Go First Admission and Historical Trust

Go First Admission and Historical Trust

The Go AdmissionService layers First Admission and Historical Trust above the six-stage Signed Document verifier (MWP-ADM-005). The language-independent flow is the local First Admission and Historical Trust runtime page, and the exact requirements are the local First-Admission and Historical-Trust clauses.

Public adapters and results

Public API	Responsibility
AdmissionCurrentKeyResolver.ResolveCurrent	Return complete Organization-wide Registry evidence that the deployment asserts is current for this decision.
TrustedAdmissionContext.Issue	Issue the trusted record ID, acceptance instant, and accepting service only after authoritative absence.
AdmissionLog.Lookup	Return a found authenticated record or AdmissionLookup{AuthoritativeAbsence: true}. Cache miss, timeout, unauthenticated absence, and indeterminate state fail closed under MWP-ADM-003.
AdmissionLog.AppendOrReturnExisting	Atomically append candidate bytes or return the concurrent authoritative winner through an authenticated service identity.
AuthenticatedAdmissionRecord	Bind RecordBytes to the service authenticated by the adapter so MWP-ADM-009 can validate the returned record.
AdmissionService.PrepareFirstAdmission	Create and validate candidate evidence from an SDK-produced VerifiedSignedDocument. It does not append or imply admission.
AdmissionService.AdmitFirst	Perform current verification, authoritative lookup, candidate creation, atomic append-or-return-existing, and returned-record validation under MWP-ADM-006.
AdmissionService.VerifyHistoricalAdmission	Rerun six-stage verification with historical Registry evidence and require an existing record without issuing context or appending, as required by MWP-ADM-008.
AdmittedSignedDocument	Return verified and parsed record evidence plus a defensive RecordBytes() copy.

A caller-provided trust boolean is not an Admission lookup outcome and must never select the success path.

First-admission call order

Informative example

first, err := missionweaveprotocol.NewAdmissionService().AdmitFirst(
    missionweaveprotocol.SignedDocumentCommand,
    documentBytes,
    currentRegistry,
    admissionLog,
    trustedContext,
)

AdmitFirst completes all six signed-document stages before consulting the log. A found record is validated and returned without issuing trusted context or appending. After authoritative absence, the service issues trusted context, calls PrepareFirstAdmission, invokes AppendOrReturnExisting, snapshots the returned value, and validates the record actually returned. A concurrent winner is acceptable only when its Schema, authenticated service, document binding, and trusted time pass MWP-ADM-009 and MWP-ADM-010.

Historical replay

Informative example

historical, err := missionweaveprotocol.NewAdmissionService().VerifyHistoricalAdmission(
    missionweaveprotocol.SignedDocumentCommand,
    documentBytes,
    historicalRegistry,
    admissionLog,
)

Historical replay reruns verification with retained Registry history, requires a found record, and never calls TrustedAdmissionContext.Issue or AdmissionLog.AppendOrReturnExisting. Matching record IDs demonstrate recovery of the same authoritative record; they do not prove Command freshness, signer authorization, state-machine acceptance, or portable log-proof verification. Those remain separate under MWP-ADM-013 and MWP-ADM-014.

Error surface

AdmissionError.WireCode() returns AUTH_INVALID_SIGNATURE, while ProtectedDiagnostic().Stage() returns admission. Stable protected reasons distinguish missing, conflicting, malformed, unauthenticated, unavailable, indeterminate, and self-anchoring evidence while preserving the non-oracular wire result required by MWP-ADM-012.

Deployment adapters should return NewAdmissionAdapterError with a supported reason when they need the service to remap a trusted local failure. Arbitrary errors are not proof of authoritative absence.

Runnable exact-pinned example

Informative example

The example deterministically derives one Ed25519 key, constructs a complete Registry and signed Command, and supplies typed in-memory adapters. One sync.Mutex protects the shared authoritative map. Lookup and AppendOrReturnExisting acquire it independently; the mutex makes AppendOrReturnExisting atomic when it checks for a concurrent winner and conditionally appends. The protocol requires authoritative lookup and atomic append-or-return-existing behavior, not one transaction spanning both calls. The fixed seed is demonstration material and must never be used outside the example.

package main

import (
	"bytes"
	"crypto/ed25519"
	"crypto/sha256"
	"encoding/base64"
	"encoding/json"
	"fmt"
	"sync"

	missionweaveprotocol "github.com/missionweaveprotocol/go-sdk"
)

const (
	agentID        = "urn:missionweaveprotocol:agent:website-example"
	keyID          = "urn:missionweaveprotocol:key:website-example"
	organizationID = "urn:missionweaveprotocol:organization:website-example"
)

var admissionService = missionweaveprotocol.Principal{
	Type: "service",
	ID:   "urn:missionweaveprotocol:service:admission",
}

type deterministicSigningKey struct {
	privateKey ed25519.PrivateKey
}

func (deterministicSigningKey) Algorithm() string { return "Ed25519" }
func (deterministicSigningKey) KeyID() string     { return keyID }
func (key deterministicSigningKey) Sign(message []byte) ([]byte, error) {
	return ed25519.Sign(key.privateKey, message), nil
}

type currentRegistryFixture struct {
	registryBytes []byte
}

var _ missionweaveprotocol.AdmissionCurrentKeyResolver = currentRegistryFixture{}
var _ missionweaveprotocol.KeyResolver = currentRegistryFixture{}

func (fixture currentRegistryFixture) ResolveCurrent(
	_ missionweaveprotocol.KeyResolutionRequest,
) (missionweaveprotocol.KeyRegistrySnapshot, error) {
	return fixture.snapshot(), nil
}

func (fixture currentRegistryFixture) Resolve(
	_ missionweaveprotocol.KeyResolutionRequest,
) (missionweaveprotocol.KeyRegistrySnapshot, error) {
	return fixture.snapshot(), nil
}

func (fixture currentRegistryFixture) snapshot() missionweaveprotocol.KeyRegistrySnapshot {
	return missionweaveprotocol.KeyRegistrySnapshot{
		Completeness:  missionweaveprotocol.KeyRegistryOrganizationWide,
		RegistryBytes: append([]byte(nil), fixture.registryBytes...),
	}
}

type fixedTrustedAdmissionContext struct{}

var _ missionweaveprotocol.TrustedAdmissionContext = fixedTrustedAdmissionContext{}

func (fixedTrustedAdmissionContext) Issue(
	organizationID string,
	signingHash string,
) (missionweaveprotocol.AdmissionContextValue, error) {
	digest := sha256.Sum256([]byte(organizationID + "\x00" + signingHash))
	return missionweaveprotocol.AdmissionContextValue{
		AdmissionRecordID: fmt.Sprintf(
			"urn:missionweaveprotocol:admission-record:%x",
			digest,
		),
		TrustedAcceptedAt: "2026-07-15T00:05:00Z",
		AcceptedBy:        admissionService,
	}, nil
}

type inMemoryAdmissionLog struct {
	mu          sync.Mutex
	records     map[string]missionweaveprotocol.AuthenticatedAdmissionRecord
	appendCount int
}

var _ missionweaveprotocol.AdmissionLog = (*inMemoryAdmissionLog)(nil)

func (log *inMemoryAdmissionLog) Lookup(
	organizationID string,
	signingHash string,
) (missionweaveprotocol.AdmissionLookup, error) {
	log.mu.Lock()
	defer log.mu.Unlock()
	record, found := log.records[logKey(organizationID, signingHash)]
	if !found {
		return missionweaveprotocol.AdmissionLookup{AuthoritativeAbsence: true}, nil
	}
	copied := copyAuthenticatedRecord(record)
	return missionweaveprotocol.AdmissionLookup{Record: &copied}, nil
}

func (log *inMemoryAdmissionLog) AppendOrReturnExisting(
	organizationID string,
	signingHash string,
	candidateBytes []byte,
) (missionweaveprotocol.AuthenticatedAdmissionRecord, error) {
	log.mu.Lock()
	defer log.mu.Unlock()
	key := logKey(organizationID, signingHash)
	if existing, found := log.records[key]; found {
		return copyAuthenticatedRecord(existing), nil
	}
	candidate := missionweaveprotocol.AuthenticatedAdmissionRecord{
		RecordBytes:          append([]byte(nil), candidateBytes...),
		AuthenticatedService: admissionService,
	}
	log.records[key] = copyAuthenticatedRecord(candidate)
	log.appendCount++
	return copyAuthenticatedRecord(candidate), nil
}

func copyAuthenticatedRecord(
	record missionweaveprotocol.AuthenticatedAdmissionRecord,
) missionweaveprotocol.AuthenticatedAdmissionRecord {
	return missionweaveprotocol.AuthenticatedAdmissionRecord{
		RecordBytes:          append([]byte(nil), record.RecordBytes...),
		AuthenticatedService: record.AuthenticatedService,
	}
}

func logKey(organizationID string, signingHash string) string {
	return organizationID + "\x00" + signingHash
}

func main() {
	seed := make([]byte, ed25519.SeedSize)
	for index := range seed {
		seed[index] = byte(index + 1)
	}
	privateKey := ed25519.NewKeyFromSeed(seed)
	publicKey := privateKey.Public().(ed25519.PublicKey)
	signingKey := deterministicSigningKey{privateKey: privateKey}

	registryBytes, err := json.Marshal(map[string]any{
		"organizationId": organizationID,
		"bindings": []any{map[string]any{
			"keyId":           keyID,
			"principal":       map[string]any{"type": "agent", "id": agentID},
			"algorithm":       "Ed25519",
			"publicKey":       base64.RawURLEncoding.EncodeToString(publicKey),
			"validFrom":       "2026-07-01T00:00:00Z",
			"validityHistory": []any{},
		}},
	})
	if err != nil {
		panic(err)
	}
	registry := currentRegistryFixture{registryBytes: registryBytes}

	codec, err := missionweaveprotocol.NewSignedDocumentCodec()
	if err != nil {
		panic(err)
	}
	signedDocument, err := codec.Sign(
		missionweaveprotocol.SignedDocumentCommand,
		map[string]any{
			"protocolVersion": "0.1",
			"actionId":        "urn:uuid:11111111-2222-4333-8444-555555555555",
			"actor":           map[string]any{"type": "agent", "id": agentID},
			"sessionEpoch":    float64(1),
			"membershipEpoch": float64(1),
			"groupId":         "urn:missionweaveprotocol:group:website-example",
			"kind":            "message.post",
			"correlationId":   "urn:uuid:aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee",
			"issuedAt":        "2026-07-15T00:00:00Z",
			"payload":         map[string]any{"text": "Admission example"},
		},
		signingKey,
	)
	if err != nil {
		panic(err)
	}
	documentBytes, err := missionweaveprotocol.MarshalCanonicalJSON(signedDocument)
	if err != nil {
		panic(err)
	}

	admissionLog := &inMemoryAdmissionLog{
		records: make(map[string]missionweaveprotocol.AuthenticatedAdmissionRecord),
	}
	service := missionweaveprotocol.NewAdmissionService()
	first, err := service.AdmitFirst(
		missionweaveprotocol.SignedDocumentCommand,
		documentBytes,
		registry,
		admissionLog,
		fixedTrustedAdmissionContext{},
	)
	if err != nil {
		panic(err)
	}
	historical, err := service.VerifyHistoricalAdmission(
		missionweaveprotocol.SignedDocumentCommand,
		documentBytes,
		registry,
		admissionLog,
	)
	if err != nil {
		panic(err)
	}

	if !(first.Record().AdmissionRecordID() == historical.Record().AdmissionRecordID()) {
		panic("historical replay returned a different Admission record")
	}
	if !(first.Verified().SigningHash() == historical.Verified().SigningHash()) {
		panic("historical replay returned a different signing hash")
	}
	if !bytes.Equal(first.RecordBytes(), historical.RecordBytes()) {
		panic("historical replay returned different record bytes")
	}
	if !(admissionLog.appendCount == 1) {
		panic("Admission Log did not append exactly once")
	}

	fmt.Printf("first admission: %s\n", first.Record().AdmissionRecordID())
	fmt.Printf("historical replay: %s\n", historical.Record().AdmissionRecordID())
}

Run it from an exact SDK checkout:

go test ./...
go run /absolute/path/to/examples/sdk/go/admission/main.go

Expected output contains the same record ID for first admission and historical replay. The program also asserts matching signing hashes and record bytes and exactly one append.

Implementation note

Replace currentRegistryFixture with authenticated current and historical Registry adapters, inMemoryAdmissionLog with an authenticated durable log that returns authoritative lookup outcomes and makes AppendOrReturnExisting atomic over the logical key, and fixedTrustedAdmissionContext with Organization-controlled trusted time and accepting-service issuance. A deployment may use a wider transaction, but the protocol does not require one transaction to span Lookup and AppendOrReturnExisting.

Replace deterministicSigningKey with a deployment-owned key service. Preserve defensive byte copies and do not collapse authority boundaries into one caller-provided trust boolean.