@xyo-network/event-kit-protocol

Transport-neutral verification and admission orchestration for Event Kit wakes:

1. Verify a real ES256K wallet JWT with the XYO SDK
2. Bind JWT eventHash to the wake Payload data hash
3. Bind the Payload to one immutable route, source identity, and authorization chain
4. Require an exact active subscription and its live Statement Graph grant
5. Resolve replay, logical idempotency, receipt creation, and durable enqueue through one atomic inbox boundary

The D-002 split now exists as pure verifyWakeRequest plus stateful admitAndEnqueue over explicit WakeGrantAuthorizer and AtomicWakeInbox ports. Protocol code owns no cloud or transport SDK. The stateful layer invokes injected I/O, while the inbox contract deliberately owns durable enqueue or a transactional outbox instead of exposing a split queue callback. See Yellow Paper §6 and §13.

D-002's target is a raw strict XYO Payload plus a real short-lived wallet JWT; there is no separate event signature.

D-005 adds a second, independent pure-protocol surface for the on-chain subscription handshake. It provides canonical RFC 8785 bytes, one fixed RFC 9180 Base-mode suite (X25519/HKDF-SHA256/AES-128-GCM), dedicated encryption-key generation, strict one-shot subscription encryption/decryption, HMAC-SHA256 endpoint challenge proof, and deterministic fail-closed service/key/ subscription lifecycle selection. Clear routing fields and the structural subscriber claim source are HPKE associated data. This package still performs no XL1, datalake, filesystem, HTTP, or cloud I/O.

See the normative on-chain handshake profile and the language-neutral fixture at ../../conformance/vectors/subscription-hpke.json.

createMemoryWakeInbox ships one conformant AtomicWakeInbox: it serializes the critical section, binds a fresh jti to an existing wake receipt, and hands the wake to its sink before consuming either identity, so a failing sink leaves the attempt retryable. It is single-process and loses state on restart — a durable adapter is available from @xyo-network/event-kit-node, but full resident-runtime and network qualification remain pending. The memory adapter is not production evidence.

Source binding and activation

verifyWakeRequest and admitAndEnqueue implement the one current source-aware contract. Routes pin the independent XL1 authorization chain, source, canonical filter hash, immutable subscription hash, source floor, and range bound. createStatementGraphWakeGrantAuthorizer requires a finalized activation reader in addition to the grant viewer. The production helper createActiveSourceWakeGrantAuthorizer in event-kit-statement-graph supplies the exact active D-005 lifecycle binding and selects the exact accepted grant.

AtomicWakeInbox<TWake>, WakeQueue<TWake>, and drainQueue default to AdmittedWake. Use AdmittedWakeZod to validate repeated persisted fields and parseAdmittedWake to also recompute the event hash. Neither parser authenticates an arbitrary raw record or replaces the HTTP admission path.

The exact source/floor/range filter is encrypted and authenticated. Activation height on the authorization chain never substitutes for a source position. All public schemas and helpers describe this contract; versioned Event Kit schemas and alternative plaintext readers are rejected.