Phase 4: groups, encryption, and history

doc/2026-10-11T11-08-42Z_design_remaining_work/plan-phases.md

@@ -135,20 +135,21 @@ Goal: range sync and LogSync on the store, blob gating, and relay defaults that
 
 Goal: group encryption on DataScheme, with the history modes, the heads rule, warnings, and the scheme v1.
 
-| Step  | What                                                                                                                                                                                                  | Blocked by             | Parallel with     | Tests                                                                                                                                   |
-| ----- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------- | ----------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
-| P4.1  | DataScheme adapter around the crate: create, add, remove, update, process                                                                                                                             | Phase 1, P2.1          | P4.4, P4.8, P4.10 | unit; multi-member integration                                                                                                          |
-| P4.2  | Our DGM and the from_join membership fix, in our fork (decision 18)                                                                                                                                   | P4.1                   | P4.4              | regression: a joiner reads messages after joining; the fork's patch has its own test                                                    |
-| P4.3  | from_join: immediate update, and the withholding rule for pre-join application messages                                                                                                               | P4.1, P4.2             | P4.4, P4.5        | integration: a joiner cannot read pre-join messages but reads post-join ones                                                            |
-| P4.4  | Scheme v1: `serde_bytes` on the two fields, the version bound to the signed policy and copied in the header and welcome envelope, and welcomes sorted before signing (owner question 2)               | P4.1                   | P4.3, P4.5        | interop: v0 and v1 do not decode each other (verified); size tests (40.0 B per epoch); determinism test: sorted bytes are stable        |
-| P4.5  | `recent:N` and `full`: the adapter checks the group secret ID before `receive`, and keeps pre-welcome history outside the crate. The reproduction of the 80-of-120 failure comes first, as a red test | P4.1, P3.1 (transport) | P4.3, P4.4        | integration: a `recent:N` joiner reads the last N epochs, is refused older ones, and the welcome succeeds for every N and K combination |
-| P4.6  | Lazy full history: a joiner asks a member for older epoch secrets, sent encrypted to the joiner                                                                                                       | P4.5                   | P4.7              | integration: the request returns the older keys; a non-member gets nothing                                                              |
-| P4.7  | Heads rule: cap 32, the author's latest event always named, merge when the heads would exceed the cap                                                                                                 | P4.1, P1.3             | P4.8              | the S10 scenarios as tests; adversarial order tests                                                                                     |
-| P4.8  | Rotation policy (no periodic rotation, N7). PCS recovery is a CLI procedure: remove and re-add (N8)                                                                                                   | P4.1, P6.7 (CLI)       | P4.7              | integration: a compromised member is replaced and cannot read new epochs                                                                |
-| P4.9  | Warnings: 96, 128 and 1,000 members (N11); churn warnings (N34); local emission from the server; surfaces in logs and CLI status                                                                      | P4.1 (counts)          | P4.7, P4.8, P4.10 | unit: thresholds; e2e: the server warns at a threshold                                                                                  |
-| P4.10 | "scheme: none" notice in the UI and in group metadata (decision 8)                                                                                                                                    | P4.1                   | P4.9              | e2e                                                                                                                                     |
-| P4.11 | Measure DataScheme update cost at 100, 1,000 and 5,000 members with our adapter, for the BeeKEM comparison                                                                                            | P4.1                   | P4.4 to P4.10     | recorded in the phase document; no pass or fail                                                                                         |
-| P4.12 | Welcome size budget: chunking above the frame cap (owner question 4)                                                                                                                                  | P4.5                   | P4.6              | a `full` welcome above the cap is chunked and reassembled                                                                               |
+| Step  | What                                                                                                                                                                                                                                                                                                           | Blocked by             | Parallel with     | Tests                                                                                                                                                                       |
+| ----- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------- | ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| P4.1  | DataScheme adapter around the crate: create, add, remove, update, process                                                                                                                                                                                                                                      | Phase 1, P2.1          | P4.4, P4.8, P4.10 | unit; multi-member integration                                                                                                                                              |
+| P4.2  | Our DGM and the from_join membership fix, in our fork (decision 18)                                                                                                                                                                                                                                            | P4.1                   | P4.4              | regression: a joiner reads messages after joining; the fork's patch has its own test                                                                                        |
+| P4.3  | from_join: immediate update, and the withholding rule for pre-join application messages                                                                                                                                                                                                                        | P4.1, P4.2             | P4.4, P4.5        | integration: a joiner cannot read pre-join messages but reads post-join ones                                                                                                |
+| P4.4  | Scheme v1: `serde_bytes` on the two fields, the version bound to the signed policy and copied in the header and welcome envelope, and welcomes sorted before signing (owner question 2)                                                                                                                        | P4.1                   | P4.3, P4.5        | interop: v0 and v1 do not decode each other (verified); size tests (40.0 B per epoch); determinism test: sorted bytes are stable                                            |
+| P4.5  | `recent:N` and `full`: the adapter checks the group secret ID before `receive`, and keeps pre-welcome history outside the crate. The reproduction of the 80-of-120 failure comes first, as a red test                                                                                                          | P4.1, P3.1 (transport) | P4.3, P4.4        | integration: a `recent:N` joiner reads the last N epochs, is refused older ones, and the welcome succeeds for every N and K combination                                     |
+| P4.6  | Lazy full history: a joiner asks a member for older epoch secrets, sent encrypted to the joiner                                                                                                                                                                                                                | P4.5                   | P4.7              | integration: the request returns the older keys; a non-member gets nothing                                                                                                  |
+| P4.7  | Heads rule: cap 32, the author's latest event always named, merge when the heads would exceed the cap                                                                                                                                                                                                          | P4.1, P1.3             | P4.8              | the S10 scenarios as tests; adversarial order tests                                                                                                                         |
+| P4.8  | Rotation policy (no periodic rotation, N7). PCS recovery is a CLI procedure: remove and re-add (N8)                                                                                                                                                                                                            | P4.1, P6.7 (CLI)       | P4.7              | integration: a compromised member is replaced and cannot read new epochs                                                                                                    |
+| P4.9  | Warnings: 96, 128 and 1,000 members (N11); churn warnings (N34); local emission from the server; surfaces in logs and CLI status                                                                                                                                                                               | P4.1 (counts)          | P4.7, P4.8, P4.10 | unit: thresholds; e2e: the server warns at a threshold                                                                                                                      |
+| P4.10 | "scheme: none" notice in the UI and in group metadata (decision 8)                                                                                                                                                                                                                                             | P4.1                   | P4.9              | e2e                                                                                                                                                                         |
+| P4.11 | Measure DataScheme update cost at 100, 1,000 and 5,000 members with our adapter, for the BeeKEM comparison                                                                                                                                                                                                     | P4.1                   | P4.4 to P4.10     | recorded in the phase document; no pass or fail                                                                                                                             |
+| P4.12 | Welcome size budget: chunking above the frame cap (owner question 4)                                                                                                                                                                                                                                           | P4.5                   | P4.6              | a `full` welcome above the cap is chunked and reassembled                                                                                                                   |
+| P4.13 | Membership source: the adapter takes its members from the group fold (`GroupView.members` from `groups::fold`), not from the caller. After each local membership change the crate's roster equals the fold's set. A mismatch is a refusal and poisons the session. Remote control messages are not checked yet | P4.1, P2.4             | P4.5, P4.7        | integration: a membership change through the group path updates the roster; a mismatch is refused; property over random changes: the roster equals the fold after each step |
 
 ## 10. Phase 5: tags, documents, search