# WAX-SEAL W3 — entry points, sealed dispatch, two-node int (todlando, 2026-08-23)

Lane: `build/wax-seal-w3` off `8079987a` (the W2 delivering commit), worktree
`.worktrees/wax-seal-w1` (kept per dispatch), pool re-claimed label `wax-seal-w3`.
Dispatch of record: doyle 2026-08-23 (drain file, quoted verbatim below in scope).
W2 gate runs IN PARALLEL — findings arrive as rebase notes; expect possible rebase.

## Scope (doyle's five points, verbatim intent)

1. **`spt seal mint`** — decision-seal entry point: text on stdin → ceremony (the W2
   `Brain::seal_ceremony` seam) → token printed. Refusals ride through from the seam
   (no-surface, cap, UTF-8, throttle) — the CLI never re-words a refusal it did not decide.
2. **`spt send <id> --seal [--subnet <name>]`** — sealed dispatch: ceremony over the EXACT
   bytes that will be delivered (ONE buffer end to end, never re-read or re-encoded between
   ceremony and delivery; unit pins ceremony-buffer == delivered-buffer identity). Overlay
   additionally shows the DESTINATION ID (design-of-record; the W2 overlay named only the
   subnet — this is an overlay change too: destination line when present).
3. **Binding-subnet default (ruling 5 + Q8)**: minter endpoint's ANCHOR subnet; on sealed
   dispatch where the destination does not share the anchor → the LEXICOGRAPHICALLY-FIRST
   subnet shared by both endpoints; `--subnet` overrides; NO shared subnet → named refusal
   (never fall back to a subnet the receiver cannot verify in). Overlay always names the
   chosen subnet (W2 already renders it).
4. **Seal envelope attribute**: token rides as a SENDER-AUTHORED envelope attribute (like
   `json=`, collision-proof). MUST ride end-to-end: verify it is NOT caught by the
   receiver-composed attribute strip CLASS (trust-warning/mnemonics-json, CONTEXT.md:960)
   — sender-authored attrs are a different class. Unit: sealed message arrives with attr
   intact + receiver-side rendering surfaces it in the EVENT envelope.
5. **TWO-NODE INT LEG + int activation**: (a) seal minted on node A answers describe AND
   content-bound verify on member node B — activates the INT stage of
   REQ-SEAL-STORE-REPLICATES-SUBNET-SCOPED in this lane; (b) sealed send delivering
   cross-node with the attr intact — int for REQ-SEAL-ENVELOPE-ATTR. Twohost-pattern rig;
   READ GATE-TEST-INDEX twohost entries before authoring ([twohost window discipline],
   [two-daemon one-box], [isolated home/socket]).

## REQs to mint in-lane (registry-first, before satisfying)

REQ-SEAL-MINT-VERB · REQ-SEAL-SEND-SEALED · REQ-SEAL-SUBNET-BINDING-DEFAULT ·
REQ-SEAL-ENVELOPE-ATTR — doc/impl/unit active; int where the leg lands per point 5
(ENVELOPE-ATTR gets int; STORE-REPLICATES gets its int ACTIVATED, REQ already exists).
House form per the W2 block (banner + single-line title + Gate: clause + activation comment).

## KH sweep BEFORE shaping (dispatch-ordered)

- Envelope attr seams: find the receiver-composed attribute STRIP sites (trust-warning /
  mnemonics-json class, CONTEXT.md:960) and establish the sender-authored class boundary.
- KH 7.5: the token (and any envelope attribute carrying it) is NEVER an authorization
  subject — verify is the only evidence. No consumer may branch authority on the attr.
- REQ-HAZARD-ID-CHARSET: attr name/value grammar — the token alphabet vs attr charset.

## Recon needed post-clear (W2 seam knowledge carries; send path does not)

- `spt send` CLI path + envelope attribute grammar (`json=` precedent): where attrs are
  authored sender-side, where the strip class runs receiver-side, where EVENT envelope
  renders. Grep `json=` and CONTEXT.md:960 region first.
- Anchor-subnet resolution helpers (endpoint anchor; shared-subnet set for two endpoints —
  likely SubnetStore + registry membership; the lexicographic tie rule is NEW code).
- Existing twohost rig entry points (crates/spt-daemon/tests/twohost.rs) for the int leg.
- `spt seal` CLI verb family (W1's api/seal.rs) for the mint verb's home + refusal style.

## Task order

T0 registry mints → T1 `spt seal mint` (stdin → seal_ceremony → token; refusal
passthrough; exit contract mirroring W1 verify: 0 iff admitted) → T2 subnet-binding
default resolver (pure fn + unit table: anchor / shared-lex-first / override / no-shared
named refusal) → T3 sealed dispatch (`spt send --seal`: one-buffer discipline, ceremony
w/ destination on overlay, attr authored, delivery) → T4 attr end-to-end (strip-class
proof + EVENT envelope rendering + units) → T5 twohost int leg (replication describe/verify
+ sealed cross-node send) + int activations → T6 clippy + treqs + env-scrubbed workspace
nextest, captures W3_*.raw/.exit, report to doyle (conditions named separately).

## Standing cautions carried from W2 (cost paid already — do not re-pay)

- Full sweeps: env-scrub OWL_SESSION_ID/SPT_AGENT_ID/SPT_ENDPOINT_ID or the two
  daemon-stop e2e rigs red (documented live-agent class, delta-proven in W2).
- Each full sweep leaks ~4 rig daemons from the worktree's target/debug/spt.exe that PIN
  the exe (next build fails os error 5) — census by exact path, reap by path (never image
  name), installed fleet untouched.
- nextest never bare cargo; prebuild translate_proof_fixture + post_step_fixture in a cold
  pool; exits from .exit files never pipes; pool verbs judged by the verdict token up top.
- W2 gate findings may arrive mid-lane as rebase notes — rebase onto the amended W2, then
  re-run the affected legs (rebase fidelity = the lane's own diff).