OMEService

• Package: ome.v1
• Fully-qualified name: ome.v1.OMEService
• Source file: ome_service.proto
• RPC count: 57

OMEService is the gRPC API for institutional AI agent memory with cryptographic attestation. Internal-only; external consumers reach the service via the AP00001 Edge Gateway (gRPC translation + JWT validation + rate limiting).

RPCs

| RPC | Kind | Request | Response | |-----|------|---------|----------| | AppendOutcome | unary | AppendOutcomeRequest | AppendOutcomeResponse | | BatchInsert | unary | BatchInsertRequest | BatchInsertResponse | | CaptureTrace | unary | CaptureTraceRequest | CaptureTraceResponse | | CheckPolicy | unary | CheckPolicyRequest | CheckPolicyResponse | | CryptoEraseWorkspace | unary | CryptoEraseWorkspaceRequest | CryptoEraseWorkspaceResponse | | DispatchKind | unary | DispatchKindRequest | DispatchKindResponse | | EmergencyEraseWorkspace | unary | EmergencyEraseWorkspaceRequest | EmergencyEraseWorkspaceResponse | | EmitInferenceAttestation | unary | EmitInferenceAttestationRequest | EmitInferenceAttestationResponse | | EraseEra | unary | EraseEraRequest | EraseEraResponse | | ExportArchive | unary | ExportArchiveRequest | ExportArchiveResponse | | ExportAuditBundle | server streaming | ExportAuditBundleRequest | ExportAuditBundleChunk | | ExportBundle | server streaming | ExportBundleRequest | ExportBundleChunk | | ExportForSubject | server streaming | ExportForSubjectRequest | ExportForSubjectChunk | | ExportTraceBundle | unary | ExportTraceBundleRequest | ExportTraceBundleResponse | | GatedMemoryRead | unary | GatedMemoryReadRequest | GatedMemoryReadResponse | | GatedMemoryWrite | unary | GatedMemoryWriteRequest | GatedMemoryWriteResponse | | GetClaimBody | unary | GetClaimBodyRequest | GetClaimBodyResponse | | GetDerivationChain | unary | GetDerivationChainRequest | GetDerivationChainResponse | | GetDerivationChainMetadata | unary | GetDerivationChainMetadataRequest | GetDerivationChainMetadataResponse | | GetReceipt | unary | GetReceiptRequest | GetReceiptResponse | | GetServerSpec | unary | GetServerSpecRequest | GetServerSpecResponse | | GetTrace | unary | GetTraceRequest | GetTraceResponse | | HistogramReceipts | unary | HistogramReceiptsRequest | HistogramReceiptsResponse | | ImportArchive | unary | ImportArchiveRequest | ImportArchiveResponse | | ImportBundle | client streaming | ImportBundleChunk | ImportBundleResponse | | Insert | unary | InsertRequest | InsertResponse | | IssueGrant | unary | IssueGrantRequest | IssueGrantResponse | | ListAmgateDecisions | unary | ListAmgateDecisionsRequest | ListAmgateDecisionsResponse | | ListClaims | unary | ListClaimsRequest | ListClaimsResponse | | ListReceipts | unary | ListReceiptsRequest | ListReceiptsResponse | | ListSignerPubs | unary | ListSignerPubsRequest | ListSignerPubsResponse | | ListTraces | unary | ListTracesRequest | ListTracesResponse | | ListWitnessEvents | unary | ListWitnessEventsRequest | ListWitnessEventsResponse | | MergeArchives | unary | MergeArchivesRequest | MergeArchivesResponse | | Prove | unary | ProveRequest | ProveResponse | | ProveTombstoned | unary | ProveTombstonedRequest | ProveTombstonedResponse | | RefreshOrgRoot | unary | RefreshOrgRootRequest | RefreshOrgRootResponse | | RegisterClaimKind | unary | RegisterClaimKindRequest | RegisterClaimKindResponse | | RegisterWorkspaceKEK | unary | RegisterWorkspaceKEKRequest | RegisterWorkspaceKEKResponse | | RevokeSignerPub | unary | RevokeSignerPubRequest | RevokeSignerPubResponse | | SetTransparencyPublicRead | unary | SetTransparencyPublicReadRequest | SetTransparencyPublicReadResponse | | Sign | unary | SignRequest | SignResponse | | SignAndInsert | unary | SignAndInsertRequest | SignAndInsertResponse | | StreamSignerPubChanges | server streaming | WorkspaceFilter | SignerPubChangeEvent | | Tombstone | unary | TombstoneRequest | TombstoneResponse | | VerifyBundle | unary | VerifyBundleRequest | VerifyBundleResponse | | VerifyFull | unary | VerifyFullRequest | VerifyResponse | | VerifyGrant | unary | VerifyGrantRequest | VerifyGrantResponse | | VerifyInBand | unary | VerifyInBandRequest | VerifyResponse | | VerifyMergeReceipt | unary | VerifyMergeReceiptRequest | VerifyMergeReceiptResponse | | VerifyProof | unary | VerifyProofRequest | VerifyProofResponse | | VerifyRetrieval | unary | VerifyRetrievalRequest | VerifyRetrievalResponse | | VerifyTokenCapital | unary | VerifyTokenCapitalRequest | VerifyTokenCapitalResponse | | VerifyWithPubkey | unary | VerifyWithPubkeyRequest | VerifyResponse | | VerifyWitness | unary | VerifyWitnessRequest | VerifyWitnessResponse | | WitnessTop | unary | WitnessTopRequest | WitnessTopResponse | | WrapReceiptEnvelope | unary | WrapReceiptEnvelopeRequest | WrapReceiptEnvelopeResponse |

AppendOutcome

rpc AppendOutcome(AppendOutcomeRequest) returns (AppendOutcomeResponse)

• Kind: unary
• Request type: AppendOutcomeRequest
• Response type: AppendOutcomeResponse

AppendOutcome — the asynchronous outcome amendment (design §3.3 / §6 outcome path; §8 MUST). Resolves the referenced parent trace UNDER RLS (the authorization check), content-binds the supplied trace_hash to the resolved parent's Form-B hash, then signs + JMT-commits a SEPARATE append-only osyra-trace-outcome-v1 leaf (the original trace leaf is never touched). >=1 amendment per trace allowed (provisional → final).

Errors: OSY-TRACE-7510 TRACE_OUTCOME_DANGLING (parent absent / cross-workspace / forward reference — fail-closed, NEVER an orphan insert); 7511 TRACE_OUTCOME_LINK_MISMATCH (supplied trace_hash != resolved parent); 7503 TRACE_WS_MISMATCH; outcome-body shape codes.

BatchInsert

rpc BatchInsert(BatchInsertRequest) returns (BatchInsertResponse)

• Kind: unary
• Request type: BatchInsertRequest
• Response type: BatchInsertResponse

Edge Gateway-only: batched insert from inline-signed claims (Edge buffers up to 1 MB or 256 claims, whichever is reached first, then flushes every 5s). Each claim is canonical-CBOR and is idempotent on (workspace_id, claim_id).

Authorization: caller must present an Edge Gateway service identity (mTLS cert); ENG-572 wires the policy in the Edge integration ticket.

Errors: per-claim FailureDetail entries with OSY-MEM-NNNN reasons; the RPC itself returns OK as long as authentication succeeded.

CaptureTrace

rpc CaptureTrace(CaptureTraceRequest) returns (CaptureTraceResponse)

• Kind: unary
• Request type: CaptureTraceRequest
• Response type: CaptureTraceResponse

CaptureTrace — the synchronous capture (design §6 sync path; §8 MUST). Signs the producer-supplied trace body as a standalone COSE_Sign1 (workspace mguard key) and JMT-commits it under the trace dsTag keyspace, atomically (SERIALIZABLE). Idempotent on (workspace_id, idempotency_key): a retried capture (same broker request) resolves to the EXISTING committed trace and mints NO second leaf (replayed=true).

Errors: OSY-TRACE-7500..7505 (TRACE_BODY_SHAPE / NONCANONICAL / BAD_VERSION / WS_MISMATCH / EPOCH_STALE / SCHEMA); 7503 TRACE_WS_MISMATCH when the body ws disagrees with the GUC workspace; append-only reject on a re-used trace_id.

CheckPolicy

rpc CheckPolicy(CheckPolicyRequest) returns (CheckPolicyResponse)

• Kind: unary
• Request type: CheckPolicyRequest
• Response type: CheckPolicyResponse

ENG-2569 (ARC-36, MCP-C-32/38): the osymem.policy.check pre-flight — a QUERY (no side effects) that runs the workspace's verified, signed OPA-WASM policy cascade LOCALLY (ADR-078: never an online AP00019 request-path call) over the already-loaded enforcer (the same OpaCascadeDecider the GatedMemoryRead/Write gates consult internally — NOT a separate engine) and returns the would-be admission decision WITHOUT performing the action.

FAIL-CLOSED IMPLICIT_DENY (ADR-291 D3, non-negotiable): an unreachable enforcer, a workspace with NO verified bundle loaded (fail-static default-DENY per ADR-284 D5), or an indeterminate decision resolves to decision = IMPLICIT_DENY (mirrors the AP00019 reference default allow := false). A deny is a RESULT, not a transport error; a transport/timeout error NEVER reads as ALLOW.

policy_version is the enforcer's SINGLE combined cascade content-address (OpaCascadeDecider.digest() — the bundle wasm_sha256 for a one-layer cascade, else a domain-separated hash over the ordered per-layer wasm_sha256s); it is a replayable pass-through pin, NOT a per-layer array (MCP-C-38).

Workspace is SERVER-AUTHORITATIVE (OS-Workspace-ID header → ome.workspace_id GUC), NEVER a request field. Edge mTLS identity (EdgeIdentityKey) is required (else PERMISSION_DENIED / OSY-MEM-5312). action is the decision verb (e.g. "memory.put", mapped to the enforcer's memory:read/memory:write axis); resource is the optional target key/ORN; context carries bounded non-PII decision context.

Errors: 5312 (EdgeIdentityKey absent); 5310/5311 (workspace binding/GUC); 5321 (filter/action validation). A policy DENY is OK with decision=DENY/IMPLICIT_DENY (NOT an error status).

CryptoEraseWorkspace

rpc CryptoEraseWorkspace(CryptoEraseWorkspaceRequest) returns (CryptoEraseWorkspaceResponse)

• Kind: unary
• Request type: CryptoEraseWorkspaceRequest
• Response type: CryptoEraseWorkspaceResponse

ENG-1951: gated, dry-run-first crypto-erasure for a confirmed-exploit org's workspace. Unlike EmergencyEraseWorkspace (unconditional), this enforces the allow-list + fail-closed legal-hold ABORT + the two-lock sign-off (executor enable-flag + 2-of-3 JWS bound to workspace+inventory-hash+nonce) + immutable evidence. Edge-mTLS gated. Errors: 5380..5385.

DispatchKind

rpc DispatchKind(DispatchKindRequest) returns (DispatchKindResponse)

• Kind: unary
• Request type: DispatchKindRequest
• Response type: DispatchKindResponse

Dispatch a claim to its kind-specific handler. V1: 18 hardcoded kinds in 8 reverse-DNS namespaces. V1.5: pluggable handlers registered via RegisterClaimKind.

Errors: 5451 (kind already registered with different version); 5452 (version downgrade).

EmergencyEraseWorkspace

rpc EmergencyEraseWorkspace(EmergencyEraseWorkspaceRequest) returns (EmergencyEraseWorkspaceResponse)

• Kind: unary
• Request type: EmergencyEraseWorkspaceRequest
• Response type: EmergencyEraseWorkspaceResponse

Emergency erasure: full workspace cryptographic erasure (all eras). Use case: legal hold expiry, GDPR right-to-erasure, customer offboarding.

Errors: 5351..5353.

EmitInferenceAttestation

rpc EmitInferenceAttestation(EmitInferenceAttestationRequest) returns (EmitInferenceAttestationResponse)

• Kind: unary
• Request type: EmitInferenceAttestationRequest
• Response type: EmitInferenceAttestationResponse

Emit the INFERENCE-binding OIR receipt over the declared attested context + the produced output (§5). The context is assembled from the disclosed attested-claim-ref keys; the receipt is the SINGLE OIR the shipped AP00016 re-decider consumes (S1).

EraseEra

rpc EraseEra(EraseEraRequest) returns (EraseEraResponse)

• Kind: unary
• Request type: EraseEraRequest
• Response type: EraseEraResponse

GDPR Art. 17 cryptographic erasure: revoke an era_secret_n. The customer must hold the KMS Decrypt grant; revoke is performed via the customer's KMS console out-of-band. This RPC removes the era from in-memory cache and marks the era retired in the database (claims encrypted under era_n become preimage-confirmation- resistant within the cache TTL boundary).

Errors: 5351..5353 (era_secret / KMS).

ExportArchive

rpc ExportArchive(ExportArchiveRequest) returns (ExportArchiveResponse)

• Kind: unary
• Request type: ExportArchiveRequest
• Response type: ExportArchiveResponse

Export the calling workspace's current memory as a signed OMP archive (osyra-omp-archive-v1, workspace-KMS-signed). Workspace is server-authoritative (OS-Workspace-ID header). Errors: OSY-OMP-6500..6525.

ExportAuditBundle

rpc ExportAuditBundle(ExportAuditBundleRequest) returns (stream ExportAuditBundleChunk)

• Kind: server streaming
• Request type: ExportAuditBundleRequest
• Response type: ExportAuditBundleChunk

Stream-export the workspace's Pillar-1 retrieval-receipt set as a bit-identical .ome-audit.zip (workspace-key-signed audit bundle per ADR-040). First chunk is the AuditBundleManifestProto; subsequent chunks are raw ZIP bytes (oneof payload). Chunk size configurable in [1 KiB, 16 MiB]; default 1 MiB.

Auth model: requires EdgeIdentityKey (Edge mTLS) + OPA scope osyra:ome:audit-bundle:export (Edge-gateway-enforced; see ENG-1592).

Cap: server-enforced max receipts per export = audit.bundle.export.max-receipts-per-export (default 10 000; 1/5 of spec §8 50K hard limit to bound pod heap budget).

Errors: 5270 (export failed); 5271 (filter invalid); 5272 (receipt cap exceeded); 5273 (workspace signing key missing — translated from 5351); 5274 (signature failed); 5277 (no receipts match filter); 5279 (content_type invalid); 5310..5312 (WBW / Edge identity).

B.3 will ADD (not replace) a presigned_url leg to the chunk oneof for S3 transport per ADR-057.

ExportBundle

rpc ExportBundle(ExportBundleRequest) returns (stream ExportBundleChunk)

• Kind: server streaming
• Request type: ExportBundleRequest
• Response type: ExportBundleChunk

Stream-export the workspace state as a bit-identical .ome v2 ZIP bundle. First chunk is the BundleManifest; subsequent chunks are raw ZIP bytes. Chunk size is configurable (default 4 MiB; max 16 MiB).

Errors: 5251..5253 (export / manifest / signature); 5212 (TOMBSTONE_SALTS_REQUIRES_AUDIT_MODE — ENG-782), 5213 (TOMBSTONE_SALT_MISMATCH — ENG-782 audit-mode verification), 5310..5311 (workspace binding / scope; AUDIT_MODE_AUDIT without audit:read scope falls here).

ExportForSubject

rpc ExportForSubject(ExportForSubjectRequest) returns (stream ExportForSubjectChunk)

• Kind: server streaming
• Request type: ExportForSubjectRequest
• Response type: ExportForSubjectChunk

Stream-export every Claim in the workspace where Claim.subject_id matches the requested DID, plus the transitive parent claim chain (deterministic BFS, capped at MAX_TRANSITIVE_PARENTS=10_000 per spec §3.2), plus per-claim JMT inclusion proofs (one per claim) — all packaged as a bit-identical .ome-subject.zip (workspace-key-signed data-subject-access bundle per ADR-060). First chunk is the SubjectBundleManifestProto; subsequent chunks are raw ZIP bytes (oneof payload). Chunk size configurable in [1 KiB, 16 MiB]; default 1 MiB.

Auth model: requires EdgeIdentityKey (Edge mTLS) + OPA scope osyra:ome:subject-bundle:export (Edge-gateway-enforced).

Caps (server-enforced):

• max direct claims = subject.bundle.export.max-direct-claims (default 100_000; OSY-MEM-5282 on overflow)
• max transitive parents = subject.bundle.export.max-transitive-parents (default 10_000; OSY-MEM-5286 on overflow)
• rate limit per workspace = 5/hour (configurable); per requestor = 50/hour (OSY-MEM-5287 on overflow)

GDPR Art-15(1) right-of-access + Art-15(3) verifiable-copy delivery. The bundle signature uses dsTag osyra-ome-subject-bundle-v1 (27 UTF-8 bytes, byte-position-13 disjoint from .ome / .ome-audit / .ome-mguard / .ome-claim per ADR-060 Decision 3), workspace key resolved via MGuardSigningKeyResolver. Tombstoned subject-claims (ENG-583) exported as tombstone_witness records ONLY (NEVER pre-tombstone bodies; spec §3.4).

Errors: 5280 (export failed); 5281 (subject filter / manifest invalid); 5282 (direct-claim cap exceeded); 5283 (workspace signing key missing); 5284 (signature failed); 5285 (subject has no claims — informational); 5286 (transitive-parent cap exceeded); 5287 (rate limited); 5288 (content_type / dsTag / version invalid; cross-format replay); 5289 (JMT proof generation failed); 5310..5312 (WBW / Edge identity).

ExportTraceBundle

rpc ExportTraceBundle(ExportTraceBundleRequest) returns (ExportTraceBundleResponse)

• Kind: unary
• Request type: ExportTraceBundleRequest
• Response type: ExportTraceBundleResponse

ExportTraceBundle — the vendor-neutral offline-verify artifact (design §6/§7; §8 MUST). Gathers, UNDER RLS at ONE consistent (root, sequence_no) snapshot, every matching signed trace + its outcome amendment(s) + each referenced-memory claim, plus a per-leaf JMT inclusion proof for all three, and returns the deterministic .ome trace-bundle bytes (content-type application/vnd.osyra.ome.trace-bundle.v1+zip). The bundle re-verifies OFFLINE (no OME, no DB) via the TraceBundleVerifier four checks: every carried proof recomputes to the single attested root. The filter is server-workspace-scoped; a result-cap bounds the response size.

Errors: in V1 export failures (filter invalid / empty match, result cap exceeded, export failed) map to the existing TRACE_SCHEMA (OSY-TRACE-7506), distinguished by gRPC/HTTP status + message; distinct export-specific codes remain RESERVED in the OSY-TRACE 7500-7599 band for a future mint.

GatedMemoryRead

rpc GatedMemoryRead(GatedMemoryReadRequest) returns (GatedMemoryReadResponse)

• Kind: unary
• Request type: GatedMemoryReadRequest
• Response type: GatedMemoryReadResponse

Read a value through the READ-gate (cap ∧ policy ∧ attestation; source default-DENY ATTESTED_CLAIM_REF). A request-supplied verification key/epoch is the confused-deputy probe -> DENY (8507). Diagnostics ride OSY-AMGATE-85xx.

GatedMemoryWrite

rpc GatedMemoryWrite(GatedMemoryWriteRequest) returns (GatedMemoryWriteResponse)

• Kind: unary
• Request type: GatedMemoryWriteRequest
• Response type: GatedMemoryWriteResponse

Commit a value through the WRITE-gate (cap ∧ policy; the effect is DERIVED internally — §4.3). A denied write is a PROVABLE NO-OP. Returns the post-commit durable sequence_no (the §D2 emit-after-commit epoch).

GetClaimBody

rpc GetClaimBody(GetClaimBodyRequest) returns (GetClaimBodyResponse)

• Kind: unary
• Request type: GetClaimBodyRequest
• Response type: GetClaimBodyResponse

ENG-2225 [D3]: fetch the raw canonical-CBOR BODY of a single claim by id.

The AC2 read-side sanitization (which keeps body/signature/signer_pub off the wire for ListClaims) is CONSCIOUSLY REVERSED for THIS one RPC, by CEO ratification: the body IS returned. Only the body payload ({@code SignedClaim.claim.body}) is returned — the signature and signer_pub are still NOT on the wire. This backs the SDK agent-framework resume/recall path (LangGraph checkpoint, AutoGen memory): those adapters write a checkpoint/memory payload as the claim body and read it back here.

Because the raw body is the most sensitive read on this service, the Edge mTLS identity gate (EdgeIdentityKey) is MANDATORY + load-bearing. Workspace-binding GUC + RLS apply as on every read.

Source: the body is stored inline in the canonical-CBOR SignedClaim ({@code claim.signed_claim_cbor}, plaintext at rest in V1); the server decodes it and returns {@code claim.body}. (No object-store / BYOK read path exists in V1.)

Not-found semantics: a claim_id absent from the caller's workspace returns NOT_FOUND. A TOMBSTONED claim (GDPR Art-17 crypto-erasure — the body is hard-deleted) returns an error status finalized under the D3 tombstone-status decision; see the handler.

Errors: NOT_FOUND (no such claim); 5163 (stored-row decode failure → INTERNAL); 5312 (EdgeIdentityKey absent); 5310/5311 (workspace binding/GUC).

GetDerivationChain

rpc GetDerivationChain(GetDerivationChainRequest) returns (GetDerivationChainResponse)

• Kind: unary
• Request type: GetDerivationChainRequest
• Response type: GetDerivationChainResponse

Return the Pillar-6 receipt-lattice composition over the MAPL derivation claim chain (input_hash → model_id → output_hash → signer) anchored at the requested request_id. Backs the public-facing AP00001-edge endpoint at GET /v1/transparency/derivation/{request_id}. EU AI Act Article 50(2) effective 2026-08-02 (Article 113); this RPC ships the cryptographic substrate that downstream deployers (our customers) use to satisfy the "machine-readable + detectable" obligation when surfacing AI outputs to natural persons.

Workspace tenancy: enforced via (a) EdgeIdentityKey gate (mTLS service identity from Edge), (b) workspace_id_for_lookup field (NOT JWT — Edge resolves opt-in / private mode + workspace binding BEFORE calling this RPC), (c) RLS via ome.workspace_id GUC bound from the OS-Workspace-ID gRPC header.

PII sanitization: server returns RAW signer_did + workspace_id; the Edge handler hashes them for public-mode responses per ENG-585 plan §6.2. This split is deliberate: keeping all-raw on the gRPC surface lets the same RPC serve both private (JWT-scoped) and public (anonymous) modes without duplicating the BFS chain-assembly logic.

Tombstone-aware reader (inherits ENG-583 / ENG-584 §3.4 pattern): if any claim in the chain is tombstoned (claim or any transitive parent), the response carries tombstone-witness records at the affected indices instead of full claim bodies; chain_partial_tombstone=true marks this case. Verifier semantics: the chain is still complete (witness proves what was redacted), only the redacted body is unavailable.

DoS hardening: BFS cap MAX_DERIVATION_CHAIN_LENGTH=1000 (mirrors ENG-584 direct-claim cap). cap-exceeded → OSY-TRANS-6105 UNIFIED-NOT-FOUND (NOT 413; the wire-level Unified policy collapses cap-exceeded into the enumeration-defense class to avoid leaking chain-size oracles).

Errors: OSY-TRANS-6101 (malformed request_id); OSY-TRANS-6104 (chain not found in caller's workspace); OSY-TRANS-6106 (chain tombstoned, returns witness skeleton); OSY-MEM-5310..5312 (workspace binding / EdgeIdentityKey).

GetDerivationChainMetadata

rpc GetDerivationChainMetadata(GetDerivationChainMetadataRequest) returns (GetDerivationChainMetadataResponse)

• Kind: unary
• Request type: GetDerivationChainMetadataRequest
• Response type: GetDerivationChainMetadataResponse

Cheap metadata-only probe used by Edge to resolve workspace_id BEFORE the full chain-assembly call. Returns ONLY the chain's workspace_id (raw UUIDv4 string) and chain_exists bool. Edge uses this to gate auth/opt-in logic (public mode requires workspace.transparency_public_read=TRUE; private mode requires JWT workspace_id match). On chain_exists=false the response carries empty workspace_id; Edge MAPS THIS TO UNIFIED-NOT-FOUND with the constant-time 404-cushion per ENG-585 plan §6.3.

The split-call design is load-bearing for the timing oracle defense: a single round-trip that returns "chain exists in workspace X" would leak workspace- existence to enumeration probers. The metadata probe ALWAYS performs the same database lookup (idx_claim_workspace_request_id partial index) regardless of workspace opt-in state, so Edge can resolve auth without observable timing differences.

Errors: OSY-TRANS-6101 (malformed request_id); OSY-MEM-5310..5312 (workspace binding / EdgeIdentityKey absent).

GetReceipt

rpc GetReceipt(GetReceiptRequest) returns (GetReceiptResponse)

• Kind: unary
• Request type: GetReceiptRequest
• Response type: GetReceiptResponse

VM-6.2 — single-receipt lookup by stable id (lowercase-hex SHA-256 of the outer envelope bytes). Backs the dashboard detail-pane modal that the frontend opens when a row in the receipts list is clicked.

EdgeIdentityKey-gated (PERMISSION_DENIED otherwise); RLS-scoped via the ome.workspace_id GUC. Returns the same sanitized projection as ListReceipts so the FE node shape is identical.

Returns GetReceiptResponse with the node field absent when the receipt_id is not present in the caller's workspace (RLS-filtered — never reveals cross-workspace existence).

Errors: 5121 (filter validation, malformed receipt_id); 5122 (envelope decode failure on a corrupt stored row); 5312 (EdgeIdentityKey absent); 5310/5311 (workspace binding/GUC).

GetServerSpec

rpc GetServerSpec(GetServerSpecRequest) returns (GetServerSpecResponse)

• Kind: unary
• Request type: GetServerSpecRequest
• Response type: GetServerSpecResponse

ENG-2568 (ARC-36, MCP-C-37): advertise the server's pinned OME spec-id + residency region so a client (notably the AP00015 MCP server) can FAIL-CLOSED bind its expected osyra.spec_id to this backend at STARTUP (AP00015 design §5.4 step 5; ADR-292). A mismatch between the client's pinned spec-id and spec_id MUST abort the client's startup — never serve a tool call against a spec-divergent backend.

This is a cheap, read-only, workspace-agnostic metadata probe (no claim access, no JMT touch): it returns the server's COMPILE/CONFIG-pinned identity, not any tenant data. No OS-Workspace-ID binding is required (and none is read).

spec_id is the stable, frozen wire-format spec identity (ADR-046 RATIFIED .ome v1 family); spec_version is the informational point release (AP00011-OME-FILE-FORMAT-V1.md frontmatter, e.g. "1.0.9"); region is the backend residency region (ome.region, e.g. "us-east-1") feeding the MCP-C-31 region-binding check (ADR-297).

Errors: never throws on a well-formed request (returns the static server spec).

GetTrace

rpc GetTrace(GetTraceRequest) returns (GetTraceResponse)

• Kind: unary
• Request type: GetTraceRequest
• Response type: GetTraceResponse

GetTrace — read one trace's indexed projection by trace_id (design §8 SHOULD). Reads with an EXPLICIT workspace_id predicate (defense-in-depth WITH FORCE-RLS — never RLS alone for a tenant decision; the BYPASSRLS lesson). Never crosses workspaces.

Errors: in V1 a not-found (absent / other-workspace) maps to the existing TRACE_SCHEMA (OSY-TRACE-7506), distinguished by gRPC NOT_FOUND / HTTP 404 + message; a distinct TRACE_NOT_FOUND code remains RESERVED in the OSY-TRACE 7500-7599 band for a future mint.

HistogramReceipts

rpc HistogramReceipts(HistogramReceiptsRequest) returns (HistogramReceiptsResponse)

• Kind: unary
• Request type: HistogramReceiptsRequest
• Response type: HistogramReceiptsResponse

VM-6.2 — server-aggregated imitation_distance histogram over the filtered receipt set. Same filter shape as ListReceipts (no pagination — aggregate is bounded by a hard 10,000-row decode cap). Powers the <ImitationHistogram/> SVG on the Verified Memory dashboard.

V1 aggregation strategy: per-fact imitation_distance lives inside the signed CBOR receipt envelope (not a queryable column), so the service decodes each matched row's envelope_cbor on-read and bins distances in application memory. The 10K row cap (OSY-MEM-5123) keeps this bounded; a denormalized fact-distance table for unbounded windows is tracked as ENG-FU-2.

EdgeIdentityKey-gated; RLS-scoped.

Errors: 5121 (filter validation); 5122 (persistence); 5123 (filter too wide — > 10K matching receipts; caller hint: narrow since/until or add purpose/retriever filter); 5312 (EdgeIdentityKey absent); 5310/5311 (workspace binding/GUC).

ImportArchive

rpc ImportArchive(ImportArchiveRequest) returns (ImportArchiveResponse)

• Kind: unary
• Request type: ImportArchiveRequest
• Response type: ImportArchiveResponse

Import (verify-admit) a signed OMP archive into the calling workspace. Like ImportBundle, the plain import path REFUSES a non-empty target (OSY-MEM-5254); a verified UNION into a non-empty workspace is the MergeArchives verb instead. Errors: OSY-OMP-6500..6525, OSY-MEM-5254.

ImportBundle

rpc ImportBundle(stream ImportBundleChunk) returns (ImportBundleResponse)

• Kind: client streaming
• Request type: ImportBundleChunk
• Response type: ImportBundleResponse

Stream-import a .ome ZIP into the target workspace. Refuses if the target workspace already has prior claims (idempotency / safety).

Errors: 5251..5254 (import / manifest / signature / target-not-empty); 5310..5311.

Insert

rpc Insert(InsertRequest) returns (InsertResponse)

• Kind: unary
• Request type: InsertRequest
• Response type: InsertResponse

Insert a (claim_id, value_hash) pair into the per-workspace JMT. Idempotent on (workspace_id, claim_id, value_hash) — re-insert with the same value_hash is a no-op (200 OK with the unchanged root).

Errors: 5151..5153 (tree insert / proof / inconsistent root); 5310..5311 (WBW).

IssueGrant

rpc IssueGrant(IssueGrantRequest) returns (IssueGrantResponse)

• Kind: unary
• Request type: IssueGrantRequest
• Response type: IssueGrantResponse

Issue a grant for cross-workspace query. V1 enforces same-org-only at the application level (per Master Paper R4 P0.3 Option-(a)-safest); cross-org grants land with V1.5 ClaimKind 19 osyra.claim.workspace.boundary.cross-org-bridge.v1.

Errors: 5302 (cross-org forbidden in V1); 5310..5311.

ListAmgateDecisions

rpc ListAmgateDecisions(ListAmgateDecisionsRequest) returns (ListAmgateDecisionsResponse)

• Kind: unary
• Request type: ListAmgateDecisionsRequest
• Response type: ListAmgateDecisionsResponse

ListAmgateDecisions - paginated history of Attested-Memory-Gate decisions (admits AND denials) for the attested-memory-I/O dashboard (ARC-31 / ADR-281; ENG-2514 edge -> ENG-2421 FE). Mirrors ListReceipts: workspace is the AUTHORITATIVE OS-Workspace-ID identity (ome.workspace_id GUC / RLS), never request input; keyset pagination; sanitized projection (NO crypto inputs). HONEST-SCOPE (ADR-177 D5, non-negotiable): these are CHANNEL-ENFORCEMENT records of the memory I/O channel (input-provenance admission + output-receipt binding) - NOT cognition-control, and NOT a claim that the model only reasons over attested memory. /osyra-legal ENG-1741 gate.

ListClaims

rpc ListClaims(ListClaimsRequest) returns (ListClaimsResponse)

• Kind: unary
• Request type: ListClaimsRequest
• Response type: ListClaimsResponse

ENG-568: workspace-scoped paginated list of OAP-MEM Claim envelopes. Backs the AP00001-edge claims GraphQL query (read-side dashboard).

Tenancy is enforced via (a) EdgeIdentityKey mTLS gate, (b) the OS-Workspace-ID gRPC header binding the ome.workspace_id Postgres GUC for RLS, and (c) the V1 baseline row-level-security policies on the {@code claim} table. workspace identity is server-authoritative.

Filters: since/until (Unix ms; bound on created_at), issuer_did (exact), subject_id (exact), kind (enum), include_tombstoned (bool). All optional; AND-combined. String filters capped at 512 bytes server-side (mirrors ListReceipts DoS guard).

Pagination: opaque cursor + limit (clamped server-side to [1, 200]; default 50). Ordering is (created_at DESC, claim_id DESC) — keyset pagination stable under concurrent inserts. Cursor decodes to (created_at_unix_ms, claim_id_hex); next page returns rows strictly older than the cursor tuple.

Sanitized projection: response carries only safe Claim fields — see {@code ClaimProjection}. The raw {@code body} bytes, {@code signature} bytes, and {@code signer_pub} bytes are NEVER on the wire. The body is exposed via the {@code GetClaimBody} gRPC RPC below (D3 / ENG-2225) — NOT a REST endpoint (an earlier comment referenced a REST path that was never implemented).

Errors: 5320 (cursor decode); 5321 (filter validation, e.g. until<since); 5322 (persistence); 5312 (EdgeIdentityKey absent); 5310/5311 (workspace binding/GUC).

ListReceipts

rpc ListReceipts(ListReceiptsRequest) returns (ListReceiptsResponse)

• Kind: unary
• Request type: ListReceiptsRequest
• Response type: ListReceiptsResponse

Return a paginated page of Verified Memory retrieval receipts emitted by ReceiptEmissionPipeline for the caller's workspace. Backs the AP00001-edge verifiedMemoryReceipts GraphQL query.

Workspace tenancy is enforced via (a) EdgeIdentityKey gate (mTLS service identity), (b) ome.workspace_id Postgres GUC binding for RLS via the OS-Workspace-ID gRPC header, and (c) the V9 row-level-security policies. workspace_did is NOT carried on the request (removed in cross-review HIGH-1; redundant with MDC). DoS hardening: string filters capped at 512 bytes, cursor capped at 256 bytes server-side.

Pagination: opaque cursor + limit (clamped server-side to [1, 200]; default 50). Ordering is emitted_at_unix_ms DESC, receipt_id DESC — keyset pagination stable under concurrent inserts. Cursor decodes to (emitted_at_unix_ms, receipt_id); page-N+1 returns rows strictly older than the cursor.

Filters: since/until (Unix ms), purpose_did / retriever_did (exact), quarantine_class / verdict (enum). All optional; combined as AND.

Sanitized projection (AC2): the response carries only safe fields (see VerifiedMemoryReceiptProjection). Raw signature/pubkey/biscuit/ proof bytes are NEVER on the wire — the proto messages have no fields to carry them, enforcing the contract structurally.

Errors: 5120 (cursor decode); 5121 (filter validation, e.g. until<since); 5312 (EdgeIdentityKey absent); 5310/5311 (workspace binding/GUC).

ListSignerPubs

rpc ListSignerPubs(ListSignerPubsRequest) returns (ListSignerPubsResponse)

• Kind: unary
• Request type: ListSignerPubsRequest
• Response type: ListSignerPubsResponse

Return the active+retired set of Ed25519 public keys authorized to sign MGuardRetrievalReceipt envelopes for a given workspace_did. Used by AP00001-edge (Go gateway) for response-side receipt-verify middleware per ENG-927 (VM-5). The server backs this via MGuardSignerPubCache (60s TTL; LISTEN/NOTIFY invalidation on rotation), so the same query OME's own MGuardEnforcingVerifier consults internally is what Edge sees externally.

Fail-closed semantics per ADR-040 v0.2 §3: an unresolvable workspace_did returns an EMPTY signer_pubs set (not an error); the Edge verifier MUST map empty to a 403 reject. This avoids leaking workspace-existence information via separate NOT_FOUND vs OK status codes.

Edge caching guidance: clients SHOULD cache the result for 60 seconds using a fixed window (NOT the informational valid_until_unix_ms field, which is provided for observability only — using it for TTL would create a thundering-herd at rotation boundaries).

Errors: never throws on missing workspace (empty set returned instead); internal errors mapped to gRPC INTERNAL with OSY-MEM-NNNN code.

ListTraces

rpc ListTraces(ListTracesRequest) returns (ListTracesResponse)

• Kind: unary
• Request type: ListTracesRequest
• Response type: ListTracesResponse

ListTraces — list trace projections filtered by time-range | model_id | broker_request_id within the caller's workspace (design §8 SHOULD). Reads with an EXPLICIT workspace_id predicate; never crosses workspaces. Paginated; capped.

Errors: in V1 an invalid filter maps to the existing TRACE_SCHEMA (OSY-TRACE-7506), distinguished by gRPC/HTTP status + message; a distinct filter-specific code remains RESERVED in the OSY-TRACE 7500-7599 band for a future mint.

ListWitnessEvents

rpc ListWitnessEvents(ListWitnessEventsRequest) returns (ListWitnessEventsResponse)

• Kind: unary
• Request type: ListWitnessEventsRequest
• Response type: ListWitnessEventsResponse

ENG-2073: paginated, workspace-scoped witness-events feed backing the Edge witnessEvents GraphQL query (Witness Auditor dashboard). Projects the signed-claim store (claim + tombstone) — each signed claim is one witness event. operator + claim_kind derive from the claim's ClaimKind; verdict is computed from REAL per-row re-verification (tombstone → sealed; canonical CBOR absent → pending; signature + content-hash binding → valid / invalid), never hardcoded. Workspace is server-authoritative (OS-Workspace-ID header → ome.workspace_id GUC RLS); clients never carry workspace_id.

Errors: 5320 (cursor decode); 5321 (filter validation); 5322 (persistence); 5312 (EdgeIdentityKey absent); 5310/5311 (workspace binding / GUC).

MergeArchives

rpc MergeArchives(MergeArchivesRequest) returns (MergeArchivesResponse)

• Kind: unary
• Request type: MergeArchivesRequest
• Response type: MergeArchivesResponse

Merge ≥2 signed OMP archives into the calling workspace under a VERIFIED UNION (lifting the empty-target restriction): emits the merged OMP archive (live winners), the surfaced-contradiction audit set, and an EAT-hosted, offline- re-decidable Merge Receipt; anchors the merge root. Errors: OSY-EAT-6390..6399.

Prove

rpc Prove(ProveRequest) returns (ProveResponse)

• Kind: unary
• Request type: ProveRequest
• Response type: ProveResponse

Generate an inclusion or non-membership proof for the given claim_id against the current JMT root. Offline-verifier suitable; deterministic.

Errors: 5151 (tree state error).

ProveTombstoned

rpc ProveTombstoned(ProveTombstonedRequest) returns (ProveTombstonedResponse)

• Kind: unary
• Request type: ProveTombstonedRequest
• Response type: ProveTombstonedResponse

Prove that a claim was tombstoned. Returns the JMT inclusion proof at the leaf position, the redacted tombstone_digest (= SHA-256("TOMBSTONE\0" || salt16) — the post-tombstone leaf valueHash), the era_index in which the tombstone was bound, redacted_at timestamp, audit correlation_id, and the workspace_jmt_root at the time of tombstoning. The salt is NEVER returned on the wire — exposing it during an active era reconstructs the dictionary-attack surface ADR-016 closes.

Constant-time + rate-limited (100/500 rps per workspace) + unified MEM_TOMBSTONE_NOT_FOUND (5182) for "never existed" + "never tombstoned" branches (enumeration-probe defense per ENG-1215 §14.47.13.4).

Errors: 5151 (tree state), 5182 (unified not-found), 5186 (era revoked — preimage is no longer recomputable; verifier should treat as cryptographically erased), 5187 (rate limited), 5188 (binding mismatch), 5310..5311 (WBW).

LINEAR: ENG-583.

RefreshOrgRoot

rpc RefreshOrgRoot(RefreshOrgRootRequest) returns (RefreshOrgRootResponse)

• Kind: unary
• Request type: RefreshOrgRootRequest
• Response type: RefreshOrgRootResponse

Refresh the org root (forest-of-merkles aggregate) per ADR-025. Typically called nightly by a scheduled job; admin scope.

Errors: 5310..5311 (admin-scope auth).

RegisterClaimKind

rpc RegisterClaimKind(RegisterClaimKindRequest) returns (RegisterClaimKindResponse)

• Kind: unary
• Request type: RegisterClaimKindRequest
• Response type: RegisterClaimKindResponse

Register a new ClaimKind in the runtime registry. V1: registry is hardcoded (this RPC validates only); V1.5+: dynamic registration with byte-code-validated CDDL schema.

Errors: 5451 (already registered), 5452 (version downgrade).

RegisterWorkspaceKEK

rpc RegisterWorkspaceKEK(RegisterWorkspaceKEKRequest) returns (RegisterWorkspaceKEKResponse)

• Kind: unary
• Request type: RegisterWorkspaceKEKRequest
• Response type: RegisterWorkspaceKEKResponse

Register a customer-controlled KMS CMK (BYOK) for a workspace per ADR-016 A3-Era (ENG-957). Inserts the workspace_kek row + bootstraps era_index=0 atomically: (i) generates a 32-byte era_secret_n via SecureRandom, (ii) wraps under the customer KEK via KMS Encrypt with encryption_context = {tag, workspace_id, era_index, era_created_at_ns}, (iii) persists workspace_era row with the 47-byte byte-blob aad witness (M2). Idempotent on the workspace_id PK: a second call returns the previously-bootstrapped era_index without re-wrapping.

Tier model (M-arch-1): kek_managed_by='customer' for ENT BYOK; 'osyra' for FREE/PRO managed-Osyra path. See ADR-016 §Implementation Notes lines 248-254.

Errors: 5301 (workspace not found); 5310..5311 (admin scope auth); 5351..5353 (KMS / era).

RevokeSignerPub

rpc RevokeSignerPub(RevokeSignerPubRequest) returns (RevokeSignerPubResponse)

• Kind: unary
• Request type: RevokeSignerPubRequest
• Response type: RevokeSignerPubResponse

RevokeSignerPub — granular per-signer_pub revocation distinct from KEK-level cascade per ADR-016. Closes /osyra-security T1 (compromised key, rotated-but- not-revoked forgery window).

ACCESS GATING (per ADR-040 v0.4 §3.20.3):

1. Edge mTLS service identity (OMEService is OME-only; not exposed via Edge public API). Missing identity → OSY-MEM-5312 MEM_EDGE_IDENTITY_REQUIRED. Mirrors EmergencyEraseWorkspace precedent.
2. OPA gate osyra.iam.mguard.allow_revoke_signer_pub: caller MUST hold owner or security-admin role + provide an MFA challenge ID issued ≤15 minutes ago. Rejection → OSY-MEM-5127 MEM_REVOKE_UNAUTHORIZED_ROLE (insufficient role) or OSY-MEM-5128 MEM_REVOKE_STALE_MFA (challenge >15min).
3. Per-workspace rate-limit 10 calls/hour (token bucket via osyra-rate-limit- common). Rejection → OSY-MEM-5137 MEM_REVOKE_RATE_LIMITED.
4. MDC ome.workspace_id MUST equal request.workspace_id (anti-spoof per ENG-587 cross-workspace isolation pattern).

STATE MACHINE (per ADR-040 v0.4 §3.20.2):

• active → revoked (emergency direct-revoke)
• retired → revoked (post-rotation revoke; most common case)
• revoked → revoked is IDEMPOTENT but returns OSY-MEM-5126 MEM_SIGNERPUB_REVOKED so the operator knows the row was already terminal.

RevocationReason restrictions:

• UNSPECIFIED rejected with INVALID_ARGUMENT.
• KEK_CASCADE rejected from external callers (server INVALID_ARGUMENT); KEK_CASCADE is reserved for the ADR-016 cascade path internal to MGuardSigningKeyRepository.revokeAll().

SIDE EFFECTS (atomic transaction):

• workspace_mguard_signing_key row UPDATE key_status='revoked', signerpub_revoked_at=NOW(), signerpub_revoked_reason=reason.
• V6 trigger fires LISTEN/NOTIFY ome.mguard.signing_key.revoked.
• MGuardSigningKeyRevocationListener consumes within ≤1s, invalidates MGuardSignerPubCache for the workspace.
• CRITICAL audit event MEMORY_MGUARD_SIGNER_PUB_REVOKED emitted (10y retention).
• SignerPubChangeEvent{event_type=REVOKED, signer_did, revocation_reason, signerpub_revoked_at_unix_ms} queued for cross-region propagation (ENG-1233 stream RPC).

Errors: 5126 (already-revoked), 5127 (OPA reject), 5128 (stale MFA), 5129 (key not found), 5137 (rate-limited), 5312 (Edge identity required), 5310 (workspace_id missing from MDC), 5311 (workspace_id mismatch).

SetTransparencyPublicRead

rpc SetTransparencyPublicRead(SetTransparencyPublicReadRequest) returns (SetTransparencyPublicReadResponse)

• Kind: unary
• Request type: SetTransparencyPublicReadRequest
• Response type: SetTransparencyPublicReadResponse

Admin RPC to toggle workspace_settings.transparency_public_read (the per-workspace opt-in flag for public-mode anonymous reads). NOT exposed via Edge REST; admin surface only — gated to the EdgeIdentityKey admin-mTLS surface until AP00009 admin-gateway ships. Per CEO directive 2026-05-24: opt-in is deliberate, never silent; admin RPC required to flip; justification mandatory and SHA-256-pinned on the settings row for tamper-evident compliance trail.

Side effects: (a) writes workspace_settings row with new value + set_at + set_by_actor_did + justification_sha256; (b) emits MEMORY_TRANSPARENCY_PUBLIC_READ_CHANGED audit event with RAW workspace_id + RAW actor_did + verbatim justification (admin-trail audience has authoritative access, no public-mode hashing applies); (c) bumps workspace_settings_version counter so Edge LRU caches honour the 60-second TTL invalidation.

Errors: OSY-MEM-5301 (workspace not found); OSY-MEM-5310..5312 (admin scope auth).

Sign

rpc Sign(SignRequest) returns (SignResponse)

• Kind: unary
• Request type: SignRequest
• Response type: SignResponse

Sign a Claim and return a SignedClaim with Ed25519 signature over the canonical CBOR Form B preimage with dsTag "osyra-ome-claim-v1".

Errors: 5101..5106 (sig/preimage/pubkey/dsTag/content-hash/issuer-auth); 5310..5311 (WBW workspace-binding mismatch / missing GUC); 5403 (issuer not in workspace trust anchor).

SignAndInsert

rpc SignAndInsert(SignAndInsertRequest) returns (SignAndInsertResponse)

• Kind: unary
• Request type: SignAndInsertRequest
• Response type: SignAndInsertResponse

ENG-568: atomic sign-then-insert. FUSES the existing Sign + Insert RPCs into a SINGLE SERIALIZABLE transaction. Closes the race window where a separate Sign call succeeds (key signs the preimage) but the subsequent Insert call fails (CAS retry exhaustion, network drop) — leaving an orphan signature in caller memory without a JMT leaf, OR (worse) a JMT leaf inserted via Insert without the corresponding signed-claim row.

Tier-gated: PRO/ENTERPRISE only (mirrors Sign + Insert). FREE tier rejected with {@code OSY-MEM-5108}.

Auth model: standard Edge mTLS identity (EdgeIdentityKey gate) + workspace-binding GUC + RLS. Same as Sign/Insert.

Implementation: under a single REQUIRES_NEW SERIALIZABLE transaction — (1) resolve signer key via WorkspaceSigningKeyProvider, (2) verify optional signer_pub_hint matches canonical pubkey, (3) sign canonical-CBOR Form B preimage with dsTag "osyra-ome-claim-v1", (4) compute value_hash = SHA-256(canonical_cbor(SignedClaim)), (5) UPSERT claim row via ClaimRepository.insertOrUpdate, (6) JMT insert via PersistentJmt.insert (with CAS retry), (7) emit MEMORY_CLAIM_SIGNED + MEMORY_CLAIM_INSERTED audit events.

Any step failure rolls back the whole transaction. This is the load-bearing invariant for the GraphQL writeClaim mutation atomicity promise (ENG-568 plan §10 OQ-4 default).

Errors: 5101..5106 (sig/preimage/pubkey/dsTag/content-hash/issuer-auth); 5108 (tier not entitled); 5151 (JMT insert), 5160 (CAS retry exhausted); 5310..5312 (WBW / Edge identity); 5330 (atomicity invariant violation — rollback path traced).

StreamSignerPubChanges

rpc StreamSignerPubChanges(WorkspaceFilter) returns (stream SignerPubChangeEvent)

• Kind: server streaming
• Request type: WorkspaceFilter
• Response type: SignerPubChangeEvent

ENG-1233 — Server-streaming RPC for real-time SignerPubChangeEvent propagation to Edge replicas. Pillar of the ADR-040 v0.4 §3.4 / §3.20 production posture for bounded-staleness flag-flip.

WIRE-FREEZE SHA-256 (LOCKED at ENG-1235 ratification; CONSUMED here): cfee621c737a59e3c5934e7a97c5a6a7d40ea5ca98336da5b53faf61d1a736ab

Computed as: sha256(vec-01-rotated.cbor || vec-02-revoked-compromise.cbor || vec-03-kek-revoked.cbor) in that LITERAL order. The streaming RPC carries the SAME 13-field SignerPubChangeEvent message already locked at ENG-1235; ENG-1233 owns the SHA gate via the StreamSignerPubChangesKATTest assertion that re-runs the byte-identity check against the 3 published vectors on every PR.

OPA gate: osyra:ome:signerpub:stream:read (subscriber-mTLS-identity → workspace_did authorization; clamps requested filter to the subscriber's allowed set). PERMISSION_DENIED on empty intersection + audit MEMORY_SIGNERPUB_STREAM_AUTHZ_DENIED.

Sequence-number dedup keyed on (source_region, workspace_did, sequence_number) 3-tuple per ADR-040 v0.4 §3.4.2 (sliding 5-min window on Edge side). Within (source_region, workspace_did) monotonic order is guaranteed by the V13 signer_pub_change_event_sequence allocator.

Stream lifetime: 24h forced re-auth (server-side context-timeout) per ADR-040 §3.4.4. Reconnect-forever loop on the Edge side rebuilds the subscription state (workspace_did filter + last-seen sequence-number resume cursor); audit MEMORY_SIGNERPUB_STREAM_DISCONNECTED on disconnect.

STREAM_GAP signaling: when the producer-side ring buffer overflows or sequence-number resume falls outside the 7-day event-log retention window, server emits Status.DATA_LOSS + audit MEMORY_SIGNERPUB_GAP_DETECTED. Edge MUST trigger full cache rebuild via existing ListSignerPubs path before resuming.

Errors: 5127 (OPA reject), 5128 (stale MFA), 5141 (stream-gap detected), 5142 (subscriber buffer overflow), 5312 (Edge identity required).

Tombstone

rpc Tombstone(TombstoneRequest) returns (TombstoneResponse)

• Kind: unary
• Request type: TombstoneRequest
• Response type: TombstoneResponse

Tombstone a claim — overwrite its leaf valueHash with a tombstone digest derived from an era-secret-bound salt; preserves all sibling proofs (design §1.6 + Master Paper §3.5 redactable-Merkle invariant). Additionally physically destroys the claim body row (hard DELETE FROM claim) inside the same SERIALIZABLE transaction (ENG-583 AC #2 — body cryptographically unrecoverable). Emits MEMORY_TOMBSTONED audit event with hashed claim_id + reason_code + actor_id payload.

GDPR Art. 17 / EU AI Act Art. 26 implementation gate.

Errors: 5151 (tree state), 5160 (CAS retry exhausted), 5181 (claim_id not found), 5183 (cross-era duplicate), 5184 (reason_code UNSPECIFIED or detail >256ch), 5185 (authz denied), 5188 (workspace binding mismatch), 5310..5311 (WBW), 5351..5353 (era_secret unavailable / revoked / KMS).

LINEAR: ENG-583.

VerifyBundle

rpc VerifyBundle(VerifyBundleRequest) returns (VerifyBundleResponse)

• Kind: unary
• Request type: VerifyBundleRequest
• Response type: VerifyBundleResponse

Verify bundle integrity without materialising it into a target workspace. Use case: audit / forensic consumers, or pre-import validation.

Errors: 5251..5253.

VerifyFull

rpc VerifyFull(VerifyFullRequest) returns (VerifyResponse)

• Kind: unary
• Request type: VerifyFullRequest
• Response type: VerifyResponse

High-assurance verify: signature + DID resolution (via IAM) + trust-anchor check

• content-hash verification when the body is included. Default verification path for external callers and audit consumers.

Errors: 5101..5106, 5401..5403 (DID resolution / trust anchor / issuer authz).

VerifyGrant

rpc VerifyGrant(VerifyGrantRequest) returns (VerifyGrantResponse)

• Kind: unary
• Request type: VerifyGrantRequest
• Response type: VerifyGrantResponse

Verify a grant prior to executing a cross-workspace query.

Errors: 5302.

VerifyInBand

rpc VerifyInBand(VerifyInBandRequest) returns (VerifyResponse)

• Kind: unary
• Request type: VerifyInBandRequest
• Response type: VerifyResponse

Verify by extracting the signer pubkey embedded in the SignedClaim.signer_pub field (legacy pre-ADR-008 path; deprecated post-V1 once all signers populate out-of-band trust-anchor lookups instead).

Errors: 5101..5103, 5403 (signer not in workspace trust anchor).

VerifyMergeReceipt

rpc VerifyMergeReceipt(VerifyMergeReceiptRequest) returns (VerifyMergeReceiptResponse)

• Kind: unary
• Request type: VerifyMergeReceiptRequest
• Response type: VerifyMergeReceiptResponse

Offline re-decide an EAT-hosted Merge Receipt: the verifier independently recomputes the merge over the supplied input archives and FORCES the receipt's claimed digests/counts to equal the recomputation (acceptance is not a trusted verdict). Replay/forgery/wrong-kind/substituted-input reject. Errors: OSY-EAT-6390..6399.

VerifyProof

rpc VerifyProof(VerifyProofRequest) returns (VerifyProofResponse)

• Kind: unary
• Request type: VerifyProofRequest
• Response type: VerifyProofResponse

Verify a proof against a root. Stateless / deterministic.

Errors: 5151 (proof structurally invalid).

VerifyRetrieval

rpc VerifyRetrieval(VerifyRetrievalRequest) returns (VerifyRetrievalResponse)

• Kind: unary
• Request type: VerifyRetrievalRequest
• Response type: VerifyRetrievalResponse

VerifyRetrieval - re-decide an osyidx verifiable-retrieval response server-side, equivalent to the offline relying-party re-decision (ENG-2513 / ARC-19 / ADR-232). Wraps ai.osyra.ome.osyidx.OsyidxReDecider: manifestSig (under the relying-party PINNED index public key, never receipt-supplied) AND freshness (manifest_ver >= hwm, monotone HWM advance) AND per-hit content-rebind + radix-16 JMT inclusion. The index public key + the consumer high-water-mark are caller-supplied out-of-band pinned inputs; the workspace is the AUTHORITATIVE OS-Workspace-ID identity, never request input. The source the AP00001-edge verifyRetrieval GraphQL mutation proxies (unblocks ENG-2471). Per-hit verdicts carry OSY-OSYIDX-84xx codes; a malformed request is INVALID_ARGUMENT.

VerifyTokenCapital

rpc VerifyTokenCapital(VerifyTokenCapitalRequest) returns (VerifyTokenCapitalResponse)

• Kind: unary
• Request type: VerifyTokenCapitalRequest
• Response type: VerifyTokenCapitalResponse

ENG-2524 (ARC-28, ADR-265/266/267): the OTCC VerifyTokenCapital convenience RPC — re-decides, OFFLINE-equivalently and WITHOUT trusting the trainer, that the counterfactual benchmark gain Δ = score_B(M_full) − score_B(M_¬S) committed in a signed otcc.v1 receipt body is re-derivable from the OME corpus. It resolves the committed ensemble_cid/bench_cid against the workspace's registered OTCC corpus claims (osyra.otcc.ensemble/osyra.otcc.benchmark, the ENG-2521 ClaimKinds), RE-RUNS the deterministic ablation-codeword ensemble forward over the pinned benchmark, and recompute-and-byte-compares the re-derived Δ + the FROZEN digest constructions — NEVER trusting the issuer's number.

CONVENIENCE, NOT THE TRUST ANCHOR: this RPC is byte-for-byte identical to the air-gapped offline library (OtccOfflineReDecider) — there is exactly ONE re-decision implementation; the RPC merely resolves the corpus from the live store first. An air-gapped relying party re-derives the SAME verdict from an .ome corpus bundle with no service. The offline path is the trust anchor (the RPC adds nothing a relying party must trust).

CROSS-IMPL CONFORMANCE: the re-decision is reason-/byte-identical to the AP00016 Go re-decider (the otcc.v1 EAT re-decider, ENG-2522) on the SAME frozen vectors. This RPC re-decides the BODY; the enclosing EAT envelope COSE_Sign1 + (ws, eat_nonce) burn remain the AP00016 verifier's job.

DETERMINISM HONESTY (ADR-266): the DETERMINISTIC-SURROGATE path re-derives Δ bit-exact (EXACT). A DENSE-LLM ensemble (TOLERANCE until ODRE batch-invariant kernels graduate, ADR-244 V2.0) needs a model-execution substrate not present in this process — modeled as a pluggable resolver. NO fabricated Δ in any path.

DoS BOUND (ADR-270 co-sign): the O(|ensemble|·|B|) re-derivation cost is bounded BEFORE the forward pass (OTCC_REDERIVATION_TOO_LARGE); the surfaced rederivation_cost lets a relying party budget it.

Workspace is SERVER-AUTHORITATIVE (OS-Workspace-ID header → ome.workspace_id GUC), NEVER a request field — it is the verified ws the LEG0 tenant binding checks. A reject is a RESULT (accepted=false + a non-OK reason), NOT a transport error.

VerifyWithPubkey

rpc VerifyWithPubkey(VerifyWithPubkeyRequest) returns (VerifyResponse)

• Kind: unary
• Request type: VerifyWithPubkeyRequest
• Response type: VerifyResponse

Verify a SignedClaim's signature against a caller-supplied public key. Use case: Edge Gateway has pre-resolved the issuer DID and cached the pubkey; this path skips the IAM ResolveDid round-trip.

Errors: 5101..5103 (signature invalid / preimage decode / pubkey mismatch).

VerifyWitness

rpc VerifyWitness(VerifyWitnessRequest) returns (VerifyWitnessResponse)

• Kind: unary
• Request type: VerifyWitnessRequest
• Response type: VerifyWitnessResponse

Verify a CompletenessWitness offline. Caller-supplied expected_root and signer_pub MUST match the witness payload; signature verification is performed BEFORE root comparison (design /osyra-security M2 v1.0.4 — avoids the root-equality oracle side-channel).

Errors: 5201..5204 (gen / verify / gap-proof / top-K-out-of-range).

WitnessTop

rpc WitnessTop(WitnessTopRequest) returns (WitnessTopResponse)

• Kind: unary
• Request type: WitnessTopRequest
• Response type: WitnessTopResponse

Generate a top-K signed completeness witness with gap proofs over the current workspace JMT. Signature uses dsTag "osyra-ome-cw-v1".

Errors: 5151 (tree state), 5201 (witness generation), 5212 (TOMBSTONE_SALTS_REQUIRES_AUDIT_MODE — ENG-782), 5213 (TOMBSTONE_SALT_MISMATCH — ENG-782 audit-mode verification), 5310..5311 (workspace binding / scope; includes ENG-782 AUDIT_MODE_AUDIT without audit:read scope, and ENG-783 dual-form signer-key reference).

WrapReceiptEnvelope

rpc WrapReceiptEnvelope(WrapReceiptEnvelopeRequest) returns (WrapReceiptEnvelopeResponse)

• Kind: unary
• Request type: WrapReceiptEnvelopeRequest
• Response type: WrapReceiptEnvelopeResponse

Server-side wrap of an inner Pillar-1 receipt payload in the cross-product osyra-receipt-envelope-v1 wrapper. Used by direct-MGUARD-aware clients to produce envelope bytes without depending on the universal verifier SDK (which lands in VM-5 / V1.5 per ADR-039 v0.2 §"Cross-product trust chain").

The server signs the envelope under the workspace's MGUARD signing key (ADR-040 v0.2 KmsTwoTierSigningKeyProvider); caller supplies an already- signed inner payload (MGUARD, BAR, OMP-archive, or FORGET-RECEIPT). The inner_ds_tag MUST be in the AllowedInnerDsTags allowlist (ADR-039 v0.2 §2).

Errors: 5108 (tier not entitled), 5117 (inner_ds_tag unknown), 5119 (inner payload > 1 MiB cap), 5404 (purpose_did missing), 5354..5356 (KMS / KEK signing failures), 5107 (generic emission failure).