Self-hosted Store Authority v0.1

Status and scope

This specification defines the content-store production-authority slice of SD-STORE under R4.2.e. The artifact-loaded bindings core/store::authority and core/store::verify-authority are the sole production semantic producers for core/store::{put,has,get,verify}: payload and lowercase-hash admission; canonical artifact bytes; local-integrity verdicts; local/remote source selection; operation and cumulative cache-write budgets; self-hosted CoreForm parsing; canonical whole-store inventory selection and order; verification bounds; first-failure attribution; and content identity.

This slice does not promote SD-STORE above H0. Internal direct-store consumers, package/registry/VCS storage decisions, and non-store canonical identities remain host-authoritative and must be migrated before the row or R4.2.e can close.

Protocol

The request kind is genesis/store-authority-request-v0.1. A put request is an exact map with :budget-limit, :budget-used, :kind, :max-bytes, :payload, :phase, and :v. :phase is :put; :payload must contain exactly :artifact; byte limits are nonnegative integers and the cumulative limit may be nil.

The authority prints the artifact with the self-hosted canonical printer, converts that exact string to UTF-8 bytes, enforces the operation and cumulative limits, computes plain BLAKE3 over those bytes, and returns an exact genesis/store-authority-result-v0.1 envelope bound to the canonical request hash. A semantic denial is an accepted protocol result with :action :error. An open, mistyped, unsupported, or version-mismatched request is a protocol rejection and cannot authorize a write.

For :action :write, the result includes the exact bytes, lowercase hash, and byte count. Rust rejects open or contradictory results, independently checks only the mechanical byte-count and BLAKE3 binding, writes exactly the authorized bytes through the existing write-once atomic store mechanism, and requires the mechanism’s returned hash to equal the authorized hash. No write occurs before authority acceptance.

has uses exact genesis/store-has-authority-request-v0.1 and genesis/store-has-authority-result-v0.1 envelopes. An initial :plan request validates the payload and returns :observe-local with the request-bound lowercase hash before Rust performs any path operation. Rust then reports only a bounded local byte/hash observation. GenesisCode returns presence, corruption, I/O/resource failure, or :fetch-remote; only the latter permits a policy-authorized remote presence probe, whose raw boolean or mechanism error is returned for the final verdict.

get analogously uses exact genesis/store-get-authority-request-v0.1 and genesis/store-get-authority-result-v0.1 envelopes. After :observe-local, Rust reports bounded stable bytes, missing, size overflow, or I/O failure. GenesisCode checks BLAKE3 identity, parses the exact bytes with selfhost/parse::parse-term, decides local corruption versus remote hash mismatch, and either returns the artifact or authorizes a remote fetch. The remote mechanism reports bounded bytes or an exact transport integrity outcome; GenesisCode assigns the public verdict. Remote bytes are admitted only after identity, parse, operation-limit, and cumulative cache-write checks; :cache-return binds the exact bytes, hash, artifact, and byte count before the host may perform its write-once cache mechanism.

verify uses exact genesis/store-verify-authority-request-v0.1 and genesis/store-verify-authority-result-v0.1 envelopes. The :plan phase validates the exact {:hash nil|string} payload before any inventory or path observation. A specific lowercase hash directly selects one bounded hash observation. A whole-store request first authorizes :observe-inventory; Rust returns only a bounded, raw-byte-sorted vector of exact {:kind symbol :name bytes} entries. GenesisCode independently verifies strict ordering and shape, selects only regular files whose raw names are exactly 64 lowercase hexadecimal bytes, and returns the ordered hash vector to observe.

Rust then streams each selected file through a bounded BLAKE3 mechanism without retaining the full artifact, returning exact hash, observed-byte count, and closed status observations. GenesisCode re-derives the selected hash inventory from the original entries, rejects order or substitution drift, enforces the 32 MiB per-artifact and 512 MiB cumulative ceilings, compares each observed hash to its selected identity, and returns success or the first raw-byte-ordered failure with an exact checked count. Missing specific artifacts are core/store/not-found; disappearing scan entries and hash mismatches are core/store/corruption; host read and inventory failures use stable nondisclosing core/store/io-error; bounded overflow is core/caps/resource-limit. Unsupported observation statuses are protocol rejections, not host-selected semantic errors.

Production and fallback boundary

Production CLI policy loading records the exact self-host bootstrap mode and artifact path. A run that admits core/store::{put,has,get,verify} loads both store authority bindings from that artifact once and fails closed if either authority is absent or invalid. The prior Rust producers are compiled only for unit tests and the explicit parity-oracle feature used by dedicated parity binaries; they are not standard production fallbacks.

Rust retains TOML transport, already-authorized operation-limit extraction, bounded artifact bootstrap/evaluation, stable bounded file reads, policy-authorized remote HTTP/auth/integrity mechanisms, BLAKE3 and byte-count contradiction checks, bounded raw directory enumeration, regular-file type observation, raw-byte sorting, bounded streamed hashing, directory creation, atomic write-once filesystem mechanics, durability sync, concurrent-writer handling, and sealed host-I/O error transport using stable nondisclosing messages. GenesisCode validates the host-provided order, entry shape, selection, observation binding, and all semantic verdicts. Host mechanisms cannot select an unapproved hash or source, parse an artifact, alter payload admission, bytes or limits, or assign final presence/integrity outcomes.

Resource bounds and evidence

Authority evaluation is bounded to 20,000,000 steps, 160,000,000 allocation units, 40 MiB byte/string values, 16,384 vector entries, and 32 map entries per request. The store capability retains the lower 32 MiB hard artifact ceiling. Whole-store verification additionally admits at most 8,192 raw entries, 2 MiB of cumulative raw entry-name bytes, and 512 MiB of cumulative artifact bytes. Limit arithmetic is saturating in the host mechanism and rechecked from exact observations by GenesisCode.

scripts/lib/selfhost_store_authority.py verifies profile and both source identities, artifact custody, all four exact protocols, planner-before-I/O and authority-before-write ordering, bounded raw inventory and streamed hash observations, exact parse/cache/inventory binding, strict result decoding, parity-only fallback isolation, native CLI coverage, truthful H0 ledger scope, and permanent source/route mutations. Its report is evidence for this partial slice only and cannot promote SD-STORE, close R4.2.e, replace later runtime tests, or authorize a release.