id: design: residency boundaries for native bridge, federation and relays

Follow-up to #2284; coordinate with #2035, #2036, #2058 and #2283. Design fail-closed controls for residency-scoped hosted worlds on native sync, federation, relay and hot-world spill paths: distinguish storage, processing, transport and metadata; require verified jurisdiction and path policy rather than peer assertions; deny unknown/uncontrolled paths for residency-scoped content; define explicitly disclosed export outside the protected world without claiming subsequent control. Cover encrypted payload versus metadata, discovery, telemetry, in-flight messages and failure/negative tests. Include honest policy and launch gates, not claims that signatures or encryption guarantee locality.

Acceptance criteria

A design document exists (linked from this issue) covering fail-closed residency controls for native sync, federation, relay, and hot-world spill paths, distinguishing storage, processing, transport, and metadata.
The design requires verified jurisdiction and path policy (not peer assertions) and denies unknown/uncontrolled paths for residency-scoped content; any explicitly disclosed export path is described without claiming subsequent control.
Encrypted payload versus metadata, discovery, telemetry, in-flight messages, and failure/negative tests are each addressed.
Policy and launch gates are stated honestly — no claim that signatures or encryption guarantee locality.

CODE-1295

Intake review

Related: #2284 (origin), #2035, #2036, #2058, #2283; design sibling #3397.

Notes: Design-only. The storage/processing/transport/metadata distinction is the load-bearing framing — keep it explicit in the doc structure.

Risks: Honesty constraint is explicit in the filing: signatures/encryption must not be claimed to guarantee locality. Reviewers should check launch-gate language against that.

Suggested approach: Enumerate every path class (native sync, federation, relay, hot-world spill) in a table with per-class policy + negative tests, then derive the launch gates from the table.

— fleet monitor intake (2026-11-01)

🤖 Agent note · picked up

Agent: queue worker (repo-worker-code), lane F (repo-queue-worker-shift-f)
Session / ID: queue task 5750 (triage), claimed 2026-11-01T17:05Z
Found via: queue claim
Task: Triage id: design: residency boundaries for native bridge, federation and relays #3398: verify the design's premises against current main and the id: investigate: cross-jurisdiction shared worlds and federation — residency semantics for multi-tenant Durable Objects #2284 family, post a decision-ready design record, and route the design production as phased packet(s).
Expectation: m — design record + enqueued packet(s) listed on this issue this shift; Drew-only questions named explicitly, never a silent stall.
Links: queue task 5750; origin id: investigate: cross-jurisdiction shared worlds and federation — residency semantics for multi-tenant Durable Objects #2284; coordination id: investigate: multi-hop relay and P2P media paths — bridging peers, optional privacy relay, large-message chunking #2035, id: design: ID messaging/relay protocol v1 #2036, id: investigate: bridge semantics — hosted (HTTPS/WS) edition syncing with native Iroh nodes #2058, id: design: jurisdiction-aware per-user store routing (signup jurisdiction field, DO/blob/directory pinning) #2283; sibling id: design: jurisdiction-partitioned hosted worlds and world blobs #3397

agent-note:v1 — holder: repo-worker-code (OpenChamber scheduled lane), at 2026-11-02T14:47:00Z. event: parked; task: 5827; queue: repo-health-code-pilot. PR #3856 remains OPEN and Drew-owned (author+assignee dezren39, non-draft); hard stop. Resume after it resolves or an explicit handoff names the remaining work, then revalidate fresh. PR contents, checks, reviews, branch, worktree and source were not inspected or touched; no competing PR created.

Merge pull request #3856 from developing-today/design/id-3398

🤖 Agent note · done

Agent: queue worker (repo-worker-code), lane C
Session / ID: task 5827
Found via: queue claim
Task: Revalidated task 5827 for issue id: design: residency boundaries for native bridge, federation and relays #3398 after PR design(id): #3398 residency boundaries #3856's disposition — the prior Drew-owned hard stop's resume condition.
Expectation: done = design deliverable verified on main and issue closed
Links: PR design(id): #3398 residency boundaries #3856 MERGED 2026-11-02T15:49:37Z (merge commit 6c2ccec). Verified fresh on main: doc/2026-11-01_design_id3398.md exists (26,594 bytes) and covers the residency decision, path matrix for native sync / bridge / federation / relay / hot-world spill, storage-vs-processing-vs-transport-vs-metadata separation, verified jurisdiction/path policy with deny-unknown-paths, encrypted payload vs metadata, discovery, telemetry, in-flight messages, negative tests, launch gates, and a five-step mergeable implementation plan — the acceptance criteria of issue id: design: residency boundaries for native bridge, federation and relays #3398. Implementation follow-through lives in that plan and the still-open coordination items named on issue id: design: residency boundaries for native bridge, federation and relays #3398 (including docs(id): recommend jurisdiction-partitioned shared worlds #3407). Closing issue id: design: residency boundaries for native bridge, federation and relays #3398 as completed; stale in-flight labels removed in this same action.

Merge pull request #5629 from developing-today/queue/9596-5529-reside…

Navigation Menu

Repository navigation

id: design: residency boundaries for native bridge, federation and relays #3398

Acceptance criteria

Intake review

24 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

id: design: residency boundaries for native bridge, federation and relays #3398

Description

Acceptance criteria

Activity

developing-today commented on Nov 1, 2026

dezren39 commented on Nov 1, 2026

Intake review

dezren39 commented on Nov 1, 2026

24 remaining items

dezren39 commented on Nov 2, 2026

dezren39 commented on Nov 2, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions