msgctl 0.1.0a1__py3-none-any.whl

msg/security/custody_history.py

@@ -0,0 +1,146 @@
+"""Read-only evidence for a bounded custody migration, never retirement authority.
+
+A valid ACK is the client's signed declaration that it decrypted one mapped copy.
+It cannot prove that no external ciphertext, recipient or recoverable backup exists.
+"""
+from __future__ import annotations
+
+from msg.core.codec import canonical, decode, unb64
+from msg.core.errors import Failure
+from msg.core.models import Signature
+from msg.security.age_keys import encryption_key_id, public_from_recipient
+from msg.security.backup_retirement import verified as verified_backup
+from msg.security.crypto import key_id, verify
+
+
+def _sha256(value):
+    return (isinstance(value, str) and len(value) == 71 and
+            value.startswith('sha256:') and
+            all(char in '0123456789abcdef' for char in value[7:]))
+
+
+def _entry(value):
+    return (isinstance(value, dict) and set(value) == {'id', 'revision', 'ciphertext_digest'}
+            and all(isinstance(value[key], str) and value[key] for key in ('id', 'revision'))
+            and _sha256(value['ciphertext_digest']))
+
+
+def history_evidence(subject_id, challenge_id, challenge, details, current):
+    """Reverify persisted ACKs, not merely their presence or cached success flags.
+
+    Legacy mappings bind the keys through the immutable challenge. New mappings
+    additionally carry the exact old/new key IDs; a conflicting binding is denied.
+    Unknown or malformed records stay pending and are not repaired by this read.
+    """
+    frozen = details.get('age_inventory')
+    mappings = details.get('rewrap_mappings', {})
+    acks = details.get('rewrap_acks', {})
+    result = {'verification_scope': 'enumerated_keystore_age_revisions',
+              'external_coverage': 'unknown', 'inventory_changed': True,
+              'mapped_count': len(mappings) if isinstance(mappings, dict) else 0,
+              'acked_count': len(acks) if isinstance(acks, dict) else 0,
+              'verified_acked_count': 0, 'known_ciphertexts_migrated': False,
+              'historical_revisions_require_migration': True}
+    try:
+        if not (isinstance(frozen, list) and all(_entry(item) for item in frozen)
+                and isinstance(mappings, dict) and isinstance(acks, dict)
+                and isinstance(current, list) and all(_entry(item) for item in current)):
+            return result
+        sources = {item['revision']: item for item in frozen}
+        if len(sources) != len(frozen):
+            return result
+        public = unb64(challenge['public_key'], limit=32)
+        if (challenge['subject_id'] != subject_id or challenge['challenge_id'] != challenge_id
+                or key_id(public) != details['new_identity_key_id']
+                or encryption_key_id(public_from_recipient(challenge['encryption_recipient']))
+                    != details['new_encryption_key_id']):
+            return result
+        copies = []
+        for revision, mapping in mappings.items():
+            if not (isinstance(mapping, dict) and mapping.get('old') == sources.get(revision)
+                    and revision in sources and _entry(mapping.get('new'))
+                    and mapping['new']['revision'] != revision
+                    and mapping.get('recipient') == challenge['encryption_recipient']
+                    and mapping.get('old_encryption_key_id', details['old_encryption_key_id'])
+                        == details['old_encryption_key_id']
+                    and mapping.get('new_encryption_key_id', details['new_encryption_key_id'])
+                        == details['new_encryption_key_id']):
+                return result
+            copies.append(mapping['new'])
+        if len({item['revision'] for item in copies}) != len(copies):
+            return result
+        expected = sorted(frozen + copies, key=lambda item: (item['id'], item['revision']))
+        result['inventory_changed'] = current != expected
+        verified = 0
+        for revision, ack in acks.items():
+            mapping = mappings.get(revision)
+            if not (mapping is not None and isinstance(ack, dict)
+                    and ack.get('old_revision') == revision
+                    and ack.get('new_revision') == mapping['new']['revision']
+                    and ack.get('ciphertext_digest') == mapping['new']['ciphertext_digest']
+                    and _sha256(ack.get('plaintext_digest'))
+                    and isinstance(ack.get('request_id'), str) and ack['request_id']):
+                continue
+            signed = {'subject_id': subject_id, 'challenge_id': challenge_id,
+                      'old': mapping['old'], 'new': mapping['new'],
+                      'plaintext_digest': ack['plaintext_digest'], 'request_id': ack['request_id']}
+            try:
+                verify(public, canonical(signed), decode(Signature, ack['signature']),
+                       purpose='custodial-rewrap-ack')
+            except (Failure, KeyError, TypeError, ValueError):
+                continue
+            verified += 1
+        result['verified_acked_count'] = verified
+        complete = (set(mappings) == set(acks) == set(sources)
+                    and verified == len(sources) and not result['inventory_changed'])
+        result['known_ciphertexts_migrated'] = complete
+        result['historical_revisions_require_migration'] = not complete
+    except (Failure, KeyError, TypeError, ValueError):
+        # Persisted damaged state is not successful evidence, nor a reason to
+        # expose ciphertext/secret details through an exception message.
+        pass
+    return result
+
+
+async def retirement_evidence(tx, subject_id, details, *, history_recoverable, now=None):
+    """Separate observable online retirement from locally attested backup retirement.
+
+    backup_retired needs one exact root-signed record imported at the physical
+    console; server_key_retired additionally needs observable online retirement.
+    """
+    new_signing = tx.one('SELECT key_id FROM identity_keys WHERE subject=? AND is_primary=1',
+                         (subject_id,))
+    new_encryption = tx.one('SELECT key_id FROM encryption_subkeys WHERE subject=? AND is_primary=1',
+                            (subject_id,))
+    switched = (new_signing is not None and new_encryption is not None
+                and new_signing[0] == details.get('new_identity_key_id')
+                and new_encryption[0] == details.get('new_encryption_key_id'))
+    vault = tx.one('''SELECT status,signing_nonce,signing_ciphertext,age_nonce,age_ciphertext,
+        destroyed_at,signing_key_id,encryption_key_id FROM custodial_vault WHERE subject=?''',
+        (subject_id,))
+    destroyed = (vault is not None and vault[0] == 'destroyed' and vault[5] is not None
+                 and all(value is None for value in vault[1:5])
+                 and vault[6] == details.get('old_identity_key_id')
+                 and vault[7] == details.get('old_encryption_key_id'))
+    old_signing = tx.one('SELECT retired_at,is_primary FROM identity_keys WHERE subject=? AND key_id=?',
+                         (subject_id, details.get('old_identity_key_id')))
+    old_encryption = tx.one('SELECT retired_at,is_primary FROM encryption_subkeys WHERE subject=? AND key_id=?',
+                            (subject_id, details.get('old_encryption_key_id')))
+    try:
+        credential = await tx.credential(details.get('old_identity_key_id'))
+        signing_revoked = credential.subject_id == subject_id and credential.revoked_at is not None
+    except Failure:
+        signing_revoked = False
+    online = (switched and destroyed and signing_revoked and
+              all(row is not None and row[0] is not None and not row[1]
+                  for row in (old_signing, old_encryption)))
+    status, attestation = await verified_backup(tx, subject_id, details, now=now)
+    backup = attestation is not None and attestation.binds(subject_id, details)
+    server = online and backup
+    return {'identity_switched': switched, 'history_recoverable': history_recoverable,
+            'online_retired': online, 'backup_retired': backup, 'server_key_retired': server,
+            'backup_retirement_evidence': status if not backup else 'local_attestation_verified',
+            'backup_retirement_record': attestation.view() if backup else None,
+            'completion_status': ('server_key_retired' if server and history_recoverable
+                                  else 'pending_backup_retirement' if online and history_recoverable
+                                  else 'pending_history' if switched else 'pending_identity_switch')}

msg/security/network.py

@@ -0,0 +1,81 @@
+"""Network policies are intersected; parsing or DNS never grants authority."""
+from __future__ import annotations
+
+from dataclasses import replace
+import ipaddress
+import re
+from urllib.parse import urlsplit
+
+from msg.core.errors import Failure,require
+
+
+def normalized_host(host):
+    require(isinstance(host,str) and host and len(host)<=253 and '%' not in host and
+            not any(ord(c)<=32 or ord(c)==127 for c in host),'invalid_host')
+    host=host.rstrip('.').lower()
+    try:
+        return str(ipaddress.ip_address(host))
+    except ValueError:
+        try:
+            value=host.encode('idna').decode('ascii')
+        except UnicodeError as exc:
+            raise Failure('invalid_host') from exc
+        require(all(re.fullmatch(r'[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?',part) for part in value.split('.')),'invalid_host')
+        return value
+
+
+def validate_url(url,method,policy):
+    require(type(url) is str and 0<len(url)<=8192 and '\\' not in url and
+            all(ord(c)>32 and ord(c)!=127 for c in url),'invalid_network_url')
+    try:
+        parsed=urlsplit(url)
+        require(parsed.scheme in policy.schemes and parsed.scheme in {'http','https'},'network_scheme_forbidden')
+        require(parsed.hostname is not None and parsed.username is None and parsed.password is None and not parsed.fragment,
+                'invalid_network_url')
+        host=normalized_host(parsed.hostname)
+        port=parsed.port or (443 if parsed.scheme=='https' else 80)
+    except ValueError as exc:
+        if isinstance(exc,Failure):raise
+        raise Failure('invalid_network_url') from exc
+    require(port in policy.ports,'network_port_forbidden')
+    require(method in policy.methods,'network_method_forbidden')
+    require(not policy.hosts or host in {normalized_host(h) for h in policy.hosts},'network_host_forbidden')
+    return parsed
+
+
+def validate_addresses(addresses,policy):
+    require(bool(addresses),'dns_no_address')
+    results=[]
+    for value in addresses:
+        require('%' not in value,'invalid_network_target')
+        try:
+            ip=ipaddress.ip_address(value)
+        except ValueError as exc:
+            raise Failure('invalid_network_target') from exc
+        actual=ip.ipv4_mapped if isinstance(ip,ipaddress.IPv6Address) and ip.ipv4_mapped else ip
+        if not policy.allow_private:
+            require(actual.is_global and not actual.is_multicast,'private_target_forbidden')
+        require(not actual.is_unspecified and not actual.is_multicast,'invalid_network_target')
+        results.append(value)
+    return results
+
+
+def intersect_policy(policy,constraints):
+    require(set(constraints)<={'hosts','schemes','ports','methods','timeout_ms','max_response_bytes','max_redirects'},
+            'unknown_network_constraint')
+    values={}
+    for field in ('hosts','schemes','ports','methods'):
+        if field not in constraints:continue
+        supplied=set(constraints[field])
+        if field=='hosts':
+            supplied={normalized_host(h) for h in supplied}
+        current=set(getattr(policy,field))
+        narrowed=supplied if field=='hosts' and not current else current&supplied
+        require(bool(narrowed),'network_policy_empty')
+        values[field]=tuple(sorted(narrowed)) if field=='hosts' else frozenset(narrowed)
+    for field in ('timeout_ms','max_response_bytes','max_redirects'):
+        if field in constraints:
+            value=constraints[field]
+            require(type(value) is int and value>=(0 if field=='max_redirects' else 1),'invalid_network_limit')
+            values[field]=min(value,getattr(policy,field))
+    return replace(policy,**values)

msg/security/policy.py

@@ -0,0 +1,67 @@
+"""Small pure mode/scope primitives. Certificate rights never replace entry checks."""
+from __future__ import annotations
+from msg.core.errors import require
+
+READ,WRITE,EXECUTE=4,2,1
+CERTGATE,SETGID,STICKY=0o4000,0o2000,0o1000
+
+
+def selected_class(resource,subject,memberships):
+    if subject is not None and subject==resource.owner:
+        return 'owner'
+    if subject is not None and resource.group in memberships:
+        return 'group'
+    return 'other'
+
+
+def class_bits(mode,permission_class):
+    require(type(mode) is int and 0<=mode<=0o7777,'invalid_mode')
+    return (mode>>{'owner':6,'group':3,'other':0}[permission_class])&7
+
+
+def allows(resource,subject,memberships,permission):
+    mask={'read':READ,'write':WRITE,'execute':EXECUTE,'list':READ,'traverse':EXECUTE}[permission]
+    return class_bits(resource.mode,selected_class(resource,subject,memberships))&mask==mask
+
+
+def inherit_group(parent,primary_group):
+    return parent.group if parent.mode&SETGID else primary_group
+
+
+def format_mode(mode):
+    require(type(mode) is int and 0<=mode<=0o7777,'invalid_mode')
+    return f'{mode:04o}'
+
+
+async def scope_contains(scope,resource_id,session):
+    if scope.resource_id==resource_id:
+        return True
+    return scope.descendants and any(r.id==scope.resource_id for r in await session.ancestors(resource_id))
+
+
+async def scope_subset(child,parent,session):
+    if child.resource_id==parent.resource_id:
+        return not child.descendants or parent.descendants
+    return parent.descendants and await scope_contains(parent,child.resource_id,session)
+
+
+async def grant_covers(grant,capability,operation,resource_id,session):
+    return (grant.capability==capability and grant.version==1 and operation in grant.operations
+            and await scope_contains(grant.scope,resource_id,session))
+
+
+def constraints_subset(child,parent):
+    """Lists narrow allowlists; upper bounds may only decrease. Unknown keys reject upstream."""
+    for name,value in parent.items():
+        if name not in child:
+            return False
+        proposed=child[name]
+        if name in {'hosts','methods','ports','schemes'}:
+            if not set(proposed)<=set(value):
+                return False
+        elif name in {'max_response_bytes','timeout_ms','max_redirects'}:
+            if type(proposed) is not int or proposed>value:
+                return False
+        elif proposed!=value:
+            return False
+    return True

msg/security/quarantine.py

@@ -0,0 +1,19 @@
+"""A restored snapshot is not current authority until a local recovery is proven.
+
+The gate is a database fact, not a deletable config marker. No network operation
+may clear it. Absence alone means an ordinary installation; malformed, false or
+unknown values fail closed. This is containment, not a revocation replay proof.
+"""
+from msg.core.errors import require
+
+SETTING = 'recovery_quarantine'
+
+
+def active(session):
+    return session.one('SELECT value FROM settings WHERE key=?', (SETTING,)) is not None
+
+
+def require_live_authority(session):
+    # Even anonymous access to formerly public content may revive an ACL that
+    # was revoked after the snapshot. Only the transport health probe remains.
+    require(not active(session), 'recovery_quarantined')

msg/security/root_files.py

@@ -0,0 +1,67 @@
+"""Descriptor-checked private Root files and a nonblocking local rotation lock.
+
+These helpers confer no Root authority. RootAdmin must still enforce the real
+OS-console/PIN ceremony; isolated tests exercise only the internal file use case.
+"""
+import fcntl
+import os
+import stat
+from contextlib import contextmanager
+from pathlib import Path
+
+from msg.core.errors import Failure, require
+
+
+def _private_descriptor(fd):
+    info = os.fstat(fd)
+    require(stat.S_ISREG(info.st_mode) and info.st_uid == os.geteuid() and
+            stat.S_IMODE(info.st_mode) == 0o600 and info.st_nlink == 1,
+            'unsafe_root_private_file')
+    return info
+
+
+def read_private(path, *, limit=4 * 1024 * 1024):
+    try:
+        fd = os.open(path, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK | os.O_CLOEXEC)
+    except OSError as exc:
+        raise Failure('unsafe_root_private_file') from exc
+    try:
+        before = _private_descriptor(fd)
+        require(0 < before.st_size <= limit, 'unsafe_root_private_file')
+        chunks, count = [], 0
+        while chunk := os.read(fd, min(65536, limit + 1 - count)):
+            count += len(chunk)
+            require(count <= limit, 'unsafe_root_private_file')
+            chunks.append(chunk)
+        after = os.fstat(fd)
+        require(before.st_size == count == after.st_size and
+                before.st_mtime_ns == after.st_mtime_ns and before.st_ctime_ns == after.st_ctime_ns,
+                'root_private_file_changed')
+        return b''.join(chunks)
+    finally:
+        os.close(fd)
+
+
+@contextmanager
+def rotation_lock(protected):
+    protected = Path(protected)
+    require(not protected.is_symlink(), 'unsafe_root_private_path')
+    protected.mkdir(mode=0o700, parents=True, exist_ok=True)
+    info = protected.stat()
+    require(stat.S_ISDIR(info.st_mode) and info.st_uid == os.geteuid() and
+            stat.S_IMODE(info.st_mode) == 0o700, 'unsafe_root_private_path')
+    try:
+        fd = os.open(protected / '.rotation.lock', os.O_CREAT | os.O_RDWR | os.O_NOFOLLOW |
+                     os.O_NONBLOCK | os.O_CLOEXEC, 0o600)
+    except OSError as exc:
+        raise Failure('unsafe_root_private_file') from exc
+    try:
+        _private_descriptor(fd)
+        try:
+            fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
+        except BlockingIOError as exc:
+            raise Failure('root_rotation_busy', retryable=True) from exc
+        yield
+    finally:
+        fcntl.flock(fd, fcntl.LOCK_UN)
+        os.close(fd)

msg/security/rotation_journal.py

@@ -0,0 +1,60 @@
+"""Validate a locally approved root rotation without loading a network service."""
+from msg.constants import ROOT_SUBJECT, ONLINE_CA
+from msg.core.codec import canonical, decode, digest, unb64
+from msg.core.errors import require
+from msg.core.models import Certificate, CertificateRequest, Signature
+from msg.security.certificates import certificate_body, verify_csr
+from msg.security.crypto import Ed25519Signer, open_private_key, verify
+
+_FIELDS = {'version', 'old_certificate', 'new_trust', 'new_envelope', 'online_csr',
+           'previous_envelope_digest', 'statement', 'new_signature', 'old_signature'}
+
+
+def authorization(journal):
+    """Public, signed commitments; never copy the encrypted root into an audit."""
+    return {'version': journal['version'], 'statement': journal['statement'],
+            'old_certificate_digest': digest(journal['old_certificate']),
+            'new_trust_digest': digest(journal['new_trust']),
+            'new_envelope_digest': digest(journal['new_envelope']),
+            'online_csr_digest': digest(journal['online_csr']),
+            'previous_envelope_digest': journal['previous_envelope_digest']}
+
+
+def validate(journal, *, pin, service, online_public):
+    require(isinstance(journal, dict) and journal.get('version') == 2,
+            'rotation_journal_upgrade_required')
+    require(set(journal) == _FIELDS, 'invalid_rotation_journal')
+    signer = Ed25519Signer.from_bytes(open_private_key(journal['new_envelope'], pin))
+    trust = journal['new_trust']
+    require(set(trust) == {'version', 'public_key', 'certificate'} and trust['version'] == 1,
+            'invalid_trust_anchor')
+    require(signer.public_key == unb64(trust['public_key'], limit=32), 'root_key_mismatch')
+    proof = authorization(journal)
+    verify(signer.public_key, canonical(proof), decode(Signature, journal['new_signature']),
+           purpose='root-rotation')
+    old = decode(Certificate, journal['old_certificate'])
+    new = decode(Certificate, trust['certificate'])
+    statement = journal['statement']
+    require(statement['old_certificate'] == old.resource_id and
+            statement['new_certificate'] == new.resource_id and
+            statement['new_fingerprint'] == digest(signer.public_key) and
+            type(statement['previous_key_proved']) is bool and
+            statement['previous_key_proved'] == (journal['old_signature'] is not None),
+            'rotation_statement_mismatch')
+    require(old.resource_id != new.resource_id and old.key_id != new.key_id,
+            'rotation_keys_must_change')
+    require(new.key_id == signer.key_id and new.subject_id == new.issuer_id == ROOT_SUBJECT and
+            new.parent_certificate_id is None and new.kind == 'ca' and
+            new.issuance is not None and not new.authority_sources and
+            old.subject_id == ROOT_SUBJECT and
+            new.target_service == old.target_service == service, 'rotation_service_mismatch')
+    verify(signer.public_key, canonical(certificate_body(new)), new.signature, purpose='certificate')
+    csr = decode(CertificateRequest, journal['online_csr'])
+    verify_csr(csr)
+    require(csr.public_key == online_public and csr.subject_id == csr.applicant == ONLINE_CA and
+            csr.requested_issuer == ROOT_SUBJECT and csr.target_service == service and
+            csr.kind == 'ca' and csr.delegation_depth == 0 and not csr.authority_sources and
+            csr.issuance is not None and csr.issuance.max_child_ca_depth == 0 and
+            len(csr.grants) == 1 and csr.grants[0].capability == 'cert.issue',
+            'rotation_online_csr_mismatch')
+    return signer, old, new, csr, proof

msg/security/sealed_box.py

@@ -0,0 +1,70 @@
+"""Client-side X25519 + HKDF-SHA256 + AES-256-GCM envelope.
+
+This is a versioned msg envelope, not age, OpenPGP or a new cryptographic
+primitive. Encryption keys are independent of signing keys. The server validates
+only the envelope shape; it never receives a decryption key.
+"""
+from __future__ import annotations
+import os
+from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PrivateKey, X25519PublicKey
+from cryptography.hazmat.primitives.kdf.hkdf import HKDF
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+from cryptography.exceptions import InvalidTag
+from msg.core.codec import b64, unb64, canonical, loads
+from msg.core.errors import Failure, require
+
+FORMAT='msg-x25519-v1'
+
+
+def generate_key():
+    key=X25519PrivateKey.generate()
+    return key.private_bytes_raw(),key.public_key().public_bytes_raw()
+
+
+def validate_envelope(content):
+    value=loads(content)
+    require(isinstance(value,dict) and set(value)=={'format','recipient','ephemeral','salt','nonce','ciphertext'},
+            'invalid_ciphertext_envelope')
+    require(value['format']==FORMAT,'invalid_ciphertext_format')
+    for name,size in (('recipient',32),('ephemeral',32),('salt',32),('nonce',12)):
+        require(len(unb64(value[name],limit=size))==size,'invalid_ciphertext_envelope')
+    require(len(unb64(value['ciphertext']))>=16,'invalid_ciphertext_envelope')
+    return value
+
+
+def derived(shared,salt,recipient,ephemeral):
+    return HKDF(algorithm=hashes.SHA256(),length=32,salt=salt,
+                info=b'msg-keystore-v1\0'+recipient+ephemeral).derive(shared)
+
+
+def encrypt(plaintext,recipient_public):
+    require(isinstance(plaintext,bytes) and len(recipient_public)==32,'invalid_encryption_input')
+    ephemeral=X25519PrivateKey.generate()
+    public=ephemeral.public_key().public_bytes_raw()
+    salt,nonce=os.urandom(32),os.urandom(12)
+    header={'format':FORMAT,'recipient':b64(recipient_public),'ephemeral':b64(public),
+            'salt':b64(salt),'nonce':b64(nonce)}
+    try:
+        shared=ephemeral.exchange(X25519PublicKey.from_public_bytes(recipient_public))
+    except ValueError as exc:
+        raise Failure('invalid_encryption_recipient') from exc
+    key=derived(shared,salt,recipient_public,public)
+    ciphertext=AESGCM(key).encrypt(nonce,plaintext,canonical(header))
+    return canonical({**header,'ciphertext':b64(ciphertext)})
+
+
+def decrypt(content,private):
+    try:
+        value=validate_envelope(content)
+        key=X25519PrivateKey.from_private_bytes(private)
+        recipient=key.public_key().public_bytes_raw()
+        require(b64(recipient)==value['recipient'],'wrong_decryption_recipient')
+        ephemeral=unb64(value['ephemeral'])
+        shared=key.exchange(X25519PublicKey.from_public_bytes(ephemeral))
+        derived_key=derived(shared,unb64(value['salt']),recipient,ephemeral)
+        header={k:v for k,v in value.items() if k!='ciphertext'}
+        return AESGCM(derived_key).decrypt(unb64(value['nonce']),unb64(value['ciphertext']),canonical(header))
+    except (ValueError,InvalidTag,KeyError,TypeError) as exc:
+        if isinstance(exc,Failure):raise
+        raise Failure('ciphertext_authentication_failed') from exc

msg/security/sharing_policy.py

@@ -0,0 +1,29 @@
+"""Shared, current-state boundaries for grants, delegated sources and links.
+
+Only the finite ShareGrant@2 contract (read, no constraints) is accepted. These
+checks do not grant an owner, a role or a certificate any additional permission.
+"""
+from __future__ import annotations
+
+
+def share_target_error(registry, resource, chain, session):
+    """Return the same denial at issuance and at every source revalidation."""
+    if resource.state != 'active' or any(item.state != 'active' for item in chain):
+        return 'share_forbidden_resource'
+    if registry.resource_type(resource.type, resource.type_version).container:
+        return 'share_container_forbidden'
+    if any(item.id in {'r_agents', 'r_rules', 't_last_will'} or item.type in {
+            'tool', 'csr', 'certificate', 'credential', 'legacy_directive',
+            'dm_conversation'} for item in chain):
+        return 'share_forbidden_resource'
+    if any(parent.type == 'user' and child.name in {'SOUL.md', 'AGENTS.md', 'todos'}
+           for parent, child in zip(chain, chain[1:])):
+        return 'share_forbidden_resource'
+    if any(session.setting('hosting_preview:' + item.id) or
+           session.setting('hosting_preview_file:' + item.id) for item in chain):
+        return 'share_forbidden_resource'
+    if session.one('SELECT 1 FROM dm_conversations WHERE resource_id IN (' +
+                   ','.join('?' for _ in chain) + ') LIMIT 1',
+                   tuple(item.id for item in chain)) is not None:
+        return 'share_forbidden_resource'
+    return None

msg/security/token_delivery.py

@@ -0,0 +1,93 @@
+"""One-time credential delivery, distinct from service composition.
+
+The handler records the verifier in its existing issuance transaction. After that
+transaction commits, release claims the delivery in a separate write transaction;
+only a committed claim can produce a response-only token. Lost responses must use
+the pre-bound recovery operation, never replay a persistent secret. This module
+owns no signer, vault, root capability, HTTP adapter or plugin registry.
+
+Clock and window providers preserve the configured current values without giving
+the domain access to the whole settings/Application object. These are trusted
+in-process dependencies, not a Python sandbox or an additional authorization path.
+"""
+from __future__ import annotations
+
+from collections.abc import Callable
+from dataclasses import replace
+from datetime import datetime, timedelta
+import hashlib
+import hmac
+
+from msg.core.codec import b64, canonical, unb64, wire
+from msg.core.contracts import MetadataStore
+from msg.core.errors import require
+from msg.core.requests import SECRET_DELIVERY_MIN_VERSION
+
+
+def recovery_verifier(value):
+    secret=unb64(value,limit=64)
+    require(len(secret)>=32,'invalid_recovery_secret')
+    return hashlib.sha256(b'token-recovery-v1\0'+secret).hexdigest()
+
+class TokenDelivery:
+    def __init__(self, *, metadata: MetadataStore, token_secret: bytes,
+                 clock: Callable[[], datetime], recovery_window: Callable[[], int]):
+        require(len(token_secret)==32,'invalid_service_key')
+        self.metadata=metadata
+        self._token_secret=token_secret
+        self.clock=clock
+        self.recovery_window=recovery_window
+
+    def issued_token(self,request,subject):
+        # Nonces are high-entropy claims, not random tokens persisted in results.
+        return hmac.digest(self._token_secret,b'issued-token-v1\0'+canonical({
+            'subject':subject,'request_id':request.request_id,'nonce':request.arguments['nonce']}),'sha256')
+
+    recovery_verifier=staticmethod(recovery_verifier)
+
+    def record_token_delivery(self,tx,request,credential,now,*,recovery_deadline=None):
+        """Bind recovery before commit; neither token nor recovery secret is stored."""
+        require(request.operation in SECRET_DELIVERY_MIN_VERSION and
+                request.contract_version>=SECRET_DELIVERY_MIN_VERSION[request.operation],
+                'credential_delivery_upgrade_required')
+        field='new_recovery_secret' if request.operation=='identity.token_recover' else 'recovery_secret'
+        secret=unb64(request.arguments[field],limit=64)
+        require(secret!=unb64(request.arguments['nonce'],limit=64),'recovery_secret_not_independent')
+        if request.operation=='identity.token_recover':
+            require(secret!=unb64(request.arguments['recovery_secret'],limit=64),
+                    'recovery_secret_not_independent')
+        expires=min(credential.expires_at,
+                    recovery_deadline if recovery_deadline is not None else
+                    now+timedelta(seconds=self.recovery_window()))
+        require(expires>now,'recovery_unavailable')
+        tx.execute('''INSERT INTO token_deliveries
+            (credential_id,subject,request_id,request_digest,recovery_verifier,recovery_expires_at,
+             claimed_at,consumed_at) VALUES (?,?,?,?,?,?,NULL,NULL)''',
+            (credential.id,credential.subject_id,request.request_id,request.payload_digest,
+             self.recovery_verifier(request.arguments[field]),wire(expires)),write=True)
+
+    async def release(self,request,result):
+        if result.status!='ok' or request.operation not in SECRET_DELIVERY_MIN_VERSION:
+            return result
+        require(request.contract_version>=SECRET_DELIVERY_MIN_VERSION[request.operation],
+                'credential_delivery_upgrade_required')
+        token=self.issued_token(request,result.subject)
+        async with self.metadata.transaction(write=True) as tx:
+            credential=await tx.credential(result.data['credential_id'])
+            require(credential.revoked_at is None and credential.expires_at>self.clock(),'credential_expired')
+            require(hmac.compare_digest(credential.verifier,hashlib.sha256(token).digest()),'invalid_token_result')
+            row=tx.one('''SELECT subject,request_id,request_digest,claimed_at,consumed_at
+                FROM token_deliveries WHERE credential_id=?''',(credential.id,))
+            require(row is not None and row[0]==result.subject and row[1]==request.request_id
+                    and row[2]==request.payload_digest and row[4] is None,'token_delivery_unavailable',
+                    details={'committed_result':wire(result,compact=True)})
+            require(row[3] is None,'token_delivery_unavailable',
+                    details={'committed_result':wire(result,compact=True)})
+            updated=tx.execute('''UPDATE token_deliveries SET claimed_at=? WHERE credential_id=?
+                AND claimed_at IS NULL AND consumed_at IS NULL''',
+                (wire(self.clock()),credential.id),write=True)
+            require(updated.rowcount==1,'token_delivery_unavailable',
+                    details={'committed_result':wire(result,compact=True)})
+        # The claim commits before the adapter sees the token. A dropped response
+        # must use a separate, pre-bound recovery secret to rotate the credential.
+        return replace(result,data=dict(result.data,token=b64(token)))