Every accepted mutation proves authority and state.

WorkSession-scoped mutation headers

Every WorkSession-scoped mutating operation uses the HostAuth security scheme and requires these protocol headers. Hosts own the authentication system.

• Jarvis-Protocol-Version
• Jarvis-Actor-Id
• Jarvis-Idempotency-Key
• Jarvis-Request-Timestamp
• Jarvis-Expected-WorkSession-Revision
• Jarvis-Previous-Event-Hash

WorkSession genesis rule

createWorkSession is the genesis WorkSession mutation. Compatible implementations MUST require Jarvis-Expected-WorkSession-Revision set to 0 and Jarvis-Previous-Event-Hash set to hash:protocol-genesis.

The accepted WorkSession snapshot starts as active at revision 1 with first event type work_session.created.

Non-WorkSession mutation headers

Worker registration, Actor registration, and OutcomeReport submission use the HostAuth security scheme and require the non-WorkSession mutation header set. Hosts own the authentication system.

• Jarvis-Protocol-Version
• Jarvis-Actor-Id
• Jarvis-Idempotency-Key
• Jarvis-Request-Timestamp

They MUST NOT require fake WorkSession revision or previous event hash values.

Read and export headers

WorkSession-scoped read operations and EvidenceManifest export reads use the HostAuth security scheme and require Jarvis-Protocol-Version and Jarvis-Actor-Id. Hosts own the authentication system.

Read and export operations MUST NOT require mutation-only idempotency, expected revision, or previous event hash headers.

Accepted state checks

Rejection rules

• The protocol rejects missing protocol version, Actor, idempotency key, timestamp, expected revision, or previous event hash when required.
• The protocol rejects stale request timestamp, stale WorkSession revision, previous event hash mismatch, unauthorized Actor, and Actor mismatch.
• The protocol rejects forbidden host-private fields in portable records and exports.
• The protocol rejects sealed WorkSession and EvidenceManifest mutation.