Membership & Leave Operations

Forward-only invariant — load-bearing

The apply-time membership check is a function of two things only: the signer's identity and the governance-DAG position the signer signed against. It is not a function of the receiver's current local state. This is the forward-only property: a write authored at governance position P stays valid forever, even if the receiver has since applied a MemberRemoved for the signer at a later position P' in its local DAG.

Why this matters

Without forward-only, two peers receiving the same set of ops in different orders would end up with different state:

• Peer A receives MemberRemoved first, then the pre-removal delta. If "is the signer currently a member?" gates the apply, the delta is rejected.
• Peer B receives the delta first, then MemberRemoved. The delta applies; the later removal doesn't retroactively undo it.

That divergence cascades: any subsequent delta that reads the (different) state diverges further, context root hashes drift apart, and the network has no honest convergence point. Forward-only removes the receive-order dependence: pre-removal writes always apply on every peer, regardless of when the receiver learns about the removal.

How it's implemented

Every state delta carries a governance_position field that names the governance-DAG heads the author observed at sign time. On receive, the apply path evaluates membership at the signed heads via the unified projection — which resolves the ancestry of those heads and derives the membership state from the folded projection. The resolution visits only the prefix that was already final when the delta was signed; anything causally after the signed cut (including a later MemberRemoved for this signer) is invisible to the resolution and cannot retroactively invalidate the delta.

The namespace-level applier (NamespaceGovernanceApplier in crates/context/src/governance_dag.rs) threads this cut into the apply path directly: DeltaApplier<SignedNamespaceOp>::apply calls apply_signed_namespace_op_at_cut(&delta.parents, &LIVE_FALLBACK_AUTHORIZER) rather than the cut-free apply_signed_namespace_op. Passing delta.parents as the causal cut ensures membership is evaluated at the position the author signed against. LIVE_FALLBACK_AUTHORIZER is a placeholder authorizer that delegates to the live store; membership authorization for all other paths is now handled entirely by the unified projection (EphemeralProjectionAuthorizer / ScopeProjections) — the acl_view_at, MembershipStatus, prefix_walk_membership, MembershipTransition, heads_equal, and MAX_PREFIX_WALK_NODES helpers that previously backed the live DAG-walk resolver have been deleted.

Resolving the current governance cut — ScopeProjections::namespace_current_heads

Current-state membership reads (as opposed to historical signed-position checks) need a "now" frontier: the set of parent hashes that represents the namespace's current DAG head. The static method ScopeProjections::namespace_current_heads provides this:

1. Resolves the supplied ContextGroupId to its owning namespace by walking the parent chain.
2. Reads that namespace's DAG head record from the governance store.
3. Returns the parent hashes of that head — the cut argument passed to membership_status_at (or AclView::is_member_at_cut) for a current-state query.

None return cases. The method returns None when the group cannot be resolved to a namespace (e.g. the group does not exist in the local store) or when the head record itself is unreadable. Callers must fall back to the live membership store (check_group_membership_path) in both cases rather than treating None as an empty cut — an empty cut would falsely deny all access.

Projection-derived member counts and migration cohorts. ScopeProjections::member_identities_with extends this pattern to identity-set reads: given an already-built projection fold it calls cut_ancestry_complete on the fold before reading the ACL view, and returns None if the ancestry is only partially folded (a governance-backfill race). This None propagates to get_group_info (which falls back to MembershipRepository::count + enumerate_inherited) and to collect_migration_cohort (which falls back to the live list ∪ enumerate_inherited union). The private ephemeral_view helper has been removed; the subtree ephemeral path now calls ephemeral_fold directly and performs the cut_ancestry_complete check itself before reading the view.

Ephemeral per-query projection — ScopeProjections::member_now_ephemeral

Context-layer handlers that do not hold a cached ScopeProjections instance use ScopeProjections::member_now_ephemeral to obtain a one-shot membership verdict from the governance DAG without requiring a pre-built projection. On each call it:

1. Resolves the supplied group to its owning namespace.
2. Folds the full governance DAG for that namespace via collect_namespace_ops.
3. Reads the DAG heads after the fold (not before), so a concurrent governance-op advance cannot leave the cut naming ops the fold hasn't processed.
4. Calls member_at_cut at those heads and returns the boolean verdict.

None return cases. The method returns None — never deciding against the member — when: (a) the namespace is unresolvable, (b) collect_namespace_ops reports a store fault (surfaced with a tracing::warn), or (c) the cut-completeness guard determines the recorded heads don't cover the full fold. Callers must treat None as undecidable and fall back to the live store rather than denying access.

Unified membership gate — ScopeProjections::member_now_checked

ScopeProjections::member_now_checked is the single decision point used by all context-layer membership gates (get_cascade_status, get_group_upgrade_status, list_group_contexts, list_all_groups). Its semantics:

• Projection wins when decidable. It calls member_now_ephemeral first. When the projection returns a verdict it acts on that verdict, then cross-checks MembershipRepository::is_member best-effort. A transient live error does not override a projection verdict.
• Live wins when projection is undecidable. When member_now_ephemeral returns None, member_now_checked falls back to MembershipRepository::is_member as authoritative and propagates any live error normally.
• Divergence telemetry. When the projection and live store both return definite but conflicting answers, member_now_checked emits a tracing::warn with marker=unified_projection_divergence and plane=membership-query. The projection verdict is still used as the final answer.

Direct use of MembershipRepository in get_cascade_status.rs, get_group_upgrade_status.rs, list_all_groups.rs, and list_group_contexts.rs is eliminated; those handlers now call member_now_checked exclusively and no longer import MembershipRepository.

Behavior change in list_all_groups. Previously, a membership-check error in the per-group loop would propagate and abort the entire response. Now the loop catches errors from member_now_checked with a tracing::warn and continues to the next group, silently omitting groups whose membership cannot be determined. This matches the existing skip behavior for a missing node identity and avoids a single inaccessible group blocking the whole listing.

Op-store reconstruction root — ScopeProjections::scope_root_from_op_store and shadow_compare_op_store

ScopeProjections::scope_root_from_op_store(scope_id, store) provides an independent view of a scope's governance root derived entirely from the persisted op log rather than the maintained in-memory projection:

1. Loads all ops for the given ScopeId via load_scope_ops.
2. Replays them into a fresh ScopeProjections instance (causal ordering recovered through DagStore<Op> + UnifiedApplier).
3. Returns the resulting scope_root computed with a fixed zero entities_root.

Returns Ok(None) when the scope has no persisted ops; Err on store faults. This is intended for completeness verification before C2.2b — not for hot-path membership decisions.

ScopeProjections::shadow_compare_op_store(namespace_id, store) is an observe-only companion that compares the maintained projection's scope_root against the op-store reconstruction. On mismatch it emits a tracing::warn with marker=unified_op_store_divergence and truncated hex of both roots. This log marker is the e2e gate signal for C2.2b readiness. The method silently skips (no divergence reported) when the scope is unfolded, the op-store is empty for it, or the store read fails — none of those conditions count as divergence. calimero_op / ScopeId types stay inside the context crate and are not leaked into the node crate.

Convergence root — ScopeProjections::scope_root_for and group_scope_root_ephemeral

ScopeProjections::scope_root_for(scope) computes a single SHA-256 digest over the folded state of a governance scope: SHA-256(entities_root ‖ acl_hash ‖ governance_hash). This gives callers a cheap way to detect whether two nodes have converged on the same membership/governance state without enumerating members.

• Returns None when the scope has not been folded yet (i.e. it has no entry in the projection). Callers must treat None as "cannot compare" — never as a divergence signal. False divergences from mid-backfill nodes are the main hazard here.
• ACL component is currently an empty placeholder because SetWriters ops are not yet routed through the governance DAG. The hash over ACL state will become meaningful at C2 when that routing lands.

The companion free function ScopeProjections::group_scope_root_ephemeral(group_id, store) builds an ephemeral projection from the raw store (no NodeState required), adds an ancestry-completeness guard via cut_ancestry_complete, and delegates to scope_root_for. It returns None when the governance DAG cut is not fully folded, preventing false divergence reports from nodes that are still mid-backfill. Both symbols are public API on ScopeProjections (crates/context/src/scope_projections.rs).

Behavior is pinned by scope_root_for_moves_on_hash_neutral_membership_change_and_is_none_when_unfolded: the test holds entities_root fixed, ingests an AdminChanged op then a causally-chained MemberAdded op, and asserts that scope_root_for returns different values before and after, and returns None for an unfolded scope.

Batch role resolution — ScopeProjections::member_roles_for

Where namespace_current_heads answers "is this member present?", member_roles_for answers "what role does the projection assign to each of these members?". It folds the ACL view exactly once for the supplied batch and returns a BTreeMap<PublicKey, GroupMemberRole>:

• Direct members keep their folded role from the projection.
• Inherited{via_admin:true} → Admin.
• Inherited{via_admin:false} → the member's stored role at the anchor group (mirroring live's list ∪ enumerate_inherited semantics).
• Abstain (empty map) when the ancestry is not fully folded, or when the group has no entry in view.groups (materialized-fallback parity — Restricted subgroup or undecryptable member ops). An empty return means "projection has no opinion"; callers must not treat it as "all roles are wrong".

list_group_members calls member_roles_for once for all live members after the existing identity-set shadow. Each live member's role is compared to its projected role; mismatches are emitted as unified_projection_divergence log events with plane=membership-role. Members absent from the returned map (projection abstains) are skipped — presence divergence is already owned by the identity shadow. The handler still returns the live list unchanged.

Operator note. membership-role divergence warnings in logs indicate a pre-flip validation failure. They will block the eventual flip of list_group_members from the live store to the projection as the authoritative source. Note that acl_view_at and MembershipStatus (the former live DAG-walk resolver types) are no longer available; divergence detection now operates entirely through ScopeProjections projection methods.

Full effective-member enumeration — ScopeProjections::member_entries_with

member_entries_with returns a Vec<(PublicKey, GroupMemberRole)> for every effective member of a group at the current cut, derived entirely from the already-folded auth_cut_context view. It reuses member_identities_in_view_with_ctx for the identity set and resolves each member's role via member_path_at_cut.

The method returns None (signalling: defer to the live store) in three cases:

• The cited ancestry is not yet fully folded — a partial fold could produce an incomplete member list, so the caller falls back rather than silently truncating.
• The target group has no folded direct-membership entry in the view — the projection does not cover this group yet.
• A validated identity resolves to MemberPathAtCut::None or has a missing inherited anchor row — this indicates a fold inconsistency. The method logs a unified_projection_divergence warning and abandons the entire enumeration rather than returning a partial list.

The all-or-nothing fallback contract means callers never observe a silently truncated member list: either the projection supplies the complete set or the live store is used in its entirety.

At-cut effective role — ScopeProjections::role_at_cut_for_group

ScopeProjections::role_at_cut_for_group(member, group_id, cut) resolves the effective GroupMemberRole of a member in a group at a specific governance cut. It gates on cut_ancestry_complete via auth_cut_context (returning None immediately when ancestry is incomplete) and then delegates to member_path_at_cut to handle three cases:

• Direct membership — returns the folded role from the projection (the same derivation already validated by the membership-role divergence plane).
• Inherited{via_admin:true} — always resolves to Admin, mirroring the live semantics for anchor-via-admin inheritance.
• Inherited{via_admin:false} — returns the member's stored role at the anchor group. Returns None rather than guessing when the anchor row is missing, preventing spurious divergence reports.

The method returns None — signalling "projection has no opinion, defer to live store" — in four cases: ancestry is not yet fully folded, the member is absent from the group at the cut, the auth_cut_context call cannot resolve the namespace, and the anchor row is missing for an inherited-via-anchor path. Callers must not treat None as a role denial.

Shared-context identity resolution — ScopeProjections::member_identities_in_view_with_ctx

member_identities_in_view_with_ctx accepts caller-supplied root and default_cap_base instead of re-reading MetaRepository / CapabilitiesRepository internally. member_identities_in_view delegates to it unchanged (existing callers are unaffected). member_entries_with passes the values it already obtained from auth_cut_context, ensuring the candidate-identity filter and the per-member role resolution use a single consistent store snapshot with no window for a concurrent governance write to make them disagree. Prefer member_identities_in_view_with_ctx over member_identities_in_view whenever the caller already holds the root and capability values — it avoids a redundant store read and eliminates the TOCTOU window.

Projection-first list_group_members with stable pagination

The list_group_members handler now reads from the projection authoritatively when a folded proj_ctx is available. It falls back to the live MembershipRepository::list ∪ enumerate_inherited union only when member_entries_with returns None. Previously the handler always read from the live store and compared the projection in shadow mode; the shadow scaffolding methods shadow_member_enum_with and member_roles_for have been deleted as they had no remaining callers.

Both the projection path and the live-store fallback path now apply a members.sort_by_key(|(identity, _)| *identity) sort by PublicKey before the skip(offset).take(limit) slice. The projection returns a BTreeSet-ordered (PublicKey-sorted) result while the live store returns insertion/store order; without the explicit sort, a mid-backfill request served by the projection followed by a next-page request served by the live store could skip or repeat members. The sort makes pagination order stable and path-independent across a mid-backfill transition.

member_now_checked / member_now_checked_with

ScopeProjections::member_now_checked and its shared-fold variant member_now_checked_with are the two query-gate helpers that call namespace_current_heads and then delegate to AclView::is_member_at_cut. Their behavior follows a strict two-branch contract:

• Projection returns Some — the result is acted on directly. There is no secondary MembershipRepository::is_member live read and no unified_projection_divergence cross-check. The projection verdict is authoritative when it is available.
• Projection returns None (unresolvable group or unreadable head) — fall back to the live membership store (check_group_membership_path) as before.

The earlier best-effort live cross-check (which compared the projection verdict against the live resolver and emitted a warning/error on divergence) has been removed from both functions. The None→live fallback path is preserved unchanged.

At-cut admin & capability accessors — is_admin_at_cut, is_admin_or_capability_at_cut, is_last_admin_at_cut

Five additional methods on ScopeProjections expose admin/capability checks against a historic DAG cut, mirroring what the live authorization gate does at apply time:

• auth_cut_context(group_id, cut) — shared setup used by the public accessors. Resolves the namespace for the supplied group, gates on cut_ancestry_complete (returns None immediately if the cited ancestry is not yet fully folded), builds the AclView folded to the cut, and returns the genesis root tuple plus default-capability base.
• is_admin_at_cut(signer, group_id, cut) — returns Some(true) if the signer holds an admin role at the cut, Some(false) if they do not, and None when ancestry is incomplete. Callers must defer to the live gate on None — incomplete ancestry is not equivalent to unauthorized.
• is_admin_or_capability_at_cut(signer, group_id, cut, cap_bits) — admin OR capability-bit check, mirroring the live is_authorized_with_capability. Same None semantics as above. This method is a required method on the AtCutAuthorizer trait; all implementors must provide it.
• is_last_admin_at_cut(member, group_id, cut) — answers, at the op's parent cut (pre-mutation), whether removing or demoting the given member would orphan the group's admin set. Mirrors live logic exactly: a member counts as admin if they hold a direct Admin-role row or are the genesis admin; "another admin" requires a distinct Admin-role row (the genesis admin alone does not satisfy it). Returns None when ancestry is incomplete, deferring to the live last-admin guard.
  
  Causal-position semantics. Because this method reads the DAG state the signer observed at sign time (the parent cut), not the receiver's current local state, it can legitimately disagree with a live query made after concurrent ops have advanced the DAG — this is the causal-honor property and is expected behavior, not a divergence.
• membership_path_at_cut(member, group_id, cut) — returns Some(AtCutMembershipPath) indicating whether the member has a direct row, an inherited path, or no membership at the cut, and None when ancestry is incomplete. Delegates to ScopeProjections::membership_path_at_cut, which calls member_path_at_cut on the folded projection via auth_cut_context and maps the result (projecting away the role/anchor detail). Callers must defer to the live gate on None.

All public accessors return None (not Some(false)) when cited ancestry is not fully folded, ensuring callers do not treat an incomplete fold as a denial verdict.

AtCutAuthorizer trait and implementations

The AtCutAuthorizer trait abstracts over how an at-cut admin/capability check is resolved. It declares four required methods: is_admin_at_cut, is_admin_or_capability_at_cut, is_last_admin_at_cut, and membership_path_at_cut. All return Option<…> with the same None = undecidable semantics.

Empty-cut contract. Every method on this trait must return None when the supplied parents slice is empty. Violating this contract would cause a genesis-state fold (no MemberAdded or role ops processed) to produce Some(false), falsely rejecting genesis ops that the live store correctly permits.

• LiveFallbackAuthorizer — the placeholder implementation used by the current namespace-envelope applier stage. Returns None for all four methods, delegating all decisions to the live store.
• EphemeralProjectionAuthorizer — the projection-backed implementation. Holds a Mutex<Option<(ContextGroupId, Arc<FoldedProjection>)>> cache. The private folded(group_id) method checks the cache first; on a cache miss it calls ScopeProjections::ephemeral_projection and stores the result. If the fold fails (store or DAG-head fault) it emits a tracing::warn and returns None. All four at-cut methods go through folded, so a single apply call reuses the same folded DAG rather than re-folding per check. is_last_admin_at_cut delegates to ScopeProjections::is_last_admin_at_cut and guards against an empty parents slice with an immediate None return, consistent with the trait-level empty-cut contract. membership_path_at_cut delegates to ScopeProjections::membership_path_at_cut, which calls the projection's member_path_at_cut walk via auth_cut_context and maps the result to AtCutMembershipPath (projecting away the role/anchor detail). An empty parents slice returns None immediately, consistent with the empty-cut contract.

GroupGovernanceApplier — live gates only, no authorizer injection

The standalone GroupGovernanceApplier::apply continues to call apply_local_signed_group_op (live-fallback) and does not accept an injected AtCutAuthorizer. A code comment documents why: a SignedGroupOp's parent_op_hashes belong to the per-group op log, not the namespace governance log that EphemeralProjectionAuthorizer is keyed by. Passing those hashes to the projection authorizer would resolve against the wrong id-space and silently no-op, producing a false "undecidable" verdict on every group op. The real group-auth projection shadow therefore fires only on the namespace-envelope group-op path, not through the standalone applier.

UnifiedApplier — projection-backing DeltaApplier<Op>

UnifiedApplier is the C2.0 struct that bridges DagStore<Op> and ScopeProjections. It implements DeltaApplier<Op>: its apply method acquires a write lock on the inner Arc<std::sync::RwLock<ScopeProjections>>, calls ScopeProjections::ingest_op with the delta's payload, then releases the lock. The lock is a std::sync::RwLock (not a Tokio lock) and is never held across an .await; lock poison is recovered rather than propagated, matching the stance already documented on NodeState::read_scope_projections. Two constructors are provided:

• UnifiedApplier::new() — creates a private, standalone projection. Use this for replay pipelines and tests.
• UnifiedApplier::with_projection(Arc<RwLock<ScopeProjections>>) — attaches to the node's live shared projection. This is the C2.1 dual-write seam: governance ops processed by the existing live pipeline are simultaneously ingested into the shared projection.

A projection() accessor exposes the Arc for inspection or cross-checking. pub mod unified_applier is exported from crates/context/src/lib.rs, making UnifiedApplier part of the crate's public API.

Behavior is pinned by dag_releases_out_of_order_ops_and_the_projection_converges: a four-op causal chain spanning the admin, membership, ACL, and data planes is fed through DagStore<Op> + UnifiedApplier in four delivery orders (in-order, full reverse, and two interleaved). The test asserts that every op is applied (none stuck pending) and that scope_root matches the result of direct in-order folding in all cases — confirming causal ordering and projection convergence regardless of receive order.

Shadow authorization check in apply_signed_namespace_op

After a governance op is successfully applied by the live gate, the handler runs a non-blocking shadow authorization check for observability. The check is implemented in two parts:

• apply_auth_requirement(op) maps the just-applied SignedNamespaceOp to an (ContextGroupId, ApplyAuthReq) pair. ApplyAuthReq is either Admin or AdminOrCap(bits). The mapping covers:
  • Root-level AdminChanged, PolicyUpdated, GroupReparented → Admin
  • GroupCreated → AdminOrCap(CAN_CREATE_SUBGROUP)
  • Group-level MemberAdded / MemberRemoved → AdminOrCap(MANAGE_MEMBERS)
  • SubgroupVisibilitySet → AdminOrCap(CAN_MANAGE_VISIBILITY)
  • MemberRoleSet, MemberCapabilitySet, DefaultCapabilitiesSet → Admin
  Explicitly excluded from the mapping (returning None): MemberJoined / MemberJoinedAt (inviter authority; MemberJoinedAt additionally enforces deterministic expiry — apply rejects when joined_at > expiration_timestamp), MemberJoinedOpen (inheritance proof), MemberLeft (self-authored), GroupDeleted and TransferOwnership (owner-gated), and other metadata/context-registration ops.
• The handler then calls the corresponding at-cut accessor against the op's delta_parents cut (the DAG state the signer observed, not the post-apply cut). If the projection returns Some(false) — it would have rejected what the live gate accepted — a warn! is emitted with marker=unified_projection_divergence and plane=governance-auth. None (ancestry incomplete) is silently skipped. The check runs outside the projection write lock under a brief read lock.

Live authorization gates are entirely unchanged. The shadow check is log-only and has no effect on whether an op is accepted or rejected.

Concurrent-op convergence test — concurrent_independent_member_adds_converge

The integration test concurrent_independent_member_adds_converge pins the CRDT convergence semantics for concurrent ops authored against the same genesis state. Two admins independently add different members (D and E) against the same genesis state; the ops are applied in opposite orders on two nodes. The test asserts: (1) both ops succeed on both nodes, (2) both nodes converge to the identical four-member set, and (3) replaying a seen op is a no-op — the per-signer nonce window dedups it and the member count does not change. The only apply gate is the per-signer nonce window; there is no state-hash staleness check. The old test (state_hash_prevents_concurrent_op_divergence) asserted that the second concurrent op must fail; that hard-reject behavior no longer exists and the old test has been removed.

Where this can break

Two classes of change would silently re-introduce the divergence described above:

• Calling the projection with the wrong position. Any caller of the at-cut membership resolver that passes the receiver's current state (or any post-cut heuristic) instead of the signed delta position breaks forward-only. The three production call sites — gossip-receive, governance-pending drain, and snapshot-sync replay — each carry inline comments naming this contract; reviewers should flag any new caller that doesn't pass delta.governance_position verbatim.
• Expanding the cut resolution to visit descendants. A "performance optimization" that advances the resolved cut beyond the signed heads would observe ops the signer hadn't signed against, including later MemberRemoved ops. The forward-only contract is documented on the public projection at-cut methods; the prefix_walk_forward_only_* regression tests pin the boundary.
• Reintroducing a state-hash staleness gate. Governance ops no longer carry a meaningful root-hash claim (state_hash has been removed from the synthesized SignedGroupOp in decrypt_and_apply_group_op, and signed_op_to_delta / signed_namespace_op_to_delta now pass [0u8; 32] as expected_root_hash). Any new code that gates apply on a non-zero root-hash match would incorrectly reject concurrent ops and break the CRDT convergence property pinned by concurrent_independent_member_adds_converge. The per-signer nonce window is the sole apply gate for replay deduplication.

Scope

Forward-only applies to MemberRemoved and MemberLeft — operations that revoke authorship. It does not apply to role demotions (MemberRoleSet transitioning a Member to ReadOnly): those are enforced against current state at the receive path, separately from the cross-DAG check, because a member who was demoted retains a different relationship to their pre-demotion writes than a member who was fully removed. See is_read_only_for_context for the live-state role gate.

leave_context — local-only opt-out

Stop syncing a context on this node. No DAG op, no broadcast, no key rotation. Other members never observe the leave; from their perspective the leaver is still in the membership list (which is implicit anyway, computed from group membership + auto-follow).

Storage

Two separate stores live side by side: the synced ContextIdentity row (key at crates/store/src/key/context.rs:120, value at crates/store/src/types/context.rs:117) and a node-local ContextLeftMarker tombstone in a new column.

The marker lives in Column::ContextLocal (a new column specifically for node-local context-scoped state — never synchronized). Keying is identical to ContextIdentity so the (context_id, member_pk) pair is the unit of opt-out:

A separate column instead of a flag on ContextIdentity for two reasons: (a) ContextIdentity is part of the synced membership shape, so adding a node-local field to it would conflate replicated and node-local state; (b) extending the existing Borsh value would break deserialization of pre-existing on-disk rows, requiring a migration. The dedicated column makes the node-local-ness explicit at the storage layer and keeps the synced shape clean.

Flow

1. Client calls leave_context(context_id).
2. Handler resolves the local ContextIdentity via find_local_signing_identity — scans the column for the row where this node holds the private key. Falls back to the namespace identity if no local row exists.
3. In a single batched store handle (so they land in one commit), the handler:
   1. Writes the ContextLeftMarker row in Column::ContextLocal.
   2. Deletes the corresponding ContextIdentity row, which stops sync (the sync layer iterates these rows).
4. Calls node_client.unsubscribe(&context_id) to leave the gossipsub topic, mirroring join_context's subscribe.
5. Auto-follow handler (auto_follow.rs:255) checks for the marker via has_left_context on every ContextRegistered event and skips the auto-rejoin if it finds one.

Properties

Scope	Local only
DAG entry	None
Key rotation	None — leaver still holds the group key
Coordination	None — cannot fail
Reversibility	Trivial — JoinContextRequest deletes the marker as a side-effect of joining and writes a fresh ContextIdentity row
Other members observe	No
Forward secrecy	Not provided — leaver retains the key, can decrypt anything they sync later if they rejoin

What this is not

• Not a kick. Leaver still appears in any "members of this context" query.
• Not a cryptographic leave. If the user wants forward secrecy on a context, they must leave the group containing it (which rotates the group key).

leave_group — self-removal, no cascade

Self-removal from a single group via GroupOp::MemberLeft. The leaver publishes the leave op; every receiver deletes the leaver's (member, group) row.

As-built caveat — no key rotation on self-leave. Unlike owner-initiated MemberRemoved, MemberLeft deliberately does not trigger the key-rotation pipeline. The publisher of a self-leave is the leaver, and the leaver cannot generate the fresh group key without also retaining it — which would defeat forward secrecy. So MemberLeft is the governance-level departure (the membership row is removed, peers observe the leave, the leaver is deny-listed) without a re-key. The path to a cryptographically-complete leave is an admin/owner-initiated MemberRemoved, which rotates. A two-phase self-leave rotation (a remaining admin's apply hook publishes the new key) is a tracked follow-up, not yet shipped. See the inline note in crates/governance-store/src/ops/group/member_left.rs.

New op

Distinct from MemberRemoved for audit clarity — "this member chose to leave" vs "this member was removed" are semantically different events even when they have similar effects.

Preconditions

• Signer equals the member being removed (SelfLeaveOnly) and has a direct row in the group; reject with MemberNotDirect if the signer is only an inherited member — they must leave the anchor instead.
• Signer is not the group's owner_identity (OwnerCannotSelfLeave; must TransferOwnership first).
• Removing the signer does not leave the group with zero admins (LastAdmin via ensure_not_last_admin_removal).

Flow

1. Leaver's client calls leave_group(group_id).
2. Apply enforces the preconditions above (self-equality, direct-row, owner, last-admin).
3. Leaver publishes MemberLeft { member: signer } via the governance DAG. Signed by the leaver. Targets this group.
4. Op broadcasts to all members of the group. Each receiver applies it: cascade_remove_member_from_group_tree drops the leaver's ContextIdentity rows, remove_member deletes the (leaver, group_id) membership row, and the leaver is added to the group deny-list so their state-delta traffic is dropped until they re-join.
5. The apply emits OpEvent::MemberRemoved; if the leaver's role was ReadOnlyTee it additionally emits OpEvent::TeeMemberRemoved, which drives the leaver's own node to self-purge the group's local key material.
6. No automatic re-key. As noted above, MemberLeft does not rotate the group key — the leaver still holds the last key it received and can decrypt writes made under it. Forward secrecy on future writes requires the owner-initiated MemberRemoved path (or the deferred two-phase self-leave rotation).

Cascade behavior

Direct rows in subgroups under this group	Untouched. Leaver keeps those memberships. (You can be invited to a child while explicitly leaving the parent.)
Inherited memberships in Open subgroups	Resolve themselves. The walker stops finding the leaver once their parent row is gone — no extra work needed.

Failure modes

• No forward secrecy on self-leave (by design, not a failure). Because MemberLeft never rotates, the leaver retains the ability to decrypt writes made under the key they last held. To revoke that, an admin/owner must issue MemberRemoved (which rotates) or the deferred two-phase self-leave rotation must land.
• Inherited-only membership. A signer whose membership is purely inherited (no direct row) is rejected with MemberNotDirect; they must leave the anchoring ancestor instead.

Rejoin

• Restricted group: requires fresh add_group_members from a remaining admin. New keys delivered via the existing membership-add path.
• Open group (if leaver had a redundant direct row): same. If leaver's path to the group was via inheritance from a parent, that inheritance is automatically restored as soon as they rejoin the parent.

leave_namespace — cascading, heaviest

A namespace is the root group. Leaving it is a single MemberLeft at the namespace root whose apply cascades through every descendant group where the leaver has a direct row. This is the only leave operation that fans out across multiple scopes. As with leave_group, the self-leave op does not rotate keys (same publisher-holds-the-key constraint); row removal + deny-listing only.

Preconditions

• Signer has a direct row at the namespace root (MemberNotDirect otherwise).
• Signer is not the owner_identity of the namespace root (OwnerCannotSelfLeave) nor of any subgroup beneath it where they have a direct row (OwnerOwnsSubgroup, reporting the offending scope).
• Removing the signer doesn't leave any scope (namespace or descendant) admin-less. If it would → LastAdmin reports the offending scope, forcing a successor promotion before retry. All these checks run upfront, before any mutation.

Flow

1. Client calls leave_namespace(namespace_id).
2. Apply detects the no-parent (namespace-root) case and walks the subtree:
   • Compute the descendant groups where the signer has a direct row.
   • Run owner check + last-admin check across all of them upfront. If any fails (OwnerOwnsSubgroup, OwnerCannotSelfLeave, LastAdmin) it bails before mutating anything — no half-applied cleanup.
3. Signer publishes a single MemberLeft { member: signer } at the namespace root.
4. The apply cascades: for each direct-row descendant it calls cascade_remove_member_from_group_tree, removes the membership row, deny-lists the leaver, and emits OpEvent::MemberRemoved. For each descendant where the leaver's role was ReadOnlyTee it also emits a per-subgroup OpEvent::TeeMemberRemoved. The same removal then runs for the namespace root, emitting a root MemberRemoved (and a root TeeMemberRemoved if the root role was ReadOnlyTee).
5. No per-scope key rotation. The cascade is row-removal only — there is no KeyDelivery fan-out. Forward secrecy on each scope's future writes is provided by the owner-initiated MemberRemoved rotation pipeline, not by self-leave.
6. Local cleanup on the leaver's node is role-scoped, not a soft/hard toggle:
   • Non-TEE roles: soft leave. Local rows (identity, signing keys, contexts) are kept so rejoin / keyshare / inheritance-rejoin flows can reuse them.
   • ReadOnlyTee: the emitted TeeMemberRemoved events drive the self-purge listener to hard-delete local key material across the whole subtree and unsubscribe from the namespace gossipsub topic.

Edge case — last member of the namespace

If the leaver is the last remaining member, MemberLeft writes locally but has no peers to broadcast to. The namespace effectively dies on the leaver's node.

If the leaver is also the owner AND last member, they're stuck in the cycle — they must transfer ownership but there's no one to transfer to. Use a dedicated DeleteNamespace op (analogous to DeleteGroup but at root) that bypasses the owner-cannot-leave rule.

Failure modes

• No forward secrecy on self-leave across any scope (same constraint as leave_group): the cascade removes rows but does not re-key. Use owner-initiated MemberRemoved for a cryptographically-complete eviction.
• Interrupted TEE self-purge. If the leaver was a ReadOnlyTee node and its local cascade-purge is interrupted (crash, or a signing-key delete error), a durable pending-self-purge marker survives and the startup reconcile_sweep completes the purge on next restart. See TEE self-purge.

Open Questions & Follow-ups

1. Two-phase self-leave rotation. MemberLeft currently does not re-key (the leaver can't generate a key without retaining it). A deferred design has a remaining admin's apply hook publish the new key after the leave. Until it lands, owner-initiated MemberRemoved is the only rotating leave.
2. Local cleanup is role-scoped, not a toggle. The earlier soft-vs-hard default question is resolved by role (ADR 0002): non-TEE removals stay soft; ReadOnlyTee removals hard-purge. No global default knob.
3. Admin-mutual demote. Admins can demote each other. Whether to restrict this to Owner-only is unresolved; current behavior is preserved.
4. Old owner after TransferOwnership. Becomes a regular admin (current behavior) or just a member (alternative)?
5. Subgroup-level self-purge reconcile. The startup reconcile is namespace-level only; a subgroup-only purge has no reconcile retry surface yet (tracked in #2726).
6. Periodic reconcile. A purely-lagged-drop of TeeMemberRemoved writes no marker and is not recovered until a future eviction; a periodic sweep is an open follow-up.

Atomic op-store write — removal of per-site dual-write scaffolding

Status: shipped. store_signed_operation now persists every governance op atomically at apply time, making all per-site op-store write calls redundant. This section documents what was removed and why, and supersedes the Deferred op-store read-flip and persist_namespace_head_ops sections above where they describe the old per-site scaffolding.

What was removed

• Receive-handler dual-write. The persist_op call inside apply_signed_namespace_op that was labelled C2.1b dual-write has been deleted. The ingest_op fold into the live projection is deliberately kept; only the now-redundant durable-store write is gone.
• sign_apply_and_publish_group_op wrapper. The crate-private function in lib.rs that wrapped calimero_governance_store::sign_apply_and_publish and appended a persist_namespace_head_ops call is deleted entirely. All ~15 call sites (add_group_members, admit_tee_node, create_context, delete_context, detach_context_from_group, join_context, leave_group, leave_namespace, set_member_auto_follow, set_member_capabilities, set_subgroup_visibility, set_tee_admission_policy, update_member_role, upgrade_group, dispatch_cascade, and others) now call calimero_governance_store::sign_apply_and_publish directly.
• ScopeProjections::persist_namespace_head_ops. The thin alias for repersist_namespace_ops that documented the C3 Stage 1/2/3 per-site persist pattern is deleted from scope_projections.rs. All call sites are also removed: create_group, delete_group, join_context, join_subgroup_inheritance, remove_group_members, join_namespace (node crate), reparent_group (admin API), and create_group_in_namespace (admin API).

Why the per-site scaffolding was safe to delete

store_signed_operation is called on every apply path — both local authoring and peer-receive — and now writes the op into the unified op-store as part of the same atomic commit. Because the persist is guaranteed at the apply chokepoint, no handler needs to issue a separate post-publish persist call. The two problems the scaffolding addressed are resolved at source:

• Local-author gap. A locally authored op is written by store_signed_operation at apply time, before the handler returns. There is no window in which the op could be absent from the op-store after a successful publish.
• Late-decrypted membership. repersist_namespace_ops (called by the key-delivery path) still overwrites stale Noop entries with their now-decryptable payloads. The atomic write path records the best payload available at apply time; the key-delivery re-persist corrects any entry frozen as Noop before the group key arrived. Both paths remain in place; only the redundant per-site calls are removed.

Race that the old heads-only walk would have introduced

The deleted persist_namespace_head_ops performed a full collect_namespace_ops-backed fold after publish to avoid a heads-only-walk race (a concurrent peer op advancing the head past the just-authored op before the walk ran). The atomic write in store_signed_operation sidesteps this entirely: the authored op is written at apply time under its content-addressed op id, so its presence in the op-store is independent of where the DAG head points afterward.

Surviving use of repersist_namespace_ops

repersist_namespace_ops itself is not deleted. It continues to serve the key-delivery path: when a group key arrives late, the key-delivery handler calls repersist_namespace_ops to re-walk the namespace via collect_namespace_ops and overwrite any op-store entries that were frozen as Noop at apply time because the key was absent. This is the only remaining call site.

Updated test — locally_authored_op_lands_in_the_op_store_atomically

The test previously named persist_namespace_head_ops_lands_locally_authored_op_in_the_op_store is renamed locally_authored_op_lands_in_the_op_store_atomically. Its structure is updated to reflect the atomic-write path:

1. An encrypted MemberAdded op is passed through store_signed_operation (the atomic path).
2. The test asserts the op appears in the op-store immediately after that call, with no intervening persist_namespace_head_ops call required — authoring handlers need only call calimero_governance_store::sign_apply_and_publish directly; no post-author mirror step is needed.
3. The test then calls ScopeProjections::repersist_namespace_ops directly (replacing the now-deleted persist_namespace_head_ops alias) and asserts the op-store state is unchanged — confirming idempotency over an already-present entry.

The test runs without #[ignore] in CI and is the readiness gate confirming that the atomic-write path is sufficient and that the per-site scaffolding carried no load that store_signed_operation does not now cover.