next: cloud-copy collections — service-created, owner-device, and device join (cloud-copy bootstrap C2)

[callumalpass]

Cloud-copy bootstrap, PR C2. It is stacked on #615 (C1), so review only the last commit until #615 merges. It follows the coordinator's sealed-envelope §7.1 decision: only the owner's device keys the hosted replica. On create, the owner's desktop performs the initial rekey with wraps for desktop + hosted + escrow, and there is no automatic escrow→hosted wrap. Control owns these paths and ACKed the direction; security-2 review requested.

Route

POST /v1/next/collections/cloud-copy {collection_id, device_id, challenge, sig}

• Connector auth plus a device signature over H("mdbase/v1/cloud-copy-create", cbor[challenge, connector, device, collection]), using a challenge from /v1/next/devices/challenge, consumed once.
• Mounted only with MDBASE_NEXT_CLOUD_COPY_BOOTSTRAP=1. That setting requires:
  • MDBASE_NEXT_{HOSTED,ESCROW}_SERVICE_URL (https) and MDBASE_NEXT_{HOSTED,ESCROW}_SERVICE_TOKEN;
  • both inbound internal tokens;
  • all four tokens distinct.
• Rate limit 6/min; cache-control: no-store.

Flow

1. Transaction with a per-collection advisory lock: verify the proof and consume the challenge. The collection must be free, or already be this owner's cloud copy. A local collection with that id owned by someone else is refused.
2. With no lock held, the hosted and escrow deployments each generate their device through the C1 client (bounded, HTTPS, kind-checked, no weak keys, escrow Noise key zero).
3. Transaction: lock again and recheck (a concurrent create gets 503 and the retry path handles it). Register the genesis with ops genesis(cloud-copy), member-set(owner), device-enrol(owner device), then device-enrol(hosted, zero account) and device-enrol(escrow, zero account). Store both records in the same transaction.
4. Drain the emitter. Success is returned only once the log returns the exact genesis bytes at seq 1.

The response carries:

• head, root, cert and genesis;
• rekey_recipients = [owner device, hosted, escrow];
• the service devices' public keys (no wrapped keys, no ARN);
• a role-0, single-collection, 15-minute log token for the owner device to append the rekey.

A retry must come from the enrolled device: its device-enrol, with the same sign key, must be in the genesis outbox row. It reuses the stored records and does not call the deployments. Other devices, other owners and existing private collections get 409. A failed or mismatched generation registers nothing and returns 503, so the client retries with a fresh proof.

Not here

• Converting an existing private collection to a cloud copy.
• Log quotas: the default applies.
• Readiness: hosted Ready still needs the replica observer (fresh authenticated head + verified membership + clean cache). The directory's standard here is only bootstrap eligibility.

Tests

cloud-copy-bootstrap.postgres.test.ts runs against a real Postgres, a fake log and fake deployments:

• config gating;
• genesis ops, kinds and accounts decoded from the signed item;
• token claims;
• no wrapped keys in the response;
• idempotent retry without regeneration;
• sibling device, stranger, private and foreign-local refusals;
• proof replay and wrong collection;
• deployment down or wrong kind registers nothing, then a retry succeeds.

Results: server pnpm test 786 passed; src/features/next with PG16, serial: 160 passed. Typecheck, architecture and changelog checks pass.

[callumalpass]

Merged C1's review fixes (now 4537913). Changes:

• The fake deployments are stateless (a new device on every call); the CP's first stored record still wins.
• New test: a retry after leaving sync gets 409. existing() refuses left_sync_at rows before any anyState read.
• There is no cleanup or delete on any failure path. The log and genesis are always preserved (per migration's 14:39 note).

Results: server 786 passed; next/* 164 passed against PG16.

[callumalpass]

Control touched-path/source owner ACK at exact C2 head 2e1a32b, stacked on C1 f3076cd. Independently reviewed production bootstrap/app/config and the currentness/nil/lock-bound deltas plus regression source. Owner findings are closed in source: after remote generation and log read-back, current connector/account/device and immutable tuple are rechecked and locked; final current collection/enrolment/record lookup and token mint occur under transaction locks; nil IDs fail; all bootstrap transactions set 5s lock_timeout, with no network inside them. Exact persisted genesis/log read-back equality and first-record retention remain; escrow has a genuine unused Noise key, no validator change or endpoint. This is identity/genesis provisioning only, not legal epoch keying or Ready; rekey_recipients is advisory historical genesis identity data, and the consumer derives legal/current recipients and owner authority from the verified log. Source review only: no independent author-test rerun, IAM/private-material verification, actual policy-validator/LAB/epoch/Ready acceptance. Initial lock failure returns busy without registration; later post-commit uncertainty remains not_ready with retained state, not a no-side-effects claim. Scoped security and actual CI qualification remain required.

[callumalpass]

Reworked at 336b474 for Callum's 2026-10-06 decision, which replaces §7.1 owner-only keying for cloud copy only. Private collections are unchanged.

New routes

• POST /v1/next/collections/cloud-copy/service {collection_id}
  • Auth: account session (requireUser, under the global origin gate). No device needed.
  • Genesis is [genesis cloud-copy, member-set owner, device-enrol hosted, device-enrol escrow]. Hosted is the first member and generates/wraps the key (hosted plus replica/policy work).
  • Phases are the same as the owner path. Generation runs with no lock held; the account and collection are rechecked under a 5 s lock; the exact genesis is read back from the log. No token is minted.
• POST /v1/next/collections/:id/devices {device_id, challenge, sig}
  • Auth: connector plus a join-domain device proof, H("mdbase/v1/cloud-copy-join", cbor[challenge, connector, device, collection]).
  • The device is enrolled only into this owner's current cloud copy. Private, foreign or left collections get 409 before any policy op is queued.
  • Idempotent for the same keys; 409 for a different enrolment.
  • A role-0 token is minted only after the enrol batch reads back exactly, under a final identity and collection recheck. Hosted (or escrow) then wraps the epoch key to the device.

Unchanged

• The owner-device create path stays.

Tests

• Genesis ops and accounts for service-created.
• Idempotent retry with no new generation.
• No session (401), a foreign collection (409), suspension during generation (403, nothing registered).
• Join: enrolment op in the log at seq 2, token claims, idempotent re-join.
• Private exclusion: no outbox row is ever written for a private collection (this fails if the cloud-copy check is removed).
• Foreign and left collections refused; proof bound to the collection and the join domain; revocation during the read-back mints nothing.

Results: next/* 175 passed against PG16; server suite 786 passed; architecture and changelog checks pass.

[callumalpass]

Control touched-path/source owner ACK at exact new-rule head 0e523eb. Reviewed 2e→336 service/account-join production changes and 336→0e fixes, app/config/docs and new regression source; also checked existing session/authentication helper semantics. Source findings are closed: join locks current connector/account/device/full tuple before enqueue or idempotent acceptance; cookie sessions are rechecked with revocation/expiry/account-session epoch under lock after remote work; whole enrollment tuple is compared; recorded device revocation denies retry/final mint. Tailscale-auth mode uses its existing actual Tailscale identity path (not a cookie-session fallback). Existing bounded transactions, no network within them, strict cloud-copy/private rejection, exact batch read-back, nil checks and retained unknown outcomes carry. This is component/source review ONLY: author 178/786 are not my test executions; no actual policy-validator/service keying or wrapping, IAM, LAB/app-serving or Ready qualification. Response metadata/first-member labels are not authority; legal current mode, membership, signer/recipient and epoch at delivery remain verified-log/consumer obligations. Private→cloud conversion is NOT implemented. Scoped security and actual CI remain required; ordinary device log-token refresh is a separate follow-up, not private-mode expansion here.

[callumalpass]

security: no blocking findings at 0e523eb, base f3076cd (scoped CloudCopy creation/device-join source review under the revised cloud-copy rule). Reviewed account-session revalidation after awaits and locked current connector/account/full-device identity before enrollment publication, exact genesis/enrollment readback, canonical namespace and domain-separated single-use proof, full-tuple idempotence and later-revoke refusal. Earlier scoped source concerns are corrected here. This is source review; author PG/barrier/suite results, owner ACK and CI metadata are separate—not my independently executed PG or actual genesis-to-Replica interoperability. No private-create/private-join or private-to-cloud conversion authorization, mutable epoch-key delivery, KMS custody, Ready, live acceptance or deployment qualification is conveyed.