[ty-everett]

Program and scope

Message Box uses KnexSessionManager for HTTP authentication, but its service migrations never create the required auth_message_nonces table. A database with auth_sessions alone returns HTTP 500 during the first BRC-103 handshake, even while health and independently managed WebSocket authentication pass.

Add the service-owned replay-table migration with the schema expected by the durable session manager. Refuse a down migration that would discard any replay claim. Document additive deployment, migration-ledger compatibility and separate HTTP/WebSocket acceptance.

• Coordination: BotBoard [BotBoard][closed] ty-everett / Codex — SDK explicit-originator discovery compatibility #586; [BotBoard][closed] ty-everett / Codex — PR 569 review and main integration #585 acknowledged separate Message Box ownership.
• Service candidate remains the existing unpublished @bsv/messagebox-server 1.1.45; no public npm version changes.
• No AuthFetch, auth middleware, Toolbox implementation, request permission or replay-policy relaxation.

Verification

• Real HTTP regression reproduces the old-schema 500, then authenticates and sends a signed request across two replicas with separate Knex-backed session managers. Replaying the exact request against the other replica returns 401 without reaching the application.
• Shared initial-request claims reject duplicates; normal migration replay is a no-op; a nonempty down migration fails without losing the table.
• Full service tests and coverage: 227 tests / 27 suites pass. Service types, build, lint and format pass.
• Root health, lint, format, workspace build and typecheck pass. SDK fix(sdk): preserve BRC100 discovery and signed action history #587 is incorporated from current main.
• Isolated MySQL rehearsal using the deployed 1.1.44 runtime and two restored schemas applies only the new migration, preserves all nine existing application tables per schema with exact definitions/counts/checksums, applies nothing on repeat, rejects a duplicate replay claim and refuses populated rollback. Real HTTP acceptance with the deployed runtime returns 200 and rejects a replay against the other replica with 401.
• Exact-head ecb119ae26ad6cfe66bc29bf10710ac69f61a475: all applicable hosted checks, CodeQL, zero-new-Sonar, container runtime contract and merge-gate pass. Scope-based skips are validated by merge-gate.
• Final diff reviewed for schema compatibility, atomic replay claims, failure behavior and rollback. All review conversations resolved; CodeQL alert 284 is fixed by rate limiting the test HTTP server.

Security, release and operations

• No credentials, identity data or deployment-specific names included.
• Existing messages, sessions, permissions and payment-recovery tables are not rewritten.
• No dependency override, new suppression, skipped test or quality-threshold change.
• Keep the replay table and its migration file during recovery/rollback; never disable replay checks or clear claims to recover availability.
• Protected image publication, staging-first deployment and live HTTP/WebSocket acceptance remain separate steps. No rollout is claimed by this PR.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[ty-everett]

Maintainer review of exact head ecb119ae26ad6cfe66bc29bf10710ac69f61a475 is complete. This is the authoring agent’s maintainer review, not an independent second review.

The additive schema matches KnexSessionManager: the composite primary key makes claims atomic across replicas, with adequate identity/session lengths and the existing expiry index. No authentication rule, replay check, existing application row or API format is weakened. Populated rollback is deliberately refused; documentation preserves the table and migration ledger across recovery.

The regression reproduces the missing-schema initial HTTP 500, then proves real signed HTTP requests with two database-backed replicas and rejects replay on the other replica. All 227 service tests, root/service checks and an isolated MySQL rehearsal pass. The rehearsal preserved definitions, counts and checksums of all nine existing application tables in each of two schemas and used the deployed runtime for HTTP/replay acceptance.

All applicable exact-head CI checks, zero-new-Sonar, CodeQL, container runtime contracts and merge-gate passed. CodeQL alert 284 was corrected with an actual rate limiter; its review thread is resolved. No finding suppression or threshold change. Existing unpublished service candidate remains 1.1.45. Publication and deployment remain separate verified steps.

No blocking correctness, security, compatibility or operational issue remains in this diff. Maintainer/admin integration is authorized by the operator’s instruction and the repository policy.