# `transport-moqt` — CommunicationOS transport binding (the last federation layer)

A consumer **binding** showing a Joule Code collaboration's committed coding
operations carried over **CommunicationOS's MoQT transport** — the network wire
layer left deferred by [`spec/collab.md`](../../spec/collab.md) §2.

It closes the loop on the federation stack. The other three layers are already
built and tested in [`joule-code-collab`](../../joule-code-rs/crates/joule-code-collab/):
BFT consensus (`LockstepCluster`), FROST threshold authorization (`protected`),
and MLS group keying (`tests/mls_keying.rs`). This example adds the transport.

## What it demonstrates

The whole stack, end to end, in one in-process test:

```
BFT consensus (LockstepCluster)  →  committed, op_id-ordered coding ops
   →  published as MoQT objects over CommunicationOS's transport (inv-moq)
   →  each object carries a real Ed25519 / BLAKE3 signed receipt
   →  a subscriber receives every op, verifies the signed receipts against the
      publisher's key, and recovers the original SignedOp intact
```

A second test shows the ownerless-trust property: a subscriber that requires
receipts rejects a group whose signed receipt does not chain to a trusted
publisher key — no central authority decides who is authentic.

## The transport

The carrier is **[`inv-moq`](../../../../joulesperbit/crates/inv-moq)** —
joulesperbit's MoQT (Media over QUIC Transport) wire protocol plus its JWP
receipt extension, the CommunicationOS broadcast-media transport. It exposes
`Publisher` / `Subscriber` / `GroupHandle` / `Relay` traits with object-level
signed provenance and joule receipts.

The test drives `inv-moq` through its **`MockFabric`**, which runs the real
publish/subscribe/receipt machinery in-process — real Ed25519 signatures, real
BLAKE3 merkle receipts — with **no QUIC and no network**. `inv-moq`'s `quic`
feature is the real-wire path (quinn/rustls); the trait surface is identical, so
this binding moves to the network by swapping the fabric, not the code.

This is a **standalone workspace** (path-deps `inv-moq` from joulesperbit and the
`joule-code-*` crates), so the standard's reference library stays free of a
joulesperbit dependency — the same discipline as [`examples/l3-jouleclaw`](../l3-jouleclaw).

## Run

```sh
cargo test
```

Expected:

```
test untrusted_publisher_is_rejected ... ok
test committed_ops_replicate_over_communicationos_moqt_with_signed_receipts ... ok
```