76b55fc4d2
The group-work layer: everything an orchestrator, a team of workers, or a pair of partnering agents needs, enforced by the same deterministic runtime. - Delegation control (SPEC §4.4): grants carry delegate_depth — absent = unlimited, 0 = leaf-only. Depth narrows every hop (child = parent − 1); attenuate() refuses delegation of a leaf-only grant and verify_chain() refuses forged deepening. An orchestrator's workers cannot mint sub-workers. - Sharded budgets (SPEC §4.5): shard() splits a grant into siblings whose budgets MUST sum within the parent — one shard per enforcement point, each enforced locally. Distributed budget state with no consensus: conservation by mint-time arithmetic. Receipt-settled channels noted as OPTIONAL profile. - Identity continuity (SPEC §2.1): KERI-style pre-committed rotation. KeyEvent log where rotation N is signed by the NEW current key, which must hash to event N−1's next_hash. A thief holding the current key cannot rotate the identity away; an owner who lost it still can. Identity = inception DID, stable for life. Trust roots made normative: enforcement points are configured with the root issuers they honor (authorized_keys shape, no CA). - Threshold actors (SPEC §2.2): jcp-threshold (10th crate) — FROST (RFC 9591) k-of-n Ed25519. The group key is an ordinary did:key, so a 2-of-3 team issues, holds, delegates, and signs wire requests with nothing else in JCP changing. The two-agent rule for irreversible actions, refused by arithmetic, not policy. - Caller-signed wire (SPEC §11): WireRequest now carries the caller's Ed25519 signature over its canonical bytes; the endpoint authenticates from the request itself, denies impersonation bad-signature, and seals the refusal. A threshold aggregate signs the same field, indistinguishable on the wire. - Receipt stream as WAL + group accounting (SPEC §8.1–§8.2): extract() parses a verified envelope's signed core; replay_spend() + Runtime::restore() rebuild a crashed enforcement point's budget state from its own sealed output; aggregate() keys a team's receipts by (grant, subject) for per-worker cost attribution from evidence, counting (not skipping) receipts that fail verification. Conformance grows to C1–C14 (threshold caller over the wire, runtime restored from its own receipts, depth/shard/rotation invariants). SPEC bumped to v0.2.0 draft; published vectors unchanged byte-for-byte. 58 tests, clippy clean. Co-Authored-By: Claude Opus 4.8 <[email protected]>
23 lines
494 B
TOML
23 lines
494 B
TOML
[package]
|
|
name = "jcp-threshold"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
repository.workspace = true
|
|
rust-version.workspace = true
|
|
|
|
[dependencies]
|
|
jcp-schema = { workspace = true }
|
|
frost-ed25519 = "2"
|
|
rand_core = "0.6"
|
|
thiserror = { workspace = true }
|
|
|
|
[dev-dependencies]
|
|
jcp-grant = { workspace = true }
|
|
jcp-wire = { path = "../jcp-wire" }
|
|
jcp-runtime = { workspace = true }
|
|
ed25519-dalek = { workspace = true }
|
|
rand_chacha = "0.3"
|
|
|
|
[lints]
|
|
workspace = true
|