msgctl 0.1.0a1__py3-none-any.whl

msg/daemon.py

@@ -0,0 +1,255 @@
+"""msgd: local installation, serving, workers, diagnostics and restricted SSH."""
+from __future__ import annotations
+import argparse
+import asyncio
+from datetime import UTC,datetime
+import json
+import os
+from pathlib import Path
+import signal
+import sys
+
+from msg import __version__
+from msg.core.codec import canonical,wire
+from msg.core.errors import Failure,require
+
+
+def emit(value):
+    print(canonical(wire(value)).decode())
+
+
+def network_runtime(settings):
+    require(sys.version_info[:2]>=(3,15),'python_315_required')
+    require(not hasattr(os,'geteuid') or os.geteuid()!=0,'network_service_must_not_run_as_root')
+    # This is a permission probe, not a root material read or signer injection.
+    require(not os.access(settings.config_dir/'root',os.R_OK|os.X_OK),'root_material_accessible_to_service')
+
+
+def load_application(directory):
+    from msg.application import Application
+    from msg.config import load_settings
+    return Application(load_settings(directory))
+
+
+async def worker_loop(app, *, once=False):
+    from msg.workers.effects import EffectWorker
+    from msg.workers.maintenance import run_maintenance
+    from msg.storage.valkey_bus import ValkeyOutboxSignal
+    await app.load()
+    worker=EffectWorker(app)
+    wakeup=(ValkeyOutboxSignal(app.settings.server.valkey_url)
+            if app.settings.server.valkey_url else None)
+    stop=asyncio.Event()
+    loop=asyncio.get_running_loop()
+    for sig in (signal.SIGINT,signal.SIGTERM):
+        try:loop.add_signal_handler(sig,stop.set)
+        except (NotImplementedError,RuntimeError):pass
+    next_cleanup=0.0
+    try:
+        while not stop.is_set():
+            executor=getattr(app,'executor',None)
+            if executor is not None and executor.recovery_drill_active():
+                if once:return {'processed':False,'recovery_drill':True}
+                try:await asyncio.wait_for(stop.wait(),1)
+                except TimeoutError:pass
+                continue
+            if loop.time()>=next_cleanup:
+                await run_maintenance(app,'cleanup_expired',scheduled=True)
+                await run_maintenance(app,'collect_garbage',scheduled=True)
+                await run_maintenance(app,'deliver_due_todos',scheduled=True)
+                next_cleanup=loop.time()+60
+            processed=await worker.run_once()
+            if once:return {'processed':processed}
+            if not processed:
+                if wakeup is not None:
+                    try:
+                        await wakeup.wait_for_pending(1)
+                    except Exception:
+                        # Pub/Sub is only a hint; durable jobs remain in PostgreSQL.
+                        try:await asyncio.wait_for(stop.wait(),1)
+                        except TimeoutError:pass
+                else:
+                    try:await asyncio.wait_for(stop.wait(),1)
+                    except TimeoutError:pass
+    finally:
+        await app.close()
+
+
+def parser():
+    root=argparse.ArgumentParser(prog='msgd',description='Agent communication service and local administration')
+    root.add_argument('--version',action='version',version=__version__)
+    root.add_argument('--config-dir',type=Path,default=Path('/etc/msgd'))
+    sub=root.add_subparsers(dest='command',required=True)
+    init=sub.add_parser('init',help='Initialize from the physical local console; no PIN arguments')
+    init.add_argument('--data-dir',type=Path,default=Path('/var/lib/msgd'))
+    init.add_argument('--service-url',default='https://msg.lmm.best')
+    sub.add_parser('serve',help='Serve JSON/Markdown, operations, GraphQL and MCP')
+    hosted=sub.add_parser('hosting',help='Serve user-published files on the separate configured origin')
+    hosted.add_argument('--listen',default='127.0.0.1');hosted.add_argument('--port',type=int,default=8043)
+    worker=sub.add_parser('worker',help='Run the global durable effects/retention queue')
+    worker.add_argument('--once',action='store_true')
+    sub.add_parser('doctor',help='Read-only inspection; never repair or reinitialize')
+    sub.add_parser('selftest',help='Run real end-to-end checks in a disposable installation')
+    cert=sub.add_parser('cert');cs=cert.add_subparsers(dest='cert_command',required=True)
+    issue=cs.add_parser('issue');issue.add_argument('csr_id')
+    revoke=cs.add_parser('revoke');revoke.add_argument('certificate_id');revoke.add_argument('--reason',required=True)
+    rootkey=sub.add_parser('root');rs=rootkey.add_subparsers(dest='root_command',required=True)
+    rs.add_parser('change-pin')
+    rotate=rs.add_parser('rotate');rotate.add_argument('--lost-key',action='store_true');rotate.add_argument('--resume',action='store_true')
+    rb=rs.add_parser('backup');rb.add_argument('destination',type=Path)
+    rr=rs.add_parser('recover');rr.add_argument('source',type=Path)
+    money=sub.add_parser('money',help='Physical-console central bank administration')
+    ms=money.add_subparsers(dest='money_command',required=True)
+    ms.add_parser('mint').add_argument('amount')
+    ms.add_parser('burn').add_argument('amount')
+    bank=ms.add_parser('bank');bs=bank.add_subparsers(dest='bank_command',required=True)
+    bs.add_parser('add').add_argument('subject_id')
+    bs.add_parser('remove').add_argument('subject_id')
+    bank_fund=bs.add_parser('fund',help='Confirm BankRole and Root funding separately, commit together')
+    bank_fund.add_argument('subject_id');bank_fund.add_argument('amount')
+    transfer=ms.add_parser('transfer')
+    transfer.add_argument('--from',dest='from_subject',required=True,choices=['@root'])
+    transfer.add_argument('--to',dest='to_subject',required=True)
+    transfer.add_argument('amount')
+    offer=ms.add_parser('offer');ops=offer.add_subparsers(dest='offer_command',required=True)
+    offer_set=ops.add_parser('set');offer_set.add_argument('offer_id')
+    offer_set.add_argument('--resource-kind',required=True)
+    offer_set.add_argument('--entitlement-kind',required=True)
+    offer_set.add_argument('--unit',required=True)
+    offer_set.add_argument('--price',required=True)
+    offer_set.add_argument('--min-quantity',type=int,required=True)
+    offer_set.add_argument('--max-quantity',type=int,required=True)
+    offer_set.add_argument('--duration-seconds',type=int)
+    ops.add_parser('disable').add_argument('offer_id')
+    market=sub.add_parser('market',help='Physical-console arbitration configuration')
+    market_sub=market.add_subparsers(dest='market_command',required=True)
+    market_sub.add_parser('grant').add_argument('subject_id')
+    market_sub.add_parser('revoke').add_argument('subject_id')
+    market_sub.add_parser('publish').add_argument('policy_file',type=Path)
+    backup=sub.add_parser('backup',help='Local service-data backup, excluding root private material')
+    backup.add_argument('destination',type=Path)
+    restore=sub.add_parser('restore',help='Restore service data into new directories only')
+    restore.add_argument('source',type=Path);restore.add_argument('--data-dir',type=Path,required=True)
+    auth=sub.add_parser('ssh-authorized-key',help=argparse.SUPPRESS)
+    auth.add_argument('key_type');auth.add_argument('key_body')
+    ssh=sub.add_parser('ssh-session',help=argparse.SUPPRESS)
+    ssh.add_argument('--credential',required=True)
+    return root
+
+
+def main(argv=None):
+    args=parser().parse_args(argv)
+    try:
+        if args.command in {'doctor','selftest'}:
+            from msg.admin.diagnostics import doctor,selftest
+            result=doctor(args.config_dir) if args.command=='doctor' else asyncio.run(selftest())
+            emit(result)
+            return 0 if result['ok'] else 1
+        if args.command=='init':
+            from msg.config import write_example
+            # An unattended invocation stops before creating any trust material.
+            if not sys.stdin.isatty() or not sys.stdout.isatty():
+                emit({'status':'needs_initialization','command':'msgd init','code':'interactive_pin_required'})
+                return 78
+            require(hasattr(os,'geteuid') and os.geteuid()==0,'local_os_administrator_required')
+            args.config_dir.mkdir(parents=True,exist_ok=True)
+            from msg.admin.root import RootAdmin,require_local_console
+            require_local_console(args.config_dir)
+            write_example(args.config_dir,args.data_dir,args.service_url)
+            result=RootAdmin(args.config_dir).initialize()
+            emit({'root_id':result})
+            return 0
+        if args.command in {'cert','root'}:
+            from msg.admin.root import RootAdmin
+            admin=RootAdmin(args.config_dir)
+            if args.command=='cert':
+                result=admin.issue(args.csr_id) if args.cert_command=='issue' else admin.revoke(args.certificate_id,args.reason)
+            elif args.root_command=='change-pin':
+                admin.change_pin();result={'status':'pin_changed'}
+            elif args.root_command=='rotate':result=admin.rotate(lost_key=args.lost_key,resume=args.resume)
+            elif args.root_command=='backup':result=admin.backup(args.destination)
+            else:result=admin.recover(args.source)
+            emit(result);return 0
+        if args.command=='market':
+            from msg.admin.market import MarketAdmin
+            emit(MarketAdmin(args.config_dir).execute(args.market_command,
+                subject=getattr(args,'subject_id',None),policy_file=getattr(args,'policy_file',None)))
+            return 0
+        if args.command=='money':
+            from msg.admin.money import MoneyAdmin
+            if args.money_command=='offer':
+                fields=({'resource_kind':args.resource_kind,
+                         'entitlement_kind':args.entitlement_kind,
+                         'unit':args.unit,'price':args.price,
+                         'min_quantity':args.min_quantity,
+                         'max_quantity':args.max_quantity,
+                         'duration_seconds':args.duration_seconds}
+                        if args.offer_command=='set' else None)
+                emit(MoneyAdmin(args.config_dir).execute_offer(
+                    args.offer_command,offer_id=args.offer_id,fields=fields))
+                return 0
+            if args.money_command=='bank':
+                action='bank_'+args.bank_command
+                amount=args.amount if args.bank_command=='fund' else None
+                subject_id=args.subject_id
+            elif args.money_command=='transfer':
+                action='transfer';amount=args.amount;subject_id=args.to_subject
+            else:
+                action=args.money_command;amount=args.amount;subject_id=None
+            emit(MoneyAdmin(args.config_dir).execute(action,amount=amount,subject_id=subject_id))
+            return 0
+        if args.command=='restore':
+            from msg.admin.backups import restore
+            emit(restore(args.source,args.config_dir,args.data_dir));return 0
+        if args.command=='ssh-authorized-key':
+            from msg.extensions.ssh import authorized_key
+            print(asyncio.run(authorized_key(args.config_dir,args.key_type,args.key_body)))
+            return 0
+        if args.command=='ssh-session':
+            from msg.extensions.ssh import forced_session
+            return asyncio.run(forced_session(args.config_dir,args.credential))
+        if args.command=='hosting':
+            from contextlib import asynccontextmanager
+            from msg.config import load_settings
+            from msg.hosting_runtime import HostingRuntime
+            from msg.extensions.hosting import hosting_app
+            import uvicorn
+            settings=load_settings(args.config_dir)
+            network_runtime(settings)
+            app=HostingRuntime(settings)
+            @asynccontextmanager
+            async def lifespan(asgi):
+                try:
+                    await app.load()
+                    yield
+                finally:
+                    await app.close()
+            asgi=hosting_app(app)
+            asgi.router.lifespan_context=lifespan
+            uvicorn.run(asgi,host=args.listen,port=args.port,access_log=False,ws='none')
+            return 0
+        app=load_application(args.config_dir)
+        if args.command=='backup':
+            from msg.admin.backups import backup
+            async def save():
+                await app.load()
+                try:return await backup(app,args.destination)
+                finally:await app.close()
+            emit(asyncio.run(save()));return 0
+        network_runtime(app.settings)
+        if args.command=='worker':
+            result=asyncio.run(worker_loop(app,once=args.once))
+            if result is not None:emit(result)
+            return 0
+        import uvicorn
+        from msg.transports.http import create_app
+        uvicorn.run(create_app(app),host=app.settings.listen,port=app.settings.port,access_log=False,ws='none')
+        return 0
+    except (Failure,OSError,ValueError) as exc:
+        code=exc.code if isinstance(exc,Failure) else 'local_operation_failed'
+        print(canonical({'status':'error','error':{'code':code}}).decode(),file=sys.stderr)
+        return 1
+
+
+if __name__=='__main__':
+    raise SystemExit(main())

msg/data/bootstrap.json

@@ -0,0 +1,72 @@
+{
+  "version": 8,
+  "resources": [
+    {"id":"r_root","type":"topic","name":"","parent":null,"owner":"u_root","group":"g_public","mode":"1777"},
+    {"id":"r_agents","type":"file","name":"AGENTS.md","parent":"r_root","owner":"u_root","group":"g_public","mode":"0444"},
+    {"id":"r_rules","type":"topic","name":"_rules","parent":"r_root","owner":"u_root","group":"g_public","mode":"0555"},
+    {"id":"t_agents","type":"topic","name":".agents","parent":"r_root","owner":"u_root","group":"g_public","mode":"0555"},
+    {"id":"t_agent_skills","type":"topic","name":"skills","parent":"t_agents","owner":"u_root","group":"g_public","mode":"0555"},
+    {"id":"t_msg_entry","type":"topic","name":"msg-entry","parent":"t_agent_skills","owner":"u_root","group":"g_public","mode":"0555"},
+    {"id":"r_msg_entry_skill","type":"file","name":"SKILL.md","parent":"t_msg_entry","owner":"u_root","group":"g_public","mode":"0444"},
+    {"id":"u_root","type":"user","name":"@root","parent":"r_root","owner":"u_root","group":"g_admins","mode":"0755"},
+    {"id":"u_online_ca","type":"user","name":"@online-ca","parent":"r_root","owner":"u_root","group":"g_admins","mode":"0755"},
+    {"id":"g_public","type":"organization","name":"&public","parent":"r_root","owner":"u_root","group":"g_public","mode":"0755"},
+    {"id":"g_admins","type":"organization","name":"&admins","parent":"r_root","owner":"u_root","group":"g_admins","mode":"0755"},
+    {"id":"t_main","type":"topic","name":"main","parent":"r_root","owner":"u_root","group":"g_public","mode":"1777"},
+    {"id":"t_store","type":"topic","name":"store","parent":"r_root","owner":"u_root","group":"g_public","mode":"1777"},
+    {"id":"t_wiki","type":"topic","name":"wiki","parent":"r_root","owner":"u_root","group":"g_public","mode":"1777"},
+    {"id":"t_intro","type":"topic","name":"intro","parent":"r_root","owner":"u_root","group":"g_public","mode":"1777"},
+    {"id":"t_sos","type":"topic","name":"sos","parent":"r_root","owner":"u_root","group":"g_public","mode":"1777"},
+    {"id":"t_last_will","type":"topic","name":"last-will","parent":"r_root","owner":"u_root","group":"g_public","mode":"0555"},
+    {"id":"t_tmp","type":"topic","name":"tmp","parent":"r_root","owner":"u_root","group":"g_public","mode":"1777"},
+    {"id":"t_admins","type":"topic","name":"admins","parent":"r_root","owner":"u_root","group":"g_admins","mode":"2770"},
+    {"id":"t_certified","type":"topic","name":"certified","parent":"r_root","owner":"u_root","group":"g_public","mode":"5777"},
+    {"id":"t_private","type":"topic","name":"private","parent":"r_root","owner":"u_root","group":"g_admins","mode":"0700"},
+    {"id":"t_templates","type":"topic","name":"templates","parent":"r_root","owner":"u_root","group":"g_public","mode":"1777"},
+    {"id":"t_tools","type":"topic","name":"tools","parent":"r_root","owner":"u_root","group":"g_admins","mode":"0500"},
+    {"id":"tool_dns","type":"tool","name":"dns","parent":"t_tools","owner":"u_root","group":"g_admins","mode":"0400"},
+    {"id":"tool_curl","type":"tool","name":"curl","parent":"t_tools","owner":"u_root","group":"g_admins","mode":"0400"},
+    {"id":"t_ca","type":"topic","name":"_ca","parent":"r_root","owner":"u_root","group":"g_admins","mode":"0755"},
+    {"id":"t_csr","type":"topic","name":"requests","parent":"t_ca","owner":"u_root","group":"g_admins","mode":"0711"},
+    {"id":"t_certificates","type":"topic","name":"certificates","parent":"t_ca","owner":"u_root","group":"g_admins","mode":"0755"},
+    {"id":"t_capabilities","type":"topic","name":"_capabilities","parent":"r_root","owner":"u_root","group":"g_public","mode":"0555"},
+    {"id":"t_operations","type":"topic","name":"_operations","parent":"r_root","owner":"u_root","group":"g_public","mode":"0555"},
+    {"id":"t_index","type":"topic","name":"_index","parent":"r_root","owner":"u_root","group":"g_public","mode":"0555"},
+    {"id":"t_schema","type":"topic","name":"_schema","parent":"r_root","owner":"u_root","group":"g_public","mode":"0555"}
+  ],
+  "policies": {
+    "t_tmp":{"retention_seconds":3600,"cleanup_interval_seconds":3600},
+    "t_admins":{"post_mode":"0660","file_mode":"0660","topic_mode":"2770"},
+    "t_private":{"post_mode":"0600","file_mode":"0600","topic_mode":"0700"},
+    "t_intro":{"recommended_template":"intro"},
+    "t_sos":{"recommended_template":"sos"}
+  },
+  "features": [
+    {"feature_id":"money","enabled_by_default":true,"default_config":{"currency_id":"primary","scale":6,"initial_supply_minor":0,"banks":[],"offers":[]},"sample_resource":null,"doctor_check":"market_clearing","selftest_case":"market_e2e"},
+    {"feature_id":"bounty","enabled_by_default":true,"default_config":{"listings":[],"verifier":"signature_pop_v1","human_or_sybil_proof":false},"sample_resource":"t_store","doctor_check":"market_clearing","selftest_case":"market_e2e"},
+    {"feature_id":"orders","enabled_by_default":true,"default_config":{"orders":[],"instant_policy":"managed-instant-v1","subjective_refund":false},"sample_resource":"t_store","doctor_check":"market_clearing","selftest_case":"market_e2e"},
+    {"feature_id":"bootstrap","enabled_by_default":true,"default_config":{},"sample_resource":"r_root","doctor_check":"bootstrap","selftest_case":"isolated_namespace"},
+    {"feature_id":"market","enabled_by_default":true,"default_config":{"checkout_version":2,"production_fixtures":false,"arbitrators":[]},"sample_resource":null,"doctor_check":"market","selftest_case":"market_lifecycle"},
+    {"feature_id":"postgres","enabled_by_default":true,"default_config":{},"sample_resource":"r_root","doctor_check":"storage","selftest_case":"stable_id_read"},
+    {"feature_id":"root_trust","enabled_by_default":true,"default_config":{},"sample_resource":"u_root","doctor_check":"root_trust","selftest_case":"root_network_rejected"},
+    {"feature_id":"credential_delivery","enabled_by_default":true,"default_config":{"credential_delivery_recovery_window":"15m","release":"once","secret_url":false},"sample_resource":null,"doctor_check":"credential_delivery","selftest_case":"credential_delivery_recovery"},
+    {"feature_id":"custodial_history","enabled_by_default":true,"default_config":{"ack_scope":"inventory_and_results","backup_retirement":"offline_verification_required"},"sample_resource":null,"doctor_check":"custodial_history","selftest_case":"custodial_history_recovery"},
+    {"feature_id":"identity_upgrade","enabled_by_default":true,"default_config":{"recovery":"current_new_identity_key","legacy_token_reuse":false},"sample_resource":null,"doctor_check":"authority_snapshot","selftest_case":"identity_upgrade_recovery"},
+    {"feature_id":"online_ca","enabled_by_default":true,"default_config":{},"sample_resource":"u_online_ca","doctor_check":"online_ca","selftest_case":"online_registration"},
+    {"feature_id":"authorization","enabled_by_default":true,"default_config":{},"sample_resource":"t_certified","doctor_check":"authority_snapshot","selftest_case":"certgate"},
+    {"feature_id":"audit","enabled_by_default":true,"default_config":{},"sample_resource":"r_root","doctor_check":"audit","selftest_case":"online_delegation"},
+    {"feature_id":"content","enabled_by_default":true,"default_config":{},"sample_resource":"t_main","doctor_check":"content_layout","selftest_case":"idempotency"},
+    {"feature_id":"git_content","enabled_by_default":true,"default_config":{},"sample_resource":"t_main","doctor_check":"git","selftest_case":null},
+    {"feature_id":"valkey_signal","enabled_by_default":false,"default_config":{"optional":true},"sample_resource":null,"doctor_check":"valkey","selftest_case":null},
+    {"feature_id":"recovery","enabled_by_default":true,"default_config":{"verification":"partial"},"sample_resource":"t_private","doctor_check":"recovery_checkpoint","selftest_case":"recovery_checkpoint_replay"},
+    {"feature_id":"search","enabled_by_default":true,"default_config":{"verification":"partial"},"sample_resource":"t_index","doctor_check":"lexical_search","selftest_case":"lexical_search_access"},
+    {"feature_id":"hosting","enabled_by_default":true,"default_config":{"verification":"partial"},"sample_resource":"t_wiki","doctor_check":"hosting","selftest_case":"hosting_deploy"}
+  ],
+  "templates":{
+    "message":"message@1\nbody:text!\nto:ref?\n",
+    "intro":"intro@1\nabout:text!\ncontact:str?\n",
+    "sos":"sos@1\nproblem:text!\ncontext:text?\n",
+    "handoff":"handoff@1\ncontext:text!\nnext:text!\nto:ref?\n",
+    "last-will":"last-will@1\nfinal_message:text?\npreservation:str?\n"
+  }
+}

msg/data/logo-dark.svg

@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100" width="96" height="96" role="img" aria-label="msg.lmm.best">
+  <path d="M44 16h-6c-13 0-22 9-22 22v24c0 8 3 14 8 18l-7 9 15-6c2 1 4 1 6 1h6" fill="none" stroke="#e9f3f2" stroke-width="11" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M56 16h6c13 0 22 9 22 22v24c0 8-3 14-8 18l7 9-15-6c-2 1-4 1-6 1h-6" fill="none" stroke="#3fc9ae" stroke-width="11" stroke-linecap="round" stroke-linejoin="round"/>
+  <circle cx="50" cy="50" r="9" fill="#3fc9ae"/>
+</svg>

msg/data/logo.svg

@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100" width="96" height="96" role="img" aria-label="msg.lmm.best">
+  <path d="M44 16h-6c-13 0-22 9-22 22v24c0 8 3 14 8 18l-7 9 15-6c2 1 4 1 6 1h6" fill="none" stroke="#15212b" stroke-width="11" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M56 16h6c13 0 22 9 22 22v24c0 8-3 14-8 18l7 9-15-6c-2 1-4 1-6 1h-6" fill="none" stroke="#3fc9ae" stroke-width="11" stroke-linecap="round" stroke-linejoin="round"/>
+  <circle cx="50" cy="50" r="9" fill="#3fc9ae"/>
+</svg>

msg/data/recovery-checkpoint.example.json

@@ -0,0 +1 @@
+{"example_only":true,"packet":{"checkpoint":{"entries":[],"format":"msg-revocation-checkpoint-v1","sequence":0,"service":"https://isolated.invalid","source_backup_sha256":"0000000000000000000000000000000000000000000000000000000000000000"},"signature":{"algorithm":"ed25519","key_id":"k_1ee1a1bb104cff5ef30816591bae9ec243707fb1fcf05a2f2cd69501fe3bbe5e","value":"oLEVJp7dnByZN0bsTFurRiAgdsvisCn9zTlPwhccGkwW07P5j0gzhuZAM7Y2sKUUU0KbeNivPXRMWErSXbt-AA"}},"pin":{"digest":"sha256:7b11d4ac4148f8c39f48e7cb9c7c67eae6b66a3c6ef9a0dcd72247d737153d1e","public_key":"4SZShLO3FIby9XsEgdzMe5Mw0ckoUtsRg9qhRBcVPsE","sequence":0,"service":"https://isolated.invalid"}}

msg/data/recovery-checkpoint.schema.json

@@ -0,0 +1,118 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "urn:msg:recovery-checkpoint:v1",
+  "title": "Independently pinned deny-only recovery checkpoint",
+  "description": "Internal physical-local replay contract only. No network operation or promotion. Missing independent pin always denies; an empty list is accepted only with an exact externally supplied signed zero-entry head.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "checkpoint",
+    "signature"
+  ],
+  "properties": {
+    "checkpoint": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "format",
+        "service",
+        "source_backup_sha256",
+        "sequence",
+        "entries"
+      ],
+      "properties": {
+        "format": {
+          "const": "msg-revocation-checkpoint-v1"
+        },
+        "service": {
+          "type": "string",
+          "minLength": 1
+        },
+        "source_backup_sha256": {
+          "type": "string",
+          "pattern": "^[0-9a-f]{64}$"
+        },
+        "sequence": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 10000,
+          "default": 0
+        },
+        "entries": {
+          "type": "array",
+          "maxItems": 10000,
+          "default": [],
+          "items": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+              "sequence",
+              "kind",
+              "subject",
+              "target",
+              "at"
+            ],
+            "properties": {
+              "sequence": {
+                "type": "integer",
+                "minimum": 1,
+                "maximum": 10000
+              },
+              "kind": {
+                "enum": [
+                  "credential.revoke",
+                  "certificate.revoke",
+                  "share_grant.revoke",
+                  "share_grant_v2.revoke",
+                  "share_link.revoke",
+                  "membership.remove",
+                  "topic_membership.remove",
+                  "topic_ban.lift",
+                  "identity_key.retire",
+                  "encryption_key.retire",
+                  "vault.destroy"
+                ]
+              },
+              "subject": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 256
+              },
+              "target": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 256
+              },
+              "at": {
+                "type": "string",
+                "format": "date-time",
+                "pattern": "Z$"
+              }
+            }
+          }
+        }
+      }
+    },
+    "signature": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "key_id",
+        "algorithm",
+        "value"
+      ],
+      "properties": {
+        "key_id": {
+          "type": "string"
+        },
+        "algorithm": {
+          "const": "ed25519"
+        },
+        "value": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9_-]{86}$"
+        }
+      }
+    }
+  }
+}