Java First Admission and Historical Trust

Java First Admission and Historical Trust

The Java AdmissionService layers First Admission and Historical Trust above the six-stage Signed Document verifier (MWP-ADM-005). The language-independent flow is the local First Admission and Historical Trust runtime page, and the exact requirements are the local Admission clauses.

Public adapters and results

Public API	Responsibility
AdmissionCurrentKeyResolver.resolveCurrent	Return complete Organization-wide Registry evidence that the deployment asserts is current for this decision.
TrustedAdmissionContext.issue	Issue the record ID, trusted acceptance instant, and accepting service only after authoritative absence.
AdmissionLog.lookup	Return AdmissionLookup.Found or AdmissionLookup.AuthoritativeAbsence. Cache miss, timeout, or unauthenticated absence fails closed under MWP-ADM-003.
AdmissionLog.appendOrReturnExisting	Atomically append candidate bytes or return the concurrent authoritative winner through an authenticated service identity.
AuthenticatedAdmissionRecord	Bind returned record bytes to the service authenticated by the adapter for MWP-ADM-009.
AdmissionService.prepareFirstAdmission	Create and validate candidate evidence from an SDK-produced VerifiedSignedDocument; it does not append or imply admission.
AdmissionService.admitFirst	Verify current evidence, lookup, prepare after absence, append-or-return-existing, and validate the returned record under MWP-ADM-006.
AdmissionService.verifyHistoricalAdmission	Rerun verification with historical Registry evidence and require an existing record without issuing context or appending under MWP-ADM-008.
PreparedFirstAdmission, AdmittedSignedDocument	Preserve immutable verification and record evidence and return defensive record-byte copies.

A caller-provided trust boolean is not an Admission lookup outcome and must never select the success path.

First-admission call order

Informative example

AdmittedSignedDocument first =
    new AdmissionService()
        .admitFirst(
            SignedDocumentKind.COMMAND,
            document,
            currentRegistry,
            admissionLog,
            trustedContext);

admitFirst completes all six verification stages before log access. A found record is validated and returned without issuing trusted context or appending. After authoritative absence, the service issues context, prepares canonical candidate bytes, calls appendOrReturnExisting, and validates the record actually returned. A concurrent winner succeeds only when Schema, authentication, document binding, and trusted time satisfy MWP-ADM-009 and MWP-ADM-010.

Historical replay and errors

verifyHistoricalAdmission uses KeyResolver, reruns all six stages, requires AdmissionLookup.Found, and never calls TrustedAdmissionContext.issue or AdmissionLog.appendOrReturnExisting. Matching record IDs recover the same authoritative record but do not prove Command freshness, signer authorization, state-machine acceptance, or portable log-proof verification under MWP-ADM-013 and MWP-ADM-014.

Six-stage faults remain SignedDocumentVerificationException. Admission-stage faults are AdmissionException with wire code AUTH_INVALID_SIGNATURE, stage admission, and a typed AdmissionReason, as required by MWP-ADM-012. Deployment adapters throw AdmissionAdapterException; generic success or availability is not authenticated evidence.

Runnable exact-pinned example

Informative example

The example reads the signed Command and Registry from resources packaged in the exact JAR, then supplies typed in-memory authority adapters. It does not read repository files. It asserts identical record IDs, signing hashes, and record bytes for First Admission and historical replay, with exactly one append.

package org.missionweaveprotocol.examples;

import java.io.IOException;
import java.io.InputStream;
import java.util.Arrays;
import java.util.HashMap;
import java.util.Map;
import org.missionweaveprotocol.sdk.AdmissionContextValue;
import org.missionweaveprotocol.sdk.AdmissionCurrentKeyResolver;
import org.missionweaveprotocol.sdk.AdmissionLog;
import org.missionweaveprotocol.sdk.AdmissionLookup;
import org.missionweaveprotocol.sdk.AdmissionService;
import org.missionweaveprotocol.sdk.AuthenticatedAdmissionRecord;
import org.missionweaveprotocol.sdk.KeyRegistrySnapshot;
import org.missionweaveprotocol.sdk.KeyResolutionRequest;
import org.missionweaveprotocol.sdk.KeyResolver;
import org.missionweaveprotocol.sdk.Principal;
import org.missionweaveprotocol.sdk.ProtocolBundle;
import org.missionweaveprotocol.sdk.SignedDocumentKind;
import org.missionweaveprotocol.sdk.TrustedAdmissionContext;

public final class AdmissionExample {
  private static final Principal ADMISSION_SERVICE =
      new Principal("service", "urn:missionweaveprotocol:service:admission");

  private AdmissionExample() {}

  private static final class CurrentRegistry implements AdmissionCurrentKeyResolver, KeyResolver {
    private final byte[] registry;

    private CurrentRegistry(byte[] registry) {
      this.registry = registry.clone();
    }

    @Override
    public KeyRegistrySnapshot resolveCurrent(KeyResolutionRequest request) {
      return snapshot();
    }

    @Override
    public KeyRegistrySnapshot resolve(KeyResolutionRequest request) {
      return snapshot();
    }

    private KeyRegistrySnapshot snapshot() {
      return KeyRegistrySnapshot.organizationWide(registry);
    }
  }

  private static final class FixedTrustedContext implements TrustedAdmissionContext {
    @Override
    public AdmissionContextValue issue(String organizationId, String signingHash) {
      return new AdmissionContextValue(
          "urn:missionweaveprotocol:admission-record:website-example",
          "2026-07-15T00:05:00Z",
          ADMISSION_SERVICE);
    }
  }

  private static final class InMemoryAdmissionLog implements AdmissionLog {
    private final Map<String, AuthenticatedAdmissionRecord> records = new HashMap<>();
    private int appendCount;

    @Override
    public AdmissionLookup lookup(String organizationId, String signingHash) {
      AuthenticatedAdmissionRecord record = records.get(key(organizationId, signingHash));
      return record == null
          ? new AdmissionLookup.AuthoritativeAbsence()
          : new AdmissionLookup.Found(copy(record));
    }

    @Override
    public AuthenticatedAdmissionRecord appendOrReturnExisting(
        String organizationId, String signingHash, byte[] candidateBytes) {
      String key = key(organizationId, signingHash);
      AuthenticatedAdmissionRecord existing = records.get(key);
      if (existing != null) {
        return copy(existing);
      }

      AuthenticatedAdmissionRecord committed =
          new AuthenticatedAdmissionRecord(candidateBytes, ADMISSION_SERVICE);
      records.put(key, committed);
      appendCount += 1;
      return copy(committed);
    }

    private int appendCount() {
      return appendCount;
    }

    private static String key(String organizationId, String signingHash) {
      return organizationId + "\0" + signingHash;
    }

    private static AuthenticatedAdmissionRecord copy(AuthenticatedAdmissionRecord record) {
      return new AuthenticatedAdmissionRecord(record.recordBytes(), record.authenticatedService());
    }
  }

  public static void main(String[] arguments) throws Exception {
    ProtocolBundle.verifyPackaged();
    ProtocolBundle.verifyPackagedCryptographyBundle();
    ProtocolBundle.verifyPackagedAdmissionBundle();

    byte[] document = resource("cryptography/vectors/signed-documents/valid/command.json");
    CurrentRegistry currentRegistry =
        new CurrentRegistry(resource("cryptography/keys/registry-valid.json"));
    InMemoryAdmissionLog admissionLog = new InMemoryAdmissionLog();
    AdmissionService service = new AdmissionService();

    var first =
        service.admitFirst(
            SignedDocumentKind.COMMAND,
            document,
            currentRegistry,
            admissionLog,
            new FixedTrustedContext());
    var historical =
        service.verifyHistoricalAdmission(
            SignedDocumentKind.COMMAND, document, currentRegistry, admissionLog);

    if (!first.record().admissionRecordId().equals(historical.record().admissionRecordId())) {
      throw new IllegalStateException("historical replay returned a different record ID");
    }
    if (!first.verified().signingHash().equals(historical.verified().signingHash())) {
      throw new IllegalStateException("historical replay returned a different signing hash");
    }
    if (!Arrays.equals(first.recordBytes(), historical.recordBytes())) {
      throw new IllegalStateException("historical replay returned different record bytes");
    }
    if (!(admissionLog.appendCount() == 1)) {
      throw new IllegalStateException("Admission Log did not append exactly once");
    }

    System.out.println("first admission: " + first.record().admissionRecordId());
    System.out.println("historical replay: " + historical.record().admissionRecordId());
  }

  private static byte[] resource(String path) throws IOException {
    try (InputStream input = AdmissionExample.class.getClassLoader().getResourceAsStream(path)) {
      if (input == null) {
        throw new IOException("Missing packaged protocol resource: " + path);
      }
      return input.readAllBytes();
    }
  }
}

Copy it into an exact checkout and run:

cp /absolute/path/to/examples/sdk/java/AdmissionExample.java \
  examples/src/main/java/org/missionweaveprotocol/examples/AdmissionExample.java
./mvnw -B -ntp verify
./mvnw -q -Dexec.mainClass=org.missionweaveprotocol.examples.AdmissionExample \
  -Dexec.classpathScope=test exec:java

Expected output contains the same record ID for first admission and historical replay.

Implementation note

Replace CurrentRegistry with authenticated current and historical Registry adapters, InMemoryAdmissionLog with an authenticated durable log whose append-or-return-existing operation is atomic, and FixedTrustedContext with Organization-controlled trusted time and accepting-service issuance. Preserve defensive copies and never collapse these authority boundaries into one caller-provided trust boolean.