04 · Join approval, index assignment and signed roster

Starting state

Token-proven pending peer connected while admission is open; organizer reachable directly or through admitted relays.

Ordered events

1. Joiner → Relay

   Signed join carries source key, name and token

2. Relay → Organizer

   Forward authorized admission request

3. Organizer → Organizer

   User approves peer; allocate unused roster index

4. Organizer → Relay

   Publish signed increasing roster version

5. Relay → Joiner

   Forward roster and apply identity/index checks

Fields and messages

join key/name/token and common source/seq; roster version/open/name/members; each member id/key/name/index.

Authorization and invariants

Join signature key hash equals source; organizer alone signs authoritative roster; duplicate identity/index or missing organizer index 0 fails. Pending links never receive source keys.

Timers

Unadmitted join retries once per second; direct ping/pong continues while waiting.

Resource lifetime

Pending approval is ephemeral; approved index remains stable for the sealed ride; roster version increases only under organizer authority.

What the rider sees

Organizer sees pending rider; joiner changes from awaiting approval to approved lobby state.

Failure branches

Organizer departure prevents later approvals; capacity 12/duplicate approval fails; a delayed earlier roster cannot replace newer state.

Resulting state

Approved rider receives stable unique index; all reachable participants learn a newer organizer-signed roster.

Evidence boundary

Production relayed-admission and protocol tests; native UI approval boundary covered by UI contract.