@serfab/cadre-core 1.13.0 → 1.14.0

package/src/seed-trust-policy.ts

@@ -1,140 +1,353 @@
-/**
- * Trust-anchor policy for control-network seeds.
- *
- * A seed carries an ed25519 signature over its body and the `signerKey` that
- * produced it. Verifying that signature only proves the seed is internally
- * consistent — it does NOT prove the signer is an owner, because both the
- * signer key and the seed's own `isOwner` peer flags are attacker-supplied.
- * The trust decision must therefore rest on an anchor that does not come from
- * the seed body:
- *
- *  1. Anchored — keys in the receiver's NODE-LOCAL `TrustedOwnerStore`: the
- *     non-replicated, per-party record of owner keys established out of band
- *     (founding the party, the `CadreInvite` that enrolled this node, an
- *     operator pin). Deliberately NOT the replicated `CadreControl.OwnerKey`
- *     table — any connecting node can genesis-insert its own key there and let
- *     it replicate, so that table can be made to say "yes" by a stranger.
- *  2. Pinned out-of-band — keys handed to the node for this seed only (carried
- *     by a `CadreInvite.ownerKeys`, or pinned by an operator) without having
- *     been anchored yet.
- *  3. TOFU (opt-in) — an explicit confirmation callback invoked on first sight
- *     of an unknown signer key. Interactive hosts only; off by default.
- *
- * Secure default (`anchoredTrustPolicy`): a node with an empty anchor and no
- * pinned keys rejects the seed — a seed can no longer vouch for its own signer,
- * and neither can a polluted replicated table.
- *
- * A key accepted via anchor 2 or 3 is reported back through
- * {@link SeedTrustDecision.anchorAs} so `applySeed` can persist it into the
- * node-local anchor, and later seeds from the same owner are accepted without
- * re-supplying the invite/confirmation.
- */
-import type { TrustSource } from './trusted-owner-store.js';
-
-export interface SeedTrustContext {
-  /** Party the seed claims to belong to. */
-  partyId: string;
-  /** ed25519 base64url signer key — already signature-verified by `applySeed`. */
-  signerKey: string;
-  /**
-   * The receiver's anchored owner keys, sourced from its node-local
-   * `TrustedOwnerStore` — NOT from the seed, and NOT from the replicated
-   * `OwnerKey` table. Empty for a node whose anchor was never seeded.
-   */
-  knownOwnerKeys: ReadonlySet<string>;
-}
-
-export interface SeedTrustDecision {
-  /** Whether the signer key is trusted. */
-  trusted: boolean;
-  /** Human-readable reason, surfaced as the seed-apply error when not trusted. */
-  reason?: string;
-  /**
-   * Set when the key was trusted via an anchor OUTSIDE the node-local store (a
-   * pinned key, a TOFU confirmation): the provenance to record it under, so
-   * `applySeed` persists it and the next seed from that owner is anchored
-   * without re-supplying the pin. Omitted when the key was already anchored
-   * (nothing to persist) or not trusted at all.
-   */
-  anchorAs?: Exclude<TrustSource, 'genesis'>;
-}
-
-/**
- * Decides whether a signature-verified seed's signer key should be trusted.
- * May be synchronous (anchored/pinned) or asynchronous (TOFU confirmation).
- */
-export interface SeedTrustPolicy {
-  evaluate(ctx: SeedTrustContext): Promise<SeedTrustDecision> | SeedTrustDecision;
-}
-
-/**
- * Default policy: trust only keys already in the receiver's node-local
- * trusted-owner anchor. A node whose anchor was never seeded (no genesis, no
- * invite pin, no operator pin) rejects every seed.
- */
-export function anchoredTrustPolicy(): SeedTrustPolicy {
-  return {
-    evaluate({ signerKey, knownOwnerKeys }) {
-      if (knownOwnerKeys.has(signerKey)) {
-        return { trusted: true };
-      }
-      return {
-        trusted: false,
-        reason: 'Signer key is not an anchored owner (anchored trust policy)',
-      };
-    },
-  };
-}
-
-/**
- * Cold-start policy: trust anchored keys plus a set pinned out-of-band
- * (typically `CadreInvite.ownerKeys` or operator config). Lets an unenrolled
- * invitee accept its first seed without the seed vouching for itself.
- *
- * @param anchorAs - provenance under which a pin-only acceptance is persisted
- *   into the node-local anchor ('invite' by default — the invite-redemption
- *   case; pass 'operator' for an operator-supplied pin).
- */
-export function pinnedKeyTrustPolicy(
-  pinned: Iterable<string>,
-  anchorAs: Exclude<TrustSource, 'genesis'> = 'invite'
-): SeedTrustPolicy {
-  const pinnedSet = new Set(pinned);
-  return {
-    evaluate({ signerKey, knownOwnerKeys }) {
-      if (knownOwnerKeys.has(signerKey)) {
-        return { trusted: true };
-      }
-      if (pinnedSet.has(signerKey)) {
-        return { trusted: true, anchorAs };
-      }
-      return {
-        trusted: false,
-        reason: 'Signer key is neither an anchored nor a pinned owner (pinned-key trust policy)',
-      };
-    },
-  };
-}
-
-/**
- * Opt-in interactive policy: trust keys already in the node-local anchor, and
- * on an unknown key invoke `confirm` (e.g. a trust-circle UI prompt). The key is
- * trusted iff `confirm` resolves true, and a confirmed key is persisted into the
- * anchor as an 'operator' pin (a human at the console is the same provenance as
- * an explicit operator pin) so the prompt is not repeated. Not enabled by default.
- */
-export function tofuTrustPolicy(
-  confirm: (ctx: SeedTrustContext) => Promise<boolean>
-): SeedTrustPolicy {
-  return {
-    async evaluate(ctx) {
-      if (ctx.knownOwnerKeys.has(ctx.signerKey)) {
-        return { trusted: true };
-      }
-      const accepted = await confirm(ctx);
-      return accepted
-        ? { trusted: true, anchorAs: 'operator' }
-        : { trusted: false, reason: 'TOFU confirmation declined for unknown signer key' };
-    },
-  };
-}
+/**
+ * Trust-anchor policy for control-network seeds.
+ *
+ * A seed carries an ed25519 signature over its body and the `signerKey` that
+ * produced it. Verifying that signature only proves the seed is internally
+ * consistent — it does NOT prove the signer is an owner, because both the
+ * signer key and the seed's own `isOwner` peer flags are attacker-supplied.
+ * The trust decision must therefore rest on an anchor that does not come from
+ * the seed body:
+ *
+ *  1. Anchored — keys in the receiver's NODE-LOCAL `TrustedOwnerStore`: the
+ *     non-replicated, per-party record of owner keys established out of band
+ *     (founding the party, the cadre invitation that enrolled this node, an
+ *     operator pin, a claim). Deliberately NOT the replicated `CadreControl.OwnerKey`
+ *     table — any connecting node can genesis-insert its own key there and let
+ *     it replicate, so that table can be made to say "yes" by a stranger.
+ *  2. Pinned out-of-band — keys handed to the node for this seed only (carried
+ *     by a cadre invitation's `ownerKeys`, or pinned by an operator) without having
+ *     been anchored yet.
+ *  3. Claim secret — a brand-new node that belongs to nobody accepts its first seed
+ *     from whoever proves they hold its one-time claim secret (`claim-proof.ts`), and
+ *     anchors that signer itself under source `claim`.
+ *  4. TOFU (opt-in) — an explicit confirmation callback invoked on first sight
+ *     of an unknown signer key. Interactive hosts only; off by default.
+ *
+ * Secure default (`anchoredTrustPolicy`): a node with an empty anchor and no
+ * pinned keys rejects the seed — a seed can no longer vouch for its own signer,
+ * and neither can a polluted replicated table.
+ *
+ * A key accepted via anchor 2 or 4 is reported back through
+ * {@link SeedTrustDecision.anchorAs} so `applySeed` can persist it into the
+ * node-local anchor, and later seeds from the same owner are accepted without
+ * re-supplying the invite/confirmation. Anchor 3 persists the key itself before it
+ * answers, because for a claim the persist must succeed for the acceptance to mean
+ * anything (see {@link claimSecretTrustPolicy}).
+ */
+import debug from 'debug';
+import type { NodeClaimRecord, SeedRefusalCode } from './types.js';
+import type { TrustSource, TrustedOwnerStore } from './trusted-owner-store.js';
+import { verifyClaimProof } from './claim-proof.js';
+
+const log = debug('sereus:cadre:seed-trust-policy');
+
+export interface SeedTrustContext {
+  /** Party the seed claims to belong to. */
+  partyId: string;
+  /** ed25519 base64url signer key — already signature-verified by `applySeed`. */
+  signerKey: string;
+  /**
+   * The receiver's anchored owner keys, sourced from its node-local
+   * `TrustedOwnerStore` — NOT from the seed, and NOT from the replicated
+   * `OwnerKey` table. Empty for a node whose anchor was never seeded.
+   */
+  knownOwnerKeys: ReadonlySet<string>;
+  /**
+   * The receiver's OWN libp2p peer id. A claim proof is bound to the node it was
+   * minted for, and this is the receiver's side of that binding; it must never be
+   * taken from the message.
+   */
+  localPeerId: string;
+  /**
+   * The seed's signature digest (`seedDigest` in `seed-bootstrap.ts`), computed once
+   * per seed and shared with the signature check. The third field a claim proof binds.
+   */
+  seedDigest: string;
+  /** The claim proof the message carried beside the seed, if any (`SeedMessage.claimProof`). */
+  claimProof?: string;
+  /** The delivering peer, when the seed arrived over the wire; absent for a local `applySeed`. */
+  remotePeerId?: string;
+}
+
+export interface SeedTrustDecision {
+  /** Whether the signer key is trusted. */
+  trusted: boolean;
+  /** Human-readable reason, surfaced as the seed-apply error when not trusted. */
+  reason?: string;
+  /** Machine-readable refusal cause, for callers that must branch on it (the claiming phone). */
+  code?: SeedRefusalCode;
+  /**
+   * Set when the key was trusted via an anchor OUTSIDE the node-local store (a
+   * pinned key, a TOFU confirmation): the provenance to record it under, so
+   * `applySeed` persists it and the next seed from that owner is anchored
+   * without re-supplying the pin. Omitted when the key was already anchored
+   * (nothing to persist) or not trusted at all.
+   *
+   * `claim` is excluded on purpose: `applySeed` logs and continues when this persist
+   * fails, which is right for a pin that is re-supplied at the next start and wrong for
+   * a claim, so the claim policy anchors its signer itself and never asks for it here.
+   */
+  anchorAs?: Exclude<TrustSource, 'genesis' | 'claim'>;
+}
+
+/**
+ * Decides whether a signature-verified seed's signer key should be trusted.
+ * May be synchronous (anchored/pinned) or asynchronous (TOFU confirmation, claim).
+ */
+export interface SeedTrustPolicy {
+  evaluate(ctx: SeedTrustContext): Promise<SeedTrustDecision> | SeedTrustDecision;
+}
+
+/**
+ * Default policy: trust only keys already in the receiver's node-local
+ * trusted-owner anchor. A node whose anchor was never seeded (no genesis, no
+ * invite pin, no operator pin) rejects every seed.
+ */
+export function anchoredTrustPolicy(): SeedTrustPolicy {
+  return {
+    evaluate({ signerKey, knownOwnerKeys }) {
+      if (knownOwnerKeys.has(signerKey)) {
+        return { trusted: true };
+      }
+      return {
+        trusted: false,
+        reason: 'Signer key is not an anchored owner (anchored trust policy)',
+      };
+    },
+  };
+}
+
+/**
+ * Cold-start policy: trust anchored keys plus a set pinned out-of-band
+ * (typically a cadre invitation's `ownerKeys` or operator config). Lets an unenrolled
+ * invitee accept its first seed without the seed vouching for itself.
+ *
+ * @param anchorAs - provenance under which a pin-only acceptance is persisted
+ *   into the node-local anchor ('invite' by default — the invite-redemption
+ *   case; pass 'operator' for an operator-supplied pin).
+ */
+export function pinnedKeyTrustPolicy(
+  pinned: Iterable<string>,
+  anchorAs: Exclude<TrustSource, 'genesis' | 'claim'> = 'invite'
+): SeedTrustPolicy {
+  const pinnedSet = new Set(pinned);
+  return {
+    evaluate({ signerKey, knownOwnerKeys }) {
+      if (knownOwnerKeys.has(signerKey)) {
+        return { trusted: true };
+      }
+      if (pinnedSet.has(signerKey)) {
+        return { trusted: true, anchorAs };
+      }
+      return {
+        trusted: false,
+        reason: 'Signer key is neither an anchored nor a pinned owner (pinned-key trust policy)',
+      };
+    },
+  };
+}
+
+/**
+ * Opt-in interactive policy: trust keys already in the node-local anchor, and
+ * on an unknown key invoke `confirm` (e.g. a host UI prompt). The key is
+ * trusted iff `confirm` resolves true, and a confirmed key is persisted into the
+ * anchor as an 'operator' pin (a human at the console is the same provenance as
+ * an explicit operator pin) so the prompt is not repeated. Not enabled by default.
+ */
+export function tofuTrustPolicy(
+  confirm: (ctx: SeedTrustContext) => Promise<boolean>
+): SeedTrustPolicy {
+  return {
+    async evaluate(ctx) {
+      if (ctx.knownOwnerKeys.has(ctx.signerKey)) {
+        return { trusted: true };
+      }
+      const accepted = await confirm(ctx);
+      return accepted
+        ? { trusted: true, anchorAs: 'operator' }
+        : { trusted: false, reason: 'TOFU confirmation declined for unknown signer key' };
+    },
+  };
+}
+
+/** Failed proofs tolerated inside one window before further proofs are refused unverified. */
+const DEFAULT_CLAIM_FAILURE_LIMIT = 10;
+/** The sliding window the failure limit counts over (ms). */
+const DEFAULT_CLAIM_FAILURE_WINDOW_MS = 60_000;
+
+export interface ClaimSecretTrustPolicyOptions {
+  /** The node's one-time claim secret, already parsed (`parseClaimSecret`): 32 bytes. */
+  secret: Uint8Array;
+  /**
+   * The node's anchor. A key under source `claim` here is the durable "this node is
+   * claimed" marker; the policy writes it and awaits its durability before accepting.
+   * Must be the same store the `SeedBootstrapService` snapshots into
+   * `SeedTrustContext.knownOwnerKeys`: steps 1 and 2 read that snapshot, and a claim
+   * written to a different store would never be seen there.
+   */
+  trustedOwners: TrustedOwnerStore;
+  /**
+   * Record the claim — the seed's party and the claimant's key — BEFORE the claimant is
+   * anchored, and await its durability (`CadreNodeConfig.claim.record`). The party is the
+   * one fact the anchor cannot hold: an unclaimed node's own party is a placeholder, and
+   * the claim seed is the first thing to name the real one. A rejection refuses the claim
+   * `claim-not-persisted` with nothing anchored. Optional: a policy with nothing to record
+   * only anchors.
+   */
+  recordClaim?: (claim: NodeClaimRecord) => Promise<void>;
+  /** Called once, after the claim is durable, with the party and owner key that claimed the node. */
+  onClaimed?: (claim: NodeClaimRecord) => void;
+  /** Failed proofs tolerated per window; default {@link DEFAULT_CLAIM_FAILURE_LIMIT}. */
+  failureLimit?: number;
+  /** The window those failures are counted over (ms); default {@link DEFAULT_CLAIM_FAILURE_WINDOW_MS}. */
+  failureWindowMs?: number;
+  /** Clock, injectable for tests; defaults to `Date.now`. */
+  now?: () => number;
+}
+
+/**
+ * Cold-start policy for a node that belongs to nobody yet: accept the first seed whose
+ * sender proves it holds this node's one-time claim secret, anchor that signer under
+ * source `claim`, and from then on behave as the anchored policy.
+ *
+ * Decision order, for a signer key `K` with proof `P`:
+ *
+ *  1. `K` is anchored → trusted. The node was claimed by this owner earlier, possibly in
+ *     an earlier process. This is also why a claimed node restarted with the secret still
+ *     in its config ignores the secret.
+ *  2. The anchor holds some other key, or the in-process latch names another key →
+ *     refused, `already-claimed`.
+ *  3. The latch names `K` → trusted. The same owner re-sent while its first delivery's
+ *     persist is still in flight (a dropped response); idempotent success.
+ *  4. No `P` → refused, `claim-proof-invalid`.
+ *  5. Too many failed proofs recently → refused, `claim-rate-limited`, without verifying.
+ *  6. `P` does not verify → one failure counted, refused, `claim-proof-invalid`.
+ *  7. Latch `K`, then `recordClaim({ partyId, ownerKey: K })` and await it. Rejected →
+ *     clear the latch, refuse `claim-not-persisted` with nothing anchored.
+ *  8. `trustedOwners.trust(K, 'claim')` and await it. Durable → trusted, with no
+ *     `anchorAs` (the policy anchored the key itself). Persist rejected → remove `K`
+ *     from the anchor, clear the latch, refuse `claim-not-persisted`; the claimant may
+ *     retry. The record stands: an embedder that starts from its record comes up
+ *     claimed by `K`, and `K`'s retry is accepted at step 1.
+ *
+ * The anchor write is the commit point. `SeedBootstrapService.anchorAcceptedSigner`
+ * deliberately logs and continues when a persist fails, which is right for a pin that
+ * is re-supplied at the next start but wrong here: a lost claim anchor would leave the
+ * node unclaimed again after a restart with nobody told. Keeping the latch, the anchor
+ * write and the rollback in one object is what lets the refusal be definite.
+ *
+ * The record goes first because it names the party, which the anchor does not. A crash
+ * between the two leaves a record and an empty anchor, which the embedder's next start
+ * repairs (above); the other order would leave an anchored node that serves its
+ * placeholder party forever with no record of the real one.
+ *
+ * The failure limit is node-wide, not per peer: libp2p peer ids are free to mint, so a
+ * per-peer limit is bypassed by reconnecting. With a 256-bit secret guessing is
+ * infeasible either way; the limit bounds CPU and log noise, not security.
+ */
+export function claimSecretTrustPolicy(options: ClaimSecretTrustPolicyOptions): SeedTrustPolicy {
+  const { secret, trustedOwners, recordClaim, onClaimed } = options;
+  const failureLimit = options.failureLimit ?? DEFAULT_CLAIM_FAILURE_LIMIT;
+  const failureWindowMs = options.failureWindowMs ?? DEFAULT_CLAIM_FAILURE_WINDOW_MS;
+  const now = options.now ?? (() => Date.now());
+
+  /**
+   * The signer whose claim this process has accepted or is persisting. Set
+   * synchronously in `evaluate`, before its first `await`, so a second claimant whose
+   * evaluation interleaves with the first's persist sees it and is refused.
+   */
+  let latchedSigner: string | undefined;
+  /** Wall-clock times of recent failed proofs, oldest first. */
+  const failureTimes: number[] = [];
+
+  function refuse(code: SeedRefusalCode, reason: string): SeedTrustDecision {
+    return { trusted: false, code, reason };
+  }
+
+  /** Drop failures older than the window, then say whether the limit is reached. */
+  function rateLimited(at: number): boolean {
+    while (failureTimes.length > 0 && failureTimes[0]! <= at - failureWindowMs) {
+      failureTimes.shift();
+    }
+    return failureTimes.length >= failureLimit;
+  }
+
+  /** Steps 7 and 8: record the claim, then anchor the claimant; either failure refuses. */
+  async function anchorClaim(claim: NodeClaimRecord): Promise<SeedTrustDecision> {
+    try {
+      await recordClaim?.(claim);
+    } catch (error) {
+      log('claim record failed; the node stays unclaimed: %o', error);
+      latchedSigner = undefined;
+      return refuse('claim-not-persisted', 'This node could not durably record the claim; it remains unclaimed, retry');
+    }
+    try {
+      await trustedOwners.trust(claim.ownerKey, 'claim');
+    } catch (error) {
+      log('claim anchor persist failed; rolling the claim back: %o', error);
+      await rollbackClaim(claim.ownerKey);
+      return refuse('claim-not-persisted', 'This node could not durably record the claim; it remains unclaimed, retry');
+    }
+    log('node claimed by signer %s into party %s', claim.ownerKey, claim.partyId);
+    notifyClaimed(claim);
+    return { trusted: true };
+  }
+
+  /**
+   * Undo an in-memory anchor whose persist failed, so the node is unclaimed again.
+   * Best effort: the remove is a second write to the same slot and may fail the same
+   * way, and the latch clears regardless so the claimant (or another) can retry. A
+   * claimant refused `already-claimed` while this was in flight was refused wrongly and
+   * simply retries; acceptable.
+   */
+  async function rollbackClaim(signerKey: string): Promise<void> {
+    try {
+      await trustedOwners.remove(signerKey);
+    } catch (error) {
+      log('failed to remove the un-persisted claim anchor for %s: %o', signerKey, error);
+    }
+    latchedSigner = undefined;
+  }
+
+  /** The claim is durable whatever the callback does; a throwing embedder must not undo it. */
+  function notifyClaimed(claim: NodeClaimRecord): void {
+    try {
+      onClaimed?.(claim);
+    } catch (error) {
+      log('onClaimed callback threw; the claim stands: %o', error);
+    }
+  }
+
+  return {
+    evaluate(ctx) {
+      if (ctx.knownOwnerKeys.has(ctx.signerKey)) {
+        return { trusted: true };
+      }
+      if (ctx.knownOwnerKeys.size > 0 || (latchedSigner !== undefined && latchedSigner !== ctx.signerKey)) {
+        return refuse('already-claimed', 'This node has already been claimed by another owner');
+      }
+      if (latchedSigner === ctx.signerKey) {
+        return { trusted: true };
+      }
+      if (ctx.claimProof === undefined) {
+        return refuse('claim-proof-invalid', 'This node is unclaimed and accepts only a seed carrying its claim proof');
+      }
+      const at = now();
+      if (rateLimited(at)) {
+        return refuse('claim-rate-limited', 'Too many failed claim proofs recently; retry later');
+      }
+      if (!verifyClaimProof(secret, ctx.localPeerId, ctx.signerKey, ctx.seedDigest, ctx.claimProof)) {
+        failureTimes.push(at);
+        log('claim proof from %s did not verify (%d recent failure(s))', ctx.remotePeerId ?? 'local', failureTimes.length);
+        return refuse('claim-proof-invalid', 'The claim proof does not verify for this node, signer and seed');
+      }
+      // Everything above ran synchronously: this is the first point the policy yields,
+      // and the latch is set before it. Two claimants racing with valid proofs therefore
+      // cannot both reach the record or the anchor write; the second sees the latch at
+      // step 2. The party is the seed's: signed by the claimant, and the only statement of
+      // which cadre this node now belongs to.
+      latchedSigner = ctx.signerKey;
+      return anchorClaim({ partyId: ctx.partyId, ownerKey: ctx.signerKey });
+    },
+  };
+}

package/src/strand-addr-protocol.ts

@@ -18,14 +18,14 @@
  * one stream, so each side reads to EOF (under a read timeout) and decodes one
  * frame via the shared {@link decodeLengthPrefixedFrame} guard.
  *
- * **Authorization (v1):** like wake, the receiver defers entirely to the injected
- * `isMember` predicate and requires no further signature; a peer it rejects gets
- * a `refused` reply with no addresses. `CadreNode` injects its AUTHORIZED-membership predicate
- * (`isAuthorizedMember`: voucher on the requester's `CadrePeer` row verified
- * against the node-local trusted-owner anchor), so an outsider that published its
- * own rows into the replicated control DB cannot harvest live strand addresses.
- * Cross-party strand bootstrap is a different mechanism (strand formation /
- * `MemberPeer`) and is out of scope here.
+ * **Authorization (v1):** like wake, the request carries no signature. Membership
+ * is checked before this handler runs, by the control node's protocol guard
+ * (`control-protocol-guard.ts`, the `members` class: `CadreNode.isAuthorizedMember`,
+ * a voucher on the requester's `CadrePeer` row verified against the node-local
+ * trusted-owner anchor). A peer it refuses gets its stream reset, never a reply, so
+ * an outsider that published its own rows into the replicated control DB can neither
+ * harvest live strand addresses nor announce a delegate. Cross-party strand bootstrap
+ * is a different mechanism (strand formation / `MemberPeer`) and is out of scope here.
  */
 
 import debug from 'debug';
@@ -69,7 +69,7 @@ async function readFrame<T>(stream: ControlStream, timeoutMs: number): Promise<T
   return JSON.parse(new TextDecoder().decode(body)) as T;
 }
 
-/** An address-free reply, for every path but a member's lookup: cap, unreadable request, lookup failure, non-member. */
+/** An address-free reply, for every path but a lookup: over the cap, an unreadable request, a lookup that threw. */
 function addrlessResponse(status: StrandAddrStatus, strandId: string): StrandAddrResponse {
   return { status, strandId, multiaddrs: [] };
 }
@@ -79,8 +79,6 @@ function addrlessResponse(status: StrandAddrStatus, strandId: string): StrandAdd
  * (`CadreNode`), injected so the service is testable without a full node.
  */
 export interface StrandAddrServiceOptions {
-  /** Membership gate: is the remote peer a `CadrePeer` member of this cadre? */
-  isMember(remotePeerId: string): Promise<boolean>;
   /**
    * The local strand instance's dialable strand-network multiaddrs, ordered
    * signaling-first. Returns `[]` when the strand is not running / has no live
@@ -90,8 +88,9 @@ export interface StrandAddrServiceOptions {
   getStrandMultiaddrs(strandId: string): string[];
   /**
    * Called when a member's request carries a `delegatePeerId` — the derived
-   * transport peerId its strand-`strandId` node runs as. Invoked only AFTER the
-   * `isMember` gate passed, with a validated (parseable, non-self) peerId.
+   * transport peerId its strand-`strandId` node runs as, with a validated
+   * (parseable, non-self) peerId. Every caller is an authorized member: the
+   * protocol guard admitted it before this handler ran.
    * `CadreNode` injects its delegate-admission grant recorder so this node's
    * connection gate — and thus its circuit-relay server, when it runs one —
    * admits that peerId (see `delegate-admission.ts`). Optional: absent, an
@@ -114,10 +113,10 @@ export interface StrandAddrServiceOptions {
 
 /**
  * Receiver side of the strand-address RPC. Registers a `STRAND_ADDR_PROTOCOL`
- * handler on the control node and, for each inbound {@link StrandAddrRequest},
- * gates on cadre membership, then replies with the local strand instance's live
- * multiaddrs — `ok` with an empty list when the strand is not running, `refused`
- * for a non-member, `unavailable` when it could not answer at all.
+ * handler on the control node and, for each inbound {@link StrandAddrRequest}
+ * (from a peer the protocol guard has already admitted as an authorized member),
+ * replies with the local strand instance's live multiaddrs — `ok` with an empty
+ * list when the strand is not running, `unavailable` when it could not answer at all.
  */
 export class StrandAddrService {
   private readonly options: StrandAddrServiceOptions;
@@ -175,8 +174,8 @@ export class StrandAddrService {
    * (over {@link maxConcurrent}, reply without looking up any address), a read
    * timeout (a peer that never half-closes is aborted inside {@link readFrame}/
    * `readStreamToEnd`), and the existing malformed/oversized-frame guard. A
-   * lookup that throws — the membership read failing, say — is `unavailable` too,
-   * never a `refused` or an empty `ok` the asker would wait ten minutes on.
+   * lookup that throws is `unavailable` too, never an empty `ok` the asker would
+   * wait ten minutes on.
    */
   private async handleStream(stream: ControlStream, remotePeerId: string): Promise<void> {
     log('Incoming strand-addr request from: %s', remotePeerId);
@@ -215,22 +214,14 @@ export class StrandAddrService {
    * decision matrix can be unit-tested directly (mirrors wake's
    * `processWakeRequest`).
    *
-   * - Non-member sender → `refused`, no delegate grant.
-   * - Member request carrying a `delegatePeerId` → recorded via
+   * - Request carrying a `delegatePeerId` → recorded via
    *   {@link StrandAddrServiceOptions.onDelegateAnnounce} before the lookup.
    * - Strand not running locally → `ok` with empty `multiaddrs` (`getStrandMultiaddrs` → `[]`).
-   * - Member + running strand → `ok` with the strand's live, signaling-first multiaddrs.
+   * - Running strand → `ok` with the strand's live, signaling-first multiaddrs.
    *
-   * A throwing `isMember` propagates; {@link handleStream} answers it `unavailable`.
+   * A throwing lookup propagates; {@link handleStream} answers it `unavailable`.
    */
   async processAddrRequest(request: StrandAddrRequest, remotePeerId: string): Promise<StrandAddrResponse> {
-    // Control-network membership is the v1 authorization: only this party's
-    // cadre peers may ask us for a strand address (or announce a delegate).
-    if (!(await this.options.isMember(remotePeerId))) {
-      log('Refusing strand-addr from non-member %s', remotePeerId);
-      return addrlessResponse('refused', request.strandId);
-    }
-
     this.recordDelegateAnnounce(request, remotePeerId);
 
     const multiaddrs = this.options.getStrandMultiaddrs(request.strandId);
@@ -303,11 +294,11 @@ export interface CollectStrandAddrsOptions {
  * - `empty` — status `ok` with no address: the sibling does not run the strand
  *   right now, a normal steady state.
  * - `unavailable` — the sibling replied that it could not answer.
- * - `refused` — the sibling does not (yet) count the asker as an authorized member.
- * - `unreachable` — no reply at all: every dial target failed or timed out, or
- *   the reply was malformed.
+ * - `unreachable` — no reply at all: every dial target failed or timed out, the
+ *   reply was malformed, or the sibling's protocol guard reset the stream because
+ *   it does not (yet) count the asker as an authorized member.
  */
-export type StrandAddrOutcome = 'answered' | 'empty' | 'unavailable' | 'refused' | 'unreachable';
+export type StrandAddrOutcome = 'answered' | 'empty' | 'unavailable' | 'unreachable';
 
 /** Result of {@link collectStrandAddrs}. */
 export interface StrandAddrCollection {
@@ -525,7 +516,7 @@ async function sendStrandAddr(
   return response;
 }
 
-const STRAND_ADDR_STATUSES: ReadonlySet<string> = new Set<StrandAddrStatus>(['ok', 'unavailable', 'refused']);
+const STRAND_ADDR_STATUSES: ReadonlySet<string> = new Set<StrandAddrStatus>(['ok', 'unavailable']);
 
 /**
  * Shape check on a decoded reply: the responder is another machine, so a reply

package/src/strand-formation-protocol.ts

@@ -28,7 +28,7 @@ import { requireEd25519PublicKeyB64 } from './ed25519-key.js';
 import { verifyFormationConsent } from './peer-authorization.js';
 // seed-bootstrap imports neither this protocol nor the manager/solicitation layers,
 // so this import introduces no cycle.
-import { ed25519PublicKeyB64FromPeerId } from './seed-bootstrap.js';
+import { ed25519PublicKeyB64FromPeerId } from './ed25519-key.js';
 import { trailingPeerId } from './peer-record.js';
 import {
   formationDeadlines,