CEG normative absorption for v4.0: streaming + fountain + ALM + WholenessWitness + holonomic primitives

[emooreatx]

Goal

By CIRIS v4.0 (CEWP-1.0 holonomic federation seal), everything we've designed across the realtime A/V + holographic storage + holonomic substrate work must be promoted from informative implementation guidance to normative CEG wire format.

Without normative status, two independent implementations of the federation will diverge at exactly the points where the holonomic property requires agreement — Merkle roots over the same claim sets must match across implementations; ALM planners must arrive at the same tree from the same inputs; fountain symbol IDs must be deterministic; rarity computations must agree; witness reconciliation depends on byte-equal canonical encodings.

This issue scaffolds the cross-repo coordination for what CIRISRegistry needs to absorb into CEG normative sections by v4.0.

What is currently informative + needs to become normative

Each of these is shipped or designed at the edge / persist / verify layer today as implementation guidance. They MUST become CEG normative for interoperability at scale.

From CIRISEdge v3.6.x – v3.8.0 (shipped substrate)

Component	Current state	Normative ask
`SealedAvChunk` wire byte layout	Informative (docs/CEG §10.5.8 discussion)	§N realtime A/V chunk wire-format normative
`codec_id` namespace	Filed at #84, not ratified	§N.1 codec_id namespace ratified (0x01 AV1 SVC / 0x02 JPEG XS / 0x03 MDC / 0xFF opaque)
`ChunkLayer { spatial, temporal, quality }`	Informative	§N.2 normative layout
`SubStreamPath = Vec`	Informative	§N.3 variable-depth MDC path encoding
MLS ciphersuite `0x004D` X-Wing	openmls 0.8.1 ships; no IANA code-point	§N.4 CEG-reserved code-point until IANA assigns; migration rule
`RosterDelta::Batch` wire shape	Informative	§N.5 mass-join commit batching

From CIRISEdge v3.8.0 ALM substrate

Component	Current state	Normative ask
`RelayCapacity` advertisement canonical bytes	Informative (`b"CIRISALM-CAPv2\0\0"` domain sep)	§M ALM capacity-advertisement wire normative
`SignedRelayCapacity` envelope	Informative	§M.1 signed envelope, hybrid sig fields
`SubStreamCommitment` shape	Informative	§M.2 per-substream commitment layout
`has_room_for_substream` algorithm	Informative	§M.3 deterministic admission algorithm (so two ALM planners agree)
`AlmJoinPlanner::plan` selection algorithm	Informative	§M.4 deterministic parent selection (stale → layer → room → reachability filter, then RTT ascending sort, tiebreaks specified)
`MultiParentSubscription` dedup discipline	Informative	§M.5 `(epoch, chunk_seq)` dedup key normative

From CIRISPersist#227 — fountain content + eviction

Component	Current state	Normative ask
`FountainManifestV1` canonical bytes	Drafted, edge#133 ratified, persist starting	§P.1 manifest wire layout (incl. the `original_content_length` add I flagged)
`FountainSymbolV1` layout	Drafted	§P.2 symbol byte layout
`retention_priority: u8` computation	Edge owns; persist treats opaque	§P.3 edge-side priority encoding (SVC layer × source/repair × position bucket) so two edge implementations agree on byte values for the same input
SHA-256 per-symbol hash discipline	Drafted	§P.4 hash chain in manifest
Hybrid signature requirements	Following #225 hard cut	§P.5 reference to #225's signing rules + manifest-binding
Eviction tier table (T1..T5 + EnvelopeOnly)	Drafted	§P.6 retention tier definitions (keep counts, reconstruction guarantees)
Decay trigger (consent SLA)	Drafted	§P.7 dual-trigger (DiskPressure + consent decay)

From CIRISEdge#133 — codec wiring (v3.9.0)

Component	Current state	Normative ask
RaptorQ wrap canonical mapping	TBD in v3.9.0 work	§Q fountain encode/decode contract (so different implementations produce identical symbol bytes for the same input)
AV1 chunk → fountain symbols mapping	TBD	§Q.1 chunking + padding discipline
Opus frame → fountain symbols mapping	TBD	§Q.2 voice chunking
Per-codec wire compatibility floor	TBD	§Q.3 minimum-decode requirement per codec_id

From CIRISEdge#134 — swarm-coordinated rarest-shard retention (v3.10.0)

Component	Normative ask
`FountainCompressRequest` canonical bytes	§R.1 swarm-coordination request envelope
`FountainHoldingClaim` canonical bytes	§R.2 holding-claim envelope
Rarity computation algorithm	§R.3 deterministic rarity scoring (so two peers compute the same priority recomputation)
Reweighted `retention_priority` formula	§R.4 deterministic byte formula (so persist's ORDER BY produces the same evictions everywhere)
Deadline / propagation requirements	§R.5 swarm-coordination timing

From CIRISEdge#135 — WholenessWitness (v3.10.0 keystone)

Component	Normative ask
`WholenessWitness` canonical bytes (`b"CIRIS-WITNESS-v1\0\0"`)	§W.1 witness envelope normative
Merkle tree construction algorithm	§W.2 leaf encoding (sha256 of canonical envelope bytes), sort order (`(claim_kind, claim_id)` ASCII), odd-node duplication rule (so two peers arrive at identical roots)
Publish cadence requirements	§W.3 minimum publish frequency for conformance
Reconciliation protocol	§W.4 Merkle-proof exchange + claim envelope fetch
Hybrid signature discipline	§W.5 reference to #225 + ML-DSA-65 required
`covers_claim_kinds` namespace	§W.6 valid claim-kind strings ("federation_key", "trace", "relay_capacity", "holding_claim", etc.)

From CIRISEdge v3.10.0 — deterministic ALM topology (new)

Component	Normative ask
Tree topology = pure function of (capacity_ads, trust_graph, reachability_snapshot)	§T.1 the function MUST be specified — sort order, tiebreaks, root-of-tree selection rule
Two peers with identical inputs produce identical trees	§T.2 conformance test (input vector → expected tree hash)

From CIRISEdge v3.10.0 — recursive trust bootstrap (new)

Component	Normative ask
Trust chain following algorithm	§B.1 deterministic admission rule (any signed claim chaining to a trust root in the receiver's graph)
Bootstrap admission test	§B.2 conformance test (a peer joining with no priors arrives at a valid federation view)

Why this matters for v4.0

A holographic substrate (v3.8.0 + v3.9.0 + v3.10.0 part 1) gives graceful degradation. A holonomic substrate (v3.10.0 parts 2-4) gives graceful reconstitution from any sufficient fragment.

Both depend on byte-equal canonical encodings + deterministic algorithms. Without normative CEG status:

• Two implementations of `WholenessWitness` produce different Merkle roots from the same claim set → reconciliation is impossible
• Two implementations of `AlmJoinPlanner` arrive at different ALM trees from the same inputs → the holonomic topology fails
• Two implementations of `retention_priority` evict different symbols under the same pressure → swarm coverage diverges
• Two implementations of `FountainSymbol` produce different bytes for the same content → persist's symbol_hashes verification fails

These aren't theoretical risks — they're the immediate breakage modes of a non-normative substrate.

What CIRISRegistry needs to produce

A CEG 1.1 spec absorbing all of the above into normative §N / §M / §P / §Q / §R / §W / §T / §B sections, with:

1. Canonical byte encodings for every envelope shape — length-prefixed, sort-order specified, domain separators frozen
2. Deterministic algorithms for retention_priority computation, rarity scoring, Merkle tree construction, ALM topology, trust-chain following
3. Conformance test vectors — input → expected output pairs that any CEG-conformant implementation must reproduce byte-for-byte
4. Migration paths for each currently-informative-to-normative promotion (no flag day; existing v3.6+ wires interop with v4.0 wires)
5. §0.1 conformance language updates acknowledging the new sections

Sequencing

This work proceeds in lockstep with edge cuts:

Edge cut	CEG normative addition
v3.8.0 (shipping)	§N realtime A/V chunk wire + §M ALM substrate envelope shapes — immediate priority
v3.9.0 (next)	§Q codec wiring contract (rav1e/dav1d/opus/raptorq fountain mapping)
v3.10.0	§P fountain content/manifest (incl. `original_content_length` add) + §R swarm rarity + §W WholenessWitness + §T deterministic topology + §B recursive trust bootstrap
v4.0	CEG 1.1 published with all of the above normative; conformance test vectors locked; FREEZE

Filed-by

Claude Code (CIRIS Edge v3.8.0 ship coordination → v4.0 cross-repo scaffolding). Architectural framing from @emooreatx ("they need to make everything else we have done normative, streaming and fountain encoding etc... all necessary for the mesh to operate at scale as desired").

Composes with:

• CIRISEdge#84 (codec_id namespace — already filed here)
• CIRISEdge#131 (v3.8.0 PR — substrate shipping)
• CIRISEdge#133 (v3.9.0 codec wiring)
• CIRISEdge#134 (v3.10.0 swarm rarity)
• CIRISEdge#135 (v3.10.0 WholenessWitness)
• CIRISPersist#227 (v8.0.0 layer-aware eviction)

This is the gate to v4.0 on the spec side. Without this work landing in CEG 1.1, v4.0 cannot ship as "the holonomic federation seal" because the federation isn't actually interoperable across implementations.

[emooreatx]

Accord-holder ruling: this is the CEG 1.0 line, not a 1.1 major. The 1+4 attestation grammar (§3/§4/§5 subject_kinds/§0.5–0.9 canonicalization/§6/§7/§8) is what's frozen. The holonomic wave — codec/chunk wire, ALM envelopes, fountain manifest/symbol bytes, rarity scoring, WholenessWitness Merkle rules, deterministic topology, trust bootstrap — is additive normative transport/substrate sections + deterministic-algorithm pins + conformance vectors. None of it alters the 1+4 envelope or breaks an existing committed shape, so it rides the 1.0 line as additive cuts — the same category as §10.5.8 (0.13), the streaming standards-anchoring (0.15), and RC2's three new subject_kinds, all shipped under "no 1+4 change." Retarget this epic CEG 1.0 (absorbed additively), not 1.1.

First section landed — RC9: §N.1 codec_id namespace → §10.5.8.2 (closes #84).

Sequencing (lockstep with edge cuts), each an additive RC on the 1.0 line:

Edge cut	CEG section	Status
v3.8.0	§10.5.8.2 codec_id (§N.1)	✅ RC9
v3.8.0	SealedAvChunk full byte layout (§N), ChunkLayer (§N.2), SubStreamPath (§N.3), MLS 0x004D X-Wing code-point (§N.4), RosterDelta::Batch (§N.5)	ready to absorb — point me at the frozen byte layouts
v3.8.0	ALM capacity/commitment envelopes + deterministic admission & parent-selection (§M.1–M.5)	ready when the algorithms are frozen (need the tiebreak spec to be final)
v3.9.0	fountain manifest/symbol bytes + encode/decode contract (§P, §Q)	when v3.9.0 lands
v3.10.0	swarm rarity (§R), WholenessWitness Merkle (§W), deterministic topology (§T), recursive trust bootstrap (§B)	when v3.10.0 lands

The gating discipline for each: I'll absorb a section as normative only once its byte layout + sort order + domain separators + tiebreaks are frozen on the edge side and conformance vectors (input→expected-bytes) exist — that's what makes two implementations actually converge (the whole point of #85). A "drafted/TBD" item isn't ready to pin; ratifying a moving target would re-create the divergence hazard. So: as each edge cut freezes its shapes + ships vectors, ping here and I'll cut the matching RC.

Want me to absorb the rest of the v3.8.0 batch now (§N full chunk layout + §M ALM)? If #131's byte layouts and the ALM tiebreak/selection algorithm are frozen, point me at them and I'll cut RC10. This issue stays open as the absorption tracker.

[emooreatx]

Absorption underway — edge v4.0.0 is the freeze trigger. Ruling applied: absorb now, conformance vectors as the 1.0-freeze gate.

Landed:

• RC9 — §N.1 codec_id namespace → §10.5.8.2 (CEG §10.5.8 — codec_id namespace for realtime A/V SealedAvChunk #84 closed).
• RC10 (v-ceg-1.0-rc10) — §N realtime A/V chunk wire, byte-exact from the v4.0.0 reference impl:
  • §10.5.8.3 SealedAvChunk (52-byte header map; v3.7.0 length-disambiguated backward-compat)
  • §10.5.8.4 ChunkLayer + ReceiverLayerPolicy (monotonic SVC axes; per-receiver drop over the existing entitlement surface)
  • §10.5.8.5 double-seal + deterministic nonce derivation (b"CIRIS-AV-INNER-V1" / b"CIRIS-AV-OUTER-V1" domain separators pinned)

Next — RC11 (the holonomic file, new §19): §M ALM (RelayCapacity v2 / CIRISALM-CAPv2\0\0, SignedRelayCapacity, SubStreamCommitment, SubStreamPath, deterministic admission + parent-selection weights CAPACITY=50/TRUST=30/REACH=20), §P fountain (FountainManifestV1, FountainSymbolV1, retention_priority bit-pack), §Q raptorq symbol-id determinism, §R swarm rarity (ciris-edge/holding-claim/v1, ciris-edge/compress-request/v1), §W WholenessWitness (Merkle RFC 6962 + odd-node dup, WW-v1-empty sentinel), §T deterministic topology, §B recursive trust bootstrap — each transcribed byte-exact from edge v4.0.0.

The freeze-gate caveat (verified): no conformance vectors exist yet — none in edge v4.0.0 (property-tests only), none in CIRISConformance; even the base §0.9 vector set (Conformance#9) is open. So per the absorb-now-vectors-gate ruling: CEG pins the byte layouts now, and input→expected-bytes vectors generated from the v4.0.0 reference impl are the named #57 freeze gate — 1.0 does not label until they prove cross-impl byte-equality. The shapes are frozen (edge-tagged) but unproven across a second implementation; the vectors are what close that. Tracking under #57 + CIRISConformance#9.

[emooreatx]

Absorption verdict (four-agent CEG review) — absorb WITH guardrails, not verbatim

Edge tagged v4.0.0 (the freeze trigger). A four-agent review (supersession map / anonymous-tier coexistence / absorption-correctness / adversarial security) concluded: the holonomic concept is sound and additive at the wire layer (no 1+4 break), but absorbing edge v4.0.0 verbatim would inject fail-secure regressions. RC11 therefore pins the holonomic wire shapes AND binds them under normative guardrail invariants that subordinate them to CEG's existing trust / PQC / consent / replication / anonymous guarantees. Matching edge implementation fixes: CIRISEdge#143 (in-flight hardening, not a non-conformance flag).

"Supersedes existing structures"? → mostly RECONCILE (4 of 5), supersedes nothing in the trust core

• WholenessWitness vs §10.1.6 V058 R1/Q1 quorum-merge ([Epic] Remove Spock — replication becomes CEG-native (all cross-region data → signed CEG envelopes) #58) — ⚑ highest-value. WholenessWitness has no quorum, no revision anti-rollback; if it "supersedes" the quorum-merge we lose front-running resistance + revoked-key-resurrection protection. → §W is a divergence detector that triggers the quorum-merge for revocation/partner_record/org_membership; it never decides one.
• WholenessWitness vs §10.3 "witness" (STH cosigner) — terminology inversion (self-witness vs cosigner). → namespace wholeness_witness:; not append-only/anti-equivocation (≠ §10.3.1/§10.5.1).
• Recursive bootstrap vs §5.6.8.10 admission — → trust-discovery only; gated downstream by owner-binding + consensus_protocol.
• FountainHoldingClaim vs §10.1.2 holds_bytes:* — → specialize, don't duplicate; inherit §10.1.4 self/family suppression.
• Deterministic ALM vs §10.5.8 / §8.1.13.1.1 / §10.5.6 D6 — → the deferred relay-tree profile; reachability_observations stay ephemeral (never attested/replicated/witness-leafed).

Coexists with the anonymous tier (NodeCore#22)? → yes, with named invariants (edge already violates one)

Orthogonal in 3 of 4 dimensions (anonymous content = parallel record class, no stable signer). Edge gap: the WholenessWitness leaf-walk has no exclusion guard → a naive build sweeps cohort_scope:self/anonymous rows into a signed federating root (re-attribution). Fixed by WW-2 + edge#143.

Normative invariants RC11 will state (new §19 holonomic file)

• WW-1/2/3 — witness covers only its claim_namespaces; MUST NOT cover anonymous-tier or cohort_scope:self local-tier rows; family/community witnessed only at opaque content_id grain.
• RB-1 / N1 / N2 — recursive admission = trust+serve only; non-infra membership needs owner-binding (§5.6.8.10) + consensus_protocol vote; infra stays founder-quorum; depth ≤ 5 + cycle-reject + §13.3 weight cap; self-supplied chains aren't admission evidence.
• SR-1/2/3 / N5/N6/N7 — consent-decay/revocation overrides rarity (a withdrawn content_id is evict-eligible regardless of rarity); anonymous content exempt from swarm-mandatory retention (LRU only); holding claims possession-bound; reconstitution-from-any-fragment scoped to the witnessed corpus only.
• N3/N4 — WholenessWitness is federation-tier (§10.1.5.1.1 binds it): hybrid PQC verified at ingest + before persistence; retain + surface same-(peer,epoch) divergent roots as equivocation proof.
• N8 — capacity ads hybrid-verified before scoring; self-asserted capacity not the dominant unbounded selection term.
• Canonicalization boundary — §19 uses binary length-prefixed, domain-separated preimages (NOT §0.9 JCS — these are verify-to-verify transport primitives, never JSON envelopes); state it so signatures verify cross-impl.

PIN verdicts (the §1.1 wire-vs-internal line)

• PIN-NORMATIVE: signed binary preimages (RelayCapacity v2, FountainHoldingClaim w/ sorted symbol_ids, CompressRequest, WholenessWitness canonical bytes + Merkle, bootstrap SignedClaim) + compute_alm_topology contract (pure/deterministic/integer-only/lex-tiebreak/canonical-output) with byte-exactness gated on vectors.
• PIN-AS-RECOMMENDATION: compute_rarity_score.
• LEAVE-EDGE-INTERNAL: ALM parent-selection (AlmJoinPlanner — per-peer RTT/reachability) + retention_priority (never on the wire) — pinning these would freeze non-shared local computation.

Two fixes before pinning WholenessWitness

• Leaf-order is under-specified ("as long as both peers agree") → pin lexicographic (MUST).
• Its Merkle isn't RFC-6962 (no 0x00/0x01 prefix → CVE-2012-2459 second-preimage class) while §10.3 is → declare it a distinct construction (and consider adopting the prefixed form since it's freezing now).

RC11 will be written against these. Conformance vectors from the fixed v4.0.x are the #57 freeze gate.

[emooreatx]

RC11 landed — §19 Holonomic substrate (v-ceg-1.0-rc11, commit 030b8d1). The absorb-with-guardrails verdict is now normative: §19 pins the holonomic concept under invariants that subordinate it to CEG's trust / PQC / consent / quorum-merge / anonymous guarantees. No 1+4 change. Matching edge fixes: CIRISEdge#143.

This closes the structural absorption (the realtime A/V chunk wire landed byte-exact in RC10 §10.5.8.3-.5; the holonomic invariants in RC11 §19). What remains is byte-exact preimage transcription for the PIN-NORMATIVE shapes — and that is deliberately deferred to the fixed v4.0.x, because several preimages change under #143 (e.g. SignedClaim gains owner-binding fields; the witness verification path; capacity verification). Pinning those bytes against v4.0.0 now would pin shapes we already know must change.

Remaining absorption work (gated on edge#143 landing + vectors):

• Byte-exact SignedRelayCapacity / FountainHoldingClaim / FountainCompressRequest / WholenessWitness canonical preimages + compute_alm_topology output, transcribed from fixed v4.0.x.
• Conformance vectors (input→expected-bytes) from the fixed impl → the CEG 1.0 readiness — freeze checklist (streaming + PQC-everywhere REQUIRED) #57 freeze gate (CIRISConformance#9).

This issue stays open as the absorption tracker. Sequence: edge#143 fixes → fixed v4.0.x → byte-exact pins (RC12) → vectors → #57 gate → 1.0.