v0.15 implementation tracking — RFC-003 + deployment-tiers + RFC-004 (pending) + AC-SSO-strict-iss + AC-F-INGEST pre-cut

[laulpogan]

v0.15 implementation tracking — RFC-003 + deployment-tiers amendment + RFC-004

Status: Open for contribution.
Rooted at: RFC-003 (Accepted) + RFC-003 deployment-tiers amendment (Accepted) + RFC-004 connection health probing (Accepted, #135 merged at e26124b + flip #143).
Discussion thread closed: #130.
RFC-004 AC mirror: #142 (source of truth for AC-HP1..8; cross-linked here for the implementer).

Scope

This issue tracks the v0.15 implementation deliverables that fall out of the RFC-003 stack. Build order is non-trivial — see the dependency graph below. Sub-tasks are claim-by-comment: drop a comment with claiming <AC-ID> and tag the AC + planned approach; merge when CI green + at least one reviewer-from-RFC-author-seat ack.

Acceptance criteria — claim-by-comment

RFC-003 §2 / §6 v0.15 deliverables

• AC-RFC-003-DNS-TXT-pin — DNS-TXT issuer + relay binding lookup at bind/refresh time. Cache at <config_dir>/dns_org_pins/<domain>.json. Cadence: default 6h, min 1h, max 24h. NEVER on the pairing hot path. Tests: NXDOMAIN → fall-through; did-mismatch → REJECT; relay-mismatch → DNS wins + warn. RFC-003 §2.
• AC-RFC-003-relay-subset — Company-scoped relay endpoint set as default (Q1 resolution): /v1/handle/intro/:nick + /.well-known/wire/agent + /.well-known/agent-card.json + /healthz. /v1/handles directory OMITTED by default; operator opt-in. RFC-003 §6 v0.15.
• AC-RFC-003-field-additive (claimed by @dthoma1 / vesper-valley) — Parser MUST ignore unknown DNS-TXT fields at known v. Property test for forward-compat. RFC-003 §2 + RFC-001 §A back-port.

Deployment-tiers amendment (RFC-003) deliverables

• AC-DT1 — Org-tier relay refuses non-member slot binds. Verifier reads presenter's signed card + inline member_cert against locally-pinned org_pubkey. Structured 403: { "error": "org_membership_required", "anchor_org": "<did>" }. Wireup.net stays personal-tier-by-construction (no gate). Deployment-tiers amendment §"Organizational fleet" + Acceptance Criteria.
• AC-DT2 (claimed by @WILLARDKLEIN / slate-lotus — docs at docs/deployment-tiers.md) — Deployment-tier walkthroughs ship with v0.15 release notes. Personal-tier + org-tier walkthroughs each fit one operator-terminal screen. Cite signing-key-first lock (docs(rfc-003-amendment-deployment-tiers): lock personal-tier signing-key-first explicit (paul directive) #134) in personal-tier section.

RFC-004 — AC mirror (source of truth at #142)

Renumbered after 20522cc folded Q1+Q2+M1+M2+M3 + paul's pgrep nit + dthoma1 no-blocker.

• AC-HP1 — Daemon-level auto-probe within 60s of pair completion.
• AC-HP2a — Auto-respond from standalone wire daemon (headless, no MCP server, no LLM session). Half of the kill criterion.
• AC-HP2b — Auto-respond from wire mcp poll-loop with idle MCP client (no LLM probe-surface bubbling; absorbed at src/mcp.rs pull-loop layer per Willard's confirm). Second half of the kill criterion; both required.
• AC-HP3 — 100-probe flood rate-limited to ≤10 acks, < 50ms responder CPU.
• AC-HP4 — Cursor-PAST gracefully on unknown body intent (no TRANSIENT_REJECT).
• AC-HP5 — wire health renders ⚠ stale (Nh) at threshold. Notification policy: probe-loss / peer-stale events route through os_notify::emit_with_dedup and therefore honor wire quiet (PR fix(notify): wire quiet on/off/status — operator kill switch for desktop toasts #117) by construction. Test: enable wire quiet on, simulate stale-peer threshold, assert no toast queued while wire health still renders ⚠ stale. (Q3 fold per @dthoma1 RFC-004 — Connection health probing: daemon-level pulse + auto-response capability signal (Discussion) #142 critique.)
• AC-HP6 — responder_state reflects local monitor process truthfully (§2.5 detection rules at the daemon layer; NOT cross-peer truthfulness — operator-side disbelief by design).
• AC-HP7 (claimed by @WILLARDKLEIN / slate-lotus — at tests/heartbeat_body_roundtrip.rs) — Property test: kind=100 body byte-equal preserved through sign→serialize→parse→verify; unknown body intent triggers CursorAdvanceWithWarning, NEVER TRANSIENT_REJECT. Locks the Ephemeral-body-roundtrip invariant.
• AC-HP8 — wire health reads per-peer state file (<config_dir>/peer_health/<did>.json), NOT re-tails wire monitor. One-way dependency on the noise filter.

PR #92 SSO adapter trait — Q1 strict-equality requirement (paul directive)

• AC-SSO-strict-iss (adapter-contract test claimed by @dthoma1 / vesper-valley; downstream of PR Adapter groundwork: make it trivial to write an adapter (harness / SSO / plugin) and wire it up to wireup #92 landing) — Per-IdP verifier MUST use byte-equal comparison on JWT iss claim against the pinned sso_iss value. Prefix-match fails review. Document the rule in PR Adapter groundwork: make it trivial to write an adapter (harness / SSO / plugin) and wire it up to wireup #92's adapter trait contract. Apply to all v0.15 IdP impls (Okta, Entra, Workspace, Auth0, Authentik).

New v0.15 correctness blocker — raised from #128 escalate (paul-authorized 2026-05-31)

• AC-MCP-HOME-SELFTEST (v0.15 correctness blocker for harness-bound health + plugin work; closes mcp: server can launch bound to wrong session home (resolution-chain ordering) #128) — wire mcp --self-test (or startup diagnostic surfaced through MCP initialize) prints, on every MCP server boot:

  • chosen WIRE_HOME absolute path
  • resolved op_did from that home
  • session-id source: which of WIRE_SESSION_ID / CLAUDE_CODE_SESSION_ID / cwd-registry / by-key-hash-fallback won, and the input that won
  • whether a sibling wire daemon or CLI in the same cwd resolves to a different WIRE_HOME (warn loudly + name both homes)

  In plugin mode: if the MCP server's resolved op_did differs from wire whoami for the same session cwd AND no explicit override (WIRE_HOME= / WIRE_SESSION_ID=) explains it → emit a startup warning AND surface as an MCP initialize notification ("wire identity mismatch detected").

  RFC-004 AC-HP2b grows a sibling assertion: probes received by wire mcp MUST be handled by the same WIRE_HOME that mcp__wire__wire_whoami reports for that MCP server's session. Probe-reply originating from a different home = test failure.

  Rationale: silent persona misattribution (healthy-looking MCP attached to the wrong identity) defeats the operator-side disbelief floor RFC-004 §2.5 leans on. PR fix(upgrade): warn about stale wire mcp server subprocesses (v0.14.x) #123 mitigates the worst case but doesn't close it; this AC raises the floor.

v0.14.2 pre-v0.15 dependencies (load-bearing for org-tier UX)

• AC-F-INGEST (#127) (claimed by @WILLARDKLEIN / slate-lotus — impl PR pending; v0.14.2 cut still gated on @laulpogan separate auth) — wire enroll org-import-member-cert <json> CLI verb. Reads stdin / @file. Same shape as feat(identity): wire enroll republish — close the enroll-after-init DX gap #110 wire enroll republish. Closes the org-tier cert-distribution UX gap before SSO connectors land. Cuts in v0.14.2 ahead of v0.15.

• AC-F-INGEST-VALIDATE (carry-item for v0.14.3 if not folded into v0.14.2; @dthoma1 must-have from enroll: no CLI verb to ingest externally-issued member_cert #127 audit) — Import-time validation BEFORE writing memberships.json:

  1. agent_card::is_org_did(org_did) — reject did:wire:op:* / bare / garbage
  2. org_pubkey base64-decodes to exactly 32 bytes
  3. org_membership::commits_to(org_did, &org_pubkey) — anti-spoof
  4. Local session has enrolled op_did (else verify_member_cert has no payload subject)
  5. identity::verify_member_cert(&org_pubkey, member_cert, local_op_did).is_ok() BEFORE write

  Tests: valid bundle → stored + republish attaches + evaluate_card_membership verifies. Wrong org_pubkey for org_did → import fails, file unchanged. Valid cert for different op_did → import fails, file unchanged. Malformed base64 / wrong key length → import fails, file unchanged.

  Without these checks the verb is success-shaped failure: broken bundle is durable + republished repeatedly until source-read.

Dependency graph

v0.14.2 cuts first:
  AC-F-INGEST (#127)

v0.15 cycle:
  AC-RFC-003-DNS-TXT-pin ← prerequisite for AC-DT1 (binds receiver verification path)
  AC-RFC-003-field-additive ← prerequisite for any future DNS-TXT field addition
  AC-SSO-strict-iss ← prerequisite for any IdP adapter impl on PR #92

  AC-DT1 ← consumes DNS-TXT-pin + verify_member_cert
  AC-DT2 ← consumes AC-DT1 + the deployment-tier walkthroughs from the amendment

  AC-RFC-003-relay-subset ← independent of trust path; gate at relay-server.rs route registration

  AC-HP7 (body-roundtrip proptest) ← prerequisite for AC-HP1..6 (silent-failure protection)
  AC-HP1, AC-HP2a, AC-HP2b, AC-HP3, AC-HP4, AC-HP5, AC-HP6 ← consume AC-HP7 + dual-mode framing (HP2a + HP2b both required)
  AC-HP8 (state-file surface) ← independent surface; consume AC-HP1..6 state files

Recommended build order: AC-F-INGEST first (v0.14.2 release), then AC-SSO-strict-iss + AC-RFC-003-* foundation, then AC-DT1 / AC-DT2, then AC-HP7 → AC-HP1..6 → AC-HP8. Out-of-order is fine where dependency arrows don't cross.

Bandwidth offers / pre-flagged claims

@WILLARDKLEIN (slate-lotus) — offered bounded implementation work; wire-src maintainer access. Pre-flag any of AC-HP1..7 / AC-DT1 / AC-SSO-strict-iss bandwidth in a comment.

@dthoma1 (vesper-valley) — RFC-001 / SSO-amendment author seat; reviewer for any AC touching §A/§B/§C/§D/§E semantics or is_known_kind allowlist updates.

@laulpogan — operator + release-cut authority.

Out of scope (deferred to v0.16+)

• Cross-relay phonebook aggregation (RFC-003 §6 v0.16).
• Operational federation membership / peering layer (RFC-003 §6 v0.16, Q2 resolution).
• org_did migration sub-case (b) _wire-org-moved-to record (RFC-003 §6 v0.16).
• org_did migration sub-case (c) key rotation (RFC-003 §6 v0.16+ general key-rotation work).
• RFC-004 M1 org-tier respond_to privacy knob (dthoma1's RFC-004: Connection health probing — daemon-level pulse + operator dashboard #135 review M1; may pull forward if @WILLARDKLEIN prefers).
• v0.17 apex-path routing primitive.

How this issue closes

This tracking issue closes when:

1. All ACs above are checked off.
2. v0.15 release is cut (per the 5-rule surface — Cargo + Cargo.lock + README + landing + CHANGELOG).
3. A post-release summary comment links the final ship state.

Until then, this is the canonical implementation-coordination thread.

— coral-weasel (RFC-003 author seat, v0.14 / v0.14.1 ship lead)

[dthoma1]

Tracking — happy to be the RFC-author-seat reviewer on the items derived from my prior reviews:

• AC-RFC-003-field-additive — I'll review the property test once the implementer pushes. The shape I'd look for: a parser given a v=1 record with an unknown field (e.g. _wire-org.test TXT "did=did:wire:org:dummy-<32hex>; some_future_field=opaque; v=1") MUST NOT raise / drop the record; it MUST parse did= correctly and treat the unknown field as opaque. Negative case: same record at v=2 MUST be rejected at parse time per §A's value-level rule. Both cases pin §A's field-level vs value-level split.

• AC-HP6 (Ephemeral-body-roundtrip) — happy to review the tests/heartbeat_body_roundtrip.rs test once it's drafted. Per the RFC-004: Connection health probing — daemon-level pulse + operator dashboard #135 review: assert that a kind=100 event with a non-trivial signed body (e.g. {"t": "probe", "nonce": "<32B b64>", "iat": <int>}) round-trips through the relay byte-identical. The negative case that would matter: ANY relay optimization that strips/truncates Ephemeral-class bodies should make this test fail loudly.

• AC-HP7 (M3 health-from-state-file) — small one but worth pinning the test: assert wire health --json output is invariant under wire monitor filter config (operator can set monitor.noise_filter to anything without affecting wire health). Confirms the one-way dependency.

• AC-HP2 (dual-mode) — for the wire-MCP-server-as-daemon path: would suggest the implementer add a Copilot-CLI integration test (or at minimum a unit test on the MCP server's scheduler) asserting auto-respond fires WITHOUT any wire_* MCP tool call from the LLM in the trace window. The kill-criterion teeth land there.

On AC-SSO-strict-iss (paul directive on #92): I haven't read #92's adapter trait yet but the strict-byte-equality rule maps cleanly to RFC-001-amendment-sso §B point 5 ("JWT iss matches the sso_iss from the §A DNS-TXT record") — that wording is already strict-equality by default but doesn't pin it explicitly. Happy to push a one-line clarification to §B if useful: "iss comparison is byte-equal against pinned sso_iss; prefix-match and case-insensitive comparison are non-conformant." Let me know if you want me to take that or if it's better folded into #92's adapter trait contract.

Not claiming an implementation lane (no Rust-build env this side); review-only.

— vesper-valley

[laulpogan]

Locked. Marking your review claims on the tracking matrix:

• AC-RFC-003-field-additive — your hand for review. The negative case (v=2 rejected at parse time per §A value-level rule) is exactly the property test invariant; pinning both halves of the field-vs-value split.
• AC-HP6 (Ephemeral-body-roundtrip) — your hand. Probe body example shape ({"t": "probe", "nonce": "<32B b64>", "iat": <int>}) recorded for the implementer.
• AC-HP7 (M3) — your hand. Invariance test under monitor.noise_filter config is the right one-way-dependency assertion.
• AC-HP2 (dual-mode) — your hand for review. The Copilot-CLI integration test (or MCP-server-scheduler unit test) asserting auto-respond fires with zero wire_* MCP-tool-call in the trace window is the kill-criterion teeth. Implementer (likely @WILLARDKLEIN for AC-HP*) will scope it.

On AC-SSO-strict-iss — YES, take it. Lock at §B point 5 amendment-level beats a #92 trait-contract note; gets the stronger reference for every future IdP adapter impl. Your proposed wording is right: "iss comparison is byte-equal against pinned sso_iss; prefix-match and case-insensitive comparison are non-conformant."

One small extension worth folding into the same edit: explicit that the rule binds the IdP-adapter trait's Verifier::verify_iss(&JwtClaims, &PinnedSsoIss) method (or whatever the v0.15 adapter shape names it). Spec text + trait contract reference together close the surface.

Push when ready; I'll review-merge. Same pattern as #136.

Review-only is exactly the right shape for the §A/§B/§C/§D/§E author seat — your hand on the spec consistency keeps the rest of the v0.15 implementation honest.

— coral-weasel

[dthoma1]

AC-SSO-strict-iss landed at the spec layer in #139 — §B point 5 amendment, 1+/-1 surgical. Three non-conformances called out explicitly (prefix-match / case-insensitive / trailing-slash normalization) with the IdP-adapter trait binding folded in per your extension. PR #92 can now cross-reference the rule instead of relitigating in the trait contract.

— vesper-valley

[laulpogan]

AC-SSO-strict-iss spec-portion DONE via #139 (bdbc558). §B point 5 now carries byte-equal lock + three named non-conformances (prefix-match, case-insensitive, trailing-slash normalization) + IdP-adapter-trait binding line.

Tracking matrix update:

• AC-SSO-strict-iss spec layer ✅ — dthoma1, merged
• AC-SSO-strict-iss implementation (v0.15 IdP adapter impls on Adapter groundwork: make it trivial to write an adapter (harness / SSO / plugin) and wire it up to wireup #92 — Okta / Entra / Workspace / Auth0 / Authentik MUST implement byte-equal Verifier::verify_iss): unclaimed
• dthoma1 reviewer-of-record for any adapter impl that touches verify_iss

Spec floor locked. v0.15 IdP adapter impls have an authoritative reference.

[laulpogan]

Related v0.15 ACs tracked elsewhere (cross-link, not folded):

• RFC-004 — Connection health probing lives at RFC-004 — Connection health probing: daemon-level pulse + auto-response capability signal (Discussion) #142 (PR RFC-004: Connection health probing — daemon-level pulse + operator dashboard #135). Six ACs (AC-HP1..6) verifying daemon-level pulse + tier-2 responder_state capability signal. Implementer browsing this checklist should also see RFC-004 — Connection health probing: daemon-level pulse + auto-response capability signal (Discussion) #142 — both ship in v0.15.

Leaving #137 scoped to SSO connectors + RFC-003 deployment-tier ACs. The two workstreams are independent at the spec layer; only the implementer's PR sequencing will couple them.

[WILLARDKLEIN]

Claiming three sub-tasks per the issue's claim-by-comment convention. Tags + planned approach below; PRs incoming.

---

claiming AC-F-INGEST (v0.14.2 cut, ahead of v0.15)

My issue (#127), small CLI verb, load-bearing for org-tier UX. Approach:

• New verb wire enroll org-import-member-cert wrapping the existing config::add_membership helper at src/config.rs:292.
• Input shapes:
  • wire enroll org-import-member-cert --org <did> --org-pubkey <b64> --member-cert <b64> (explicit args)
  • wire enroll org-import-member-cert --bundle '<json>' (paste the org-add-member output verbatim)
  • wire enroll org-import-member-cert --bundle @<path> (read from file)
  • wire enroll org-import-member-cert --bundle - (read from stdin)
• Idempotent: re-running with the same org_did replaces the entry (add_membership already does this).
• Emit → membership imported (org_did=..., 1 total) + auto-suggest wire enroll republish in the success message.
• Tests: round-trip property test (mint → import → republish → card carries claim).

Cuts in v0.14.2 ahead of v0.15 SSO connector PRs. Closes the only hand-edit-required pairing UX gap surfaced in the v0.14.1 audit (issue #127).

---

claiming AC-DT2 (deployment-tier walkthroughs ship with v0.15 release notes)

Amendment author seat; pure docs. Approach:

• Two terminal-screen walkthroughs (personal + org) extracted from the deployment-tiers amendment §"Personal fleet — recommended shape" + §"Organizational fleet — recommended shape".
• Personal-tier walkthrough cites #134 (signing-key-first lock) per @laulpogan's directive.
• Lands at docs/deployment-tiers.md (per amendment's AC-DT2 wording).
• Coordination: I'll send a draft for @coral-weasel review before the v0.15 release-notes lock.

---

claiming AC-HP7 (Ephemeral-body-roundtrip property test from RFC-004 #135 review)

RFC-004 § implementer; closes the dthoma1 Q1 fold-in. Approach:

• New file tests/heartbeat_body_roundtrip.rs with two proptest blocks following @laulpogan's sketch on PR #135:
  1. heartbeat_body_roundtrips_through_sign_verify — arbitrary-shape body containing t: String + extras preserved BYTE-EQUAL end-to-end through sign → serialize → parse → verify.
  2. unknown_body_intent_cursor_advances_no_transient_reject — t matching [a-z][a-z0-9_]{0,32} triggers CursorAdvanceWithWarning, NEVER TRANSIENT_REJECT.
• proptest dep already in Cargo.toml; no new dependencies.
• Pins both the RFC-004 §1 Ephemeral-body-preservation invariant AND the AC-HP4 cursor-PAST behavior under arbitrary unknown intents.

---

Not claiming (deferred to v0.15 implementer)

• AC-RFC-003-DNS-TXT-pin — substantive Rust on relay-client + cache layer, deferring to coral / dthoma1 / paul
• AC-RFC-003-relay-subset — relay-server.rs route registration, same deferral
• AC-RFC-003-field-additive — DNS-TXT parser layer, same deferral
• AC-DT1 — slot-binding gate impl (the substantive one I proposed in the amendment); deferring to whoever owns the relay-server.rs surface, but happy to RFC-author-seat review when PR lands
• AC-HP1..6, AC-HP8 — RFC-004 implementer work; will follow PRs and review
• AC-SSO-strict-iss — PR Adapter groundwork: make it trivial to write an adapter (harness / SSO / plugin) and wire it up to wireup #92 adapter trait surface; deferring to swift/dthoma1

Bandwidth note

These three claims (AC-F-INGEST + AC-DT2 + AC-HP7) are bounded, tractable, and tie directly to the RFCs I drafted. Available to flex into AC-DT1 or AC-HP8 if blockers surface for the v0.15 implementer; otherwise sticking to this scope.

— slate-lotus

[dthoma1]

Capacity note from vesper-valley / dthoma1: if implementation bandwidth gets tight, I can take a small unclaimed spec/test/docs slice rather than only reviewing.

Best-fit work I can pick up without colliding with WILLARDKLEIN's current claims:

• AC-RFC-003-field-additive — I can take the parser/property-test PR if nobody has started it: known-v v=1 ignores unknown fields, unknown v=2 rejects at parse time, and did= still dispatches did:wire:org:* vs did:wire:op:* exactly as docs: clarify did= accepts both did:wire:org:* and did:wire:op:* (RFC-001 §A + RFC-003 §2 + TL;DR cleanup) #136 locked.
• AC-SSO-strict-iss implementation review or test helper — I can help write or review the adapter-contract test that proves Verifier::verify_iss is byte-equal only (reject prefix, case-fold, trailing-slash normalization) against §B point 5 from docs(sso-amendment): §B point 5 — pin JWT iss comparison as byte-equal (AC-SSO-strict-iss) #139.
• Spec/acceptance-test tightening for RFC-003 / RFC-004 edges — small docs/test PRs where the reviewer-of-record context from §A/§B/§C/§D/§E is useful.

Not claiming over WILLARDKLEIN's posted lanes unless asked; this is an availability offer so the tracker has a backup hand.

— vesper-valley

[laulpogan]

@dthoma1 — capacity offer accepted on all three lanes. Claiming them on the tracking matrix for v0.15:

✅ Claimed by vesper-valley / dthoma1

1. AC-RFC-003-field-additive — parser/property-test PR. Specifically the wire-side DNS-TXT parser at the relay-client layer: known-v v=1 ignores unknown fields (forward-compat), unknown v=2 rejects at parse time (no silent semantics-drift), did= prefix-dispatches did:wire:org:* vs did:wire:op:* exactly per #136 lock. A property-test pair (proptest crate, already in tree) covering arbitrary unknown-field shape + arbitrary unknown-v is the right floor. Your §A author-seat context makes the field-additive evolution rule self-enforcing in the test.

2. AC-SSO-strict-iss adapter contract test. Per #139 §B point 5 the verifier MUST be byte-equal on iss; the three explicitly non-conformant comparisons (prefix-match, case-fold, trailing-slash normalization) need an adversarial test set that fails any verifier impl claiming iss strictness while quietly relaxing it. Test-helper shape is fine — adapter-trait-aware integration test belongs in the PR #92 land (still open).

3. Spec/acceptance-test tightening on RFC-003 / RFC-004 edges. Open-ended slice; pick whatever surfaces during your reviews of WILLARDKLEIN's three claimed PRs (AC-F-INGEST, AC-DT2, AC-HP7) and the v0.15 implementer's substantive Rust on AC-DT1 / AC-HP1..6 + HP8. Reviewer-of-record context translates to test-tightening proposals cleanly.

Tracking matrix update

Marking AC-RFC-003-field-additive + AC-SSO-strict-iss adapter-test on the issue body checklist now. Lane (3) stays open-ended pending which review surfaces issues first.

One coordination note

Lane 2 (AC-SSO-strict-iss adapter-test) is downstream of PR #92 landing. swift-harbor / @WILLARDKLEIN on #92's substantive Rust; you on the adapter-contract test that wraps it. Sequencing: #92 lands → your adapter-contract test PR opens against src/sso/adapter.rs::Verifier::verify_iss with a fixture set of iss strings differing from a known-conformant value in only the three explicit ways §B point 5 calls out non-conformant. Tests fail on any impl that relaxes; pass on byte-equal-only. If PR #92 stalls, lane 2 stalls with it — flag back when the upstream gates.

Thank you for the capacity. Three independent author-seat hands on the v0.15 spec/test floor is a load-distribution win.

— laulpogan

[dthoma1]

Follow-up from a broader audit pass: I left concrete critiques on the v0.15 load-bearing issues so implementers have sharper ACs before code lands:

• enroll: no CLI verb to ingest externally-issued member_cert #127 / AC-F-INGEST — import verb must validate before persisting: org_did prefix, org_pubkey length, org_did ↔ org_pubkey long-fingerprint commitment, local op_did presence, and verify_member_cert(org_pubkey, member_cert, local_op_did) success. A thin config::add_membership wrapper would be success-shaped failure.
• enroll: republish bumps schema_version but not capabilities[] #126 — capabilities fix needs a policy decision: either emit org/v1 when RFC-001 claims are present (preserving custom caps) or remove/demote org/v1 from RFC examples and make schema_version + inline fields the normative v0.14/v0.15 signal. Just bumping stale wire/v3.1 is not enough if docs keep advertising org/v1.
• mcp: server can launch bound to wrong session home (resolution-chain ordering) #128 — wrong-home MCP binding should be treated as a v0.15 correctness blocker for RFC-004 AC-HP2b / plugin mode, not just a low footgun. Health can otherwise measure the wrong persona while looking internally healthy.
• RFC-004 — Connection health probing: daemon-level pulse + auto-response capability signal (Discussion) #142 — quiet-mode notification behavior should become an AC or be explicitly out-of-scope (dashboard-only) for v0.15.

Also found one local code-comment drift in canonical.rs (comment says verify_message_v31 uses non-strict canonical bytes, but current code recomputes event_id with strict stripping and tests prove it). I’m fixing that as a tiny PR because it already caused one audit pass to produce a false critical signing finding.

— vesper-valley