Changeset 69bd747 in Klonkt for src/services/guardianship/handshake.js

Timestamp:

08/03/2026 06:26:57 AM (5 weeks ago)

Author:

Bart <bart@…>

Branches:

main

Children:

30d0e2c

Parents:

5327324

Message:

§4.2 bijgewerkt: wie wat te horen krijgt is niet voor iedereen hetzelfde

De herziene §4.2 maakt twee dingen expliciet die de implementatie van vanmiddag
verkeerd deed.

Eén: de kandidaat krijgt een KALE Reject. Commit is de laatste stap van §3.1,
dus een weigering die zichzelf als technisch aankondigt verklapt meteen dat alle
menselijke partijen al hadden geaccepteerd en alleen het protocol nog bezwaar
maakte. Bij een betwiste guardianship is dat precies wat een partij niet hoort
te weten. De ward en de bestaande guardians krijgen de reden wél: zij zijn
partij, de toestand komt uit publieke data (§2.1), en een stille void laat een
ward geloven dat een adoptie doorging die niet doorging.

Twee: dezelfde controle draait nu ook als de Offer binnenkomt. Daar heeft nog
niemand geaccepteerd, dus daar mag de reden gewoon mee — en een kandidaat die
alleen maar verkeerd geconfigureerd staat komt daar achter op het moment dat
dat nog alles is wat het betekent. De controle bij commit blijft verplicht als
vangnet voor wie tussendoor van toestand verandert.

Co-Authored-By: Claude Opus 5 <claude@…>

File:

• src/services/guardianship/handshake.js (modified) (3 diffs)

src/services/guardianship/handshake.js

@@ -168 +168 @@
       reason: 'not_a_teapot', candidate: offer.candidate_uri,
     });
-    return { done: null, refused: 'not_a_teapot' };
+    return { done: null, refused: 'not_a_teapot', offer };
   }
 
@@ -352 +352 @@
   offers.recordAccept(site.slug, offerId, me);
   await fanout(site, others, { id: `${me}/answers/${Date.now().toString(36)}`, type: 'Accept', actor: me, to: others, object: offerId });
-  const { done, refused } = await maybeCommit(site.slug, offerId);
+  const { done, refused, offer: voided } = await maybeCommit(site.slug, offerId);
   if (refused) {
-    // §4.2: the refusal travels as a `Reject` of the Offer, from whoever was
-    // about to commit — the same voice that just sent the Accept. A `Reject`
-    // is what §3 already understands, so a server that has never heard of §4
-    // still voids its copy correctly; the marker only adds the reason.
-    await fanout(site, others, {
+    // §4.2: the refusal travels as a `Reject` of the Offer (§3.2), which an
+    // implementation unaware of §4 still handles correctly. Who is told WHY is
+    // not uniform, and deliberately so.
+    const answer = (to, withReason) => ({
       id: `${me}/answers/${Date.now().toString(36)}`,
-      type: 'Reject', actor: me, to: others, object: offerId, 'shaer:notATeapot': true,
+      type: 'Reject', actor: me, to, object: offerId,
+      ...(withReason ? { 'shaer:notATeapot': true } : {}),
     });
+    const candidate = voided && voided.candidate_uri;
+    // The ward and its existing guardians MUST learn the reason: they are
+    // parties, the condition is public data (§2.1), and a bare void would
+    // leave a ward believing an adoption completed that did not.
+    const family = others.filter((u) => u !== candidate);
+    if (family.length) await fanout(site, family, answer(family, true));
+    // The candidate gets a BARE Reject. Commit is the last step of §3.1, so a
+    // refusal that names itself technical also discloses that every human
+    // party already accepted and only the protocol objected — which, where a
+    // guardianship is contested, is not theirs to learn. The kind path for an
+    // merely misconfigured candidate is the check on the Offer, before anyone
+    // has consented to anything.
+    if (candidate && others.includes(candidate)) await fanout(site, [candidate], answer([candidate], false));
     return { status: 202, id: offerId, url: offerId, committed: false, refused };
   }
@@ -460 +473 @@
     const existing = recipients.filter((u) => u !== rel.ward);
     if (rel.ward !== me && !existing.includes(me)) return false;
+    // §4.2: check the candidate here too, and refuse before anyone accepts.
+    // At this point no party has consented, so saying why discloses nothing
+    // about anyone's position, and a candidate that is merely misconfigured
+    // can find that out and fix it. The commit-time check stays REQUIRED as
+    // the backstop for a candidate whose state changes in between.
+    if (await candidateFitness(rel.candidate) === 'malformed') {
+      notify(site.slug, { kind: 'offer_refused', offer: idOf(activity), reason: 'not_a_teapot', candidate: rel.candidate });
+      await fanout(site, [rel.candidate], {
+        id: `${me}/answers/${Date.now().toString(36)}`,
+        type: 'Reject', actor: me, to: [rel.candidate], object: idOf(activity), 'shaer:notATeapot': true,
+      });
+      return true;
+    }
     offers.start(site.slug, {
       offerId: idOf(activity), ward: rel.ward, candidate: rel.candidate, existingGuardians: existing,