Struct Conversation 

pub struct Conversation<C: ConsensusPlugin, Sc: PeerScoringPlugin, St: StewardListPlugin> { /* private fields */ }

Implementations

impl<C, Sc, St> Conversation<C, Sc, St>

where C: ConsensusPlugin, Sc: PeerScoringPlugin, St: StewardListPlugin,

pub fn create<Pr>( conversation_id: &str, provider: &Pr, credential: CredentialWithKey, ciphersuite: Ciphersuite, signer: &impl Signer, scoring: Sc, steward: St, consensus: ConsensusServiceFor<C>, app_id: Arc<[u8]>, config: ConversationConfig, member_id: &[u8], ) -> Result<Self, ConversationError>

where Pr: OpenMlsProvider, <Pr::StorageProvider as StorageProvider<1>>::Error: StdError + Send + Sync + 'static,

Create a brand-new conversation we steward. Starts in Working with the local member installed as sole steward at epoch 0. The library seeds a fresh MLS group into provider (which it does not retain) from credential and ciphersuite. member_id names the local member — the opaque id bytes the protocol matches on.

pub fn join<Pr>( provider: &Pr, welcome_bytes: &[u8], conversation_sync_bytes: &[u8], scoring: Sc, steward: St, consensus: ConsensusServiceFor<C>, app_id: Arc<[u8]>, config: ConversationConfig, member_id: &[u8], signer: &impl Signer, ) -> Result<Option<Self>, ConversationError>

where Pr: OpenMlsProvider, <Pr::StorageProvider as StorageProvider<1>>::Error: StdError + Send + Sync + 'static,

Build a fully-joined conversation from a welcome: the library opens the joiner-side MLS group from welcome_bytes using provider (which must hold the joiner’s key-package private keys), runs the joiner-side join side-effects, and replays the bundled ConversationSync (steward list, timing, peer scores).

Returns Ok(None) when the welcome doesn’t address one of our key packages — the “not for us” branch, not an error.

The conversation id comes from the MLS group, so the caller needs no prior knowledge of the conversation.

impl<C, Sc, St> Conversation<C, Sc, St>

where C: ConsensusPlugin, Sc: PeerScoringPlugin, St: StewardListPlugin,

pub fn is_in_recovery_mode(&self) -> bool

pub fn enter_recovery_mode(&mut self)

pub fn exit_recovery_mode(&mut self)

pub fn current_state(&self) -> ConversationState

pub fn drain_events(&self) -> Vec<ConversationEvent>

Drain every pending ConversationEvent accumulated since the last call. Returns events in insertion order. Callers (UI fanout, audit log) invoke this once per polling cycle.

pub fn next_wakeup_in(&self) -> Option<Duration>

Smallest pending deadline relative to now, or None when nothing is scheduled. Returns Some(Duration::ZERO) for an already-elapsed deadline. Covers consensus-session timeouts, auto-vote timers, and state-machine phase deadlines (Freezing window, steward / recovery inactivity). Forward to an external scheduler that calls poll() on fire; extra/early wakeups are no-ops.

pub fn drain_outbound(&self) -> Vec<Outbound>

Drain every buffered Outbound accumulated since the last call, in insertion order. The integrator invokes this once per cycle (after poll / handle_inbound / an intent) and maps each item onto its own transport.

pub fn leave<Pr>( &mut self, provider: &Pr, signer: &impl Signer, ) -> Result<LeaveOutcome, ConversationError>

where Pr: OpenMlsProvider, <Pr::StorageProvider as StorageProvider<1>>::Error: StdError + Send + Sync + 'static,

Leave this conversation. Opens a self-leave consensus round and returns LeaveOutcome::LeaveInitiated; the leave completes when the next steward commit merges the removal. signer is the local member’s MLS signer, used to authenticate the self-leave proposal.

impl<C, Sc, St> Conversation<C, Sc, St>

where C: ConsensusPlugin, Sc: PeerScoringPlugin, St: StewardListPlugin,

pub fn process_inbound<Pr>( &mut self, provider: &Pr, sender: &[u8], payload: &[u8], signer: &impl Signer, ) -> Result<DispatchOutcome, ConversationError>

where Pr: OpenMlsProvider, <Pr::StorageProvider as StorageProvider<1>>::Error: StdError + Send + Sync + 'static,

Decrypt and dispatch an inbound conversation payload. Drops self-echoes. Runs the full dispatch chain internally. Returns DispatchOutcome::LeaveRequested when the conversation has completed its protocol-side teardown; the integrator must then remove the registry entry and clean up the consensus scope.

pub fn apply_welcome_sync<Pr>( &mut self, provider: &Pr, sync_bytes: &[u8], signer: &impl Signer, ) -> Result<(), ConversationError>

where Pr: OpenMlsProvider, <Pr::StorageProvider as StorageProvider<1>>::Error: StdError + Send + Sync + 'static,

impl<C, Sc, St> Conversation<C, Sc, St>

where C: ConsensusPlugin, Sc: PeerScoringPlugin, St: StewardListPlugin,

pub fn send_message<Pr>( &mut self, provider: &Pr, message: Vec<u8>, signer: &impl Signer, ) -> Result<(), ConversationError>

where Pr: OpenMlsProvider, <Pr::StorageProvider as StorageProvider<1>>::Error: StdError + Send + Sync + 'static,

Buffer a chat message for broadcast. The conversation never sends — the message is enqueued and the integrator drains it via Conversation::drain_outbound. Blocked in Freezing and Selection (epoch rotation in flight — the message might not decrypt on peers who already merged the next commit). Governance traffic has its own gate (check_proposal_allowed). signer is the local member’s MLS signer, used to authenticate the outbound message.

pub fn add_member<Pr>( &mut self, provider: &Pr, key_package_bytes: &[u8], signer: &impl Signer, ) -> Result<(), ConversationError>

where Pr: OpenMlsProvider, <Pr::StorageProvider as StorageProvider<1>>::Error: StdError + Send + Sync + 'static,

Invite a joiner whose key package the caller supplies out of band, endorsing the add by bundling a YES vote at submit. Any member may call. Errors unless the conversation is Working.

See Self::sponsor_member for the non-endorsing steward relay.

pub fn sponsor_member<Pr>( &mut self, provider: &Pr, key_package_bytes: &[u8], signer: &impl Signer, ) -> Result<(), ConversationError>

where Pr: OpenMlsProvider, <Pr::StorageProvider as StorageProvider<1>>::Error: StdError + Send + Sync + 'static,

Relay a joiner that announced its own key package, without endorsing it: the proposal is submitted unbundled (CreatorVote::Deferred) and this member votes on it like any other. Only the primary epoch steward relays immediately, so a single Add proposal is opened per joiner. Every other member records the announcement in the pending-update buffer instead — a backup proposes it from there if the epoch steward stays silent past the recovery window (drained by poll), so an offline epoch steward doesn’t strand the join. No-op outside Working.

See Self::add_member for the endorsing out-of-band invite.

pub fn remove_member<Pr>( &mut self, provider: &Pr, member_id: &[u8], signer: &impl Signer, ) -> Result<(), ConversationError>

where Pr: OpenMlsProvider, <Pr::StorageProvider as StorageProvider<1>>::Error: StdError + Send + Sync + 'static,

Start a RemoveMember consensus round targeting member_id. The requester’s intent is the removal → the creator’s vote is bundled as YES at submit; no vote request is shown to the requester.

impl<C, Sc, St> Conversation<C, Sc, St>

where C: ConsensusPlugin, Sc: PeerScoringPlugin, St: StewardListPlugin,

pub fn poll<Pr>(&mut self, provider: &Pr, signer: &impl Signer) -> PollOutcome

where Pr: OpenMlsProvider, <Pr::StorageProvider as StorageProvider<1>>::Error: StdError + Send + Sync + 'static,

Drive one polling cycle: tick consensus deadlines, advance freeze state, and check steward inactivity.

Best-effort: each step runs regardless of whether the previous one failed; step errors are transient (a step that can’t act this cycle retries on the next) and are logged rather than surfaced.

Returns PollOutcome::leave_requested when the conversation is ready to be torn down; the integrator finalizes the leave.

signer is the local member’s MLS signer, threaded into the steward commit-candidate build and any auto-vote casts that fire this cycle.

impl<C, Sc, St> Conversation<C, Sc, St>

where C: ConsensusPlugin, Sc: PeerScoringPlugin, St: StewardListPlugin,

pub fn state(&self) -> ConversationState

Current state of the conversation’s state machine.

pub fn id(&self) -> &str

Name of this conversation. Identifies it in the integrator’s registry and on every crate::Outbound it produces.

pub fn member_id_bytes(&self) -> &[u8]

Identity bytes of the local member in this conversation.

pub fn app_id(&self) -> &[u8]

App id this conversation tags on outbound packets and uses for self-echo filtering in Conversation::process_inbound.

pub fn epoch_and_retry(&self) -> Result<(u64, u32), ConversationError>

Current MLS epoch + reelection retry round. Intended for UI status display.

pub fn pending_update_count(&self) -> usize

Count of buffered pending membership updates. Used by tests and the UI to verify buffer hygiene (e.g., that a joiner’s buffer is empty right after they receive the welcome).

pub fn freeze_candidate_count(&self) -> (usize, usize)

Freeze round progress: (received, expected). Returns (0, 0) if not in freeze or no steward list is known.

pub fn is_steward(&self) -> bool

pub fn is_epoch_steward(&self) -> Result<bool, ConversationError>

true if the local member is the primary steward designated for the current epoch — the one that should commit and sponsor joiners first. Unlike Self::is_steward (true for any member on the list, backups included), this is true for exactly one member per epoch, so it gates the single-actor paths: backups defer to the primary and only step in after the recovery window. Eligibility is the same live rotation Self::member_roles uses, so all members agree on who it is.

pub fn members(&self) -> Result<Vec<Vec<u8>>, ConversationError>

Identity bytes of every current member of this conversation, as reported by MLS.

pub fn member_scores(&self) -> Vec<(Vec<u8>, i64)>

pub fn member_score(&self, member_id: &[u8]) -> Option<i64>

pub fn pending_leave_member_ids( &self, ) -> Result<Vec<Vec<u8>>, ConversationError>

Identities that have an in-flight self-leave request. Used by the UI to render a “pending leave” indicator.

pub fn member_roles( &self, ) -> Result<Vec<(Vec<u8>, MemberRole)>, ConversationError>

Steward role for each member. Uses live rotation so removed or pending-leave stewards are skipped in role display.

pub fn approved_proposals_for_current_epoch( &self, ) -> Vec<ConversationUpdateRequest>

impl<C, Sc, St> Conversation<C, Sc, St>

where C: ConsensusPlugin, Sc: PeerScoringPlugin, St: StewardListPlugin,

pub fn initiate_proposal<Pr>( &mut self, provider: &Pr, request: ConversationUpdateRequest, creator_vote: CreatorVote, signer: &impl Signer, ) -> Result<(), ConversationError>

where Pr: OpenMlsProvider, <Pr::StorageProvider as StorageProvider<1>>::Error: StdError + Send + Sync + 'static,

Open a consensus vote for request; CreatorVote picks the wire shape and the integrator event.

Errors when the state machine forbids new proposals (freeze phases, partial freeze during an active emergency). On success the proposal is on the wire and a consensus-timeout deadline is armed for tick_deadlines to fire.

Local ownership is recorded before any vote is cast: with a single expected voter the bundled YES resolves the session synchronously, and the outcome handler must already see us as the owner by then.

pub fn vote<Pr>( &mut self, provider: &Pr, proposal_id: u32, vote: bool, signer: &impl Signer, ) -> Result<(), ConversationError>

where Pr: OpenMlsProvider, <Pr::StorageProvider as StorageProvider<1>>::Error: StdError + Send + Sync + 'static,

Cast the local member’s vote. Cancels the pending auto-vote so the manual choice wins. Blocked while an epoch rotation is in flight (Freezing/Selection) — the encrypted vote might not decrypt on peers that already merged the next commit.