@uuaid/agent-commons 0.2.0-alpha.2 → 0.2.0-alpha.4

package/src/spaces/store.mjs

@@ -0,0 +1,325 @@
+/**
+ * The space store (design §8). Additive; imports the vendored pillar engine
+ * ONLY through ./pillar-group.mjs (C9). Computes no engine-vs-client hash
+ * (C13/V-7). Never opens engine.db (F9); it only hands back the path.
+ *
+ * Layout under <commonsHome>/spaces/ (all dirs 0700, all files 0600, atomic):
+ *   groups-v2/grp-<32 hex>.json   roster record, via the vendored RosterStore
+ *   grp-<32 hex>/adapter.json     adapter state (this file)
+ *   grp-<32 hex>/engine.db        this space's own engine store (path only)
+ *   dispatcher.json               per-carrier cursors
+ */
+import { randomBytes } from "node:crypto";
+import {
+  chmodSync, closeSync, fsyncSync, mkdirSync, openSync,
+  readFileSync, renameSync, writeFileSync,
+} from "node:fs";
+import { join } from "node:path";
+import { RosterStore, isGroupIdV2 } from "./pillar-group.mjs";
+
+export const ADAPTER_V = "commons-space-adapter/1";
+export const DISPATCHER_V = "commons-space-dispatcher/1";
+export const PENDING_TTL_MS = 60 * 60 * 1000; // S-3: a pending removal lives at most 1 hour
+
+const HEX64 = /^[0-9a-f]{64}$/;
+const HARD_REASONS = ["outsider", "policy-mismatch"]; // A-4, P-9 (HS-1)
+const SOFT_REASONS = ["reconsent"]; // P-12 (HS-1)
+
+// Exact key sets, one per level. A strict set at every level is what refuses a
+// `policy`/`agents` key anywhere (S-4: policy is derived, never stored) and a
+// `body` inside a heldRefs entry (L-6: metadata only) — neither is in a set.
+const ADAPTER_KEYS = ["v", "groupId", "channels", "profile", "consent", "outsiderScan", "hardStop", "softStop", "pendingRemovals", "heldRefs"];
+const CHANNELS_KEYS = ["content", "control"];
+const PROFILE_KEYS = ["id", "hash"];
+const CONSENT_KEYS = ["manifestVersion", "charterHash", "carriers"];
+const OUTSIDER_SCAN_KEYS = ["version", "hash"];
+const STOP_KEYS = ["reason", "at"];
+const PENDING_KEYS = ["uuaid", "key", "manifestVersion", "queuedAt", "outboxId"];
+const HELDREF_KEYS = ["ref", "groupId", "from", "msgId", "receivedAt"];
+const DISPATCHER_KEYS = ["v", "cursors"];
+
+const plain = (o) => o !== null && typeof o === "object" && !Array.isArray(o);
+const nonEmptyString = (s) => typeof s === "string" && s.length > 0;
+const hex64 = (s) => typeof s === "string" && HEX64.test(s);
+const safeInt = (n) => Number.isSafeInteger(n);
+const posInt = (n) => safeInt(n) && n >= 1;
+const nonNegInt = (n) => safeInt(n) && n >= 0;
+
+function exactKeys(obj, keys) {
+  if (!plain(obj)) return false;
+  const own = Object.keys(obj);
+  if (own.length !== keys.length) return false;
+  return keys.every((k) => Object.hasOwn(obj, k));
+}
+
+/** A named error, so a caller (and a pole) can tell a bad shape from an absent file. */
+export class SpaceStoreError extends Error {
+  constructor(name, message) { super(message); this.name = name; }
+}
+const badId = (id) => new SpaceStoreError("GroupIdError", `not a v2 group id: ${String(id)}`);
+const badAdapter = (why) => new SpaceStoreError("AdapterStateError", `adapter.json: ${why}`);
+const badDispatcher = (why) => new SpaceStoreError("DispatcherStateError", `dispatcher.json: ${why}`);
+
+function validateStop(stop, reasons, label) {
+  if (stop === null) return;
+  if (!exactKeys(stop, STOP_KEYS)) throw badAdapter(`${label}: expected null or {reason, at}`);
+  if (!reasons.includes(stop.reason)) throw badAdapter(`${label}.reason: not one of ${reasons.join("|")}`);
+  if (!safeInt(stop.at)) throw badAdapter(`${label}.at: not a safe integer`);
+}
+
+/**
+ * Strict shape check of an adapter state. Throws AdapterStateError on any
+ * deviation. When `id` is given, the record's groupId must match it.
+ */
+export function validateAdapterState(state, id) {
+  if (!exactKeys(state, ADAPTER_KEYS)) throw badAdapter("top-level key set is not exact (a policy/agents key is refused here, S-4)");
+  if (state.v !== ADAPTER_V) throw badAdapter(`v: expected ${ADAPTER_V}`);
+  if (!isGroupIdV2(state.groupId)) throw badAdapter("groupId: not a v2 group id");
+  if (id !== undefined && state.groupId !== id) throw badAdapter("groupId does not match the space it is stored under");
+  if (!exactKeys(state.channels, CHANNELS_KEYS)) throw badAdapter("channels: expected {content, control}");
+  if (!nonEmptyString(state.channels.content)) throw badAdapter("channels.content: not a non-empty string");
+  if (!nonEmptyString(state.channels.control)) throw badAdapter("channels.control: not a non-empty string");
+  if (!exactKeys(state.profile, PROFILE_KEYS)) throw badAdapter("profile: expected {id, hash}");
+  if (!nonEmptyString(state.profile.id)) throw badAdapter("profile.id: not a non-empty string");
+  if (!hex64(state.profile.hash)) throw badAdapter("profile.hash: not a 64-hex sha256");
+  if (!exactKeys(state.consent, CONSENT_KEYS)) throw badAdapter("consent: expected {manifestVersion, charterHash, carriers}");
+  if (!posInt(state.consent.manifestVersion)) throw badAdapter("consent.manifestVersion: not a positive safe integer");
+  if (!hex64(state.consent.charterHash)) throw badAdapter("consent.charterHash: not a 64-hex sha256");
+  if (!Array.isArray(state.consent.carriers)) throw badAdapter("consent.carriers: not an array");
+  if (!state.consent.carriers.every(nonEmptyString)) throw badAdapter("consent.carriers: every entry must be a non-empty string");
+  if (!exactKeys(state.outsiderScan, OUTSIDER_SCAN_KEYS) || !posInt(state.outsiderScan.version) || !hex64(state.outsiderScan.hash)) throw badAdapter("outsiderScan: expected {version: positive safe integer, hash: 64-hex}");
+  validateStop(state.hardStop, HARD_REASONS, "hardStop");
+  validateStop(state.softStop, SOFT_REASONS, "softStop");
+  if (!Array.isArray(state.pendingRemovals)) throw badAdapter("pendingRemovals: not an array");
+  for (const e of state.pendingRemovals) {
+    if (!exactKeys(e, PENDING_KEYS)) throw badAdapter("pendingRemovals entry: expected {uuaid, key, manifestVersion, queuedAt, outboxId}");
+    if (!nonEmptyString(e.uuaid)) throw badAdapter("pendingRemovals.uuaid: not a non-empty string");
+    if (!hex64(e.key)) throw badAdapter("pendingRemovals.key: not a 64-hex public key");
+    if (!posInt(e.manifestVersion)) throw badAdapter("pendingRemovals.manifestVersion: not a positive safe integer");
+    if (!safeInt(e.queuedAt)) throw badAdapter("pendingRemovals.queuedAt: not a safe integer");
+    if (!nonEmptyString(e.outboxId)) throw badAdapter("pendingRemovals.outboxId: not a non-empty string");
+  }
+  if (!Array.isArray(state.heldRefs)) throw badAdapter("heldRefs: not an array");
+  for (const e of state.heldRefs) {
+    if (!exactKeys(e, HELDREF_KEYS)) throw badAdapter("heldRefs entry: expected exactly {ref, groupId, from, msgId, receivedAt} (a body is refused here, L-6)");
+    if (!nonEmptyString(e.ref)) throw badAdapter("heldRefs.ref: not a non-empty string");
+    if (!isGroupIdV2(e.groupId)) throw badAdapter("heldRefs.groupId: not a v2 group id");
+    if (!nonEmptyString(e.from)) throw badAdapter("heldRefs.from: not a non-empty string");
+    if (!nonEmptyString(e.msgId)) throw badAdapter("heldRefs.msgId: not a non-empty string");
+    if (!safeInt(e.receivedAt)) throw badAdapter("heldRefs.receivedAt: not a safe integer");
+  }
+}
+
+function validateDispatcher(d) {
+  if (!exactKeys(d, DISPATCHER_KEYS)) throw badDispatcher("top-level key set is not exact");
+  if (d.v !== DISPATCHER_V) throw badDispatcher(`v: expected ${DISPATCHER_V}`);
+  if (!plain(d.cursors)) throw badDispatcher("cursors: not an object");
+  for (const [url, seq] of Object.entries(d.cursors)) {
+    if (!nonEmptyString(url)) throw badDispatcher("cursors: a carrier url key is empty");
+    if (!nonNegInt(seq)) throw badDispatcher(`cursors[${url}]: not a non-negative safe integer`);
+  }
+}
+
+/** temp 0600 + wx, fsync, rename — the RosterStore.save pattern (groups-v2.mjs:414-426). */
+function atomicWrite0600(filePath, text) {
+  const tmp = `${filePath}.tmp-${process.pid}-${randomBytes(4).toString("hex")}`;
+  writeFileSync(tmp, text, { mode: 0o600, flag: "wx" });
+  const fd = openSync(tmp, "r");
+  try { fsyncSync(fd); } finally { closeSync(fd); }
+  renameSync(tmp, filePath);
+}
+
+/**
+ * S-3 load-time pruning. Re-checks every pendingRemovals entry against the
+ * roster record VERIFIED IN THE SAME CALL. An entry is kept only if (a) the
+ * verified head shows the row removed with the same key, (b) the verified chain
+ * carries the manifest at manifestVersion showing that row removed and
+ * manifestVersion <= head.version, and (c) now - queuedAt <= 1 hour and
+ * queuedAt <= now. Anything else is dropped, with one reason per entry.
+ * `now` is injectable for tests.
+ *
+ * Contract: `rec` MUST be the output of `loadRoster(id)` (i.e. of the vendored
+ * `RosterStore.load`), so it is a record whose chain verified from version 1 in
+ * that same call. This function does not verify `rec` — it trusts it — and an
+ * unverified or hand-built chain is accepted and read literally.
+ *
+ * Every clause is written KEEP-ONLY-IF, never drop-if: a keep widens policy
+ * (P-7 puts pending rows into `agents`), so anything this function cannot
+ * positively prove in-window is dropped. That includes a clock it cannot
+ * compare with: a `now` that is not a safe integer (undefined, NaN, a string,
+ * a fraction, a value past 2^53-1) drops every entry as `bad-clock`, and an
+ * entry whose own `queuedAt` is not a safe integer drops as `bad-entry`,
+ * because each comparison against such a value is false or coerced and a
+ * negated clause would read that as "in window".
+ */
+export function prunePendingRemovals(entries, rec, now) {
+  const kept = [];
+  const dropped = [];
+  const head = rec && Array.isArray(rec.chain) && rec.chain.length > 0 ? rec.chain[rec.chain.length - 1] : null;
+  for (const e of entries) {
+    let reason = null;
+    if (!rec || !head) {
+      reason = "roster-absent"; // no verified roster -> nothing grants a keep
+    } else {
+      // (a) verified head
+      const hrow = head.members?.find((r) => r.uuaid === e.uuaid);
+      if (!hrow) reason = "head-no-row";
+      else if (hrow.status !== "removed") reason = "head-not-removed";
+      else if (hrow.key !== e.key) reason = "head-key-mismatch";
+      // (b) verified chain carries the manifest at manifestVersion
+      if (reason === null) {
+        const man = rec.chain.find((m) => m.version === e.manifestVersion);
+        if (!man) reason = "chain-manifest-absent";
+        // Unreachable on a VERIFIED record: verifyChain (groups-v2.mjs:281) forces
+        // contiguous versions 1..N via verifyNext's prev/version checks, so a manifest
+        // present in the chain can never exceed the head. Kept because (i) the brief
+        // names "manifestVersion <= head.version" as a keep-condition and a reviewer
+        // reads the code against that text, (ii) it is a guard against a future change
+        // to the vendored verifyChain, and (iii) this function is exported and trusts
+        // its `rec` argument, so a hand-built out-of-order chain does reach it (pinned
+        // by a unit test).
+        else if (e.manifestVersion > head.version) reason = "manifest-ahead-of-head";
+        else {
+          const mrow = man.members?.find((r) => r.uuaid === e.uuaid);
+          if (!mrow || mrow.status !== "removed") reason = "chain-not-removed";
+        }
+      }
+      // (c) the 1-hour window, and no future stamp. KEEP-ONLY-IF: the clause is
+      // written as the positive keep condition, so a `now` that cannot be compared
+      // (undefined, NaN, a string, a fraction, a value past 2^53-1) drops as
+      // `bad-clock` instead of keeping. Written as "drop if X", both comparisons are
+      // false for such a `now`, which reads as "in window" and keeps a removed member
+      // authorized past the 1-hour bound. A safe integer is required, not merely a
+      // finite one: `Number.isFinite(now0 + 0.5)` is true, yet a fractional clock
+      // compares loosely against an integer stamp and cannot pin the window exactly.
+      // The entry's own stamp is held to the same bar — this function is exported and
+      // trusts its arguments, so an in-memory entry (a later slice's policy writer) can
+      // reach it with a string `queuedAt` that `<=` and `-` would silently coerce.
+      if (reason === null && !Number.isSafeInteger(now)) reason = "bad-clock";
+      else if (reason === null && !Number.isSafeInteger(e.queuedAt)) reason = "bad-entry";
+      else if (reason === null && !(e.queuedAt <= now && now - e.queuedAt <= PENDING_TTL_MS)) {
+        reason = e.queuedAt > now ? "future-stamp" : "expired";
+      }
+    }
+    if (reason === null) kept.push(e);
+    else dropped.push({ entry: e, reason });
+  }
+  return { kept, dropped };
+}
+
+export class SpaceStore {
+  /** @param {string} commonsHome the engine home chosen by the operator */
+  constructor(commonsHome) {
+    if (!nonEmptyString(commonsHome)) throw new SpaceStoreError("BadHomeError", "commonsHome: not a non-empty string");
+    this.commonsHome = commonsHome;
+    this.spacesHome = join(commonsHome, "spaces");
+    // The vendored RosterStore makes groups-v2/ (0700) and writes 0600 atomically itself.
+    this._roster = new RosterStore(this.spacesHome);
+  }
+
+  _ensureSpaces() {
+    mkdirSync(this.spacesHome, { recursive: true, mode: 0o700 });
+    chmodSync(this.spacesHome, 0o700);
+  }
+
+  _assertId(id) { if (!isGroupIdV2(id)) throw badId(id); }
+
+  /** spaces/grp-<id>/ — validated before any fs call (P7). */
+  groupDir(id) { this._assertId(id); return join(this.spacesHome, id); }
+  /** spaces/grp-<id>/adapter.json */
+  adapterPath(id) { return join(this.groupDir(id), "adapter.json"); }
+  /** spaces/grp-<id>/engine.db — path only; F9 gives one engine store per space. Never opened here. */
+  engineDbPath(id) { return join(this.groupDir(id), "engine.db"); }
+  /** spaces/dispatcher.json */
+  dispatcherPath() { return join(this.spacesHome, "dispatcher.json"); }
+  /** spaces/groups-v2/grp-<id>.json (the vendored roster record path). */
+  rosterPath(id) { this._assertId(id); return this._roster.path(id); }
+
+  // ── roster (S-1, F13) ──────────────────────────────────────────────────
+
+  /** Delegates to RosterStore.save, which refuses an unverified record (S-1). */
+  saveRoster(rec) {
+    // Verify before create: RosterStore.save runs checkStoreRecord and throws BEFORE
+    // its own mkdir, so an unverified record never makes spaces/ exist.
+    this._roster.save(rec); // throws if the chain does not verify / head mismatches
+    this._ensureSpaces(); // tighten spaces/ to 0700 once the record is known good
+  }
+
+  /** The verified record, or null. Any read, parse or verify failure reads as ABSENT (F13). */
+  loadRoster(id) {
+    this._assertId(id);
+    try { return this._roster.load(id); } catch { return null; }
+  }
+
+  // ── adapter.json ───────────────────────────────────────────────────────
+
+  /** Validates the strict shape, then writes 0600 atomically under grp-<id>/. */
+  saveAdapter(id, state) {
+    this._assertId(id);
+    validateAdapterState(state, id);
+    this._ensureSpaces(); // tighten a pre-existing spaces/ to 0700 before writing under it
+    const dir = this.groupDir(id);
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    chmodSync(dir, 0o700);
+    atomicWrite0600(this.adapterPath(id), JSON.stringify(state));
+  }
+
+  /**
+   * Loads adapter state and runs S-3 pruning against the roster verified in the
+   * same call. A MISSING file reads as null (no adapter state yet). A CORRUPT or
+   * wrong-shape file THROWS — it never defaults, because defaulting would turn a
+   * lost hardStop into "no stop" and widen authority (CL-1, HS-1).
+   * @returns {null | { state: object, dropped: Array<{entry, reason}> }}
+   */
+  loadAdapter(id, { now = Date.now() } = {}) {
+    this._assertId(id);
+    // The `= Date.now()` default catches only `undefined`. An explicitly passed
+    // NaN or "abc" flows through to prunePendingRemovals, whose keep-only-if clause
+    // drops every entry as `bad-clock` — a non-finite clock fails closed here too.
+    const p = this.adapterPath(id);
+    // Only ENOENT means "absent". Read inside try/catch instead of existsSync,
+    // which reports EACCES and ENOTDIR as absent too — so a grp dir at mode 000, or a
+    // grp path replaced by a regular file, would read a latched hardStop as "no state"
+    // and widen authority (CL-1, HS-1).
+    let raw;
+    try { raw = readFileSync(p, "utf-8"); }
+    catch (e) {
+      if (e.code === "ENOENT") return null;
+      throw badAdapter(`unreadable: ${e.code}: ${e.message}`);
+    }
+    let parsed;
+    try { parsed = JSON.parse(raw); } catch (e) { throw badAdapter(`not valid JSON: ${e.message}`); }
+    validateAdapterState(parsed, id); // throws AdapterStateError on a bad shape
+    const rec = this.loadRoster(id); // verified in THIS call
+    const { kept, dropped } = prunePendingRemovals(parsed.pendingRemovals, rec, now);
+    const state = { ...parsed, pendingRemovals: kept };
+    return { state, dropped };
+  }
+
+  // ── dispatcher.json ────────────────────────────────────────────────────
+
+  /** Validates and writes 0600 atomically at spaces/dispatcher.json. */
+  saveDispatcher(d) {
+    validateDispatcher(d);
+    this._ensureSpaces();
+    atomicWrite0600(this.dispatcherPath(), JSON.stringify(d));
+  }
+
+  /** A missing file means empty cursors; a bad shape throws (never defaults). */
+  loadDispatcher() {
+    const p = this.dispatcherPath();
+    // Only ENOENT means "empty cursors". Any other read failure (EACCES on a
+    // spaces/ at mode 000, ENOTDIR if the path is a file) throws the named error —
+    // existsSync would report those as absent and silently lose every cursor.
+    let raw;
+    try { raw = readFileSync(p, "utf-8"); }
+    catch (e) {
+      if (e.code === "ENOENT") return { v: DISPATCHER_V, cursors: {} };
+      throw badDispatcher(`unreadable: ${e.code}: ${e.message}`);
+    }
+    let parsed;
+    try { parsed = JSON.parse(raw); } catch (e) { throw badDispatcher(`not valid JSON: ${e.message}`); }
+    validateDispatcher(parsed);
+    return parsed;
+  }
+}

package/src/trust.mjs

@@ -1,5 +1,6 @@
 import { UuaidClient } from "@uuaid/sdk";
 import { Keychain } from "./pillar.mjs";
+import { keyIsBlocked, SELF_CERTIFYING_AGENT_UUAID } from "./uuaid-namespace.mjs";
 import { isLoopbackUrl, isOffline } from "./offline.mjs";
 
 export const REQUIRED_STANDARDS=["IAASO-1001","IAASO-2001","IAASO-3101","IAASO-3301"];
@@ -8,6 +9,22 @@ export class TrustError extends Error { constructor(code,message,{transient=fals
 export function isTransientTrustFailure(error){if(error?.transient===true)return true;const status=error?.status??error?.statusCode;return error!=null&&!(error instanceof TrustError)&&(!Number.isInteger(status)||status>=500||status===408||status===429)}
 async function backend(fn,code){try{return await fn()}catch(error){if(error instanceof TrustError)throw error;if(isTransientTrustFailure(error))throw new TrustError(code,`Trust backend unavailable: ${String(error?.message??error).slice(0,120)}`,{transient:true});throw error}}
 export class RegistryTrust {
+  #denied=false;
+  static isCanonicalTrust(value){
+    if(value===null||(typeof value!=="object"&&typeof value!=="function")||!(#denied in value))return false;
+    let current=value,found=false;
+    while(current!==null){
+      if(current!==value&&current!==TRUST_PROTOTYPE&&current!==OBJECT_PROTOTYPE)return false;
+      const descriptor=getOwnPropertyDescriptor(current,"authorize");
+      if(!found&&descriptor){
+        if(!("value" in descriptor)||descriptor.value!==CANONICAL_AUTHORIZE)return false;
+        found=true;
+      }
+      current=getPrototypeOf(current);
+    }
+    return found;
+  }
+  denyPermanently(){this.#denied=true}
   constructor({policy={},client,fetchImpl=fetch,env=process.env}={}) {
     if(policy.mode!==undefined&&!["local","global"].includes(policy.mode))throw new TrustError("INVALID_POLICY_MODE","Policy mode must be explicitly local or global");
     this.policy=policy;this.policy.mode??="local";this.env=env;
@@ -33,15 +50,26 @@ export class RegistryTrust {
     }
     return list;
   }
-  async authorize(uuaid,publicKey,capability="commons:message"){
-    if(!/^uuaid:[a-z0-9-]+:agent:[0-9a-f-]{36}$/.test(uuaid)||!/^[0-9a-f]{64}$/.test(publicKey))throw new TrustError("AGENT_ONLY","A cryptographically bound agent UUAID is required");
+  // The local half of admission: identity shape, key binding, block list, and the
+  // operator's binding and capability. Synchronous, so it reads the policy as it is now.
+  #localAdmission(uuaid,publicKey,capability){
+    if(!SELF_CERTIFYING_AGENT_UUAID.test(uuaid)||!/^[0-9a-f]{64}$/.test(publicKey))throw new TrustError("AGENT_ONLY","A cryptographically bound agent UUAID in a self-certifying namespace (foundation, pillar, agentnet) is required");
     if(Keychain.localIdFromKey(Buffer.from(publicKey,"hex"))!==uuaid.split(":")[3])throw new TrustError("KEY_BINDING","Agent UUAID is not owned by the presented key");
-    if(this.policy.blocked?.includes(uuaid))throw new TrustError("SUBJECT_BLOCKED","Subject is blocked");
+    if(keyIsBlocked(this.policy.blocked,uuaid))throw new TrustError("SUBJECT_BLOCKED","Subject is blocked (under this or another spelling of its key)");
     const binding=this.policy.agents?.[uuaid];
     // One key must be one voice: reject any policy that admits the same key under several UUAID spellings.
     if(binding&&Object.values(this.policy.agents).filter(a=>a?.publicKey===publicKey).length!==1)throw new TrustError("DUPLICATE_KEY","One public key is admitted under more than one UUAID; Sybil-ambiguous policy is denied");
     if(!binding||binding.publicKey!==publicKey||binding.kind!=="agent"||!binding.capabilities?.includes(capability))throw new TrustError("NOT_ADMITTED","Subject/key/capability has not been admitted by this deployment");
-    if(this.policy.mode!=="global")return {tier:"local-policy-pinned",uuaid,capability,certified:false};
+    return binding;
+  }
+  async authorize(uuaid,publicKey,capability="commons:message"){
+    if(this.#denied)throw new TrustError("NOT_ADMITTED","Trust receiver has been permanently denied");
+    const binding=this.#localAdmission(uuaid,publicKey,capability);
+    if(this.policy.mode!=="global"){
+      const result={tier:"local-policy-pinned",uuaid,capability,certified:false};
+      if(this.#denied)throw new TrustError("NOT_ADMITTED","Trust receiver has been permanently denied");
+      return result;
+    }
     if(!(this.policy.registryUrl??"https://api.uuaid.org").startsWith("https://"))throw new TrustError("INSECURE_REGISTRY","Global registry verification requires HTTPS");
     await this.standards();
     const resolution=await backend(()=>this.client.resolve(uuaid),"REGISTRY_UNAVAILABLE");
@@ -50,9 +78,15 @@ export class RegistryTrust {
     if(!binding.credentialId)throw new TrustError("CREDENTIAL_REQUIRED","Global agent admission requires a pinned credential");
     const verdict=await backend(()=>this.client.verify(binding.credentialId),"REGISTRY_UNAVAILABLE");
     if(verdict.credential_id!==binding.credentialId||verdict.agent_uuaid!==uuaid||![verdict.valid,verdict.signatureValid,verdict.active,verdict.notExpired].every(v=>v===true))throw new TrustError("CREDENTIAL_INVALID","Credential signature, subject, active status, or expiry failed");
+    // The registry calls above await, and the operator's policy may change meanwhile
+    // (a block, a removal, a narrowed capability). Decide on the policy as it is now,
+    // for the same credential the registry just verified.
+    if(this.#localAdmission(uuaid,publicKey,capability).credentialId!==binding.credentialId)throw new TrustError("NOT_ADMITTED","Admission changed while the registry was consulted");
     // Capabilities are operator policy grants. A valid credential alone does not
     // imply an IAASO accreditation role or permission to ratify a standard.
-    return {tier:"registry-credential-and-policy",uuaid,capability,credentialId:binding.credentialId,certified:false};
+    const result={tier:"registry-credential-and-policy",uuaid,capability,credentialId:binding.credentialId,certified:false};
+    if(this.#denied)throw new TrustError("NOT_ADMITTED","Trust receiver has been permanently denied");
+    return result;
   }
   async publishedProfilePin(code,profileHash){
     await this.standards();
@@ -63,3 +97,8 @@ export class RegistryTrust {
     return record;
   }
 }
+const TRUST_PROTOTYPE=RegistryTrust.prototype;
+const OBJECT_PROTOTYPE=Object.prototype;
+const CANONICAL_AUTHORIZE=RegistryTrust.prototype.authorize;
+const getOwnPropertyDescriptor=Object.getOwnPropertyDescriptor;
+const getPrototypeOf=Object.getPrototypeOf;

package/src/uuaid-namespace.d.mts

@@ -0,0 +1,6 @@
+export declare const RUNTIME_UUAID_NAMESPACE: "agentnet";
+export declare function mintNamespace(requested?: string | null): string;
+export declare const SELF_CERTIFYING_NAMESPACES: readonly string[];
+export declare const SELF_CERTIFYING_AGENT_UUAID: RegExp;
+export declare function keyBindsAgentUuaid(uuaid: unknown, publicKeyHex: unknown): boolean;
+export declare function keyIsBlocked(blocked: unknown, uuaid: unknown): boolean;

package/src/uuaid-namespace.mjs

@@ -0,0 +1,48 @@
+import { localIdFromKey, mintNamespace, SELF_CERTIFYING_NAMESPACES } from "./vendor/pillar/identity/keychain.mjs";
+
+// The namespace Agent Commons mints NEW key-derived identities in:
+// uuaid:agentnet:agent:<localIdFromKey(publicKey)>.
+//
+// Pass it explicitly at every mint site. The vendored Keychain.generate default
+// ("foundation") stays unchanged on purpose: a stored key without a recorded
+// namespace must never be re-derived under a new default and renamed (the
+// 2026-09-20 peek() defect). Existing identities keep their ids; "foundation"
+// remains a valid self-certifying namespace.
+export const RUNTIME_UUAID_NAMESPACE = "agentnet";
+
+// Every mint site passes mintNamespace(RUNTIME_UUAID_NAMESPACE): the vendored
+// check throws on a namespace a key cannot claim, so a wrong constant fails at
+// mint instead of producing an identity no verifier accepts.
+export { mintNamespace };
+
+// The namespaces a key alone can claim, taken from the vendored @uuaid/pillar
+// (foundation, pillar, agentnet). A registry namespace (zilligon, iaaso, ...) is
+// vouched for by its registry, not by a key, so it is refused wherever Agent
+// Commons accepts an identity on the strength of its key.
+export { SELF_CERTIFYING_NAMESPACES };
+
+// The shape of a key-derived agent UUAID in a self-certifying namespace. The
+// local id is the canonical lower-case 8-4-4-4-12 form localIdFromKey emits.
+export const SELF_CERTIFYING_AGENT_UUAID = new RegExp(`^uuaid:(?:${SELF_CERTIFYING_NAMESPACES.join("|")}):agent:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$`);
+
+// Namespace alignment rule 1: the UUAID has the shape above and its local id is
+// the key's. The id is parsed and its local id compared; it is never rebuilt
+// from the key and compared whole (rule 2).
+export function keyBindsAgentUuaid(uuaid, publicKeyHex) {
+  return typeof uuaid === "string" && SELF_CERTIFYING_AGENT_UUAID.test(uuaid) &&
+    typeof publicKeyHex === "string" && /^[0-9a-f]{64}$/.test(publicKeyHex) &&
+    localIdFromKey(Buffer.from(publicKeyHex, "hex")) === uuaid.split(":")[3];
+}
+
+// Block by key, not by spelling. One key has a spelling in each self-certifying
+// namespace, all with the same local id, so a block on any of them blocks the
+// key. An entry that is not a key-derived spelling blocks only itself.
+// Block entries are operator-asserted, not key-verified: a list carries no
+// public keys, so a shape-valid entry blocks whichever key has that local id.
+export function keyIsBlocked(blocked, uuaid) {
+  if (!Array.isArray(blocked) || typeof uuaid !== "string") return false;
+  if (blocked.includes(uuaid)) return true;
+  if (!SELF_CERTIFYING_AGENT_UUAID.test(uuaid)) return false;
+  const local = uuaid.split(":")[3];
+  return blocked.some(entry => typeof entry === "string" && SELF_CERTIFYING_AGENT_UUAID.test(entry) && entry.split(":")[3] === local);
+}

package/src/vendor/pillar/blob/blob.mjs

@@ -35,7 +35,8 @@
  */
 import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
 import { jcs } from "../identity/jcs.mjs";
-import { Keychain, localIdFromKey } from "../identity/keychain.mjs";
+import { Keychain, keyDerivedUuaidFor, keyDerivesUuaid } from "../identity/keychain.mjs";
+export { SELF_CERTIFYING_NAMESPACES } from "../identity/keychain.mjs";
 import { ABSOLUTE_MAX_BODY, TIER_DEFAULTS } from "../identity/tier.mjs";
 import { REFUSAL_FIXES } from "../net/refusals.mjs";
 
@@ -51,8 +52,9 @@ export const NONCE_BYTES = 12;
 export const DEK_BYTES = 32;
 /** keyId a broker request presents when the identity proves itself by its own key. */
 export const SELF_CERTIFIED_KEY_ID = "self-certified:ed25519";
-/** The one UUAID namespace and object type the broker accepts on the self-certified path. */
+/** @deprecated Default minting namespace only; verification uses SELF_CERTIFYING_NAMESPACES. */
 export const SELF_CERTIFIED_NAMESPACE = "foundation";
+/** The object type the broker accepts across self-certifying namespaces. */
 export const SELF_CERTIFIED_OBJECT_TYPE = "agent";
 
 // ---------------------------------------------------------------- errors ---
@@ -170,26 +172,22 @@ export function mkObjectName() {
 
 // ------------------------------------------------------ self-certified ---
 /**
- * The one UUAID a key self-certifies, rebuilt in full:
- * `uuaid:foundation:agent:` + sha256(publicKey)[:16] as a UUID (localIdFromKey,
- * the twin of pillar-client's localIdFromPublicKey). Null for a malformed key.
+ * Rebuild a key-derived agent UUAID in a self-certifying namespace.
+ * Foundation remains the default. Null for a malformed key or registry namespace.
  */
-export function selfCertifiedUuaidFor(publicKeyHex) {
-  if (typeof publicKeyHex !== "string" || !/^[0-9a-f]{64}$/i.test(publicKeyHex)) return null;
-  const localId = localIdFromKey(Buffer.from(publicKeyHex, "hex"));
-  return `uuaid:${SELF_CERTIFIED_NAMESPACE}:${SELF_CERTIFIED_OBJECT_TYPE}:${localId}`;
+export function selfCertifiedUuaidFor(publicKeyHex, namespace = "foundation") {
+  return keyDerivedUuaidFor(publicKeyHex, { namespace, objectType: SELF_CERTIFIED_OBJECT_TYPE });
 }
 
 /**
  * True only when `uuaid` is EXACTLY the UUAID the key self-certifies (full
- * string, namespace and object type included, the broker's rule); such an
+ * string, self-certifying namespace and agent object type included); such an
  * identity uses the broker without a registry badge. A device, a service,
- * another namespace, or a matching local id under any other prefix is not
+ * a registry namespace, or a matching local id under any other prefix is not
  * self-certified: it needs a registry badge naming its key.
  */
 export function isSelfCertifiedUuaid(uuaid, publicKeyHex) {
-  const expected = selfCertifiedUuaidFor(publicKeyHex);
-  return expected !== null && uuaid === expected;
+  return keyDerivesUuaid(publicKeyHex, uuaid, SELF_CERTIFIED_OBJECT_TYPE);
 }
 
 /**
@@ -471,7 +469,7 @@ export async function prepareBrokerBlobSend(keychain, { data, envelopeId, recipi
 
 /**
  * Production receive path; the sender key gate precedes broker redemption.
- * A sender whose UUAID is exactly the uuaid:foundation:agent UUAID of the
+ * A sender whose UUAID is exactly a self-certifying agent UUAID of the
  * ref's verified signing key passes without a badge; any other sender needs
  * a fresh registry badge naming that key (client.assertRegistryActiveSender).
  *