myc

README (36463B)

---

 # mycorrhiza
 
 This is the README for `myc` which provides a Nostr remote signer for
 standalone and application-embedded clients.
 
 ## Public API boundary
 
 The library exposes one curated crate-root API. All implementation modules are
 private, and public errors use Myc-owned stable classifications with redacted
 diagnostics and no raw dependency-owned source chain. The shared runtime-path,
 service-SQLite, and storage identity values that appear in signatures are
 intentional governed contract types; raw SQLx, provider, transport, Serde, and
 task authority never crosses this boundary.
 
 The runtime foundation is sealed and cannot be forged or reached through a
 child module:
 
 ```compile_fail
 use myc::runtime_foundation::MycRuntimeFoundation;
 
 fn forge(_: MycRuntimeFoundation) {}
 ```
 
 The reviewed all-features surface is frozen in the
 [Myc API baseline](contracts/api_baselines/myc.txt).
 
 Status publication and cached snapshots can be obtained only through the
 validated factory and its sealed handles:
 
 ```compile_fail
 use myc::{MycStatusPublisher, MycStatusSnapshot};
 
 let _publisher = MycStatusPublisher {};
 let _snapshot = MycStatusSnapshot {};
 ```
 
 The native package, artifact, and dependency-trust boundary is frozen by
 `contracts/services_hardening/native_release.v3.json`. Linux x86_64 and
 aarch64 are the only admitted native artifact targets. `cargo xtask
 native-release` consumes an exact prebuilt target binary from a clean Git head
 and deterministically writes or checks the complete binary/source archive,
 systemd, configuration, source-lock, SBOM, notices, checksum, manifest, and
 unsigned provenance inventory outside the source tree. The source archive
 vendors the exact locked Cargo graph and proves an offline metadata read before
 packaging. Signing credentials and parent-owned human documentation are never
 inputs.
 
 The standalone Linux systemd boundary is frozen by
 `contracts/services_hardening/systemd_qualification.v1.json` and checked by
 `scripts/verify-systemd.sh`. The instance unit uses the canonical service-host
 paths, fixed unprivileged account, restrictive directory modes and umask,
 fixed restart delay, bounded stop behavior, empty capabilities, no environment-based secret
 input, and the reviewed filesystem, kernel, namespace, process, and address-
 family protections. The Linux-only verifier requires systemd 252 or newer,
 runs syntax verification, and rejects an offline security exposure above 3.0.
 Type `simple` remains deliberate: readiness is the cached CLI/admin contract,
 not `sd_notify`. Compatibility-sensitive `MemoryDenyWriteExecute` and syscall
 filters remain deferred to the Step 229 integration wave rather than being
 enabled without real-binary evidence. This qualification does not install,
 enable, start, stop, or deploy a production service.
 
 The canonical service source lock binds the exact active public Lib cohort,
 Cargo lock, verified Lib source archive, toolchain, feature profile, and
 service contract versions. Source-lock v3 binds the public flake lock to the
 same exact Lib revision as Cargo and records qualified Nix material for only
 macOS aarch64 and Linux x86_64. The Linux-only NixOS module and unsigned OCI
 derivation are build outputs; signing, tags, publication, deployment, and
 production activation remain unclaimed.
 
 ## Hardened v1 configuration contract
 
 The target service configuration is frozen by
 `contracts/services_hardening/config.v1.schema.json` and the canonical
 non-secret `config.v1.example.toml`. It is one strict, immutable TOML document
 with explicit identity, relay, authorization, rate, and discovery authority.
 Only reviewed bounded operational leaves have defaults. Bootstrap profile,
 instance, repo-local root, and config-path selection are CLI concerns and are
 not document fields.
 
 The hardened CLI parser admits the common command tree in one parse. It
 requires explicit `--profile <service-host|interactive|repo-local>` and
 `--instance <validated-instance-id>` selectors, requires an absolute
 `--repo-local-root` only for `repo-local`, and accepts only an optional absolute
 `--config` path. Its exact command inventory is `run`; `config
 init|validate|show|schema|apply`; `state init|status|backup|restore|verify|migrate`;
 `identity init|status|export-public`; `status`; and `doctor`. Identity rotation
 is an offline create-new/config-apply lifecycle and is intentionally absent
 from the live CLI and Unix-admin inventories.
 The process binary uses only this parser and consumes its sealed execution plan
 exactly once. Every command reaches its governed config, state, identity,
 Unix-admin, doctor, or daemon authority. `run` installs the authoritative
 bounded daemon graph; no admitted command can return success through a
 prototype or unavailable-operation fallback.
 
 The selected absolute config path is opened no-follow through its retained
 parent descriptor. The loader requires a regular, single-link,
 effective-user-owned file with no group/other-write permission, caps bytes
 before parsing, and revalidates device, inode, length, and parent identity after
 the read. Config initialization consumes bounded non-secret TOML from stdin and
 uses create-new `0600` persistence plus file and parent synchronization. Secret
 identity provisioning is a separate fixed 117-byte zeroizing stdin document;
 secret arguments, environment values, JSON strings, and trailing bytes are not
 accepted.
 
 One binary-owned Tokio runtime is created from the validated fixed thread
 limits for each asynchronous command process; there is no CPU-derived default
 or library-owned runtime. Existing-state commands discover actual metadata
 through the retained shared intent. Offline backup writes the exact canonical
 manifest bytes to stdout without a trailing newline, so direct redirection
 preserves the bytes bound by its digest. Restore derives expected backup identity
 from the trusted manifest digest rather than requiring the damaged live
 database to open, and exclusive commands retain the writer-authority boundary.
 Deployment directory provisioning remains outside the service executable.
 
 The parsed invocation is projected once into a sealed execution plan. `run`
 selects daemon authority; config, exclusive state/identity provisioning, and
 doctor select offline authority; state/identity/service inspection and live
 mutations select the permissioned Unix-admin authority. Only explicitly
 read-only status, backup, and public-identity operations may fall back when a
 later executor proves the daemon writer lock is free. No live plan carries
 SQLite authority.
 
 The active doctor boundary executes the exact 13-check operator inventory in
 contract order under fixed per-check deadlines. Check implementations retain
 their filesystem, SQLite, provider, bind, network, relay, and clock authority;
 only closed pass/fail/skipped observations cross into the report builder. The
 builder enforces required-check semantics, returns exit 6 for required failure
 or timeout, and emits at most 8,192 bytes of compact canonical JSON using only
 fixed summaries and remediation codes. Raw errors, paths, relay URLs,
 credentials, public keys, and arbitrary detail strings cannot enter the report.
 A pass requires every machine-listed scope facet. Probe futures own their work,
 must stop safely when dropped at deadline, and may not detach later mutation.
 The production adapter composes secure path and disk inspection, writer-lock
 and SQLite authorities, exact schema and outbox checks, provider opening and
 Describe verification, validated bind/network policy, and bounded required-
 relay reads. It never publishes a relay event. Clock skew remains the sole
 optional `Skipped` check until a trusted time source is governed.
 
 The service status boundary uses the shared service-host lifecycle contract
 behind one Myc-owned non-clone publisher and cloneable passive readers. Each
 publication validates the lifecycle transition and encodes the complete
 bounded `service_status_v1` payload before atomically replacing the single
 retained immutable snapshot. Repeated reads return that exact cached value and
 perform no SQLite, provider, relay, credential, DNS, clock, filesystem, or
 fresh-probe work. Connection counts use the closed pending/active/denied/
 expired vocabulary, identity health uses the fixed transport/user/discovery
 roles, failed publication preserves the last valid snapshot, and detailed
 status remains local to the permissioned Unix-admin surface. Status reason
 codes use a closed twelve-value vocabulary; arbitrary strings cannot enter the
 cached response.
 
 The optional TCP operations adapter consumes that same supervisor publication
 through a second passive bounded projection and delegates the transport to the
 source-locked service-host server. It exposes exactly HTTP/1.1 `GET /livez`,
 `GET /readyz`, and `GET /metrics`; every other method, path, or query is
 unrouteable. The two Prometheus families are the cached phase and cached
 readiness bit with only the closed phase label. Requests perform no SQLite,
 filesystem, provider, relay, credential, DNS, or fresh-probe work; the shared
 transport still reads its monotonic deadline clock.
 Detailed status, configuration, paths, identities, connection/audit data, and
 all mutations remain on the permissioned Unix-admin surface. The listener is
 disabled unless the validated configuration explicitly enables and binds it,
 and its parser floor, headers, response, concurrency, deadline, and idle bounds
 remain enforced by the shared server.
 
 Process outcomes use one exact seven-value vocabulary with exit codes 0
 through 6. Diagnostics are compact single-line JSON on stderr; result data is
 reserved for stdout, and Myc never writes log files. The structured record
 admits only the closed level, event, result, lifecycle, task-failure, and signal
 codes. It accepts no caller text, path, SQL, raw cause, identity, relay URL,
 credential, secret, or decrypted content. Every public Myc error remains a
 crate-owned source-free classification, so ordinary `Display`, `Debug`, and
 whole-chain traversal cannot bypass redaction. Current binary dispatch reports
 invalid input as exit 2 and service dependency unavailability as exit 3. The
 Myc runtime owns one sealed, bounded critical-task graph over the shared supervisor:
 task error, panic, join failure, unexpected cancellation, or critical success
 before cancellation coordinates shutdown, joins every task, and maps to the
 fixed nonzero process result. Tasks receive only a cooperative cancellation
 observer; task names and handles remain internal. The binary owns signal
 installation. The graph uses one configured absolute graceful-shutdown deadline
 for mutation rejection, ingress and operations drain,
 recoverable-work persistence, network and SQLite close, and socket close; it
 adds no hidden second cleanup budget.
 
 `parse_myc_config_v1` caps original bytes before decoding, checks the schema
 header before closed contract admission, rejects duplicate, null, unknown, and
 semantically inconsistent input, and returns an immutable document plus a
 deterministic redacted effective-configuration projection. Every projected
 leaf records whether it came from the document or one of the exact governed
 default authorities. Ordinary errors and `Debug` output contain no source
 text, paths, credentials, relay URLs, or identity values.
 
 The prototype environment loader, `.env` example, environment selectors,
 implicit command/profile selection, compatibility aliases, and arbitrary leaf
 flags have been removed. Bootstrap now resolves a sealed runtime context from
 the validated CLI profile and typed instance ID through the source-locked
 `radroots_runtime_paths` authority. Config, state, cache, logs, run, secrets,
 `config.toml`, `state.sqlite`, `state.lock`, and `admin.sock` are derived under
 the exact `services/myc/<instance>` namespace. The service contains no local
 host-environment resolver, worker namespace, ambient selector, or implicit
 path default. An explicit absolute `--config` may select the document to read
 without changing the canonical common artifact inventory.
 
 ## Governed state boundary
 
 Create-new initialization reserves the shared schema-v1 metadata and migration
 ledger, retains exclusive writer authority, applies the exact Myc schema-v2
 through schema-v12 migrations, binds the normalized configuration, expected
 identity roles, and policy versions through a sealed typed repository, and
 explicitly closes the host before reporting success. Existing writable open can
 resume any exact v1 through v11 prefix or admit the current v12 catalog;
 read-only inspection requires the current catalog and exact latest Myc binding.
 
 Schema v10 adds an append-only configuration-binding history capped at exactly
 1,024 generations. Generation 1 is seeded only after the v10 migration commits,
 including for an upgraded v9 database, while the immutable original birth
 record remains unchanged. `apply_configuration` is admitted only through an
 exclusive writable host and independently validates the retained current and
 candidate documents before one atomic append. A changed identity expires live
 sessions and pending challenges; permission narrowing expires only sessions
 whose retained grants are removed. Removing or changing a relay that is still
 referenced by nonterminal delivery work fails closed, while safe relay additions
 remain admissible. Exact replay returns the retained generation without another
 append or revocation, including after an ambiguous caller result. Future startup
 must present the latest normalized config and public-identity binding. The
 history stores only digests, public identities,
 closed contract versions, injected application evidence, and safe build
 identity; it stores no credentials, provider envelopes, paths, or relay URLs.
 
 Schema v11 adds the bounded admin-operation journal. It binds each mutation's
 validated operation ID to its fixed route and canonical request digest, retains
 at most 128 unresolved Prepared records and 4,096 completed responses, caps a
 replayed response model at 8,192 bytes, and prunes only a bounded expired
 completed prefix before admission. The journal stores no request body, path,
 correlation ID, credential, bundle path, or secret. Completed responses use an
 explicit retention policy whose admitted range is 1 through 31,536,000,000
 milliseconds; the governed operating value is seven days.
 The admin response transport admits at least 8,382 UTF-8 bytes so the maximum
 retained model plus the maximum safe correlation identity always fits its
 canonical success envelope.
 
 Schema v12 adds immutable response authority for a connect request awaiting
 explicit approval. Myc signs and atomically retains the exact
 `pending_connection` response with its initial delivery job before relay
 publication, without recording a false terminal operation completion. Exact
 replay and delivery use only the retained signed bytes, and a later terminal
 response cannot conflict with the pending authority.
 
 The Step 159 provider and delivery boundary is sealed inside the crate. Both
 governed provider kinds execute only fully bound operations, and every result
 is independently verified before it becomes authority. Protected blocking
 work is joined, local-signer calls use the hardened Unix-admin client, and no
 raw provider client, secret, callback, or dependency-owned error crosses the
 public API.
 
 Relay publication uses only the exact source-locked
 `radroots_transport_nostr` adapter. Preparation validates the exact committed,
 signature-verified event bytes without network I/O. The delivery worker then
 persists Submitted immediately before execution. Accepted, rejected,
 transport-failed, and unknown acknowledgements remain distinct; cancellation
 or lost acknowledgement after Submitted is durably unknown, and retries never
 alter the committed bytes. Provider or relay work never occurs inside a SQLite
 transaction. The secure command executor and production daemon graph use these
 same provider, relay, and exact-byte delivery boundaries.
 
 The production `run` path owns the exact five-role bounded graph:
 `admin_server`, optional `operations_server`, `relay_ingress`,
 `provider_dispatch`, and `delivery_outbox`. It creates no task per request or
 relay. Required relay subscriptions and provider handshakes complete before
 Ready; bounded reconnect publishes Unready when a required dependency is lost,
 while optional operations loss publishes Degraded. NIP-46 dispatch verifies,
 decrypts, admits, authorizes, executes providers outside transactions,
 re-encrypts in the verified request context, signs through the transport provider,
 and atomically commits completion, exact response bytes, immutable targets,
 and initial outbox state. Completed replay never re-executes a provider.
 
 Schema v8 adds immutable NIP-46 operation-completion evidence. The Step 147
 integration checkpoint binds each durable request to its stable operation and
 correlation identities, terminal connect authority or exact active session,
 safe completion reason, and any independently verified inner signed-event
 bytes and digest. Logout revocation and completion insertion share one
 transaction, exact replay returns the stored decision, and failed transactions
 expose neither effect. Protected provider output is never persisted. This is an
 integration component, not the final production response boundary: Step 148
 must compose it with the outer signed response bytes, immutable relay targets,
 and initial outbox state in one transaction before RCLD-RSHR-080 can be
 promoted to `master`.
 
 Schema v9 closes that production boundary. `commit_nip46_response` admits only
 an independently signature-verified, canonical kind-24133 response bound to the
 original client and exact provider signing operation. One SQLite transaction
 commits the Step 147 completion, exact response bytes and SHA-256 identity,
 immutable configured relay targets, pending delivery job, and zero-attempt
 target state. Exact replay returns only the retained response bytes; partial
 legacy completion state and mismatched replay fail closed. Provider execution
 and relay I/O remain outside the transaction.
 
 Step 149 closes the repository-owned delivery recovery boundary without
 claiming the final daemon task graph. New jobs can be created only by the
 atomic signed-response or discovery commit and are rejected at the configured
 active-outbox ceiling. Attempt resolution persists caller-injected,
 attempt-cap-bounded full jitter; restart recovery scans fixed 128-job cursor
 batches, revalidates exact signed source bytes and bounded attempt histories,
 recovers only expired leases, and idempotently promotes proven desired
 discovery. It performs no relay I/O and creates no task, clock, or entropy
 authority. Explicit desired/current offline NIP-05 export re-reads verified
 state, works through read-only inspection, and returns canonical compact
 `names` plus NIP-46 discovery JSON without hosting it.
 
 The implemented v1 Myc administration adapter registers the exact 19-route
 inventory and validates every request and response against all 32 model
 references in `contracts/services_hardening/operator_contract.v1.json`. It
 reuses the hardened Lib HTTP/1.1-over-Unix server for original-wire duplicate
 and null rejection, percent-decoded bounded path parameters, peer admission,
 deadlines, concurrency, body limits, and effective correlation IDs. The Myc
 boundary additionally rejects unknown or missing model fields, invalid query
 types, noncanonical response JSON, unsafe URLs and identifiers, and response
 model drift. Raw shared-host routers and JSON values never cross the public
 API.
 
 The domain handler receives compact canonical model bytes plus the durable
 operation ID. A successful mutation means its contract-defined local effect
 and operation audit are committed; it does not claim relay submission or
 delivery. Identical operation-ID reuse must return the original committed
 result, different-byte reuse returns `operation_id_conflict`, and pagination
 cursors remain authenticated to the same route, filters, and snapshot. Unit 13
 seals that handler boundary inside the production `MycAdminServer`,
 projects the exact admitted admin transport limits, and binds only the
 canonical permissioned `admin.sock` through the shared host authority. The raw
 router, listener, entropy source, and cancellation token remain private. The
 existing sole status publisher feeds both detailed local status and the
 optional passive three-route TCP operations server, while doctor continues to
 accept only its exact injected 13-check probe inventory. Unit 14 supplies the
 secure CLI/config bootstrap and concrete doctor probes. Unit 15 alone owns task
 spawning, provider/relay wiring, readiness, reconnect, and phase-aware
 shutdown.
 
 The transport capability and admitted request remain non-forgeable outside
 the crate:
 
 ```compile_fail
 use myc::{MycAdminRequestDocument, MycAdminRouter};
 
 let _request = MycAdminRequestDocument {};
 let _router = MycAdminRouter {};
 ```
 
 The public Myc repository exposes no raw pool, connection, transaction-control
 handle, path, or SQL. Binding and request-admission mutations execute only
 inside the shared `ServiceSqliteTransaction` runner. Provider and relay work
 cannot occur inside that transaction boundary. The v2 binding table, v3
 request/dedup tables, and v4 connection, permission, request-decision, and
 authorization-challenge tables and guards are checksum-pinned service-owned
 schema objects. Schema v5 adds checksum-pinned audit-sequence, safe operation
 audit, request-audit binding, and bounded rate-window objects. Schema v6 adds
 checksum-pinned publication-job, target, attempt, transition-guard, and
 no-delete objects. Schema v7 adds desired/current discovery state, exact signed
 NIP-89 event bytes, deterministic NIP-05 projection inputs, and their delivery
 binding.
 
 The earlier JSON signer store, JSONL audit log, separate signer/audit/outbox
 SQLite databases, prototype import/backup adapter, independent migration
 directories, and their runtime/operability consumers have been removed. The
 only authoritative service-state database is the canonical `state.sqlite` and
 the only writer authority is its retained `state.lock`; there is no backend
 selection, compatibility reader, prototype importer, or secondary migration
 engine.
 
 The side-effect-free signer-provider contract admits exactly `encrypted_file`
 and `local_signer` assignments for the explicit transport, user, and optional
 discovery roles. It freezes the seven-operation capability vocabulary, exact
 role requirements, stable provider-instance/operation/correlation identities,
 absolute deadlines, bounded semantic input and untrusted output, local-signer
 resource limits, and logical credential references. Construction derives from
 the already admitted v1 configuration, exposes no provider path or secret in
 ordinary Debug, and performs no filesystem, credential, socket, clock, task,
 or cryptographic work. Envelope execution, credential resolution, Unix-socket
 transport, and independent result verification remain later checkpoints.
 
 The encrypted-file provider now uses the source-locked `radroots_secrets` v2
 context-bound envelope behind a sealed Myc boundary. Offline provisioning
 requires explicit identity, data-key, envelope-nonce, and wrapping-nonce
 material; verifies the derived public key before persistence; and creates one
 owner-only envelope without overwrite. Existing reads are bounded, no-follow,
 single-link, owner-only, context/reference checked, and independently verify
 the decrypted public key against the configured role identity. Protected
 material is zeroizing and absent from diagnostics. The service-state backup
 inventory remains exactly `state.sqlite`: encrypted identity envelopes,
 wrapping credentials, and plaintext identity material are excluded. Canonical
 credential artifact resolution remains Step 133 and ordinary run never
 provisions an identity.
 
 Wrapping credentials now resolve only from the shared validated
 `ServiceCredentialArtifactName` beneath the sealed runtime context's canonical
 instance secrets root. The resolver accepts no path or credential bytes and
 reads only an existing exact 32-byte, euid-owned, single-link artifact through
 descriptor-relative no-follow admission. Service-host deployments inject or
 mount that fixed file; repo-local developers provision it offline. Interactive
 resolution is unsupported, and TOML, environment, process arguments, adjacent
 envelope files, ordinary run, and state backup neither carry nor create the
 credential.
 
 Local-signer calls use the source-locked hardened Lib administration client for
 strict HTTP/1.1 JSON over the configured Unix socket. One fixed
 `/v1/provider/operation` endpoint carries a closed internally tagged operation
 and result plus exact provider instance, role, operation/correlation IDs,
 absolute deadline, expected identity, capability, and contract version. The
 validated binding supplies body, deadline, and per-client concurrency limits.
 Transport success remains sealed and semantically untrusted until independent
 Step 135 verification; cancellation does not prove the signer had no effect,
 and signing is never publication. No TCP, browser origin, or child process is
 part of this boundary.
 
 Independent provider verification uses injected completion time and rejects a
 late result before semantic exposure. It rebinds the configured role,
 instance, identity, operation/correlation IDs, deadline, capability, NIP peer,
 direction, and version. Describe/public-identity results must match the
 configured identity and limits; signed Nostr events must preserve the exact
 canonical unsigned fields, pass event-ID and Schnorr verification, and retain
 the exact verified canonical response bytes; NIP-04 and NIP-44 ciphertext must
 have canonical protocol shape and exact padding length where the plaintext is
 known. NIP-44 v2 plaintext is admitted only through its exact 65,408-byte
 implementation ceiling. Verified output remains sealed and redacted, and
 neither verification nor signing constitutes publication.
 
 The obsolete prototype provider tree has been removed. Myc ships no account
 keyring, managed-account selector, plaintext or adjacent-key file adapter,
 child-process signer, implicit host identity, generic remote-session signer,
 or legacy logging/client wrapper. Its removed production dependencies and
 Tokio process capability are absent from the locked graph; the active typed
 provider contract, encrypted envelope, credential resolver, local-signer
 transport, and independent verifier are the only provider boundaries.
 
 The existing-only runtime foundation owns the writable state host, retained
 provider capabilities, and a shared Lib task supervisor. Encrypted-file
 identities open only in synchronously joined one-shot startup tasks;
 local-signer clients perform no construction-time I/O and remain unready until
 their later governed handshake. A passive closed prerequisite snapshot keeps
 state, providers, recovery, required relays, admin, and optional operations
 conditions explicit without claiming the later status cache or final daemon
 task graph.
 
 Signer-request admission validates bounded client, request, event, method,
 canonical request, injected operation entropy, and injected time evidence
 before storage. Stable domain-separated operation and correlation identities
 bind the logical client request to its persisted entropy evidence. Event
 identity and logical request identity retain distinct durable deduplication
 records, so an exact replay is idempotent while event or request reuse with
 different normalized content records a conflict without retaining the
 decrypted request bytes. Replay and conflict counters are bounded and
 survive explicit close and reopen; retention remains owned by its later state
 checkpoint.
 
 Connection admission consumes an already-admitted `connect` operation and an
 explicit policy generation. Trusted admission creates an active connection;
 explicit approval creates a pending connection that can transition once to an
 operator-approved or operator-denied terminal decision; direct policy denial
 records a durable decision without creating a connection or approval workflow.
 Requested and granted permissions are closed, bounded, and independently
 bound. Authorization challenges are issued only for a non-connect operation
 bound to an active connection, use an operator-owned canonical URL plus
 injected entropy and time, and transition once to authorized or expired.
 Exact retries return the original durable identity or terminal state, including
 after explicit close and reopen.
 
 Connection admission uses one bounded global window plus one configured relay
 window, so arbitrary client keys cannot create persistent subjects before a
 connection exists. Challenge creation and authorization use distinct stable
 connection-scoped windows. Exact saturation creates no connection, decision,
 challenge, or authorization transition beyond the accepted bound, and a
 retained rate rejection is replay-stable. Safe audit records preserve exact
 typed operation/correlation bindings and use closed category, outcome, and
 reason vocabularies; snapshot pagination is bounded and Debug output redacts
 identity. Explicit bounded compaction is correlation-idempotent and retires
 only expired rate-window and old safe-audit evidence. It never removes schema
 history, metadata, connections, decisions, permissions, or challenges.
 
 Delivery admission copies the exact normalized write-relay inventory,
 required-target flags, acknowledgement policy, retry ceiling, backoff, and
 attempt deadline into one immutable publication job. Target leases and attempt
 records are advanced only through the shared transaction runner; relay I/O is
 never awaited while a transaction is open. Exact retries are idempotent, stale
 leases recover through injected time evidence, and an acknowledgement whose
 outcome is not known remains `unknown` rather than being relabeled as failure
 or delivery. This checkpoint binds an artifact digest and precommit identity;
 the exact committed signed-event bytes and discovery projection are owned by
 their subsequent state checkpoints.
 
 Discovery desired state is committed atomically with signature-verified,
 canonical NIP-89 event bytes, deterministic NIP-05 projection inputs, the
 immutable relay targets, and the initial delivery job. The desired generation
 may advance independently, while current generation advances only after the
 corresponding desired job has proven the configured delivery policy. Restart
 reads return the same committed event bytes and projection inputs; publication
 and hosted NIP-05 responses remain later runtime concerns and never run inside
 the SQLite transaction.
 
 Explicit state initialization validates runtime identity, build evidence, and
 the complete migration/schema catalogs before invoking the runtime-path
 directory plan. That plan alone may provision the exact interactive
 `services/myc/<instance>` suffix; service-host deployment roots and suffixes
 must already exist. The shared service-SQLite initializer owns the one
 transaction and exposes only its sealed typed SQLx executor. Existing writable
 and inspection opens never provision directories or create missing state.
 
 Writable hosts expose Myc-bound online-backup and active-integrity operations.
 Backup verification retains the exact admitted member inode, and
 offline staging derives the same runtime paths, database identity, migration
 catalog, and schema catalog from sealed Myc evidence. Finalization returns no
 open host; the next writable open alone reconciles durable recovery evidence.
 Read-only hosts cannot capture backups, and any live host prevents offline
 restore authority. Cancellation, explicit close, and cleanup behavior remain
 owned by the source-locked shared SQLx host; Myc maps every public failure to a
 stable source-free classification.
 
 ## Executable qualification
 
 The Step 161 process qualification is frozen by
 `contracts/services_hardening/process_qualification.v1.json`. It runs the
 actual `myc` executable under fixed deadlines, bounded captured output, eight
 concurrent inspection processes, 32 deterministic reopen iterations, and one
 64 MiB crash fixture. External process termination exercises interrupted
 backup and pre-marker restore boundaries without adding a production
 failpoint, hidden command, environment selector, feature, or detached test
 worker. An interrupted backup preserves the live database and leaves explicit
 collision evidence. An orphan restore stage prevents admission until an
 operator removes the owned test fixture, while a durable replacement marker is
 reconciled only by the next governed writable process open.
 
 The executable corpus composes with the exact Myc component-level atomicity,
 backlog, saturation, recovery, property, and adversarial tests and the
 source-locked shared SQLx initialization, transaction, backup, close, marker,
 restore, and `SIGKILL` failpoint corpus named by that contract. Qualification
 adds no runtime authority and makes no RCLD promotion, parent-alignment, Nix,
 OCI, signing, publication, or deployment claim.
 
 ## NIP-46 runtime contract
 
 Myc listens for encrypted kind-24133 requests on the exact configured relay
 inventory. The signer transport identity authors and encrypts
 protocol responses; the separate user identity is returned by
 `get_public_key` and signs user events. Client-supplied connect metadata is a
 bounded, display-only hint and never changes approval, authentication, or
 permissions.
 
 The public approval default is `explicit_user`. Trusted and denied clients,
 permission ceilings, allowed signing kinds, auth challenges, relay switching,
 and delivery policy are represented only by the strict v1 TOML contract. A
 successful `logout` publishes its acknowledgement before
 revoking the session. Failed acknowledgement delivery remains recoverable on
 restart, while requests from a revoked session remain unauthorized until a new
 connect is approved.
 
 Myc rejects invalid signatures, wrong recipient tags, empty request IDs,
 malformed ciphertext, and duplicate event delivery before dispatch. Runtime
 state and audit output do not log client private keys or raw connection URIs.
 Signer-authored protocol responses use the checked generic-event boundary from
 `radroots_nostr`. External custody commands receive canonical unsigned-event
 JSON only after typed-authoring policy succeeds, and Myc accepts their result
 only when the author and event id match the exact request and the complete
 NIP-01 event verifies. Caller-supplied NIP-46 `sign_event` payloads remain a
 separate low-level interoperability boundary and receive the same exact-result
 integrity checks without acquiring a typed product-authoring claim.
 The production external-command executor drains stdout and stderr concurrently,
 enforces bounded output, applies one end-to-end timeout, kills and reaps timed
 out helpers, and releases Myc's multi-thread Tokio worker while waiting.
 Helper-provided stderr and protocol error text are never copied into operator
 errors.
 
 The default Cargo feature profile is `service-host`. Validate the standalone
 crate through extbuild:
 
 ```text
 cargo extbuild doctor
 cargo extbuild run -- ./scripts/verify-boundaries.sh
 cargo extbuild run -- ./scripts/verify-supply-chain.sh
 cargo extbuild run -- ./scripts/release-acceptance.sh
 ```
 
 After building one of the two admitted Linux targets, create and then
 byte-check an external release directory with explicit deterministic evidence:
 
 ```text
 cargo extbuild run -- cargo xtask native-release --mode write --target <aarch64-unknown-linux-gnu|x86_64-unknown-linux-gnu> --binary <absolute-binary> --output <absolute-new-directory> --source-date-epoch <positive-u32-seconds>
 cargo extbuild run -- cargo xtask native-release --mode check --target <same-target> --binary <same-absolute-binary> --output <same-absolute-directory> --source-date-epoch <same-seconds>
 ```
 
 The flake exposes the Myc package, application, checks, and development shell
 for `aarch64-darwin` and `x86_64-linux`, plus the NixOS module and unsigned OCI
 derivation for `x86_64-linux`. Run Nix and narrower ad hoc Cargo commands
 through `cargo extbuild run --` from this repository root.
 
 ## Copyright
 
 Except as otherwise noted, all files in the `myc` distribution are
 
 `Copyright (c) 2026 Tyson Lupul`
 
 ## License
 
 This repository is licensed under AGPL-3.0-or-later. See LICENSE.