mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
DuncanandWill Pfleger
0c24b692bf
Addresses all 7 blocking and 1 minor finding from Thufir's pass 1: CRITICAL: Inventory author/agent confusion - Extract agent pubkey from kind:30177 d-tag; never treat ev.pubkey (owner) as agent - Fetch agent's kind:0 separately; verify NIP-01 id+signature before classifying - All NipIaOwnerProof variants preserved in OwnedAgentInstance IMPORTANT: Exhaustive race-safe inventory - fetch_all_owned_30177 pages to exhaustion with composite (until, before_id) cursor - All state captured via capture_archive_scope (seqlock epoch) before I/O - Reject malformed d-tags; dedup with canonical (created_at DESC, id ASC) - Drop dead cursor API; return one complete snapshot IMPORTANT: Approved model + Sheet behavior - InstancesSheet: persona filtering, Archive/Unarchive via ArchiveConfirmDialog, 'Relay only' badge for non-local instances, archive trust unknown retry - Rows link to exact-pubkey profile; mutations gated by NipIaOwnerProof::Verified IMPORTANT: Start-control safeguard - handleStartPersonaWithSafeguard in UnifiedAgentsSection: opens Sheet when inventory loading/untrusted or active relay instance exists; prevents 3rd mint - Card-level focusable Instances (N) button with aria-expanded/aria-controls IMPORTANT: Acceptance tests — observation seam - SubmitObserver captures signed request + attempt count - 9035: asserts auth_tags.len()==1, empty condition, Postgres consent_path='owner' scoped by community, kind:8002 delta consent=owner + actor - 9036: kind:8003 delta consent=owner + actor - self: asserts 0 auth tags both directions - rejection: asserts exactly 1 attempt (no retry) - Fixture queries relay_members to assert actor absence (not just a comment) IMPORTANT: Classifier exact-one-tag rule - Count ALL auth tags (any first element='auth') before arity check - Wrong-arity → InvalidAuth; malformed+valid → MultipleAuthTags - Verify fetched kind:0 NIP-01 id/sig; authored by target; kind:0 - Tests: wrong-arity, malformed-plus-valid, bad-sig, missing-profile reachable IMPORTANT: Recovery-mode signing gate - capture_archive_scope checks identity_lost/keyring_locked inside epoch window - Tests: lost/locked both return Err containing 'recovery mode' Structural split: identity_archive.rs → inventory.rs + mod.rs - inventory module: paging, d-tag extraction, kind:0 fetch+verify, classification - mod.rs: scoped operation, classifier, archive/unarchive commands, shared helpers - Relay acceptance tests remain in-crate under relay_acceptance module Biome format fixes in UnifiedAgentsSection.tsx and InstancesSheet.tsx Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>