Attribution requires Rooted, no production agent can root, and the self-attribution hole that hid it is closed: the trace plane has been dark since 2026-09-18

[emooreatx]

Attribution requires Rooted, no production agent can be Rooted, and the hole that hid it is now closed — the trace plane has been dark since 2026-09-18

Full RCA with the read-only evidence: CIRISAI/CIRISServer#632 (comment of 2026-09-23). The short form, and the ask.

What happened

• SourceKeyId::from_rooted_binding admits an inbound frame's source only when the peer is Rooted ∧ owns_key. Unchanged since v19; correct as a trust statement.
• No production agent's key roots at the accord anchor: every agent/node/owner chain terminates at a self-signed row, so persist's root_binding answers NotRootedAtSteward for all of them. Also correct.
• For months the canonical held itself in its peers map as Rooted (a server-side boot-prime bug, CIRISServer#607). Link attribution's destination branch therefore resolved every otherwise-unattributable inbound link to the canonical's own key, which passed both conditions, and every unrooted peer's frames were admitted as the canonical's own (the responder then replied to itself: no route to peer: key_id=<own key>). That hole was the only path production agents ever had.
• CIRISServer#607 (0.5.212, rolled to the production canonical 2026-09-18 22:41Z) stopped the self-prime; 862b0a8 here (Branch-B link attribution can resolve an inbound link to the LOCAL node's own key when the peers map holds a self-entry — the responder then replies to itself; refuse self and name it #621/fix(621): inbound attribution never resolves to this node's own key; no responder is ever built for ourselves #623, v29.1) added ResolvedToSelf → drop. Both right. Since 22:41Z on 09-18, zero non-bootstrap rows from any agent have landed on the canonical (keys admitted per day vs rows landed: 09-21 10/0, 09-22 12/0, 09-23 35/0).
• With the hole closed an unrooted peer has no path: condition 1 needs Rooted; heal_or_report_attribution_miss correctly refuses the peer's own rooted SignedTransportDestination (StoreClaimUnrooted); the v25.3.0+ regression: the #624 bootstrap equality drops third-party records and the canonical's own record — the link never attributes, every non-bootstrap frame on it is dropped, chat ladder bound=0 on v26.0.0 #636 bootstrap door only runs for links with no candidate key, and an announced peer always has one (decision=not_applicable, verified with an unthrottled diagnostic build on a production-faithful harness: resolved=(Advisory, owns_key=true, 0), item2_binding_exists=false).

The ask: separate attribution from rooting

Attribution answers who sent this frame. Rooting answers what this peer may be served. The gate conflates them, and your own comments already draw the line ("routing ≠ trust", "served no trace:*").

Proposed rule — a frame is attributed to key K when:

1. the link's proven transport identity equals the transport identity in a hybrid-verified SignedTransportDestination for K (today's item 2), and
2. K's registered pubkey matched at cold start (owns_key, i.e. any rejection after the pubkey match, or Confirmed).

provenance (Rooted / Advisory) is carried on the attributed source and gates serving exactly as it does now; the trace:* serve gate stays Rooted-only. ResolvedToSelf stays a drop. Admission stays the trust boundary — persist hybrid-verifies every row against the directory under Strict and refuses an unregistered attester regardless of which link carried it, so attributing on the transport binding widens nothing at rest.

This makes the bootstrap carve-out the general case rather than an exception: a peer whose Key + TransportDestination crossed (both verified at admission) is thereby attributable; a peer that never proved control of its transport identity is not.

Three observability asks, from the same day

They each cost an inference step that the log should simply have stated:

1. the cold-start rooting rejection is logged only at debug — an operator never learns why a peer is Advisory (UnknownKeyId vs NotRootedAtSteward is the whole story here);
2. link_attribution_miss_log throttles per key, so after the first miss every further drop is silent (suppressed_prev=22 on a canonical that was dropping every frame);
3. the (Advisory, owns_key=true) hint says "a churn downgrade (owner reroute overwrote a Rooted binding)" — for a peer that was never Rooted (stored_provenance=None), which sent the first read of feat(25.4.0): adopt CIRISPersist v44.8.0 — the consent scope grammar; the transfer grant's principle is pinned to propagate #632 the wrong way.

The unthrottled DIAG#632 lines used for this RCA (attribution operands incl. item 2; every advisory admit with its rejection; every door decision with both identities) are on a throwaway worktree at v29.5.0; happy to send them as a PR if you want them as the permanent shape.

Refs: CIRISServer#632 (RCA), CIRISServer#607, #621/#623, #636, #393.

[emooreatx]

Ruling on what Rooted must mean, and the model that follows (supersedes the "attribute on owns_key ∧ binding" proposal above)

Eric's ruling (2026-09-23): both sides must trust a mutual root. It does not have to be the CIRIS accord root, but it must be a valid root by our criteria (self-chartered with a recovery commitment, hardware-backed holder keys, live lifecycle, no halt latched), and more than one root may be pinned at the same time. In practice each side claims its roots; Rooted holds when the claims intersect on a valid one.

That is what the Rooted test is for: "trusts the same root we do" — so a CONSTITUTIONAL halt or drill from that root would bind the peer (CC 4.2.1 defines reach as exactly the nodes holding a live delegates_to(user → root)), and the peer finds our conferred authority valid.

Why the current walk cannot express it

root_binding walks the peer key's scrub chain to a self-signed steward whose pubkey is in a hard-coded anchor. That proves conferral — an accord holder co-scrubbed this registration — which is true only of canonicals. Agents are never conferred; they accept a root, by a signed row of their own. So the walk answers a different question, and answers "no" for every production agent, correctly.

The proof at first contact

The allegiance rows already exist on every node and are already at federation scope:

• delegates_to(node → R, [infra:attest, infra:serve]) — written by accept_trust_root at boot ("recognition can be shipped; acceptance can only be signed"), revocable by withdraws;
• delegates_to(owner → node, infra:*) — the owner-binding, written at claim.

They cannot cross today for one reason: they are Attestation-kind, and an Advisory peer may not deliver Attestation kinds — the deadlock. Make this narrow shape bootstrap-eligible, beside Key / IdentityOccurrence / TransportDestination: delegates_to rows whose attester is the peer key or its owner, whose subject is the peer node or a root, with infra:* scope. They satisfy the same test as the existing three — signed by keys the receiver has just admitted, hybrid-verified by persist, granting the receiver nothing.

Then, per peer, three states, each answering one question:

state	established by	may do
Identified	the link proved a remote transport identity	nothing yet
Attributed	owns_key ∧ the link's identity matches a hybrid-verified SignedTransportDestination for that key	deliver; persist's gates decide admission; nothing is served
Rooted	Attributed ∧ ∃ R ∈ my pinned roots: peer holds a live delegates_to(peer → R) — or delegates_to(owner → R) plus a live owner-binding — and R is valid	served trace:*, scored, vouched; a halt from R binds it

Compare R by key id and anchor pubkey against the receiver's own pins (CC 4.4.3.8: roots are pluggable and hung by each consumer), never by label. Re-evaluate on each announce epoch and on any withdraws. Conferral (the accord co-scrub, infra:serve) stays what it is — authority — a separate property held by canonicals. ResolvedToSelf stays a drop.

Two traps from this week to design out: on a split install the accepts row must be authored by the node key or bridged through the owner-binding (CIRISServer#629's axis); and the witness has to be a genesis-shaped, unblessed peer — a test-root-blessed peer passes the old walk and proves nothing about this one.

Server side, we will: make trust:accepts authored by the wire key on split installs, run the production-faithful harness by default, and carry the unthrottled DIAG#632 operands permanently. Happy to draft the edge change from the diagnostic worktree if you'd like a starting point.

[emooreatx]

Refinement: the acceptance lives on the owner, and Rooted walks the owner-binding

Eric's ruling, same day: trust "lives" on the owner, so the walk goes through the owner-binding. That is CC 4.4.3.8's own shape — delegates_to(user → root), with the node inheriting via delegates_to(owner → node).

So Rooted(peer) at node N is a two-hop walk over the peer's own signed rows:

peer node key
  └─ live owner-binding   delegates_to(owner → peer_node, infra:*)      (written at claim)
       └─ live acceptance delegates_to(owner → R, [infra:attest, infra:serve])
            └─ R ∈ N's pinned roots (by key id AND anchor pubkey), R valid

and N's own side is the same walk through N's owner, which is what makes it mutual.

Three consequences:

1. Bootstrap-eligible shape, tightened: delegates_to rows whose attester is the peer's owner (the key the owner-binding names), with subject the peer node or a root, infra:* scope. The owner key already crosses in the Key round.
2. The acceptance is one-time and durable — no expiry, idempotent, revoked only by a signed withdraws (CC 4.2.3: no automatic decay). Verification repeats: re-evaluate on every announce epoch and on any withdraws or halt-state change; never cache past those.
3. Server side (ours): today accept_trust_root writes node → R under local_derived_key_id(), which on a split install is the actor key — so the current row bridges to nothing under this walk. We will move acceptance to the owner's pen on owned nodes (unclaimed nodes keep node → R as bootstrap default trust; the owner re-accepts at claim), the same way consent moved in CIRISServer#599. On the node side of the chain the owner-binding is already on the wire key (docs: accuracy sweep — proving-test column on the link-state table, send-set docstrings, release notes v22–v25.2, the two consent grammars #629).

[emooreatx]

The full account: what was wrong on each side, what edge's harness must prove before it certifies, and which FSD sections move

This is the write-up Eric asked for so edge can make its own end-to-end catch this class and update the FSDs. Evidence and timeline are in the RCA on CIRISServer#632; rulings are the two comments above.

---

1. What the Constitution says should happen

Three questions, three layers, in this order:

question	layer	CC	test
Who is this address?	transport, cryptographic	3.3.6.2 transport_destination — the identity↔address binding is a federation-key-signed, hybrid-signed row; a consumer MUST verify the signature against the member's key and that the destination hash recomputes	no trust involved
Is this row admissible?	persist	5.3.2.4.3.1 PQC mandatory at admission; 3.4 open vocabulary, reserved prefixes only for specific identity types; 3.3 "authorization is consumer-policy, not wire"	the put-gates
How much do I trust it / what may it do?	consumer policy	4.4.3.8 roots are pluggable, hung by each consumer as delegates_to(user → root); a node inherits via the owner-binding; the capability gate disables capabilities without a valid external root — it does not refuse rows; 4.2.1 a halt binds exactly the nodes holding a live edge to that root	serving, scoring, vouching

The accord triple (4.2) roots two things: the kill switch and the conferral of infra:serve on canonicals. CC 5.3.3.5 E3 reads "fan-out = entitled ∧ reachable: persist owns durable entitlement, edge owns transport-reachability". persist's trust_root_valid already implements the third row from the user's records and accepts a family as a root (v24, #557). The CC also makes ownership observable (ownership:responsible_party:node:v1, CC 3.1).

2. What edge had wrong

1. Rooted tested conferral, not allegiance. root_binding walks the peer key's scrub chain to a self-signed steward whose pubkey is in a hard-coded anchor. That is true only of a key an accord holder co-scrubbed — a canonical. Every production agent, node and owner chain ends at a self-signed row → NotRootedAtSteward, always, correctly. The question the test is for — "does this peer trust a root we trust, so a halt from it binds them?" — is answered by a different row entirely: the owner's delegates_to(owner → R), reached through the owner-binding.
2. Attribution was gated on Rooted. §5.2 item 1 makes "who sent this frame" depend on "whom we trust". §5.3's own prose says the rooting walk "upgrades the binding afterwards without ever gating attribution" — the FSD disagrees with itself, and the CC sides with §5.3.
3. Only three kinds could cross from an Advisory peer. §5.4.1's Advisory row: bootstrap kinds attributed, any other kind: drop. So the very rows that would prove allegiance (they are delegates_to, an Attestation kind) could never be delivered by a peer that had not yet proven it — the deadlock, one layer up from the one Attribution-gate BOOTSTRAP DEADLOCK: a fresh/un-attributed peer's own Key frame is dropped by the gate that needs the key (source_key_id=None → #317) — no un-blessed initiator can ever introduce itself on v14.2.x; co-design with #393 #402 broke.
4. The anchor was fixed, not pinned. root_binding "secure by default" hard-codes A1/B1/C1; CC 4.4.3.8 says roots are pluggable per consumer and several may be pinned. Eric's ruling: any valid root both sides hold, several at once.
5. The CC citation was wrong. The code cites "CC 3.3.6.2 (advisory admit: routing hint, authority not established)". CC 3.3.6.2 is the authenticated binding — precisely the check that should suffice for attribution.
6. The witness could not see any of this. §5.4.1's Advisory row is "proven by" tests that feed an already-attributable peer (inject_rooted_peer_for_test, a test root that scrubs the peer). The FSD names this trap itself — test-field-provenance — and it applied once more: no test ever presented a peer whose chain roots nowhere, which is every production peer.
7. The failure was silent. The rooting rejection is logged at debug; link_attribution_miss_log throttles per key so every drop after the first is invisible (suppressed_prev=22 on a canonical dropping every frame); the (Advisory, owns_key=true) hint says "a churn downgrade" for a peer that was never Rooted; the bootstrap door logs the link's identity but not the identity it compared against.

3. What the server had wrong (ours)

1. The canonical primed itself into its own peers map as Rooted (CIRISServer#607). Link attribution's destination branch then resolved every unattributable inbound link to the canonical's own key, which passed both conditions. That hole was the only path production agents ever had; it carried traces for months and served zero rounds. feat(24.2.0): adopt CIRISPersist v44.4.0 — the occurrence is PUBLISHED, and the LocalSigner can finally name itself #607 (0.5.212, rolled 2026-09-18 22:41Z) closed it; Branch-B link attribution can resolve an inbound link to the LOCAL node's own key when the peers map holds a self-entry — the responder then replies to itself; refuse self and name it #621/fix(621): inbound attribution never resolves to this node's own key; no responder is ever built for ourselves #623 closed it again on your side. Both correct; nothing replaced it. The mesh has admitted no non-bootstrap row from any agent since 22:41Z on 09-18.
2. accept_trust_root writes node → R under local_derived_key_id() — on a split install the actor key. The 815 agent-attested acceptances on the canonical through 09-18 are exactly those rows, arrived through the hole. Under the owner-binding walk they bridge to nothing. Moving to the owner's pen (as consent did in Blob-backed chat is unreadable on any node that did not seed its own fixtures: nothing provisions an identity occurrence with content-KEM keys #599).
3. Every writer of the owner-binding puts it at cohort self, which the send side withholds from any peer that is not the owner's own device — so the first hop of the walk never reaches the canonical. The CC makes ownership observable; whether the binding row itself or its ownership: projection is what crosses is a ruling we will bring, but one of them must be on the bootstrap plane.
4. The harness certified a topology production does not have: the agent registered through an unauthenticated test-admit-peer that scrub-signed it under the test root (so the canonical rooted it and item 1 passed); the agent was an unsplit embedded process; harness agents dialed the production canonical (ciris-agent-harness-* keys are on the real directory). Reproduced faithfully with CIRIS_TEST_ADMIT_NO_BLESS=true: NotRootedAtSteward, bootstrap kinds cross, everything else drops with resolved=(Advisory, owns_key=true), item2=false, door=not_applicable — production exactly.
5. Our logs hid it too: "RNS announce rooted (peer now reachable)" printed for Advisory admits; log_dedup collapsed the diagnostic lines into "event repeated N times".

4. What edge's harness must prove before it certifies

Every item below is a witness that would have been red for the last five days. None of them is satisfiable by a test double that injects Rooted, by a test root that scrubs the peer, or by an already-attributed link literal.

Topology (the peer must be production-shaped):

• The peer's key record is self-signed (scrub_key_id == key_id, no steward or test-root scrub); root_binding on it returns NotRootedAtSteward.
• The peer is a split install: configured key is actor-typed (agent), a node key is minted, the owner-binding has moved to the node key, and the wire identity is the node key while edge.signer_key_id() is still the actor. Run the unsplit shape too; both must pass.
• The peer is owned: a distinct user key, a live owner-binding delegates_to(owner → node, infra:*), and the owner's acceptance delegates_to(owner → R).
• Both sides pin R (a valid root: self-chartered with recovery commitment, hardware-attested holders, no halt latched); the receiver's pins hold at least two roots and the intersection is on the second one in at least one run.
• The receiver does not hold itself in its peers map. Permanent assertion: no responder round with peer == own key, no reply send failed … key_id=<own key>.
• No node in the harness dials any production address.

First contact (the order things arrive):

• Links beat the announce (Identified first); the announce then yields Attributed (owns_key ∧ verified transport binding) without any directory walk gating it.
• Key, IdentityOccurrence, TransportDestination and the two allegiance rows (owner-binding, owner's acceptance) cross on the bootstrap plane before any Attestation round; each is persist-verified on arrival.
• After they land, the receiver evaluates Rooted = ∃ R ∈ my pins: live owner-binding ∧ live owner acceptance of R ∧ R valid — compared by root key id and anchor pubkey.
• The peer's next Attestation Offer is attributed, the receiver serves the round (responder served … kind: Attestation), and rows land (arrive > 0). "Served a Key round" is not success; "UNSOLICITED Deliver admitted" is not success (production had those lines while persist refused every row).
• The reverse direction passes the same way (receiver as initiator toward the peer; peer as responder).

Negatives (each must fail for the stated reason and log it):

• Owner accepts a different root → Attributed, not Rooted: rows are delivered and admitted by persist; nothing is served; trace:* withheld.
• No acceptance at all → Attributed, not Rooted.
• Acceptance withdrawn mid-run → Rooted drops to Attributed on the next evaluation (announce epoch or the withdraws itself), never cached past it.
• Peer whose transport identity does not match its binding → not Attributed (this is the anti-spoof invariant; keep HijackRefused and ResolvedToSelf).
• A halt latched on R → the peer's Rooted evaluation reflects it.

Observability (assert on the log, unthrottled):

• Every dropped frame names the key, the link's identity, the identity it was compared against, and the failing condition.
• Every advisory/attributed admit names the rooting rejection kind at warn.
• No line says "rooted" for a peer that is not; link_before_binding == 0; bootstrap_door_outcomes and attribution misses are 0 for a Rooted peer after first contact.

5. FSD sections that move

CIRIS_EDGE_TRANSPORT.md:

• §5.1/§5.2 — the gate: attribution = owns_key ∧ hybrid transport binding; Rooted becomes a pair property evaluated afterwards; E3 is cited correctly (persist owns entitlement).
• §5.3 — the prose is already right; the state machine gains Attributed between Identified and Rooted, and Rooted's definition becomes the mutual-root walk.
• §5.4 — bootstrap plane gains the two allegiance row shapes (delegates_to by the peer's owner, subject the node or a root, infra:*).
• §5.4.0 — key objects gain the owner key, the owner-binding and the acceptance.
• §5.4.1 — the table gains an Attributed row (deliver; persist admits; nothing served) and the Rooted row's "established by" changes; the "proven by" column must cite witnesses built on an unrooted, split, owned peer.
• §5.4.2/§5.4.3, CONTENT_TRANSFER.md, REPLICATION_ROUND_CORRELATION.md — every "Rooted ∧ owns_key" reference re-pointed.
• The CC 3.3.6.2 citation corrected wherever it appears.

persist: trust_root.rs already evaluates from the user's records; an FSD note that the acceptance is the owner's act on owned nodes, and that the owner-binding (or its ownership: projection) is bootstrap-visible, once Eric rules on which.

Server (ours, tracked on #632): accept_trust_root on the owner's pen and the wire key; the owner-binding's visibility ruling; production-faithful harness as the default for every ladder; permanent unthrottled drop diagnostics exempt from dedup; the announce-log misnomer.

[emooreatx]

Refinement 3: no node-level trust binding, and no unowned participant

Two more rulings from Eric today that remove branches rather than add them:

1. The node never mints trust on its owner's behalf. A node-signed delegates_to(node → R) would be infrastructure making a human's trust statement (the 0.5.203 consent mistake), would not be CC 4.2.1 reach (which is defined on the owner's edge), and would drift from the owner's un-trust. Instead the node carries three owner-signed rows on the bootstrap plane at first contact — the owner's key record, the owner-binding delegates_to(owner → node, infra:*), and the acceptance delegates_to(owner → R) — and the receiver verifies each against the owner key admitted in the same Key round. "Recognition can be shipped; acceptance can only be signed" — by the owner. If edge wants O(1) per frame, cache the walk's verdict keyed on the three row ids and invalidate on any withdraws or announce epoch; never persist it as a row.

2. An unowned node is not a mesh participant. So there is no "node is its own root" case and node → R disappears entirely. Boot installs the bundle's records (recognition); the acceptance is written at claim, by the owner's pen, beside the owner-binding. An unclaimed node holds recognition and no acceptance — correct, it isn't a participant yet.

Rooted therefore has exactly one shape on both sides:

peer node key → live owner-binding(owner → node) → live acceptance(owner → R) → R ∈ my pins ∧ R valid

and the receiver's own side is the same walk through its own owner. For the harness checklist above this removes the unowned variants and adds one: a canonical that is not itself claimed must be Rooted to nobody — which we are checking against the production store now.

[emooreatx]

Edge's read before building: what persist already gives us, and two criteria with nothing under them yet

Checked against persist v47.0.0 (d4cf3ac7, the pin edge is adopting on #658). Neither v46.5.0 nor v47.0.0 touches anything here; they're the drive/affiliations fixes and don't move rooting, attribution or the bootstrap plane.

The mutual-root test is mostly already in persist

• trusted_roots_of(dir, key, now) — every root key holds a live delegates_to(key → R) edge to (non-tombstoned, non-expired, federation-tier, infra:* job dimension). Evaluated with the same four predicates as trust_root_valid leg 1, on purpose, so a caller can't fork "live trust edge".
• trust_root_valid(dir, user, R) — leg 1 the edge exists; leg 2 R self-declares with both infra:serve and infra:attest and carries the recovery pre-commitment; leg 3 no halt latched. Family/threshold roots since v24 (v18.12.1 — chat-harness integration guide, compile-pinned #557), quorum re-derived from this node's own stored roster at read time. Returns bounded_until, the instant the verdict can first stop holding on time alone — that is the re-evaluation hook the ruling asks for, alongside announce epoch, withdraws and halt-state.

So with the refinement (acceptance lives on the owner):

Rooted(peer) at N  ⇔  ∃ R ∈ trusted_roots_of(N.owner)
                       ∩ trusted_roots_of(owner_of(peer))         // through the live owner-binding
                     : trust_root_valid(N.owner, R).valid
                     ∧ trust_root_valid(owner_of(peer), R).valid

compared by R's key id and the anchor pubkey in this node's directory. No new persist read is needed for the core.

Two criteria in the ruling have no substrate behind them — rulings needed before the walk is end-to-end

1. "hardware-backed holder keys". CC 4.2.2's hardware_class field on federation_keys rows is not implemented in persist (no such field on KeyRecord; hardware_attestation exists only on occurrence rows). What persist does enforce is HardwareAttestationPolicy at admission of accord_holder-typed keys (v2.5.0, #102 ask 8): an accord holder's key must arrive with hardware custody evidence or it isn't registered. So:

• for the accord root (Family kind, holders are accord_holder keys) the criterion is met by admission;
• for a self-chartered Key-kind root signed by a user key, nothing checks hardware anywhere.

Proposed ruling, the cheaper one: a valid root's charter holders must be accord_holder-typed keys — hardware is then enforced by the door that already does it, trust_root_valid gains no leg, and no hardware_class field has to be invented (edge won't add one on its own; it's persist's row). The alternative is a persist ask to add a hardware leg for Key-kind roots. Either way it's a line in the FSD, not edge code.

2. The walk's first hop can't cross today. The owner-binding delegates_to(owner → node, infra:*) is written at cohort self by every writer (CIRISServer#632 §3 item 3), and the send side withholds self rows from any node the owner doesn't own — so the receiver never holds the row the walk starts from. Server said a ruling is coming on which crosses: the binding row itself, or its ownership:responsible_party:node:v1 projection (CC 3.1). Edge's recommendation: the binding row itself, on the bootstrap plane at federation tier. It is what persist's owner_of reads and what the walk keys on; a projection is a second spelling of the same fact, and this week's two persist issues were both "two spellings of one fact". Until this is ruled, edge can build and witness everything up to Attributed and the Rooted evaluation on a locally-seeded binding, but the first-contact ladder in comment 3 §4 can't go green.

3. "live lifecycle" — I read it as the charter rows are live, which trust_root_valid checks. Drill freshness was removed from validity in v23 (#551) and is reported as a signal, not a gate. Say if the ruling meant the drill.

Build order on edge (FSD delta first, then code, each with the witness in comment 3 §4)

1. CIRIS_EDGE_TRANSPORT.md §5.1–§5.4.3: the three-state machine, Rooted as the mutual-root walk, the bootstrap plane's two allegiance shapes, and the CC 3.3.6.2 citation corrected.
2. Attributed split from Rooted: attribution = owns_key ∧ hybrid-verified transport binding; deliver on Attributed; ResolvedToSelf and HijackRefused unchanged; trace:* serve stays Rooted-only.
3. Bootstrap-eligible allegiance rows: delegates_to authored by the peer's owner key, subject the peer node or a root, infra:* scope — beside Key / IdentityOccurrence / TransportDestination.
4. Rooted = the walk above, re-evaluated on announce epoch, withdraws, halt change and bounded_until; never cached past them.
5. The three observability asks (rooting rejection at warn, attribution misses counted not silenced, the "churn downgrade" hint only when a Rooted binding was actually overwritten).

The witness peer will be genesis-shaped, self-signed, split-installed and owned, with no test root scrubbing it — root_binding on it must return NotRootedAtSteward as a precondition, or the test proves nothing about this change.

[emooreatx]

Ruling (2) resolved: no new rule — announcing already publishes the owner-binding at federation; the defect is which key it publishes

Eric's check, verified in code and on the production store:

• Announcing is the participation act, and it restamps the binding. POST /v1/federation/announce requires the owner's session, resolves the owner's signer, and calls promote_owner_binding_to_federation — the owner re-signs the node's self owner-binding at cohort_scope: federation — then sets net.announce_ownership = true. self is the pre-announce state; a node that has not announced is P2P-only by design.
• It works. The production canonical holds 13 delegation_purpose: responsible_for owner-bindings at federation scope (Aug: 9, Sep: 4), beside 18 self copies. So the row itself already crosses, on the existing plane, and your recommendation (the row, not a projection) is what exists. Nothing new to rule.
• The defect. The announce promotes the binding for node_code.key_id, and the NodeCode is built from the configured key — on a split install, the actor. Of those 13 federation-scoped bindings, 13 name actor keys, 0 name node keys. The node key's binding is written only by the boot move (move_owner_binding_to_node_key) and only at self; nothing widens it. So the copy that crosses names a key that isn't the one linking, and the receiver still cannot make the first hop for any split install. (Seventh instance of the actor/node axis on our side.)

Server fix (ours, small, no new row shape): the announce promotes the binding for the wire identity; the boot move, when net.announce_ownership is already true, re-authors the node key's binding at federation as well (it already requires the owner's signer to run).

For edge's walk: expect delegates_to(owner → node_key, infra:*) at federation — the same row owner_of reads — arriving on the bootstrap plane with the peer's Key/TD/IO rows; self copies stay withheld exactly as now. Nothing in the first-contact contract depends on a projection.

Ruling (1) — a valid root's charter holders must be accord_holder-typed keys, in lieu of an unimplemented hardware_class — is Eric's to confirm; I've put it to him.

[emooreatx]

Ruling (1) resolved: a valid root is defined by its holders' ATTESTED HARDWARE PROPERTY, not their identity type

Eric's ruling: the second option — "yubikey-backed etc." means the property, evaluated where the root is judged.

Correction to the premise first. CC 4.2.2's hardware_class is implemented: there is no free-standing column, the class rides inside the key record's attestation_evidence (the PlatformAttestation variant is the class claim), and it is gated in two layers today:

• Layer A — persist's HardwareAttestationPolicy::check at put_public_key: evidence present, canonical shape, derived HardwareType in the accepted set, capture nonce ≤ 24 h. Persist runs it only for identity_type = accord_holder rows.
• Layer B — the server's binding check (hardware_attestation::register_attested_federation_key, CC 4.2.2.1, every server admission path): Layer A for every row, plus, for the class with a pinned attestation root (YubiKey PIV), the chain walk to Yubico's root and the assertion that the attested key equals the record's Ed25519 pubkey. No evidence = software-class, admitted; an unverifiable claim = refused, never downgraded.

Keying validity on the accord_holder type would only work because Layer A happens to be type-keyed, and it would inherit its limits (structural only, no chain check). A record that arrives by replication is admitted by persist directly, so a peer never sees Layer B at all.

The rule: a root R is valid at node N iff, besides the existing legs (delegates_to(R → R) charter with a pre-rotation commitment, lifecycle active, no halt latched), every charter holder's key record carries attestation_evidence that passes Layer A, and passes Layer B for any class N holds a pinned attestation root for — evaluated in trust_root_valid on N, from the records N holds, not only at admission. accord_holder stays the accord's reserved identity type; it is not the definition of "valid".

What this asks of each side:

• persist — trust_root_valid gains a holder-hardware leg calling the existing policy, and a hook for the chain verifier (verify-core already has verify_yubikey_piv_attestation; TPM / Secure Enclave / StrongBox stay Layer-A-only until a root is pinned for them). Replicated key records should get the same Layer A regardless of type, so a peer's directory is not weaker than the admitting node's.
• edge — Rooted(peer) = the mutual walk (owner-binding → owner's acceptance → R) with R valid under this rule; the walk is persist's, edge composes it. Re-evaluate on announce epoch, withdraws, halt-state change, and when a holder record changes.
• server — nothing new beyond what is already ours: the announce/move fix for the wire key, acceptance on the owner's pen at claim, and the harness witness (an unrooted, split, owned peer under a root whose holders carry real evidence; a negative with a holder that carries none).

That closes both rulings. The first-contact contract is now fully specified: Attributed on owns_key ∧ verified transport binding; Rooted when the two nodes' owners accept a common root whose holders are hardware-attested by the property, checked where the root is judged.

[emooreatx]

Threat check on the two rulings: no new DoS class, one property changes meaning, five invariants to state explicitly

Checked against edge's transport FSD and code (bundle_gate, bridge, the responder gate, the announce/peer bounds), persist's admission gates, and the production store.

What changes in kind: Rooted becomes self-declarable

Under the old walk, Rooted was conferral — unforgeable. Under the mutual-root walk it is allegiance: the peer's owner signed an acceptance of a root we also accept. Anyone can sign that. So Rooted must be read as standing (this peer is bound by our root's halt; it recognises our authority), never as authority or trust weight. That is safe today because every authority path is already gated on something acceptance cannot forge:

• Trace serving — the sender withholds unless the recipient's infra:serve is conferred by a root the sender trusts (capability_roots_to_trusted_root; WithholdReason::ServeCapabilityNotRooted is the capability's rooting, not the peer's provenance); the responder's gate is peer_has_serve_capability → has_accord_conferred_role, and its test is literally trace_serve_requires_accord_blessing_and_trusted…. Conferral, not allegiance.
• Trust weighting — CC 4.4.3.8 Policy A weights attestations by whether the attester is in the consumer's pinned set; a peer's provenance is not an input.
• Audience — consent and cohort rows decide who receives what; provenance is not an input.

Invariant 1 (new, must be written into §5.4.1): no serve, score, vouch or audience decision may take Rooted as sufficient; conferral or consent remains the gate. The responder's "stays strictly Rooted∧owns_key (E3)" wording must be re-specified as "attributed ∧ conferred", or an implementer will read the new Rooted as the old one.

DoS surface

1. Hardware verification cost (Layer B chain walks) is not attacker-steerable. The walk verifies holders of roots the receiver pinned; an attacker cannot make us verify their holders, and cannot replace our holders' records (a replacement for A1 must be signed by A1). Cache the verdict per holder-record content hash; three holders, verified once each per record version. Bounded.
2. Two more bootstrap-eligible row shapes (owner-binding, acceptance) mean up to three more hybrid-verified rows per fake peer than today's Key/IO/TD flood — the same class as AV-42 ("advisory admits are attacker-floodable: mint unlimited self-signed keypairs"), bounded by the same things: persist's per-peer quota (AV-76), ANNOUNCE_QUEUE_DEPTH 256 / priority 64, MAX_PEERS 4096, MAX_DELIVER_ENVELOPE_BYTES 512 KiB. Two asks: count the allegiance rows in the same per-peer quota, and admit them only when the attesting owner key is already admitted in the same round (they are unverifiable otherwise, so this is free). Storage growth from minted owner keys is the pre-existing Key-record concern, not a new one.
3. Re-evaluation triggers are attacker-paced (an attacker can re-announce to force re-evaluation of its own status) but the walk is three local lookups plus a cached verdict, and announces already drain through bounded queues. Bounded.
4. Layer A on replicated records refuses nothing that exists: on the production canonical only A1/B1/C1 carry attestation_evidence (3 of 1,634 records). Measured, not assumed.

Invariants to preserve or add

2. Nonce freshness is an admission-time property, not a validity-time one. Layer A's ≤ 24 h capture-nonce check protects against replay at registration. Re-checking it in trust_root_valid would expire every real root a day after its holders registered. The validity-time leg checks structure + chain, never freshness.
3. A durably-Rooted binding must carry its basis and be re-evaluated on load. bundle_gate gates the durable Rooted save and the Live peers map never upgrades Advisory→Rooted after boot — every announce-admitted peer is permanently unattributable on the Attestation plane #432 divergence heal upgrades from it; under allegiance, a restart must not reload a peer as Rooted whose owner has since withdrawn. Persist the three row ids the verdict rested on; re-walk them on load, on withdraws, on halt-state change, on announce epoch.
4. Unchanged and load-bearing: HijackRefused (CRITICAL: route table hijackable — higher-epoch Advisory announce overwrites a Rooted route; replication apply accepts unsigned routes for any key_id #337 — a non-owning announce never supersedes a route; the attacker's own standing doesn't touch a victim's key), ResolvedToSelf drop (fix(621): inbound attribution never resolves to this node's own key; no responder is ever built for ourselves #623), E2 proof-of-possession, the single-owner invariant (the actor-key and node-key bindings name the same owner, so admission's "second binding, different owner" refusal is not triggered), and persist's accord:* × accord_holder asymmetry (the accord's reserved namespace stays reserved; validity is a property of holders' evidence, not a new way to become accord_holder).
5. The only widening is deliberate and is the point: an unrooted-but-attributed peer's rows are now admitted (persist verifies each one) where before they were dropped at the transport. Admission was always the trust boundary the CC assigns (5.3.2.4.3.1, 3.4); the transport had been doing admission's job by refusing everyone.

Net: no new DoS class; the cost of a fake peer rises by a bounded, quota-covered amount; one word (Rooted) changes meaning and must be fenced from every authority path in the FSD before code moves.

[emooreatx]

Landed on PR #660 (5cb7988): attribution split, Rooted computed, the serve floor, the invariants

• Attribution is owns_key ∧ hybrid transport binding. Two real-link e2e tests that asserted None for a never-conferred peer now assert Some(B) — a peer scrubbed by a steward outside the pinned anchor, i.e. every production agent's shape.
• Rooted is rooted_with(peer) in the bridge: owner-binding → owner's acceptance → a valid root in common, from persist's owner_of / trusted_roots_of / trust_root_valid, memoized per sweep and never stored — so the "durably-Rooted must carry its basis and be re-walked on load" invariant holds by construction, and withdraws / halt / bounded_until re-evaluate for free.
• The floor: nothing is served below Rooted (recipient_not_rooted, last gate, so a more specific refusal keeps its name). Rooted is standing, never sufficient — trace:* keeps its conferral gate; the "strictly Rooted∧owns_key" comments now say "attributed ∧ conferred"; all five invariants from the threat check are in §5.4.1.
• No new bootstrap shape. The owner-binding and the acceptance cross as ordinary Attestation deliveries from an Attributed peer, admitted by persist (which refuses an unregistered attester, so only once the owner key has crossed) under the existing per-peer quota. The "make the narrow shape bootstrap-eligible" step is unnecessary once attribution stops asking about trust.
• Persist ask for ruling (1): CIRISPersist#901 (holder-hardware leg in trust_root_valid; Layer A on replicated key records regardless of type).

Still to do on edge: the §4 first-contact ladder as an e2e — genesis-shaped, split-installed, owned peer no test root scrubs; both directions; the negatives. None of the 22 multi-node binaries in tree serves attestation rows to an unrooted recipient, so that ladder is the floor's end-to-end proof; today it is proven at the bridge and on real links for attribution.