C++ First Admission and Historical Trust

C++ First Admission and Historical Trust

The C++ AdmissionService layers First Admission and Historical Trust above the six-stage Signed Document verifier (MWP-ADM-005). The language-independent flow is the local First Admission and Historical Trust runtime page, and the exact requirements are the local Admission clauses.

Public adapters and results

Public API	Responsibility
AdmissionCurrentKeyResolver::resolve_current	Return complete Organization-wide Registry evidence that the deployment asserts is current for this decision.
TrustedAdmissionContext::issue	Issue the record ID, trusted acceptance instant, and accepting service only after authoritative absence.
AdmissionLog::lookup	Return AdmissionLookup::found or AdmissionLookup::authoritative_absence. Cache miss, timeout, or unauthenticated absence fails closed under MWP-ADM-003.
AdmissionLog::append_or_return_existing	Atomically append candidate bytes or return the concurrent authoritative winner through an authenticated service identity.
AuthenticatedAdmissionRecord	Bind returned record bytes to the service identity authenticated by the adapter for MWP-ADM-009.
AdmissionService::prepare_first_admission	Create and validate candidate evidence from an SDK-produced VerifiedSignedDocument; it does not append or imply admission.
AdmissionService::admit_first	Verify current evidence, lookup, prepare after absence, append-or-return-existing, and validate the returned record under MWP-ADM-006.
AdmissionService::verify_historical_admission	Rerun verification with historical Registry evidence and require an existing record without issuing context or appending under MWP-ADM-008.
PreparedFirstAdmission, AdmittedSignedDocument	Preserve immutable verification and record evidence; record_bytes returns a view over the validated record bytes.

A caller-provided trust boolean is not an Admission lookup outcome and must never select the success path.

First-admission call order

Informative example

const auto first = AdmissionService{}.admit_first(
    SignedDocumentKind::command,
    document,
    current_registry,
    admission_log,
    trusted_context);

admit_first completes all six verification stages before log access. A found record is validated and returned without issuing trusted context or appending. After authoritative absence, the service issues context, prepares canonical candidate bytes, calls append_or_return_existing, and validates the record actually returned. A concurrent winner succeeds only when Schema, authentication, document binding, and trusted time satisfy MWP-ADM-009 and MWP-ADM-010.

Historical replay and errors

verify_historical_admission uses KeyResolver, reruns all six stages, requires a found record, and never calls TrustedAdmissionContext::issue or AdmissionLog::append_or_return_existing. Matching record IDs recover the same authoritative record but do not prove Command freshness, signer authorization, state-machine acceptance, or portable log-proof verification under MWP-ADM-013 and MWP-ADM-014.

Six-stage faults remain SignedDocumentVerificationError. Admission-stage faults are AdmissionError with wire code AUTH_INVALID_SIGNATURE, stage admission, and a typed AdmissionReason, as required by MWP-ADM-012. Deployment adapters throw AdmissionAdapterError; generic success or availability is not authenticated evidence.

Runnable exact-pinned example

Informative example

The example reads the signed Command and Registry from the SDK’s verified embedded ProtocolBundle, then supplies typed in-memory authority adapters. It does not read repository files. It asserts identical record IDs, signing hashes, and record bytes for First Admission and historical replay, with exactly one append.

#include <missionweaveprotocol/admission.hpp>
#include <missionweaveprotocol/bundle.hpp>

#include <cstddef>
#include <cstdint>
#include <iostream>
#include <optional>
#include <ranges>
#include <stdexcept>
#include <string_view>
#include <utility>
#include <vector>

namespace {

constexpr std::string_view service_id = "urn:missionweaveprotocol:service:admission";

class CurrentRegistry final : public missionweaveprotocol::AdmissionCurrentKeyResolver,
                              public missionweaveprotocol::KeyResolver {
public:
  explicit CurrentRegistry(const missionweaveprotocol::AssetBytes registry)
      : registry_(registry.begin(), registry.end()) {}

  [[nodiscard]] missionweaveprotocol::KeyRegistrySnapshot
  resolve_current(const missionweaveprotocol::KeyResolutionRequest&) const override {
    return snapshot();
  }

  [[nodiscard]] missionweaveprotocol::KeyRegistrySnapshot
  resolve(const missionweaveprotocol::KeyResolutionRequest&) const override {
    return snapshot();
  }

private:
  [[nodiscard]] missionweaveprotocol::KeyRegistrySnapshot snapshot() const {
    return missionweaveprotocol::KeyRegistrySnapshot::organization_wide(registry_);
  }

  std::vector<std::uint8_t> registry_;
};

class FixedTrustedContext final : public missionweaveprotocol::TrustedAdmissionContext {
public:
  [[nodiscard]] missionweaveprotocol::AdmissionContextValue issue(std::string_view,
                                                                  std::string_view) const override {
    return {
        .admission_record_id = "urn:missionweaveprotocol:admission-record:website-example",
        .trusted_accepted_at = "2026-07-15T00:05:00Z",
        .accepted_by = {.type = "service", .id = std::string{service_id}},
    };
  }
};

class InMemoryAdmissionLog final : public missionweaveprotocol::AdmissionLog {
public:
  [[nodiscard]] missionweaveprotocol::AdmissionLookup lookup(std::string_view,
                                                             std::string_view) const override {
    return record_ ? missionweaveprotocol::AdmissionLookup::found(*record_)
                   : missionweaveprotocol::AdmissionLookup::authoritative_absence();
  }

  [[nodiscard]] missionweaveprotocol::AuthenticatedAdmissionRecord
  append_or_return_existing(std::string_view, std::string_view,
                            const missionweaveprotocol::AssetBytes candidate_bytes) const override {
    if (record_) {
      return *record_;
    }

    record_.emplace(
        std::vector<std::uint8_t>{candidate_bytes.begin(), candidate_bytes.end()},
        missionweaveprotocol::Principal{.type = "service", .id = std::string{service_id}});
    append_count_ += 1;
    return *record_;
  }

  [[nodiscard]] std::size_t append_count() const noexcept { return append_count_; }

private:
  mutable std::optional<missionweaveprotocol::AuthenticatedAdmissionRecord> record_;
  mutable std::size_t append_count_ = 0;
};

} // namespace

int main() {
  const auto protocol = missionweaveprotocol::ProtocolBundle::verify();
  const auto cryptography = missionweaveprotocol::ProtocolBundle::verify_cryptography();
  const auto admission = missionweaveprotocol::ProtocolBundle::verify_admission();
  if (protocol.schema_files != 22 || cryptography.evaluation_count != 62 ||
      admission.evaluation_count != 30) {
    throw std::runtime_error("embedded bundle identity is inconsistent");
  }

  const auto document = missionweaveprotocol::ProtocolBundle::cryptography(
      "vectors/signed-documents/valid/command.json");
  const auto registry =
      missionweaveprotocol::ProtocolBundle::cryptography("keys/registry-valid.json");
  if (!document || !registry) {
    throw std::runtime_error("packaged Command or Registry is missing");
  }

  const CurrentRegistry current_registry{*registry};
  const InMemoryAdmissionLog admission_log;
  const FixedTrustedContext trusted_context;
  const missionweaveprotocol::AdmissionService service;

  const auto first =
      service.admit_first(missionweaveprotocol::SignedDocumentKind::command, *document,
                          current_registry, admission_log, trusted_context);
  const auto historical =
      service.verify_historical_admission(missionweaveprotocol::SignedDocumentKind::command,
                                          *document, current_registry, admission_log);

  if (first.record().admission_record_id() != historical.record().admission_record_id()) {
    throw std::runtime_error("historical replay returned a different record ID");
  }
  if (first.verified().signing_hash() != historical.verified().signing_hash()) {
    throw std::runtime_error("historical replay returned a different signing hash");
  }
  if (!std::ranges::equal(first.record_bytes(), historical.record_bytes())) {
    throw std::runtime_error("historical replay returned different record bytes");
  }
  if (!(admission_log.append_count() == 1)) {
    throw std::runtime_error("Admission Log did not append exactly once");
  }

  std::cout << "first admission: " << first.record().admission_record_id() << '\n';
  std::cout << "historical replay: " << historical.record().admission_record_id() << '\n';
}

Copy admission.cpp and the following CMakeLists.txt into one empty consumer directory. The build recipe defines the executable itself and adds the exact-pinned SDK checkout as a dependency; it does not depend on a target that the consumer has not declared.

cmake_minimum_required(VERSION 3.24)

project(missionweaveprotocol_website_admission LANGUAGES CXX)

if(NOT DEFINED MISSIONWEAVEPROTOCOL_SDK_ROOT)
  message(FATAL_ERROR "Set MISSIONWEAVEPROTOCOL_SDK_ROOT to the exact-pinned C++ SDK checkout")
endif()

set(MISSIONWEAVEPROTOCOL_BUILD_TESTS OFF CACHE BOOL "" FORCE)
set(MISSIONWEAVEPROTOCOL_BUILD_EXAMPLES OFF CACHE BOOL "" FORCE)
add_subdirectory("${MISSIONWEAVEPROTOCOL_SDK_ROOT}"
                 "${CMAKE_BINARY_DIR}/missionweaveprotocol-sdk")

add_executable(missionweaveprotocol_website_admission admission.cpp)
target_link_libraries(missionweaveprotocol_website_admission
                      PRIVATE MissionWeaveProtocol::sdk)
target_compile_features(missionweaveprotocol_website_admission PRIVATE cxx_std_20)

From that consumer directory, run:

cmake -S . -B build \
  -DMISSIONWEAVEPROTOCOL_SDK_ROOT=/absolute/path/to/exact/cpp-sdk \
  -DOPENSSL_ROOT_DIR=/absolute/path/to/openssl-3
cmake --build build --target missionweaveprotocol_website_admission --parallel 2
./build/missionweaveprotocol_website_admission

Expected output contains the same record ID for first admission and historical replay.

Implementation note

Replace CurrentRegistry with authenticated current and historical Registry adapters, InMemoryAdmissionLog with an authenticated durable log whose append-or-return-existing operation is atomic, and FixedTrustedContext with Organization-controlled trusted time and accepting-service issuance. Preserve byte lifetimes and never collapse these authority boundaries into one caller-provided trust boolean.