Bounded preverification and issuer comparison v1

Experimental local library · 5 September 2026 · no public ingress enabled

What changed

admission_wire::queue::VerificationQueue provides a volatile, bounded queue for signed claim envelopes and conflict pairs. It performs signature checks before returning work to the caller. Its output is not an admission receipt: the durable ledger still validates descriptor, policy, work, current time, and accounting. The extra verification is intentionally explicit; no cross-layer verification cache or bypass of ledger validation is introduced.

Eight deterministic issuer scenarios compare two or four trusted issuers, with one honest issuer and one or three compromised issuers. Each attacker supplies valid conflicting allocations. With honest-first arrival, reserved capacity keeps the unrelated honest receipt usable across restart; the control disables it. With attack-first arrival, both reject the honest newcomer. Combining allocations from different issuer credentials cannot produce valid same-slot evidence. This confirms the earlier limited result across issuer separation; it does not establish provenance independence, broad Sybil resistance, or semantic utility.

Queue contract and bounds

Configure 1–64 active sources, 1–64 pending jobs per source, 1–1,024 total pending jobs, and an age limit of 1–3,600 caller clock units. One claim occupies exactly 210 or 442 bytes. Conflict input is exactly two concatenated 442-byte sponsored claim envelopes (884 bytes). This is a local queue format, not a network standard.

The node assigns source IDs to transport sessions. Payloads MUST NOT choose their own source accounting identity. Enqueue checks shape and capacity before copying bytes, and performs no public-key verification. Accepted pending payload bytes are bounded by 884 times the configured total. Metadata and retained deque capacity are additional: O(sources × per-source limit). Limits are validated before constructing the queue; no map of rejected identities is retained.

Jobs remain FIFO within a source; each processing step moves that source to the back of the active-source queue. Four credits are required and consumed for every processed job, including invalid signatures. A conflict attempts at most four signature verifications; a claim needs at most two. The conservative charge avoids variable-cost scheduling and prevents cheap frames from stretching a call's budget.

The caller supplies a monotonic clock and a credit budget for its scheduling turn. Backward time is rejected. Expiry removes old jobs before admission or processing; age equal to the limit expires, and expiration consumes no verification credits. Expiry/source lookup scans at most the configured sources and bounded expired jobs. It does not promise constant CPU per rejected call. On restart all pending work is lost; queue acceptance is neither durable acknowledgement nor promised service.

Boundaries that remain open

Credits limit attempted cryptographic work in this queue invocation, not wall-clock CPU, transport parsing, ledger fsync, or the ledger's later verification. A driver that repeatedly replenishes credits without a rate policy has no time-based CPU limit. No such production driver is wired up yet. Callers must promptly consume or bound returned outcomes; the queue cannot bound caller-owned output storage.

Round-robin service protects already admitted source queues. An attacker able to open enough sessions can fill all source slots before honest traffic arrives. There is no identity scarcity claim, preferential lane for local conflict evidence, replay cache, cancellation protocol, or automatic transport backpressure. Signature invalidity cannot be established from the untrusted issuer field at enqueue time. Do not add per-issuer priority before authentication as a shortcut.

The next ingress design must bound frame allocation before parsing, connection creation, scheduling rate, and downstream disk work. It must preserve a path for local conflict evidence under overload. Fsync-error evidence is now recorded in docs/ADMISSION_FSYNC_V1.md. Independent transition review and a tested driver remain prerequisites to public admission.

Evidence and reproduction

Three queue tests cover source/total caps, rotation, credits, invalid signatures, malformed lengths, expiration, backward time, identity churn, and a signed weak work proof that passes preverification but is rejected by the ledger. Fifteen admission integration tests include the eight issuer scenarios and previous reserved-capacity durability cases. These are bounded tests, not network simulation.

cargo test --locked --offline --features peer-recovery --test admission_queue
SKEIN_ISSUER_REPORT=docs/results/reserved-capacity-issuers-v1.json \
  cargo test --locked --offline --features peer-recovery --test admission_wire \
  heterogeneous_issuer_capture_comparison

Issuer fixtures use public deterministic test seeds only. The default admission policy, frozen discovery control, existing fixtures, and historical reports remain unchanged. The queue adds no dependency and performs no model inference.