Java 首次準入與歷史信任

Java AdmissionService 將首次準入和歷史信任置於六階段 Signed Document 驗證器 (MWP-ADM-005) 之上。與語言無關的流程是本地首次準入和歷史信任運行時頁面，確切的要求是本地準入條款。

公共適配器和結果

公開 API	責任
`AdmissionCurrentKeyResolver.resolveCurrent`	返回完整的 Organization 範圍的 Registry 證據，表明部署斷言對於此決策是最新的。
`TrustedAdmissionContext.issue`	下發記錄ID，即時可信受理，權威不在場後才接受服務。
`AdmissionLog.lookup`	返回 `AdmissionLookup.Found` 或 `AdmissionLookup.AuthoritativeAbsence`。快取未命中、逾時或未經身份驗證的缺失在 MWP-ADM-003 下關閉失敗。
`AdmissionLog.appendOrReturnExisting`	以原子方式追加候選位元組或透過經過驗證的服務身分返回並發權威獲勝者。
`AuthenticatedAdmissionRecord`	將傳回的記錄位元組綁定到由 MWP-ADM-009 的適配器驗證的服務。
`AdmissionService.prepareFirstAdmission`	從 SDK 產生的 `VerifiedSignedDocument` 建立並驗證候選證據；它不附加或暗示承認。
`AdmissionService.admitFirst`	驗證目前證據、尋找、缺席後準備、追加或回傳現有證據，並驗證 MWP-ADM-006 下回傳的記錄。
`AdmissionService.verifyHistoricalAdmission`	使用歷史 Registry 證據重新運行驗證，並需要現有記錄，而不發布上下文或在 MWP-ADM-008 下附加。
`PreparedFirstAdmission`、`AdmittedSignedDocument`	保留不可變的驗證和記錄證據並返回防禦性記錄位元組副本。

呼叫者提供的信任布林值不是準入查找結果，絕不能選擇成功路徑。

首次準入呼叫順序

AdmittedSignedDocument first =
    new AdmissionService()
        .admitFirst(
            SignedDocumentKind.COMMAND,
            document,
            currentRegistry,
            admissionLog,
            trustedContext);

admitFirst 在日誌存取之前完成所有六個驗證階段。找到的記錄經過驗證並返回，無需發出可信上下文或附加。權威缺席後，服務發佈上下文，準備規範候選字節，呼叫 appendOrReturnExisting，並驗證實際傳回的記錄。仅当架构、身份验证、文档绑定和可信时间满足 MWP-ADM-009 和 MWP-ADM-010 时，并发获胜者才会成功。

歷史回放與錯誤

verifyHistoricalAdmission 使用 KeyResolver，重新运行所有六个阶段，需要 AdmissionLookup.Found，并且从不调用 TrustedAdmissionContext.issue 或 AdmissionLog.appendOrReturnExisting。匹配的记录 ID 恢复相同的权威记录，但不能证明 Command 的新鲜度、签名者授权、状态机接受或 MWP-ADM-013 和 MWP-ADM-014 下的便携式日志证明验证。

六級故障依然存在 SignedDocumentVerificationException。準入階段故障有 AdmissionException 有線碼 AUTH_INVALID_SIGNATURE，階段 admission，以及一個型別化的 AdmissionReason，依照MWP-ADM-012的要求。部署適配器拋出 AdmissionAdapterException;一般性的成功或可用性並不是經過驗證的證據。

可運行的精確固定範例

此範例讀取簽名的 Command 和 Registry 從打包在確切的 JAR 中的資源中獲取，然後提供類型化的記憶體中權限適配器。它不會讀取存儲庫文件。它為首次準入和歷史重播斷言相同的記錄 ID、簽名雜湊值和記錄位元組，並且只有一個附加。

package org.missionweaveprotocol.examples;

import java.io.IOException;
import java.io.InputStream;
import java.util.Arrays;
import java.util.HashMap;
import java.util.Map;
import org.missionweaveprotocol.sdk.AdmissionContextValue;
import org.missionweaveprotocol.sdk.AdmissionCurrentKeyResolver;
import org.missionweaveprotocol.sdk.AdmissionLog;
import org.missionweaveprotocol.sdk.AdmissionLookup;
import org.missionweaveprotocol.sdk.AdmissionService;
import org.missionweaveprotocol.sdk.AuthenticatedAdmissionRecord;
import org.missionweaveprotocol.sdk.KeyRegistrySnapshot;
import org.missionweaveprotocol.sdk.KeyResolutionRequest;
import org.missionweaveprotocol.sdk.KeyResolver;
import org.missionweaveprotocol.sdk.Principal;
import org.missionweaveprotocol.sdk.ProtocolBundle;
import org.missionweaveprotocol.sdk.SignedDocumentKind;
import org.missionweaveprotocol.sdk.TrustedAdmissionContext;

public final class AdmissionExample {
  private static final Principal ADMISSION_SERVICE =
      new Principal("service", "urn:missionweaveprotocol:service:admission");

  private AdmissionExample() {}

  private static final class CurrentRegistry implements AdmissionCurrentKeyResolver, KeyResolver {
    private final byte[] registry;

    private CurrentRegistry(byte[] registry) {
      this.registry = registry.clone();
    }

    @Override
    public KeyRegistrySnapshot resolveCurrent(KeyResolutionRequest request) {
      return snapshot();
    }

    @Override
    public KeyRegistrySnapshot resolve(KeyResolutionRequest request) {
      return snapshot();
    }

    private KeyRegistrySnapshot snapshot() {
      return KeyRegistrySnapshot.organizationWide(registry);
    }
  }

  private static final class FixedTrustedContext implements TrustedAdmissionContext {
    @Override
    public AdmissionContextValue issue(String organizationId, String signingHash) {
      return new AdmissionContextValue(
          "urn:missionweaveprotocol:admission-record:website-example",
          "2026-07-15T00:05:00Z",
          ADMISSION_SERVICE);
    }
  }

  private static final class InMemoryAdmissionLog implements AdmissionLog {
    private final Map<String, AuthenticatedAdmissionRecord> records = new HashMap<>();
    private int appendCount;

    @Override
    public AdmissionLookup lookup(String organizationId, String signingHash) {
      AuthenticatedAdmissionRecord record = records.get(key(organizationId, signingHash));
      return record == null
          ? new AdmissionLookup.AuthoritativeAbsence()
          : new AdmissionLookup.Found(copy(record));
    }

    @Override
    public AuthenticatedAdmissionRecord appendOrReturnExisting(
        String organizationId, String signingHash, byte[] candidateBytes) {
      String key = key(organizationId, signingHash);
      AuthenticatedAdmissionRecord existing = records.get(key);
      if (existing != null) {
        return copy(existing);
      }

      AuthenticatedAdmissionRecord committed =
          new AuthenticatedAdmissionRecord(candidateBytes, ADMISSION_SERVICE);
      records.put(key, committed);
      appendCount += 1;
      return copy(committed);
    }

    private int appendCount() {
      return appendCount;
    }

    private static String key(String organizationId, String signingHash) {
      return organizationId + "\0" + signingHash;
    }

    private static AuthenticatedAdmissionRecord copy(AuthenticatedAdmissionRecord record) {
      return new AuthenticatedAdmissionRecord(record.recordBytes(), record.authenticatedService());
    }
  }

  public static void main(String[] arguments) throws Exception {
    ProtocolBundle.verifyPackaged();
    ProtocolBundle.verifyPackagedCryptographyBundle();
    ProtocolBundle.verifyPackagedAdmissionBundle();

    byte[] document = resource("cryptography/vectors/signed-documents/valid/command.json");
    CurrentRegistry currentRegistry =
        new CurrentRegistry(resource("cryptography/keys/registry-valid.json"));
    InMemoryAdmissionLog admissionLog = new InMemoryAdmissionLog();
    AdmissionService service = new AdmissionService();

    var first =
        service.admitFirst(
            SignedDocumentKind.COMMAND,
            document,
            currentRegistry,
            admissionLog,
            new FixedTrustedContext());
    var historical =
        service.verifyHistoricalAdmission(
            SignedDocumentKind.COMMAND, document, currentRegistry, admissionLog);

    if (!first.record().admissionRecordId().equals(historical.record().admissionRecordId())) {
      throw new IllegalStateException("historical replay returned a different record ID");
    }
    if (!first.verified().signingHash().equals(historical.verified().signingHash())) {
      throw new IllegalStateException("historical replay returned a different signing hash");
    }
    if (!Arrays.equals(first.recordBytes(), historical.recordBytes())) {
      throw new IllegalStateException("historical replay returned different record bytes");
    }
    if (!(admissionLog.appendCount() == 1)) {
      throw new IllegalStateException("Admission Log did not append exactly once");
    }

    System.out.println("first admission: " + first.record().admissionRecordId());
    System.out.println("historical replay: " + historical.record().admissionRecordId());
  }

  private static byte[] resource(String path) throws IOException {
    try (InputStream input = AdmissionExample.class.getClassLoader().getResourceAsStream(path)) {
      if (input == null) {
        throw new IOException("Missing packaged protocol resource: " + path);
      }
      return input.readAllBytes();
    }
  }
}

將其複製到精確的結帳並運行：

cp /absolute/path/to/examples/sdk/java/AdmissionExample.java \
  examples/src/main/java/org/missionweaveprotocol/examples/AdmissionExample.java
./mvnw -B -ntp verify
./mvnw -q -Dexec.mainClass=org.missionweaveprotocol.examples.AdmissionExample \
  -Dexec.classpathScope=test exec:java

預期輸出包含相同的記錄 ID first admission 和 historical replay.