From 913a1d24908ea68c2018c74699f11671047cd166 Mon Sep 17 00:00:00 2001 From: Andrew Plaza Date: Fri, 7 Aug 2026 17:06:17 -0400 Subject: [PATCH] feat(mls/database): add KpLiveness Task variant MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds a KpLiveness variant to the Task oneof: a recurring singleton that verifies this installation still has a usable key package published on the network, and queues a rotation when it does not. Rotation (KpRotation) is driven purely by a local deadline column. If that column is ever wrong, the client silently stops rotating, its published key package expires, and it becomes permanently unreachable: anyone adding it records it as a failed installation, so it receives no welcome and therefore never gets the welcome-driven rotation nudge either. Nothing in that loop produces a local error. KpLiveness is the independent watchdog — separate schedule, separate retry/backoff, and a network probe rather than a local deadline as its source of truth. Consumed by libxmtp (xmtp/libxmtp). Co-Authored-By: Claude Opus 5 (1M context) --- proto/mls/database/task.proto | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/proto/mls/database/task.proto b/proto/mls/database/task.proto index 5791994b..6ece0bfe 100644 --- a/proto/mls/database/task.proto +++ b/proto/mls/database/task.proto @@ -18,6 +18,7 @@ message Task { KpRotation kp_rotation = 5; KpDeletion kp_deletion = 6; AddMissingInstallations add_missing_installations = 7; + KpLiveness kp_liveness = 8; } } @@ -38,6 +39,19 @@ message KpRotation {} // delete_at_ns has passed. Empty payload => stable data_hash for pull-ins. message KpDeletion {} +// Recurring singleton: verify that THIS installation still has a usable key +// package published on the network, and queue a rotation when it does not. +// +// Distinct from KpRotation on purpose. Rotation is driven by a local deadline +// column; if that column is ever wrong the client stops rotating, its published +// key package expires, and it becomes permanently unreachable (added to groups +// only as a failed installation, so it never receives a welcome and never gets +// the welcome-driven rotation nudge either) without observing any local error. +// Liveness is the independent watchdog for that closed loop: its own schedule, +// its own retry/backoff, and a network probe rather than a local deadline as +// its source of truth. Empty payload => stable data_hash for pull-ins. +message KpLiveness {} + message SendSyncArchive { xmtp.device_sync.ArchiveOptions options = 1; bytes sync_group_id = 2;