@serfab/cadre-core 0.8.1 → 0.9.0

package/src/control-cohort.ts

@@ -5,14 +5,14 @@
  * connected (and thus replicating), without devolving into an N² mesh.
  *
  * FRET only needs a *connected* graph with the block clusters reachable, not a
- * full mesh. Storage/authority nodes are the stable, publicly-dialable backbone
+ * full mesh. Storage/owner nodes are the stable, publicly-dialable backbone
  * that hold the control blocks, so the policy is **backbone-preferential with a
  * bounded out-degree**:
  *
- * - **Always dial every backbone (authority) member** — the authority set is
+ * - **Always dial every backbone (owner) member** — the owner set is
  *   small by design, and routing cohort formation through publicly-dialable
- *   authority nodes keeps the cohort ≥2 where authority-signed writes originate.
- * - **Fill the remainder** up to `targetDegree` with non-authority members,
+ *   owner nodes keeps the cohort ≥2 where owner-signed writes originate.
+ * - **Fill the remainder** up to `targetDegree` with non-owner members,
  *   ordered deterministically (peerId sort) so every node makes the same stable
  *   choice across passes and load spreads predictably.
  *
@@ -32,8 +32,8 @@ import type { CohortPeerRow } from './strand-cohort.js';
 export const DEFAULT_CONTROL_COHORT_RECONCILE_MS = 15_000;
 
 /**
- * Default cap on the number of **non-authority** members a single reconcile pass
- * proactively dials. Backbone (authority) members are always dialed and do NOT
+ * Default cap on the number of **non-owner** members a single reconcile pass
+ * proactively dials. Backbone (owner) members are always dialed and do NOT
  * count against this cap.
  */
 export const DEFAULT_CONTROL_COHORT_TARGET_DEGREE = 6;
@@ -41,14 +41,14 @@ export const DEFAULT_CONTROL_COHORT_TARGET_DEGREE = 6;
 /** Outcome of {@link selectControlCohortDials}: who to dial + what the cap dropped. */
 export interface ControlCohortSelection {
   /**
-   * Siblings to dial this pass, backbone first then the bounded non-authority
+   * Siblings to dial this pass, backbone first then the bounded non-owner
    * fill. Already self-excluded (the caller must pass self-excluded `siblings`).
    * Still includes peers that may turn out to be already-connected — the caller
    * diffs against live connections separately.
    */
   dials: CohortPeerRow[];
-  /** Non-authority members dropped by the `targetDegree` cap (0 when none). */
-  cappedNonAuthority: number;
+  /** Non-owner members dropped by the `targetDegree` cap (0 when none). */
+  cappedNonOwner: number;
 }
 
 /** Stable peerId ordering so the bounded fill is identical across passes/nodes. */
@@ -63,19 +63,19 @@ function byPeerId(a: CohortPeerRow, b: CohortPeerRow): number {
  * to dial.
  *
  * A member is **backbone** iff the ed25519 key derived from its peerId
- * (see {@link ed25519PublicKeyB64FromPeerId}) is in `authorityKeys`. All backbone
- * members are selected; non-authority members fill up to `targetDegree` in
+ * (see {@link ed25519PublicKeyB64FromPeerId}) is in `ownerKeys`. All backbone
+ * members are selected; non-owner members fill up to `targetDegree` in
  * deterministic peerId order.
  *
  * @param siblings - cadre members EXCLUDING self (the caller filters self out).
- * @param authorityKeys - the converged `AuthorityKey` set; may be empty/partial
- *   before authority convergence, in which case no member classifies as backbone
+ * @param ownerKeys - the converged `OwnerKey` set; may be empty/partial
+ *   before owner convergence, in which case no member classifies as backbone
  *   yet and the bounded fill still makes progress (preference sharpens later).
- * @param targetDegree - cap on non-authority dials (negative is treated as 0).
+ * @param targetDegree - cap on non-owner dials (negative is treated as 0).
  */
 export function selectControlCohortDials(
   siblings: CohortPeerRow[],
-  authorityKeys: ReadonlySet<string>,
+  ownerKeys: ReadonlySet<string>,
   targetDegree: number,
 ): ControlCohortSelection {
   const backbone: CohortPeerRow[] = [];
@@ -83,7 +83,7 @@ export function selectControlCohortDials(
 
   for (const peer of siblings) {
     const pubKey = ed25519PublicKeyB64FromPeerId(peer.peerId);
-    if (pubKey !== null && authorityKeys.has(pubKey)) {
+    if (pubKey !== null && ownerKeys.has(pubKey)) {
       backbone.push(peer);
     } else {
       rest.push(peer);
@@ -98,6 +98,6 @@ export function selectControlCohortDials(
 
   return {
     dials: [...backbone, ...fill],
-    cappedNonAuthority: rest.length - fill.length,
+    cappedNonOwner: rest.length - fill.length,
   };
 }

package/src/control-database.ts

@@ -20,7 +20,7 @@ const timing = debug('sereus:cadre:timing');
  * - First 16 bytes: SHA-256 hash of peer ID (for distributed uniqueness)
  * - Last 16 bytes: Random bytes (for collision resistance)
  */
-function generateStampId(peerId: string): string {
+export function generateStampId(peerId: string): string {
   // Hash the peer ID and get first 16 bytes (128 bits). A purely local ID
   // generator: never signed/verified against SQL, so the framed single-field
   // digest is fine (the changed framing is not cross-checked anywhere).
@@ -54,7 +54,7 @@ function parseStoredDatetimeMs(value: string | number): number {
 }
 
 /**
- * Build the canonical authorization message that authority signatures are bound to.
+ * Build the canonical authorization message that owner signatures are bound to.
  *
  * The message is a SINGLE framed SHA-256 digest over the ordered tuple of fields (the
  * crypto plugin's injective multi-field encoding), in a fixed field order, with the
@@ -111,7 +111,7 @@ interface OptimysticPluginResult {
  * `waitForControlSync`) a typo-proof table argument.
  */
 export type ControlTable =
-  | 'AuthorityKey'
+  | 'OwnerKey'
   | 'ValidationKey'
   | 'Strand'
   | 'CadrePeer'
@@ -121,7 +121,7 @@ export type ControlTable =
 
 /** Runtime guard mirroring {@link ControlTable} for the dynamic-`from` count. */
 const CONTROL_TABLES: ReadonlySet<ControlTable> = new Set<ControlTable>([
-  'AuthorityKey',
+  'OwnerKey',
   'ValidationKey',
   'Strand',
   'CadrePeer',
@@ -329,7 +329,7 @@ export class ControlDatabase {
    * into the `from` clause: the names are not user input, but the check keeps the
    * dynamic query off the injection surface and fails loudly on a typo instead of
    * emitting a malformed statement. The count reflects only the rows this node's
-   * control DB has converged on — in the integration harness that is the authority
+   * control DB has converged on — in the integration harness that is the owner
    * node (one ControlDatabase per party), i.e. the authoritative control-network
    * view, not a per-drone convergence guarantee.
    */
@@ -353,44 +353,44 @@ export class ControlDatabase {
   }
 
   /**
-   * Check whether any authority key exists in the control database.
+   * Check whether any owner key exists in the control database.
    * Used to decide whether a fresh-party genesis insert is required.
    */
-  async hasAuthorityKey(): Promise<boolean> {
+  async hasOwnerKey(): Promise<boolean> {
     this.ensureInitialized();
-    for await (const row of this.db!.eval('select count(1) as Count from CadreControl.AuthorityKey')) {
+    for await (const row of this.db!.eval('select count(1) as Count from CadreControl.OwnerKey')) {
       return (row.Count as number) > 0;
     }
     return false;
   }
 
   /**
-   * Idempotent genesis: insert `key` as the founding authority key only when
-   * the party has none yet. Returns true if it inserted, false if an authority
-   * key already existed (so a repeat `--authority` start is a no-op).
+   * Idempotent genesis: insert `key` as the founding owner key only when
+   * the party has none yet. Returns true if it inserted, false if an owner
+   * key already existed (so a repeat `--owner` start is a no-op).
    */
-  async ensureAuthorityKey(key: string): Promise<boolean> {
+  async ensureOwnerKey(key: string): Promise<boolean> {
     this.ensureInitialized();
-    if (await this.hasAuthorityKey()) {
-      log('Authority key already present; skipping genesis insert');
+    if (await this.hasOwnerKey()) {
+      log('Owner key already present; skipping genesis insert');
       return false;
     }
-    await this.insertAuthorityKey(key);
+    await this.insertOwnerKey(key);
     return true;
   }
 
   /**
-   * Collect every authority key (`CadreControl.AuthorityKey.Key`) as a set.
+   * Collect every owner key (`CadreControl.OwnerKey.Key`) as a set.
    *
    * This is the steady-state trust anchor for seeds: a seed's signer key is
    * trusted only if it is already enrolled here (see `SeedTrustPolicy`). It is
-   * also the authority-identity source for `queryPeers`, decoupling authority
+   * also the owner-identity source for `queryPeers`, decoupling owner
    * status from the libp2p transport peer ID.
    */
-  async getAuthorityKeys(): Promise<Set<string>> {
+  async getOwnerKeys(): Promise<Set<string>> {
     this.ensureInitialized();
     const keys = new Set<string>();
-    for await (const row of this.db!.eval('select Key from CadreControl.AuthorityKey')) {
+    for await (const row of this.db!.eval('select Key from CadreControl.OwnerKey')) {
       keys.add(row.Key as string);
     }
     return keys;
@@ -399,18 +399,35 @@ export class ControlDatabase {
   /**
    * Enumerate the CadrePeer rows (cadre membership) for admin/membership reads.
    */
-  async queryCadrePeers(): Promise<Array<{ peerId: string; multiaddr: string | null }>> {
+  async queryCadrePeers(): Promise<Array<{ peerId: string; multiaddr: string | null; stampId: string | null; vouchOwner: string | null; vouchSig: string | null }>> {
     this.ensureInitialized();
-    const rows: Array<{ peerId: string; multiaddr: string | null }> = [];
-    for await (const row of this.db!.eval('select PeerId, Multiaddr from CadreControl.CadrePeer')) {
+    const rows: Array<{ peerId: string; multiaddr: string | null; stampId: string | null; vouchOwner: string | null; vouchSig: string | null }> = [];
+    for await (const row of this.db!.eval('select PeerId, Multiaddr, StampId, VouchOwner, VouchSig from CadreControl.CadrePeer')) {
       rows.push({
         peerId: row.PeerId as string,
         multiaddr: (row.Multiaddr as string | null) ?? null,
+        stampId: (row.StampId as string | null) ?? null,
+        vouchOwner: (row.VouchOwner as string | null) ?? null,
+        vouchSig: (row.VouchSig as string | null) ?? null,
       });
     }
     return rows;
   }
 
+  /**
+   * Read a single `CadrePeer` row's single-use `StampId` nonce (null when the row
+   * does not exist). Used by the owner delete / re-touch paths, which must bind
+   * their signature to the row's CURRENT nonce ({@link cadrePeerRemoveDigest} /
+   * {@link cadrePeerVoucherDigest}).
+   */
+  async queryCadrePeerStampId(peerId: string): Promise<string | null> {
+    this.ensureInitialized();
+    for await (const row of this.db!.eval('select StampId from CadreControl.CadrePeer where PeerId = ?', [peerId])) {
+      return (row.StampId as string | null) ?? null;
+    }
+    return null;
+  }
+
   /**
    * Read a single peer's address record (the full `CadrePeer` row) by PeerId.
    *
@@ -444,8 +461,8 @@ export class ControlDatabase {
    *
    * Authorization is carried entirely by the record: the `Sig` column (verified
    * by the `AuthorizedUpdate` self-branch against the stored `PublicKey`) plus
-   * the strictly-increasing `UpdatedAt`. No authority key is involved, so this
-   * is the refresh path for any member — authority or drone — once its row
+   * the strictly-increasing `UpdatedAt`. No owner key is involved, so this
+   * is the refresh path for any member — owner or drone — once its row
    * exists. `PublicKey` is intentionally not in the SET list (it is immutable on
    * self-update and the constraint enforces `new.PublicKey = old.PublicKey`).
    */
@@ -454,7 +471,7 @@ export class ControlDatabase {
     const multiaddr = record.addrs.join(',');
     await this.db!.exec(`
       update CadreControl.CadrePeer
-        with context AuthorityKey = null, Signature = ?
+        with context OwnerKey = null, Signature = ?
         set Multiaddr = ?, UpdatedAt = ?, Sig = ?
         where PeerId = ?
     `, [record.sig, multiaddr, record.updatedAt, record.sig, record.peerId]);
@@ -492,7 +509,7 @@ export class ControlDatabase {
    *
    * Authorization is carried entirely by the record: the `Sig` column (verified by
    * the `DeviceToken.AuthorizedUpdate` self-branch against the stored
-   * `CadrePeer.PublicKey`) plus the strictly-increasing `UpdatedAt`. No authority key
+   * `CadrePeer.PublicKey`) plus the strictly-increasing `UpdatedAt`. No owner key
    * is involved, so this is the refresh / rotation path for any member once both its
    * `CadrePeer` row (for the PublicKey) and its `DeviceToken` row exist. `PeerId` is
    * intentionally not in the SET list (immutable; the constraint enforces
@@ -502,7 +519,7 @@ export class ControlDatabase {
     this.ensureInitialized();
     await this.db!.exec(`
       update CadreControl.DeviceToken
-        with context AuthorityKey = null, Signature = ?
+        with context OwnerKey = null, Signature = ?
         set Platform = ?, Token = ?, UpdatedAt = ?, Sig = ?
         where PeerId = ?
     `, [record.sig, record.platform, record.token, record.updatedAt, record.sig, record.peerId]);
@@ -510,44 +527,44 @@ export class ControlDatabase {
   }
 
   /**
-   * Insert the initial authority key (bootstrap - no existing authorities required)
+   * Insert the initial owner key (bootstrap - no existing owners required)
    */
-  async insertAuthorityKey(key: string): Promise<void> {
+  async insertOwnerKey(key: string): Promise<void> {
     this.ensureInitialized();
-    log('Inserting authority key: %s', key);
+    log('Inserting owner key: %s', key);
 
-    // Bootstrap is authorized by the schema's `(select count(1) from AuthorityKey) <= 1`
+    // Bootstrap is authorized by the schema's `(select count(1) from OwnerKey) <= 1`
     // branch, so no signature is needed. We still persist a fresh, unique StampId in the
     // row's own column to satisfy the not-null/unique anti-replay constraint — the StampId
     // is now a real column value, not the optimystic `StampId()` SQL function.
     const stampId = generateStampId(this.config.libp2pNode.peerId.toString());
     await this.db!.exec(`
-      insert into CadreControl.AuthorityKey (Key, StampId)
-        with context AuthorityKey = null, Signature = null
+      insert into CadreControl.OwnerKey (Key, StampId)
+        with context OwnerKey = null, Signature = null
         values (?, ?)
     `, [key, stampId]);
-    log('Authority key inserted');
+    log('Owner key inserted');
   }
 
   /**
-   * Insert a strand into the control database using an authority signature.
+   * Insert a strand into the control database using an owner signature.
    *
-   * The authority signs the canonical row-bound authorization message (see
+   * The owner signs the canonical row-bound authorization message (see
    * {@link buildAuthorizationMessage}) — NOT a bare stamp — so the signature is bound to
    * this strand's contents and cannot be transplanted onto an attacker-chosen row. The
    * StampId is persisted as a unique column for single-use anti-replay.
    *
    * @param strandId - Unique identifier for the strand
    * @param type - Strand type: 'o' for open, 'c' for closed
-   * @param authorityKey - Public key of the authorizing authority
+   * @param ownerKey - Public key of the authorizing owner
    * @param signMessage - Function that ed25519-signs the raw message bytes (no pre-hash)
-   *   with the authority's private key, returning a base64url signature
+   *   with the owner's private key, returning a base64url signature
    * @param memberPrivateKey - Optional private key for membership in closed strands
    */
   async insertStrand(
     strandId: string,
     type: 'o' | 'c',
-    authorityKey: string,
+    ownerKey: string,
     signMessage: (message: Uint8Array) => string,
     memberPrivateKey?: string
   ): Promise<void> {
@@ -566,29 +583,29 @@ export class ControlDatabase {
     // StampId is a real, unique column (single-use anti-replay), no longer a context value.
     await this.db!.exec(`
       insert into CadreControl.Strand (Id, Type, MemberPrivateKey, StampId)
-        with context AuthorityKey = ?, Signature = ?
+        with context OwnerKey = ?, Signature = ?
         values (?, ?, ?, ?)
-    `, [authorityKey, signature, strandId, type, memberPrivateKey ?? null, stampId]);
+    `, [ownerKey, signature, strandId, type, memberPrivateKey ?? null, stampId]);
 
     log('Strand inserted: %s', strandId);
   }
 
   /**
-   * Insert a validation key into the control database using an authority signature.
+   * Insert a validation key into the control database using an owner signature.
    *
-   * Mirrors {@link insertStrand}: the authority signs the canonical row-bound
+   * Mirrors {@link insertStrand}: the owner signs the canonical row-bound
    * authorization message over (Key, StampId), and the StampId is persisted as a unique
    * column for single-use anti-replay. A `ValidationKey` authorizes verifying strand
    * formation disclosures.
    *
    * @param key - The validation public key to enroll
-   * @param authorityKey - Public key of the authorizing authority
+   * @param ownerKey - Public key of the authorizing owner
    * @param signMessage - Function that ed25519-signs the raw message bytes (no pre-hash)
-   *   with the authority's private key, returning a base64url signature
+   *   with the owner's private key, returning a base64url signature
    */
   async insertValidationKey(
     key: string,
-    authorityKey: string,
+    ownerKey: string,
     signMessage: (message: Uint8Array) => string
   ): Promise<void> {
     this.ensureInitialized();
@@ -603,22 +620,22 @@ export class ControlDatabase {
 
     await this.db!.exec(`
       insert into CadreControl.ValidationKey (Key, StampId)
-        with context AuthorityKey = ?, Signature = ?
+        with context OwnerKey = ?, Signature = ?
         values (?, ?)
-    `, [authorityKey, signature, key, stampId]);
+    `, [ownerKey, signature, key, stampId]);
 
     log('Validation key inserted: %s', key);
   }
 
   /**
-   * Insert an authority-signed `FormationInvite` (open invitation token).
+   * Insert an owner-signed `FormationInvite` (open invitation token).
    *
    * The invite is the on-network record that later authorizes an
-   * authority-signature-FREE `Strand` creation: an invited cadre peer redeems it
+   * owner-signature-FREE `Strand` creation: an invited cadre peer redeems it
    * by inserting a matching `FormationUsage` row (see {@link redeemInvitation}),
    * which satisfies the consent branch of `Strand.Authorized`.
    *
-   * Like {@link insertStrand}/{@link insertValidationKey}, the authority signs the
+   * Like {@link insertStrand}/{@link insertValidationKey}, the owner signs the
    * canonical row-bound authorization message (see {@link buildAuthorizationMessage})
    * over (Token, sAppId, ExpiresAt, TotalUses, ValidationUrl, StrandId, StampId) — NOT a
    * bare stamp — so the signature is bound to this invite's contents and cannot be
@@ -643,7 +660,7 @@ export class ControlDatabase {
    *
    * @param token - Invitation token (the `FormationInvite` primary key)
    * @param sAppId - The sApp a redeemed strand will use
-   * @param authorityKey - Public key of the authorizing authority
+   * @param ownerKey - Public key of the authorizing owner
    * @param signMessage - ed25519-signs the raw message bytes (no pre-hash),
    *   returning a base64url signature — the same callback shape {@link insertStrand} uses
    * @param options - Optional `expiresAtMs` (epoch ms), `totalUses`, `validationUrl`,
@@ -652,7 +669,7 @@ export class ControlDatabase {
   async insertFormationInvite(
     token: string,
     sAppId: string,
-    authorityKey: string,
+    ownerKey: string,
     signMessage: (message: Uint8Array) => string,
     options: { expiresAtMs?: number; totalUses?: number; validationUrl?: string; strandId?: string } = {}
   ): Promise<void> {
@@ -687,10 +704,10 @@ export class ControlDatabase {
     // unique column (single-use anti-replay), no longer a context value.
     await this.db!.exec(`
       insert into CadreControl.FormationInvite (Token, sAppId, ExpiresAt, TotalUses, ValidationUrl, StrandId, StampId)
-        with context AuthorityKey = ?, Signature = ?
+        with context OwnerKey = ?, Signature = ?
         values (?, ?, ?, ?, ?, ?, ?)
     `, [
-      authorityKey, signature,
+      ownerKey, signature,
       token, sAppId,
       expiresAtCanonical,
       options.totalUses ?? null,
@@ -711,7 +728,7 @@ export class ControlDatabase {
    * `FormationUsage.StrandExists` requires the `Strand` row. Both CHECKs contain
    * subqueries, so Quereus auto-defers them to transaction commit — wrapping both
    * inserts in a single explicit `begin … commit` lets both deferred CHECKs see
-   * both rows at commit. The strand is authorised WITHOUT an authority signature
+   * both rows at commit. The strand is authorised WITHOUT an owner signature
    * (the `FormationUsage` branch of `Strand.Authorized`) but still gets a fresh,
    * unique `StampId` column to satisfy the not-null/unique anti-replay column.
    *
@@ -746,11 +763,11 @@ export class ControlDatabase {
 
     await this.db!.beginTransaction();
     try {
-      // 1. Strand row — authorised by the FormationUsage branch (no authority sig),
+      // 1. Strand row — authorised by the FormationUsage branch (no owner sig),
       //    still carrying a fresh unique StampId for the anti-replay column.
       await this.db!.exec(`
         insert into CadreControl.Strand (Id, Type, MemberPrivateKey, StampId)
-          with context AuthorityKey = null, Signature = null
+          with context OwnerKey = null, Signature = null
           values (?, ?, ?, ?)
       `, [strandId, type, memberPrivateKey ?? null, strandStampId]);
 
@@ -778,7 +795,7 @@ export class ControlDatabase {
   /**
    * Record a `FormationUsage` against an **already-existing** `Strand` (no strand
    * insert). This is the redemption path when the strand was provisioned
-   * separately (e.g. authority-signed) and the consent record is added after the
+   * separately (e.g. owner-signed) and the consent record is added after the
    * fact: the single insert auto-commits, and the deferred `StrandExists` CHECK
    * is satisfied by the pre-existing committed strand row. Returns the assigned
    * `UseNumber`.

package/src/control-formation-recorder.ts

@@ -16,7 +16,7 @@ const NEVER_EXPIRES = new Date(8640000000000000);
  * usage questions, and writes the consent row that records a redemption. Two
  * provisioning shapes are supported, keyed on whether the invite binds a host strand:
  *
- * - **Bound (provision-then-record):** the host strand already exists (authority-signed
+ * - **Bound (provision-then-record):** the host strand already exists (owner-signed
  *   up front and named by the invite's `StrandId`), so {@link resolveStrand} reports it
  *   and {@link recordUsage} writes the consent row against that pre-existing strand
  *   (record-only) rather than inserting a new `Strand`.
@@ -74,7 +74,7 @@ export class ControlFormationUsageRecorder implements FormationUsageRecorder {
    * Record consent against an **already-existing** host strand (record-only): the
    * single `FormationUsage` insert auto-commits and the deferred `StrandExists`
    * CHECK is satisfied by the pre-existing strand. This is the provision-then-record
-   * commitment — the strand was minted authority-signed up front, so we do NOT
+   * commitment — the strand was minted owner-signed up front, so we do NOT
    * re-insert it (which would double-insert the same PK). `initiatorKey` is carried
    * as the usage `PeerId` (advisory). Use {@link ControlDatabase.redeemInvitation}
    * for the consent-creates-strand path instead.

package/src/control-schema.ts

@@ -12,30 +12,30 @@
 export const CONTROL_SCHEMA = `-- This manages a Sereus party's cadre, or set of nodes, and their participation in strands (networks)
 declare schema CadreControl {
     -- A key that can authorize various control changes
-    table AuthorityKey (
+    table OwnerKey (
         Key text primary key,
         StampId text not null unique,   -- single-use authorization nonce (anti-replay)
         constraint Authorized check (
-            -- Bootstrap: first authority key needs no existing authorization
-            (select count(1) from AuthorityKey) <= 1
+            -- Bootstrap: first owner key needs no existing authorization
+            (select count(1) from OwnerKey) <= 1
 
-                -- Old authority authorizes by signing over THIS row (Key, StampId); single-use via unique StampId
-                or (old.Key is not null and old.Key = context.AuthorityKey and verify(digest(new.Key, new.StampId), context.Signature, old.Key, 'ed25519'))
+                -- Old owner authorizes by signing over THIS row (Key, StampId); single-use via unique StampId
+                or (old.Key is not null and old.Key = context.OwnerKey and verify(digest(new.Key, new.StampId), context.Signature, old.Key, 'ed25519'))
 
-                -- or other authorities authorize by signing over THIS row (Key, StampId); single-use via unique StampId
-                or exists (select 1 from AuthorityKey A where A.Key = context.AuthorityKey and verify(digest(new.Key, new.StampId), context.Signature, A.Key, 'ed25519'))
+                -- or other owners authorize by signing over THIS row (Key, StampId); single-use via unique StampId
+                or exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(new.Key, new.StampId), context.Signature, A.Key, 'ed25519'))
         )
-    ) with context (AuthorityKey text null, Signature text null);
+    ) with context (OwnerKey text null, Signature text null);
 
     -- A key that can validate a strand formation disclosure
     table ValidationKey (
         Key text primary key,
         StampId text not null unique,   -- single-use authorization nonce (anti-replay)
         constraint Authorized check (
-            -- Authorities authorize by signing over THIS row (Key, StampId); single-use via unique StampId
-            exists (select 1 from AuthorityKey A where A.Key = context.AuthorityKey and verify(digest(new.Key, new.StampId), context.Signature, A.Key, 'ed25519'))
+            -- Owners authorize by signing over THIS row (Key, StampId); single-use via unique StampId
+            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(new.Key, new.StampId), context.Signature, A.Key, 'ed25519'))
         )
-    ) with context (AuthorityKey text, Signature text);
+    ) with context (OwnerKey text, Signature text);
 
     -- A network of members sharing an sApp database, each contributing peer nodes (their cadre) to the overall cohort
     -- Cadre peers should participate in each of these strands
@@ -45,8 +45,8 @@ declare schema CadreControl {
         Type text, -- Types: 'o' = Open, 'c' = Closed -- Open can still control writes in the sApp, but only Closed controls reads
         StampId text not null unique,   -- single-use authorization nonce (anti-replay)
         constraint Authorized check (
-            -- Authorized by an authority signing over THIS row (Id, Type, MemberPrivateKey, StampId); single-use via unique StampId
-            exists (select 1 from AuthorityKey A where A.Key = context.AuthorityKey and verify(digest(new.Id, new.Type, coalesce(new.MemberPrivateKey, ''), new.StampId), context.Signature, A.Key, 'ed25519'))
+            -- Authorized by an owner signing over THIS row (Id, Type, MemberPrivateKey, StampId); single-use via unique StampId
+            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(new.Id, new.Type, coalesce(new.MemberPrivateKey, ''), new.StampId), context.Signature, A.Key, 'ed25519'))
 
                 -- or authorized by a cadre peer who has received a valid formation invitation.
                 -- That path has no signed writer yet; when one is built it must still supply a
@@ -58,7 +58,7 @@ declare schema CadreControl {
             -- member key. A non-null MemberPrivateKey requires a closed strand ('c').
             new.MemberPrivateKey is null or new.Type = 'c'
         )
-    ) with context (AuthorityKey text, Signature text);
+    ) with context (OwnerKey text, Signature text);
 
     -- A peer (node) that is part of the cadre, carrying a self-published,
     -- freshness-stamped, self-signed address record (see PeerAddressRecord in cadre-core).
@@ -70,31 +70,55 @@ declare schema CadreControl {
         Multiaddr text,                 -- comma-joined current addrs (signaling / p2p-circuit first)
         UpdatedAt int null,             -- epoch ms; strictly increases per self-update (replay/rollback guard)
         Sig text null,                  -- ed25519 self-signature over the signed payload (base64url); null until self-published
-        constraint AuthorizedInsert check on insert, delete (
-            -- Authorized by an authority key, which vouches both membership and the
+        StampId text not null unique,    -- single-use authorization nonce (anti-replay), bound into the voucher/remove digests; rotates on (re)insert
+        VouchOwner text null,        -- ed25519 (base64url) owner key that vouched this membership (== insert context.OwnerKey)
+        VouchSig text null,              -- that owner's signature over digest(PeerId, StampId) (== insert context.Signature). A reader checks VouchOwner against its NODE-LOCAL trusted-owner anchor (not this replicated table, which a self-owner can pollute) to decide authorized membership.
+        constraint AuthorizedInsert check on insert (
+            -- Authorized by an owner key, which vouches both membership and the
             -- PublicKey<->PeerId binding (cadre-core derives PublicKey from PeerId before insert).
-            -- The single-field digest frames the base58btc PeerId as TEXT, matching
-            -- cadre-core peer-authorization.ts:peerAuthorizationDigest.
-            exists (select 1 from AuthorityKey A where A.Key = context.AuthorityKey and verify(digest(coalesce(new.PeerId, old.PeerId)), context.Signature, A.Key, 'ed25519'))
+            -- The digest binds PeerId + the single-use StampId nonce (two TEXT fields),
+            -- matching cadre-core peer-authorization.ts:cadrePeerVoucherDigest.
+            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(new.PeerId, new.StampId), context.Signature, A.Key, 'ed25519'))
+            -- Persist the vouching (owner, signature) onto the row so a reader can later
+            -- re-check VouchOwner against its node-local anchor. The stored pair MUST equal
+            -- the pair the verify above validated, so a writer cannot store a voucher it did
+            -- not actually receive a signature for.
+            and new.VouchOwner = context.OwnerKey
+            and new.VouchSig = context.Signature
+        ),
+        constraint AuthorizedDelete check on delete (
+            -- Delete is authorized by a signature over a DISTINCT 'remove'-scoped digest bound
+            -- to the row's StampId (cadre-core peer-authorization.ts:cadrePeerRemoveDigest), so
+            -- the stored voucher (a signature over digest(PeerId, StampId)) can NEVER be replayed
+            -- to authorize a delete. The remove signature rides in context and is never stored.
+            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(old.PeerId, old.StampId, 'remove'), context.Signature, A.Key, 'ed25519'))
         ),
         constraint AuthorizedUpdate check on update (
             -- Peer self-updates its own addrs + freshness, signing with its OWN ed25519 key
-            -- (the key behind PeerId). PeerId/PublicKey are immutable on self-update, UpdatedAt
-            -- must strictly increase (replay guard), and Sig is verified against the stored
-            -- PublicKey over the same payload the publish path signs
+            -- (the key behind PeerId). PeerId/PublicKey/StampId/voucher are immutable on
+            -- self-update, UpdatedAt must strictly increase (replay guard), and Sig is verified
+            -- against the stored PublicKey over the same payload the publish path signs
             -- (cadre-core peer-record.ts:peerRecordSignedPayload).
             (
                 new.PeerId = old.PeerId
                 and new.PublicKey = old.PublicKey
+                and new.StampId = old.StampId
+                and new.VouchOwner = old.VouchOwner
+                and new.VouchSig = old.VouchSig
                 and new.UpdatedAt > coalesce(old.UpdatedAt, 0)
                 and verify(
                         digest(new.PeerId || '|' || new.Multiaddr || '|' || cast(new.UpdatedAt as text)),
                         new.Sig, new.PublicKey, 'ed25519')
             )
-                -- or an authority re-authorizes (rotation / correction)
-                or exists (select 1 from AuthorityKey A where A.Key = context.AuthorityKey and verify(digest(new.PeerId), context.Signature, A.Key, 'ed25519'))
+                -- or an owner re-authorizes (rotation / correction): re-vouches the row over
+                -- its current StampId, so the stored voucher is re-bound to the re-authorizing owner.
+                or (
+                    exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(new.PeerId, new.StampId), context.Signature, A.Key, 'ed25519'))
+                    and new.VouchOwner = context.OwnerKey
+                    and new.VouchSig = context.Signature
+                )
         )
-    ) with context (AuthorityKey text null, Signature text);
+    ) with context (OwnerKey text null, Signature text);
 
     -- A mobile cadre peer's platform push token (FCM/APNs), self-published so a
     -- server peer can deliver a push-wake to a suspended app over the platform push
@@ -109,9 +133,9 @@ declare schema CadreControl {
         UpdatedAt int null,             -- epoch ms; strictly increases per self-update (replay guard)
         Sig text null,                  -- ed25519 self-sig over (PeerId|Platform|Token|UpdatedAt)
         constraint AuthorizedInsert check on insert, delete (
-            -- Authorized by an authority key (membership vouch), exactly like CadrePeer.
+            -- Authorized by an owner key (membership vouch), exactly like CadrePeer.
             -- The single-field digest frames the base58btc PeerId as TEXT.
-            exists (select 1 from AuthorityKey A where A.Key = context.AuthorityKey and verify(digest(coalesce(new.PeerId, old.PeerId)), context.Signature, A.Key, 'ed25519'))
+            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(coalesce(new.PeerId, old.PeerId)), context.Signature, A.Key, 'ed25519'))
         ),
         constraint AuthorizedUpdate check on update (
             -- Peer self-updates its own token, signing with its OWN ed25519 key (the key
@@ -126,10 +150,10 @@ declare schema CadreControl {
                         digest(new.PeerId || '|' || new.Platform || '|' || new.Token || '|' || cast(new.UpdatedAt as text)),
                         new.Sig, P.PublicKey, 'ed25519'))
             )
-                -- or an authority re-authorizes (rotation / correction)
-                or exists (select 1 from AuthorityKey A where A.Key = context.AuthorityKey and verify(digest(new.PeerId), context.Signature, A.Key, 'ed25519'))
+                -- or an owner re-authorizes (rotation / correction)
+                or exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(digest(new.PeerId), context.Signature, A.Key, 'ed25519'))
         )
-    ) with context (AuthorityKey text null, Signature text);
+    ) with context (OwnerKey text null, Signature text);
 
     -- An open invitation to form a strand with this party
     table FormationInvite (
@@ -141,11 +165,11 @@ declare schema CadreControl {
         StrandId text null,   -- Host strand this invite binds to (provision-then-record). Non-null => the responder records consent against this pre-existing strand; null => legacy responder-provisions path.
         StampId text not null unique,   -- single-use authorization nonce (anti-replay)
         constraint AuthorizedAddOrRemove check on insert, delete (
-            -- Authorized by an authority signing over THIS row
+            -- Authorized by an owner signing over THIS row
             -- (Token, sAppId, ExpiresAt, TotalUses, ValidationUrl, StrandId, StampId); single-use via unique StampId.
             -- coalesce(new.F, old.F) binds the NEW row on insert and the OLD row on delete (cf. CadrePeer).
             -- StrandId is a nullable bound field: it signs as '' when absent (cf. ValidationUrl).
-            exists (select 1 from AuthorityKey A where A.Key = context.AuthorityKey and verify(
+            exists (select 1 from OwnerKey A where A.Key = context.OwnerKey and verify(
                 digest(
                     coalesce(new.Token, old.Token),
                     coalesce(new.sAppId, old.sAppId),
@@ -163,7 +187,7 @@ declare schema CadreControl {
         -- defaults to insert+update; the check on insert, delete above excludes update,
         -- so this guard is required. Mirrors FormationUsage.InsertOnly.
         constraint Immutable check on update (false)
-    ) with context (AuthorityKey text, Signature text);
+    ) with context (OwnerKey text, Signature text);
 
     table FormationUsage (
         Token text,