Draft 0.5: identity/registry spec; Phase A signed MA registry, mailbox challenge auth, key rotation, skew rejection

rfc.txt

@@ -1,6 +1,6 @@
 FRX — Federated Retrieval Exchange
 
-Status: Draft 0.4. Experimental. Reference implementation: frxd (Rust).
+Status: Draft 0.5. Experimental. Reference implementation: frxd (Rust).
 
 1. Summary
 
@@ -9,7 +9,7 @@ FRX is a membership federation for retrieval. Content owners answer broadcast qu
 2. Invariants
 
  I1 Ingress consent — content enters a member's index only via the publisher adding its own content or a user-supplied URL.
- I2 Local sovereignty — nothing centralizes a decision a member could make locally.
+ I2 Local judgment — decisions that consume local information (matching, relevance, sharing, retention) are made locally. Shared coordination (identity, admission, contract) is centralized in the MA, because common state is cheaper held once.
  I3 Broadcast privacy — broadcast payloads MUST NOT contain third-party private content. Queries derived from scoring others' posts MUST be canonicalized (claims/entities). First-party user-initiated search text MAY be sent as typed.
  I4 Channel separation — statements advise (aggregates), contracts govern (membership); never cross-wired. The protocol carries no pricing, metering, or settlement.
  I5 Role symmetry — no privileged roles. Any member may originate queries or responses; no peer may require remote work per incoming query (I7). Neither role is privileged.
@@ -33,7 +33,7 @@ Silence is conformant and informative: an unanswered query means no member's ava
 
 4. Messages
 
-Envelope (all messages): {type, from, ts, nonce, body, sig} — Ed25519, key listed in the member directory.
+Envelope (all messages): {type, from, key, ts, nonce, body, sig}. `from` is the sender's member identifier; `key` is the Ed25519 public key used to sign; `sig` covers the canonical form of the other fields (RFC 8785 JCS under a versioned prefix; bodies carry no floating-point numbers). A receiver verifies the signature under `key`, then verifies that `key` is authorized for `from` by the member registry (§6).
 
 query
 
@@ -65,21 +65,21 @@ There is no publish/announce message. Document metadata is carried in responses
 
 5. Local Policy Domains
 
-Protocol-silent by design (I2): ranking, ordering, presentation, relevance gating, reputation counters and throttles, verification/spot-checks, caching and invalidation, claim minting, mode (eager/lazy), external fallback, sharing policy above the I9 floor. Advisory reputation bureaus MAY exist; no member is bound.
+Protocol-silent by design (I2): ranking, ordering, presentation, relevance gating, reputation counters and throttles, verification/spot-checks, caching and invalidation, claim minting, external fallback, sharing policy above the I9 floor. Advisory reputation bureaus MAY exist; no member is bound.
 
 6. Membership
 
-The MA governs identity, contract, expulsion — who, never quality. Admission cost is the Sybil defense. Expulsion grounds: fabrication, admission fraud, sustained abuse — never low quality. Escalation: local throttle → advisory aggregates → MA warning → delisting → expulsion. Aggregates are inadmissible as sanction evidence (I4). Membership classes: source members (own content) and enrichment members (derived corpora, e.g. GDELT/CC-NEWS bots — metadata-only exposure, transformation logic open and auditable).
+The MA governs identity, contract, expulsion — who, never quality. Identifiers are MA-hosted FQDNs (`<label>.frx.<ma-domain>`); no member-controlled DNS is required. Member-hosted identifiers — keys published in the member's own domain and allowlisted by the MA — are planned, not yet normative. The MA maintains a signed, versioned registry snapshot listing identifiers, class, and authorized keys with validity windows. Nodes pin the MA key; the snapshot is the sole authority for the key→identifier binding. Rotation publishes a successor key before retiring its predecessor; revocation removes a key or shortens its validity. Registry outage is fail-static: the last validated snapshot stays in force, and open bootstrap requires an explicit development flag. Admission cost is the Sybil defense. Expulsion grounds: fabrication, admission fraud, sustained abuse — never low quality. Escalation: local throttle → advisory aggregates → MA warning → delisting → expulsion. Aggregates are inadmissible as sanction evidence (I4). Conduct not observable on the wire — link handling, retention, gating — is governed by contract; the protocol neither observes nor adjudicates it. Membership classes: source members (own content) and enrichment members (derived corpora, e.g. GDELT/CC-NEWS bots — metadata-only exposure, transformation logic open and auditable).
 
 7. Reference Implementation — frxd
 
 A single static Rust binary. Install, point at a directory, done. It is simultaneously: (a) a personal search engine over local files, (b) a conformant FRX member.
 
-First run: generate keypair, write config.toml, open localhost web UI (plus frx search CLI). Index target directories with Tantivy; watch for changes; extract text from txt/md/html (PDF optional). Nothing is shared until a collection is explicitly marked shared (I9).
+First run: generate keypair, join the MA registry (no domain or DNS required), write config.toml, open localhost web UI (plus frx search CLI). Index target directories with Tantivy; watch for changes; extract text from txt/md/html (PDF optional). Nothing is shared until a collection is explicitly marked shared (I9).
 
 As responder: subscribe to the live query stream via configured relays; match incoming queries against shared collections only (receiver-local lexical/embedding match); respond within budget with honest truncation; sign.
 
-As consumer: search is local-first; a network toggle broadcasts the query and merges responses, provenance-marked ("your files" / "member X"). Fetched content is retained (fetch-on-miss-and-retain): the kept-set converges to the demand-weighted corpus.
+As consumer: search is local-first; a network toggle broadcasts the query and merges responses, provenance-marked ("your files" / "member X").
 
 Dashboard: sent / passed per period (self-derived from local counters; aggregates requested from queriers on demand).
 
@@ -93,20 +93,22 @@ Query visibility is total among members; abstraction level and membership are th
 
 9. Conformance
 
-A conforming implementation: signs all messages with a listed member key; publishes queries to the firehose only; respects I3 and I9; respects max_results; truncates honestly; sends results without scores; enforces visible transport backpressure, never silent transport drops; serves aggregates on request at or above the granularity floor; ingests content only via publisher-added content or user-supplied URL; implements no dispute messages.
+A conforming implementation: signs all messages with a key authorized for its identifier in the member registry; publishes queries to the firehose only; respects I3 and I9; respects max_results; truncates honestly; sends results without scores; enforces visible transport backpressure, never silent transport drops; serves aggregates on request at or above the granularity floor; ingests content only via publisher-added content or user-supplied URL; implements no dispute messages.
 
 10. Open Issues
 
 Consumer admission tier — automated/invite admission for distributed binaries without weakening the Sybil defense (MA policy, gates §7 adoption).
 Relay discovery and default-relay governance (shipped defaults are soft centralization; mitigate with multiple defaults + one-command self-host).
 Delegation grant mechanism.
-Signature canonicalization scheme (blocks Phase-1 interop; required before two implementations can exchange a valid envelope).
+Member-hosted identifiers — keys published in the member's own DNS instead of the MA registry; MA-hosted is normative until specified.
+MA anchor rollover — successor commitment and overlap for the registry signing key.
+Unicast confidentiality — response and aggregate payloads are visible to relays; no end-to-end scheme is specified.
 Document lineage (revision/supersedes) and delegation without a supply stream — previously carried by publish; now unspecified.
 Claim/entity minting conventions — recommended, non-normative (I8).
 
 Appendix A. Recommended Local Practices (Non-Normative)
 
-Two-stage ingestion (cheap gate before any LLM attention); per-peer sent/passed counters, throttling on ratios; verdict memoization and claim normalization; demand-driven prefetch (fetch and retain on attention); hot-set replication; backfill seeding (Wikipedia/Wikidata, GDELT, CC-NEWS); measure query-to-claim collapse and domain concentration before sizing anything.
+Two-stage ingestion (cheap gate before any LLM attention); per-peer sent/passed counters, throttling on ratios; verdict memoization and claim normalization; hot-set replication; backfill seeding (Wikipedia/Wikidata, GDELT, CC-NEWS); measure query-to-claim collapse and domain concentration before sizing anything.
 
 Appendix B. Purge Log (Normative)