Files
amethyst/quartz/src
Vitor PamplonaandClaude Opus 5.5 ce640e7742 fix(mls): send the UpdatePath when a commit leaves us alone in the group
Harness test 29 (disband amy->wn) failed because wn never applied the disband.
Instrumenting MDK showed why: its convergence replay rejects the commit with
openmls `InvalidCommit(RequiredPathNotFound)`.

RFC 9420 §12.4.1 requires an UpdatePath on any commit carrying a Remove,
whatever the tree size. MlsGroup.commit() built the path only when path
secrets were derived. When the proposals leave the committer as the only leaf
(a disband, or removing the last other member), the direct path is empty, so
the commit went out with no path at all. White Noise dropped every such commit:
a disbanded group stayed live there, and removing the only other member (the
device case where WN kept showing itself as a member) never reached it.

The path is now sent whenever it's required; over an empty direct path it
carries just the new leaf. The commit secret then matches openmls's
derive_path with zero nodes: the starting path secret itself. Nobody else
can open that epoch, since the committer is alone.

Harness test 34 had passed with the bug: it looked for a member list in
`wn groups show`, which has none. It now reads `wn groups members` like test
06 does. It and test 29 fail without this fix and pass with it; a quartz unit
test pins the path on a remove-the-last-member commit. Test 29 now saves wn's
full group view for diagnosis.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-09-28 09:32:44 -04:00
..