po-network

Portable C6 roster admission, C9 election reducers, durable voter storage, a fixed operation router, ciphertext relay framing, and the deterministic election simulator. There are no direct Node imports in src. The existing po-web-security proof and sealed-channel adapters support Node and workerd with Node crypto compatibility.

C6 roster

initialRosterState(networkId) seeds a network. applyRoster(state, envelope, trust, now) returns the next state, or undefined on any failed proof or shape. Use signEnvelope(key, 'po/roster/v1', payload) from po-web-security/deviceProof for snapshots, entries, and changes. Keys are base64url DER P-256 SPKI strings. The issuer signs the full snapshot. Each host entry needs a device locally pinned at that host for its owner. The trust callback must never trust keys in the incoming snapshot. Membership removal drops the person's hosts. Persist the returned state before publishing it and synchronously revoke channels when it becomes visible. Keep epoch and tombstones across restart. Equal epochs and rollback are refused; tombstoned host IDs cannot be reused.

Voter changes and evictions require a network owner's pinned-device signature at the affected host. A changed voter flag must match both the signed entry and signed change. Term changes require the named voter host's roster key, with signerKeyId equal to its host ID. Terms strictly increase. termChurnCount counts observed signed term changes, while termChurn flags at least three changes within 60 seconds at the latest application. These are diagnostics, not extra votes or authority. C6 owner authorization is not C9 configuration commitment: voter reconfiguration must still pass the existing election quorum/change-certificate protocol. Do not replace an election state's voter roster directly from an owner signature.

Durability and fencing

Open the database with the injected po/sqlite service at the composition root, then call createSqliteElectionStorage(database, seed). The adapter stores the complete election state, including promises, accepted changes and the highest fence, in a network-keyed SQLite row. Use transact for existing pure election transitions and sign their results only after commit. Never delete this row or reseed it on restart. Storage errors propagate, never acknowledge them as success.

Every coordinator mutation receiver must call storage.mutate(network, lease, now, timing, verifyVote, effect). The fence and effect(transaction) commit in the same transaction. Use only the supplied transaction for SQL effects; do not re-enter the database or perform an external effect there. A failed effect rolls back both. A Worker may implement ElectionStorage with DO storage and run admitMutation inside the same transaction as its guarded effect. Verify votes using pinned epoch keys; a lease proves quorum, not application authorization.

Router and relay

createNetworkRouter admits only NETWORK_OPERATIONS. Each typed handler supplies a shape validator, caller authorization, and implementation. Unknown operations, including object prototype names, fail closed. Mutation handlers must independently allowlist the destination operation and use durable fencing.

forwardNetworkFrame routes { destinationHostId, sealed } by host ID without keys or plaintext. Socket admission and availability are host composition concerns. receiveNetworkFrame takes an established nodeSealedChannel or async browser channel and a mandatory destination signed-request verifier (C3/C4 with durable nonces). It never treats decryption as authorization. Channel counters refuse replay and reordered-stale frames. Delayed frames still need current authorization and freshness at the destination. Reconnect with fresh authenticated channel keys; never reconstruct a channel with reset counters and reused keys. Never use sealedTransport's loopback plaintext pass-through for network traffic.

Liveness and limits

One voter can self-elect. Two voters require both: losing either means no coordinator, so roster writes and coordinated relay service pause. Existing C6 entries and direct roster-authorized peer links still serve authorized requests. A gateway can deny, delay or drop traffic, but cannot mint device proofs or decrypt sealed payloads. Relay destination and timing metadata remain visible.

This is crash-fault-tolerant, not Byzantine-safe. Leases depend on bounded clock skew; receivers need durable fencing and atomic effects for safety. An owner cannot bypass an old quorum to recover a two-voter network safely. Runtime activation, roster synchronization, outbound WebSockets and Worker socket hibernation belong to host composition, not this library.

pnpm exec nx run-many -t lint,typecheck,build,test -p @agimon-ai/po-network --parallel=1 runs the election simulator through the package's normal vitest --run test target.

Retained roster changes

Snapshots retain all signed evictions, the latest voter change per live host and current-epoch term records. Consumers verify retained signatures but apply effects only after their local epoch. This permits catch-up after a skipped eviction epoch and prevents old voter records authorizing a new flip. Evictions use owner pins without requiring a target host entry. An unverifiable eviction of a host absent locally and in the snapshot is skipped, so a newcomer can join. Such a newcomer has no tombstone for that host ID: a malicious issuer may later re-include an old device-signed entry. The issuer already orders records and may withhold changes. Independent local pins remain mandatory. Permanent eviction history requires a signed checkpoint before it can be compacted.

Durable device host entries and owner voter/eviction decisions verify as of issuance, including on catch-up after their declared expiry. The fresh issuer snapshot supplies freshness. Term diagnostics still verify at the current time. Local pin revocation or rotation removes the old key's authority, so its old records stop verifying. A compromised still-pinned owner key can backdate records until it is unpinned; the issuer cannot correct a host's local trust decision.

Current membership ceiling

ponytail: voter changes add or evict exactly one voter per owner-authorized slot. Owner changes and arbitrary voter-set replacement are unsupported; add them as new slot kinds. C6 enrollment alone never adds C9 votes.