@serfab/cadre-core 0.6.0 → 0.8.1

package/dist/strand-membership-writer.js

@@ -0,0 +1,449 @@
+import debug from 'debug';
+import { digest, sign, verify, generatePrivateKey, getPublicKey } from '@optimystic/quereus-plugin-crypto';
+import { canonicalDatetime } from './canonical-datetime.js';
+const log = debug('sereus:cadre:strand-membership');
+/**
+ * The engine (rules-logic system) assumed to manage every strand. Persisted in
+ * `Strand.Header.Engine`.
+ *
+ * PLACEHOLDER SEAM: there is no engine-selection mechanism yet — Quereus is the
+ * only engine. When a real engine-config seam lands, the founder bootstrap should
+ * read the strand's chosen engine from there instead of this constant. Documented
+ * deliberately so the column is non-null and self-describing in the meantime.
+ */
+export const STRAND_ENGINE = 'quereus';
+/**
+ * The pinned engine version recorded in `Strand.Header.EngineVersion`. A pinned
+ * string for the same reason as {@link STRAND_ENGINE}: it is a documented
+ * placeholder until an engine-selection seam supplies the real running version.
+ */
+export const STRAND_ENGINE_VERSION = '0.1.0';
+/**
+ * The single-digest ed25519 signer the `Strand.*` membership/RBAC constraints
+ * verify against.
+ *
+ * `schemas/strand.qsql` signs a single SHA-256 digest over a `'|'`-joined payload
+ * (e.g. `Member.Authorized` verifies
+ * `verify(digest(new.Key), context.AuthoritySignature, A.MemberKey, 'ed25519')`).
+ * So the signer hashes the payload to raw bytes and ed25519-signs *those bytes*:
+ * SQL `digest(...)`'s default output is base64url and `verify(...)`'s default
+ * `inputEncoding` is base64url, so signer and verifier operate on identical bytes.
+ * This differs from the control-layer's multi-field `buildAuthorizationMessage`
+ * (a single digest over MANY fields) — the strand layer is a single digest over ONE
+ * joined payload field.
+ *
+ * All strand keys are ed25519, so the explicit `'ed25519'` curve arg is mandatory
+ * (the crypto plugin otherwise defaults to secp256k1). Mirrors the proven
+ * `signItem` helper in the `rbac-signed-write` integration scenario.
+ *
+ * @param payload - The `'|'`-joined payload the matching constraint hashes.
+ * @param privateKeyB64 - The signer's base64url ed25519 private seed.
+ * @returns The base64url ed25519 signature over the payload's SHA-256 digest.
+ */
+export function signStrandPayload(payload, privateKeyB64) {
+    const hashBytes = digest([payload], 'sha256', 'bytes');
+    return sign(hashBytes, privateKeyB64, 'ed25519', 'bytes', 'base64url', 'base64url');
+}
+/**
+ * The verifier counterpart to {@link signStrandPayload}.
+ *
+ * Mirrors what every `Strand.*` constraint computes:
+ * `verify(digest(payload), signature, publicKey, 'ed25519')`.
+ * SQL `digest`'s default output and `verify`'s default `inputEncoding`/`sigEncoding`/
+ * `keyEncoding` are all base64url, so the off-engine check operates on the exact
+ * same bytes the in-engine CHECK does. Used by the off-engine `MemberVerifier`
+ * (pre-flight registration checks) so the on-engine constraint is not the only
+ * place a member self-proof is validated.
+ *
+ * @param payload - The `'|'`-joined payload the matching constraint hashes.
+ * @param signatureB64 - The base64url ed25519 signature to check.
+ * @param publicKeyB64 - The base64url ed25519 public key to verify against.
+ * @returns `true` iff the signature is valid for the payload under that key.
+ */
+export function verifyStrandPayload(payload, signatureB64, publicKeyB64) {
+    const payloadDigest = digest([payload], 'sha256', 'base64url');
+    return verify(payloadDigest, signatureB64, publicKeyB64, 'ed25519', 'base64url', 'base64url', 'base64url');
+}
+/**
+ * Count rows in a `Strand.*` table as seen by this database instance.
+ *
+ * The table name is a fixed literal supplied by this module (never user input),
+ * so the interpolation is not an injection surface — it just keeps the singleton
+ * insert-if-absent guards terse.
+ */
+async function strandTableCount(db, table) {
+    for await (const row of db.eval(`select count(1) as Count from Strand.${table}`)) {
+        return row.Count ?? 0;
+    }
+    return 0;
+}
+/**
+ * Insert the singleton `Strand.Header` if absent.
+ *
+ * Every `Header` column is NOT NULL (Quereus defaults unqualified columns to NOT
+ * NULL; the table declares no `null` columns), so all eight are supplied non-null.
+ * A missing `sApp.signature` (dev `requireSignedSchemas:false`) coalesces to `''`
+ * rather than inserting null. `Header` carries only `InsertOnly` + a singleton PK,
+ * so the insert needs no `with context`.
+ */
+async function insertHeaderIfAbsent(db, params) {
+    if (await strandTableCount(db, 'Header') > 0) {
+        log('Header already present for strand %s; skipping', params.strandId);
+        return;
+    }
+    await db.exec(`insert into Strand.Header
+       (Id, Type, sAppId, sAppVersion, sAppSchema, sAppSignature, Engine, EngineVersion)
+       values (?, ?, ?, ?, ?, ?, ?, ?)`, [
+        params.strandId,
+        params.type,
+        params.sApp.id,
+        params.sApp.version,
+        params.sApp.schema,
+        params.sApp.signature ?? '',
+        STRAND_ENGINE,
+        STRAND_ENGINE_VERSION,
+    ]);
+    log('Inserted Header for strand %s (type %s)', params.strandId, params.type);
+}
+/**
+ * Insert the founding `Strand.Member` if no member exists yet.
+ *
+ * The empty-table state satisfies the `count(1) from Member <= 1` bootstrap branch
+ * of `Member.Authorized`, so no authority signature is needed — the context fields
+ * are explicit nulls. Guarding on the count makes this idempotent: a re-run (the
+ * founder re-`addStrand`/`resumeStrand`) finds the member present and skips.
+ */
+async function insertFounderMemberIfAbsent(db, memberKey, strandId) {
+    if (await strandTableCount(db, 'Member') > 0) {
+        log('Member already present for strand %s; skipping founder Member', strandId);
+        return;
+    }
+    await db.exec(`insert into Strand.Member (Key)
+       with context AuthorityKey = null, AuthoritySignature = null
+       values (?)`, [memberKey]);
+    log('Inserted founding Member for strand %s', strandId);
+}
+/**
+ * Insert the founding `Strand.Authority` if no authority exists yet.
+ *
+ * The empty-table state satisfies the `count(1) from Authority <= 1` bootstrap
+ * branch of `Authority.Authorized`, so no signature is needed. Idempotent via the
+ * same count guard. Must run AFTER the Header insert: `Authority.OnlyClosed` is a
+ * deferred (subquery) check evaluated at commit, and the sequential auto-commit
+ * Header→Member→Authority order ensures the closed `Header` is committed first.
+ */
+async function insertFounderAuthorityIfAbsent(db, memberKey, strandId) {
+    if (await strandTableCount(db, 'Authority') > 0) {
+        log('Authority already present for strand %s; skipping founder Authority', strandId);
+        return;
+    }
+    await db.exec(`insert into Strand.Authority (MemberKey)
+       with context AuthorityKey = null, Signature = null
+       values (?)`, [memberKey]);
+    log('Inserted founding Authority for strand %s', strandId);
+}
+/**
+ * Founder-only one-time bootstrap of a strand's `Strand.*` membership/RBAC rows.
+ *
+ * Runs once at bring-up on the strand's FOUNDER (the party that provisioned and
+ * published the strand). A joiner never calls this — it receives these rows via
+ * Optimystic sync. Every write is insert-if-absent (guarded by a row count) so a
+ * restart / founder re-`addStrand` is a no-op and never double-inserts.
+ *
+ * Behavior by strand type:
+ * - **Open (`'o'`)**: insert `Header` only. `Member`/`Authority`/`Invite` are
+ *   `OnlyClosed` and would trip that constraint — they are skipped entirely.
+ * - **Closed (`'c'`)**: insert `Header(Type='c')`, then the founding `Member`
+ *   (`Key = founderKeyPair.publicKeyB64`), then the founding `Authority`
+ *   (`MemberKey = founderKeyPair.publicKeyB64`). Insert order matters: the
+ *   Header must commit before the deferred `OnlyClosed` checks on Member/Authority
+ *   evaluate at commit.
+ *
+ * A closed strand with no `founderKeyPair` throws: a closed strand with no founding
+ * Authority could never admit anyone, so failing loudly here (which propagates out
+ * of `StrandDatabase.initialize()` and triggers the runtime's rollback) is correct.
+ *
+ * @param db - The strand's Quereus database (schema already applied).
+ * @param params - Strand id/type, the sApp config for the Header, and (closed only)
+ *   the derived founder keypair.
+ * @throws If `type === 'c'` and no `founderKeyPair` is supplied.
+ */
+export async function bootstrapFounderMembership(db, params) {
+    const { strandId, type, founderKeyPair } = params;
+    log('Founder bootstrap for strand %s (type %s)', strandId, type);
+    // Validate BEFORE writing anything: a closed strand with no founder key must
+    // fail without leaving a closed `Header` that has no founding Member/Authority
+    // (such a strand could never admit anyone).
+    if (type === 'c' && !founderKeyPair) {
+        throw new Error(`Cannot bootstrap closed strand ${strandId}: no founder key pair derived from MemberPrivateKey. ` +
+            'A closed strand needs a founding Member + Authority or it can never admit members.');
+    }
+    // Header is written for every strand; Member/Authority are closed-only.
+    await insertHeaderIfAbsent(db, params);
+    if (type === 'o') {
+        // Open strand: Member/Authority/Invite are OnlyClosed — nothing else to write.
+        return;
+    }
+    const memberKey = founderKeyPair.publicKeyB64;
+    await insertFounderMemberIfAbsent(db, memberKey, strandId);
+    await insertFounderAuthorityIfAbsent(db, memberKey, strandId);
+    log('Founder bootstrap complete for closed strand %s', strandId);
+}
+/**
+ * Issue a single-use invitation to join a closed strand.
+ *
+ * Generates a fresh invite ed25519 keypair (the public key becomes `Invite.Key`),
+ * builds the constraint's payload (`Key || '|' || coalesce(Expiration, '')`), and
+ * signs it TWICE: with the authority private key (→ `AuthoritySignature`, proving
+ * an authority issued it) and with the invite private key (→ `InviteSignature`,
+ * proving the issuer actually holds the invite secret). Both signatures plus the
+ * authority public key are bound as constraint context for the `Invite` insert.
+ *
+ * The returned `invitePrivateKey` is the only secret the invitee needs to redeem
+ * the invite — it is NOT stored in the strand (only `Invite.Key`, the public half,
+ * is). Single-use is enforced at consumption time: `ConsumedInvite`'s primary key
+ * is `InviteKey`, so a given invite can be consumed at most once.
+ *
+ * @param db - The closed strand's database (founder already bootstrapped).
+ * @param params - The issuing authority keypair and optional expiry.
+ * @returns The invite public key and the out-of-band private seed.
+ */
+export async function issueInvite(db, params) {
+    const { authorityKeyPair, expiration } = params;
+    const invitePrivateKey = generatePrivateKey('ed25519', 'base64url');
+    const inviteKey = getPublicKey(invitePrivateKey, 'ed25519', 'base64url', 'base64url');
+    // Canonicalise the expiry to the engine's stored `datetime` form so the signed
+    // segment matches `new.Expiration` post-coercion; null expiry signs as ''.
+    const expirationSegment = expiration == null ? '' : await canonicalDatetime(db, expiration);
+    const expirationColumn = expiration == null ? null : expirationSegment;
+    const payload = `${inviteKey}|${expirationSegment}`;
+    const authoritySignature = signStrandPayload(payload, authorityKeyPair.privateKeyB64);
+    const inviteSignature = signStrandPayload(payload, invitePrivateKey);
+    await db.exec(`insert into Strand.Invite (Key, Expiration)
+       with context AuthorityKey = ?, AuthoritySignature = ?, InviteSignature = ?
+       values (?, ?)`, [authorityKeyPair.publicKeyB64, authoritySignature, inviteSignature, inviteKey, expirationColumn]);
+    log('Issued invite %s (expires=%s)', inviteKey, expirationColumn ?? 'never');
+    return { inviteKey, invitePrivateKey };
+}
+/**
+ * Redeem an invite to admit a new `Member`, atomically.
+ *
+ * `Member.Authorized`'s invite branch needs a `ConsumedInvite` row, while
+ * `ConsumedInvite`'s `MemberExists`/`MemberValid` need the `Member` row — a
+ * circular dependency. Both are deferred (subquery-bearing) checks that evaluate
+ * at COMMIT, so inserting `Member` then `ConsumedInvite` inside one explicit
+ * transaction lets both rows exist when the deferred checks fire. This mirrors
+ * `ControlDatabase.redeemInvitation` (Strand + FormationUsage in one txn).
+ *
+ * The `ConsumedInvite` insert carries an `InviteSignature` over
+ * `InviteKey || '|' || MemberKey`, proving the consumer holds the invite private
+ * key (the on-engine `ValidUsage` gate). The `Member` insert needs no member
+ * signature — its admission is the existence of the matching `ConsumedInvite`.
+ *
+ * Single-use: `ConsumedInvite`'s primary key is `InviteKey`, so a second consume
+ * of the same invite is rejected by the PK (a distinct layer from the control
+ * network's `FormationUsage` single-use, which gates strand FORMATION, not the
+ * per-strand member join enforced here).
+ *
+ * Expiry: the `ConsumedInvite.NotExpired` deferred check rejects redeeming an invite
+ * whose `Expiration` is at or before `context.Now`. `Now` is supplied here as a
+ * canonical-datetime string from `canonicalDatetime(db, nowMs)` — the SAME transform
+ * `issueInvite` uses to store `Invite.Expiration` — so both sides of the schema's
+ * `I.Expiration > context.Now` comparison are byte-identical canonical strings and
+ * the lexical `>` orders chronologically at any granularity. (This intentionally
+ * diverges from the control layer, which passes `Now` as a JS ISO string; Quereus
+ * does not coerce context params, so an ISO `Now` would be compared lexically against
+ * the canonical, T-separated `Expiration` and could mis-order near-same-instant
+ * timestamps (due to a trailing `.000Z` suffix). The control tests only use far-future/far-past expiries, so that latent
+ * skew never bites there — the strand layer avoids it outright.) A null `Expiration`
+ * never expires. Like `ValidUsage`, `NotExpired` defers to commit, so an expired
+ * invite rolls back the whole txn — neither the `Member` nor the `ConsumedInvite`
+ * row survives.
+ *
+ * @param db - The closed strand's database.
+ * @param params - The invite key/secret, the joining member's public key, and an
+ *   optional `nowMs` instant for the expiry comparison (default `Date.now()`).
+ * @throws If any constraint rejects (bad signature, missing invite, or an expired
+ *   invite); the whole transaction rolls back (neither the `Member` nor the
+ *   `ConsumedInvite` row survives).
+ */
+export async function consumeInvite(db, params) {
+    const { inviteKey, invitePrivateKey, memberKey, nowMs } = params;
+    const usagePayload = `${inviteKey}|${memberKey}`;
+    const inviteSignature = signStrandPayload(usagePayload, invitePrivateKey);
+    // Canonicalise "now" the same way issueInvite canonicalises Expiration, so the
+    // schema's `I.Expiration > context.Now` compares like-for-like canonical strings.
+    // Plain runtime Date.now() — the tess Workflow restriction is on scripts, not libs.
+    const nowCanonical = await canonicalDatetime(db, nowMs ?? Date.now());
+    await db.beginTransaction();
+    try {
+        // 1. Member — admitted by the deferred invite branch (the matching
+        //    ConsumedInvite below), so no authority signature is supplied.
+        await db.exec(`insert into Strand.Member (Key)
+         with context AuthorityKey = null, AuthoritySignature = null
+         values (?)`, [memberKey]);
+        // 2. ConsumedInvite — proves possession of the invite private key and that the
+        //    invite has not expired (NotExpired gate against the canonical Now).
+        await db.exec(`insert into Strand.ConsumedInvite (InviteKey, MemberKey)
+         with context InviteSignature = ?, Now = ?
+         values (?, ?)`, [inviteSignature, nowCanonical, inviteKey, memberKey]);
+        await db.commit();
+        log('Consumed invite %s -> member %s', inviteKey, memberKey);
+    }
+    catch (error) {
+        // A failed commit() already tears down the transaction, so rollback() would
+        // throw "No transaction active" and mask the real cause — swallow only that.
+        try {
+            await db.rollback();
+        }
+        catch (rollbackError) {
+            log('Rollback after consumeInvite failure was a no-op: %s', rollbackError);
+        }
+        throw error;
+    }
+}
+/**
+ * Admit a `Member` directly by authority signature — the sibling of the invite
+ * path on `Member.Authorized`'s direct-authority branch.
+ *
+ * The constraint verifies `digest(new.Key)` against an `Authority` row matching
+ * `context.AuthorityKey`, so the payload is just the member key (no `'|'` join).
+ * No `ConsumedInvite` is involved: this is the path an authority uses to seat a
+ * member it already trusts (e.g. an authority-side enrollment that admits a
+ * party already authorised out-of-band).
+ *
+ * @param db - The closed strand's database.
+ * @param params - The admitting authority keypair and the new member key.
+ * @throws If `Member.Authorized` rejects (e.g. a non-authority key); the insert
+ *   rolls back, leaving no `Member` row.
+ */
+export async function addMemberByAuthority(db, params) {
+    const { authorityKeyPair, memberKey } = params;
+    const signature = signStrandPayload(memberKey, authorityKeyPair.privateKeyB64);
+    await db.exec(`insert into Strand.Member (Key)
+       with context AuthorityKey = ?, AuthoritySignature = ?
+       values (?)`, [authorityKeyPair.publicKeyB64, signature, memberKey]);
+    log('Admitted member %s by authority %s', memberKey, authorityKeyPair.publicKeyB64);
+}
+/**
+ * Register a network node (`PeerId`) as acting on behalf of a member.
+ *
+ * The member self-signs `MemberKey || '|' || PeerId` with its OWN key; the schema's
+ * `MemberPeer.Authorized` verifies that signature against `coalesce(new.MemberKey,
+ * old.MemberKey)` — i.e. the member key itself — so only the member that owns the
+ * key can register peers for it. A deferred `MemberExists` additionally requires the
+ * `Member` row to already exist, so a peer for a non-member is rejected at commit.
+ *
+ * Insert-if-absent on the composite PK `(MemberKey, PeerId)`: a re-register on
+ * restart (or a redundant call) is a no-op rather than relying on the platform's
+ * PK-uniqueness rejection (not enforced in bootstrap mode — see
+ * `optimystic-insert-pk-uniqueness-not-enforced`). A member may register multiple
+ * DISTINCT `PeerId`s (multi-device); each is its own row under the same `MemberKey`.
+ *
+ * Out of scope: peer DELETION. The schema's `MemberExists` reads `new.MemberKey`,
+ * which is null on delete, so a `MemberPeer` delete is currently rejected by the
+ * schema (noted in the `apply-strand-membership-schema` review). Removing a peer
+ * would need a schema tweak (e.g. `coalesce(new.MemberKey, old.MemberKey)` in
+ * `MemberExists`), so no `removeMemberPeer` is provided here.
+ *
+ * @param db - The closed strand's database (the member already exists).
+ * @param params - The member's own keypair and the peer id to bind.
+ * @throws If `MemberPeer.Authorized`/`MemberExists` rejects (wrong signer, or no
+ *   matching `Member` row); the insert rolls back, leaving no `MemberPeer` row.
+ */
+export async function registerMemberPeer(db, params) {
+    const { memberKeyPair, peerId } = params;
+    const memberKey = memberKeyPair.publicKeyB64;
+    if (await memberPeerExists(db, memberKey, peerId)) {
+        log('MemberPeer (%s, %s) already present; skipping', memberKey, peerId);
+        return;
+    }
+    const payload = `${memberKey}|${peerId}`;
+    const signature = signStrandPayload(payload, memberKeyPair.privateKeyB64);
+    await db.exec(`insert into Strand.MemberPeer (MemberKey, PeerId)
+       with context Signature = ?
+       values (?, ?)`, [signature, memberKey, peerId]);
+    log('Registered MemberPeer (%s, %s)', memberKey, peerId);
+}
+/** True iff a `MemberPeer` row already exists for this `(MemberKey, PeerId)`. */
+async function memberPeerExists(db, memberKey, peerId) {
+    for await (const row of db.eval('select count(1) as Count from Strand.MemberPeer where MemberKey = ? and PeerId = ?', [memberKey, peerId])) {
+        return (row.Count ?? 0) > 0;
+    }
+    return false;
+}
+/**
+ * Promote a member to `Authority` on the signature of an existing authority.
+ *
+ * The existing-authority branch of `Authority.Authorized` verifies
+ * `digest(coalesce(new.MemberKey, old.MemberKey))` — `new.MemberKey` =
+ * `newAuthorityKey` on insert — against an `Authority` row matching
+ * `context.AuthorityKey`. So the signer signs the new authority key directly (no
+ * `'|'` join) and binds itself as `context.AuthorityKey`.
+ *
+ * Once the founder authority exists, the schema's `(select count(1) from Authority)
+ * <= 1` bootstrap shortcut no longer applies to a second add (at commit the count
+ * includes the new row, so it is ≥ 2), so this genuinely exercises signature
+ * verification — a non-authority signer, or a signature over the wrong key, is
+ * rejected.
+ *
+ * @param db - The closed strand's database (founder authority already seated).
+ * @param params - The authorizing authority's keypair and the new authority key.
+ * @throws If `Authority.Authorized` rejects; the insert rolls back.
+ */
+export async function addAuthority(db, params) {
+    const { byAuthorityKeyPair, newAuthorityKey } = params;
+    const signature = signStrandPayload(newAuthorityKey, byAuthorityKeyPair.privateKeyB64);
+    await db.exec(`insert into Strand.Authority (MemberKey)
+       with context AuthorityKey = ?, Signature = ?
+       values (?)`, [byAuthorityKeyPair.publicKeyB64, signature, newAuthorityKey]);
+    log('Added authority %s by %s', newAuthorityKey, byAuthorityKeyPair.publicKeyB64);
+}
+/**
+ * Remove an `Authority` row — either an admin removing a different authority or an
+ * authority resigning itself.
+ *
+ * On a DELETE, `coalesce(new.MemberKey, old.MemberKey)` binds `old.MemberKey =
+ * targetAuthorityKey` (there is no `new` row), so the signed payload is the target
+ * key for BOTH accepting branches of `Authority.Authorized`, and a single context
+ * construction serves both:
+ * - **Admin removal**: `byAuthorityKeyPair` is a different existing authority; the
+ *   existing-authority branch verifies the signature against `A.MemberKey =
+ *   context.AuthorityKey`.
+ * - **Self-resignation**: `byAuthorityKeyPair` IS the target (its `publicKeyB64`
+ *   equals `targetAuthorityKey`); the former-authority self branch verifies
+ *   `old.MemberKey = context.AuthorityKey` and the self-signature over `old.MemberKey`.
+ *
+ * The caller selects the case purely by which keypair it passes — no branching here.
+ *
+ * KNOWN PLATFORM GAP (not fixable here): the optimystic bootstrap-mode transactor
+ * evaluates deferred (subquery-bearing) CHECK constraints only on INSERT, not on
+ * DELETE. `Authority.Authorized` is deferred, so the platform currently accepts ANY
+ * `Authority` delete regardless of signature — `removeAuthority`'s authorization is
+ * effectively unenforced at runtime until that gap is closed (filed as
+ * `optimystic-deferred-check-not-enforced-on-delete`). This writer still builds the
+ * correct, signed delete so it works unchanged once enforcement lands — exactly as
+ * the invite path issues correct inserts despite the open PK-uniqueness gap.
+ *
+ * KNOWN SCHEMA HAZARD (not guarded here): even with enforcement, `Authority.
+ * Authorized`'s `(select count(1) from Authority) <= 1` bootstrap branch is true at
+ * commit whenever a delete drops the count to ≤ 1, so removing the strand's LAST (or
+ * second-to-last) authority would be accepted regardless of signature — and removing
+ * the last one orphans the strand (no one can ever add another). The schema does not
+ * prevent this; a "min-one-authority" invariant is deferred to a future schema change
+ * rather than grown into this writer.
+ *
+ * @param db - The closed strand's database.
+ * @param params - The authorizing keypair and the target authority key.
+ * @throws If `Authority.Authorized` rejects (e.g. a non-authority admin removal
+ *   while > 2 authorities remain); the delete rolls back.
+ */
+export async function removeAuthority(db, params) {
+    const { byAuthorityKeyPair, targetAuthorityKey } = params;
+    const signature = signStrandPayload(targetAuthorityKey, byAuthorityKeyPair.privateKeyB64);
+    await db.exec(`delete from Strand.Authority
+       with context AuthorityKey = ?, Signature = ?
+       where MemberKey = ?`, [byAuthorityKeyPair.publicKeyB64, signature, targetAuthorityKey]);
+    log('Removed authority %s by %s', targetAuthorityKey, byAuthorityKeyPair.publicKeyB64);
+}
+//# sourceMappingURL=strand-membership-writer.js.map

package/dist/strand-membership-writer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strand-membership-writer.js","sourceRoot":"","sources":["../src/strand-membership-writer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAG3G,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,MAAM,GAAG,GAAG,KAAK,CAAC,gCAAgC,CAAC,CAAC;AAEpD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAC;AAEvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,OAAO,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,aAAqB;IACtE,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAe,CAAC;IACrE,OAAO,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,CAAW,CAAC;AAChG,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,YAAoB,EAAE,YAAoB;IAC7F,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAW,CAAC;IACzE,OAAO,MAAM,CAAC,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;AAC7G,CAAC;AAkBD;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAAC,EAAY,EAAE,KAAwC;IACpF,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,wCAAwC,KAAK,EAAE,CAAC,EAAE,CAAC;QACjF,OAAQ,GAAG,CAAC,KAAgB,IAAI,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,oBAAoB,CAAC,EAAY,EAAE,MAA8B;IAC9E,IAAI,MAAM,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,gDAAgD,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvE,OAAO;IACT,CAAC;IACD,MAAM,EAAE,CAAC,IAAI,CACX;;uCAEmC,EACnC;QACE,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,IAAI;QACX,MAAM,CAAC,IAAI,CAAC,EAAE;QACd,MAAM,CAAC,IAAI,CAAC,OAAO;QACnB,MAAM,CAAC,IAAI,CAAC,MAAM;QAClB,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE;QAC3B,aAAa;QACb,qBAAqB;KACtB,CACF,CAAC;IACF,GAAG,CAAC,yCAAyC,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,2BAA2B,CAAC,EAAY,EAAE,SAAiB,EAAE,QAAgB;IAC1F,IAAI,MAAM,gBAAgB,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,+DAA+D,EAAE,QAAQ,CAAC,CAAC;QAC/E,OAAO;IACT,CAAC;IACD,MAAM,EAAE,CAAC,IAAI,CACX;;kBAEc,EACd,CAAC,SAAS,CAAC,CACZ,CAAC;IACF,GAAG,CAAC,wCAAwC,EAAE,QAAQ,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,8BAA8B,CAAC,EAAY,EAAE,SAAiB,EAAE,QAAgB;IAC7F,IAAI,MAAM,gBAAgB,CAAC,EAAE,EAAE,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,qEAAqE,EAAE,QAAQ,CAAC,CAAC;QACrF,OAAO;IACT,CAAC;IACD,MAAM,EAAE,CAAC,IAAI,CACX;;kBAEc,EACd,CAAC,SAAS,CAAC,CACZ,CAAC;IACF,GAAG,CAAC,2CAA2C,EAAE,QAAQ,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAAY,EAAE,MAA8B;IAC3F,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,MAAM,CAAC;IAClD,GAAG,CAAC,2CAA2C,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAEjE,6EAA6E;IAC7E,+EAA+E;IAC/E,4CAA4C;IAC5C,IAAI,IAAI,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,kCAAkC,QAAQ,uDAAuD;YACjG,oFAAoF,CACrF,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,MAAM,oBAAoB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAEvC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACjB,+EAA+E;QAC/E,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,cAAe,CAAC,YAAY,CAAC;IAC/C,MAAM,2BAA2B,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC3D,MAAM,8BAA8B,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC9D,GAAG,CAAC,iDAAiD,EAAE,QAAQ,CAAC,CAAC;AACnE,CAAC;AAiCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAY,EAAE,MAAyB;IACvE,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;IAEhD,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,SAAS,EAAE,WAAW,CAAW,CAAC;IAC9E,MAAM,SAAS,GAAG,YAAY,CAAC,gBAAgB,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,CAAW,CAAC;IAEhG,+EAA+E;IAC/E,2EAA2E;IAC3E,MAAM,iBAAiB,GAAG,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IAC5F,MAAM,gBAAgB,GAAG,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAEvE,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,iBAAiB,EAAE,CAAC;IACpD,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACtF,MAAM,eAAe,GAAG,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAErE,MAAM,EAAE,CAAC,IAAI,CACX;;qBAEiB,EACjB,CAAC,gBAAgB,CAAC,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAClG,CAAC;IACF,GAAG,CAAC,+BAA+B,EAAE,SAAS,EAAE,gBAAgB,IAAI,OAAO,CAAC,CAAC;IAE7E,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;AACzC,CAAC;AAkBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAY,EAAE,MAA2B;IAC3E,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IAEjE,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;IACjD,MAAM,eAAe,GAAG,iBAAiB,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;IAE1E,+EAA+E;IAC/E,kFAAkF;IAClF,oFAAoF;IACpF,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,EAAE,EAAE,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAEtE,MAAM,EAAE,CAAC,gBAAgB,EAAE,CAAC;IAC5B,IAAI,CAAC;QACH,mEAAmE;QACnE,mEAAmE;QACnE,MAAM,EAAE,CAAC,IAAI,CACX;;oBAEc,EACd,CAAC,SAAS,CAAC,CACZ,CAAC;QAEF,+EAA+E;QAC/E,yEAAyE;QACzE,MAAM,EAAE,CAAC,IAAI,CACX;;uBAEiB,EACjB,CAAC,eAAe,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CACtD,CAAC;QAEF,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC;QAClB,GAAG,CAAC,iCAAiC,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,4EAA4E;QAC5E,6EAA6E;QAC7E,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,aAAa,EAAE,CAAC;YACvB,GAAG,CAAC,sDAAsD,EAAE,aAAa,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAaD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EAAY,EAAE,MAAkC;IACzF,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAC/C,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,EAAE,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAC/E,MAAM,EAAE,CAAC,IAAI,CACX;;kBAEc,EACd,CAAC,gBAAgB,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CACtD,CAAC;IACF,GAAG,CAAC,oCAAoC,EAAE,SAAS,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC;AACtF,CAAC;AAoBD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,EAAY,EAAE,MAAgC;IACrF,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IACzC,MAAM,SAAS,GAAG,aAAa,CAAC,YAAY,CAAC;IAE7C,IAAI,MAAM,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;QAClD,GAAG,CAAC,+CAA+C,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACxE,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,MAAM,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC1E,MAAM,EAAE,CAAC,IAAI,CACX;;qBAEiB,EACjB,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAC/B,CAAC;IACF,GAAG,CAAC,gCAAgC,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AAC3D,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,gBAAgB,CAAC,EAAY,EAAE,SAAiB,EAAE,MAAc;IAC7E,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,CAAC,IAAI,CAC7B,oFAAoF,EACpF,CAAC,SAAS,EAAE,MAAM,CAAC,CACpB,EAAE,CAAC;QACF,OAAO,CAAE,GAAG,CAAC,KAAgB,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAiBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAY,EAAE,MAA0B;IACzE,MAAM,EAAE,kBAAkB,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IACvD,MAAM,SAAS,GAAG,iBAAiB,CAAC,eAAe,EAAE,kBAAkB,CAAC,aAAa,CAAC,CAAC;IACvF,MAAM,EAAE,CAAC,IAAI,CACX;;kBAEc,EACd,CAAC,kBAAkB,CAAC,YAAY,EAAE,SAAS,EAAE,eAAe,CAAC,CAC9D,CAAC;IACF,GAAG,CAAC,0BAA0B,EAAE,eAAe,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC;AACpF,CAAC;AAkBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAY,EAAE,MAA6B;IAC/E,MAAM,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC;IAC1D,MAAM,SAAS,GAAG,iBAAiB,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAC1F,MAAM,EAAE,CAAC,IAAI,CACX;;2BAEuB,EACvB,CAAC,kBAAkB,CAAC,YAAY,EAAE,SAAS,EAAE,kBAAkB,CAAC,CACjE,CAAC;IACF,GAAG,CAAC,4BAA4B,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,YAAY,CAAC,CAAC;AACzF,CAAC"}

package/dist/strand-solicitation.d.ts

@@ -1,6 +1,7 @@
 import type { Libp2p } from '@libp2p/interface';
 import type { OpenInvitation, FormStrandResult, ValidateFormationResult, StrandFormationDisclosure } from './types.js';
 import { type StrandFormationManagerConfig } from './strand-formation-manager.js';
+import { type FormationResultMessage } from './strand-formation-protocol.js';
 /**
  * Interface for validating formation disclosures
  */
@@ -13,6 +14,31 @@ export interface DisclosureValidator {
      */
     validateDisclosure(token: string, disclosure: StrandFormationDisclosure): Promise<boolean>;
 }
+/**
+ * Discriminated result of resolving the host strand an invite binds to (responder side):
+ *
+ * - `unbound`: the invite carries no `StrandId` → the responder-provisions path (provision
+ *   a NEW strand; legacy/open).
+ * - `bound`: the invite names a host strand AND that strand row is present on this responder
+ *   → provision-then-record (record consent against it, return it + its membership key).
+ * - `missing`: the invite names a host strand but the row is ABSENT on this responder (e.g.
+ *   not yet converged) → the manager rejects cleanly rather than recording usage against a
+ *   non-existent strand, which would fail the deferred `FormationUsage.StrandExists` CHECK at
+ *   commit and drop the result frame.
+ *
+ * Replaces the older `{ strandId, memberPrivateKey } | null` shape, which conflated `bound`
+ * and `missing` (both produced a non-null result whenever the invite had a `StrandId`).
+ */
+export type ResolvedHostStrand = {
+    kind: 'unbound';
+} | {
+    kind: 'bound';
+    strandId: string;
+    memberPrivateKey: string | null;
+} | {
+    kind: 'missing';
+    strandId: string;
+};
 /**
  * Interface for recording formation usage
  */
@@ -32,6 +58,26 @@ export interface FormationUsageRecorder {
         valid: boolean;
         invitation?: OpenInvitation;
     }>;
+    /**
+     * Resolve the host strand an invite binds to, classifying it as unbound / bound /
+     * missing (see {@link ResolvedHostStrand}). Optional: a recorder that does not bind
+     * strands omits it, and {@link StrandFormationManager} treats every invite as `unbound`
+     * and falls back to its provisioner. Keeping resolution behind this interface keeps the
+     * manager DB-agnostic and unit-testable with an in-memory fake.
+     */
+    resolveStrand?(token: string): Promise<ResolvedHostStrand>;
+    /**
+     * Provision a NEW strand for an UNBOUND invite and record consent against it
+     * ATOMICALLY (single `FormationUsage` row → single-use enforced on the next redemption).
+     * Optional: a recorder that only supports provision-then-record omits it, and the
+     * manager falls back to its {@link StrandProvisioner}. Mirrors the create-strand-by-consent
+     * path the schema's `Strand.Authorized` `FormationUsage` branch authorizes. Returns the
+     * minted strand id plus its membership key (null for an open responder-provisioned strand).
+     */
+    provisionAndRecord?(token: string, initiatorKey: string, sAppId: string): Promise<{
+        strandId: string;
+        memberPrivateKey: string | null;
+    }>;
 }
 /**
  * Interface for strand provisioning during formation
@@ -56,11 +102,39 @@ export interface FormationSigner {
         validationSignature: string;
     }>;
 }
+/**
+ * Interface for validating the responder's formation result on the initiator side.
+ *
+ * Symmetric to {@link DisclosureValidator} (which runs responder→initiator): it lets
+ * the initiator verify the responder's disclosed identity, cadre, and provisioned
+ * strand against the invitation/disclosure it used to form the strand. The manager
+ * owns one dialer session per `formStrand` call, so the per-session invitation +
+ * disclosure context is local — no hook-signature gymnastics needed.
+ */
+export interface FormationResponseValidator {
+    /** Validate the responder's result against the invitation/disclosure used to form the strand. */
+    validateResponse(ctx: {
+        invitation: OpenInvitation;
+        disclosure: StrandFormationDisclosure;
+        response: FormationResultMessage;
+    }): Promise<boolean>;
+}
+/**
+ * Built-in structural {@link FormationResponseValidator}.
+ *
+ * `validateResponse` rejects when the responder did not approve, omitted a disclosed
+ * identity, returned no/placeholder cadre addresses, or returned a missing/empty or
+ * non-responder-created strand (see {@link isValidResponderCreatesResult}).
+ * Apps can supply a stricter validator via {@link StrandSolicitationServiceOptions}.
+ */
+export declare function createDefaultFormationResponseValidator(): FormationResponseValidator;
 export interface StrandSolicitationServiceOptions {
     disclosureValidator?: DisclosureValidator;
     formationUsageRecorder?: FormationUsageRecorder;
     strandProvisioner?: StrandProvisioner;
     formationSigner?: FormationSigner;
+    /** Validates the responder's result on the initiator side (defaults to a structural check) */
+    formationResponseValidator?: FormationResponseValidator;
     /** Party ID for this node (used in protocol messages) */
     partyId?: string;
     /** Cadre peer addresses for this node */
@@ -75,14 +149,15 @@ export interface StrandSolicitationServiceOptions {
  * - formStrand(invitation, disclosure, node) - called by initiator
  * - validateStrandFormation(token, disclosure) - called by responder
  *
- * When a libp2p node is provided, the underlying protocol is handled by
- * strand-proto's SessionManager via StrandFormationManager.
+ * When a libp2p node is provided, the underlying protocol is handled by the
+ * native cadre-core formation transport via StrandFormationManager.
  */
 export declare class StrandSolicitationService {
     private readonly disclosureValidator?;
     private readonly formationUsageRecorder?;
     private readonly strandProvisioner?;
     private readonly formationSigner?;
+    private readonly formationResponseValidator?;
     private readonly partyId;
     private readonly cadrePeerAddrs;
     private formationManager?;

package/dist/strand-solicitation.js

@@ -3,7 +3,23 @@ import { toString as uint8ArrayToString } from 'uint8arrays';
 import { generateKeyPair, privateKeyToProtobuf } from '@libp2p/crypto/keys';
 import { peerIdFromPrivateKey } from '@libp2p/peer-id';
 import { StrandFormationManager } from './strand-formation-manager.js';
+import { isValidResponderCreatesResult } from './strand-formation-protocol.js';
 const log = debug('sereus:cadre:solicitation');
+/**
+ * Built-in structural {@link FormationResponseValidator}.
+ *
+ * `validateResponse` rejects when the responder did not approve, omitted a disclosed
+ * identity, returned no/placeholder cadre addresses, or returned a missing/empty or
+ * non-responder-created strand (see {@link isValidResponderCreatesResult}).
+ * Apps can supply a stricter validator via {@link StrandSolicitationServiceOptions}.
+ */
+export function createDefaultFormationResponseValidator() {
+    return {
+        async validateResponse({ response }) {
+            return isValidResponderCreatesResult(response);
+        }
+    };
+}
 /**
  * Strand Solicitation API for forming strands via open invitations.
  *
@@ -11,8 +27,8 @@ const log = debug('sereus:cadre:solicitation');
  * - formStrand(invitation, disclosure, node) - called by initiator
  * - validateStrandFormation(token, disclosure) - called by responder
  *
- * When a libp2p node is provided, the underlying protocol is handled by
- * strand-proto's SessionManager via StrandFormationManager.
+ * When a libp2p node is provided, the underlying protocol is handled by the
+ * native cadre-core formation transport via StrandFormationManager.
  */
 export class StrandSolicitationService {
     constructor(options) {
@@ -20,6 +36,7 @@ export class StrandSolicitationService {
         this.formationUsageRecorder = options?.formationUsageRecorder;
         this.strandProvisioner = options?.strandProvisioner;
         this.formationSigner = options?.formationSigner;
+        this.formationResponseValidator = options?.formationResponseValidator;
         this.partyId = options?.partyId ?? `party-${Date.now()}`;
         this.cadrePeerAddrs = options?.cadrePeerAddrs ?? [];
         this.formationConfig = options?.formationConfig;
@@ -35,6 +52,7 @@ export class StrandSolicitationService {
                 disclosureValidator: this.disclosureValidator,
                 formationUsageRecorder: this.formationUsageRecorder,
                 strandProvisioner: this.strandProvisioner,
+                formationResponseValidator: this.formationResponseValidator,
                 partyId: this.partyId,
                 cadrePeerAddrs: this.cadrePeerAddrs,
                 config: this.formationConfig
@@ -82,12 +100,15 @@ export class StrandSolicitationService {
         log('Generated member key: %s', memberKey);
         // If we have a full invitation and a node, use the real protocol
         if (typeof invitation !== 'string' && node) {
-            log('Using strand-proto for real protocol handling');
+            log('Using native cadre-core formation transport');
             const result = await this.getFormationManager().formStrand(invitation, { ...disclosure, partyId: memberKey }, node);
             return {
                 memberKey,
                 invitePrivateKey,
-                strandId: result.strandId
+                strandId: result.strandId,
+                // Carry the host strand's membership key delivered over the protocol (closed-strand
+                // provision-then-record). invitePrivateKey stays the initiator's generated signing key.
+                memberPrivateKey: result.memberPrivateKey
             };
         }
         // Fallback: placeholder strandId (for testing without network)