id(currency): gateway request envelope — canonical encoding, verify_strict, nonce window, idempotency IDs (from #2062)

Follow-up from the currency control plane design (#2062), §4 of
doc/2026-10-29T12-42-21Z_design_currency_control_plane/.

Scope

The gateway's signed request envelope and the pre-ledger write path.

Reuse the existing pkgs/id scheme: directory_auth.rs Signed { key, at, nonce, signature } over id-request-v1\n{method}\n{target}\n{at}\n{nonce}\nsha256(body), 5-minute window, ReplayGuard, verify_strict (never verify) (design §4.1, §4.6).
Per-op canonical CBOR bodies, domain-tagged (id.currency.request.v1), with strict decoding like chain.rs.
Device → account resolution before authorization; issuance binds to the account key (design §4.1b).
Deterministic idempotency-ID derivation and the typed-error surface (design §4.3).
Resolve the idempotency-ID vs TigerBeetle monotonic-ID guidance tension (design §9.3).

Acceptance

A signed request round-trips: sign in a client, verify in the gateway, reject a tampered body, a stale at, and a replayed nonce.
A forgery fixture proves the gateway rejects a signature that only plain verify would accept.
Signature verification alone never authorizes: a valid signature from a non-minter is rejected.

Depends on

Nothing hard; F1/F2 for the end-to-end path.

Refs #2062

CODE-1169

Intake review

Related: #2062 (design §4), #2317/#2318 (sibling slices), #2321 (the PoC that consumes this envelope)

Notes: Gateway request envelope: canonical CBOR bodies, verify_strict only, nonce window + ReplayGuard, deterministic idempotency IDs. The body carries a full ## Acceptance list (round-trip + tamper/stale/replay rejections, forgery fixture, valid-signature-from-non-minter rejection), so this pass is labels-only.

Risks: The verify-vs-verify_strict distinction and the idempotency-ID vs TigerBeetle monotonic-ID tension (§9.3) are the two places a quiet shortcut becomes a security or correctness hole.

Suggested approach: Reuse directory_auth.rs's Signed scheme as scoped; resolve the §9.3 tension explicitly in the implementation note; test the forgery fixture first.

🤖 Agent note · filed

Agent: fleet monitor (repo-fleet-monitor)
Session / ID: repo-fleet-monitor run 2026-10-29T18:12Z (13:12 CDT)
Found via: monitor reconciliation
Task: Duty 2 intake enrichment — labels normalized and meta/enriched applied; acceptance criteria appended to the body only where no acceptance section existed (original body preserved verbatim above it). Still-live check this pass: no merged PR or fix commit explicitly resolving this issue was found in this pass's search.
Expectation: see the effort label; done = the acceptance criteria are met.
Links: this issue

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-h
Session / ID: task 7899 (attempt 1)
Found via: queue claim
Task: Triage of issue id(currency): gateway request envelope — canonical encoding, verify_strict, nonce window, idempotency IDs (from #2062) #2319 (id(currency): gateway request envelope) — execution lane assigned opencode; handing off to the laptop claimant, which polls for claimed, opencode-assigned, unbound tasks and launches a bound session.
Expectation: the claimant's bound session triages issue id(currency): gateway request envelope — canonical encoding, verify_strict, nonce window, idempotency IDs (from #2062) #2319 at current main and drives task 7899 to its terminal state.
Links: n/a yet

agent-note:v1
state: triaged (coverage pass)
Coverage pass 2026-11-03: reviewed in the fleet-wide per-issue pass (drift / overlap / already-handled / stale / blockers / ordering). Verdict: still live; queued in repo-health-code-pilot as triage at priority 40 (priority/normal). If this is already handled at current main, the triage closes it with evidence; if it needs splitting, the triage files the split.
Found via: coverage pass 2026-11-03

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-k
Session / ID: task 7899
Found via: queue claim (re-handoff: prior handoff's lease expired with no bound session)
Task: Triage issue id(currency): gateway request envelope — canonical encoding, verify_strict, nonce window, idempotency IDs (from #2062) #2319 (id(currency): gateway request envelope — canonical encoding, verify_strict, nonce window) — execution lane assigned to opencode; handed off to the laptop claimant (opencode-claimant), which launches the bound session that drives task 7899 to its terminal state.
Expectation: effort m; done = issue id(currency): gateway request envelope — canonical encoding, verify_strict, nonce window, idempotency IDs (from #2062) #2319 triaged at current main with evidence, fix path scoped or closed with evidence.
Links: task 7899 · issue id(currency): gateway request envelope — canonical encoding, verify_strict, nonce window, idempotency IDs (from #2062) #2319

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-b
Session / ID: task 7899
Found via: queue claim
Task: task 7899 for issue id(currency): gateway request envelope — canonical encoding, verify_strict, nonce window, idempotency IDs (from #2062) #2319 (triage) — execution lane assigned opencode
Expectation: the laptop claimant launches the bound opencode session, which drives task 7899 to its terminal state
Links: issue id(currency): gateway request envelope — canonical encoding, verify_strict, nonce window, idempotency IDs (from #2062) #2319

🤖 Agent note · picked up

Agent: queue worker (repo-worker-code), lane openchamber-scheduled-lane
Session / ID: task 7899 (attempt 9), lane c29174f1-48e0-4b13-b4ff-9b73ab67e9ab
Found via: queue claim from the scheduled lane
Task: Triage issue id(currency): gateway request envelope — canonical encoding, verify_strict, nonce window, idempotency IDs (from #2062) #2319. The previous OpenCode handoff had expired without a bound session; this lane has now claimed the task. Fresh check: issue is open; no relevant PR found in the repo search.
Expectation: verify current main and scope the fix path or close with evidence; no implementation unless the current-main check shows work is needed.
Links: id(currency): gateway request envelope — canonical encoding, verify_strict, nonce window, idempotency IDs (from #2062) #2319 · task 7899

🤖 Agent note · triaged

Agent: queue worker (repo-worker-code), lane openchamber-scheduled-lane
Session / ID: task 7899 (attempt 9); current source base origin/main a51be0e
Found via: scheduled queue triage; fresh GitHub state and current-main inspection
Task: Issue id(currency): gateway request envelope — canonical encoding, verify_strict, nonce window, idempotency IDs (from #2062) #2319 remains OPEN. No relevant PR was found; the sole text-search hit, fix(id): no leading blank lines when blockquote starts with fence/table/rule (#1002) #4816, fixes id(web): saving a blockquote that starts with a code block, table or rule inserts two stray blank lines at the top of the quote #1002 and is unrelated. Do not close or duplicate the implementation issue.
Finding: F3 is still unimplemented on current main. Reusable primitives already exist in pkgs/id/src/directory_auth.rs (Signed, sign/verify, strict Ed25519 verification, 5-minute window and ReplayGuard), but there is no id-currency-wire crate or currency gateway request envelope/route. pkgs/id/src/currency_poc is a conversion executor/recovery PoC, not the issue→transfer gateway.
Scope and ordering: implement the shared domain-tagged canonical request-body encoding, deterministic idempotency-ID derivation and typed errors in the shared wire module; reuse directory_auth rather than reimplementing signatures. Design §4.6-4.7 places the route in the existing web server while preserving a single logical ledger writer. F3 has no hard dependency; the end-to-end F5 PoC depends on F1-F3, with F2 depending on F1 (id(currency): currency registry schema + ledger-u32 allocator (from #2062) #2317/id(currency): deterministic account factory + per-currency system accounts (from #2062) #2318). Explicitly resolve design §9.3's idempotency-ID vs TigerBeetle monotonic-ID tension in the implementation note. No external blocker prevents F3 from starting.
Next: implementation proceeds under this existing issue; no duplicate follow-up task was created.
Links: id(currency): gateway request envelope — canonical encoding, verify_strict, nonce window, idempotency IDs (from #2062) #2319 · design doc doc/2026-10-29T12-42-21Z_design_currency_control_plane/2026-10-29T12-42-21Z_design_currency_control_plane.md

Navigation Menu

Repository navigation

id(currency): gateway request envelope — canonical encoding, verify_strict, nonce window, idempotency IDs (from #2062) #2319

Scope

Acceptance

Depends on

Intake review

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

id(currency): gateway request envelope — canonical encoding, verify_strict, nonce window, idempotency IDs (from #2062) #2319

Description

Scope

Acceptance

Depends on

Activity

developing-today commented on Oct 29, 2026

dezren39 commented on Oct 29, 2026

Intake review

dezren39 commented on Nov 3, 2026

developing-today commented on Nov 3, 2026

dezren39 commented on Nov 3, 2026

dezren39 commented on Nov 3, 2026

dezren39 commented on Nov 4, 2026

dezren39 commented on Nov 4, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions