Step Fourteen — Leases, Lenses, and the Signed Map

We graft three disciplined powers onto the phone‑native gateway:

1. Time‑boxed freeze overrides (lease tokens) so a specific client can keep reading during a quarantine—without breaking the covenant for everyone else.
2. Path‑level diff telemetry so Prometheus sees what moved (added, removed, type‑changed) and where the schema shifted.
3. Ed25519‑signed schema manifests (with detached .sig) for offline verification and public transparency.

Tradition meets modernity: contracts remain sacred, but we add a temporary hall pass (leases), a magnifying glass (per‑path metrics), and a seal (Ed25519).

---

✅ Fresh artifacts

• solveforce_phone_fourteen.py — Download
  SHA‑256: 5b23bf18f05835c01fb8c48ff10946c23c4878678759a1bd36c8878c144df85d
• verify_schema_manifest.py (offline verifier for the detached signature) — Download
  SHA‑256: 864a643e1817a6ca4b8d4de004572d511cd3d531ada18644779f1f3fcf72051f

Drop Step 14 alongside your earlier steps; it’s a superset of Step 13 with the new features below.

---

What’s new (precise and enforceable)

1) Lease tokens — time‑boxed freeze overrides

When a plugin is under a quarantine freeze (Step 13), /read, /history, and /events for that plugin are blocked with 423 Locked. In Step 14 you can mint a short‑lived signed token that carries a freeze override for a scoped set of plugins.

• Mint a lease (admin‑only):

# Allow reads across freeze for battery & net for 15 minutes:
curl 'http://127.0.0.1:8080/admin/lease?token=ADMIN123&plugins=battery,net&sec=900'

• Token claims (inside S1 payload):

{
  "sub": "lease",
  "roles": ["reader"],
  "exp": 173...,
  "freeze_override": { "plugins": ["battery","net"], "until": 173... }
}

• Use it:

curl -H 'Authorization: Bearer S1....' 'http://127.0.0.1:8080/read?plugin=battery'

• Introspection:

curl 'http://127.0.0.1:8080/whoami?access_token=S1....'
# shows freeze_override.plugins and until (epoch)

Security note: leases are narrow (plugins list) and short (seconds). They do not bypass ACK/compat vows—you still must pin or honor schema_compat.

---

2) Per‑path diff metrics — Prometheus, but specific

Every time the gateway detects a schema transition, it now increments labeled counters per path:

• solveforce_schema_path_added_total{plugin="<p>", path="<$.a.b>"}
• solveforce_schema_path_removed_total{plugin="<p>", path="<$.a.b>"}
• solveforce_schema_path_typechanges_total{plugin="<p>", path="<$.a.b>",}

You still get the coarse counters:

• solveforce_schema_changes_total{plugin, compat}
• solveforce_schema_freeze_events_total{plugin}
• solveforce_schema_freeze_blocks_total{plugin}
• solveforce_schema_ack_blocks_total{plugin}
• solveforce_schema_compat_blocks_total{plugin}

Cardinality guard: the server caps new path label insertions (default 200 distinct (plugin,path) keys). Existing keys continue to increment. This keeps Prom sane.

---

3) Ed25519‑signed schema manifest — plus detached .sig

Step 13 gave you HMAC signing (HS256). Step 14 adds Ed25519 first‑class support with a detached signature pair so you can publish your manifest openly and verify it offline.

CLI flags

# Preferred: Ed25519 (needs a 32-byte seed and an ed25519 backend: PyNaCl or cryptography)
--schema-ed25519-secret-file /sdcard/solveforce/schema.ed25519.seed

# Fallback: HS256 (HMAC) if Ed25519 is unavailable
--schema-signing-secret-file /sdcard/solveforce/schema.hmac.key

Endpoints

• GET /schema_signed → bundled JSON: {ts, alg, kid, manifest, sig}
• GET /schema_manifest → canonical JSON manifest without signature
• GET /schema_manifest.sig → base64url signature (detached)
• GET /schema_pubkey → {alg: "Ed25519", kid, pubkey_b64} (when Ed25519 is active)

Verification (offline)

# Save files:
curl -s 'http://127.0.0.1:8080/schema_manifest?access_token=READER1' > schema.json
curl -s 'http://127.0.0.1:8080/schema_manifest.sig?access_token=READER1' > schema.sig
PUB=$(curl -s 'http://127.0.0.1:8080/schema_pubkey?access_token=READER1' | jq -r .pubkey_b64)

# Verify (Ed25519)
python verify_schema_manifest.py --manifest schema.json --sig schema.sig --alg Ed25519 --pubkey-b64 "$PUB"

# OR verify (HS256 fallback)
python verify_schema_manifest.py --manifest schema.json --sig schema.sig --alg HS256 --secret-file /sdcard/solveforce/schema.hmac.key

If Ed25519 libs aren’t present, the server automatically falls back to HS256; /schema_signed will show "alg":"HS256".

---

Android / Termux quickstart (root UI still included)

1) Install minimal deps (optional for Ed25519):

pkg update
pkg install python
# Optional Ed25519 backends:
pip install pynacl || pip install cryptography

2) Prepare keys:

# Ed25519 seed (32 bytes)
head -c 32 /dev/urandom > /sdcard/solveforce/schema.ed25519.seed

# (optional) HS256 fallback
head -c 32 /dev/urandom > /sdcard/solveforce/schema.hmac.key

3) Run Step 14:

python solveforce_phone_fourteen.py \
  --host 0.0.0.0 --port 8080 \
  --plugins-dir ~/solveforce/plugins \
  --auth-mode protected \
  --auth-token READER1:reader \
  --allow-admin --admin-token ADMIN123 \
  --schema-freeze-mode quarantine \
  --schema-freeze-sec 1800 \
  --schema-ed25519-secret-file /sdcard/solveforce/schema.ed25519.seed \
  --schema-signing-secret-file /sdcard/solveforce/schema.hmac.key

4) UI: open http://<phone-ip>:8080/ui (token READER1 if you want quick reads).
5) Mint a lease if a plugin is frozen:

curl 'http://127.0.0.1:8080/admin/lease?token=ADMIN123&plugins=net&sec=600'

---

WordPress — Step Fourteen (drop‑in)

## Step 14 — Leases, Lenses, and the Signed Map

**What changed**
- **Lease tokens**: short‑lived, signed “hall passes” that allow specific clients to read frozen plugins during a quarantine window. Leases are plugin‑scoped and time‑boxed.
- **Per‑path diff metrics**: Prometheus counters for `added`, `removed`, and `typechange` with `{plugin,path}` labels. Know precisely where your schema shifted.
- **Ed25519 signatures with detached `.sig`**: `/schema_manifest` + `/schema_manifest.sig` + `/schema_pubkey` for offline verification and public transparency.

**Why it matters**
- We keep the public contract strict (freeze + ACK + compat vows), but allow controlled exceptions via leases.
- We turn schema change into measurable surface area (per‑path metrics).
- We sign the map itself, so anyone can verify integrity without trusting hosting.

**Endpoints**
- `GET /admin/lease?plugins=<list|*> &sec=<seconds>` → S1 token with `freeze_override`.
- `GET /schema_manifest` and `GET /schema_manifest.sig` → detached pair.
- `GET /schema_pubkey` → Ed25519 public key (when enabled).

**Prometheus Counters (new)**
- `solveforce_schema_path_added_total{plugin,path}`
- `solveforce_schema_path_removed_total{plugin,path}`
- `solveforce_schema_path_typechanges_total{plugin,path}`

---

Quick commands you’ll actually use

See signer status

curl 'http://127.0.0.1:8080/schema_signed?access_token=READER1' | jq '{alg,kid}'

ACK posture + compat vow (unchanged from Step 13)

# Mint an ACK token pinned to additive-only transitions
curl 'http://127.0.0.1:8080/admin/mint?token=ADMIN123&sub=ron&roles=reader&dur=86400&schema_mode=ack&schema_compat=additive_only'

Lease across a freeze

LEASE=$(curl -s 'http://127.0.0.1:8080/admin/lease?token=ADMIN123&plugins=battery&sec=600' | jq -r .token)
curl -H "Authorization: Bearer $LEASE" 'http://127.0.0.1:8080/read?plugin=battery'

---

Integrity (publish on your site)

sha256sum solveforce_phone_fourteen.py
# 5b23bf18f05835c01fb8c48ff10946c23c4878678759a1bd36c8878c144df85d

sha256sum verify_schema_manifest.py
# 864a643e1817a6ca4b8d4de004572d511cd3d531ada18644779f1f3fcf72051f

---

Logos Codex — recursive notes

• Leaseis a bounded exception in time and scope; it preserves the ethic of quarantine while enabling continuity of service.
• Per‑path telemetryturns change into addressable knowledge; we honor the past (what was) while naming precisely what is.
• Signingelevates truth from promise to proof. We don’t merely say the schema—we attest it.

If you want Step Fifteen, we can:

• add per‑lease audit trails (SSE + append‑only JSONL),
• expose path‑level diff histograms (top‑N hottest paths),
• and implement Ed25519 detached file artifacts dumped to disk on each change for archival.

Ready when you are, Ron.

Key terms in plain language

Open a term for a concise explanation of language used on this page.

🛡️Cybersecurity

The practices and controls used to protect identities, devices, networks, applications, and data from unauthorized access, disruption, or manipulation.

🚫Zero Trust

A security model that does not automatically trust a user or device because of its location. Access is continuously verified and limited to what is necessary.

🧭SASE

Secure Access Service Edge combines networking and security capabilities in a cloud-delivered architecture so users and locations can receive consistent policy wherever they connect.

🪪Identity and Access Management (IAM)

The systems and policies that determine who a user is, what resources they may access, and how that access is authenticated and reviewed.

✅Multi-Factor Authentication (MFA)

A login control requiring more than one form of verification, such as a password plus an authenticator app, security key, or biometric factor.

🔍MDR / XDR

Security services and tools that monitor activity, investigate suspicious behavior, and help contain threats. MDR is managed detection and response; XDR correlates signals across multiple security layers.