Home / Projects / Orchestrata Ultimate / Decisions / ADR index / ADR-0045

ADR-0045: Per-lineage bearer token for submitter continuity (r12-decision-2, refined)

← ADR-0044 · ADR-0046 →

The record

Status: Proposed (awaiting Mohamed) · Date: 2026-08-29

Context

Volks are keyless by design; session identity authenticates connections, not principals, and dies with a queue restart. Lineage joining (review-history continuity) needs an authenticator. Refined twice under review: session-records version rejected (r13); mint-time gating rejected (r15 — deadlock + denial primitive); current form is join-only, with the silence gate at presentation time.

Decision (proposed)

At lineage creation the queue mints a 256-bit bearer token, returns it in the mint response over the submitting session's channel, stores it salted-hashed in the adjudicate-signed minting record. Joining a lineage requires presenting it. Lost or compromised: Mohamed confirms the submitter, the queue re-mints — the re-mint supersedes (revokes) the old hash. Tokens die with their lineage's terminal state. Minting itself is never refused and authenticates nobody (it reserves nothing).

Alternatives rejected

Per-volk signing keys (violates keyless-volk doctrine); session identity (not a principal, restart-fragile); mint-time enforcement (r15: deadlock, denial primitive). Fallback if REJECTED (priced in F7): joining becomes advisory; four readers degrade; a claimed join can never resolve a blocking verdict.

Consequences

Submitter continuity without volk keys; the anti-squatting property holds by mechanism.

Provenance

Design v16 C-2b + §11 F7 sub-clause; rounds 12-15.

Related ADRs

No other ADR is named in this record.

Rulings cited

None.

Specs cited

None (or no spec page exists for the ones named).