SealedRevision

Purpose

A group revision as it travels — the only form a revision takes on the swarm. Membership never leaves a member's device in the clear: the whole GroupRevision — who is in the epoch, who minted it, what it succeeds — is sealed under the epoch's key, so the swarm carries a record it cannot read. Like a message, it is not posted to a shared feed; it is dropped into each member's own inbox alongside their key delivery, and shows only the id of the key that opens it. A member who holds that key unseals the record; a member who does not never receives it. This is the membership half of the same idea that keeps messages sealed: the store sees structure only where structure is unavoidable, and here it is not.

Attributes

• key id: is Text that identifies the epoch key the revision is sealed under, such as "k-0163"
• sealed payload: is Text that carries the sealing of the revision, opaque

Invariants

• The key id is not empty.

Operations

unseal

Given the epoch's GroupKey, recovers the membership, yielding the GroupRevision the sealed payload seals — whole: the creator and each member come back with both their name and their shown name, exactly as sealed; fails when the given key is not the key that sealed it — the record is readable whole or not at all. Result: the GroupRevision it seals; fails when the key is not the one that sealed it

Scenarios

The round trip keeps the shown names

Given: a GroupRevision "g-7421.3" whose creator is the Member with name "karin.dahl" and shown name "Karin Dahl", naming that creator and the Member with name "sofie.lind" and shown name "Sofie Lind" among its members, sealed under the GroupKey "k-0163" When: the sealed revision is unsealed with that key Then: the unsealed revision's creator carries the shown name "Karin Dahl", and the member "sofie.lind" carries the shown name "Sofie Lind" — the seal is not a likeness, it is the record

A sealed revision shows only its epoch

Given: key id "k-0163" and a sealed payload When: a SealedRevision is created Then: it is accepted and reads back under key id "k-0163" — it names no group and no membership in the clear

A sealed revision betrays no membership

Given: the GroupKey "k-0163" and a GroupRevision "g-7421.3" whose members are anne.bruun, sofie.lind, and karin.dahl When: the revision is sealed under the key and a SealedRevision is created over the payload Then: the sealed payload carries neither "karin.dahl" nor "g-7421.3" readably

The epoch's key recovers the membership

Given: the GroupKey "k-0163", and a SealedRevision under key id "k-0163" whose sealed payload is that key's sealing of the GroupRevision "g-7421.3" with members anne.bruun, sofie.lind, and karin.dahl When: unseal is performed with that key Then: the yielded revision is "g-7421.3" naming those three members

Another key recovers nothing

Given: the GroupKey "k-0163", a GroupKey "k-0264" with different material, and a SealedRevision under key id "k-0163" whose sealed payload is the first key's sealing of a GroupRevision When: unseal is performed with the second key Then: the unsealing fails because the given key is not the key that sealed the payload