mesh: a cut journal is caught by the receipts the steward handed out, and the receipt chain survives a restart #306

Merged

dcharlot merged 1 commit from feat/mesh-journal-witness into main 2026-10-18 00:42:33 -04:00

Conversation 0 Commits 1 Files changed 4 +341 -72

2026-10-17

Transaction Science

mesh: a cut journal is caught by the receipts the steward handed out, and the receipt chain survives a restart ...

After #301 the journal re-established spend on restart, but nothing could
tell whether records had been cut from its end. Removing a serve's
records restored the grant's spend and unspent its presentation, so the
captured presentation could be replayed. Separately, a restarted steward
began a new receipt chain at sequence 0.

- The journal is one chain of records `{seq, prev, entry}`, `prev` being
  the BLAKE3 hash of the previous record's encoding. A record removed from
  the middle, edited or moved fails the replay. Only a cut from the end
  leaves a whole chain.
- Every receipt, granted or not, gets a `Sealed` record (its sequence and
  envelope id), written before the receipt is handed out.
  `ReceiptLog::seal_next` / `advance` split sealing from advancing, so a
  receipt that cannot be recorded is not handed out and the chain does not
  pass it.
- On restart the receipt chain continues from the last `Sealed` record
  (`ReceiptLog::resume`) instead of starting over at 0.
- `Mesh::witness(receipt, envelope)`: anyone holding a receipt the
  steward sealed can show it. If the journal does not hold that receipt,
  records were cut after it left, so the steward returns `JournalCut` and
  refuses every grant from then on. A witness that is not the steward's
  own unaltered receipt is `WitnessInvalid`.
- SPEC §2.2, §6.3, §7 and §8 describe it. That includes what remains:
  a cut that removes only an in-flight serve, which produced no receipt,
  leaves no evidence outside the steward.

Checked on the build host:
- mesh-rs: 77 tests pass, four of them new. They cover a receipt proving
  a cut, chain continuity across a restart, a record removed from the
  middle or edited, and a foreign or altered witness. The existing journal
  tests now count seal records.
- Every `mesh/1` vector is byte-identical, every Cargo.lock is current,
  and clippy is clean.
- Mutations each fail tests: a witness that always passes, a detected cut
  that is ignored, seals not recorded, no chain check, and a chain not
  resumed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

29ee437557

• View at this point in history

2026-10-17 17:13:58 -04:00