nx_mls_group.nx

nx_mls_group.nx -- C7 of the comms lane: MLS-CLASS EPOCHED GROUP RATCHET (RFC 9420 key schedule). Contract symbol mls_epoch_advance == the /compare/comms C7 watch. REFEREE: nx_mls_group_gate. DONE-RULE (comms.plan): RFC 9420-class epoched group keys on chat AND calls; member removal forces an epoch advance and the gate PROVES a removed member cannot decrypt the next frame (negative control), with forward-secrecy and post-compromise teeth; replaces the static room key. HONEST SCOPE, stated so nothing is over-claimed: this implements the RFC 9420 KEY SCHEDULE and its security properties -- one-way epoch chaining (forward secrecy), commit-secret injection (post-compromise security), and membership-bound epoch secrets (removal excludes). Commit secrets are distributed to the remaining members by FLAT per-member X25519 (O(n) wraps). TreeKEM's ratchet tree is the O(log n) DISTRIBUTION efficiency, and it is a follow-on, NOT a security gap -- every property proven by the gate is the same property TreeKEM delivers, just distributed pairwise here. PURE COMPOSITION of the sovereign primitives, no new crypto: x25519 (RFC 7748 ECDH) + sha256 (FIPS 180-4, as HMAC/HKDF-Expand) + chacha20 (RFC 8439). No WebRTC, no OpenSSL, one auditable stack. THE PROPERTIES, and how each is a tooth: * epoch_secret is per-member, never transmitted; only COMMITMENTS sha256("commit-check"||secret) are printed, so the gate can prove convergence without exposing a secret. * advance: prk = HMAC(old_epoch_secret, commit_secret); new = HKDF-Expand(prk,"epoch",group_ctx). One-way (HKDF) => forward secrecy. commit_secret fresh + ECDH-wrapped => post-compromise. * group_ctx = sha256(group_id || epoch || roster) => the epoch secret is BOUND to the membership, so a divergent roster diverges the secret (defence in depth behind the wrap exclusion). * a removed member is absent from the new roster, so no wrap is addressed to it: apply REFUSES, and even holding the old epoch_secret it cannot reach the new one (no commit_secret). * frames are real ChaCha20 sealed under framekey=HKDF(epoch_secret,"app",seq) + an HMAC tag, so open with the WRONG epoch_secret fails the MAC -- the removed member cannot open the next frame. license_tier: ORIGINAL No hw writes (Rule 26).