Module control 

The v2 Control Plane (CORD-04 over CORD-01/02).

Editions keep v1’s exact grammar — the vsk/eid/ev/ep/vac tags, the frozen edition_hash (community::version, label vector-community/v1/edition, which upstream froze verbatim), and the fold rules — but ride the v2 stream envelope: a kind-3308 UNSIGNED rumor inside a plaintext seal (20014) at control_pk. Authorship moves from the rumor’s own signature (v1) to the seal’s (v2): super::stream::open_wrap Schnorr-verifies the seal and pins rumor.pubkey == seal.pubkey, so by the time an edition is parsed here its author is already proven. The plaintext seal is load-bearing: a compaction re-wraps the signed seal into a new epoch byte-verbatim, and the signature (over the rumor string) survives — an encrypted seal could not.

Two v1↔v2 wire deltas, both deliberate:

• v2 editions carry NO ["v","1"] protocol tag (frozen derivations partition protocol revisions by address; version tags are the rejected mechanism).
• the owner is proven by the self-certifying community_id commitment (super::derive::verify_community_id), not an attestation event — vsk 7 is retired.

Structs

ChannelMetadata

Channel metadata — the vsk-2 entity content (CORD-03 §2). eid = the channel_id; gated by MANAGE_CHANNELS. Absent flags mean false; deletion is terminal.

CommunityIdentity

A v2 community’s self-certifying identity triple. The id IS the owner commitment — carry all three together and verify before trusting any claim.

CommunityMetadata

Community metadata — the vsk-0 entity content (CORD-02 §6). eid = the community_id itself; gated by MANAGE_METADATA.

Genesis

The two wraps of a community genesis — exactly two owner-signed editions: the community metadata (vsk 0) and one public #general channel (vsk 2). Nothing more — no default roles, no scaffolding.

ImageRef

An encrypted-blob image pointer (icon/banner): the media server sees only an opaque blob; members fetch, decrypt with key/nonce, and verify hash.

Enums

ControlError

Errors from the control plane layer (envelope errors ride inside).

Constants

MAX_DESCRIPTION_BYTES

UTF-8 byte cap on a community description.

MAX_NAME_BYTES

Protocol-wide UTF-8 byte cap on names (community, channel, role).

Functions

build_edition_rumor

Build the unsigned kind-3308 edition rumor — v1’s grammar minus the protocol v tag. Control editions carry no ms tag: they fold by version, not time.

genesis

Mint a v2 community: fresh identity (salt-committed to the owner), fresh community_root, and the two genesis editions sealed at the epoch-0 control plane. The caller persists the secrets and publishes the wraps.

open_control_edition

Open a control-plane wrap into a verified, parsed edition. Strict on both gates: the rumor must be kind 3308, and the seal must be the plaintext form.

parse_edition_rumor

Parse an edition from an ALREADY-VERIFIED rumor (one produced by stream::open_wrap, which proved the seal signature, the author binding, and the rumor id). No signature lives on the rumor itself — never feed this a rumor that didn’t come through the stream verifier.

seal_control_edition

Seal a signed-by-author_keys edition rumor into a control-plane wrap. Local-keys convenience; bunker accounts use stream::seal_content + their remote signer + stream::wrap_seal for identical wire output.

validate_channel_metadata

validate_community_metadata

Enforce the protocol byte caps before an edition is built (a strict reader may drop over-cap state; never publish what peers would refuse).