nervur 0.11.0 → 0.13.0

package/being.mjs

@@ -1,10 +1,10 @@
 import { ADMIN } from './admin.mjs';
 import { OPEN, STRUCTURAL, composed, coreClass } from './blueprint.mjs';
 import { Program } from './program.mjs';
-import { MEASURE, Stamp, Tools } from './tools.mjs';
+import { Bytes, MEASURE, SPAN, Stamp, Tools } from './tools.mjs';
 import { Voice } from './voice.mjs';
 
-const Compartment = ({ memory, voice, address, root, classOf }) => {
+const Compartment = ({ memory, voice, address, root, classOf, cipher }) => {
   const held = (key) => memory.read(address, key);
   const sealed = (key) => {
     const kind = classOf(key);
@@ -25,7 +25,10 @@ const Compartment = ({ memory, voice, address, root, classOf }) => {
         return undefined;
       }
       const secret = sealed(key);
-      return secret === undefined ? cell.value : Tools.unseal(secret, cell.value);
+      if (secret === undefined) {
+        return cell.value;
+      }
+      return cipher === undefined ? undefined : cipher.unseal(secret, cell.value);
     },
     write: (key, plain) => {
       if (classOf(key) === undefined) {
@@ -35,11 +38,60 @@ const Compartment = ({ memory, voice, address, root, classOf }) => {
         return put(key, null);
       }
       const secret = sealed(key);
-      return put(key, secret === undefined ? plain : Tools.seal(secret, plain));
+      if (secret === undefined) {
+        return put(key, plain);
+      }
+      if (cipher === undefined) {
+        return undefined;
+      }
+      const shut = cipher.seal(secret, plain);
+      return shut === undefined ? undefined : put(key, shut);
     },
   });
 };
 
+const spanOf = (given) =>
+  typeof given === 'number' && Number.isFinite(given) && given > 0 && given < SPAN ? given : SPAN;
+
+const within = (span, work) => {
+  let timer;
+  const lapsed = new Promise((settle) => {
+    timer = setTimeout(() => settle(undefined), span);
+    timer.unref?.();
+  });
+  return Promise.race([work, lapsed]).finally(() => clearTimeout(timer));
+};
+
+const Fence = () => {
+  let standing = true;
+  return Object.freeze({
+    close: () => {
+      standing = false;
+      return undefined;
+    },
+    open: () => standing,
+  });
+};
+
+const fenced = (mine, fence) =>
+  Object.freeze({
+    classOf: mine.classOf,
+    list: mine.list,
+    read: mine.read,
+    write: (key, plain) => (fence.open() ? mine.write(key, plain) : undefined),
+  });
+
+const custodial = (registry, fence) =>
+  registry === undefined
+    ? undefined
+    : Object.freeze({
+        ...registry,
+        create: (one) => (fence.open() ? registry.create(one) : undefined),
+        destroy: (at) => (fence.open() ? registry.destroy(at) : undefined),
+        extend: (source) => (fence.open() ? registry.extend(source) : undefined),
+        upgrade: (one) => (fence.open() ? registry.upgrade(one) : undefined),
+      });
+
 const offered = (modules, program, mine) =>
   Object.freeze({
     ...Object.fromEntries(
@@ -63,6 +115,14 @@ const referable = (mine, key, plain, program) => {
     return { ...plain, rights };
   }
   const held = mine.read(key);
+  if (
+    held?.nextPkHash != null &&
+    plain.nextPkHash !== undefined &&
+    plain.nextPkHash !== null &&
+    plain.nextPkHash !== held.nextPkHash
+  ) {
+    return undefined;
+  }
   return {
     ...plain,
     nextPkHash: plain.nextPkHash ?? held?.nextPkHash ?? null,
@@ -89,21 +149,30 @@ const scoped = (mine, program) =>
     },
   });
 
-const rootFor = ({ memory, voice, address }) => {
+const rootFor = ({ memory, voice, address, cipher }) => {
   const cell = memory.read(address, `keyring/${Tools.address(voice.pk)}`);
-  const opened = cell === undefined ? undefined : voice.open(cell.value.wrapped);
-  return opened === undefined ? undefined : Buffer.from(opened, 'base64');
+  const opened = cell === undefined ? undefined : voice.open(cell.value.wrapped, cipher);
+  return opened === undefined ? undefined : Bytes.unbase64(opened);
 };
 
-const Port = ({ voice, mine, deliver, rights }) => {
-  const stamp = Stamp();
-  const lanes = new Map();
+const Port = ({ voice, mine, deliver, rights, stamp, lanes, fence }) => {
   const send = async (to, op) => {
-    const turn = (lanes.get(to) ?? Promise.resolve()).then(() => {
+    if (fence !== undefined && !fence.open()) {
+      return undefined;
+    }
+    const turn = (lanes.get(to) ?? Promise.resolve()).then(async () => {
       const handle = mine.read(`handles/${to}`);
-      return deliver(
-        Tools.envelope(handle === undefined ? voice : Voice.revive(handle.face), to, op, stamp()),
+      const envelope = await Tools.envelope(
+        handle === undefined ? voice : Voice.revive(handle.face),
+        to,
+        op,
+        stamp(),
+      );
+      const claim = Tools.digest(
+        Tools.canon({ from: envelope.from, op: envelope.op, seq: envelope.seq, to: envelope.to }),
       );
+      const reply = await deliver(envelope);
+      return reply === undefined ? undefined : { ...reply, claim };
     });
     const settled = turn.then(
       () => undefined,
@@ -163,9 +232,10 @@ const successionOf = (memory, address) =>
     .filter((one) => one !== undefined)
     .sort((one, other) => one.v - other.v);
 
-const Being = ({ voice, address, deliver, modules, registry, vouched, watch }) => {
+const Being = ({ voice, address, cipher, deliver, modules, registry, span, vouched, watch }) => {
+  const held = spanOf(span);
   const memory = modules.memory;
-  const root = rootFor({ memory, voice, address });
+  const root = rootFor({ memory, voice, address, cipher });
   const source = memory.read(address, 'program')?.value;
   const program = source === undefined ? undefined : Program(source);
   const mine = Compartment({
@@ -174,14 +244,17 @@ const Being = ({ voice, address, deliver, modules, registry, vouched, watch }) =
     address,
     root,
     classOf: (key) => program?.classOf(key) ?? coreClass(key),
+    cipher,
   });
   const succession = successionOf(memory, address);
-  const answer = (spoken) => {
+  const stamp = Stamp();
+  const lanes = new Map();
+  const answer = (spoken, claim) => {
     const body = Tools.canon(spoken);
     if (body.length > MEASURE) {
       return undefined;
     }
-    const signed = { body: spoken, sig: voice.sign(body) };
+    const signed = { body: spoken, sig: voice.sign(Tools.canon({ body: spoken, claim })) };
     return succession.length === 0 ? signed : { ...signed, succession };
   };
   const note = (envelope, outcome) => {
@@ -205,6 +278,7 @@ const Being = ({ voice, address, deliver, modules, registry, vouched, watch }) =
       try {
         const { from, op, seq, sig, to } = envelope;
         const claim = Tools.canon({ from, op, seq, to });
+        const claimDigest = Tools.digest(claim);
         const callerPk = Tools.pkOf(from);
         const proven =
           claim.length <= MEASURE &&
@@ -228,30 +302,34 @@ const Being = ({ voice, address, deliver, modules, registry, vouched, watch }) =
           if (program !== undefined && !program.visible(rights)) {
             return undefined;
           }
-          return answer({
-            address,
-            digest: program?.digest,
-            rights,
-            sdl: program?.sdlFor(rights),
-          });
+          return answer(
+            {
+              address,
+              box: Bytes.base64(voice.boxPk),
+              digest: program?.digest,
+              rights,
+              sdl: program?.sdlFor(rights),
+            },
+            claimDigest,
+          );
         }
         if (op?.introspect !== undefined) {
           const seen = await program?.introspect(rights);
-          return seen === undefined ? undefined : answer({ introspection: seen });
+          return seen === undefined ? undefined : answer({ introspection: seen }, claimDigest);
         }
         if (op?.rotate !== undefined) {
           const rotated = rotates({ mine }, from, op.rotate.nextPkHash);
-          return rotated === undefined ? undefined : answer({ rotated });
+          return rotated === undefined ? undefined : answer({ rotated }, claimDigest);
         }
         if (op?.release !== undefined) {
           if (row === undefined) {
             return undefined;
           }
           mine.write(`refs/${from}`, undefined);
-          return answer({ released: from });
+          return answer({ released: from }, claimDigest);
         }
         if (op?.acceptInvite !== undefined) {
-          const offer = Tools.digest(Buffer.from(op.acceptInvite.proof, 'base64'));
+          const offer = Tools.digest(Bytes.unbase64(op.acceptInvite.proof));
           const pending = mine.read(`refs/pending/${offer}`);
           if (pending === undefined || pending.spent) {
             return undefined;
@@ -262,23 +340,28 @@ const Being = ({ voice, address, deliver, modules, registry, vouched, watch }) =
             rights: pending.rights,
             seen: seq ?? 0,
           });
-          return answer({ referred: from, rights: pending.rights });
+          return answer({ referred: from, rights: pending.rights }, claimDigest);
         }
         if (op?.ask === undefined || program === undefined || !program.visible(rights)) {
           return undefined;
         }
-        const asked = await program.ask({
-          context: {
-            from: program.caller ? from : undefined,
-            modules: offered(modules, program, mine),
-            port: Port({ voice, mine, deliver, rights }),
-            registry,
-            rights,
-          },
-          source: op.ask.source,
-          variables: op.ask.variables,
-        });
-        return asked === undefined ? undefined : answer(asked);
+        const fence = Fence();
+        const turn = fenced(mine, fence);
+        const asked = await within(
+          held,
+          program.ask({
+            context: {
+              from: program.caller ? from : undefined,
+              modules: offered(modules, program, turn),
+              port: Port({ voice, mine: turn, deliver, fence, lanes, rights, stamp }),
+              registry: custodial(registry, fence),
+              rights,
+            },
+            source: op.ask.source,
+            variables: op.ask.variables,
+          }),
+        ).finally(fence.close);
+        return asked === undefined ? undefined : answer(asked, claimDigest);
       } catch {
         return undefined;
       }
@@ -288,18 +371,31 @@ const Being = ({ voice, address, deliver, modules, registry, vouched, watch }) =
   });
 };
 
-const make = ({ memory, voice, address, program }) => {
+// VII: the chain takes no plain write above version 1, so its rows stand.
+const spend = ({ memory, voice, address }) => {
+  for (const key of memory.list(address, '')) {
+    const cell = key.startsWith('chain/') ? undefined : memory.read(address, key);
+    if (cell === undefined || cell.value === null) {
+      continue;
+    }
+    const claim = { address, key, value: null, version: cell.version + 1 };
+    memory.write({ ...claim, sig: voice.sign(Tools.canon(claim)) });
+  }
+  return address;
+};
+
+const make = ({ memory, voice, address, program, cipher }) => {
   const root = Tools.secret();
   const put = (key, value) => {
     const claim = { address, key, value, version: (memory.read(address, key)?.version ?? 0) + 1 };
     return memory.write({ ...claim, sig: voice.sign(Tools.canon(claim)) });
   };
-  put('chain/pk', Buffer.from(voice.pk).toString('hex'));
+  put('chain/pk', Bytes.hex(voice.pk));
   put('chain/nextPkHash', voice.nextPkHash);
   put('program', program ?? '({})');
   put(`keyring/${Tools.address(voice.pk)}`, {
-    boxPk: Buffer.from(voice.boxPk).toString('base64'),
-    wrapped: Voice.sealTo(voice.boxPk, root.toString('base64')),
+    boxPk: Bytes.base64(voice.boxPk),
+    wrapped: Voice.sealTo(voice.boxPk, Bytes.base64(root), cipher),
   });
   const written = program === undefined ? undefined : Program(program);
   return Compartment({
@@ -308,6 +404,7 @@ const make = ({ memory, voice, address, program }) => {
     address,
     root,
     classOf: (key) => written?.classOf(key) ?? coreClass(key),
+    cipher,
   });
 };
 
@@ -315,21 +412,31 @@ const Registry = ({
   memory,
   adminMine,
   address,
+  cipher,
   deliver,
   modules,
   modulesFor,
   announce,
   forget,
+  span,
   vouched,
   attest,
   watch,
+  extended,
 }) => {
   const live = new Map();
-  const orphans = (at, written) =>
-    memory
+  const stranded = (at, written) => {
+    const source = memory.read(at, 'program')?.value;
+    const standing = source === undefined ? undefined : Program(source);
+    return memory
       .list(at, '')
       .filter((key) => memory.read(at, key)?.value !== null)
-      .filter((key) => written.classOf(key) === undefined);
+      .filter((key) => {
+        const under = written.classOf(key);
+        const was = standing?.classOf(key) ?? coreClass(key);
+        return under === undefined || (was !== undefined && was !== under);
+      });
+  };
   const activate = (at) => {
     if (live.has(at)) {
       return live.get(at);
@@ -344,8 +451,10 @@ const Registry = ({
     );
     const door = Being({
       address: at,
+      cipher,
       deliver,
       modules: modulesFor(voice, declared),
+      span,
       vouched,
       voice,
       watch,
@@ -379,7 +488,7 @@ const Registry = ({
       }
       const voice = Voice();
       const address = Tools.address(voice.pk);
-      const mine = make({ memory, voice, address, program });
+      const mine = make({ memory, voice, address, program, cipher });
       for (const [key, value] of Object.entries(data)) {
         if (mine.write(key, value) === undefined) {
           forget(address);
@@ -412,10 +521,14 @@ const Registry = ({
       if (written.modules.some((one) => !modules.has(one.module))) {
         return undefined;
       }
-      if (orphans(address, written).length > 0) {
+      if (stranded(address, written).length > 0) {
         return undefined;
       }
-      return adminMine.write('program', program) === undefined ? undefined : address;
+      if (adminMine.write('program', program) === undefined) {
+        return undefined;
+      }
+      extended?.();
+      return address;
     },
     upgrade: ({ address: target, program }) => {
       if (target === address) {
@@ -425,7 +538,7 @@ const Registry = ({
       if (written === undefined) {
         return undefined;
       }
-      if (orphans(target, written).length > 0) {
+      if (stranded(target, written).length > 0) {
         return undefined;
       }
       const held = adminMine.read(`identity/custody/${target}`);
@@ -446,12 +559,14 @@ const Registry = ({
       return target;
     },
     destroy: (at) => {
-      if (adminMine.read(`identity/custody/${at}`) === undefined) {
+      const held = adminMine.read(`identity/custody/${at}`);
+      const voice = held === undefined ? undefined : Voice.revive(held);
+      if (voice === undefined) {
         return undefined;
       }
       adminMine.write(`identity/custody/${at}`, undefined);
       live.delete(at);
-      forget(at);
+      forget(at, voice);
       return at;
     },
     residents: () => {
@@ -476,4 +591,4 @@ const Registry = ({
   });
 };
 
-export { Being, Compartment, Registry, SUCCESSION, make, rootFor };
+export { Being, Compartment, Registry, SUCCESSION, make, rootFor, spend, successionOf };

package/blueprint.mjs

@@ -174,25 +174,121 @@ const doorsIn = (sdl) =>
     .definitions.filter((one) => doorHolder(one) && ['Mutation', 'Query'].includes(one.name.value))
     .flatMap((one) => (one.fields ?? []).map((field) => field.name.value));
 
-const composed = (baseSource, addedSource) => {
+const rootsIn = (document, schema) => {
+  const roots = [
+    schema.getQueryType()?.name,
+    schema.getMutationType()?.name,
+    schema.getSubscriptionType()?.name,
+  ].filter((one) => one !== undefined);
+  return document.definitions
+    .filter((one) => doorHolder(one) && roots.includes(one.name.value))
+    .flatMap((one) => one.fields ?? []);
+};
+
+// Names why Blueprint would refuse; Blueprint itself rules, and never reads
+// this. The bench binds the two: every cause named here is one it refuses.
+const faults = (source) => {
+  const trespass = reads(source);
+  if (trespass.length > 0) {
+    return [`it reads ambient power no blueprint may hold: ${trespass.join(', ')} (VIII)`];
+  }
+  let written;
+  try {
+    written = evaluated(source);
+  } catch (error) {
+    return [`it is not an expression settling a blueprint object: ${error.message} (VIII)`];
+  }
+  if (written === null || typeof written !== 'object') {
+    return ['it settles no blueprint object (VIII)'];
+  }
+  const declares = /enum\s+Rights\b/.test(written.interface) ? '' : DEFAULT_RIGHTS;
+  const sdl = [RIGHTS_DIRECTIVE, declares, written.interface].filter(Boolean).join('\n');
+  let document;
+  let schema;
+  try {
+    document = parse(sdl);
+    schema = buildSchema(sdl);
+  } catch (error) {
+    return [`its schema does not compile: ${error.message} (VIII)`];
+  }
+  const declaredNames = (schema.getType('Rights')?.getValues() ?? []).map((one) => one.name);
+  const rights = [...new Set([...STRUCTURAL, ...declaredNames])];
+  const found = [];
+  if (!declares && STRUCTURAL.some((one) => !declaredNames.includes(one))) {
+    found.push(
+      `the Rights enum does not name ${STRUCTURAL.filter((one) => !declaredNames.includes(one)).join(', ')}, and every Rights enum names both SELF and STRANGER (VI)`,
+    );
+  }
+  for (const [key, cell] of Object.entries(written.memory ?? {})) {
+    if (coreClass(key) !== undefined) {
+      found.push(`the cell ${key} is the core's own, and no program declares it (VIII)`);
+    } else if (!CLASSES.includes(cell?.class)) {
+      found.push(`the cell ${key} names no class the memory law holds: ${cell?.class} (VIII)`);
+    }
+  }
+  const bare = [];
+  const outside = new Map();
+  for (const field of rootsIn(document, schema)) {
+    const allowed = rightsOf(field);
+    if (allowed === undefined) {
+      bare.push(field.name.value);
+      continue;
+    }
+    for (const held of allowed.filter((one) => !rights.includes(one))) {
+      outside.set(held, [...(outside.get(held) ?? []), field.name.value]);
+    }
+  }
+  if (bare.length > 0) {
+    found.push(`the door ${bare.join(', ')} declares no rights, and every door declares them (VI)`);
+  }
+  for (const [held, doors] of outside) {
+    found.push(
+      `the Rights enum does not name ${held}, which ${doors.length} door${doors.length === 1 ? '' : 's'} stand behind: ${doors.join(', ')} (VI)`,
+    );
+  }
+  return found;
+};
+
+const composition = (baseSource, addedSource) => {
+  const refused = (reason) => ({ refused: reason });
   try {
     const base = evaluated(baseSource);
     const added = evaluated(addedSource);
+    if (added === null || typeof added !== 'object') {
+      return refused('the part settles no blueprint object (VIII)');
+    }
     const standard = doorsIn(base.interface);
-    if (doorsIn(added.interface).some((one) => standard.includes(one))) {
-      return undefined;
+    const collides = [...new Set(doorsIn(added.interface).filter((one) => standard.includes(one)))];
+    if (collides.length > 0) {
+      return refused(
+        `the part declares the door ${collides.join(', ')}, which the administration already names — a standard door name is reserved on both roots (X)`,
+      );
     }
-    const cells = { ...(base.memory ?? {}), ...(added.memory ?? {}) };
-    if (
-      Object.keys(base.memory ?? {}).some((key) => (added.memory ?? {})[key] !== undefined) ||
-      (added.needs?.config !== undefined && base.needs?.config !== undefined)
-    ) {
-      return undefined;
+    const kept = Object.keys(base.memory ?? {}).filter(
+      (key) => (added.memory ?? {})[key] !== undefined,
+    );
+    if (kept.length > 0) {
+      return refused(
+        `the part declares the cell ${kept.join(', ')}, which the administration already keeps (X)`,
+      );
+    }
+    if (added.needs?.config !== undefined && base.needs?.config !== undefined) {
+      return refused(
+        'the part declares needs.config, and the program it composes with declares one too — a program holds one config (X)',
+      );
     }
     const slots = [...(base.needs?.modules ?? []), ...(added.needs?.modules ?? [])];
-    if (new Set(slots.map((one) => one.module)).size !== slots.length) {
-      return undefined;
+    const twice = [
+      ...new Set(
+        slots.map((one) => one.module).filter((name, at, all) => all.indexOf(name) !== at),
+      ),
+    ];
+    if (twice.length > 0) {
+      return refused(
+        `the part declares the module slot ${twice.join(', ')}, which the administration already holds (X)`,
+      );
     }
+    const cells = { ...(base.memory ?? {}), ...(added.memory ?? {}) };
     const needs = {
       ...(base.needs ?? {}),
       ...(added.needs ?? {}),
@@ -208,18 +304,22 @@ const composed = (baseSource, addedSource) => {
             .join(', ')} }`,
       )
       .join(', ');
-    return `({
+    const source = `({
   name: ${JSON.stringify(added.name)},
   needs: ${JSON.stringify(needs)},
   memory: ${JSON.stringify(cells)},
   interface: ${JSON.stringify(`${base.interface}\n${added.interface}`)},
   resolvers: { ${written} },
 })`;
-  } catch {
-    return undefined;
+    const found = faults(source);
+    return found.length > 0 ? refused(found.join('; ')) : { source };
+  } catch (error) {
+    return refused(`the part does not compose: ${error.message} (VIII)`);
   }
 };
 
+const composed = (baseSource, addedSource) => composition(baseSource, addedSource).source;
+
 const inputCheck = (schema, typeName, given) => {
   const type = schema.getType(typeName);
   if (type?.getFields === undefined) {
@@ -245,12 +345,11 @@ const Blueprint = (source) => {
     const sdl = [RIGHTS_DIRECTIVE, declares, written.interface].filter(Boolean).join('\n');
     const document = parse(sdl);
     const schema = buildSchema(sdl);
-    const rights = [
-      ...new Set([
-        ...STRUCTURAL,
-        ...(schema.getType('Rights')?.getValues() ?? []).map((one) => one.name),
-      ]),
-    ];
+    const declaredNames = (schema.getType('Rights')?.getValues() ?? []).map((one) => one.name);
+    if (!declares && STRUCTURAL.some((one) => !declaredNames.includes(one))) {
+      return undefined;
+    }
+    const rights = [...new Set([...STRUCTURAL, ...declaredNames])];
 
     const admits = (typeName, fieldName, held) => {
       const field = document.definitions
@@ -270,18 +369,10 @@ const Blueprint = (source) => {
     if (misdeclared.length > 0) {
       return undefined;
     }
-    const roots = [
-      schema.getQueryType()?.name,
-      schema.getMutationType()?.name,
-      schema.getSubscriptionType()?.name,
-    ].filter((one) => one !== undefined);
-    const undeclared = document.definitions
-      .filter((one) => doorHolder(one) && roots.includes(one.name.value))
-      .flatMap((one) => one.fields ?? [])
-      .filter((one) => {
-        const allowed = rightsOf(one);
-        return allowed === undefined || allowed.some((held) => !rights.includes(held));
-      });
+    const undeclared = rootsIn(document, schema).filter((one) => {
+      const allowed = rightsOf(one);
+      return allowed === undefined || allowed.some((held) => !rights.includes(held));
+    });
     if (undeclared.length > 0) {
       return undefined;
     }
@@ -304,7 +395,7 @@ const Blueprint = (source) => {
         needs.config === undefined ? Object.freeze({}) : inputCheck(schema, needs.config, given),
       digest: Tools.digest(
         Tools.canon({
-          interface: print(document),
+          interface: sdl,
           memory,
           name: written.name,
           needs,
@@ -356,4 +447,16 @@ const Blueprint = (source) => {
   }
 };
 
-export { Blueprint, CLASSES, CORE_ONLY, FORBIDDEN, OPEN, STRUCTURAL, composed, coreClass, reads };
+export {
+  Blueprint,
+  CLASSES,
+  CORE_ONLY,
+  FORBIDDEN,
+  OPEN,
+  STRUCTURAL,
+  composed,
+  composition,
+  coreClass,
+  faults,
+  reads,
+};

package/client.mjs

@@ -1,7 +1,5 @@
 import { Stamp, Tools } from './tools.mjs';
 
-const KEY = /^[0-9a-f]{64}$/;
-
 const speaking = (born, at, succession) => {
   if (succession === undefined) {
     return born;
@@ -11,13 +9,14 @@ const speaking = (born, at, succession) => {
   }
   let pk = born;
   for (const step of succession) {
-    if (!KEY.test(step?.next ?? '')) {
+    const next = typeof step?.next === 'string' ? Tools.pkOf(step.next) : null;
+    if (next === null) {
       return undefined;
     }
     if (!Tools.verifies(pk, Tools.canon({ at, next: step.next, v: step.v }), step.sig)) {
       return undefined;
     }
-    pk = Buffer.from(step.next, 'hex');
+    pk = next;
   }
   return pk;
 };
@@ -32,11 +31,15 @@ const Client = ({ voice, deliver, resolve = (one) => one }) => {
       return undefined;
     }
     const turn = (lanes.get(at) ?? Promise.resolve()).then(async () => {
-      const reply = await deliver(Tools.envelope(voice, at, op, stamp()));
+      const envelope = await Tools.envelope(voice, at, op, stamp());
+      const claim = Tools.digest(
+        Tools.canon({ from: envelope.from, op: envelope.op, seq: envelope.seq, to: envelope.to }),
+      );
+      const reply = await deliver(envelope);
       const answering = speaking(born, at, reply?.succession);
       return reply?.body === undefined ||
         answering === undefined ||
-        !Tools.verifies(answering, Tools.canon(reply.body), reply.sig)
+        !Tools.verifies(answering, Tools.canon({ body: reply.body, claim }), reply.sig)
         ? undefined
         : reply;
     });