[bahdotsh]

Step 7c of the shared-network plan (ADR 0037, "Service discovery"). Stacked on #693.

On a configured node, service discovery stops naming services in the clear. A provider answers only queries proven by a member of its own application. This replaces the __SVC_DISC* exemption that #689 left in the inbound gate.

Wire

• Sealed bodies: query and response bodies are sealed under HKDF(K_app, salt, "offline-app-svc-v1") as salt(16) || ChaCha20-Poly1305(nonce 0, no AAD).
  • The cleartext service_id is the sentinel __sealed. No ServiceId can be that value, and register_service refuses it.
  • Query plaintext: {issued_at, identity_key, service_id?}.
  • Response plaintext: {provider, identity_key, service_id, version, capabilities, hop_count}.
• Proofs: each body carries an end-to-end proof (kinds 4 and 5) in a member_proof payload field. It is not in frame metadata, because every forwarder builds a new frame. The proof binds u16be(len(query_id)) || query_id || originator(21) || sealed, which no hop changes. The hop budget is not bound, because every forwarder rewrites it.
• Identity key: the sender's identity key travels sealed, because the frame's control key is the last forwarder's. The verifier checks that derive_address(identity_key) matches the address the proof speaks for.
• Unconfigured frames are byte for byte unchanged (skip_serializing_if).
• Vectors: a discovery block in app-membership-v1.vectors.json.

Rules

• Freshness: |now - issued_at| <= 60 s. One answer per query_id, held in an answered map until issued_at + 60. At its cap the map refuses rather than evicts, so the failure mode is a lost result, never a double answer.
• No crossing between modes: a configured provider never answers a cleartext query, and a configured originator never reports a cleartext response.
• Key without a certificate: a configured node with the key but no certificate sends 189 random bytes as its proof.
• Behaviour change from feat(protocol): a member answers only the peers its application admitted #689: acknowledgements now go out for discovery carriage. That covers a query, a response bound for someone else, and a proven response that ends here. Without it, a proven provider retries its answer to expiry, and which forwarded queries get acknowledged would tell an observer which pairs are members. A configured node therefore acknowledges a stranger's query, as an unconfigured node does. Please look at this one in review.

Tests

• Services: 12 new tests over a fake sealer.
• Engine (tests/membership_discovery.rs): 4 tests on a line of nodes, run over the real paths.
  • Two members are three hops apart. The nodes in between, one from another app and one unconfigured, carry the frames and register the same service id, yet never see it in the clear, never answer and never report.
  • A node with the key but no certificate gets no answer.
  • A replayed query is not answered.
  • A response whose proof names another provider is not reported.
• Mutation checks:
  • Turning off the response rule makes a_forged_answer_to_a_member_is_not_acknowledged fail.
  • Skipping the query proof check makes the stranger tests fail.

Rebase

Rebased onto #693.

• The sealed constants, label list and vector-block conflicts were merged by keeping both sides.
• The vectors were regenerated, and generate.py --check passes.
• A duplicate membership_configured (both stacks added it) was removed.
• Run after the rebase:
  • cargo clippy --workspace -- -D warnings: pass.
  • cargo test --workspace --lib: pass, except the local-only no_shipped_file_names_a_relay, whose offenders are all under a stale .claude/worktrees.
  • Uniffi 319 tests: pass.
  • Rustdoc and fmt: pass.
  • Bare-metal clippy for sealed on all four targets: pass.

Known

• Threat model R9 still says discovery gossip travels in the clear. The docs PR at the top of the stack rewrites it.
• A node on an older release forwarding a configured query drops the unknown sealed/member_proof fields, so configured discovery does not cross older nodes.

CI runs only once the stack below merges into main.