Sign and bind delivery acknowledgements

README.md

@@ -66,6 +66,10 @@ A **murmuration** is one of nature's most extraordinary phenomena — thousands
 - **Message streaming — complete.** Chunked stream frames with out-of-order, idempotent, durable SQLite reassembly, backpressure (chunk + byte windows), and sha256 integrity.
 - **Auth/authz enforcement.** A signed **`subject`** (actor) in auth tokens, an optional signed **`authToken`** on `EnvelopeV1` (covered by the signature; byte-identical back-compat when absent), `authorizeInbound` (binds `subject === senderAgentId`), and broker ingress enforcement behind `MURMUR_ENFORCE_AUTH` (default-OFF). *Daemon end-to-end wiring is the remaining step.*
 - **Conformance + versioned protocol spec — all wire types.** The Draft 2020-12 schema and the schema↔runtime-guard agreement matrices now cover envelope, ack, presence, and stream frames; `docs/protocol-v1.md` + `docs/protocol-compatibility.md` document them.
+- **Signed, peer-bound acknowledgements.** Daemons emit Ed25519-signed ACKs bound to the original
+  message digest, conversation, sender, recipient, timestamp, and nonce. After every peer is
+  upgraded, set `ackSecurity.requireSigned: true` (or `MURMUR_REQUIRE_SIGNED_ACKS=1`) to reject
+  unsigned, mismatched, stale, or replayed ACKs without logging message bodies.
 - **Validated: real cross-host A2A.** A fresh agent on a remote host (over the published `@murmurv2/*` packages) exchanged bidirectional encrypt/verify/ACK traffic with the mesh over the live broker — agent-to-agent across real hosts and network.
 - **Single canonical signing payload.** `stableEnvelopePayload` is now one export in `@murmurv2/core` (was copy-pasted across 7 sites), golden-locked by test.
 

docs/protocol-v1.md

@@ -12,7 +12,8 @@ the guards cannot drift. Versioning and forward-compatibility rules live in
 | Type | Purpose | Schema `$def` | Runtime guard |
 |------|---------|---------------|---------------|
 | `EnvelopeV1` | encrypted inbound message | document root (`#/$defs/EnvelopeV1`) | `isEnvelopeV1` |
-| `AckV1` | delivery acknowledgement | `#/$defs/AckV1` | — |
+| `AckV1` | legacy unsigned delivery acknowledgement | `#/$defs/AckV1` | — |
+| `SignedAckV1` | signed, peer/message-bound delivery acknowledgement | `#/$defs/SignedAckV1` | `isSignedAckV1` |
 | `PresenceFrameV1` | discovery announcement (public metadata) | `#/$defs/PresenceFrameV1` | `isPresenceFrameV1` |
 | `SignedPresenceFrameV1` | Ed25519-signed presence | `#/$defs/SignedPresenceFrameV1` | `isSignedPresenceFrameV1` |
 | `StreamStart` / `StreamChunk` / `StreamEnd` | chunked payload streaming | `#/$defs/Stream*` (+ `StreamFrame` union) | `isStreamStart` / `isStreamChunk` / `isStreamEnd` / `isStreamFrame` |
@@ -28,8 +29,21 @@ Envelope message payloads are encrypted on the wire; presence frames are intenti
 3. Publish to subject `msg.<conversationId>`
 4. Consumer validates schema+signature
 5. Consumer processes idempotently using `msgId`
-6. Consumer emits ACK or NACK
-7. Retry policy moves failed messages; terminal failures go to DLQ
+6. Consumer emits a signed ACK or NACK bound to the message digest, conversation, sender,
+   recipient, timestamp, and nonce.
+7. Sender verifies the signature against the expected peer key and applies an atomic transition
+   only while the outbox row is in flight. Replays and mismatched bindings are rejected.
+8. Retry policy moves failed messages; terminal failures go to DLQ.
+
+### Signed ACK migration
+
+The daemon emits `SignedAckV1` by default. During a rolling upgrade,
+`ackSecurity.requireSigned` (or `MURMUR_REQUIRE_SIGNED_ACKS=1`) remains disabled until every peer
+emits signed ACKs; old consumers ignore the additional signed fields. Once peers are upgraded,
+enable strict mode on every endpoint. Strict correlation rejects legacy ACKs, stale/future
+timestamps, wrong peers, wrong conversations or recipients, digest mismatches, invalid signatures,
+and repeated/non-in-flight transitions. Rejections increment reason-tagged counters and emit
+metadata-only security events; ACK bodies and message contents are never logged.
 
 An optional `authToken` (bearer `MURMUR-AUTH:…`) authorizes the sender. When present it
 is part of the signed payload (cannot be stripped/swapped) and can be verified with

packages/broker-nats/package.json

@@ -9,7 +9,7 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@murmurv2/core": "^0.2.0",
+    "@murmurv2/core": "^0.3.1",
     "nats": "^2.28.2"
   },
   "license": "MIT",