@network-harness/core-network

Claims ctx.network. Everything required to talk to another node: the envelope, outbound delivery, and inbound verification and routing.

The envelope certifies itself. A node id is derived from its key, and every envelope carries the sender's key, so a receiver checks that the key derives the claimed id, verifies the signature over canonicalBytes, and is done. First contact needs no handshake and no pre-provisioned peer row, and a stored message still proves who sent it long afterwards. The adapter only authenticates: whether to engage a sender it has never seen is the receiving protocol's decision.

Inbound, in order. The key derives the sender, the signature verifies, the envelope names this node, and it names a protocol and version this node runs. Then: deduplicate on the message id, open the session if the id is new, store, acknowledge, and dispatch. A rejected envelope is dropped and traced, and the reply says it was refused so the sender stops retrying what will never be accepted.

Both queues share one discipline. Outbound delivery to a peer and inbound dispatch into a protocol are the same problem against different targets: claim under a lease, settle against that claim, recover a lease that expired, and set a settled flag in the transaction that makes an item terminal -- which is what makes a terminal event reach the protocol once rather than once per crash. A message is signed when it is queued, so a retry puts identical bytes on the wire and the peer deduplicates.

A session belongs to one extension. Ownership is derived from the accessing context, never passed, and a session another extension owns is indistinguishable from one that does not exist -- so nothing can probe for another protocol's sessions. Events are dispatched into the owning extension's own context, so a listener registered by one protocol never observes another's messages.

A fetch is a message that expects an answer. It rides the same signed envelope in a frame marked fetch, so the pull path is authenticated by exactly the same rules as the push path, and serve scopes a resource to the extension that registered it.

The seam's conformance suite lives in tests/transportSuite.ts and runs against every transport, which is the claim the seam makes stated as a test: nothing above the seam varies by transport. HARNESS_TEST_IROH=1 runs it over real QUIC.