Persist encrypted mailbox journals, snapshots, and effect receipts

Agent pickup triage

Category: blocked. This classifies the next task, not completion or a verified current-source pass.

Next bounded step: Wait for #4629’s delivery semantics/API, then implement bounded encrypted journal and recovery against canonical #4628 types; do not introduce fleet-owned wire types.

Read the linked handoff and coordinate any active owner before implementation. Preserve the original acceptance criteria below; this triage grants no spending, credentials, publication, host reconfiguration, or landing authority.

Parent: #4622

Depends on #4628 and #4629.

Outcome

Persist durable mailboxes as an encrypted, bounded, append-only journal with independently recoverable delivery state, signed content-addressed snapshots, and explicit external-effect receipts.

The standalone MVM store persists canonical mvm-contract envelopes and MVM-owned delivery state. mvmd may provide an optional opaque fleet store or orchestration wrapper, but its SQLite schema and node-placement lease records do not define the canonical journal or receipt format.

Scope

Encrypted accepted-message journal with integrity chaining and remote-anchor hooks.
Mutable delivery state for attempts, acknowledgement, deduplication, expiry, retention, and dead-letter disposition.
Signed content-addressed workload snapshots carrying a journal cursor and execution epoch.
External-effect intents and receipts with idempotency keys for network requests, credential use, and other brokered effects.
Typed compensating messages for undo workflows; accepted history is never rewritten.
Crash recovery, quota enforcement, key rotation, secure deletion policy, and rollback detection.

Acceptance criteria

Recovery reconstructs queue and deduplication state from the journal without exposing plaintext on ordinary hosts in the host-blind profile.
Tampered, truncated, reordered, rolled-back, wrong-tenant, or wrong-key journal records fail closed.
Snapshot identity binds state root, mailbox cursor, workload identity, execution epoch, and admitted policy.
Replay after a snapshot does not repeat an external effect when a valid receipt already exists.
Undo is represented by an authorized compensating message and leaves the original signed history intact.
Retention, quota, expiry, dead-letter, rotation, recovery, and deletion behavior have positive, negative, and crash-interruption tests.
Canonical journal records contain no mvmd organization/fleet/node/instance types; fleet placement metadata is stored in an explicitly separate mvmd wrapper when used.
An ordinary mvmd coordinator can enqueue, route, reconcile, or retain ciphertext without possessing recipient decryption material or parsing payload plaintext.
Migration tests cover any retained mvmd mailbox rows or explicitly prove that pre-production rows are rejected and safely disposable.

fix(mailbox): reject revoked transport bindings (tinylabscom#5034)

Ownership / source check (current main 7a5ac49; no #4630 comments before this update): ADR-057 §6 requires envelope + dedup committed before destination-signed accepted_durable; §7 requires an encrypted bounded journal and rollback refusal. Today mvm-hostd/src/mailbox_service.rs admit verifies/open-decrypts, adds replay identity to an in-memory set, queues plaintext, and returns Ok(()); receive destructively pops that volatile queue. mailbox_launch.rs derives the transport encryption key using a per-launch secret that is intentionally shredded, so it cannot alone recover retained ciphertext. The published encryption-guarantees page calls this trusted-host, not host-blind. #4629 remains open; draft #5328 touches four core verifier/transport files and does not deliver durable semantics.

I asked Casey on #5328 (#5328 (comment)) to agree on interface/file ownership before editing any overlapping code. Proposed first slice: one MVM-owned bounded journal primitive persisting the canonical encrypted envelope and its dedup identity atomically before any durable receipt, with recovery and explicit tamper/wrong-key/wrong-domain/rollback failures; the existing service alone should later consume it, never a parallel service. This is not a completed acceptance criterion.

Two custody decisions are prerequisites to a real durable receipt/rollback claim: (1) where a persistent, versioned mailbox-history wrapping/authentication key is provisioned/retained/rotated independently of the erased per-launch secret, with recovery authorization; (2) what independently trusted, monotonic rollback anchor commits the (mailbox, sequence, chain head) before a durable receipt and how its authority survives host rollback/crash. A same-directory head file or signer key is not an independent anchor. Please select/approve those contracts before we advertise accepted_durable. Host-blind recovery additionally requires confidential guests with attestation-bound key release and protected memory, unavailable in the current trusted-host tier; leave that checkbox unchecked. All original issue criteria remain unchecked. Branch reserved: feat/4630-durable-mailbox-journal; no code edits, tests, or PR yet pending coordination/decisions.

Source/ownership correction before implementation: a separate active guest Receive/ACK session is already working from private mailbox handoff 4bc9e6ee946d9e3656784da7fb98575ead3cbb3a, which includes an existing mvm-core/src/mailbox/journal.rs plus hostd durable service adapter; its current worktree actively edits both. I inspected that pinned journal read-only. It already has bounded AEAD-sealed records, dedup identity, receipts and an explicitly host-local FileJournalAnchor that detects journal-only rollback but not whole-host rollback. It takes a raw key supplied by the caller, not a reviewed persistent history-key custody provider, and its current private-branch behavior is not yet current-main acceptance evidence. I have paused all source edits on my feat/4630-durable-mailbox-journal branch, asked the owner for the exact live source and incremental ownership handoff, and informed #4629 contributor on #5328. The right #4630 slice is to extend/review that one journal once source pins and ownership align, not create another store. No accepted_durable claim, host-blind claim, PR or acceptance checkbox follows from this handoff code.

Incremental private #4630 journal work, not a completion claim. Source base feat/mvm-guest-receive-ack@634d1cc687898f947129a0aec9dc89d7b117de65 (clean local handoff; owner paused journal.rs), branch feat/4630-durable-mailbox-journal. Existing MVM journal extended in mvm-core/src/mailbox/journal.rs, no second store/service or mvm-contract/mvmd edits. Added an independent-authority JournalAnchor load/CAS seam; recovery rejects missing/conflicting anchored prefixes and syncs the directory before reconciling a valid suffix. Accepted record v2 contains exact canonical encrypted frame, authenticated dedup identity, unsigned receipt state and a domain-separated destination-signed acceptance intent. The destination's actual AcceptedDurable receipt is signed only after the record publish/sync and anchor callback succeed. The legacy public arbitrary-callback MailboxJournal::admit now returns explicit DurableAuthorityUnavailable without writing or signing. Private pre-production v1 journal records fail closed rather than silently migrate.

Evidence on this private branch so far: cargo fmt --all -- --check and git diff --check passed; TMPDIR=/tmp cargo test --locked --offline -p mvm-core --lib journal::anchor_tests -- --test-threads=1 passed 6/6 (restart/dedup, wrong key/authority/domain, tamper/truncation, stale CAS, missing anchored history, interrupted anchor commit and legacy callback refusal). First two 60-second foreground attempts timed out compiling from cold target; a detached run initially failed 4/5 only because the terminal's temporary TMPDIR disappeared before tests started; the corrected stable-TMPDIR run passed. Focused Clippy is running; workspace/gated tests and live service validation have not run on this diff. Do not substitute the separate guest owner’s earlier checks for this source.

Unmet gates stay unchecked: no deployed independent remote CAS provider or persistent/versioned history-key custody; the per-launch payload secret is erased and cannot restore retained payloads; FileJournalAnchor remains host-local development-only; the existing hostd service and its old tests still need the owner’s approved dev-ephemeral/prod-refusal gate and adapter; retention/expiry/dead-letter/rotation/snapshot/effect/undo/mvmd migration and host-blind confidential-guest key release are not implemented by this slice. Parent handoff is not published, so a reviewable stacked PR must wait for a qualified/published base. I will not merge or close the issue.

Validation update on the same uncommitted private #4630 diff (base 634d1cc, no PR/merge): cargo fmt --all -- --check, git diff --check, cargo check --workspace, cargo clippy --workspace -- -D warnings, cargo clippy --locked --offline -p mvm-core --all-targets -- -D warnings all passed on macOS. Focused TMPDIR=/tmp cargo test --locked --offline -p mvm-core --lib journal::anchor_tests -- --test-threads=1 passed 6/6, zero failed/ignored; this run includes the fail-closed legacy callback, unsigned version-2 receipt state and authority-bound admission intent. The exact required cargo test --workspace was started but interrupted during compilation before any test verdict: available host disk fell from 117 GiB to 99 GiB in ~4.5 minutes with compilation still underway, on a 98%-full volume. I stopped the test process rather than risk filling the operator’s disk. just check::gated has not run; Linux-specific runtime tests and live durable acceptance have not run on this diff. No checklist item has been checked; live AcceptedDurable remains disabled pending the guest service gate and real independent provider/key custody. A reviewable stacked PR still waits for the reader owner to publish/qualify its private prerequisite.

Combined private-source validation update: feat/4630-durable-mailbox-journal@4b60a0bd0a8ddc20582f6b099f0daa8737fdc0e0 integrates my journal commit 2dbda40ba2 with guest/hostd owner’s local dev-ephemeral/prod-refusal gate 3d3d8600ad, plus a test-only update to obsolete FileJournalAnchor mission cases. Local commits only, no push/PR/main merge. A real independent checkpoint and history-key provider are still absent; no user-visible durable receipt or host-blind claim.

Checks on combined source: cargo check --workspace passed; cargo fmt --all -- --check / git diff --check passed. TMPDIR=/tmp cargo test --locked --offline -p mvm-hostd --test mission_demo -- --test-threads=1 compiled and ran 20 tests: 19 passed, 1 failed. The three updated negative/mock cases passed: local file anchor cannot issue durable acceptance, killed destination still refuses on restart, and guest lease/signed ACK recovery under a test-only CAS anchor. The failing the_mailbox_process_exits_when_its_vm_state_dir_is_removed still calls old served_mailbox_process, which builds helper config with posture: None and assumes the obsolete signed durable FileJournalAnchor path; it now fails closed before dial. An integration test cannot legally forge verified Dev: MailboxLaunchPosture::for_test is #[cfg(test)] pub(crate) and its handoff() is pub(crate). I returned this fixture to the hostd owner for a legitimate verified-admission test path, rather than defaulting Dev or editing runtime outside ownership. cargo clippy --locked --offline -p mvm-hostd --test mission_demo -- -D warnings passed. Prior cargo clippy --workspace -- -D warnings and 7/7 focused core journal tests passed before the owner-gate integration; full workspace tests/gated/Linux/live durable tests remain unchecked. A prior full cargo test --workspace attempt was stopped during compilation because the 98%-full host disk lost ~18 GiB free in ~4.5 minutes; it yielded no workspace test verdict. Publication remains blocked on this fixture, qualified/published prerequisite branch, real custody/anchor integration, and the remaining original acceptance criteria.

The private stacked branch is now clean at feat/4630-durable-mailbox-journal@5d50caa29b81bfb158719eabf53cdf382da620e2 (journal increment + guest owner’s verified-Dev ephemeral/prod-refusal gate + test-only reconciliation, no push/PR/main merge). The guest owner explicitly approved retiring the obsolete served_mailbox_process integration fixture: it required an unverified posture: None helper to mint a signed durable verdict from same-host FileJournalAnchor. The real verified-token lifecycle removal test remains in mailbox_process::tests::the_process_exits_when_the_state_dir_disappears; the integration test now accurately retains missing-posture refusal, local-anchor refusal, and a test-scoped CAS guest lease/ACK restart witness.

Exact checks on this combined source: TMPDIR=/tmp cargo test --locked --offline -p mvm-hostd --test mission_demo -- --test-threads=1: 19 passed, 0 failed/ignored; cargo test --locked --offline -p mvm-hostd --lib mailbox_process::tests -- --test-threads=1: 15 passed, 0 failed; cargo clippy --locked --offline -p mvm-hostd --test mission_demo -- -D warnings, cargo fmt --all -- --check, and git diff --check: passed. Prior final core journal targeted tests 7/7, cargo check --workspace and cargo clippy --workspace -- -D warnings passed on the journal + gate branch before the test-only retirements; those broader checks have not been repeated at 5d50caa. The full cargo test --workspace attempt was interrupted during compile under disk pressure (host ~95 GiB free/98% full now), so no full-suite result; just check::gated and Linux/live durable tests not run.

Independent read-only source investigation found no existing standalone-MVM remote monotonic CAS checkpoint. Existing signed audit roots and FileJournalAnchor remain same-host rollback-domain evidence. The persistent transcript KEK (mvm-core/src/transcript.rs) is a useful wrapped-data-key pattern, but single-version, host-held, not a versioned mailbox-history/recipient-opening-key provider. The approved future trusted-host design therefore still needs a separately operated authenticated CAS endpoint and versioned persistent mailbox-history/payload key custody before accepted_durable can be enabled. Host-blind requires a different attested key-release/memory-protection tier; all #4630 acceptance criteria remain unchecked. A reviewable stacked PR cannot yet be based on the unpublished local guest-reader prerequisite.

Final validation correction for private local 5d50caa29b81bfb158719eabf53cdf382da620e2: after the owner-approved retirement of obsolete unverified helper fixture, I reran on this exact clean commit cargo check --workspace (pass), cargo clippy --workspace -- -D warnings (pass), cargo fmt --all -- --check (pass), TMPDIR=/tmp cargo test --locked --offline -p mvm-hostd --test mission_demo -- --test-threads=1 (19/19 pass), and cargo clippy --locked --offline -p mvm-hostd --test mission_demo -- -D warnings (pass). Core anchored journal tests 7/7 and hostd mailbox-process tests 15/15 were run on the immediately preceding source with only test-fixture retirements afterward. Full workspace test/gated/Linux/live checks remain unverified as previously reported; no PR has been opened because prerequisite guest-reader work is still local/private, and neither external anchor nor key-custody provider exists. All original acceptance boxes remain unchecked.

Security-review follow-up on private clean feat/4630-durable-mailbox-journal@771a822f73d675116977b71102e6c1474cc0e208 (parent 5d50caa, still no push/PR/main merge): an independent reader review found two fail-closed gaps in the prototype journal: recovery accepted stored Leased/ACK records based on codec shape without re-verifying authority/guest signatures, and an exact duplicate ACK returned its tip before current reader reauthorization. This commit re-verifies retained destination-signed Receive capability, enrollment and lease at the historical lease time and the guest ACK under the enrolled key at its signed ACK time, before suffix anchor reconciliation. An exact ACK retry now checks current boot/session/policy/expiry and guest signature before idempotent success.

Negative witness inside the test-only mock-CAS mission_demo decrypts/reseals records with the journal history key, recomputes their HMAC and mock anchor tip, then mutates lease, enrollment, Receive grant and guest ACK signatures; all reopen attempts fail closed even though symmetric storage authentication is valid. Stale boot/session/expired committed-ACK retries refuse without appending. TMPDIR=/tmp cargo test --locked --offline -p mvm-hostd --test mission_demo -- --test-threads=1: 19/19 passed on this diff. cargo clippy --locked --offline -p mvm-core --all-targets -- -D warnings, scoped mission_demo Clippy, cargo check --workspace, cargo clippy --workspace -- -D warnings, cargo fmt --all -- --check and diff check passed. Fresh shared-source read-only review reported no blocker in these changed signed-guest paths; legacy unsigned host ACK remains separate, unchecked design. Full workspace test, gated/Linux/live durable checks still unverified due previously reported disk pressure and missing provider. No independent remote CAS or versioned persistent history/payload key provider exists; no accepted_durable or host-blind claim, and all original acceptance criteria remain unchecked.

Further guest-reader compatibility correction committed on clean private feat/4630-durable-mailbox-journal@cac0122af2f8141d01396ed123b2bcd8d1f988e5 (parent 771a822; no push/PR/main merge). A read-only guest-owner review identified that the legacy unsigned host ACK API could close a guest-leased message, and recovery would accept an encrypted unsigned Acknowledged event after Leased. The journal now returns explicit GuestAckRequired for an ever-leased message before any unsigned ACK append/anchor advance; recovery rejects such an event as corrupt. Never-leased host messages retain their legacy ACK path. No implicit host override of the guest’s signed ACK-after-processing.

Evidence: new core positive test confirms a never-leased host ACK survives restart; test-only mock-CAS mission witness confirms live lease→unsigned-host-ACK refusal and injects a forged v2 encrypted unsigned ACK with valid AEAD/HMAC and matching mock anchor tip, which recovery rejects. TMPDIR=/tmp CARGO_INCREMENTAL=0 cargo test --locked --offline -p mvm-core --lib journal::anchor_tests -- --test-threads=1: 8/8; TMPDIR=/tmp CARGO_INCREMENTAL=0 cargo test --locked --offline -p mvm-hostd --test mission_demo -- --test-threads=1: 19/19. cargo check --workspace, cargo clippy --workspace -- -D warnings, scoped core all-targets and mission_demo Clippy, fmt and diff checks passed. An initial scoped build failed at the macOS linker with unrelated undefined serde symbols after a prior 60-second compiler kill; cargo clean -p mvm-core removed stale generated artifacts and the targeted tests passed on the corrected build. Read-only shared-source review found no blocker in this change. Still absent: real independent remote CAS, versioned recoverable history/payload key custody, qualified published prerequisite, full workspace/gated/Linux/live durability validation; host-blind remains a separate architecture. All original issue criteria remain unchecked.

Architecture correction for #4630, following the owner-delegated decision on #5255 (#5255 (comment)): the immediate standalone trusted-host tier is a NEW versioned accepted_local_durable outcome, not the existing AcceptedDurable. A host-local fsynced encrypted envelope/dedup/ACK journal and local chain can support ordinary process-crash/restart recovery, but cannot prove whole-host rollback resistance or host-blindness. No remote service is required for this weaker local tier; a separately trusted compare-and-advance checkpoint remains required before the stronger existing AcceptedDurable outcome may be used. There is no implicit downgrade or relabeling. Existing Dev Send remains ephemeral/reader unavailable, and production mailbox remains refused until the distinct canonical outcome, version negotiation, persistent versioned history+payload keys in the existing protected host keys directory, signed/restartable admission scope, service integration and tests are real. The per-launch secret stays erased and cannot be the sole recovery key. My private HistoryKeyRef/HistoryKeyCustody v3 journal change is test-scoped work in progress, not a concrete provider or approved public API; raw-key strong acceptance is being made fail closed. All original #4630 boxes stay unchecked; previous remote-anchor comments describe the stronger tier, not a prerequisite for this newly named local tier. No push/PR/main merge is claimed.

Private #4630 journal/custody increment committed at clean local feat/4630-durable-mailbox-journal@d7ec5c8c6cb43e3d68f2c79b93fe7ded813bb450 (parent cac0122). No push, PR, main merge, or acceptance checkbox. HistoryKeyRef now binds canonical tenant/domain/mailbox/recipient, execution epoch, journal-history algorithm/opaque key ID/nonzero version; it is distinct from the envelope encryption-key ID. V3 encrypted records and destination-signed acceptance intents bind that exact ref; existing-only test custody lookup precedes journal creation, and missing/wrong key, key ID/version/epoch, foreign domain and v2-to-v3 reinterpretation fail closed. Raw-key open_with_anchor cannot issue AcceptedDurable; the legacy callback also refuses. The original unsigned receipt body and observation time survive recovery for a future exact local lost-verdict proof, while V1 Duplicate behavior is unchanged. Constructors/open with custody are test/test-support gated; there is NO production verified-scope/restart-manifest provider, no host signer-derived versioned history+payload key adapter, no V2 AcceptedLocalDurable journal path or receipt signer, and no host-blind/whole-host rollback claim. Scoped tests on this source: TMPDIR=/tmp CARGO_INCREMENTAL=0 cargo test --locked --offline -p mvm-core --lib journal::anchor_tests -- --test-threads=1 10/10; corresponding mvm-hostd --test mission_demo -- --test-threads=1 19/19; core all-targets and mission-demo Clippy -D warnings, cargo check --workspace, cargo clippy --workspace -- -D warnings, fmt and diff checks passed. Full workspace tests, gated/Linux/live durable checks remain unverified on this 99%-full host (~60 GiB free). Separate #5255 decision names a future accepted_local_durable tier for software-only trusted host; existing AcceptedDurable still requires independent anchor and remains disabled. Casey owns #5328 verified capsule, report session owns separate private local V2 receipt contract, guest owner owns hostd adapter. All #4630 original boxes remain unchecked.

Scope/provenance follow-up on clean LOCAL feat/4630-durable-mailbox-journal@c56bf7b654d44898e7d6a2449debc5e05d36266a (parent d7ec5c8; no push/PR/main). A decoded HistoryKeyRef is data, not proof of an admitted mailbox. Test now forges serialized key ID, version, epoch, and domain while supplying the same journal key bytes; recovery refuses mismatched retained references or foreign anchor scope without rewriting the anchored history. Production must bind a reference to a verified signed plan/VM and authenticated retained restart manifest before any key lookup or receipt path is enabled. TMPDIR=/tmp CARGO_INCREMENTAL=0 cargo test --locked --offline -p mvm-core --lib journal::anchor_tests -- --test-threads=1: 10/10 passed; scoped all-targets Clippy -D warnings, fmt and diff checks passed on this exact pin. Workspace check/Clippy and mission_demo 19/19 passed on production-code-identical parent d7ec5c8 (only tests/docs changed). Product direction for the immediate standalone trusted-host tier is the distinct V2 accepted_local_durable contract recorded on #5255; it does NOT make FileJournalAnchor an independent full-host rollback proof or permit existing V1 AcceptedDurable. The V2 signer, versioned host history+payload key provider, authenticated manifest, local journal/service adapter, full workspace/gated/Linux/live tests and reviewable published prerequisite remain absent. All #4630 original acceptance boxes remain unchecked.

Taking on the remaining trusted-host local tier as a coordinated stack, not a claim that it is already enabled. Sequence: (1) merge/review the canonical V2 accepted_local_durable contract and Casey-owned V2-only receipt signer/verifier without changing V1 signatures; (2) bind #4630 journal admission/recovery to Casey’s borrowed VerifiedMailboxScope and add admit_local with byte-identical original signed receipt on exact retry; (3) integrate a hostd-owned authenticated restart manifest and separate versioned, load-existing history/payload-opening keys under the protected host keys directory, refusing missing keys/signer rotation; (4) adapt the existing hostd mailbox service (no second service), then exercise crash/restart, tamper, wrong-key/domain, quota/expiry and live local workflow. I requested Casey’s exact signer/API pin at #5328 (comment). The guest/hostd owner retains service/key-lifecycle files until an explicit handoff; I will not edit those files concurrently. Current private #4630 journal pin c56bf7b654d44898e7d6a2449debc5e05d36266a remains a test-scoped custody prerequisite, with no production local or V1 strong receipt path; Dev Send remains ephemeral/Reader unavailable, Prod mailbox launch refused. Focused journal 10/10 and mission demo 19/19 were last run on the journal pin/production-code-identical parent; full workspace tests, gated checks and live qualification are not yet verified on the combined stack, and the host has ~49 GiB free at 99% usage. The new V2 local tier does not detect malicious whole-host rollback or provide host-blindness; the stronger AcceptedDurable still needs an independent anchor. Keep all #4630 acceptance criteria unchecked pending exact evidence. No private branch push/PR/main merge or issue closure in this update.

Integration checkpoint: I combined the guest-owned private contract stack at 62451aeb8db53ee040d5fdd9a6327ffacf89cbb2 into my private #4630 branch (382e3e41be) and resolved the only overlapping mission-demo fixture wording; 037154bde50b94721b73109e4a1e2c6db1bc5f35 adapts journal recovery to the newly optional report grant. This is NOT activation. cargo test --locked --offline -p mvm-contract --test mailbox_receipt passed 3/3, cargo check --locked --offline -p mvm-core -p mvm-hostd --tests passed, fmt/diff checks passed. Focused core test compilation exceeded the local 120s tool limit twice, with no verdict. For an enabled local tier I need a non-overlapping owner handoff: Casey, please supply the V2-only core receipt signer/verifier pin and #5328 verified-scope integration pin (requested on PR #5328); guest/hostd owner, please either own and provide an exact pin for the authenticated restart manifest, separate versioned persistent history and payload-opening custody, and existing-service bind_local adapter, or explicitly hand off those hostd files to me. I will implement the journal admit_local/recovery/exact-retry seam on my owned journal file once the signer and verified scope pins are available, without duplicating either service or signer. No strong V1 durable receipt, production gate change, push, or issue checkbox is justified by this composition yet.

Ownership update: requester explicitly authorized me to take on enabling the separate trusted-host accepted_local_durable tier. I am taking integration ownership in my private #4630 branch, including the V2 signer, verified restart/key custody, journal admit_local, and existing hostd service adapter; prior #4629/guest contributors, please pause overlapping edits to hostd mailbox service/launch/process/reader and send any in-flight exact source pin now. I will preserve Dev ephemeral and Prod refusal until complete, and will not change PR #5328 or publish the private guest branch without coordination. This does not authorize strong V1 AcceptedDurable, host-blind claims, shared-main merge or closing #4630.

Private progress pin b1d351c01ca9159442ac411e0736cf6d3abc5419: combined the private V2 contract and published #5328 verified-admission capsule, added V2-only receipt signing (629f98b4e3) and test-scoped local journal admission/recovery with same-host fsync anchor and byte-identical original signed receipt on exact retry. The local journal test passes restart, exact retry and journal-only rollback; mailbox::journal::anchor_tests 11/11, focused V2 signer 1/1, cargo check --locked --offline -p mvm-core -p mvm-hostd --tests, scoped core all-target Clippy -D warnings, fmt and diff checks passed. Not enabled in production: authenticated restart manifest, persistent distinct versioned history/payload-opening keys and existing-service adapter are still missing. Default build keeps local opener test-gated; Dev stays ephemeral, Prod refused. V1 strong AcceptedDurable still requires independent remote CAS. All #4630 acceptance boxes remain unchecked. No branch push, PR, main merge or closure.

Implementation checkpoint (private branch, NOT enabled): exact clean pin 434cca038bfc2325bf13b51e4080af9646dfc2b3. Integrated published #5328 verified-admission commits onto the private journal/guest composition, retaining the old OpenedMailboxMessage/open_authenticated_envelope compatibility wrapper while using Casey’s nonforgeable borrowed capsule. Added canonical V2-only local receipt signer/verifier (629f98b4e3), selected by validated version/outcome before signing or verifying; V1 receipt bytes unchanged. Added distinct test-scoped local journal opener and admit_local (b1d351c01c): fsync encrypted canonical frame + replay identity in one record, advance fsynced same-host file anchor, THEN sign V2; exact retry rechecks current authority and anchor tip, returns byte-identical original signed receipt after restart; strong V1 path cannot accept local tier. Added a guest-reader grant fixture (434cca038b) for the merged optional report policy. Evidence on exact composition: core mailbox crypto 26/26; journal anchor 11/11; contract receipt 3/3; cargo check --locked --offline --workspace and cargo clippy --locked --offline --workspace -- -D warnings passed; fmt/diff checks passed. Not production activated: local opener remains test-support only; persistent versioned history/payload-opening key custody, authenticated restart manifest, finite retention/expiry lifecycle and existing-service adapter are not yet integrated. Dev Send remains ephemeral/Reader unavailable; Prod mailbox launch refused; no independent anchor and no host-blind claim. Do not check #4630 boxes, close, or merge. No push/PR yet because this composition contains previously private guest work still pending qualification.

Durable-store handoff for proposed ADR-059 in draft #5304, tracked by #5126: a new task held while a dev VM rebuilds is a sender-owned, not-yet-dispatched outbox intent, not an accepted_durable destination message. A journal must not mint a destination receipt from this intent or rewrite an old signed envelope for the new epoch. The sender creates/persists a freshly authorized envelope only after replacement admission, recording a dispatch-start marker before I/O; once dispatch may have occurred, retries use the same signed bytes/ID while authority and epoch remain valid, otherwise outcome is unknown. Already accepted old-epoch messages remain pinned by default; opt-in conversation transfer needs a separate authenticated current-consumer delivery decision, old-owner fence, scoped key release and ADR review. Please reconcile this with #4630's store state machine before implementing outbox or acceptance claims. #5304 does not edit the journal or claim any checkbox complete.

Private #4630 implementation checkpoint, not production activation: 54a47bbc9ceebee6432119d95fed240a84c12943 adds test-scoped hostd custody with three separate random purpose keys in the protected host keys directory and a host-signed, versioned restart manifest binding admitted plan/nonce, VM, canonical host template address, epoch, authority and signer. It loads only existing signer/key material; partial first provision, missing or altered keys, forged manifest, wrong domain/epoch, symlinked file and signer loss/rotation refuse. Hostd custody focused tests 4/4 passed; hostd cargo check --locked --offline -p mvm-hostd --tests passed. baa6dd15bbd3a8ba9e662c644866a78fe652862b adds authority-signed, committed terminal expiry with recoverable receipt after interrupted local anchor advancement, refusal of ACK/acceptance after expiry, and valid-MAC/forged-signature recovery negative. Feature-scoped integration test cargo test --locked --offline -p mvm-core --features test-support --test mailbox_crypto local_journal_expiry_recovers_after_interrupted_anchor_commit -- --exact 1/1 passed; core cargo check --tests and cargo clippy --all-targets --features test-support -- -D warnings passed. Core lib-unit runtime compilation stalled under concurrent host builds; those tests compiled under cargo check --tests but are not claimed run on this exact pin. The local opener and custody prototype remain test-scoped, Dev Send ephemeral/Reader unavailable and Prod mailbox preboot refusal unchanged. Missing before enablement: authenticated provider handoff through the existing service, guest signed-receipt wire compatibility, bounded retention/compaction with dedup through expiry+window, full workspace/gated checks and live crash/guest witness. Strong V1 AcceptedDurable still requires an independent rollback anchor; host-blind remains unchecked. No private branch publication, PR, main merge, issue closure, or acceptance checkbox change.

Private #4630 integration checkpoint (branch feat/4630-durable-mailbox-journal, clean pin 385619f4a394704492c6595a919066b107b87f8d; not production enabled). Reused the existing journal-backed mailbox service: 23e92584e9 binds a local fsynced anchor and signs distinct V2 accepted_local_durable after ciphertext+dedup commit; host socket retries recover the original byte-identical receipt and V1 strong clients refuse local proof. 57bbdaba74 adds a separate guest outbox-local request on the same mailbox port, requiring a boot-pinned destination V2 signature/message ID/epoch before clearing the pending guest file. Unit responses or wrong signatures leave it pending; typed Expired archives a bounded terminal rejection. Host service returns signed V2 on its local guest route, and an exact source retry reuses the persisted canonical sealed frame/attempt marker rather than resealing. Proposed ADR-059/#5126 outbox intent remains distinct from destination acceptance and no old-epoch transfer is claimed (coordination: #5304 (comment)). 385619f4a3 test-binds the retained history/payload/anchor keys to the host-derived launch template; cross-boundary custody/journal restart test passed 1/1. Evidence on this exact private pin: cargo test --locked --offline -p mvm-hostd --test mission_demo -- --test-threads=1 20/20, cargo test --locked --offline -p mvm-agentd --lib mailbox_outbox::tests -- --test-threads=1 16/16, guest-agent mailbox bin 6/6, cargo check --locked --offline --workspace and cargo clippy --locked --offline --workspace -- -D warnings passed; fmt/diff clean. Core frame focused unit test is building separately, not yet claimed. Gate remains: hostd retained custody is test-scoped, real helper/reader/intent handoff is not wired, signed-plan finite retention/anchored compaction not implemented, and Dev remains ephemeral/Prod mailbox launch refused. No full workspace tests, gated Linux/BDD checks, live guest/cold-boot witness, PR/push/main merge/issue closure or checked acceptance criteria. V1 AcceptedDurable still needs an independent anchor; host-blindness remains unchecked.

Retention/compaction design checkpoint before enabling local-durable production: recommend a versioned finite retention window in the signed mailbox grant, absent on old plans (which remain ephemeral/Prod-refused) rather than inventing an implicit duration. Host record/byte/attempt ceilings still intersect it. At expiry, commit the signed terminal outcome. After expiry plus the declared window, a bounded encrypted, destination-authenticated snapshot must retain all still-live delivery state and dedup tombstones, be fsynced and advance the local chain tip before any superseded journal records are pruned. Recovery after each interruption uses either the intact old prefix or the committed snapshot; a gap, oversized snapshot, full disk, missing key, or unprovable tombstone refuses rather than resetting history. This is a proposed implementation direction, not a shipped compactor or whole-host rollback guarantee. What retention duration should the first typed-report mailbox require? I will keep production refused and avoid a guessed default until that product value is chosen.

Navigation Menu

Repository navigation

Persist encrypted mailbox journals, snapshots, and effect receipts #4630

Agent pickup triage

Outcome

Scope

Acceptance criteria

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Persist encrypted mailbox journals, snapshots, and effect receipts #4630

Description

Agent pickup triage

Outcome

Scope

Acceptance criteria

Activity

auser commented on Nov 11, 2026

auser commented on Nov 11, 2026

auser commented on Nov 11, 2026

auser commented on Nov 11, 2026

auser commented on Nov 11, 2026

auser commented on Nov 11, 2026

auser commented on Nov 11, 2026

auser commented on Nov 11, 2026

auser commented on Nov 11, 2026

auser commented on Nov 11, 2026

auser commented on Nov 11, 2026

auser commented on Nov 11, 2026

auser commented on Nov 11, 2026

auser commented on Nov 11, 2026

auser commented on Nov 11, 2026

auser commented on Nov 11, 2026

auser commented on Nov 11, 2026

auser commented on Nov 11, 2026

auser commented on Nov 11, 2026

auser commented on Nov 12, 2026

auser commented on Nov 12, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions