| … | … | @@ -56,7 +56,7 @@ settled by measurement or by decision — the discipline of §2.5. |
| 56 | 56 | | # | question | layer | settled by | |
| 57 | 57 | |---|---|---|---| |
| 58 | 58 | | 1 | where the registry autobase lives — own corestore or a namespace | **L1** | **measurement**: the daemon already namespaces three stores; read whether `IdentityRegistry`'s `prefix` + a namespace is sufficient, or whether blast-radius argues for its own | |
| 59 | | | 2 | who admits the first writer; how a second device joins | **L2** | **measurement first** — `DeviceLinker` exists in `packages/hyper-identity`; read it before designing. This is also hyper-social #49 | |
| 59 | | 2 | who admits the first writer; how a second device joins | **L2** | ✅ **MEASURED 2026-09-05 — §4.2.** There are **two** `DeviceLinker`s and `identity.md` §10 #2 points at the superseded one | |
| 60 | 60 | | 3 | ~120 DID-keyed call sites in `favela-web/lib` | **L4** | **measurement**: counted by grep, never audited. Sample them; most are probably mechanical | |
| 61 | 61 | | 5 | bridge credential custody | **L2** | **decision** — `identity.md` §6.1 says a bridge holds its own; where they live is #49 again | |
| 62 | 62 | | 6 | sequencing the fission | — | **decision**, and it got easier: the record layer is now closed | |
| … | … | @@ -73,12 +73,42 @@ That is **L2, and it is not atproto's fault** — it follows from deriving a roo |
| 73 | 73 | its seed. So it survives the fission **unless the room's genesis derivation changes**, and that is a |
| 74 | 74 | question to answer *before* building, not after inheriting 54 references worth of recovery machinery. |
| 75 | 75 | |
| 76 | ### 4.2 ⛔ TWO DeviceLinkers, and the spec points at the root-leaking one |
| 77 | |
| 78 | Read 2026-09-05. Same class name, same blind-pairing transport, **different security models**: |
| 79 | |
| 80 | | | file | lines | what crosses the wire | |
| 81 | |---|---|---|---| |
| 82 | | **v1** | `hyper-fleeky/packages/hyper-identity/lib/device-linker.js` | **86** | `{ mnemonic, instanceKey }` — **the BIP39 seed itself** | |
| 83 | | **v3** | `hyper-fleeky/pear-git-v3/lib/device-linker.js` | **298** | `{ deviceSecretKey, deviceProof, rootPubkey, label }` — a device-scoped keypair + `IdentityKey.attestDevice` chain | |
| 84 | |
| 85 | pgv3's own header says why it was replaced: |
| 86 | |
| 87 | > *"v1 transfers the full BIP39 mnemonic → compromised target leaks root. |
| 88 | > v3 transfers a device-scoped keypair + attestation chain → compromised [device is revocable]"* |
| 89 | |
| 90 | ⛔ **`identity.md` §10 #2 names "`DeviceLinker` blind-pairing" without saying which**, and the one in |
| 91 | the package **favela already depends on** (`favela-web/package.json:82` → `hyper-identity`) is **v1**. |
| 92 | Building favela-peer's admission from the obvious import would ship the model pgv3 explicitly |
| 93 | abandoned, on the path favela is already wired to. |
| 94 | |
| 95 | **It also decides a question from earlier today.** `interaction.md` §3.4.2 confines attestation to |
| 96 | minting and admission, and relies on the **epoch** as a revocation floor. That only means anything |
| 97 | under v3: **you cannot revoke a device that holds the seed.** v1 and epoch-based revocation are |
| 98 | incompatible, and only v3 makes the model coherent. |
| 99 | |
| 100 | **Consequence for the scope:** admission is not an open design question. It is a **port** — either |
| 101 | move v3 into `hyper-identity` (so the package favela depends on stops shipping v1), or have |
| 102 | favela-peer depend on pgv3's. That choice is real; the security model is not. |
| 103 | |
| 104 | ⚠ Corrected in passing: an earlier version of §5 cited |
| 105 | `packages/hyper-identity/lib/device-linker.js` at the repo root. It is under `hyper-fleeky/packages/`. |
| 106 | |
| 76 | 107 | ## 5. What must be measured before building |
| 77 | 108 | |
| 78 | 109 | In order, and none of it is design work: |
| 79 | 110 | |
| 80 | | 1. **`DeviceLinker`** (`packages/hyper-identity/lib/device-linker.js`) — the admission story is #2, #5 |
| 81 | | and #49 at once, and it is the least-known piece. |
| 111 | 1. ~~**`DeviceLinker`**~~ ✅ **DONE — §4.2.** |
| 82 | 112 | 2. **`bootSwarmDevice`'s 28 parameters** — classify each as atproto / generic / scar. That single |
| 83 | 113 | classification is most of the fission. |
| 84 | 114 | 3. **`favela-node`** — read it; it may fold in, become a bridge, or be deleted. |