feat: implement scoped join attempts and tickets (#10)

Closes #10

docs/api/rendezvous-v1.json

@@ -686,8 +686,28 @@
               }
             }
           },
-          "501": {
-            "description": "Not Implemented",
+          "400": {
+            "description": "Bad Request",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Not Found",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "503": {
+            "description": "Service Unavailable",
             "content": {
               "application/json": {
                 "schema": {
@@ -726,8 +746,109 @@
               }
             }
           },
-          "501": {
-            "description": "Not Implemented",
+          "400": {
+            "description": "Bad Request",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Not Found",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "409": {
+            "description": "Conflict",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "429": {
+            "description": "Too Many Requests",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "503": {
+            "description": "Service Unavailable",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/v1/join-attempts/{attemptId}": {
+      "delete": {
+        "tags": [
+          "Join attempts"
+        ],
+        "operationId": "CancelJoinAttempt",
+        "parameters": [
+          {
+            "name": "attemptId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "X-Rendezvous-Client-Punch-Capability",
+            "in": "header",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No Content"
+          },
+          "400": {
+            "description": "Bad Request",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "404": {
+            "description": "Not Found",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ApiError"
+                }
+              }
+            }
+          },
+          "503": {
+            "description": "Service Unavailable",
             "content": {
               "application/json": {
                 "schema": {

docs/architecture/0003-state-privacy-availability-and-budgets.md

@@ -64,7 +64,7 @@ them but must not raise them without security review.
 | Browser page | 100 listings and 256 KiB encoded response; opaque cursor; stable bounded sort |
 | UDP datagram accepted | 1,200 bytes; oversized or fragmented application payloads are dropped without response |
 | Opaque HTTP credential | 1,024 bytes encoded |
-| UDP capability or ticket | 768 bytes encoded, with the complete datagram still at most 1,200 bytes |
+| UDP capability or connection ticket | 192 base64url characters; NAT punch capabilities also remain below LiteNetLib's 256-character token ceiling; complete datagram at most 1,200 bytes |
 | Clock skew | 30 seconds maximum when validating issued/not-before/expiry times |
 | Lease lifetime | 60 seconds; renewal accepted from 30 seconds; no client-selected extension |
 | Host presence freshness | 20 seconds |

docs/architecture/0008-scoped-join-attempts-and-tickets.md

@@ -0,0 +1,66 @@
+# ADR 0008: scoped join attempts and one-time connection tickets
+
+- Status: Accepted
+- Date: 2026-07-16
+- Tracking: #10
+
+## Decision
+
+Join creation is an unauthenticated public operation because v1 does not treat a
+Rendezvous caller as game identity. The HTTP source address is normalized and
+converted to a process-keyed opaque subject for idempotency and bounded policy
+accounting; raw addresses and the derived subject are never returned or logged.
+A successful request means only that this network client may try to connect to
+this active session. It does not reserve capacity or grant gameplay admission.
+
+Creation validates the v1 contract, caller idempotency key, enabled tenant policy,
+exact gameplay protocol, listing scope, live lease, and fresh authenticated host
+presence in one atomic store operation. A listing advertised as full remains
+joinable because its player count is advisory and the game host owns the final
+capacity, identity, ban, and admission decision.
+
+Each attempt derives independent host-punch, client-punch, and connection-ticket
+credentials plus opaque attempt and mediation IDs from a process-ephemeral HMAC
+key, the client subject, the complete canonical request fingerprint, a fresh salt,
+and a purpose/role label. Credentials are 32-byte base64url values (43 characters),
+below both the 192-character Rendezvous capability ceiling and LiteNetLib's
+256-character NAT token ceiling. State retains keyed credential fingerprints,
+derivation inputs, and salt—not issued plaintext. All diagnostic string
+representations redact credentials and derivation material.
+
+The client receives only its punch capability. A host polls its own listing with
+the lease token in `X-Rendezvous-Lease-Token` and receives only host-role
+capabilities through a signed, listing-bound, five-minute cursor. Replaying an
+identical join request returns the same live attempt; changing the request under
+the same owner/key conflicts. A client may cancel with its punch capability in
+`X-Rendezvous-Client-Punch-Capability`; cancellation atomically removes the
+attempt. Listing deletion, expiry, revocation, or process restart removes every
+associated attempt and credential fingerprint.
+
+Endpoint binding remains role- and capability-specific. The first endpoint
+observed for a role wins atomically; an exact UDP duplicate is idempotent, while
+endpoint or role substitution is rejected. An introduction is consumable once
+only after both roles bind, so concurrent attempts for the same listing cannot
+cross-wire.
+
+The connection ticket is distinct from both punch capabilities and is reproduced
+only after introduction succeeds. Its window begins at that moment and lasts at
+most 20 seconds without outliving the 30-second attempt. The server has an atomic
+fingerprint-consumption seam for mediator tests and revocation. On the game host,
+the SDK's bounded `ConnectionTicketValidator` stores a process-keyed digest,
+accepts an exact ticket once under a lock, rejects altered/cross-attempt/expired/
+revoked/replayed tickets, and zeroes retained digests and key material on disposal.
+Issue #11 carries the ticket in the authenticated introduction; issue #12 wires
+authorization and consumption into the caller-owned LiteNetLib coordinator.
+
+## Consequences
+
+- A join attempt is transport authorization, never proof of player identity or a
+  game slot.
+- Network-address-derived subjects are process-local abuse/idempotency scopes,
+  not stable user identifiers; stronger authenticated player scopes require a
+  future game-owned identity contract.
+- Cancellation after a ticket has reached a host must also revoke that host's
+  local validator entry; coordinator wiring owns that race in issue #12.
+- Capability and ticket plaintext never enter browser results, state snapshots,
+  logs, metrics, or generated string representations.

docs/architecture/README.md

@@ -10,6 +10,7 @@ decision requires a superseding ADR and corresponding contract/test updates.
 - [ADR 0005: authenticated session lease and presence lifecycle](0005-session-lease-lifecycle.md)
 - [ADR 0006: bounded compatible session browser](0006-compatible-session-browser.md)
 - [ADR 0007: caller-owned .NET publisher and browser SDK](0007-caller-owned-dotnet-client-sdk.md)
+- [ADR 0008: scoped join attempts and one-time connection tickets](0008-scoped-join-attempts-and-tickets.md)
 - [Threat model](../security/threat-model.md)
 - [Security promise and test matrix](../security/control-matrix.md)
 - [Versioned HTTP and UDP contracts](../contracts/README.md)

docs/contracts/http-v1.md

@@ -33,6 +33,7 @@ the same value as a required query parameter.
 | `GET` | `/v1/sessions` | Browse compatible public sessions. |
 | `GET` | `/v1/sessions/{listingId}` | Resolve a public or explicitly shared unlisted listing. |
 | `POST` | `/v1/join-attempts` | Authorize and create a short-lived join attempt. |
+| `DELETE` | `/v1/join-attempts/{attemptId}` | Cancel an attempt using its client punch capability. |
 | `GET` | `/v1/sessions/{listingId}/join-attempts` | Let an authenticated host poll pending attempts. |
 | `POST` | `/v1/join-attempts/{attemptId}/outcome` | Report a bounded connection outcome. |
 | `GET` | `/health/live` | Report that the HTTP process is alive. |
@@ -49,6 +50,11 @@ for mutation operations are carried in their request bodies. Public browser
 responses contain no IP endpoints, lease tokens, punch capabilities, connection
 tickets, player identifiers, or gameplay state.
 
+Attempt cancellation sends the short-lived client punch capability in
+`X-Rendezvous-Client-Punch-Capability`. Join creation uses the observed HTTP
+source only for a process-keyed, short-lived idempotency/abuse scope; this is not
+player authentication and is never returned to callers.
+
 ## Idempotency, cursors, and retries
 
 Registration and join creation require a caller-generated visible-ASCII