Changes touching this path
- TS SDK slice 2: author & push a signed public change (#424)
The write half of the in-memory loop: a pre-registered key edits files and
pushes a signed full-tree change to the relay, read back to confirm. All
composition (change-id fold, dual signatures, bundle encode, /stow
envelope) stays in Rust/WASM (#381); TS owns only the capture-first overlay.
Prefactor:
- Move the change-id fold into loot-codec (change_id module:
compute_change_id_raw / change_signing_message / mint_change_id /
canonical_predecessors); loot-core's compute_change_id(&Change) delegates.
Behavior-preserving (loot-core 296 tests unchanged).
- loot-codec: seal_uncompressed (the wasm author path can't run zstd).
- loot-identity: public Identity::from_seed(&[u8;32]) (the flagged #383/#424
ctor, native side).
loot-wasm:
- Identity.sign + wrapEnvelope ([0x01][pubkey][sig][bundle], sig over bundle).
- ChangeBuilder: carry(unchanged) / put(edited, seals uncompressed public) /
finish() -> {envelope, changeId, versionId} — folds, signs the finalize
message, encodes the Sync frame, wraps the envelope, all in Rust.
- Golden parity (Seam 2) extended: frozen pubkey, signature, envelope bytes,
and change-id fold — green natively and under wasm-pack test --node.
sdk/:
- Capture-first overlay: edit/remove mutate an in-RAM overlay that IS the
pending change; describe names it; status/diff report it; push composes via
ChangeBuilder (carry unchanged paths, put edited, skip removed) and POSTs
the envelope to /stow, returning the durable change-id.
- Seam 1: a write behavior suite drives a real relay whose allow-list holds
the SDK key; the SDK authors the first change and reads it back through a
fresh connection (4 tests). Full SDK suite: 9 green.
Slice 2 authors PUBLIC content stored UNCOMPRESSED (valid + readable; zstd's C
won't build for wasm, and fzstd is decompress-only). Deferred: unauthorized
error mapping (slice 3), private/grant writes (slice 4).
Refs #424, #421.
2defc2f5 · dbf3dbe6… - Slice 2 review fixes: dedup envelope framing, rename, precondition errors (#424)
Addresses the code-review findings on 8e70ef8:
- loot-wasm: extract `envelope_bytes` — the `/stow` framing is now written
once and shared by `Identity::wrap_envelope` and `ChangeBuilder::finish`
(was duplicated). Parity vectors unchanged (byte-identical), confirming the
dedup is behavior-preserving.
- Rename `set_parent`/`setParent` -> `add_parent`/`addParent`: it appends
(push loops over merge heads), so "add" matches the accumulate semantics.
- sdk push() preconditions (no describe / nothing pending) now throw a plain
Error, not `LootError("conflict", …)` — "conflict" means a real same-path
bounce, not a caller usage bug.
- Seam 1: assert the landed change carries its describe message on the wire
(AC#5's "the message is visible"), since the v1 surface has no `log` verb.
- Honest comment on carry's visibility collapse (public-only in slice 2;
grant-id preservation is slice 4).
Green: native + `wasm-pack test --node` parity; 10 SDK tests.
Refs #424.
285b6cb5 · dbf3dbe6…diff - the readiness waits over a spawned binary in sdk stop being budgets and start ending on the host itself, and the reason they were never seen to fire is now written where a reader meets them: every behaviour suite that stands a relay up polled a real loot serve behind Date.now() plus 20 seconds, which is a SMALLER budget than the 30 seconds that already lost in #1693 over a LARGER startup, and the 60 second beforeAll hook outside it sat inside the same measured spread, so raising the inner number alone would have left the effective bound where it was. the new sdk/test/spawned-host.ts has three endings and only the last is a clock: the probe succeeding, which is the condition these suites actually need since it proves the host ANSWERS rather than that it printed a line; the child exiting, reported with its code instead of polled at for the rest of the wait, seeded from the childs recorded state as well as its future exit event so a host already gone is not waited on; and a backstop carrying the same 600 seconds tutorial.rs carries, off the same saturated measurement and for the same reason, with the hook timeout derived strictly larger so the named refusal wins the race. the fixture generator imports that module rather than restating it, which node does by stripping the types itself. THE BEHAVIOUR SUITES CANNOT PIN ANY OF THIS AND THE CONTROL SAYS SO: with the condition deleted outright the whole sdk suite still read 11 files passed, because an idle machine has the relay up before the next await, so a dedicated pin over a spawned node child carries it instead. red under mutation, counts read each time: the exit ending deleted failed two of the three pins on vitests own timeout (2 failed and 1 passed, both at 5000ms, the wait running on to the backstop), the already-gone seed dropped failed the third alone (1 failed and 2 passed), and the probe discarded so the wait returns on the first look failed all three (3 failed and 0 passed, asked 1 against 3 and two promises resolving instead of rejecting), each restored to 3 passed and the sdk suite to 129 passed over 12 files. the gate question is NOT answered here and #2080 still owns it, but the sdk README now states what decides it and gives the grep that checks it rather than listing the workflows, and tutorial.rs stops naming budgets that no longer exist. no migration, no wire or format byte moves and no host behaviour moves, so this owes no deploy. the workspace suite is green (4178 passed over 133 binaries, 9 ignored) (#1914)
2cac70f9 · dbf3dbe6…diff - a relay with a push allowlist now gates its reads on it too: every relay read route was unauthenticated while every bundle carries the key for every Internal object (ADR 0011), so an allowlisted relay.millerbyte.com served this private repo to a stranger key in plaintext (#2388). a route is a read when its answer comes from the store, and the store now sits behind Hold, whose only doors are a gated read and a gated write, with the router built from one match over Route that has no wildcard, so a later route cannot answer from the store ungated; the reads today are /negotiate, /offer, /fetch, /wants and /haves, /info stays the one open probe, and the grant lane is unchanged. with no list a relay stays open and unsigned, and loot serve and loot-relayd now warn at startup that anyone who can reach it can clone everything, Internal content included. /info advertises authenticated_reads and a client signs its reads iff it is advertised, so a new client reads an old relay unsigned and an old client gets a 401 naming the upgrade; loot seek records the posture and the SDK signs its reads the same way. no format constant moves. ADR 0011 and 0015 amendments, CONTEXT.md, the forge spec, sdk README and the site cli, guides and concepts pages say it. red under mutation, counts read: gate never on (the stranger clone succeeds), gate admitting any valid key, the 401 without the upgrade wording, /haves filed as open, /info not advertising, client never signs, client signing whenever a list exists, the startup warning dropped, the SDK never signing; each restored to green. workspace suite 4539 passed over 141 binaries, 13 ignored; SDK 145 of 145; site gate green (777). owes a release before loot serve users get it; the live relay stays stopped (#2389)
f6b5ecc7 · dbf3dbe6…diff
Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.