Identity attribution mechanism: verify-once at connect, server-attached identity, msg.by, two-lane throughput

[styk-tv]

Goal

Attribute every message in a multi-user session to its sender without per-message crypto, so identity is available to all participants at chat volume. cklib is the reference client and the public face — this contract is inherited by every public client project.

Principle — verify once, attribute cheap

The JWT signature is verified exactly once, at connection open; the connection is bound to that identity. Every later message is attributed by a lookup, never a re-verification. Signature crypto is once-per-connection; per-message cost is O(1).

Flow

1. Connect — the edge (Envoy) verifies the JWT signature once and binds the identity to the connection (header on the WS upgrade / NATS CONNECT); NATS binds it to the connection.
2. Client publishes {verb, kernel_urn, payload} — no identity field (already shipped, ck-client.js).
3. Ingress attaches — the relay reads the connections bound identity (O(1)) and passes it as the 4th element of ckp.dispatch(verb, urn, payload, identity)`. Identity is never a client parameter — the client cannot forge what it does not control.

cklib`s part (this repo)

• Never assert identity — send path stays {verb, kernel_urn, payload} (done).
• Surface msg.by — every delivered message/event carries the server-attributed sender (URN/handle), read O(1) from a header; exposed as msg.by. How a session shows who-said-what without the client asserting or verifying.
• Handle-intern participant URNs — for the ephemeral lane, resolve sender → an interned integer handle (the existing dictionary table) so attribution is ~4 bytes at volume.

Throughput — two lanes

Sealing (DB + HMAC) is the volume cost, not the JWT. Split by intent:

• Governed lane (decisions, edges, transitions): server-sealed, proof-chained, created_by stamped.
• Ephemeral lane (chat lines, typing, presence): connection-attributed by, delivered fast, not sealed per message.

The sealed-vs-ephemeral classification sets the throughput ceiling.

Implications (agreed)

• Trust boundary: NATS must be reachable only through the verifying edge, else a client bypasses verification. Deployment invariant.
• Revocation: verify-once means a revoked token stays live until the connection drops — long-lived connections need a max-lifetime (reconnect = re-verify).

Cross-repo

• Substrate reads the ingress-attached identity — styk-tv/pgCK (companion, filed).
• Edge/bundle attaches identity at connect + locks NATS to the edge — sporaxis-com/oci-germination (companion, filed).

[styk-tv]

Companions filed across the three repos: substrate styk-tv/pgCK#10 (dispatch reads the connection-bound identity), edge/bundle sporaxis-com/oci-germination#19 (Envoy attaches identity at connect + locks NATS to the edge). Composes with the client ergonomics in #10.

[styk-tv]

Auth mechanism finalized in prod — this resolves the "how does the ingress verify identity, efficiently?" question.

The identity tokens are signed with EdDSA (Ed25519). Because NATS's own credentials are Ed25519-native, a single token authenticates both the web edge and the NATS connection — so the verify-once at connect step is NATS verifying the Ed25519 signature natively at CONNECT and binding the connection to the identity. No second credential, no per-message crypto. This is exactly the mechanism this issue describes, now realized end-to-end.

What it confirms for cklib (no change needed): the client presents the JWT on the (upgraded) NATS-WSS connection (login() → token → connect) and never re-sends it per message. That existing model is validated by the finalized prod auth — cklib's contract holds: send lean {verb, kernel_urn, payload}, surface the server-attributed msg.by on receive.

So the three-repo split stands, with the verification method now pinned: substrate (styk-tv/pgCK#10) reads the connection-bound identity; edge/bundle (sporaxis-com/oci-germination#19) verifies once at connect. cklib's slice (msg.by + never-assert + handle-interning) is unchanged by this — it was already right.