fsmwire

type BootstrapPayload ¶

type BootstrapPayload struct {
	StorageDEKID   uint32
	WrappedStorage []byte
	RaftDEKID      uint32
	WrappedRaft    []byte
	BatchRegistry  []RegistrationPayload
}

BootstrapPayload is the OpBootstrap body: §5.6 step 1a's "install the initial wrapped DEK pair plus a batch of writer-registry rows for every member that passed the capability pre-check".

The wrapped DEKs are KEK-output blobs the leader produced; the FSM apply layer installs them into the local keystore via Keystore.Set after the KEK Unwrap.

func DecodeBootstrap(raw []byte) (BootstrapPayload, error)

type Purpose ¶

type Purpose byte

Purpose is the §5.1 sidecar purpose tag. The Cipher itself does not enforce purpose — that contract is maintained by the sidecar loader and the FSM apply handlers in kv/fsm_encryption.go. The fsmwire codec carries the purpose alongside each DEK so the applier can install it under the correct sidecar slot.

const (
	// PurposeStorage marks the storage-layer DEK (§4.1 envelopes).
	PurposeStorage Purpose = 1
	// PurposeRaft marks the raft-layer DEK (§4.2 envelopes).
	PurposeRaft Purpose = 2
)

type RegistrationPayload ¶

type RegistrationPayload struct {
	DEKID      uint32
	FullNodeID uint64
	LocalEpoch uint16
}

RegistrationPayload is the OpRegistration body: a single (dek_id, full_node_id, local_epoch) triple inserted by FSM apply into the §4.1 writer registry. The kv/fsm_encryption.go handler decides between case 1 (insert), 2 (re-register / monotonic bump), 3 (rollback → ErrLocalEpochRollback) and 4 (collision → ErrNodeIDCollision).

func DecodeRegistration(raw []byte) (RegistrationPayload, error)

type RotationPayload ¶

type RotationPayload struct {
	SubTag               byte
	DEKID                uint32
	Purpose              Purpose
	Wrapped              []byte
	ProposerRegistration RegistrationPayload
}

RotationPayload is the OpRotation body. SubTag selects between rotate-dek / rewrap / enable-flag variants. Stage 4 ships RotateSubRotateDEK; Stage 6D adds RotateSubEnableStorageEnvelope.

For RotateSubRotateDEK the payload is:

• DEKID: the new key id being installed
• Purpose: which sidecar slot to update (PurposeStorage / PurposeRaft)
• Wrapped: the KEK-wrapped DEK bytes
• ProposerRegistration: the proposing node's writer-registry row, inserted in the same FSM apply transaction so the proposer's first encrypted write under the new DEK is covered by the §4.1 case 2 epoch monotonicity check.

For RotateSubEnableStorageEnvelope the payload reuses the same triple but with stricter constraints (validated in both the cutover RPC mutator on the propose side and `ApplyRotation` on the apply side, per the 6D design's §2.1):

• DEKID: MUST equal sidecar.Active.Storage at apply time
• Purpose: MUST be PurposeStorage
• Wrapped: MUST be empty (`len(Wrapped) == 0`, NOT nil — the wire decoder materialises zero-length payloads as an allocated empty slice)
• ProposerRegistration: covers the proposer's first write under the now-active envelope

func DecodeRotation(raw []byte) (RotationPayload, error)