[bahdotsh]

Step 9a of the shared-network plan (ADR 0037). Stacked on #691.

A leaf can't fetch a certificate, so its paired phone hands it one inside their 1:1 session. From then on the leaf runs the membership exchange like any other node.

Sealed

• MemberProvision: base64 of version(1)=1 || kind(1)=3 || publisher_key(32) || cert(93) || u64be(supplied_time), 135 bytes. Kind 3 is not a __MEMBER__ step, so neither parser accepts the other's body.
• The new prefix __MEMBER_PROVISION__ is reserved, added to the pinned list and the shadow test.
• Vectors: a provision block and five rejects in app-membership-v1.vectors.json.
• The leaf and the engine stamp the one constant, WIRE_APP_ID.

Phone (engine and UDL)

• provision_leaf_membership(peer, cert) -> MessageId:
  • It needs a publisher key, and the certificate must name the leaf, verify and be current.
  • It seals into the confirmed session only and never starts a session.
  • It sends on the reliable ladder, then restarts the exchange with the leaf.
• Every binding is regenerated (Swift, Kotlin, Python, Ruby, Java, C dispatcher, C#, local API table). The method is classified PLATFORM.
• A bare __MEMBER_PROVISION__ on the wire, or in a decrypted plaintext on a node that is not a leaf, is consumed and acted on by nothing.

Leaf (offline-protocol-leaf/src/membership.rs)

• Accepting: it acts on provisioning only as a decrypted application message, after the sender's credential is bound. The certificate must name the device, verify and be current at the supplied time.
• Ordering: it stores the record before group.write_to_storage(), and the acknowledgement is minted after both. A failed store leaves no group write and no ack, so the phone's retransmission still opens.
• The exchange: it mirrors the engine rule for rule, and stamps offline on the wire after provisioning. It uses mls-rs crypto only, with no new dependency.
• Clock: the leaf reads none. "Supplied time" is the later of the provisioning time and the now firmware passes in, and it never moves backwards.
• Firmware: it calls LeafDevice::neighbor_discovered(peer, now) for each neighbour its radio connects.
• Bounds: 16 exchanges and 16 visible members. A corrupt stored record counts as unprovisioned, so a bad record cannot brick the device.

Found while stacking it on the inbound gate (#689)

Because of the inbound gate, a configured phone drops an unprovisioned leaf's key package unless its application named the leaf. The application does that through the out-of-band anchor step, by asking for a session with the address it verified (establish_secure_session). That call names the peer even before any key package has arrived.

• docs/spec/leaf-provisioning.md states this.
• The test rig models it.
• a_configured_phone_never_pairs_a_leaf_its_application_did_not_name pins the refusal. Mutation-checked: forcing the inbound gate open makes it fail.

Decisions to review

1. Any paired peer's session can provision the leaf, and the latest one wins. A single-owner rule would sit on top.
2. The leaf admits __MEMBER__ under the older control payload, as it already does for __MLS_KEY_PKG__. Otherwise a provisioned leaf would be invisible to members it never paired with. Freshness comes from the nonces.
3. An unprovisioned leaf remembers the last hello from each neighbour (in memory, at most 16) and answers it once provisioning lands. Until then it sends and writes nothing.

Checks

• cargo test --lib: offline-protocol 2222, sealed 108, leaf 6 and uniffi 318, all passing.
• cargo clippy --workspace -- -D warnings, rustdoc under -D warnings and fmt all pass.
• Bare-metal clippy for sealed and leaf passes on thumbv6m and riscv32imc (the agent also ran all four targets plus WASI).
• Every generator's --check passes.

CI runs only once the stack below merges into main.