Module version 

Per-entity version chain for authority editions.

Every authority record (a Grant, RoleMetadata, RoleOrder, Banlist, the OwnerAttestation) is a sequence of editions. Each edition carries a monotonic version and the hash of its predecessor (prev_hash), and the actor’s real-npub signature covers both — so the chain is over signed content, not the (ephemeral) outer wrapper. Clients fold the fetched set into the current head by the rules:

• refuse-downgrade on the version integer (never accept a version below the floor already held);
• equal-version fork resolves by a deterministic tiebreak: the lower inner edition id (a commitment hash over author+content+tags+time, NOT the author-settable created_at, so it can’t be cheaply biased — the authority-first lens is layered on by the caller via the roster);
• a gap (a higher version whose prev_hash doesn’t link contiguously to what we hold) leaves the head at the highest contiguous version and is reported, so the caller can fail closed for that entity and refetch the missing prereqs from the quorum (H1/M8) rather than fail open.

Structs

Edition

One fetched edition of an entity, reduced to what the fold needs. (Signature/authority validation happens before this — only editions whose real-npub signature verified are folded.)

FoldResult

The outcome of folding one entity’s editions.

Functions

bootstrap_head

The head a bootstrapping client accepts: the per-version winner at the HIGHEST present version ≥ floor, ignoring chain contiguity. A fresh joiner whose genesis was re-anchored away cannot verify lineage at all, so contiguity is the wrong test for it — the real gate is the edition’s signature (verified before folding) plus the author’s CURRENT authority, which the caller resolves against the roster + owner attestation. A relay cannot forge a higher version (no valid signature), so the worst case is a stale-but-valid head that the union + ratchet later upgrade. Returns None if no edition is ≥ floor. Equal-version forks use the same deterministic tiebreak as fold (lower inner edition id) so every client converges on one head.

edition_hash

SHA-256 of edition_signing_bytes — the edition’s identity in the chain. The next edition’s prev_hash cites this value.

edition_signing_bytes

Domain-separated, length-prefixed canonical bytes an authority edition commits to.

fold

Fold a set of editions for one entity into its current head.