Signup without a code queues a pending application; registry approve issues credentials

.gitignore

@@ -1,3 +1,4 @@
 /target
 /frx-data/
 /comments.txt
+/relay.log

AGENTS.md

@@ -32,7 +32,7 @@
 - Relay backpressure is global: any member's full queue 429s every publisher until drained (visible per §3, but one lagging member can stall the firehose — revisit before scale).
 - Member authority (Draft 0.5 §6): the MA-signed registry snapshot is authoritative when configured (`[node] registry` = file path or URL, `ma_key` pinned; monotonic version — rollback and forgery close the node; file path is mtime-reloaded, URL is fetched at start + every 60s and cached to `<data_dir>/registry-cache.json`, so outage fails static). Keys carry optional validity windows (`not_before`/`not_after`); rotation = `registry add-key` then `revoke-key`.
 - `<data_dir>/members.toml` (name, pubkey, class, `previous` keys, mtime-reloaded) is a dev/local fallback used only when no registry is configured; empty directory without a registry is open bootstrap only when `dev_bootstrap = true` (RFC §6: explicit dev flag). Receivers drop content-bearing responses from enrichment-class senders (metadata-only, §6).
-- MA tooling: `frxd registry init|add|add-key|revoke-key|remove|list|set-relays|show|serve` (signed `registry.json` + `ma-key.hex` in `--dir`); `frxd init --id/--registry/--ma-key`; `frxd key show|rotate`; `member add --previous <old>` for the fallback path. A node with no `[node] relays` discovers them from the registry snapshot (`doc.relays`).
+- MA tooling: `frxd registry init|add|add-key|revoke-key|remove|list|applications|set-relays|show|serve` (signed `registry.json` + `ma-key.hex` in `--dir`); `frxd init --id/--registry/--ma-key`; `frxd key show|rotate`; `member add --previous <old>` for the fallback path. A node with no `[node] relays` discovers them from the registry snapshot (`doc.relays`).
 - Aggregate semantics are our implementation choices from a terse spec: requests are `aggregate` envelopes carrying only `period`; replies carry `sent` (broadcasts that month) / `passed` (responses consumed from that member); granularity floor is enforced as YYYY or YYYY-MM only (finer rejected), yearly rolls up months. Revisit with §10 sufficiency review.
 
 ## Known gaps (Phase 2/3, intentional — don't fake them)
@@ -50,6 +50,6 @@
 - Roles are not exclusive: a single node may issue queries and answer them concurrently (I5, §3 "any member"). Implement querier/responder as independent enable flags — never an exclusive mode enum or fixed deployment role.
 - Matching floor: boundary tokenizer (`src/tokenizer.rs` — letter/digit splits so `5555` matches `DLEX5555`, lowercase, ASCII fold, English stopwords+stemmer) → coverage gate (`[match] min_coverage`, default 0.4; 1–2 term queries require all terms) → title boost 2.0 + phrase boost 3.0 + query-time snippets. Schema changes require a fresh index dir (`open_or_create` errors on mismatch).
 - Engine seam: `src/engine.rs` `SearchEngine` trait (`search` → `EngineOutput { hits, total: Option<u64> }`, `doc_count`); `respond()` in `src/node.rs` is the conformance wrapper (budget clamp, truncation from engine total — unknown total forces `truncated = true`). Power users can implement the trait (HTTP adapter or subprocess to an external engine).
-- Onboarding: `frxd --onboarding` runs a wizard consuming a credential block (`id=.. token=.. registry=.. ma_key=..`) issued by the MA's signup endpoint (`registry serve --signup-code --registry-url`; HTML page at `/`, `POST /v1/signup` → one-time invite token, `POST /v1/enroll` binds keys and re-signs). Identity registration stays MA-side; the wizard never creates identities, only binds locally generated keys. Invites live in `<registry dir>/invites.json`. Prompts accept empty input as the default; scripted stdin works for tests.
+- Onboarding: `frxd --onboarding` runs a wizard consuming a credential block (`id=.. token=.. registry=.. ma_key=..`) issued by the MA's signup endpoint (`registry serve --signup-code --registry-url`; HTML page at `/`, `POST /v1/signup` → one-time invite token, `POST /v1/enroll` binds keys and re-signs). Identity registration stays MA-side; the wizard never creates identities, only binds locally generated keys. Signup without a code queues a pending application (`<registry dir>/applications.json`, mode 600, MA contract data — never in the signed snapshot); `frxd registry approve <id>` promotes it (member stub + invite + credential block). A valid `--signup-code` approves immediately. Invites live in `<registry dir>/invites.json`. Prompts accept empty input as the default; scripted stdin works for tests.
 - Next matching steps: eval harness with a small golden set (precision@k + false-silence rate), then a dense recall leg (model2vec-rs 0.2.1 exists but needs `default-features = false, features = ["fancy-regex", "local-only"]` for musl/airgapped; verify crate + model licenses before bundling), then an optional cross-encoder reranker. Embeddings are for recall; reranking is the precision tier.
 - Identity/registry (RFC Draft 0.5 §4/§6): MA-hosted FQDN identifiers first (`<label>.frx.<ma-domain>`, no DNS needed by users), signed versioned registry snapshot with the MA key pinned; envelope `from` = identifier, `key` = pubkey; registry outage fails static. Member-hosted identities, MA anchor rollover, and unicast confidentiality are §10 open. Implementation phases: A (signed registry snapshot) and B (identifier + `key` + JCS on the wire) are built and tested. Prioritize frictionless onboarding (users may be department-level and cannot create DNS).

DEPLOY.md

@@ -29,7 +29,7 @@ frxd registry --dir ./ma init --zone frx.federatedsearch.org
 frxd registry --dir ./ma serve --listen 127.0.0.1:7800 --signup-code <code> --registry-url https://ma.federatedsearch.org/registry.json
 ```
 
-(put Caddy in front for a real domain). The page at `/` accepts a label and the signup code and returns a credential block: `id=... token=... registry=... ma_key=...`.
+(put Caddy in front for a real domain). The page at `/` collects the registration form (short name, organization details, optional pre-approval code). Without a code the application queues for MA review — `frxd registry --dir <dir> applications` lists it and `frxd registry --dir <dir> approve <id> --registry-url <url>` issues the member, the invite, and the credential block to hand over; a valid code approves immediately and shows the block on the page. The block is `id=... token=... registry=... ma_key=...`. Organization details (legal name, representative, contacts, payment) are recorded privately by the MA in `<registry dir>/applications.json` — contract data, never in the public signed snapshot.
 
 New member:
 
@@ -47,7 +47,7 @@ Run `frxd` on loopback and terminate TLS with Caddy:
 caddy reverse-proxy --from relay.federatedsearch.org --to 127.0.0.1:7700
 ```
 
-Caddyfile equivalent (apex is the public front door, `ma.` the membership service, `relay.` the relay — all on one host):
+Caddyfile equivalent (apex is the public front door, `ma.` the membership service, `relay.` the relay, `git.` the code host — all on one host):
 
 ```
 federatedsearch.org {
@@ -61,6 +61,10 @@ ma.federatedsearch.org {
 relay.federatedsearch.org {
     reverse_proxy 127.0.0.1:7700
 }
+
+git.federatedsearch.org {
+    reverse_proxy 127.0.0.1:3000
+}
 ```
 
 Relay command (peers and registry gated by the MA):
@@ -112,6 +116,77 @@ frxd registry --dir /var/lib/frxd/registry serve --listen 127.0.0.1:7800
 
 Put the same Caddy in front, or distribute `registry.json` out of band (it is signed, so the channel does not matter). The snapshot is versioned; nodes reject rollback and fail static during outages.
 
+## Code hosting and downloads (Gitea)
+
+The public source and release binaries live at `git.federatedsearch.org` (Gitea), so the
+download step on the membership page stays on infrastructure the federation operates.
+
+One-time install on the server (root):
+
+```
+VER=1.27.3
+curl -fsSLO https://dl.gitea.com/gitea/$VER/gitea-$VER-linux-amd64{,.sha256}
+sha256sum -c gitea-$VER-linux-amd64.sha256
+install -m 0755 gitea-$VER-linux-amd64 /usr/local/bin/gitea
+adduser --system --shell /bin/bash --gecos 'Gitea' --home /home/git --group git
+mkdir -p /var/lib/gitea/{custom,data,log} /etc/gitea && chown -R git:git /var/lib/gitea /etc/gitea
+```
+
+`/etc/gitea/app.ini` essentials (rest defaults; secrets via `gitea generate secret`):
+
+```ini
+WORK_PATH = /var/lib/gitea
+
+[database]
+DB_TYPE = sqlite3
+PATH = /var/lib/gitea/data/gitea.db
+
+[server]
+DOMAIN = git.federatedsearch.org
+SSH_DOMAIN = git.federatedsearch.org
+ROOT_URL = https://git.federatedsearch.org/
+HTTP_ADDR = 127.0.0.1
+HTTP_PORT = 3000
+
+[security]
+INSTALL_LOCK = true
+
+[service]
+DISABLE_REGISTRATION = true
+REQUIRE_SIGNIN_VIEW = false
+```
+
+systemd unit (`User=git`, `ExecStart=/usr/local/bin/gitea web --config /etc/gitea/app.ini`,
+`WorkingDirectory=/var/lib/gitea`), then `gitea migrate --config /etc/gitea/app.ini` as the
+`git` user and `systemctl enable --now gitea`. Git-over-SSH uses the host sshd via the `git`
+user's Gitea-managed `authorized_keys`; HTTPS pushes can use an access token instead.
+
+Admin bootstrap (as `git` user):
+
+```
+gitea admin user create --admin --username <you> --email <you>@federatedsearch.org --random-password --config /etc/gitea/app.ini
+gitea admin user generate-access-token -u <you> -t bootstrap --scopes all --config /etc/gitea/app.ini
+```
+
+The org is `frx`, the repo `frxd` → clone URL
+`https://git.federatedsearch.org/frx/frxd.git`. Membership stays closed (signup code);
+repo reads are public.
+
+Publishing a release (from the checkout):
+
+```
+git tag v0.1.0 && git push gitea v0.1.0
+# build static binaries (see next section), then attach via the API:
+curl -X POST https://git.federatedsearch.org/api/v1/repos/frx/frxd/releases \
+  -H "Authorization: token <token>" -H 'content-type: application/json' \
+  -d '{"tag_name":"v0.1.0","name":"v0.1.0"}'
+curl -X POST https://git.federatedsearch.org/api/v1/repos/frx/frxd/releases/<id>/assets?name=frxd-linux-amd64 \
+  -H "Authorization: token <token>" -F attachment=@frxd-linux-amd64
+```
+
+Asset URLs follow `/frx/frxd/releases/download/<tag>/<file>` — the membership page pins
+those. Bump the page when a release changes.
+
 ## Private networks and custom CAs
 
 - `ca_cert = "/etc/ssl/private-ca.pem"` in `[node]`, or `--ca-cert` on the relay: adds a private/corporate root CA for relay and registry connections.
@@ -125,7 +200,15 @@ rustup target add x86_64-unknown-linux-musl
 cargo build --release --target x86_64-unknown-linux-musl
 ```
 
-`[profile.release]` enables LTO and stripping. All dependencies are pure Rust, so the musl build has no system-library requirements.
+`[profile.release]` enables LTO and stripping. All dependencies are pure Rust, so the musl build has no system-library requirements. `ring` needs a musl C toolchain (`musl-tools`); without host sudo, build in a container instead:
+
+```
+docker run --rm -v "$PWD":/src -w /src rust:1-slim-bookworm bash -c \
+  "apt-get update -qq && apt-get install -y -qq musl-tools && rustup target add x86_64-unknown-linux-musl && cargo build --release --target x86_64-unknown-linux-musl"
+```
+
+Binaries land in `target/x86_64-unknown-linux-musl/release/`; rename to
+`frxd-linux-amd64` / `frx-linux-amd64` for release assets, with `sha256sum` sidecar files.
 
 ## What TLS does and does not cover
 

src/commands.rs

@@ -424,6 +424,66 @@ pub fn registry_list(dir: &Path) -> Result<()> {
     Ok(())
 }
 
+pub fn registry_applications(dir: &Path) -> Result<()> {
+    let applications = registry::load_applications(&registry::applications_path(dir))?;
+    if applications.is_empty() {
+        println!("no applications recorded");
+        return Ok(());
+    }
+    for app in &applications {
+        println!("{} [{}] {} <{}> — {}", app.id, app.class, app.org, app.email, app.status);
+        println!("    representative: {}", app.representative);
+        if !app.address.is_empty() {
+            println!("    address: {}", app.address);
+        }
+        if !app.domain.is_empty() {
+            println!("    domain: {}", app.domain);
+        }
+        if !app.payment.is_empty() {
+            println!("    payment: {}", app.payment);
+        }
+        if !app.privacy_link.is_empty() {
+            println!("    privacy: {}", app.privacy_link);
+        }
+    }
+    Ok(())
+}
+
+/// Approves a pending application: creates the member stub (class from the application),
+/// issues a 24h invite, and prints the credential block to hand to the member.
+pub fn registry_approve(dir: &Path, id: &str, registry_url: Option<&str>) -> Result<()> {
+    let (_, signed) = open_registry(dir)?;
+    if signed.doc.members.iter().any(|member| member.id == id) {
+        return Err(anyhow!("member {id} already listed"));
+    }
+    let application = registry::approve_application(dir, id)?;
+    let class = if application.class == CLASS_ENRICHMENT {
+        CLASS_ENRICHMENT
+    } else {
+        CLASS_SOURCE
+    }
+    .to_string();
+    mutate_registry(dir, |doc| {
+        doc.members.push(RegistryMember {
+            id: id.to_string(),
+            class: class.clone(),
+            keys: Vec::new(),
+            enc_key: None,
+        });
+        Ok(())
+    })?;
+    let invite = registry::create_invite(dir, id, 24 * 3600)?;
+    let (_, signed) = open_registry(dir)?;
+    let registry_url = registry_url.unwrap_or("<registry-url>");
+    println!("approved {id} ({class})");
+    println!("hand this credential block to the member:");
+    println!(
+        "id={id} token={} registry={registry_url} ma_key={}",
+        invite.token, signed.doc.ma_key
+    );
+    Ok(())
+}
+
 pub fn registry_set_relays(dir: &Path, relays: &[String]) -> Result<()> {
     mutate_registry(dir, |doc| {
         doc.relays = relays.to_vec();
@@ -519,26 +579,32 @@ fn sanitize_label(input: &str) -> String {
 struct SignupRequest {
     label: String,
     code: Option<String>,
+    #[serde(default)]
+    org: String,
+    #[serde(default)]
+    representative: String,
+    #[serde(default)]
+    email: String,
+    #[serde(default)]
+    address: String,
+    #[serde(default)]
+    domain: String,
+    #[serde(default)]
+    class: Option<String>,
+    #[serde(default)]
+    payment: String,
+    #[serde(default)]
+    privacy_link: String,
+    #[serde(default)]
+    attestation: bool,
+    #[serde(default)]
+    privacy_ack: bool,
 }
 
 async fn registry_signup(
     State(server): State<std::sync::Arc<RegistryServer>>,
     Json(request): Json<SignupRequest>,
 ) -> Response {
-    let Some(expected) = &server.signup_code else {
-        return (
-            StatusCode::FORBIDDEN,
-            Json(serde_json::json!({ "error": "signup is not enabled" })),
-        )
-            .into_response();
-    };
-    if request.code.as_deref() != Some(expected.as_str()) {
-        return (
-            StatusCode::FORBIDDEN,
-            Json(serde_json::json!({ "error": "wrong signup code" })),
-        )
-            .into_response();
-    }
     let label = sanitize_label(&request.label);
     if label.is_empty() {
         return (
@@ -547,6 +613,52 @@ async fn registry_signup(
         )
             .into_response();
     }
+    // A pre-approval code, if supplied, must be valid; an empty code queues for review.
+    let code = request
+        .code
+        .as_deref()
+        .map(str::trim)
+        .filter(|code| !code.is_empty());
+    if let Some(code) = code {
+        let Some(expected) = &server.signup_code else {
+            return (
+                StatusCode::FORBIDDEN,
+                Json(serde_json::json!({ "error": "no pre-approval code is configured; submit without one to queue for review" })),
+            )
+                .into_response();
+        };
+        if code != expected.as_str() {
+            return (
+                StatusCode::FORBIDDEN,
+                Json(serde_json::json!({ "error": "wrong signup code" })),
+            )
+                .into_response();
+        }
+    }
+    if !request.attestation {
+        return (
+            StatusCode::BAD_REQUEST,
+            Json(serde_json::json!({ "error": "content authorization must be confirmed" })),
+        )
+            .into_response();
+    }
+    if !request.privacy_ack {
+        return (
+            StatusCode::BAD_REQUEST,
+            Json(serde_json::json!({ "error": "the privacy notice must be acknowledged" })),
+        )
+            .into_response();
+    }
+    if request.org.trim().is_empty()
+        || request.representative.trim().is_empty()
+        || request.email.trim().is_empty()
+    {
+        return (
+            StatusCode::BAD_REQUEST,
+            Json(serde_json::json!({ "error": "organization name, representative, and contact email are required" })),
+        )
+            .into_response();
+    }
     let signed = match registry::load_registry(&registry_doc_path(&server.dir)) {
         Ok(signed) => signed,
         Err(error) => {
@@ -566,6 +678,71 @@ async fn registry_signup(
         )
             .into_response();
     }
+    let applications = match registry::load_applications(&registry::applications_path(&server.dir))
+    {
+        Ok(applications) => applications,
+        Err(error) => {
+            return (
+                StatusCode::INTERNAL_SERVER_ERROR,
+                Json(serde_json::json!({ "error": error.to_string() })),
+            )
+                .into_response();
+        }
+    };
+    if applications.iter().any(|application| application.id == id) {
+        return (
+            StatusCode::CONFLICT,
+            Json(serde_json::json!({ "error": "an application for this identifier is already on file" })),
+        )
+            .into_response();
+    }
+    let class = if request.class.as_deref() == Some(CLASS_ENRICHMENT) {
+        CLASS_ENRICHMENT
+    } else {
+        CLASS_SOURCE
+    };
+    let application = registry::Application {
+        id: id.clone(),
+        org: request.org.clone(),
+        representative: request.representative.clone(),
+        email: request.email.clone(),
+        address: request.address.clone(),
+        domain: request.domain.clone(),
+        class: class.to_string(),
+        payment: request.payment.clone(),
+        privacy_link: request.privacy_link.clone(),
+        status: if code.is_some() {
+            "approved".to_string()
+        } else {
+            "pending".to_string()
+        },
+        submitted_at: now_ts(),
+    };
+    if code.is_none() {
+        if let Err(error) = registry::record_application(&server.dir, application) {
+            return (
+                StatusCode::INTERNAL_SERVER_ERROR,
+                Json(serde_json::json!({ "error": error.to_string() })),
+            )
+                .into_response();
+        }
+        return (
+            StatusCode::ACCEPTED,
+            Json(serde_json::json!({
+                "status": "pending",
+                "id": id,
+                "message": "application received — the membership authority reviews it and issues your credential block"
+            })),
+        )
+            .into_response();
+    }
+    if let Err(error) = registry::record_application(&server.dir, application) {
+        return (
+            StatusCode::INTERNAL_SERVER_ERROR,
+            Json(serde_json::json!({ "error": error.to_string() })),
+        )
+            .into_response();
+    }
     let invite = match registry::create_invite(&server.dir, &id, 24 * 3600) {
         Ok(invite) => invite,
         Err(error) => {
@@ -579,7 +756,7 @@ async fn registry_signup(
     if let Err(error) = mutate_registry(&server.dir, |doc| {
         doc.members.push(RegistryMember {
             id: id.clone(),
-            class: crate::config::CLASS_SOURCE.to_string(),
+            class: class.to_string(),
             keys: Vec::new(),
             enc_key: None,
         });
@@ -707,14 +884,19 @@ const REGISTRY_PAGE: &str = r##"<!doctype html>
   .tag { color: #555; margin-top: 0; }
   .card { background: #fff; border: 1px solid #ddd; border-radius: 10px; padding: 1.1rem 1.25rem; }
   code, pre { font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; font-size: 0.92em; }
-  input, button { font: inherit; border: 1px solid #bbb; border-radius: 6px; padding: 0.45rem 0.6rem; }
-  input { width: 100%; margin: 0.2rem 0 0.9rem; }
+  input, select, button { font: inherit; border: 1px solid #bbb; border-radius: 6px; padding: 0.45rem 0.6rem; }
+  input, select { width: 100%; margin: 0.2rem 0 0.9rem; }
+  .check { display: block; font-size: 0.92rem; margin: 0.5rem 0; }
+  .check input { width: auto; margin: 0 0.4rem 0 0; }
   button { background: #174ea6; color: #fff; border: none; cursor: pointer; padding: 0.5rem 1rem; border-radius: 6px; }
   button:hover { background: #0f3d91; }
   #out { display: none; background: #101418; color: #d6f5d6; padding: 0.85rem 1rem;
          border-radius: 8px; white-space: pre-wrap; word-break: break-all; margin-top: 1rem; }
+  pre.cmd { background: #101418; color: #d6f5d6; padding: 0.85rem 1rem;
+            border-radius: 8px; overflow-x: auto; }
   .muted { color: #666; font-size: 0.92rem; }
   ol { padding-left: 1.3rem; }
+  li { margin: 0.35rem 0; }
   a { color: #174ea6; }
 </style>
 </head>
@@ -726,24 +908,85 @@ small: signed messages, budgets, honest truncation, aggregate courtesy. No annou
 scores on the wire, no in-protocol payment.</p>
 <p>Everything else — matching, ranking, retention, trust — is local.</p>
 
-<h2>Join the federation</h2>
+<h2>1. Register with the membership authority</h2>
 <div class="card">
+<p class="muted">This form requests membership from the membership authority (MA). The MA reviews
+your organization details and issues a credential block
+(<code>id=... token=... registry=... ma_key=...</code>); the onboarding wizard in step 4 then
+binds your node's keys to the identifier. The public registry publishes only your identifier,
+class, keys, and the federation's relays. The organization details below are kept privately by
+the MA for the membership contract — never published, never on the wire.</p>
 <form id="f">
-<label>Organization or handle<br>
-<input name="label" required pattern="[A-Za-z0-9 -]+" placeholder="acme-docs"></label><br>
-<label>Signup code (issued by the membership authority)<br>
-<input name="code" type="password" placeholder="signup code"></label><br>
+<label>Short name — this becomes your identifier<br>
+<input name="label" id="label" required pattern="[A-Za-z0-9 -]+" placeholder="keswick-research"></label>
+<p class="muted">identifier: <code id="preview">(type a short name)</code> — no domain or DNS of your own is needed.</p>
+<label>Signup code (optional)<br>
+<input name="code" type="password" placeholder="pre-approval code"></label>
+<p class="muted">Leave empty to queue your application for MA review — the MA will contact you
+with your credential block. A pre-approval code, issued by the MA out of band, approves you
+immediately and returns the block here.</p>
+<label>Legal organization name<br>
+<input name="org" required placeholder="Keswick Research LLC"></label>
+<label>Representative (authorized contact person)<br>
+<input name="representative" required placeholder="Jane Keswick"></label>
+<label>Contact email<br>
+<input name="email" type="email" required placeholder="ops@example.org"></label>
+<label>Registered address<br>
+<input name="address" placeholder="street, city, country"></label>
+<label>Organization domain (optional)<br>
+<input name="domain" placeholder="example.org"></label>
+<label>What you will share<br>
+<select name="member_class">
+<option value="source">Source member — content I own or host</option>
+<option value="enrichment">Enrichment member — derived corpora (metadata-only)</option>
+</select></label>
+<label>Payment details (billing / payout — e.g. IBAN or payment handle)<br>
+<input name="payment" placeholder="kept private; the protocol itself carries no payment"></label>
+<label>Your privacy statement URL (optional)<br>
+<input name="privacy_link" placeholder="https://example.org/privacy"></label>
+<label class="check"><input type="checkbox" name="attestation" required> I will only index content I own or that users supply, and only collections I explicitly mark shared will answer queries.</label>
+<label class="check"><input type="checkbox" name="privacy_ack" required> I acknowledge the privacy notice above.</label>
 <button type="submit">Request membership</button>
 </form>
 <pre id="out"></pre>
 </div>
 
-<h2>After you get credentials</h2>
+<h2>2. Download</h2>
+<div class="card">
+<p>Static Linux x86_64 binaries (musl — no runtime dependencies):</p>
+<pre class="cmd">curl -LO https://git.federatedsearch.org/frx/frxd/releases/download/v0.1.2/frxd-linux-amd64
+curl -LO https://git.federatedsearch.org/frx/frxd/releases/download/v0.1.2/frxd-linux-amd64.sha256
+curl -LO https://git.federatedsearch.org/frx/frxd/releases/download/v0.1.2/frx-linux-amd64
+curl -LO https://git.federatedsearch.org/frx/frxd/releases/download/v0.1.2/frx-linux-amd64.sha256</pre>
+<p class="muted">All releases: <a href="https://git.federatedsearch.org/frx/frxd/releases">git.federatedsearch.org/frx/frxd/releases</a>.
+Source and spec (<code>rfc.txt</code>): <a href="https://git.federatedsearch.org/frx/frxd">git.federatedsearch.org/frx/frxd</a>.</p>
+</div>
+
+<h2>3. Install</h2>
+<div class="card">
+<pre class="cmd">sha256sum -c frxd-linux-amd64.sha256
+chmod +x frxd-linux-amd64 frx-linux-amd64
+sudo mv frxd-linux-amd64 /usr/local/bin/frxd
+sudo mv frx-linux-amd64 /usr/local/bin/frx</pre>
+<p class="muted">No sudo? Run them in place — each is a single self-contained binary.</p>
+</div>
+
+<h2>4. Onboard</h2>
+<div class="card">
+<pre class="cmd">frxd --onboarding</pre>
 <ol>
-<li>Install the single static binary: <code>frxd</code>.</li>
-<li>Run <code>frxd --onboarding</code> and paste the credential block it gives you.</li>
-<li>The wizard binds your keys, verifies the signed registry, and wires your relays — no domains, DNS, or ports needed on your side.</li>
+<li>Paste the credential block from step 1.</li>
+<li>The wizard generates your keys, enrolls them with the MA, verifies the signed registry
+against the pinned MA key, and wires the federation relays — no domains, DNS, or open ports
+needed on your side.</li>
+<li>Index a directory and mark what you share:</li>
 </ol>
+<pre class="cmd">frxd add ~/documents --name docs --shared --exposure metadata
+frxd serve</pre>
+<p class="muted">Search local-first with <code>frx search "..."</code>; broadcast to the federation with
+<code>frx query "..."</code>. Nothing is shared until a collection is explicitly marked
+<code>--shared</code>.</p>
+</div>
 
 <h2>Who is in</h2>
 <p class="muted" id="members">…</p>
@@ -751,25 +994,51 @@ scores on the wire, no in-protocol payment.</p>
 
 <script>
 const out = document.getElementById("out");
-document.getElementById("f").onsubmit = async (e) => {
+const f = document.getElementById("f");
+let zone = "frx.federatedsearch.org";
+function sanitizeLabel(v) {
+  let label = "", lastDash = true;
+  for (const c of v.toLowerCase()) {
+    if (/[a-z0-9]/.test(c)) { label += c; lastDash = false; }
+    else if (!lastDash && (/\s/.test(c) || c === "-" || c === "_" || c === ".")) { label += "-"; lastDash = true; }
+    if (label.length >= 32) break;
+  }
+  return label.replace(/^-+|-+$/g, "").slice(0, 32);
+}
+const preview = document.getElementById("preview");
+const updatePreview = () => {
+  const label = sanitizeLabel(f.label.value);
+  preview.textContent = label ? label + "." + zone : "(type a short name)";
+};
+f.label.addEventListener("input", updatePreview);
+f.onsubmit = async (e) => {
   e.preventDefault();
-  const label = e.target.label.value, code = e.target.code.value;
   const res = await fetch("/v1/signup", {
     method: "POST",
     headers: {"content-type": "application/json"},
-    body: JSON.stringify({label, code})
+    body: JSON.stringify({
+      label: f.label.value, code: f.code.value,
+      org: f.org.value, representative: f.representative.value, email: f.email.value,
+      address: f.address.value, domain: f.domain.value, class: f.member_class.value,
+      payment: f.payment.value, privacy_link: f.privacy_link.value,
+      attestation: f.attestation.checked, privacy_ack: f.privacy_ack.checked
+    })
   });
   const body = await res.json();
   out.style.display = "block";
-  out.textContent = res.ok
-    ? "Membership approved.\n\nRun `frxd --onboarding` and paste this block:\n\n" + body.credentials + "\n"
-    : "Failed: " + (body.error || ("http " + res.status));
+  out.textContent = body.credentials
+    ? "Membership approved.\n\nNext: download frxd (step 2), install it (step 3), then run `frxd --onboarding` and paste this block:\n\n" + body.credentials + "\n"
+    : res.ok
+      ? "Application received.\n\n" + (body.message || "The membership authority will review it and issue your credential block.")
+      : "Failed: " + (body.error || ("http " + res.status));
 };
 
 (async () => {
   try {
     const res = await fetch("/registry.json");
     const doc = await res.json();
+    zone = doc.zone || zone;
+    updatePreview();
     const ids = doc.members.map((m) => m.id);
     document.getElementById("members").textContent = doc.members.length === 0
       ? "The registry is empty — be the first member."

src/main.rs

@@ -11,7 +11,7 @@ use frxd::{commands, node, onboard, relay};
 #[command(
     name = "frxd",
     version,
-    about = "FRX member node — querier, responder, and local index (Draft 0.4)"
+    about = "FRX member node — querier, responder, and local index (Draft 0.5)"
 )]
 struct Cli {
     #[arg(long, global = true, default_value = "frxd.toml")]
@@ -179,6 +179,12 @@ enum RegistryCommand {
         id: String,
     },
     List,
+    Applications,
+    Approve {
+        id: String,
+        #[arg(long)]
+        registry_url: Option<String>,
+    },
     SetRelays {
         #[arg(required = true)]
         relays: Vec<String>,
@@ -354,6 +360,10 @@ async fn main() -> Result<()> {
             }
             RegistryCommand::Remove { id } => commands::registry_remove(&dir, &id)?,
             RegistryCommand::List => commands::registry_list(&dir)?,
+            RegistryCommand::Applications => commands::registry_applications(&dir)?,
+            RegistryCommand::Approve { id, registry_url } => {
+                commands::registry_approve(&dir, &id, registry_url.as_deref())?
+            }
             RegistryCommand::SetRelays { relays } => commands::registry_set_relays(&dir, &relays)?,
             RegistryCommand::Show => commands::registry_show(&dir)?,
             RegistryCommand::Serve {

src/registry.rs

@@ -108,6 +108,81 @@ pub fn redeem_invite(dir: &Path, id: &str, token: &str) -> Result<()> {
     Ok(())
 }
 
+/// Membership application: MA-private contract data (organization, representative,
+/// contacts, payment). Never part of the public signed registry snapshot.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Application {
+    pub id: String,
+    #[serde(default)]
+    pub org: String,
+    #[serde(default)]
+    pub representative: String,
+    #[serde(default)]
+    pub email: String,
+    #[serde(default)]
+    pub address: String,
+    #[serde(default)]
+    pub domain: String,
+    #[serde(default)]
+    pub class: String,
+    #[serde(default)]
+    pub payment: String,
+    #[serde(default)]
+    pub privacy_link: String,
+    /// "pending" until the MA approves, then "approved".
+    #[serde(default = "default_status")]
+    pub status: String,
+    pub submitted_at: u64,
+}
+
+fn default_status() -> String {
+    "pending".to_string()
+}
+
+pub fn applications_path(dir: &Path) -> PathBuf {
+    dir.join("applications.json")
+}
+
+pub fn load_applications(path: &Path) -> Result<Vec<Application>> {
+    if !path.exists() {
+        return Ok(Vec::new());
+    }
+    let raw = fs::read_to_string(path).context("reading applications")?;
+    serde_json::from_str(&raw).context("parsing applications")
+}
+
+pub fn save_applications(path: &Path, applications: &[Application]) -> Result<()> {
+    fs::write(path, serde_json::to_string_pretty(applications)?)?;
+    crate::config::set_private_permissions(path)?;
+    Ok(())
+}
+
+pub fn record_application(dir: &Path, application: Application) -> Result<()> {
+    let path = applications_path(dir);
+    let mut applications = load_applications(&path)?;
+    applications.push(application);
+    save_applications(&path, &applications)
+}
+
+/// Marks a pending application approved and returns it. Errors if unknown or not pending.
+pub fn approve_application(dir: &Path, id: &str) -> Result<Application> {
+    let path = applications_path(dir);
+    let mut applications = load_applications(&path)?;
+    let Some(application) = applications.iter_mut().find(|app| app.id == id) else {
+        return Err(anyhow!("no application for {id}"));
+    };
+    if application.status != "pending" {
+        return Err(anyhow!(
+            "application for {id} is not pending ({})",
+            application.status
+        ));
+    }
+    application.status = "approved".to_string();
+    let approved = application.clone();
+    save_applications(&path, &applications)?;
+    Ok(approved)
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct SignedRegistry {
     #[serde(flatten)]

tests/onboarding.rs

@@ -50,7 +50,7 @@ async fn signup_issues_invite_and_enroll_binds_key() {
 
     let response = http
         .post(format!("{base}/v1/signup"))
-        .json(&serde_json::json!({"label": "Alice Dev", "code": "sesame"}))
+        .json(&serde_json::json!({"label": "Alice Dev", "code": "sesame", "org": "Alice Dev Org", "representative": "Alice", "email": "alice@example.org", "attestation": true, "privacy_ack": true}))
         .send()
         .await
         .unwrap();
@@ -99,6 +99,153 @@ async fn signup_issues_invite_and_enroll_binds_key() {
     assert_eq!(replayed.status(), reqwest::StatusCode::FORBIDDEN);
 }
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn signup_stores_private_application_and_class() {
+    let root = tempfile::tempdir().unwrap();
+    let dir = setup_ma(root.path());
+    let base = spawn_registry_server(&dir, Some("sesame")).await;
+    let http = reqwest::Client::builder()
+        .timeout(Duration::from_secs(5))
+        .build()
+        .unwrap();
+
+    let missing = http
+        .post(format!("{base}/v1/signup"))
+        .json(&serde_json::json!({"label": "acme", "code": "sesame"}))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(missing.status(), reqwest::StatusCode::BAD_REQUEST);
+
+    let response = http
+        .post(format!("{base}/v1/signup"))
+        .json(&serde_json::json!({
+            "label": "Keswick Research",
+            "code": "sesame",
+            "org": "Keswick Research LLC",
+            "representative": "J. Keswick",
+            "email": "ops@keswick.example",
+            "address": "1 Fell Road, Keswick",
+            "domain": "keswick.example",
+            "class": "enrichment",
+            "payment": "IBAN XX00 0000",
+            "privacy_link": "https://keswick.example/privacy",
+            "attestation": true,
+            "privacy_ack": true
+        }))
+        .send()
+        .await
+        .unwrap();
+    assert!(response.status().is_success());
+    let body: Value = response.json().await.unwrap();
+    assert_eq!(
+        body.get("id").and_then(Value::as_str),
+        Some("keswick-research.frx.invalid")
+    );
+
+    // public registry stays minimal: identifier + class only, no org data
+    let signed = registry::load_registry(&dir.join("registry.json")).unwrap();
+    let member = signed
+        .doc
+        .members
+        .iter()
+        .find(|m| m.id == "keswick-research.frx.invalid")
+        .unwrap();
+    assert_eq!(member.class, frxd::config::CLASS_ENRICHMENT);
+    let raw = std::fs::read_to_string(dir.join("registry.json")).unwrap();
+    assert!(!raw.contains("Keswick Research LLC"));
+    assert!(!raw.contains("ops@keswick.example"));
+
+    // private application record holds the contract details
+    let apps = registry::load_applications(&dir.join("applications.json")).unwrap();
+    assert_eq!(apps.len(), 1);
+    let app = &apps[0];
+    assert_eq!(app.id, "keswick-research.frx.invalid");
+    assert_eq!(app.org, "Keswick Research LLC");
+    assert_eq!(app.representative, "J. Keswick");
+    assert_eq!(app.email, "ops@keswick.example");
+    assert_eq!(app.payment, "IBAN XX00 0000");
+    assert_eq!(app.privacy_link, "https://keswick.example/privacy");
+    assert_eq!(app.class, "enrichment");
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn signup_without_code_queues_application_for_approval() {
+    let root = tempfile::tempdir().unwrap();
+    let dir = setup_ma(root.path());
+    let base = spawn_registry_server(&dir, Some("sesame")).await;
+    let http = reqwest::Client::builder()
+        .timeout(Duration::from_secs(5))
+        .build()
+        .unwrap();
+
+    // no code: application queues as pending; no credentials, no member entry
+    let response = http
+        .post(format!("{base}/v1/signup"))
+        .json(&serde_json::json!({
+            "label": "Pending Co",
+            "org": "Pending Co Ltd",
+            "representative": "P. Pending",
+            "email": "ops@pending.example",
+            "attestation": true,
+            "privacy_ack": true
+        }))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(response.status(), reqwest::StatusCode::ACCEPTED);
+    let body: Value = response.json().await.unwrap();
+    assert_eq!(body.get("status").and_then(Value::as_str), Some("pending"));
+    assert!(body.get("credentials").is_none());
+    let id = "pending-co.frx.invalid";
+
+    let signed = registry::load_registry(&dir.join("registry.json")).unwrap();
+    assert!(
+        signed.doc.members.iter().all(|member| member.id != id),
+        "a pending application must not create a member entry"
+    );
+    let apps = registry::load_applications(&dir.join("applications.json")).unwrap();
+    assert_eq!(apps.len(), 1);
+    assert_eq!(apps[0].id, id);
+    assert_eq!(apps[0].status, "pending");
+
+    // a wrong code is still rejected, not queued
+    let rejected = http
+        .post(format!("{base}/v1/signup"))
+        .json(&serde_json::json!({
+            "label": "other", "code": "wrong", "org": "O", "representative": "R",
+            "email": "r@o.example", "attestation": true, "privacy_ack": true
+        }))
+        .send()
+        .await
+        .unwrap();
+    assert_eq!(rejected.status(), reqwest::StatusCode::FORBIDDEN);
+
+    // MA approves: member stub + invite; enrollment binds the key
+    commands::registry_approve(&dir, id, None).unwrap();
+    let signed = registry::load_registry(&dir.join("registry.json")).unwrap();
+    assert!(signed.doc.members.iter().any(|member| member.id == id));
+    let apps = registry::load_applications(&dir.join("applications.json")).unwrap();
+    assert_eq!(apps[0].status, "approved");
+
+    let invites = registry::load_invites(&dir.join("invites.json")).unwrap();
+    let invite = invites.iter().find(|invite| invite.id == id).unwrap();
+    let key = Keypair::generate();
+    let enrolled = http
+        .post(format!("{base}/v1/enroll"))
+        .json(&serde_json::json!({
+            "id": id,
+            "token": invite.token,
+            "pubkey": key.public_hex(),
+        }))
+        .send()
+        .await
+        .unwrap();
+    assert!(enrolled.status().is_success());
+    let signed = registry::load_registry(&dir.join("registry.json")).unwrap();
+    assert!(registry::authorized_keys(&signed, now_ts()).contains_key(&key.public_hex()));
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
 async fn wizard_enrolls_and_writes_config() {
     let root = tempfile::tempdir().unwrap();
@@ -107,7 +254,7 @@ async fn wizard_enrolls_and_writes_config() {
     let http = reqwest::Client::new();
     let body: Value = http
         .post(format!("{base}/v1/signup"))
-        .json(&serde_json::json!({"label": "Wizard Test", "code": "sesame"}))
+        .json(&serde_json::json!({"label": "Wizard Test", "code": "sesame", "org": "Wizard Test Org", "representative": "Wiz", "email": "wiz@example.org", "attestation": true, "privacy_ack": true}))
         .send()
         .await
         .unwrap()