spaces: a member wears a key minted for that room alone, so a roster stops naming personas

src-tauri/src/inbox.rs

@@ -53,6 +53,19 @@ pub enum Cargo {
     SpaceInvite(SpaceInvite),
     SpaceKey(SpaceKeyCargo),
     ProposalPing(ProposalPing),
+    SpaceJoin(SpaceJoin),
+}
+
+/// The answer to an invitation: "here is the key I will wear in your Space."
+/// The room key is what lands on the published roster; `proof` is the joiner's
+/// PERSONA signature over it, and it stops at the owner — publishing it would
+/// tie the two together again and undo the point.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SpaceJoin {
+    pub space_id: [u8; 16],
+    pub owner: [u8; 32],
+    pub room_key: [u8; 32],
+    pub proof: Vec<u8>,
 }
 
 /// "Someone put a proposal on your playlist's board." Carries only enough to
@@ -495,6 +508,7 @@ async fn dispatch(app: &tauri::AppHandle, sender: [u8; 32], cargo: Cargo) {
         Cargo::SpaceInvite(i) => crate::spaces::on_inbox_invite(app, sender, i).await,
         Cargo::SpaceKey(k) => crate::spaces::on_inbox_space_key(app, sender, k).await,
         Cargo::ProposalPing(p) => crate::proposals::on_inbox_proposal(app, sender, p),
+        Cargo::SpaceJoin(j) => crate::spaces::on_inbox_join(app, sender, j).await,
     }
 }
 
@@ -554,7 +568,14 @@ mod tests {
         });
         assert_eq!(index(&share), 3, "Share moved — sealed shares in flight are now unreadable");
         assert_eq!(index(&key), 5, "SpaceKey moved — sealed keys in flight are now unreadable");
+        let join = Cargo::SpaceJoin(SpaceJoin {
+            space_id: [8u8; 16],
+            owner: [9u8; 32],
+            room_key: [10u8; 32],
+            proof: vec![1, 2, 3],
+        });
         assert_eq!(index(&ping), 6, "a new variant must be appended, never inserted");
+        assert_eq!(index(&join), 7, "a new variant must be appended, never inserted");
 
         let back: Cargo = bincode::deserialize(&bincode::serialize(&ping).unwrap()).unwrap();
         match back {