# mycorrhiza

This is the README for `myc` which provides a Nostr remote signer for
standalone and application-embedded clients.

## Public API boundary

The library exposes one curated crate-root API. All implementation modules are
private, and public errors use Myc-owned stable classifications with redacted
diagnostics and no raw dependency-owned source chain. The shared runtime-path,
service-SQLite, and storage identity values that appear in signatures are
intentional governed contract types; raw SQLx, provider, transport, Serde, and
task authority never crosses this boundary.

The runtime foundation is sealed and cannot be forged or reached through a
child module:

```compile_fail
use myc::runtime_foundation::MycRuntimeFoundation;

fn forge(_: MycRuntimeFoundation) {}
```

The reviewed all-features surface is frozen in the
[Myc API baseline](contracts/api_baselines/myc.txt).

Status publication and cached snapshots can be obtained only through the
validated factory and its sealed handles:

```compile_fail
use myc::{MycStatusPublisher, MycStatusSnapshot};

let _publisher = MycStatusPublisher {};
let _snapshot = MycStatusSnapshot {};
```

The native package, artifact, and dependency-trust boundary is frozen by
`contracts/services_hardening/native_release.v2.json`. Linux x86_64 and
aarch64 are the only admitted native artifact targets. `cargo xtask
native-release` consumes an exact prebuilt target binary from a clean Git head
and deterministically writes or checks the complete binary/source archive,
systemd, configuration, source-lock, SBOM, notices, checksum, manifest, and
unsigned provenance inventory outside the source tree. The source archive
vendors the exact locked Cargo graph and proves an offline metadata read before
packaging. Signing credentials and parent-owned human documentation are never
inputs.

The standalone Linux systemd boundary is frozen by
`contracts/services_hardening/systemd_qualification.v1.json` and checked by
`scripts/verify-systemd.sh`. The instance unit uses the canonical service-host
paths, fixed unprivileged account, restrictive directory modes and umask,
fixed restart delay, bounded stop behavior, empty capabilities, no environment-based secret
input, and the reviewed filesystem, kernel, namespace, process, and address-
family protections. The Linux-only verifier requires systemd 252 or newer,
runs syntax verification, and rejects an offline security exposure above 3.0.
Type `simple` remains deliberate: readiness is the cached CLI/admin contract,
not `sd_notify`. Compatibility-sensitive `MemoryDenyWriteExecute` and syscall
filters remain deferred to the Step 229 integration wave rather than being
enabled without real-binary evidence. This qualification does not install,
enable, start, stop, or deploy a production service.

The canonical service source lock binds the exact active public Lib cohort,
Cargo lock, verified Lib source archive, toolchain, feature profile, and
service contract versions. Deferred flake source data is independently
digest-bound and may select an older reachable Lib revision; it does not
control native artifacts or claim Nix qualification. Nix, NixOS material, OCI,
signing, tags, publication, and deployment remain deferred and unclaimed.

## Hardened v1 configuration contract

The target service configuration is frozen by
`contracts/services_hardening/config.v1.schema.json` and the canonical
non-secret `config.v1.example.toml`. It is one strict, immutable TOML document
with explicit identity, relay, authorization, rate, and discovery authority.
Only reviewed bounded operational leaves have defaults. Bootstrap profile,
instance, repo-local root, and config-path selection are CLI concerns and are
not document fields.

The hardened CLI parser admits the common command tree in one parse. It
requires explicit `--profile <service-host|interactive|repo-local>` and
`--instance <validated-instance-id>` selectors, requires an absolute
`--repo-local-root` only for `repo-local`, and accepts only an optional absolute
`--config` path. Its exact command inventory is `run`; `config
init|validate|show|schema|apply`; `state init|status|backup|restore|verify|migrate`;
`identity init|status|export-public`; `status`; and `doctor`. Identity rotation
is an offline create-new/config-apply lifecycle and is intentionally absent
from the live CLI and Unix-admin inventories.
The process binary uses only this parser and consumes its sealed execution plan
exactly once. Every command reaches its governed config, state, identity,
Unix-admin, doctor, or daemon authority. `run` installs the authoritative
bounded daemon graph; no admitted command can return success through a
prototype or unavailable-operation fallback.

The selected absolute config path is opened no-follow through its retained
parent descriptor. The loader requires a regular, single-link,
effective-user-owned file with no group/other-write permission, caps bytes
before parsing, and revalidates device, inode, length, and parent identity after
the read. Config initialization consumes bounded non-secret TOML from stdin and
uses create-new `0600` persistence plus file and parent synchronization. Secret
identity provisioning is a separate fixed 117-byte zeroizing stdin document;
secret arguments, environment values, JSON strings, and trailing bytes are not
accepted.

One binary-owned Tokio runtime is created from the validated fixed thread
limits for each asynchronous command process; there is no CPU-derived default
or library-owned runtime. Existing-state commands discover actual metadata
through the retained shared intent. Offline backup writes the exact canonical
manifest bytes to stdout without a trailing newline, so direct redirection
preserves the bytes bound by its digest. Restore derives expected backup identity
from the trusted manifest digest rather than requiring the damaged live
database to open, and exclusive commands retain the writer-authority boundary.
Deployment directory provisioning remains outside the service executable.

The parsed invocation is projected once into a sealed execution plan. `run`
selects daemon authority; config, exclusive state/identity provisioning, and
doctor select offline authority; state/identity/service inspection and live
mutations select the permissioned Unix-admin authority. Only explicitly
read-only status, backup, and public-identity operations may fall back when a
later executor proves the daemon writer lock is free. No live plan carries
SQLite authority.

The active doctor boundary executes the exact 13-check operator inventory in
contract order under fixed per-check deadlines. Check implementations retain
their filesystem, SQLite, provider, bind, network, relay, and clock authority;
only closed pass/fail/skipped observations cross into the report builder. The
builder enforces required-check semantics, returns exit 6 for required failure
or timeout, and emits at most 8,192 bytes of compact canonical JSON using only
fixed summaries and remediation codes. Raw errors, paths, relay URLs,
credentials, public keys, and arbitrary detail strings cannot enter the report.
A pass requires every machine-listed scope facet. Probe futures own their work,
must stop safely when dropped at deadline, and may not detach later mutation.
The production adapter composes secure path and disk inspection, writer-lock
and SQLite authorities, exact schema and outbox checks, provider opening and
Describe verification, validated bind/network policy, and bounded required-
relay reads. It never publishes a relay event. Clock skew remains the sole
optional `Skipped` check until a trusted time source is governed.

The service status boundary uses the shared service-host lifecycle contract
behind one Myc-owned non-clone publisher and cloneable passive readers. Each
publication validates the lifecycle transition and encodes the complete
bounded `service_status_v1` payload before atomically replacing the single
retained immutable snapshot. Repeated reads return that exact cached value and
perform no SQLite, provider, relay, credential, DNS, clock, filesystem, or
fresh-probe work. Connection counts use the closed pending/active/denied/
expired vocabulary, identity health uses the fixed transport/user/discovery
roles, failed publication preserves the last valid snapshot, and detailed
status remains local to the permissioned Unix-admin surface. Status reason
codes use a closed twelve-value vocabulary; arbitrary strings cannot enter the
cached response.

The optional TCP operations adapter consumes that same supervisor publication
through a second passive bounded projection and delegates the transport to the
source-locked service-host server. It exposes exactly HTTP/1.1 `GET /livez`,
`GET /readyz`, and `GET /metrics`; every other method, path, or query is
unrouteable. The two Prometheus families are the cached phase and cached
readiness bit with only the closed phase label. Requests perform no SQLite,
filesystem, provider, relay, credential, DNS, or fresh-probe work; the shared
transport still reads its monotonic deadline clock.
Detailed status, configuration, paths, identities, connection/audit data, and
all mutations remain on the permissioned Unix-admin surface. The listener is
disabled unless the validated configuration explicitly enables and binds it,
and its parser floor, headers, response, concurrency, deadline, and idle bounds
remain enforced by the shared server.

Process outcomes use one exact seven-value vocabulary with exit codes 0
through 6. Diagnostics are compact single-line JSON on stderr; result data is
reserved for stdout, and Myc never writes log files. The structured record
admits only the closed level, event, result, lifecycle, task-failure, and signal
codes. It accepts no caller text, path, SQL, raw cause, identity, relay URL,
credential, secret, or decrypted content. Every public Myc error remains a
crate-owned source-free classification, so ordinary `Display`, `Debug`, and
whole-chain traversal cannot bypass redaction. Current binary dispatch reports
invalid input as exit 2 and service dependency unavailability as exit 3. The
Myc runtime owns one sealed, bounded critical-task graph over the shared supervisor:
task error, panic, join failure, unexpected cancellation, or critical success
before cancellation coordinates shutdown, joins every task, and maps to the
fixed nonzero process result. Tasks receive only a cooperative cancellation
observer; task names and handles remain internal. The binary owns signal
installation. The graph uses one configured absolute graceful-shutdown deadline
for mutation rejection, ingress and operations drain,
recoverable-work persistence, network and SQLite close, and socket close; it
adds no hidden second cleanup budget.

`parse_myc_config_v1` caps original bytes before decoding, checks the schema
header before closed contract admission, rejects duplicate, null, unknown, and
semantically inconsistent input, and returns an immutable document plus a
deterministic redacted effective-configuration projection. Every projected
leaf records whether it came from the document or one of the exact governed
default authorities. Ordinary errors and `Debug` output contain no source
text, paths, credentials, relay URLs, or identity values.

The prototype environment loader, `.env` example, environment selectors,
implicit command/profile selection, compatibility aliases, and arbitrary leaf
flags have been removed. Bootstrap now resolves a sealed runtime context from
the validated CLI profile and typed instance ID through the source-locked
`radroots_runtime_paths` authority. Config, state, cache, logs, run, secrets,
`config.toml`, `state.sqlite`, `state.lock`, and `admin.sock` are derived under
the exact `services/myc/<instance>` namespace. The service contains no local
host-environment resolver, worker namespace, ambient selector, or implicit
path default. An explicit absolute `--config` may select the document to read
without changing the canonical common artifact inventory.

## Governed state boundary

Create-new initialization reserves the shared schema-v1 metadata and migration
ledger, retains exclusive writer authority, applies the exact Myc schema-v2
through schema-v12 migrations, binds the normalized configuration, expected
identity roles, and policy versions through a sealed typed repository, and
explicitly closes the host before reporting success. Existing writable open can
resume any exact v1 through v11 prefix or admit the current v12 catalog;
read-only inspection requires the current catalog and exact latest Myc binding.

Schema v10 adds an append-only configuration-binding history capped at exactly
1,024 generations. Generation 1 is seeded only after the v10 migration commits,
including for an upgraded v9 database, while the immutable original birth
record remains unchanged. `apply_configuration` is admitted only through an
exclusive writable host and independently validates the retained current and
candidate documents before one atomic append. A changed identity expires live
sessions and pending challenges; permission narrowing expires only sessions
whose retained grants are removed. Removing or changing a relay that is still
referenced by nonterminal delivery work fails closed, while safe relay additions
remain admissible. Exact replay returns the retained generation without another
append or revocation, including after an ambiguous caller result. Future startup
must present the latest normalized config and public-identity binding. The
history stores only digests, public identities,
closed contract versions, injected application evidence, and safe build
identity; it stores no credentials, provider envelopes, paths, or relay URLs.

Schema v11 adds the bounded admin-operation journal. It binds each mutation's
validated operation ID to its fixed route and canonical request digest, retains
at most 128 unresolved Prepared records and 4,096 completed responses, caps a
replayed response model at 8,192 bytes, and prunes only a bounded expired
completed prefix before admission. The journal stores no request body, path,
correlation ID, credential, bundle path, or secret. Completed responses use an
explicit retention policy whose admitted range is 1 through 31,536,000,000
milliseconds; the governed operating value is seven days.
The admin response transport admits at least 8,382 UTF-8 bytes so the maximum
retained model plus the maximum safe correlation identity always fits its
canonical success envelope.

Schema v12 adds immutable response authority for a connect request awaiting
explicit approval. Myc signs and atomically retains the exact
`pending_connection` response with its initial delivery job before relay
publication, without recording a false terminal operation completion. Exact
replay and delivery use only the retained signed bytes, and a later terminal
response cannot conflict with the pending authority.

The Step 159 provider and delivery boundary is sealed inside the crate. Both
governed provider kinds execute only fully bound operations, and every result
is independently verified before it becomes authority. Protected blocking
work is joined, local-signer calls use the hardened Unix-admin client, and no
raw provider client, secret, callback, or dependency-owned error crosses the
public API.

Relay publication uses only the exact source-locked
`radroots_transport_nostr` adapter. Preparation validates the exact committed,
signature-verified event bytes without network I/O. The delivery worker then
persists Submitted immediately before execution. Accepted, rejected,
transport-failed, and unknown acknowledgements remain distinct; cancellation
or lost acknowledgement after Submitted is durably unknown, and retries never
alter the committed bytes. Provider or relay work never occurs inside a SQLite
transaction. The secure command executor and production daemon graph use these
same provider, relay, and exact-byte delivery boundaries.

The production `run` path owns the exact five-role bounded graph:
`admin_server`, optional `operations_server`, `relay_ingress`,
`provider_dispatch`, and `delivery_outbox`. It creates no task per request or
relay. Required relay subscriptions and provider handshakes complete before
Ready; bounded reconnect publishes Unready when a required dependency is lost,
while optional operations loss publishes Degraded. NIP-46 dispatch verifies,
decrypts, admits, authorizes, executes providers outside transactions,
re-encrypts in the verified request context, signs through the transport provider,
and atomically commits completion, exact response bytes, immutable targets,
and initial outbox state. Completed replay never re-executes a provider.

Schema v8 adds immutable NIP-46 operation-completion evidence. The Step 147
integration checkpoint binds each durable request to its stable operation and
correlation identities, terminal connect authority or exact active session,
safe completion reason, and any independently verified inner signed-event
bytes and digest. Logout revocation and completion insertion share one
transaction, exact replay returns the stored decision, and failed transactions
expose neither effect. Protected provider output is never persisted. This is an
integration component, not the final production response boundary: Step 148
must compose it with the outer signed response bytes, immutable relay targets,
and initial outbox state in one transaction before RCLD-RSHR-080 can be
promoted to `master`.

Schema v9 closes that production boundary. `commit_nip46_response` admits only
an independently signature-verified, canonical kind-24133 response bound to the
original client and exact provider signing operation. One SQLite transaction
commits the Step 147 completion, exact response bytes and SHA-256 identity,
immutable configured relay targets, pending delivery job, and zero-attempt
target state. Exact replay returns only the retained response bytes; partial
legacy completion state and mismatched replay fail closed. Provider execution
and relay I/O remain outside the transaction.

Step 149 closes the repository-owned delivery recovery boundary without
claiming the final daemon task graph. New jobs can be created only by the
atomic signed-response or discovery commit and are rejected at the configured
active-outbox ceiling. Attempt resolution persists caller-injected,
attempt-cap-bounded full jitter; restart recovery scans fixed 128-job cursor
batches, revalidates exact signed source bytes and bounded attempt histories,
recovers only expired leases, and idempotently promotes proven desired
discovery. It performs no relay I/O and creates no task, clock, or entropy
authority. Explicit desired/current offline NIP-05 export re-reads verified
state, works through read-only inspection, and returns canonical compact
`names` plus NIP-46 discovery JSON without hosting it.

The implemented v1 Myc administration adapter registers the exact 19-route
inventory and validates every request and response against all 32 model
references in `contracts/services_hardening/operator_contract.v1.json`. It
reuses the hardened Lib HTTP/1.1-over-Unix server for original-wire duplicate
and null rejection, percent-decoded bounded path parameters, peer admission,
deadlines, concurrency, body limits, and effective correlation IDs. The Myc
boundary additionally rejects unknown or missing model fields, invalid query
types, noncanonical response JSON, unsafe URLs and identifiers, and response
model drift. Raw shared-host routers and JSON values never cross the public
API.

The domain handler receives compact canonical model bytes plus the durable
operation ID. A successful mutation means its contract-defined local effect
and operation audit are committed; it does not claim relay submission or
delivery. Identical operation-ID reuse must return the original committed
result, different-byte reuse returns `operation_id_conflict`, and pagination
cursors remain authenticated to the same route, filters, and snapshot. Unit 13
seals that handler boundary inside the production `MycAdminServer`,
projects the exact admitted admin transport limits, and binds only the
canonical permissioned `admin.sock` through the shared host authority. The raw
router, listener, entropy source, and cancellation token remain private. The
existing sole status publisher feeds both detailed local status and the
optional passive three-route TCP operations server, while doctor continues to
accept only its exact injected 13-check probe inventory. Unit 14 supplies the
secure CLI/config bootstrap and concrete doctor probes. Unit 15 alone owns task
spawning, provider/relay wiring, readiness, reconnect, and phase-aware
shutdown.

The transport capability and admitted request remain non-forgeable outside
the crate:

```compile_fail
use myc::{MycAdminRequestDocument, MycAdminRouter};

let _request = MycAdminRequestDocument {};
let _router = MycAdminRouter {};
```

The public Myc repository exposes no raw pool, connection, transaction-control
handle, path, or SQL. Binding and request-admission mutations execute only
inside the shared `ServiceSqliteTransaction` runner. Provider and relay work
cannot occur inside that transaction boundary. The v2 binding table, v3
request/dedup tables, and v4 connection, permission, request-decision, and
authorization-challenge tables and guards are checksum-pinned service-owned
schema objects. Schema v5 adds checksum-pinned audit-sequence, safe operation
audit, request-audit binding, and bounded rate-window objects. Schema v6 adds
checksum-pinned publication-job, target, attempt, transition-guard, and
no-delete objects. Schema v7 adds desired/current discovery state, exact signed
NIP-89 event bytes, deterministic NIP-05 projection inputs, and their delivery
binding.

The earlier JSON signer store, JSONL audit log, separate signer/audit/outbox
SQLite databases, prototype import/backup adapter, independent migration
directories, and their runtime/operability consumers have been removed. The
only authoritative service-state database is the canonical `state.sqlite` and
the only writer authority is its retained `state.lock`; there is no backend
selection, compatibility reader, prototype importer, or secondary migration
engine.

The side-effect-free signer-provider contract admits exactly `encrypted_file`
and `local_signer` assignments for the explicit transport, user, and optional
discovery roles. It freezes the seven-operation capability vocabulary, exact
role requirements, stable provider-instance/operation/correlation identities,
absolute deadlines, bounded semantic input and untrusted output, local-signer
resource limits, and logical credential references. Construction derives from
the already admitted v1 configuration, exposes no provider path or secret in
ordinary Debug, and performs no filesystem, credential, socket, clock, task,
or cryptographic work. Envelope execution, credential resolution, Unix-socket
transport, and independent result verification remain later checkpoints.

The encrypted-file provider now uses the source-locked `radroots_secrets` v2
context-bound envelope behind a sealed Myc boundary. Offline provisioning
requires explicit identity, data-key, envelope-nonce, and wrapping-nonce
material; verifies the derived public key before persistence; and creates one
owner-only envelope without overwrite. Existing reads are bounded, no-follow,
single-link, owner-only, context/reference checked, and independently verify
the decrypted public key against the configured role identity. Protected
material is zeroizing and absent from diagnostics. The service-state backup
inventory remains exactly `state.sqlite`: encrypted identity envelopes,
wrapping credentials, and plaintext identity material are excluded. Canonical
credential artifact resolution remains Step 133 and ordinary run never
provisions an identity.

Wrapping credentials now resolve only from the shared validated
`ServiceCredentialArtifactName` beneath the sealed runtime context's canonical
instance secrets root. The resolver accepts no path or credential bytes and
reads only an existing exact 32-byte, euid-owned, single-link artifact through
descriptor-relative no-follow admission. Service-host deployments inject or
mount that fixed file; repo-local developers provision it offline. Interactive
resolution is unsupported, and TOML, environment, process arguments, adjacent
envelope files, ordinary run, and state backup neither carry nor create the
credential.

Local-signer calls use the source-locked hardened Lib administration client for
strict HTTP/1.1 JSON over the configured Unix socket. One fixed
`/v1/provider/operation` endpoint carries a closed internally tagged operation
and result plus exact provider instance, role, operation/correlation IDs,
absolute deadline, expected identity, capability, and contract version. The
validated binding supplies body, deadline, and per-client concurrency limits.
Transport success remains sealed and semantically untrusted until independent
Step 135 verification; cancellation does not prove the signer had no effect,
and signing is never publication. No TCP, browser origin, or child process is
part of this boundary.

Independent provider verification uses injected completion time and rejects a
late result before semantic exposure. It rebinds the configured role,
instance, identity, operation/correlation IDs, deadline, capability, NIP peer,
direction, and version. Describe/public-identity results must match the
configured identity and limits; signed Nostr events must preserve the exact
canonical unsigned fields, pass event-ID and Schnorr verification, and retain
the exact verified canonical response bytes; NIP-04 and NIP-44 ciphertext must
have canonical protocol shape and exact padding length where the plaintext is
known. NIP-44 v2 plaintext is admitted only through its exact 65,408-byte
implementation ceiling. Verified output remains sealed and redacted, and
neither verification nor signing constitutes publication.

The obsolete prototype provider tree has been removed. Myc ships no account
keyring, managed-account selector, plaintext or adjacent-key file adapter,
child-process signer, implicit host identity, generic remote-session signer,
or legacy logging/client wrapper. Its removed production dependencies and
Tokio process capability are absent from the locked graph; the active typed
provider contract, encrypted envelope, credential resolver, local-signer
transport, and independent verifier are the only provider boundaries.

The existing-only runtime foundation owns the writable state host, retained
provider capabilities, and a shared Lib task supervisor. Encrypted-file
identities open only in synchronously joined one-shot startup tasks;
local-signer clients perform no construction-time I/O and remain unready until
their later governed handshake. A passive closed prerequisite snapshot keeps
state, providers, recovery, required relays, admin, and optional operations
conditions explicit without claiming the later status cache or final daemon
task graph.

Signer-request admission validates bounded client, request, event, method,
canonical request, injected operation entropy, and injected time evidence
before storage. Stable domain-separated operation and correlation identities
bind the logical client request to its persisted entropy evidence. Event
identity and logical request identity retain distinct durable deduplication
records, so an exact replay is idempotent while event or request reuse with
different normalized content records a conflict without retaining the
decrypted request bytes. Replay and conflict counters are bounded and
survive explicit close and reopen; retention remains owned by its later state
checkpoint.

Connection admission consumes an already-admitted `connect` operation and an
explicit policy generation. Trusted admission creates an active connection;
explicit approval creates a pending connection that can transition once to an
operator-approved or operator-denied terminal decision; direct policy denial
records a durable decision without creating a connection or approval workflow.
Requested and granted permissions are closed, bounded, and independently
bound. Authorization challenges are issued only for a non-connect operation
bound to an active connection, use an operator-owned canonical URL plus
injected entropy and time, and transition once to authorized or expired.
Exact retries return the original durable identity or terminal state, including
after explicit close and reopen.

Connection admission uses one bounded global window plus one configured relay
window, so arbitrary client keys cannot create persistent subjects before a
connection exists. Challenge creation and authorization use distinct stable
connection-scoped windows. Exact saturation creates no connection, decision,
challenge, or authorization transition beyond the accepted bound, and a
retained rate rejection is replay-stable. Safe audit records preserve exact
typed operation/correlation bindings and use closed category, outcome, and
reason vocabularies; snapshot pagination is bounded and Debug output redacts
identity. Explicit bounded compaction is correlation-idempotent and retires
only expired rate-window and old safe-audit evidence. It never removes schema
history, metadata, connections, decisions, permissions, or challenges.

Delivery admission copies the exact normalized write-relay inventory,
required-target flags, acknowledgement policy, retry ceiling, backoff, and
attempt deadline into one immutable publication job. Target leases and attempt
records are advanced only through the shared transaction runner; relay I/O is
never awaited while a transaction is open. Exact retries are idempotent, stale
leases recover through injected time evidence, and an acknowledgement whose
outcome is not known remains `unknown` rather than being relabeled as failure
or delivery. This checkpoint binds an artifact digest and precommit identity;
the exact committed signed-event bytes and discovery projection are owned by
their subsequent state checkpoints.

Discovery desired state is committed atomically with signature-verified,
canonical NIP-89 event bytes, deterministic NIP-05 projection inputs, the
immutable relay targets, and the initial delivery job. The desired generation
may advance independently, while current generation advances only after the
corresponding desired job has proven the configured delivery policy. Restart
reads return the same committed event bytes and projection inputs; publication
and hosted NIP-05 responses remain later runtime concerns and never run inside
the SQLite transaction.

Explicit state initialization validates runtime identity, build evidence, and
the complete migration/schema catalogs before invoking the runtime-path
directory plan. That plan alone may provision the exact interactive
`services/myc/<instance>` suffix; service-host deployment roots and suffixes
must already exist. The shared service-SQLite initializer owns the one
transaction and exposes only its sealed typed SQLx executor. Existing writable
and inspection opens never provision directories or create missing state.

Writable hosts expose Myc-bound online-backup and active-integrity operations.
Backup verification retains the exact admitted member inode, and
offline staging derives the same runtime paths, database identity, migration
catalog, and schema catalog from sealed Myc evidence. Finalization returns no
open host; the next writable open alone reconciles durable recovery evidence.
Read-only hosts cannot capture backups, and any live host prevents offline
restore authority. Cancellation, explicit close, and cleanup behavior remain
owned by the source-locked shared SQLx host; Myc maps every public failure to a
stable source-free classification.

## Executable qualification

The Step 161 process qualification is frozen by
`contracts/services_hardening/process_qualification.v1.json`. It runs the
actual `myc` executable under fixed deadlines, bounded captured output, eight
concurrent inspection processes, 32 deterministic reopen iterations, and one
64 MiB crash fixture. External process termination exercises interrupted
backup and pre-marker restore boundaries without adding a production
failpoint, hidden command, environment selector, feature, or detached test
worker. An interrupted backup preserves the live database and leaves explicit
collision evidence. An orphan restore stage prevents admission until an
operator removes the owned test fixture, while a durable replacement marker is
reconciled only by the next governed writable process open.

The executable corpus composes with the exact Myc component-level atomicity,
backlog, saturation, recovery, property, and adversarial tests and the
source-locked shared SQLx initialization, transaction, backup, close, marker,
restore, and `SIGKILL` failpoint corpus named by that contract. Qualification
adds no runtime authority and makes no RCLD promotion, parent-alignment, Nix,
OCI, signing, publication, or deployment claim.

## NIP-46 runtime contract

Myc listens for encrypted kind-24133 requests on the exact configured relay
inventory. The signer transport identity authors and encrypts
protocol responses; the separate user identity is returned by
`get_public_key` and signs user events. Client-supplied connect metadata is a
bounded, display-only hint and never changes approval, authentication, or
permissions.

The public approval default is `explicit_user`. Trusted and denied clients,
permission ceilings, allowed signing kinds, auth challenges, relay switching,
and delivery policy are represented only by the strict v1 TOML contract. A
successful `logout` publishes its acknowledgement before
revoking the session. Failed acknowledgement delivery remains recoverable on
restart, while requests from a revoked session remain unauthorized until a new
connect is approved.

Myc rejects invalid signatures, wrong recipient tags, empty request IDs,
malformed ciphertext, and duplicate event delivery before dispatch. Runtime
state and audit output do not log client private keys or raw connection URIs.
Signer-authored protocol responses use the checked generic-event boundary from
`radroots_nostr`. External custody commands receive canonical unsigned-event
JSON only after typed-authoring policy succeeds, and Myc accepts their result
only when the author and event id match the exact request and the complete
NIP-01 event verifies. Caller-supplied NIP-46 `sign_event` payloads remain a
separate low-level interoperability boundary and receive the same exact-result
integrity checks without acquiring a typed product-authoring claim.
The production external-command executor drains stdout and stderr concurrently,
enforces bounded output, applies one end-to-end timeout, kills and reaps timed
out helpers, and releases Myc's multi-thread Tokio worker while waiting.
Helper-provided stderr and protocol error text are never copied into operator
errors.

The default Cargo feature profile is `service-host`. Validate the standalone
crate through extbuild:

```text
cargo extbuild doctor
cargo extbuild run -- ./scripts/verify-boundaries.sh
cargo extbuild run -- ./scripts/verify-supply-chain.sh
cargo extbuild run -- ./scripts/release-acceptance.sh
```

After building one of the two admitted Linux targets, create and then
byte-check an external release directory with explicit deterministic evidence:

```text
cargo extbuild run -- cargo xtask native-release --mode write --target <aarch64-unknown-linux-gnu|x86_64-unknown-linux-gnu> --binary <absolute-binary> --output <absolute-new-directory> --source-date-epoch <positive-u32-seconds>
cargo extbuild run -- cargo xtask native-release --mode check --target <same-target> --binary <same-absolute-binary> --output <same-absolute-directory> --source-date-epoch <same-seconds>
```

Through RCLD-RSHR-170, Nix evaluation, builds, packages, NixOS modules, and
Nix-produced OCI artifacts are deferred and unclaimed. Do not install, repair,
invoke, or require Nix for these checkpoints. Run narrower ad hoc Cargo
commands through `cargo extbuild run --` from this repository root.

## Copyright

Except as otherwise noted, all files in the `myc` distribution are

`Copyright (c) 2026 Tyson Lupul`

## License

This repository is licensed under AGPL-3.0-or-later. See LICENSE.