mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
DuncanandWill Pfleger
664b679f8f
Add owner-consent archive/unarchive commands, workspace-epoch seqlock
protocol, NIP-IA ownership classifier, and Instances Sheet UI.
Rust (desktop/src-tauri):
- WorkspaceEpochWriteGuard (workspace_epoch.rs): RAII seqlock writer guard
with SeqCst ordering, writer-mutex serialization, and guaranteed even
restoration on every exit path including panic/unwind. All three production
key writers (resolve_persisted_identity, commit_imported_identity,
apply_workspace) participate; apply_workspace spans its compound
override+keys mutation under one guard.
- AppState extended with workspace_epoch: AtomicU64 + workspace_write:
Mutex<()> for the seqlock protocol.
- capture_archive_scope: bounded-retry reader that accepts only equal-and-even
epoch samples, ensuring keys and relay_url_override come from one workspace
generation.
- ArchiveScope { keys, actor, api_base_url, workspace_epoch }: immutable
snapshot consumed by every fetch/classify/mint/sign/submit in the scoped
archive operation.
- NipIaOwnerProof classifier: enum verified|missing_profile|missing_auth|
multiple_auth_tags|invalid_auth|owner_mismatch. Reuses verify_auth_tag
(syntax + signature only, no condition-clause evaluation per NIP-IA rule 6).
- scoped_archive_operation: single non-Tauri fn owning the full
fetch→classify→mint→build/sign→submit pipeline for both 9035 (archive) and
9036 (unarchive). Fresh empty-condition auth tag minted after Verified
classification; never copies the profile tag.
- archive_agent / unarchive_agent: thin #[tauri::command] wrappers.
- Keyring helpers extracted to app_state_keyfile_ops.rs to stay under the
file-size ratchet (app_state.rs: 998 gate lines, limit 1080).
- Relay acceptance tests (identity_archive/tests/identity_archive_relay_tests.rs):
five #[ignore]d tests requiring live relay+Postgres, selected by the new
desktop-tauri-relay-acceptance just recipe and the Backend Integration CI
gate. Tenant fixture makes Self and Admin impossible; 9035 asserts
consent_path='owner' in Postgres; 9036 asserts emitted delta.
- Deterministic epoch protocol tests (app_state_epoch_tests.rs): no infra,
always-required in desktop-tauri-test/Desktop Core gate. Tests: initial
capture, writer exclusion+capture retry, RAII restoration (drop/early-
return/catch_unwind), poisoned-mutex error, mixed-generation barrier test.
TypeScript (desktop/src):
- tauriIdentityArchive.ts: archiveAgent/unarchiveAgent Tauri bindings.
- hooks.ts: useOwnedAgentInventoryQuery hook with additive cache invalidation.
- InstancesSheet.tsx: instances sheet opened from Instances (N) card action;
shows tri-state archive status, start-control safeguard for 3rd instance.
- PersonaActionsMenu.tsx: onViewInstances prop wired to InstancesSheet.
- UnifiedAgentsSection.tsx: Instances button in agent card actions.
- relayQueryInvalidation.ts: ownedAgentInventoryQueryKey registration.
CI/Justfile:
- desktop-tauri-relay-acceptance just recipe: _ensure-sidecar-stubs +
nextest selector for in-crate relay acceptance module.
- Backend Integration (relay e2e) job: new step just desktop-tauri-relay-
acceptance after relay startup; job if extended to desktop-rust; Tauri Linux
apt deps + rust-cache for desktop/src-tauri; timeout raised.
Thread: nostr:nevent1qqs0jp4fmfhaxcm7etlyq9csgwhg73j44f2akkhcnzfnk7s0w6rxptqpz24mxk
Plan: v9, APPROVE by Thufir (event 7dd99118), baseline 8342dfcc
Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>