feat(core): bind owner-private Multiverse intent to signed event order

[loganj]

Summary

M02, stacked on draft #7321 (work/multiverse-01-order-b4f2fd6c at 46323b421888a45dcec687e784545d295f89145e). 538 additions / 0 deletions, five files against M01. M01 stays frozen and unchanged. Related obsolete preview #7145 is reference only, not a parent; #7140 and #7151 are independent work.

Adds a versioned, owner-private immutable intent codec bound to M01's placement projection:

• Reuses NIP-PMA's owner-to-self NIP-44 audience model, not its replaceable semantics. Existing authenticated owner Desktop contexts on X and Y read the same signed event, including Start Y observed by X. Destination-only encryption cannot provide that visibility. No group keys, executor login privilege, generic signer, or key export to runtimes.
• Strict payload contains only version, canonical community, owner, agent, host, request UUID, and Start/Stop. Event hash and signature are verified before decrypting; scope and target bindings are checked before producing the projection contribution. Unknown/legacy shapes fail closed rather than broadening exact-run Stop.
• Request identity remains separate from signed ordering identity. Newer sender seconds wins; lower event ID breaks ties. Exact signed bytes survive retries; rebuilding is not a retry. No arrival order, clock adjustment, expiry/skew gate, lease or relay sequencing.
• The new kind is reserved but relay ingest remains disabled. No runtime consumers/effects are enabled. Restart remains a separate current-host one-shot; Move can contribute Start only after ordinary Stop succeeds. Caller-supplied authoritative bindings, revocation and durable admission remain separate from cryptographic validation.

docs/multiverse-intent-wire.md traces actual native producer/receiver key+scope capture, authenticated query and timestamp+ID history seams. Next slice: owner-private relay ingest/read/live/COUNT/search coverage; then scoped native history/binding and durable admission before effects. The earlier M01–M17 list is provisional, not seventeen mandatory scaffolding PRs.

Authority and scope

Approved design local SHA-256 46724375f9913a7da96caabaf2020433e2b06fa8bb2f5f4879e30410f8188f9a.
Owner implementation authorization / source channel.

This does not add sharing/enrollment or supply owner credentials to a host. An executor without an existing authenticated owner Desktop context is unsupported. The owner-approved Desktop-host design accepts partition overlap and keeps keys out of keyless runtimes, unlike older remote-provider vision language. Broker proposed additions/keyless runtime PRs are not dependencies of this codec. No services, provisioning, installs, configuration or credential changes were performed.

Validation — exact head 125a56de70786d8b0dba724eaf5bc81981ba60bf

• Full buzz-core: 269 unit + 2 doc tests pass, none ignored, rerun after commit.
• Five new security/codec tests exercise cross-host projection with reversed delivery, exact-byte retry, independent hash/signature forgery, owner/community/agent/host scope, missing/duplicate/wrong tags, wrong kind/version, legacy/unknown fields/actions, nil requests, invalid URLs/keys, ciphertext/plaintext bounds and same-second/future timestamps.
• Three negative controls each fail a real receiver regression: remove hash verification, signature verification, or target-host binding. Restored before final package suite.
• Package all-target/all-feature Clippy with -D warnings, workspace fmt, differential file-size gate (10 policy tests), and whitespace checks pass. Clean worktree before/after final checks.
• Full just ci is incomplete, not passed: workspace Clippy requires uncached aes 0.8.4, unavailable offline. No dependency installation attempted. Tests compiled this worktree and its locked manifest via the existing reference Hermit cache. Remote CI remains a separate gate.

Review and limitations

Draft; do not merge or enable automatically. Independent review should challenge the owner-context audience assumption against the actual native call path, signature/hash-before-decrypt checks, caller authority provenance, cross-host visibility, exact-byte identity and history/error semantics. Review here is not native lifecycle acceptance or a replacement for repository security review.

Encryption is not metadata authorization. Relay owner-only read/privacy, complete history, revoked historical binding treatment, replay-safe bounded admission, current-host Restart, failure-final Move and keyless lifecycle integration are explicitly not implemented. Historic projection must never replay commands or discard fences in a way that resurrects older placement. No native app or remote lifecycle behavior is claimed tested.

[loganj]

Independent bounded M02 review — exact range

Reviewed 46323b421888a45dcec687e784545d295f89145e...125a56de70786d8b0dba724eaf5bc81981ba60bf (538 additions, five files). Source remained read-only. This is an independent analysis posted with the same GitHub account as the PR author, not independent-account approval.

Low-severity protocol conformance finding

crates/buzz-core/src/placement_wire.rs:171 deserializes directly into serde-derived Payload/Action. deny_unknown_fields does not restrict the payload to a JSON object: a positional seven-element array [v, community, owner, agent, host, request, action] is also accepted. The action also accepts {"start":null} instead of a string. A standalone probe compiling this exact source file and using existing cached dependencies confirms both forms pass the real signed/encrypted decode_event, alongside a canonical-object control.

This is a strict-wire-shape/interoperability gap, not a demonstrated authorization bypass: all identity/scope/signature checks still apply and there are no runtime consumers. Recommend explicitly rejecting alternate container/action types and adding receiver regressions before freezing the v1 format for additional consumers. No source fix made by this review.

Authentication/privacy conclusions and limits

• Owner-self NIP-44 uses one signed ordering event visible across already authenticated owner Desktop contexts; host keys do not gain owner authority. Hash and signature checks precede decryption; owner/community/agent/authorized-target comparisons precede projection construction.
• The allowlist and ownership provenance remain caller obligations. The native retention/signing/query seams exist, but no M02 producer, receiver, binding adapter or effect authorization is wired. A profile or decoded helper result must not become authority by itself.
• Kind 50003 is reserved and still rejected by relay ingest. Owner-private read/live/COUNT/search and search-storage exclusion are valid next-slice work, not implemented privacy guarantees. History must page owner-wide encrypted records with timestamp/ID ties and preserve revoked historical fences independently of current effect permission.
• Retry identity, same-second/lower-ID order and future timestamps match the approved policy. No new skew/expiry gate, host-key login, relay sequencing, new crypto infrastructure or lifecycle semantics requested.
• Reused the exact-head author evidence: 269 core + 2 doc tests, package Clippy, formatting, size policy tests and three killed receiver mutations. Did not rerun the full suites. Local full just ci remains incomplete because offline aes 0.8.4 is unavailable; no install workaround.

Gates remain open; keep draft

CI run 33865509636 and Docker run 33865509279 are still active at review publication. Security/Semgrep/zizmor/DCO are green; that does not certify all CI or runtime readiness.

No exact-range Codex security review is available. The existing trusted workflow rejects PRs whose base is not main (getPullRequest in .github/scripts/codex-security-review.js), and then pins live main rather than an arbitrary stacked base. Verified both the reviewed head and current main have that restriction. This PR targets M01, so I did not issue a command known to be unauthorized for this range, retarget the PR, or duplicate the active M01 monitor. A maintainer must resolve the supported stacked-review workflow/route; this comment is not a substitute bot result. GitHub currently reports no required checks for this stacked branch; that is not a policy waiver or merge permission.

No merge, readiness transition, source edit, rebase or push performed.