# WG Paid — responsibility contract V2

## VM121 authoritative

- user/email;
- invite and redemption;
- access grant and expiry;
- protocol quotas;
- connection profile ownership;
- keys/credentials;
- desired peer enabled state;
- provisioning intent;
- audit/payment state.

## VM100 authoritative

- `wg_paid` and planned `awg_paid` runtime peers;
- protocol-specific peer application;
- tunnel-IP collision validation;
- selector membership and selector class;
- selector load;
- canonical selector state;
- topology-aware redistribution;
- peer + selector transaction and verification.

## VM101 authoritative

- external public UDP reception;
- DNAT/forward to VM100;
- current egress slot health;
- selector-to-egress mapping;
- slot exhaustion/topology generation;
- Direct/fallback runtime.

## Enable contract

VM121 -> VM100:

- operation_id;
- profile_id;
- protocol_code;
- public_key;
- encrypted/securely transferred PSK as required;
- tunnel_ip;
- desired_enabled=true;
- desired generation.

No selector.

VM100:

- chooses target interface from protocol;
- adds peer;
- assigns selector;
- renders selector rules;
- verifies;
- returns structured ACK.

## Disable contract

VM121 -> VM100:

- operation_id;
- profile_id;
- protocol_code;
- public_key/tunnel IP;
- desired_enabled=false.

VM100 removes runtime peer and selector membership transactionally.

## VM101 transport contract for AmneziaWG

VM101 receives a separate UDP public port and forwards it to the `awg_paid` listen port on VM100.

VM101 does not terminate the user AWG tunnel and does not store user peers.

## Reconcile invariant

For each enabled profile:

```text
VM121 desired profile
= protocol runtime peer on VM100
= exactly one VM100 selector membership
```

Selector values are inspected only on VM100.