harbor
+  // may hold a shorter patience than the ward's for its own reasons — a
+  // socket it wants back, a queue it will not grow — and the two bounds never
+  // need to read each other: whichever ends first ends the ask, and each says
+  // only what it can honestly say.
+  carry(pk: string, bytes: Uint8Array): Promise<Uint8Array | undefined>;
+  random(n: number): Uint8Array; // entropy. every key a ward mints is drawn from it
+};
+
+// What a ward hands back. Two pointers.
+export type WardPointers = {
+  door(bytes: Uint8Array): Promise<Uint8Array>;
+  ask(method?: string, args?: Record<string, unknown>): Promise<unknown>;
+};

package/src/ward/heirs.ts

@@ -0,0 +1,87 @@
+// SPDX-License-Identifier: Apache-2.0
+// Heirs. The door's view of every occupant of every being in the ward, by
+// the heir pk the invitation carried. One rule: the key I hold for you may
+// speak, and so may the key it announced last time. A knock is the first
+// use of the heir, which the inviter announced on your behalf, and the heir
+// dies as it speaks.
+import type { Heir, Partition } from './partition.ts';
+
+// How wide the span is, is the ward's own — wider is more forgiving of a
+// rough road, and no peer can tell the difference except by being refused.
+const SPAN = 64;
+
+export class Heirs {
+  #p: Partition;
+  constructor(p: Partition) {
+    this.#p = p;
+  }
+  open(heir: string, being: string, id: string): void {
+    this.#p.heirs[heir] = { being, id, current: heir, announced: null, fresh: true, mark: 0, spent: [] };
+  }
+  close(heir: string): void {
+    delete this.#p.heirs[heir];
+  }
+  get(heir: string): Heir | undefined {
+    return this.#p.heirs[heir];
+  }
+  // May `by` speak for this heir? Returns the record if so, null if not.
+  // Does not write: the caller verifies the signature first, then settles.
+  admits(heir: string, by: string): Heir | null {
+    const h = this.#p.heirs[heir];
+    if (!h) return null;
+    if (h.fresh) return by === h.current ? h : null;
+    return by === h.current || by === h.announced ? h : null;
+  }
+  // Once only. A number above the mark is honoured and moves it; a number
+  // inside the span is honoured once and never again; a number at or below
+  // the span is refused, because a door that remembered every number ever
+  // seen would be a door with unbounded memory. Counting starts where
+  // strangers must agree: the first legal number is one.
+  //
+  // The number rides inside the signed body, so bytes caught on the road
+  // carry the number they were sent under and are refused as themselves. A
+  // caller who means to ask again asks again, under the next number, and is
+  // heard: retry and fire-and-forget stay hers to build. Only the accident
+  // and the interception are refused.
+  //
+  // Writes, so the caller settles it only once the signature has checked out.
+  // The same bytes twice are one honoured call and one silence.
+  spend(h: Heir, seq: number): boolean {
+    if (!Number.isSafeInteger(seq) || seq < 1) return false;
+    if (seq > h.mark) {
+      if (h.mark > 0) h.spent.push(h.mark);
+      h.mark = seq;
+      h.spent = h.spent.filter((past) => past > seq - SPAN);
+      return true;
+    }
+    if (seq === h.mark || seq <= h.mark - SPAN || h.spent.includes(seq)) return false;
+    h.spent.push(seq);
+    return true;
+  }
+
+  // The signature checked out. Spend the number and settle the keys, or do
+  // neither: a call that binds nothing must not burn a number on its way to
+  // being refused, or a stranger who cannot be heard would still leave a mark
+  // behind her. Every write below this line is one that is going to hold.
+  honour(h: Heir, by: string, next: string | null, seq: number): boolean {
+    if (h.fresh && next === null) return false; // a knock without a key of her own binds nothing
+    if (!this.spend(h, seq)) return false;
+    return this.settle(h, by, next);
+  }
+
+  // The signature checked out. Settle the keys: a fresh heir rotates at once
+  // to what it announced and must announce something; a current key replaces
+  // its announcement; an announced key becomes current.
+  settle(h: Heir, by: string, next: string | null): boolean {
+    if (h.fresh) {
+      if (next === null) return false; // a knock without a key of her own binds nothing
+      h.current = next;
+      h.announced = null;
+      h.fresh = false;
+      return true;
+    }
+    if (by === h.announced) h.current = by;
+    h.announced = next;
+    return true;
+  }
+}

package/src/ward/index.ts

@@ -0,0 +1,14 @@
+// SPDX-License-Identifier: Apache-2.0
+// @quo-systems/quo/ward — one function. Every ward is the same ward.
+export { Ward } from './ward.ts';
+export type { Ground, WardPointers } from './ground.ts';
+export type { Partition, Heir, Bind, StandingKeys } from './partition.ts';
+export type { AskPayload, ReplyPayload } from './seal.ts';
+// The seal and the arithmetic, for a kit in another language to check its
+// bytes against, and for tests that speak to a door directly.
+export * as seal from './seal.ts';
+export * as arithmetic from './arithmetic.ts';
+// The allowance every ask carries, for a kit in another language and for
+// tests that speak to a door directly.
+export { allow, spent, DEFAULT, CEILING } from './allowance.ts';
+export type { Allowance } from './allowance.ts';