sequenceDiagram
    participant Device
    participant DHV as DEK Holder Validator
    participant Chain as CometBFT Chain
    participant BT as BitTorrent Network

    Device->>DHV: access request<br/>{ cid, device_x25519_pubkey }<br/>signed by Ed25519

    DHV->>Chain: read access policy for CID
    Chain-->>DHV: policy + conditions

    rect rgb(40, 40, 60)
        Note over DHV: Policy Evaluation
        DHV->>DHV: verify Ed25519 signature
        DHV->>DHV: evaluate policy<br/>(Casbin or Goja)
    end

    alt Access Granted
        DHV->>Chain: GrantAccess tx<br/>(audit: Ed25519 key + CID + timestamp)
        DHV->>DHV: wrap DEK to device X25519 pubkey
        DHV-->>Device: wrapped DEK
        Device->>BT: fetch .tdf<br/>(rendezvous on encrypted CID)
        BT-->>Device: encrypted .tdf blob
        Device->>Device: unwrap DEK with device X25519 private key
        Device->>Device: decrypt .tdf → FLAC
        Device->>Device: play
    else Access Denied
        DHV-->>Device: denied + reason
    end
