Module replica 

A seed (D80): a node whose log is a copy of another node’s, taken one way, verified before it is kept, and never written to by anybody here.

Seeds, not peers. A home is the one node whose sequencer admits submissions for its log. A seed replicates that log page by page over GET /api/log, checks every page with SYNC.md’s three checks, and appends what passed through its own writer thread with Platform::replicate — so invariant 5 holds on a seed exactly as on a home, and nothing here is a second writer. It fetches the git objects the log points at, checks every ref the view names against the bare repository at the same oid, and serves what it holds.

One key, one grant

A seed is a named reader of its home, never an anonymous one: /api/log needs a node-wide read grant and the ACL parser refuses to give that to @anon. So the home’s operator registers the seed’s node public key, binds it as an operator, and grants that operator @node auditor (the node-wide read) plus read on the repositories it should hold. The credential the home issued for that principal is what this module presents, and the node key is what a seed signs witness statements with, so the name in the home’s bindings and the key on a statement are one identity.

Public keys come from the home’s GET /api/signers, because the log carries a key’s id and never the key. The home’s own node key is pinned beside this seed’s log on first contact, the same shape a node uses to pin its own key: a later start against a home signing with a different key refuses, since a copy that quietly follows its source to a new identity is not a copy of anything in particular.

What stops replication, and what does not

A page that fails a check, and an entry this build cannot fold, both halt replication at that seq. What was verified before it stays and is still served; nothing after it is attempted, and the halt holds until the process restarts. Skipping the entry instead would make this node a fork of its home that looks like a copy. An unreachable home is not a halt: the next round tries again.

An entry whose author key the home does not list is unverified, counted, and still replicated. Continuity and recomputation passed, and the home admitted it; what nobody here can say is who signed it, and the count is how a reader is told so.

A home that has evicted the entries this seed needs (409 log_evicted) cannot be followed at all. Its window resumes at a later seq, and this log’s next position is fixed by what it holds: the writer appends only at log.len() and the view folds only from genesis, so a chain with a hole in it cannot be held here, and SYNC.md’s gap rule forbids reporting two pieces as one. The seed records gap, stops, and keeps serving what it has. A home with a persisted log never answers that way.

Structs

Credential

The credential a home issued to a seed’s principal: one user:token line, the shape of a line in the home’s --auth-file.

Home

The home a seed copies: its base URL and the node key it signs with.

Progress

What one successful round did.

Replica

A running seed: the home it copies, the credential it copies with, and the platform it copies into.

Shared

What a seed shares with the platform serving it, so /api/view can say where replication stands without holding the replicator.

SignedStatement

A statement, the public key that signed it, and the signature.

Signers

The home’s signer table, as GET /api/signers served it.

SnapshotChain

The home’s attestation chain, as far as a reader has read its log: each RecordRefSnapshot’s id and the id its prev_snapshot names.

Status

Where replication stands, as /api/view reports it on a seed.

WitnessStatement

A seed’s word that it folded the home’s attestation snapshot (D80).

Enums

Relation

How two attestations stand by the fork rule (D80).

ReplicaError

Why a round stopped.

Constants

INTERVAL_SECS

Seconds between replication rounds in the daemon.

WITNESS_CHANNEL

The channel a witness statement is signed on.

WITNESS_HISTORY

Statements GET /api/witness serves beside the latest.

Functions

contact

First contact with a home: its signer table fetched, and its node key pinned beside this seed’s log (or checked against the pin already there).

fetch_signers

GET /api/signers on the home at base, checked: every key’s id is the hash of the key it is listed beside, and the node’s too.

pin_home

Pins node_id as this seed’s home on first contact, and refuses a different one afterwards.

pinned

The home key this seed pinned, if it has met its home before.

run

Runs replica forever, a round every INTERVAL_SECS, on the calling thread.