Access Control

Exact invites bootstrap access; short-lived Access Leases authorize every open; revocation fences access at advancing epochs.

Life of an authorization

flowchart TD Share["tubo share pipe/x
(provisions Exact Authority)"] --> Invite["one-time invite (10 min TTL)"] Invite -->|redeem once + possession proof| Accept["accepted relationship
(durable binding, epoch N)"] Accept -->|renewal per open| Lease["Access Lease (minutes, epoch N)"] Lease -->|receiving-boundary verify| Open["Pipe open → Session"] Revoke["tubo revoke pipe-access"] -.->|epoch N → N+1| Accept Revoke -.-> Lease

What each credential can and cannot do

Credential	Lifetime	Can	Cannot
Exact invite	10 minutes, one use	bootstrap one accepted relationship	open a Pipe, renew, outlive redemption
Accepted binding	until revoked	renew short leases per open; survive restarts	authorize anything by itself
Access Lease	minutes	authorize one Pipe open for one subject	be replayed, swapped across Pipes or subjects, outlive expiry

Revocation

# An invite that was never redeemed (JTI or the full token)
$ tubo revoke invite <token>          # fenced at the redemption boundary

# An already-accepted invite (its Pipe is resolved from redemption evidence)
$ tubo revoke invite <jti>

# All access to a Pipe: advances the authorization epoch
$ tubo revoke pipe-access pipe/myapi

pipe-access revocation advances the epoch: accepted relationships and outstanding leases become stale immediately; a fresh share + connect re-authorizes at the new epoch.
Revocation checks happen before any target dial and fail closed on unavailable state.
A revoked-not-yet-redeemed invite never burns: redemption denies with zero state mutation.

Determinism

Exactly one authoritative accepted relationship exists per (Pipe, recipient). A newer invite for the same pair replaces it; the same recipient retrying never regresses it; a different recipient fails closed. Obsolete invite revocations are harmless; revoking the current invite's JTI fences renewal.