Why is `HrmpChannelAccepted` described as only being safe to originate from a relay chain and not a parachain?

Question

I am reading through this section of XCM Instructions : https://github.com/paritytech/polkadot/blob/97930a8b2cc211ecfb80f289c4c578a9157e6dc4/xcm/src/v2/mod.rs#L532-L565 And what I find here is that both HrmpNewChannelOpenRequest & HrmpChannelAccepted have comments saying that these messages must or rather are only safe when originated on a relay chain. I am not familiar with HRMP channels so can someone explain to me, why should both of these messages be relay-chain origin only?

My understanding is that a channel open request could be sent by either the parachain or the relay chain, and HrmpChannelAccepted should be a message to acknowledge the aforementioned request. So what is different ?

Answer 1

HRMP is a stop-gap protocol for XCMP, it stores all messages in the Relay Chain storage. Before the channel is opened, the two parachains are not interoperable, and can only establish a connection with the VMP through the relaychain.

When ParachainA wants to open a channel to ParachainB, ParachainA should send XCM Transact(hrmpInitOpenChannel) to relaychain, then the relaychain send XCM HrmpNewChannelOpenRequest notification to ParachainB via DMP. So the origin is relaychain.

When ParachainB wants to accept the channel request, ParachainB should send XCM hrmpAcceptOpenChannel to relaychain, then the relaychain send XCM HrmpChannelAccepted notification to ParachainA via DMP. So the origin is relaychain.