nervur 0.10.0 → 0.12.0

package/README.md

@@ -134,6 +134,17 @@ after. Both are custody's own calls on the shelf, never doors — which is
 what running-is-custody looks like from the outside, stated rather than
 hidden.
 
+`unproven()` is custody's third call, and it is a read: the addresses whose
+writes have stopped proving, with when each was first and last seen and how
+many writes have been refused. A write is proven against the key on the
+being's `chain/pk` cell, so whoever holds the shelf can overwrite that cell
+and freeze a being's memory while it answers on, correctly signed and
+indistinguishable to every caller. The ground records that in its own host
+rows under `ground/` — no being reads them, nothing goes over the wire — and
+this is where a host reads them back. Show it to whoever operates the
+machine; a ground that has stopped proving its own writes is a custody
+incident, not a bug.
+
 **`serve` is the client, and it has four faces of one door.** `pointer(at)`
 is a plain object with one function per field, generated from the schema that
 caller is allowed to see. `gql(at)` is the raw document. `mcp(at)` is the
@@ -215,7 +226,8 @@ silence, and silence is something local delivery never answers with.
   activates and destroys, reachable only through the admin being.
 - [admin.mjs](admin.mjs) — the administrative program every ground installs
   for itself, aliased `Ground`: census, create, activate, destroy, upgrade,
-  alias, attest, and behind `SELF` alone invite, drop and extend. Upgrade is
+  alias, attest, invite, drop, wear, and behind `SELF` alone extend; `wears`
+  answers any stranger with the livery being the ground wears. Upgrade is
   custody moving the one cell that was always the core's to move: the
   program is replaced in place — address, cells, refs and chain surviving —
   refused whole when a cell the being holds would go undeclared, and visible

package/admin.mjs

@@ -1,7 +1,10 @@
 const ADMIN = `({
   name: 'nervur.ground',
   needs: { modules: [{ module: 'memory', contract: 'nervur.memory' }] },
-  memory: { 'aliases/*': { type: 'String', class: 'data' } },
+  memory: {
+    'aliases/*': { type: 'String', class: 'data' },
+    wears: { type: 'String', class: 'data' },
+  },
   interface: \`
     input RefInput { address: String!, nextPkHash: String, rights: String }
     type Resident { address: String!, alias: String, digest: String, active: Boolean! }
@@ -11,6 +14,7 @@ const ADMIN = `({
       aliasOf(name: String!): String   @rights(is: [SELF, MEMBER])
       attest(module: String!): Boolean @rights(is: [SELF, MEMBER])
       opened: Boolean                  @rights(is: [SELF, MEMBER, STRANGER])
+      wears: String                    @rights(is: [SELF, MEMBER, STRANGER])
     }
     type Mutation {
       invite(address: String!, nextPkHash: String, rights: String): Boolean @rights(is: [SELF, MEMBER])
@@ -22,6 +26,7 @@ const ADMIN = `({
       destroy(address: String!): String                    @rights(is: [SELF, MEMBER])
       upgrade(address: String!, program: String!): Boolean  @rights(is: [SELF, MEMBER])
       alias(name: String!, address: String!): Boolean       @rights(is: [SELF, MEMBER])
+      wear(address: String): Boolean                        @rights(is: [SELF, MEMBER])
     }
   \`,
   resolvers: {
@@ -37,6 +42,7 @@ const ADMIN = `({
       aliasOf: (_, { name }, { modules }) => modules.memory.read('aliases/' + name),
       attest: (_, { module }, { registry }) => registry.attest(module),
       opened: (_, __, { modules }) => modules.memory.list('refs/').length > 0,
+      wears: (_, __, { modules }) => modules.memory.read('wears') ?? null,
     },
     Mutation: {
       invite: (_, { address, nextPkHash, rights }, { modules }) =>
@@ -66,6 +72,10 @@ const ADMIN = `({
         registry.upgrade({ address, program }) !== undefined,
       alias: (_, { name, address }, { modules }) =>
         modules.memory.write('aliases/' + name, address) !== undefined,
+      wear: (_, { address }, { modules }) => {
+        modules.memory.write('wears', address ?? undefined);
+        return modules.memory.read('wears') === (address ?? undefined);
+      },
     },
   },
 })`;

package/being.mjs

@@ -1,7 +1,7 @@
 import { ADMIN } from './admin.mjs';
 import { OPEN, STRUCTURAL, composed, coreClass } from './blueprint.mjs';
 import { Program } from './program.mjs';
-import { MEASURE, Stamp, Tools } from './tools.mjs';
+import { MEASURE, SPAN, Stamp, Tools } from './tools.mjs';
 import { Voice } from './voice.mjs';
 
 const Compartment = ({ memory, voice, address, root, classOf }) => {
@@ -40,6 +40,48 @@ const Compartment = ({ memory, voice, address, root, classOf }) => {
   });
 };
 
+const spanOf = (given) =>
+  typeof given === 'number' && Number.isFinite(given) && given > 0 && given < SPAN ? given : SPAN;
+
+const within = (span, work) => {
+  let timer;
+  const lapsed = new Promise((settle) => {
+    timer = setTimeout(() => settle(undefined), span);
+    timer.unref?.();
+  });
+  return Promise.race([work, lapsed]).finally(() => clearTimeout(timer));
+};
+
+const Fence = () => {
+  let standing = true;
+  return Object.freeze({
+    close: () => {
+      standing = false;
+      return undefined;
+    },
+    open: () => standing,
+  });
+};
+
+const fenced = (mine, fence) =>
+  Object.freeze({
+    classOf: mine.classOf,
+    list: mine.list,
+    read: mine.read,
+    write: (key, plain) => (fence.open() ? mine.write(key, plain) : undefined),
+  });
+
+const custodial = (registry, fence) =>
+  registry === undefined
+    ? undefined
+    : Object.freeze({
+        ...registry,
+        create: (one) => (fence.open() ? registry.create(one) : undefined),
+        destroy: (at) => (fence.open() ? registry.destroy(at) : undefined),
+        extend: (source) => (fence.open() ? registry.extend(source) : undefined),
+        upgrade: (one) => (fence.open() ? registry.upgrade(one) : undefined),
+      });
+
 const offered = (modules, program, mine) =>
   Object.freeze({
     ...Object.fromEntries(
@@ -95,10 +137,11 @@ const rootFor = ({ memory, voice, address }) => {
   return opened === undefined ? undefined : Buffer.from(opened, 'base64');
 };
 
-const Port = ({ voice, mine, deliver, rights }) => {
-  const stamp = Stamp();
-  const lanes = new Map();
+const Port = ({ voice, mine, deliver, rights, stamp, lanes, fence }) => {
   const send = async (to, op) => {
+    if (fence !== undefined && !fence.open()) {
+      return undefined;
+    }
     const turn = (lanes.get(to) ?? Promise.resolve()).then(() => {
       const handle = mine.read(`handles/${to}`);
       return deliver(
@@ -143,7 +186,10 @@ const rotates = ({ mine }, from, nextPkHash) => {
     .list('refs/')
     .map((key) => ({ key, referred: mine.read(key) }))
     .find(({ referred }) => referred?.nextPkHash === claim);
-  if (held === undefined) {
+  if (
+    held === undefined ||
+    (held.key !== `refs/${from}` && mine.read(`refs/${from}`) !== undefined)
+  ) {
     return undefined;
   }
   mine.write(`refs/${from}`, { nextPkHash, rights: held.referred.rights });
@@ -160,7 +206,8 @@ const successionOf = (memory, address) =>
     .filter((one) => one !== undefined)
     .sort((one, other) => one.v - other.v);
 
-const Being = ({ voice, address, deliver, modules, registry, vouched, watch }) => {
+const Being = ({ voice, address, deliver, modules, registry, span, vouched, watch }) => {
+  const held = spanOf(span);
   const memory = modules.memory;
   const root = rootFor({ memory, voice, address });
   const source = memory.read(address, 'program')?.value;
@@ -173,6 +220,8 @@ const Being = ({ voice, address, deliver, modules, registry, vouched, watch }) =
     classOf: (key) => program?.classOf(key) ?? coreClass(key),
   });
   const succession = successionOf(memory, address);
+  const stamp = Stamp();
+  const lanes = new Map();
   const answer = (spoken) => {
     const body = Tools.canon(spoken);
     if (body.length > MEASURE) {
@@ -261,20 +310,25 @@ const Being = ({ voice, address, deliver, modules, registry, vouched, watch }) =
           });
           return answer({ referred: from, rights: pending.rights });
         }
-        if (op?.ask === undefined || program === undefined) {
+        if (op?.ask === undefined || program === undefined || !program.visible(rights)) {
           return undefined;
         }
-        const asked = await program.ask({
-          context: {
-            from: program.caller ? from : undefined,
-            modules: offered(modules, program, mine),
-            port: Port({ voice, mine, deliver, rights }),
-            registry,
-            rights,
-          },
-          source: op.ask.source,
-          variables: op.ask.variables,
-        });
+        const fence = Fence();
+        const turn = fenced(mine, fence);
+        const asked = await within(
+          held,
+          program.ask({
+            context: {
+              from: program.caller ? from : undefined,
+              modules: offered(modules, program, turn),
+              port: Port({ voice, mine: turn, deliver, fence, lanes, rights, stamp }),
+              registry: custodial(registry, fence),
+              rights,
+            },
+            source: op.ask.source,
+            variables: op.ask.variables,
+          }),
+        ).finally(fence.close);
         return asked === undefined ? undefined : answer(asked);
       } catch {
         return undefined;
@@ -285,6 +339,19 @@ const Being = ({ voice, address, deliver, modules, registry, vouched, watch }) =
   });
 };
 
+// VII: the chain takes no plain write above version 1, so its rows stand.
+const spend = ({ memory, voice, address }) => {
+  for (const key of memory.list(address, '')) {
+    const cell = key.startsWith('chain/') ? undefined : memory.read(address, key);
+    if (cell === undefined || cell.value === null) {
+      continue;
+    }
+    const claim = { address, key, value: null, version: cell.version + 1 };
+    memory.write({ ...claim, sig: voice.sign(Tools.canon(claim)) });
+  }
+  return address;
+};
+
 const make = ({ memory, voice, address, program }) => {
   const root = Tools.secret();
   const put = (key, value) => {
@@ -317,16 +384,24 @@ const Registry = ({
   modulesFor,
   announce,
   forget,
+  span,
   vouched,
   attest,
   watch,
 }) => {
   const live = new Map();
-  const orphans = (at, written) =>
-    memory
+  const stranded = (at, written) => {
+    const source = memory.read(at, 'program')?.value;
+    const standing = source === undefined ? undefined : Program(source);
+    return memory
       .list(at, '')
       .filter((key) => memory.read(at, key)?.value !== null)
-      .filter((key) => written.classOf(key) === undefined);
+      .filter((key) => {
+        const under = written.classOf(key);
+        const was = standing?.classOf(key) ?? coreClass(key);
+        return under === undefined || (was !== undefined && was !== under);
+      });
+  };
   const activate = (at) => {
     if (live.has(at)) {
       return live.get(at);
@@ -343,6 +418,7 @@ const Registry = ({
       address: at,
       deliver,
       modules: modulesFor(voice, declared),
+      span,
       vouched,
       voice,
       watch,
@@ -409,7 +485,7 @@ const Registry = ({
       if (written.modules.some((one) => !modules.has(one.module))) {
         return undefined;
       }
-      if (orphans(address, written).length > 0) {
+      if (stranded(address, written).length > 0) {
         return undefined;
       }
       return adminMine.write('program', program) === undefined ? undefined : address;
@@ -422,7 +498,7 @@ const Registry = ({
       if (written === undefined) {
         return undefined;
       }
-      if (orphans(target, written).length > 0) {
+      if (stranded(target, written).length > 0) {
         return undefined;
       }
       const held = adminMine.read(`identity/custody/${target}`);
@@ -443,12 +519,14 @@ const Registry = ({
       return target;
     },
     destroy: (at) => {
-      if (adminMine.read(`identity/custody/${at}`) === undefined) {
+      const held = adminMine.read(`identity/custody/${at}`);
+      const voice = held === undefined ? undefined : Voice.revive(held);
+      if (voice === undefined) {
         return undefined;
       }
       adminMine.write(`identity/custody/${at}`, undefined);
       live.delete(at);
-      forget(at);
+      forget(at, voice);
       return at;
     },
     residents: () => {
@@ -473,4 +551,4 @@ const Registry = ({
   });
 };
 
-export { Being, Compartment, Registry, SUCCESSION, make, rootFor };
+export { Being, Compartment, Registry, SUCCESSION, make, rootFor, spend };

package/blueprint.mjs

@@ -167,32 +167,127 @@ const merged = (base, added) =>
     ]),
   );
 
+// Bare names, not Type.field pairs: X's "if create answers, it created"
+// makes Query.create and Mutation.create one reserved word.
 const doorsIn = (sdl) =>
   parse(sdl)
-    .definitions.filter(
-      (one) => one.kind === Kind.OBJECT_TYPE_DEFINITION || one.kind === Kind.OBJECT_TYPE_EXTENSION,
-    )
-    .flatMap((one) => (one.fields ?? []).map((field) => `${one.name.value}.${field.name.value}`));
+    .definitions.filter((one) => doorHolder(one) && ['Mutation', 'Query'].includes(one.name.value))
+    .flatMap((one) => (one.fields ?? []).map((field) => field.name.value));
 
-const composed = (baseSource, addedSource) => {
+const rootsIn = (document, schema) => {
+  const roots = [
+    schema.getQueryType()?.name,
+    schema.getMutationType()?.name,
+    schema.getSubscriptionType()?.name,
+  ].filter((one) => one !== undefined);
+  return document.definitions
+    .filter((one) => doorHolder(one) && roots.includes(one.name.value))
+    .flatMap((one) => one.fields ?? []);
+};
+
+// Names why Blueprint would refuse; Blueprint itself rules, and never reads
+// this. The bench binds the two: every cause named here is one it refuses.
+const faults = (source) => {
+  const trespass = reads(source);
+  if (trespass.length > 0) {
+    return [`it reads ambient power no blueprint may hold: ${trespass.join(', ')} (VIII)`];
+  }
+  let written;
+  try {
+    written = evaluated(source);
+  } catch (error) {
+    return [`it is not an expression settling a blueprint object: ${error.message} (VIII)`];
+  }
+  if (written === null || typeof written !== 'object') {
+    return ['it settles no blueprint object (VIII)'];
+  }
+  const declares = /enum\s+Rights\b/.test(written.interface) ? '' : DEFAULT_RIGHTS;
+  const sdl = [RIGHTS_DIRECTIVE, declares, written.interface].filter(Boolean).join('\n');
+  let document;
+  let schema;
+  try {
+    document = parse(sdl);
+    schema = buildSchema(sdl);
+  } catch (error) {
+    return [`its schema does not compile: ${error.message} (VIII)`];
+  }
+  const rights = [
+    ...new Set([
+      ...STRUCTURAL,
+      ...(schema.getType('Rights')?.getValues() ?? []).map((one) => one.name),
+    ]),
+  ];
+  const found = [];
+  for (const [key, cell] of Object.entries(written.memory ?? {})) {
+    if (coreClass(key) !== undefined) {
+      found.push(`the cell ${key} is the core's own, and no program declares it (VIII)`);
+    } else if (!CLASSES.includes(cell?.class)) {
+      found.push(`the cell ${key} names no class the memory law holds: ${cell?.class} (VIII)`);
+    }
+  }
+  const bare = [];
+  const outside = new Map();
+  for (const field of rootsIn(document, schema)) {
+    const allowed = rightsOf(field);
+    if (allowed === undefined) {
+      bare.push(field.name.value);
+      continue;
+    }
+    for (const held of allowed.filter((one) => !rights.includes(one))) {
+      outside.set(held, [...(outside.get(held) ?? []), field.name.value]);
+    }
+  }
+  if (bare.length > 0) {
+    found.push(`the door ${bare.join(', ')} declares no rights, and every door declares them (VI)`);
+  }
+  for (const [held, doors] of outside) {
+    found.push(
+      `the Rights enum does not name ${held}, which ${doors.length} door${doors.length === 1 ? '' : 's'} stand behind: ${doors.join(', ')} (VI)`,
+    );
+  }
+  return found;
+};
+
+const composition = (baseSource, addedSource) => {
+  const refused = (reason) => ({ refused: reason });
   try {
     const base = evaluated(baseSource);
     const added = evaluated(addedSource);
+    if (added === null || typeof added !== 'object') {
+      return refused('the part settles no blueprint object (VIII)');
+    }
     const standard = doorsIn(base.interface);
-    if (doorsIn(added.interface).some((one) => standard.includes(one))) {
-      return undefined;
+    const collides = [...new Set(doorsIn(added.interface).filter((one) => standard.includes(one)))];
+    if (collides.length > 0) {
+      return refused(
+        `the part declares the door ${collides.join(', ')}, which the administration already names — a standard door name is reserved on both roots (X)`,
+      );
     }
-    const cells = { ...(base.memory ?? {}), ...(added.memory ?? {}) };
-    if (
-      Object.keys(base.memory ?? {}).some((key) => (added.memory ?? {})[key] !== undefined) ||
-      (added.needs?.config !== undefined && base.needs?.config !== undefined)
-    ) {
-      return undefined;
+    const kept = Object.keys(base.memory ?? {}).filter(
+      (key) => (added.memory ?? {})[key] !== undefined,
+    );
+    if (kept.length > 0) {
+      return refused(
+        `the part declares the cell ${kept.join(', ')}, which the administration already keeps (X)`,
+      );
+    }
+    if (added.needs?.config !== undefined && base.needs?.config !== undefined) {
+      return refused(
+        'the part declares needs.config, and the program it composes with declares one too — a program holds one config (X)',
+      );
     }
     const slots = [...(base.needs?.modules ?? []), ...(added.needs?.modules ?? [])];
-    if (new Set(slots.map((one) => one.module)).size !== slots.length) {
-      return undefined;
+    const twice = [
+      ...new Set(
+        slots.map((one) => one.module).filter((name, at, all) => all.indexOf(name) !== at),
+      ),
+    ];
+    if (twice.length > 0) {
+      return refused(
+        `the part declares the module slot ${twice.join(', ')}, which the administration already holds (X)`,
+      );
     }
+    const cells = { ...(base.memory ?? {}), ...(added.memory ?? {}) };
     const needs = {
       ...(base.needs ?? {}),
       ...(added.needs ?? {}),
@@ -208,18 +303,22 @@ const composed = (baseSource, addedSource) => {
             .join(', ')} }`,
       )
       .join(', ');
-    return `({
+    const source = `({
   name: ${JSON.stringify(added.name)},
   needs: ${JSON.stringify(needs)},
   memory: ${JSON.stringify(cells)},
   interface: ${JSON.stringify(`${base.interface}\n${added.interface}`)},
   resolvers: { ${written} },
 })`;
-  } catch {
-    return undefined;
+    const found = faults(source);
+    return found.length > 0 ? refused(found.join('; ')) : { source };
+  } catch (error) {
+    return refused(`the part does not compose: ${error.message} (VIII)`);
   }
 };
 
+const composed = (baseSource, addedSource) => composition(baseSource, addedSource).source;
+
 const inputCheck = (schema, typeName, given) => {
   const type = schema.getType(typeName);
   if (type?.getFields === undefined) {
@@ -270,18 +369,10 @@ const Blueprint = (source) => {
     if (misdeclared.length > 0) {
       return undefined;
     }
-    const roots = [
-      schema.getQueryType()?.name,
-      schema.getMutationType()?.name,
-      schema.getSubscriptionType()?.name,
-    ].filter((one) => one !== undefined);
-    const undeclared = document.definitions
-      .filter((one) => doorHolder(one) && roots.includes(one.name.value))
-      .flatMap((one) => one.fields ?? [])
-      .filter((one) => {
-        const allowed = rightsOf(one);
-        return allowed === undefined || allowed.some((held) => !rights.includes(held));
-      });
+    const undeclared = rootsIn(document, schema).filter((one) => {
+      const allowed = rightsOf(one);
+      return allowed === undefined || allowed.some((held) => !rights.includes(held));
+    });
     if (undeclared.length > 0) {
       return undefined;
     }
@@ -319,23 +410,36 @@ const Blueprint = (source) => {
       rights,
       schema,
       // The directive definition stays: pointer.mjs runs buildSchema on this output.
-      sdlFor: (held) =>
-        print({
+      sdlFor: (held) => {
+        const kept = document.definitions
+          .map((one) =>
+            doorHolder(one)
+              ? {
+                  ...one,
+                  fields: (one.fields ?? []).filter((field) => {
+                    const allowed = rightsOf(field);
+                    return allowed === undefined || allowed.includes(held);
+                  }),
+                }
+              : one,
+          )
+          .filter((one) => !doorHolder(one) || one.fields.length > 0);
+        const defined = new Set(
+          kept
+            .filter((one) => one.kind === Kind.OBJECT_TYPE_DEFINITION)
+            .map((one) => one.name.value),
+        );
+        // A filtered view where only a part's extension survives must still
+        // stand alone as a schema, or the right it serves opens nothing.
+        return print({
           ...document,
-          definitions: document.definitions
-            .map((one) =>
-              doorHolder(one)
-                ? {
-                    ...one,
-                    fields: (one.fields ?? []).filter((field) => {
-                      const allowed = rightsOf(field);
-                      return allowed === undefined || allowed.includes(held);
-                    }),
-                  }
-                : one,
-            )
-            .filter((one) => !doorHolder(one) || one.fields.length > 0),
-        }),
+          definitions: kept.map((one) =>
+            one.kind === Kind.OBJECT_TYPE_EXTENSION && !defined.has(one.name.value)
+              ? { ...one, kind: Kind.OBJECT_TYPE_DEFINITION }
+              : one,
+          ),
+        });
+      },
       trespass: [],
     });
   } catch {
@@ -343,4 +447,16 @@ const Blueprint = (source) => {
   }
 };
 
-export { Blueprint, CLASSES, CORE_ONLY, FORBIDDEN, OPEN, STRUCTURAL, composed, coreClass, reads };
+export {
+  Blueprint,
+  CLASSES,
+  CORE_ONLY,
+  FORBIDDEN,
+  OPEN,
+  STRUCTURAL,
+  composed,
+  composition,
+  coreClass,
+  faults,
+  reads,
+};

package/client.mjs

@@ -64,4 +64,4 @@ const Client = ({ voice, deliver, resolve = (one) => one }) => {
   });
 };
 
-export { Client };
+export { Client, speaking };

package/ground.mjs

@@ -1,5 +1,5 @@
 import { ADMIN } from './admin.mjs';
-import { Being, Compartment, Registry, SUCCESSION, make, rootFor } from './being.mjs';
+import { Being, Compartment, Registry, SUCCESSION, make, rootFor, spend } from './being.mjs';
 import { Blueprint, composed, coreClass } from './blueprint.mjs';
 import { Client } from './client.mjs';
 import { Contracts } from './contract.mjs';
@@ -13,6 +13,36 @@ const GROUND = 'Ground';
 
 const FLOOR = ['blueprints', 'cells', 'contracts', 'keychain', 'paths', 'watch', 'wire'];
 
+const UNPROVEN = 'ground/unproven/';
+
+const HEIR = 'ground/heir';
+
+const commits = (cells, bundle) => {
+  const boxPk = bundle?.heirBoxPk;
+  if (typeof boxPk !== 'string' || Buffer.from(boxPk, 'base64').length !== 32) {
+    return undefined;
+  }
+  cells.put(HEIR, { boxPk, nextPkHash: bundle.nextPkHash });
+  return undefined;
+};
+
+const unprovenAt = (cells) => (at) => {
+  try {
+    const stood = cells.peek(`${UNPROVEN}${at}`);
+    const seen = Date.now();
+    cells.put(`${UNPROVEN}${at}`, {
+      at,
+      last: seen,
+      seen: (stood?.seen ?? 0) + 1,
+      since: stood?.since ?? seen,
+    });
+  } catch {
+    return undefined;
+  }
+};
+
+const unprovenRows = (cells) => cells.keys(UNPROVEN).map((row) => cells.peek(row));
+
 const install = ({ cells, keychain, program, bundle }) => {
   if (bundle?.next !== undefined) {
     return undefined;
@@ -29,6 +59,7 @@ const install = ({ cells, keychain, program, bundle }) => {
   }
   make({ memory, voice, address, program });
   cells.put('ground/admin', { address, sealed });
+  commits(cells, bundle);
   return address;
 };
 
@@ -72,10 +103,13 @@ const succeeds = ({ adminMine, adminVoice, address, bundle, cells, keychain, mem
     return undefined;
   }
   cells.put('ground/admin', { address, sealed });
+  commits(cells, bundle);
   return Tools.address(heir.pk);
 };
 
-const Ground = (modules = {}) => {
+// Never a key in the modules object: everything there that is not in FLOOR
+// becomes a module handed to programs under that name.
+const Ground = (modules = {}, { span } = {}) => {
   const cells = modules.cells;
   const keychain = modules.keychain;
   if (cells === undefined || keychain?.seal === undefined || keychain?.unseal === undefined) {
@@ -121,7 +155,7 @@ const Ground = (modules = {}) => {
   };
 
   const address = installed.address;
-  const memory = Memory(cells);
+  const memory = Memory(cells, unprovenAt(cells));
   const paths = modules.paths ?? Paths(new Map());
   const wire = modules.wire ?? Wire();
 
@@ -185,9 +219,13 @@ const Ground = (modules = {}) => {
     return door(envelope, token);
   };
   const announce = (at) => paths.publish(at, receive);
-  const forget = (at) => {
+  const forget = (at, voice) => {
     paths.publish(at, undefined);
-    cells.drop(`${at}/`);
+    if (voice === undefined) {
+      cells.drop(`${at}/`);
+      return undefined;
+    }
+    return spend({ memory, voice, address: at });
   };
 
   const attest = async (name) => {
@@ -213,6 +251,7 @@ const Ground = (modules = {}) => {
     modulesFor,
     announce,
     forget,
+    span,
     vouched,
     attest,
     watch,
@@ -223,6 +262,7 @@ const Ground = (modules = {}) => {
       deliver: (envelope) => deliver(envelope),
       modules: modulesFor(adminVoice, adminDeclared()),
       registry,
+      span,
       vouched,
       voice: adminVoice,
       watch,
@@ -268,6 +308,14 @@ const Ground = (modules = {}) => {
         },
       });
     },
+    seated: (at, from) => {
+      if (at === from) {
+        return true;
+      }
+      const row = held(at) ? memory.read(at, `refs/${from}`)?.value : undefined;
+      return row !== undefined && row !== null;
+    },
+    unproven: () => unprovenRows(cells),
   });
 };
 

package/index.mjs

@@ -1,10 +1,20 @@
 export { ADMIN } from './admin.mjs';
-export { Blueprint, CLASSES, CORE_ONLY, OPEN, STRUCTURAL, coreClass, reads } from './blueprint.mjs';
-export { Client } from './client.mjs';
+export {
+  Blueprint,
+  CLASSES,
+  CORE_ONLY,
+  OPEN,
+  STRUCTURAL,
+  composition,
+  coreClass,
+  faults,
+  reads,
+} from './blueprint.mjs';
+export { Client, speaking } from './client.mjs';
 export { Contract, Contracts } from './contract.mjs';
 export { FLOOR, GROUND, Ground } from './ground.mjs';
 export { Cells, Clock, Dns, Entropy, Keychain, Memory, Paths, Wire } from './modules.mjs';
 export { Mcp, Pointer } from './pointer.mjs';
 export { Program } from './program.mjs';
-export { MEASURE, Stamp, Tools } from './tools.mjs';
+export { MEASURE, SPAN, Stamp, Tools } from './tools.mjs';
 export { Voice } from './voice.mjs';

package/modules.mjs

@@ -28,7 +28,7 @@ const Cells = ({ file } = {}) => {
   });
 };
 
-const Memory = (cells) => {
+const Memory = (cells, unproven) => {
   const held = (address, key) => cells.peek(`${address}/${key}`);
   const writerAt = (address) => {
     const chain = held(address, 'chain/pk');
@@ -64,6 +64,7 @@ const Memory = (cells) => {
         return undefined;
       }
       if (!Tools.verifies(writer, Tools.canon({ address, key, value, version }), sig)) {
+        unproven?.(address);
         return undefined;
       }
       cells.put(`${address}/${key}`, { value, version });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nervur",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "description": "A distributed system of sovereign beings — one door, one question: by whose authority.",
   "license": "Apache-2.0",
   "author": "Razvan Gherghina",

package/program.mjs

@@ -4,6 +4,8 @@ import {
   getIntrospectionQuery,
   graphql,
   isObjectType,
+  parse,
+  validate,
 } from 'graphql';
 import { Blueprint } from './blueprint.mjs';
 
@@ -41,8 +43,39 @@ const Program = (source) => {
     }
     return curtained.get(held);
   };
+  // graphql's validator demands a Query root even to judge a mutation, so an
+  // all-mutation filtered world validates against a copy wearing an empty one
+  // — never printed, never executed against.
+  const askable = new Map();
+  const askableBy = (held) => {
+    if (!askable.has(held)) {
+      const seen = seenBy(held);
+      try {
+        askable.set(
+          held,
+          seen === undefined || seen.getQueryType() != null
+            ? seen
+            : buildSchema(`${blueprint.sdlFor(held)}\ntype Query { _stands: Boolean }`),
+        );
+      } catch {
+        askable.set(held, undefined);
+      }
+    }
+    return askable.get(held);
+  };
   return Object.freeze({
     ask: async ({ source: asked, variables, context }) => {
+      const seen = askableBy(context.rights);
+      if (seen === undefined) {
+        return undefined;
+      }
+      try {
+        if (validate(seen, parse(asked)).length > 0) {
+          return undefined;
+        }
+      } catch {
+        return undefined;
+      }
       const answered = await graphql({
         contextValue: context,
         schema,

package/tools.mjs

@@ -15,6 +15,8 @@ const VERSION_G = 6 << 3;
 
 const MEASURE = 8_388_608;
 
+const SPAN = 60_000;
+
 const ordered = (value) =>
   value === null || typeof value !== 'object'
     ? value
@@ -138,4 +140,4 @@ const Stamp = () => {
   };
 };
 
-export { MEASURE, Stamp, Tools };
+export { MEASURE, SPAN, Stamp, Tools };