Module sync_protocol 

Versioned, replay-safe sync-operation protocol and quarantined inbox.

This is the delivery layer that lets Projects/Finance (and any domain) converge across nodes without duplicating money or obligations. It implements the master plan’s SyncService (§4.2), link-protocol framing (§9.5), and the money-safety invariants (§17):

• every operation is versioned (protocol + schema) and content-hashed;
• the inbox is quarantined: untrusted frames are decoded into this DTO and validated before anything is admitted — oversized, malformed, unsigned, wrong-hash, wrong-version, and Sanctuary-classified frames are rejected fail-closed;
• admission is idempotent: a replayed operation_id is recorded as Duplicate, never applied twice;
• merge_operations is add-wins by operation id and order-independent, so duplicate/reordered/replayed frames converge to the same set — the same discipline the domain layers (finance::derived_balance, projects::derive_obligations) use to derive totals purely over the unique-id set.

Full signature verification is the identity/key-vault layer’s job (it holds the actor public keys); this layer verifies presence + integrity and enforces the routing lane.

Structs

InboxRecord

A persisted inbox record: the operation plus its admission outcome and time.

SyncInbox

Durable quarantined inbox (append-only jsonl). Admission validates, dedupes by operation id, and records the outcome; only Validated records represent applicable operations.

SyncOperation

A single versioned, content-addressed sync operation (the wire DTO).

Enums

AdmitOutcome

Outcome of validating/admitting an inbound operation.

Constants

CURRENT_PROTOCOL_VERSION

CURRENT_SCHEMA_VERSION

MAX_OPERATION_BYTES

Hard cap on a single serialized operation (defends the quarantine against oversized frames).

MAX_SUMMARY_BYTES

Hard cap on the payload summary carried inline.

SYNC_INBOX_FILE

Functions

lamport_next

Next Lamport clock value given the local counter and an observed remote value.

merge_operations

Merge two operation sets add-wins by operation id (never re-apply), returning a deterministically ordered union (by Lamport clock, then id). Idempotent and order-independent.

sha256_hex

validate_operation

Validate an inbound operation fail-closed. seen_ids is the set of already-admitted operation ids (for replay detection). Returns the admission outcome without persisting.