I AdmissionCostRuleV1_AdmissionCostRuleV1FAdmissionCostRuleV1 {
costClassRuleId: u16
ruleKind: u8
} AdmissionParametersV1��AdmissionParametersV1�~AdmissionParametersV1 {
version: u8 = 1
relayPublicKey: 32 bytes
profileId: u16
schemeId: u16
conformanceClass: u8
roleBits: u16
verifierKey: bounded bytes[0..4096]
resourceCosts: sorted array[1..512] of
{ familyId: u8, operationId: u8, resourceClass: u8,
leaseClass: u8, costUnits: u64 }
tokenMaxBytes: u16 // <= 4096
issuanceUrl: optional canonical URL bytes[1..512]
issuerRelayKey: optional 32 bytes
validFromEpoch: u32
expiresEpoch: u32
nonce: 32 bytes
signature: 64 bytes
} AdmissionProfileV1�vAdmissionProfileV1�\AdmissionProfileV1 {
profileId: u16 // unique within descriptor, 1..65535
schemeId: u16
conformanceClass: u8 // 1 open, 2 private
roleBits: u16 // operations/hops at which this profile redeems
parameterUrl: optional canonical URL bytes[1..512] // evidence mirror only
parameterHash: 32 bytes
} AdmissionV1� AdmissionV1�AdmissionV1 {
profileId: u16
schemeId: u16
parameterHash: 32 bytes
token: bounded bytes[1..4096]
} BatchGetEntryV1�BatchGetEntryV1}BatchGetEntryV1 = tagged union {
0: { status: absent }
1: { status: found, sizeClass: u8, cellBlob: exact class bytes }
} BatchGetResultV1�ZBatchGetResultV1� BatchGetResultV1 {
version: u8 = 1
relayBinding: RelayResultBindingV1
requestNonce: 32 bytes
requestCommitment:32 bytes
entries: ordered array[1..64] of tagged BatchGetEntryV1
entriesCommitment:BLAKE2b-256(canonical(entries))
signature: 64 bytes
} BatchGetEntryV1RelayResultBindingV1 BatchGetSignaturePayloadV1�BatchGetSignaturePayloadV1�BatchGetSignaturePayloadV1 {
version: u8 = 1
relayBinding: RelayResultBindingV1
requestNonce: 32 bytes
requestCommitment:32 bytes
entriesCommitment:32 bytes
} RelayResultBindingV1
BatchGetV1�
BatchGetV1�BatchGetV1 {
version: u8 = 1
clientNonce: 32 bytes
slots: bounded array[1..64] of 32 bytes
admission: optional AdmissionV1
} AdmissionV1 !BlindAdmissionParametersRequestV1�!BlindAdmissionParametersRequestV1�BlindAdmissionParametersRequestV1 {
version: u8 = 1
profileId: u16
schemeId: u16
clientNonce: 32 bytes
}
BlindBackupChunkManifestV1�sBlindBackupChunkManifestV1�2BlindBackupChunkManifestV1 {
version: u8 = 1
backupId: 32 random nonzero bytes
encryptionProfile: BlindBackupEncryptionProfileV1
encryptionManifestHash:32 bytes
entries: sorted array[1..16777216] of {
path: portable relative ASCII bytes[1..512],
fileOffset: u64,
plaintextByteLength: u32[1..4194304],
ciphertextByteLength:u32[17..4194320],
chunkObjectId:32 random nonzero bytes,
chunkSalt:32 random nonzero bytes,
nonce: 24 bytes,
ciphertextHash: 32 bytes
}
totalPlaintextByteLength:u64
totalCiphertextByteLength:u64
} BlindBackupEncryptionProfileV1 BlindBackupEncryptionProfileV1�Q BlindBackupEncryptionProfileV1�+BlindBackupEncryptionProfileV1 {
version: u8 = 1
algorithmId: u16 = 1 // XCHACHA20_POLY1305_IETF
keyDerivationId: u16 = 1 // HKDF_SHA256
recoveryKeyId: 32 random nonzero bytes
keyEpoch: u32 // nonzero; rotation forces full re-encryption
} BlindBackupManifestV1��BlindBackupManifestV1��BlindBackupManifestV1 {
version: u8 = 1
relayPublicKey: 32 bytes
storeId: 32 bytes
externalJournalId: 32 random nonzero bytes
durabilityContinuityHash:32 bytes
backupId: 32 random nonzero bytes
backupFailureGroupId: 32 nonzero topology-witness-assigned bytes
storeManifestRevision: u64
storeManifestHash: 32 bytes
storeFormatHash: 32 bytes
coverageCutoffExternalUnixMillis:u64
coveredWalSequence: u64
coveredWalHash: 32 bytes
externalFloorRevision: u64
externalFloorHash: 32 bytes
externalCheckpointRevision:u64
externalCheckpointHash:32 bytes
baseFloorRevision: u64
baseFloorHash: 32 bytes
controlSnapshotHash: 32 bytes
backupEncryptionProfileHash:32 bytes
encryptionManifestHash:32 bytes
chunkManifestByteLength:u64
chunkManifestHash: 32 bytes
totalPlaintextByteLength:u64
totalCiphertextByteLength:u64
restoreVerifierPublicKey:optional 32-byte Ed25519 public key
cleanRestoreEvidenceHash:optional 32 bytes
createdExternalUnixMillis:u64
restoreSupportExpiresUnixMillis:u64
witnessPublicKey: 32-byte Ed25519 public key
signature: 64-byte Ed25519 signature
}
BlindBackupRetentionTransitionV1�� BlindBackupRetentionTransitionV1��BlindBackupRetentionTransitionV1 {
version: u8 = 1
relayPublicKey: 32 bytes
storeId: 32 bytes
externalJournalId: 32 random nonzero bytes
durabilityContinuityHash:32 bytes
backupId: 32 random nonzero bytes
backupManifestHash: 32 bytes
transitionRevision: u64
previousTransitionHash:optional 32 bytes // absent rev1; otherwise H(previous)
operation: u8 // 1 REGISTER, 2 EXTEND, 3 RETIRE
supportExpiresUnixMillis:u64
replacementBackupId: optional 32 bytes
effectiveExternalTimeFloorMillis:u64
witnessPublicKey: 32-byte Ed25519 public key
signature: 64-byte Ed25519 signature
} BlindCleanRestoreEvidenceV1��BlindCleanRestoreEvidenceV1�lBlindCleanRestoreEvidenceV1 {
version: u8 = 1
backupId: 32 random nonzero bytes
backupCandidateCommitment:32 bytes
restoredStoreManifestHash:32 bytes
verifiedWalSequence: u64
verifiedWalHash: 32 bytes
verifiedExternalFloorRevision:u64
verifiedExternalFloorHash:32 bytes
verifiedCheckpointRevision:u64
verifiedCheckpointHash:32 bytes
scrubbedObjectCount: u64
scrubFailureCount: u32 = 0
startedExternalUnixMillis:u64
completedExternalUnixMillis:u64
verifierPublicKey: 32-byte Ed25519 public key
signature: 64-byte Ed25519 signature
} BlindCoreAckV1��BlindCoreAckV1��BlindCoreAckV1 {
version: u8 = 1
relayBinding: RelayResultBindingV1
corePublicKey: 32 bytes
fork: u64
length: u64
signedHeadHash: 32 bytes
observedAtEpoch: u32
leaseEpoch: u32
result: u8 // 1 MIRROR_ACCEPTED, 2 RECENTLY_SERVED
requestNonce: 32 bytes
requestCommitment:32 bytes
signature: relay Ed25519 signature over canonical domain-separated bytes
} RelayResultBindingV1 BlindDescribeGetV1�BlindDescribeGetV1�BlindDescribeGetV1 {
version: u8 = 1
descriptorHash: optional 32 bytes // absent=current; present=history by hash
clientNonce: 32 bytes
} BlindDhtPointerV1�{BlindDhtPointerV1�bBlindDhtPointerV1 { // total canonical bytes <= 1000
version: u8 = 1
relayPublicKey: 32 bytes
descriptorSequence:u64
descriptorHash: 32 bytes
descriptorUrl: canonical HTTPS URL bytes[1..512]
transportBits: u16
issuedEpoch: u32
expiresEpoch: u32
nonce: 32 bytes
signature: 64 bytes
} BlindDispatchFrameV1�BlindDispatchFrameV1��BlindDispatchFrameV1 {
frameLength: u32 // bytes after this field, <= 4 MiB + 64
version: u8 = 1
frameKind: u8 // 1 request, 2 response, 3 error,
// 4 stream-control/data
familyId: u8
operationId: u8
flags: u8 = 0 // all bits reserved in v1
requestId: 16 bytes // random nonzero for unary/open; zero for stream
streamId: u64 // zero for unary/open request; nonzero after open
sequence: u64 // zero for unary; per-sender monotonic for stream
bodyLength: u32 // exact following bytes, <= family/op cap
body: exact canonical operation bytes
} BlindErrorV1� BlindErrorV1�BlindErrorV1 {
version: u8 = 1
code: stable u8 enum
retryable: u8 = 0 | 1
retryAfterEpoch: optional u32
} BlindExternalCommitWitnessV1�� BlindExternalCommitWitnessV1��BlindExternalCommitWitnessV1 { // conditionally present under the closed table below
version: u8 = 1
relayPublicKey: 32 bytes
storeId: 32 random nonzero bytes
externalJournalId: 32 random nonzero bytes
durabilityContinuityHash:32 bytes
durabilityProfileHash: 32 bytes
restoreEvidenceHeadSequence:u64
restoreEvidenceHeadHash:32 bytes
familyId: u8
operationId: u8
requestCommitment: 32 bytes
resultCommitment: 32 bytes
commitWalSequence: u64
commitWalHash: 32 bytes
coveringFloorRevision:u64
coveringFloorHash: 32 bytes
coveringFloorWalSequence:u64
coveringFloorWalHash: 32 bytes
writerEpoch: u64
writerFenceTokenHash: 32 bytes
externalLeaseRevision: u64
witnessedUnixMillis: u64
witnessPublicKey: 32-byte Ed25519 public key
signature: 64-byte Ed25519 signature
} BlindExternalJournalTopologyV1�� BlindExternalJournalTopologyV1��BlindExternalJournalTopologyV1 { // public generic durability evidence
version: u8 = 1
relayPublicKey: 32 bytes
storeId: 32 bytes
externalJournalId: 32 random nonzero bytes
durabilityContinuityHash:32 bytes
topologySequence: u64
previousTopologyHash: optional 32 bytes
replicationClass: u8 = 1
commitQuorum: u8 = 2
sharedFailureGroupId: 32 random nonzero bytes
liveStoreFailureGroupId:32 nonzero topology-witness-assigned bytes
backupFailureGroups: sorted array[0..16] of {
backupFailureGroupId:32 nonzero witness-assigned bytes,
operatorGroupId:32 random nonzero bytes
}
nodes: sorted array[3..3] of {
nodePublicKey: 32-byte Ed25519 public key,
operatorGroupId: 32 random nonzero bytes,
failureDomainId: 32 random nonzero bytes,
roleConflictBits: u16
}
issuedEpoch: u32
expiresEpoch: u32
witnessPublicKey: 32-byte Ed25519 public key
signature: 64-byte Ed25519 signature
} BlindForwardCloseV1�BlindForwardCloseV1�� BlindForwardCloseV1 {
version: u8 = 1
circuitNonce: 32 bytes
closeKind: u8 // 1 FIN(send side), 2 ABORT(both sides)
finalSendOffset: u64
reasonCode: u8 // generic bounded enum, no app text
} BlindForwardDataV1�BlindForwardDataV1�BlindForwardDataV1 {
version: u8 = 1
circuitNonce: 32 bytes
offset: u64
bytes: bounded opaque bytes[1..maxDataBytes]
} BlindForwardHopAcceptV1��BlindForwardHopAcceptV1��BlindForwardHopAcceptV1 { // returned before destination resources are exposed
version: u8 = 1
previousRelayKey: 32 bytes
previousDescriptorSequence:u64
previousDescriptorHash: 32 bytes
nextRelayKey: 32 bytes
nextDescriptorSequence: u64
nextDescriptorHash: 32 bytes
nextRelayBinding: RelayResultBindingV1
routeId: 16 bytes
circuitNonce: 32 bytes
nextStreamId: u64 // random nonzero on adjacent authenticated link
grantedWireClass: u8
circuitClass: u8
grantedInitialWindow: u32
maxDataBytes: u32
maxCircuitBytes: u64
idleMillis: u32
lifetimeMillis: u32
openedAtEpoch: u32
hopOpenCommitment: 32 bytes
handshakeFlight2: 96 bytes
nextSignature: 64 bytes
} RelayResultBindingV1 BlindForwardHopOpenV1��BlindForwardHopOpenV1��BlindForwardHopOpenV1 { // authenticated length-delimited adjacent-hop preface
version: u8 = 1
route: BlindTransportRouteV1
routeScope: BlindForwardRouteScopeV1
previousDescriptorSequence:u64
previousDescriptorHash: 32 bytes
circuitNonce: 32 bytes
requestedWireClass: u8
circuitClass: u8
grantedInitialWindow: u32
maxDataBytes: u32
maxCircuitBytes: u64
idleMillis: u32
lifetimeMillis: u32
clientRequestCommitment: 32 bytes
handshakeFlight1: 32 bytes
forwarderSignature: 64 bytes
} BlindForwardRouteScopeV1BlindTransportRouteV1 BlindForwardOpenResultV1��BlindForwardOpenResultV1�JBlindForwardOpenResultV1 {
version: u8 = 1
relayBinding: RelayResultBindingV1
routeId: 16 bytes
nextDescriptorSequence:u64
nextDescriptorHash:32 bytes
circuitNonce: 32 bytes
grantedWireClass:u8 // exactly requestedWireClass in v1
circuitClass: u8
streamId: u64 // random nonzero on this authenticated channel
grantedInitialWindow:u32 // exact circuitClass tuple
maxDataBytes: u32 // exact wireClass bytes in split-native
maxCircuitBytes: u64 // exact circuitClass tuple
idleMillis: u32 // exact circuitClass tuple
lifetimeMillis: u32 // exact circuitClass tuple
openedAtEpoch: u32
requestCommitment:32 bytes
nextHopAccept: BlindForwardHopAcceptV1
signature: 64 bytes
} BlindForwardHopAcceptV1RelayResultBindingV1 BlindForwardOpenV1��BlindForwardOpenV1�cBlindForwardOpenV1 {
version: u8 = 1
routeId: 16 bytes
nextDescriptorSequence:u64
nextDescriptorHash: 32 bytes
requestedWireClass: u8
circuitClass: u8
circuitNonce: 32 bytes
hopAdmission: AdmissionV1
innerHandshake: bounded opaque bytes[32] // exact Curve25519 Noise flight 1
} AdmissionV1 BlindForwardRouteHopV1�9BlindForwardRouteHopV1�BlindForwardRouteHopV1 {
hopIndex: u8 // 0..3
relayPublicKey: 32 nonzero bytes
descriptorSequence: u64
descriptorHash: 32 nonzero bytes
previousScopeHash: 32 bytes
scopeHash: 32 nonzero bytes
relaySignature: 64 bytes
} BlindForwardRouteScopeV1�sBlindForwardRouteScopeV1�<BlindForwardRouteScopeV1 {
version: u8 = 1
rootRouteId: 16 nonzero bytes
rootCircuitNonce: 32 nonzero bytes
rootRequestCommitment: 32 nonzero bytes
maxRelayCount: u8 // 2..4
expiresEpoch: u32 // nonzero
hops: BlindForwardRouteHopV1[1..4]
} BlindForwardRouteHopV1 BlindForwardWindowV1�BlindForwardWindowV1�BlindForwardWindowV1 {
version: u8 = 1
circuitNonce: 32 bytes
consumedThrough: u64
creditIncrement: u32 // 1..1 MiB; total credit remains capped
} BlindHealthChallengeV1�RBlindHealthChallengeV1�4BlindHealthChallengeV1 {
version: u8 = 1
descriptorSequence:u64
descriptorHash: 32 bytes
endpointId: u8 // exact signed descriptor endpoint
transportSupportBit:u16 // exactly one frozen support bit
requestedRoleBits:u16
requestedOperationBits:u32
clientNonce: 32 bytes
} BlindHealthResultV1��BlindHealthResultV1��BlindHealthResultV1 {
version: u8 = 1
relayPublicKey: 32 bytes
storeId: 32 random nonzero bytes
descriptorSequence:u64
descriptorHash: 32 bytes
endpointId: u8 // exact challenged endpoint
transportSupportBit:u16 // exact challenged one-hot support bit
durabilityContinuityHash:32 bytes
durabilityProfileHash:32 bytes
clientNonce: 32 bytes
readyRoleBits: u16
readyOperationBits:u32
clockState: u8 // 1 ready, 2 unsafe, 3 verifying
effectiveEpochFloor:u32
integrityState: u8 // 1 verified, 2 degraded, 3 failed
checkpointAgeBand:u8 // coarse universal band, no exact revision/time
scrubAgeBand: u8 // coarse universal band, no exact revision/time
rebalanceState: u8 // 0 stable, 1 copying, 2 catching-up, 3 fenced
capacityBand: u8
challengeEpoch: u32
signature: 64 bytes
} !BlindOhttpKeyConfigV1��BlindOhttpKeyConfigV1��BlindOhttpKeyConfigV1 {
version: u8 = 1
gatewayRelayKey: 32 bytes
gatewayDescriptorSequence:u64
configId: u8
kemId: u16
kdfId: u16
aeadId: u16
encodedPublicKey: bounded bytes[1..256]
notBeforeEpoch: u32
notAfterEpoch: u32
previousConfigHash:optional 32 bytes
signature: gateway relay Ed25519 signature
} "BlindOhttpTransportErrorV1�BlindOhttpTransportErrorV1{BlindOhttpTransportErrorV1 {
version: u8 = 1
code: u8 // 1 MALFORMED_INNER, 2 TARGET_UNAVAILABLE, 3 TARGET_TIMEOUT
} #BlindOuterEnvelopeV1�LBlindOuterEnvelopeV1�BlindOuterEnvelopeV1 { // exact total bytes = outerClass size
version: u8 = 1
outerClass: u8
innerLength: u32 // exact complete BlindDispatchFrameV1 bytes
innerDispatch: bytes[innerLength]
randomPadding: remaining bytes to exact class
} BlindDispatchFrameV1 $BlindReceiptV1�nBlindReceiptV1�CBlindReceiptV1 {
version: u8 = 1
protocol: exact ASCII "hiverelay-blind-cell-v1" (23 bytes)
relayBinding: RelayResultBindingV1
slotCommitment: BLAKE2b-256(slot)
cellBlobHash: 32 bytes
allocationCommitment: 32 bytes
requestCommitment:32 bytes
sizeClass: u8
allocationEpoch:u32
leaseClass: u8
leaseEpoch: u32
stateRevision: u64
receiptEpoch: u32
requestNonce: 32 bytes
result: u8 // 1 STORED, 2 SERVED, 3 RENEWED, 4 DROPPED
signature: 64-byte Ed25519 signature over canonical domain-separated bytes
} RelayResultBindingV1 % BlindRestoreEvidenceBundleV1�? BlindRestoreEvidenceBundleV1� BlindRestoreEvidenceBundleV1 { // fetched exact bytes, canonical size <= 524288
version: u8 = 1
heads: ordered array[1..385] of BlindRestoreEvidenceHeadV1
currentBackupManifestBytes:bounded canonical bytes[1..65535]
currentRetentionTransitionBytes:bounded canonical bytes[1..8192]
drillBackupManifestBytes:bounded canonical bytes[1..65535]
drillCleanRestoreEvidenceBytes:bounded canonical bytes[1..8192]
drillRetentionTransitionBytes:bounded canonical bytes[1..8192]
} BlindRestoreEvidenceHeadV1 &BlindRestoreEvidenceHeadV1��BlindRestoreEvidenceHeadV1�xBlindRestoreEvidenceHeadV1 { // independently advancing public profile-2 feed
version: u8 = 1
relayPublicKey: 32 bytes
storeId: 32 bytes
externalJournalId: 32 random nonzero bytes
durabilityContinuityHash:32 bytes
restoreEvidenceFeedId: 32 random nonzero bytes
evidenceSequence: u64
previousEvidenceHeadHash:optional 32 bytes
currentBackupManifestHash:32 bytes
currentRetentionTransitionHash:32 bytes // H(current REGISTER or EXTEND)
currentCoveredWalSequence:u64
currentExternalFloorRevision:u64
currentChunkObjectCount:u64
currentAvailabilityAuditHash:32 bytes
currentSupportExpiresUnixMillis:u64
drillBackupManifestHash:32 bytes
drillCleanRestoreEvidenceHash:32 bytes
drillRetentionTransitionHash:32 bytes // H(current REGISTER or EXTEND)
restoreDrillCompletedUnixMillis:u64
drillSupportExpiresUnixMillis:u64
issuedExternalUnixMillis:u64
expiresExternalUnixMillis:u64
issuedEpoch: u32 // checked floor(issuedExternalUnixMillis/21600000)
witnessPublicKey: 32-byte Ed25519 public key
signature: 64-byte Ed25519 signature
} 'BlindServiceDescriptorV1�WBlindServiceDescriptorV1��BlindServiceDescriptorV1 {
version: u8 = 1
relayPublicKey: 32 bytes
storeId: 32 random nonzero bytes
descriptorSequence:u64
previousDescriptorHash:optional 32 bytes
identitySequence: u64
previousRelayKey: optional 32 bytes
identityTransition:optional RelayIdentityTransitionV1
build: BuildProfileV1
protocols: sorted array[1..16] of ProtocolProfileV1
endpoints: sorted array[1..16] of TransportEndpointV1
cellSizeClassBits:u8
leaseClassBits: u8
maxBatchCount: u16 // <= 64
maxResponseBytes: u32 // <= 4 MiB
maxSponsoredCoreLength:u64
enabledOperationBits:u32 // operation-ordinal bitmap; bits 22..31 zero
admissionProfiles:sorted array[1..8] of AdmissionProfileV1
durability: DurabilityProfileV1
durabilityContinuityHash:32 bytes
durabilityProfileHash:32 bytes
storeLifecycleState:u8 // 1 ACTIVE, 2 DRAINING, 3 RETIRED
drainStartedEpoch:optional u32 // present exactly for DRAINING/RETIRED
capacityBand: u8 // coarse enum 0..7, not an exact byte count
issuedEpoch: u32
expiresEpoch: u32 // issued < expiry <= issued + 4
descriptorNonce: 32 bytes
signature: 64 bytes
} AdmissionProfileV1BuildProfileV1DurabilityProfileV1ProtocolProfileV1RelayIdentityTransitionV1TransportEndpointV1 (BlindStreamChunkPlainV1��BlindStreamChunkPlainV1�rBlindStreamChunkPlainV1 { // exact total = wireClass bytes - 16-byte AEAD tag
version: u8 = 1
wireClass: u8 // ciphertext: 1=4096, 2=16384, 3=65535 bytes
flags: u8 // bit 0 FIN; other bits zero
contentLength: u32
content: bytes[contentLength]
randomPadding: remaining bytes to (wireClass bytes - 16)
} )BlindTransportRouteV1��BlindTransportRouteV1��BlindTransportRouteV1 {
version: u8 = 1
routeKind: u8 // 1 OHTTP ingress→gateway,
// 2 Protomux entry→exit, 3 Protomux exit→storage,
// 4 MASQUE entry→exit, 5 MASQUE exit→storage,
// 6 mix hop→next hop
routeId: 16 random bytes
previousRelayKey: 32 bytes
previousEndpointId: u8
nextRelayKey: 32 bytes
nextDescriptorSequence:u64
nextDescriptorHash: 32 bytes
nextEndpointId: u8
envelopeClassBits: u16
wireClassBits: u8
maxCanonicalDispatchBytes:u32
maxEncapsulatedRequestBytes:u32
maxOpenBytes: u32
maxCircuitBytes: u64
maxConcurrentStreams: u16
hopAdmissionProfileId:u16
issuedEpoch: u32
expiresEpoch: u32 // issued < expiry <= issued + 4
routeNonce: 32 bytes
previousSignature: 64 bytes
} *BuildProfileV1��BuildProfileV1��BuildProfileV1 {
specHash: 32 bytes
abiHash: 32 bytes
vectorSetHash: 32 bytes
evidenceFormatHash:32 bytes
evidenceVectorSetHash:32 bytes
storeFormatHash: 32 bytes
storeVectorSetHash:32 bytes
privateIpcFormatHash:32 bytes
privateIpcVectorSetHash:32 bytes
buildArtifactHash:32 bytes
buildArtifactUrl: canonical HTTPS URL bytes[1..512]
buildManifestUrl: canonical HTTPS URL bytes[1..512]
buildManifestHash:32 bytes
releaseEvidenceBundleUrl:canonical HTTPS URL bytes[1..512]
releaseEvidenceBundleHash:32 bytes
releaseSupportHorizonHash:32 bytes
runtimeBoundaryEvidenceUrl:canonical HTTPS URL bytes[1..512]
runtimeBoundaryEvidenceHash:32 bytes
} +CoreMirrorRequestV1�CoreMirrorRequestV1�CoreMirrorRequestV1 {
version: u8 = 1
corePublicKey: 32 bytes
fork: u64
length: u64
signedHeadHash: 32 bytes
leaseClass: u8
clientNonce: 32 bytes
admission: AdmissionV1
} AdmissionV1 ,CoreOpenReplicationResultV1��CoreOpenReplicationResultV1��CoreOpenReplicationResultV1 {
version: u8 = 1
relayBinding: RelayResultBindingV1
wireProfileHash: 32 bytes
sessionClass: u8
controlChannelId: u64
parentChannelBinding:32 bytes
streamId: u64 // child adapter stream, random nonzero
maxSessionBytes: u64
idleMillis: u32
lifetimeMillis: u32
openedAtEpoch: u32
requestNonce: 32 bytes
requestCommitment:32 bytes
signature: 64 bytes
} RelayResultBindingV1 -CoreOpenReplicationV1�YCoreOpenReplicationV1�0CoreOpenReplicationV1 {
version: u8 = 1
wireProfileHash: 32 bytes
sessionClass: u8 // frozen C1/C2/C3 class
controlChannelId: u64 // client-random nonzero, unique in authenticated session
parentChannelBinding:32 bytes
clientNonce: 32 bytes
admission: AdmissionV1
} AdmissionV1 .CoreServeChallengeV1�PCoreServeChallengeV1�(CoreServeChallengeV1 {
version: u8 = 1
corePublicKey: 32 bytes
fork: u64
length: u64
signedHeadHash: 32 bytes
blockIndices: sorted distinct array[1..16] of u64 below length
clientNonce: 32 bytes
admission: optional AdmissionV1
} AdmissionV1 /CoreServeResultV1�CoreServeResultV1�CoreServeResultV1 {
version: u8 = 1
acknowledgement: BlindCoreAckV1
proofsAndBlocks: bounded canonical upstream Hypercore proof response
} BlindCoreAckV1 0DomainRegistryEntryV1��DomainRegistryEntryV1�gDomainRegistryEntryV1 {
domainId: u16
purpose: u8 // 1 request commitment, 2 result signature,
// 3 auxiliary WIRE signature
recipeId: u8 // 1 operation-defined commitment preimage,
// 2 Ed25519(domain || len64(payload) || payload)
exactAsciiBytes: canonical ASCII bytes[1..96]
} 1
DropCellV1�
DropCellV1�DropCellV1 {
version: u8 = 1
storageSlot: 32 bytes
expectedRevision:u64
expectedLeaseEpoch:u32
clientNonce: 32 bytes
signature: 64 bytes
} 2 DurabilityContinuityBindingV1�( DurabilityContinuityBindingV1�DurabilityContinuityBindingV1 {
version: u8 = 1
profileId: u8
externalJournalId:32 bytes
externalWitnessPublicKey:32 bytes
externalJournalReplicationClass:u8
externalJournalFailureGroupId:32 bytes
restoreEvidenceFeedId:32 bytes
} 3DurabilityProfileV1�qDurabilityProfileV1�VDurabilityProfileV1 {
profileId: u8 // 1 LOCAL_FSYNC_IDENTITY_RESET_V1,
// 2 CONTROL_RPO0_3_NODE_V1
storeFormatMajor: u16
storeFormatMinor: u16
storeFormatHash: 32 bytes
externalJournalId:32 bytes // all zero for profile 1; random nonzero for 2
externalWitnessPublicKey:32 bytes // all zero for 1; Ed25519 key for 2
externalJournalReplicationClass:u8 // 0 for 1; 1 LINEARIZABLE_3_NODE_QUORUM_V1 for 2
externalJournalFailureGroupId:32 bytes // zero for 1; stable nonzero for 2
externalCheckpointAgeBand:u8
externalJournalTopologyUrl:optional canonical HTTPS URL bytes[1..512] // absent for 1
externalJournalTopologyHash:32 bytes // zero for 1
restoreEvidenceFeedUrl:optional canonical HTTPS URL bytes[1..512] // feed-bound/backed evidence mirror
restoreEvidenceFeedId:32 bytes // zero for profile1/control-only; otherwise stable nonzero
restoreEvidenceCheckpointSequence:u64 // zero until a feed head; nonzero when backed
restoreEvidenceCheckpointHash:32 bytes // paired zero or complete signed head hash
acknowledgedRpoBand:u8 // 0 undeclared, 1 <=15m, 2 <=1h, 3 <=6h
targetRtoBand: u8 // 0 undeclared, 1 <=1h, 2 <=4h, 3 <=24h
redundancyClass: u8 // 0 single, 1 local redundant, 2 verified off-host backup; 3 reserved invalid
restoreDrillAgeBand:u8 // universal coarse age band or unknown
} 4ErrorProfileEntryV1�ErrorProfileEntryV1� ErrorProfileEntryV1 {
errorProfileId: u8 = 1
code: u8
directCorrelatedStatus:u16 = 200
protectedInnerStatus: u16 = 200
retryable: u8 = 0 | 1
retryAfterMode: u8 // 0 MUST be absent, 1 MUST be present
} 5GetCellResultV1�GetCellResultV1xGetCellResultV1 {
version: u8 = 1
sizeClass: u8
cellBlob: exact bytes selected by sizeClass
} 6 GetCellV1� GetCellV1�GetCellV1 {
version: u8 = 1
storageSlot: 32 bytes
clientNonce: 32 bytes
admission: optional AdmissionV1
} AdmissionV1 7InboxAppendAckV1��InboxAppendAckV1�wInboxAppendAckV1 {
version: u8 = 1
relayBinding: RelayResultBindingV1
topicCommitment: BLAKE2b-256(physicalTopic)
frameHash: 32 bytes
appendRevision: u64
storedAtEpoch: u32
expiresAtEpoch: u32
requestNonce: 32 bytes
requestCommitment:32 bytes
result: u8 = 1 // STORED
signature: relay Ed25519 signature
} RelayResultBindingV1 8
InboxAppendV1��
InboxAppendV1�pInboxAppendV1 {
version: u8 = 1
physicalTopic: 32 bytes
frameClass: u8 // 1=4 KiB, 2=16 KiB, 3=64 KiB total
frameHash: 32 bytes
clientNonce: 32 bytes
appendSignature: optional 64 bytes, required exactly for auth mode 1
admission: AdmissionV1
frame: exact fixed-size randomized opaque bytes
} AdmissionV1 9
InboxCreateV1�;
InboxCreateV1�InboxCreateV1 {
version: u8 = 1
allocationEpoch: u32
physicalTopic: 32 bytes
frameClassBits: u8
appendAuthMode: u8 // 0 open-capability, 1 signature-required
createPublicKey: 32 bytes
appendPublicKey: optional 32 bytes, required exactly for mode 1
renewPublicKey: 32 bytes
closePublicKey: 32 bytes
retentionClass: u8 // R1/R7/R30/R90; per-frame retention
leaseClass: u8
clientNonce: 32 bytes
createSignature: 64 bytes
admission: AdmissionV1
} AdmissionV1 :
InboxManageV1��
InboxManageV1�_InboxManageV1 {
version: u8 = 1
operation: u8 // 1 renew, 2 close
physicalTopic: 32 bytes
expectedRevision: u64
expectedLeaseEpoch:u32
leaseClass: u8 // NONE for close
clientNonce: 32 bytes
signature: 64 bytes
admission: optional AdmissionV1 // required for renew
} AdmissionV1 ;InboxReadResultV1�\InboxReadResultV1�InboxReadResultV1 {
version: u8 = 1
relayBinding: RelayResultBindingV1
requestNonce: 32 bytes
requestCommitment:32 bytes
snapshotRevision: u64
entries: bounded ordered array[0..64] of
{ appendRevision: u64, frameHash: 32,
frameClass: u8, frame: exact class bytes }
entriesCommitment:BLAKE2b-256(canonical(entries))
nextCursor: optional opaque bytes, maximum 128
signature: relay Ed25519 signature over InboxReadSignaturePayloadV1
} InboxReadSignaturePayloadV1RelayResultBindingV1 <InboxReadSignaturePayloadV1�;InboxReadSignaturePayloadV1�InboxReadSignaturePayloadV1 {
version: u8 = 1
relayBinding: RelayResultBindingV1
requestNonce: 32 bytes
requestCommitment:32 bytes
snapshotRevision:u64
entriesCommitment:32 bytes
nextCursor: optional opaque bytes[0..128]
} RelayResultBindingV1 = InboxReadV1� InboxReadV1�InboxReadV1 {
version: u8 = 1
physicalTopic: 32 bytes
cursor: opaque bounded bytes
limit: u16
clientNonce: 32 bytes
admission: optional AdmissionV1
} AdmissionV1 >InboxReceiptV1��InboxReceiptV1�hInboxReceiptV1 {
version: u8 = 1
relayBinding: RelayResultBindingV1
topicCommitment: BLAKE2b-256(physicalTopic)
stateRevision: u64
leaseClass: u8
leaseEpoch: u32
requestNonce: 32 bytes
requestCommitment:32 bytes
result: u8 // 1 created, 2 renewed, 3 closed
signature: 64 bytes
} RelayResultBindingV1 ? InboxWatchV1� InboxWatchV1�InboxWatchV1 {
version: u8 = 1
physicalTopic: 32 bytes
afterRevision: u64
limit: u16
maxWaitMillis: u16 // 1..30000
clientNonce: 32 bytes
admission: AdmissionV1
} AdmissionV1 @OperationProfileV1�_OperationProfileV1�8OperationProfileV1 { // ABI-registry metadata, not sent in each request
familyId: u8
operationId: u8
requestSchemaId: u16
resultSchemaId: u16 // zero only for kind-4-only stream verbs
allowedRequestKindBits:u8
allowedResultKindBits: u8
streamTransition: u8 // 0 unary, 1 core-child, 2 forward-open, 3 forward-active
maxRequestBodyBytes: u32
maxResultBodyBytes: u32
admissionMode: u8 // 0 none, 1 optional, 2 required
costClassRuleId: u16 // zero only when admissionMode=0
requestCommitmentDomainId:u16 // zero only when no request commitment exists
resultSignatureDomainId:u16 // zero when transport/authentication is sufficient
errorProfileId: u8 // 1 = canonical BlindErrorV1 precedence/mapping
transportSupportBits: u16
} BlindErrorV1 AProtocolProfileV1�ProtocolProfileV1�ProtocolProfileV1 {
protocolId: u16 // enum below
major: u16
minor: u16
featureBits: u64
profileHash: 32 bytes // exact protocol-specific schemas/vectors/dependency profile
} BProveCellResultV1�ProveCellResultV1�ProveCellResultV1 {
version: u8 = 1
receipt: BlindReceiptV1
sizeClass: u8
cellBlob: exact bytes selected by sizeClass
} BlindReceiptV1 C ProveCellV1� ProveCellV1�ProveCellV1 {
version: u8 = 1
storageSlot: 32 bytes
clientNonce: 32 bytes
admission: optional AdmissionV1
} AdmissionV1 D PutCellV1�� PutCellV1��PutCellV1 {
version: u8 = 1
storageSlot: 32 bytes
allocationEpoch: u32
sizeClass: u8
leaseClass: u8
clientNonce: 32 bytes
createPublicKey: 32 bytes
renewPublicKey: 32 bytes
dropPublicKey: 32 bytes
declaredBlobHash:32 bytes
createSignature:64 bytes
admission: AdmissionV1
cellBlob: exact bytes selected by sizeClass
} AdmissionV1 ERelayIdentityTransitionV1��RelayIdentityTransitionV1�{RelayIdentityTransitionV1 {
version: u8 = 1
oldRelayKey: 32 bytes
newRelayKey: 32 bytes
oldIdentitySequence:u64
newIdentitySequence:u64 // exactly old + 1
validFromEpoch: u32
reasonCode: u8 // generic rotation/compromise/recovery enum
transitionNonce: 32 bytes
oldSignature: 64 bytes
newSignature: 64 bytes
} FRelayResultBindingV1� RelayResultBindingV1��RelayResultBindingV1 { // nested in every persistent signed operation result
version: u8 = 1
relayPublicKey: 32 bytes
storeId: 32 random nonzero bytes
descriptorSequence: u64
descriptorHash: 32 bytes
durabilityProfileId: u8
durabilityContinuityHash:32 bytes
durabilityProfileHash: 32 bytes
restoreEvidenceHeadSequence:u64
restoreEvidenceHeadHash:32 bytes
externalCommitWitness: optional BlindExternalCommitWitnessV1
} BlindExternalCommitWitnessV1 G RenewCellV1�� RenewCellV1�RenewCellV1 {
version: u8 = 1
storageSlot: 32 bytes
expectedRevision:u64
expectedLeaseEpoch:u32
leaseClass: u8
clientNonce: 32 bytes
admission: AdmissionV1
signature: 64 bytes
} AdmissionV1 HSchemaCatalogEntryV1�SchemaCatalogEntryV1�� SchemaCatalogEntryV1 {
category: u8 // 1 WIRE, 2 EVIDENCE, 3 CLIENT_EXAMPLE, 4 INTERNAL_STORE, 5 PRIVATE_IPC
categoryLocalSchemaId:u16
schemaName: canonical ASCII bytes[1..96]
canonicalSchemaBytes: bounded bytes[1..65535]
} ITransportEndpointV1��TransportEndpointV1��TransportEndpointV1 {
endpointId: u8 // unique within this descriptor, 1..255
transportId: u8 // enum below
transportProfileHash:32 bytes
roleBits: u16 // generic infrastructure roles only
privacyProfileBits:u16 // routes this endpoint can participate in
canonicalUrl: UTF-8 bytes[1..512]
endpointKey: optional 32 bytes
envelopeClassBits:u16 // supported BlindOuterEnvelope classes
wireClassBits: u8 // supported Noise record classes; zero if not streaming
maxStreams: u16 // 0 for request/response-only endpoint
auxiliaryUrl: optional UTF-8 bytes[1..512]
auxiliaryHash: optional 32 bytes
}