lfg2025/archy
1
0
Fork 0
Code Issues 24 Pull Requests 4 Actions Packages Projects Releases 74 Wiki Activity
Files
39d53d212ef2fbb5562ee179e4cfcf28e05a91a9
archy/.planning/STATE.md
T

34 KiB
Raw Blame History

gsd_state_version, milestone, milestone_name, current_phase, current_phase_name, status, stopped_at, last_updated, last_activity, last_activity_desc, progress
gsd_state_version milestone milestone_name current_phase current_phase_name status stopped_at last_updated last_activity last_activity_desc progress
1.0 v1.8.0 milestone 13 aiui-functional-conversational-node-control-and-content-surf executing 13-14 AT TASK 3 BLOCKING HUMAN-VERIFY GATE 2026-08-06. Tasks 1+2 COMPLETE+pushed (d419141a eighteen cases, 27aa5ccd harness; evals 23/23, crate 1258/1258, zero release-binary footprint). Task 3 = E-02/E-09 comprehension study: NON-TECHNICAL reviewer (not the builder, not a systems person) reads three write dialogs in a scripted 6-action session on archi-dev-box (3 reads must produce zero dialogs), 10s timer each, verbatim answers recorded, >=2/3 correct or FAIL recorded with their words; dialogs verbatim into summary. Node needs CURRENT build+frontend redeploy before the session. Resume-signal: approved + 3 dialog texts + n/3 score. NO SUMMARY yet. 2026-08-06T05:40:00.000Z 2026-08-06 13-13 complete (Routstr backend — Nostr discovery, OpenAI chat, Cashu payment via auto_pay_token; AssistantBudget arithmetic ceiling, BudgetExhausted stop, D-04 chain complete)
total_phases completed_phases total_plans completed_plans percent
13 2 60 51 15

Project State

Project Reference

See: .planning/PROJECT.md (updated 2026-07-29)

Core value: A third-party developer can publish an app via the signed/decentralized registry and a user can install it on their node — manifest-driven, rootless, secure, robust. Current focus: Phase 13 — aiui-functional-conversational-node-control-and-content-surf

Current Position

Phase: 13 (aiui-functional-conversational-node-control-and-content-surf) — EXECUTING Plan: 13 of 15 complete (13-01..13-13) — next: 13-14 Status: Ready to execute Last activity: 2026-08-06 — 13-13 complete (Routstr backend — Nostr discovery, OpenAI chat, Cashu payment; AssistantBudget arithmetic ceiling; D-04 chain complete)

Progress: [████████░░] 87%

Performance Metrics

Velocity:

  • Total plans completed: 11
  • Average duration: —
  • Total execution time: —

By Phase:

Phase Plans Total Avg/Plan
02 11 - -
Per-Plan Metrics:
Plan Duration Tasks Files
Phase 02 P01 100min 3 tasks 5 files
Phase 02 P03 45min 3 tasks 5 files
Phase 02 P02 105min 3 tasks 11 files
Phase 02 P04 150min 3 tasks 12 files
Phase 02 P05 50min 2 tasks 8 files
Phase 02 P06 73min 2 tasks 7 files
Phase 02 P07 75min 3 tasks 5 files
Phase 02 P08 ~190min 3 tasks 4 files
Phase 02 P09 130min 3 tasks 3 files
Phase 02 P10 55min 2 tasks 3 files
Phase 02 P11 ~150min 3 tasks 8 files
Phase 01 P01 n/a-continuation 2 tasks 1 files
Phase 13 P07 ~3h45m 2 tasks 5 files
Phase 13 P08 ~7h45m (elapsed, w/ session restart) 3 tasks 10 files
Phase 13 P10 ~2h45m 2 tasks 10 files
Phase 13 P11 27min 3 tasks 12 files
Phase 13 P12 ~4h35m (shared-box compute contention) 3 tasks 9 files
Phase 13 P13 ~4h (shared-box compute contention, session crash-recovered mid-Task-3) 3 tasks 6 files

Accumulated Context

Roadmap Evolution

  • Phase 1 added (2026-07-29): Federation & Mesh Hardening — user-directed top priority (node removal/sync issues, mesh attachment parity incl. demo); prior phases shifted down
  • Phase 2 added (2026-07-29): UI Performance — slow tab switches and secondary screens; prior phases shifted down
  • FED-05 added to Phase 1 (2026-07-29): inter-node Lightning channel-opening UX (share node URI, pick trusted/federated nodes by hostname, request channels with public nodes); UI tested on :8100 dev preview against archi-dev before deploy
  • FED-06 added to Phase 1 (2026-07-29): on-brand paid-tick animation — screensaver ring + EQ segments (reuse ScreensaverRing.vue compact) replacing the success burst in SendBitcoinModal.vue
  • Phase 9 added (2026-07-30): BotFights Platform Upgrade — native nostr signer login, unified AI bot-setup prompt replacing docs page, shared public match endpoint on VPS2 (all nodes see all fighters), registry/manifest update. Independent of Phases 1–8.
  • Phase 13 added (2026-08-03): AIUI — Conversational Node Control & Content Surfaces. User-directed: AIUI is embedded and styled but non-functional — chat cannot act on the node, content surfaces are unwired. Scope is (a) Pine's human-language intent→action capability reachable from typed chat, (b) conversational settings, (c) peer files / music / IndeeHub movies / node content rendered live, (d) a user-granted capability sandbox keeping keys, secrets and identity material away from the browser and the model — the user called this out explicitly as non-negotiable. Spans two repos: this one and git.tx1138.com/lfg2025/AIUI (branch development, clone at ~/Projects/AIUI). Appended, not inserted — numeric position is append order, not priority.
  • Phase 10 added (2026-08-01): Key-Material Hardening — KEY-01/F-01 (Critical: unauthenticated seed.generate/seed.restore overwrite a live node's identity keys), KEY-02/F-03 (fail-open first-boot secret regeneration over a fleet-shared rootfs), KEY-03/F-13 (BIP-84 private key imported into Bitcoin Core), KEY-04 (on-node verification of the audit's UNVERIFIED checklist). Sourced from docs/security/ENTROPY-SEED-AUDIT-2026-07-31.md (quick task 260731-upz). Appended rather than inserted to avoid renumbering a roadmap with concurrent uncommitted edits — numeric position is append order, not priority; F-01 is Critical and live on the fleet.

Decisions

  • [Phase 13, D-19 (2026-08-03)]: AIUI's source migrated into this repo at aiui/, via git subtree with its full 230-commit history (7ba3109b, from AIUI development @ e30ac1d). Supersedes D-15's two-repo premise and voids D-18 entirely. Retires the recurring "AIUI commit stranded local-only" failure (windows 4 and 17) — e30ac1d came across in the import and is now pushed. D-17 (standalone mode) is unaffected: archy has no root package.json, so AIUI's pnpm/turbo workspace does not collide. Consequence: plans 13-06, 13-09, 13-11 still target /home/archipelago/Projects/AIUI/ absolute paths and must be re-planned before wave 2; 13-09's scripts/aiui.pin deliverable is now meaningless for an in-repo directory.
  • [Phase 13, wave 1]: Recovered from a broken-pipe interruption that left 13-01 and 13-02 executor work uncommitted in orphaned worktrees. Both were checkpointed verbatim before any agent touched them, then re-committed atomically per task by continuation executors (both chose reset --soft + recommit). 13-03 was already complete and was fast-forwarded in.
  • [Phase 13, execution mode]: parallelization: false — this 4-core box thrashed (load 35-55, 15G/23G swap) running two worktree cargo builds concurrently alongside a live node (bitcoind/electrumx/lnd). Serial execution is strictly faster here.
  • [Phase 13, 13-04 / D-13 one-way half (2026-08-04, operator)]: Music entity model recorded in 13-MUSIC-MODEL.md BEFORE any node indexes a library — hybrid-identity ((source, canonical path) row key + lazily-backfilled content-hash dedupe column), derived-albums (albums/artists computed at read time, never stored rows), index-format-json (data_dir/music/index.json, content_server.rs precedent), sources = both OwnLibrary and Peer. MUSIC_SCHEMA_VERSION starts at 1; an older binary treats a newer-versioned index as absent (log + empty in-memory index, never overwrite) until an explicit reindex.
  • [Phase 13, 13-04 Task 2 (2026-08-04, operator)]: lofty 0.24.0 approved through the blocking-human package-legitimacy gate ([ASSUMED] in 13-RESEARCH.md's audit); dep tree reviewed, no networking crates. Media-root confinement in extract_tags is a parameter (media_roots), checked via canonicalize before any file open (T-13-20).

Decisions are logged in PROJECT.md (10 locked ADRs in the <decisions> block + milestone decisions table). Recent decisions affecting current work:

  • Milestone version = 1.8.0-alpha (decided 2026-07-08)
  • Phase-3 Quadlet default-flip is gated on the second-node gate reporting clean (do fresh, never stage uncommitted)
  • Workstream D (DHT distribution) deferred to v2 — design-only backlog
  • Canonical manifest schema = core/container/src/manifest.rs (code wins over spec doc)
  • [Phase ?]: Marketplace is the 02-02 tracer tab (worst-measured main tab, 2033ms revisit) matching the user's own 'often app store' complaint
  • [Phase ?]: ContainerAppDetails.vue confirmed fully unreachable dead code (no importer, no route) — no serial-RPC-waterfall target exists in the measured D-09 surface set
  • [Phase ?]: archi-dev-box UI password was unknown/undiscoverable from this environment — paused at a checkpoint:human-action rather than guessing or falling back to a mock baseline silently
  • [Phase ?]: Purged the resource cache on logout via clearAll() + a generation guard, so no in-flight fetch from an ending session can repopulate memory or sessionStorage (T-02-02)
  • [Phase ?]: AppDetails/MarketplaceAppDetails/OpenWrtGateway converted to per-item (or single-key) keyed useCachedResource; CloudFolder.vue's existing store-level cache left as-is (cloud.ts TTL gate is a follow-up, out of this plan's file scope)
  • [Phase ?]: Wallet/send flow (SendBitcoinModal.vue) reported as an unplanned-item gap — named by findings as owned by 02-03 but not in files_modified; its cost is pure client-side remount, not a caching problem
  • [Phase ?]: PERF-03 reverted to Pending in REQUIREMENTS.md after an initial mark-complete was premature — its own text requires real-node-hardware verification, which is 02-08's job (also declares PERF-03); 02-03 delivers the code-level portion only
  • [Phase ?]: 02-02: DashboardRouterView final shape uses statically-named per-route KeepAlive wrapper components (dashboardViewWrappers.ts) with :include name-matching, restoring pre-restructure view-wrapper DOM/animations byte-for-byte after a checkpoint-caught regression
  • [Phase ?]: 02-02: HARD RULE for rest of Phase 02 — perf work must be visually invisible; verify against the real dev preview before considering a checkpoint satisfied
  • [Phase ?]: 02-02: app-catalog persist:true ttl 300000ms; bitcoin.prune-status persist:true ttl 30000ms — both explicit per T-02-01, no default relied on
  • [Phase ?]: 02-02: PERF-02 reverted to Pending/In-Progress in REQUIREMENTS.md after an automated mark-complete run — PERF-02 also spans 02-04..02-07 (extending KeepAlive caching to every remaining main tab); this plan proves the architecture on the tracer tab only
  • [Phase ?]: 02-04: KEEP_ALIVE_PATHS widened to every audited main tab (10 paths) derived from TAB_ORDER + /dashboard/discover; /dashboard/settings deliberately withheld — its child sections (SystemDangerZone reboot poll, several onMounted-only fetches) were never audited by this plan
  • [Phase ?]: 02-04: onActivated is a documented no-op outside a KeepAlive boundary — every arm function now runs from both onMounted and onActivated (fresh-mount guards on Home/Web5/Mesh/Server avoid doubling first-load RPC cost); caught by CloudPeersRefresh.test.ts
  • [Phase ?]: 02-04: useCachedResource.ts's onActivated no longer eagerly force-loads a never-fetched immediate:false resource, so tab-gated lazy data (Cloud.vue Paid Files/My Files) isn't force-loaded merely by its view entering the KeepAlive cache
  • [Phase ?]: 02-04: AIUI blank-screen-and-loading symptom reported at Task 3 checkpoint diagnosed as pre-existing (local mock-backend dev mode sets VITE_AIUI_URL=http://localhost:5173 unconditionally with no AIUI repo checked out) — not a regression, left for 02-07 (Chat/AIUI) to address
  • [Phase ?]: 02-05: mesh.refreshAll()/transport.fetchStatus() stay uncached at the store level (other callers need guaranteed-fresh reads); the useCachedResource wrapper around each lives in Mesh.vue instead, since Pinia's defineStore(id,setup) runs in a bare effectScope where onActivated() silently no-ops
  • [Phase ?]: 02-05: FLAGGED - RESEARCH.md's premise that Mesh.vue owns a D3 force simulation is incorrect for this codebase (verified via grep); only NetworkMap.vue/Federation.vue has one. Task 2's D3 truths are vacuously satisfied; only the real Leaflet map lifecycle (MeshMap.vue, added to scope) was implemented
  • [Phase ?]: 02-05: per-group TTL/persist table - mesh.refresh-all/federation-nodes/self-onion/self-did/contacts all persist:false (identity payload); transport-status persists (aggregate, non-identity); reachability groups get 10s TTL, identity groups 300s
  • [Phase ?]: 02-06: RESEARCH A3 settled — none of Server's seven load-group loaders consumes another's result; concurrent fan-out is correct as-is
  • [Phase ?]: 02-06: Five of Server's seven groups were already on useCachedResource from a pre-phase legacy commit (ea254f63) with only composable defaults (30s TTL, persist:true) — this plan's work was explicit TTL/persist/dedup, not initial conversion; only loadDiskStatus was a genuinely uncached plain fetch
  • [Phase ?]: 02-06: Home's wallet composite does NOT share a cache key with Web5.vue's web5.lnd-info — sharing would either corrupt Web5's typed entry.data or fail to close the sessionStorage gap since Web5.vue's own hook (out of scope) defaults persist:true
  • [Phase ?]: 02-06: homeStatus.refresh() wrapped by useCachedResource at Home.vue (the view), not inside the homeStatus Pinia store — defineStore(id,setup) runs in a bare effectScope where onActivated() silently no-ops, same finding as 02-05's Mesh.vue
  • [Phase ?]: 02-07: AIUI source located mid-plan at git.tx1138.com/lfg2025/AIUI (base branch development, not stale main); AIUI-side D-14 commit 900c0b9 initially local-only (anonymous push 403) then pushed/merged upstream onto development by the orchestrator using a user-supplied write token
  • [Phase ?]: 02-07: D-14a fixed via new ?chatExpanded param overriding chat.ts's chatCollapsed default (never persisted to localStorage); D-14b fixed via new ?mobileChat param re-asserting ChatPage.vue's mobileTab='chat' once on mount, guarding against module-singleton content-panel state surviving an internal AIUI remount
  • [Phase ?]: 02-07: PERF-02 marked Complete in REQUIREMENTS.md — 02-02 through 02-07 extended KeepAlive/useCachedResource to every main tab, each dev-preview-verified against archi-dev-box per D-11
  • [Phase ?]: 02-08: KEEP_ALIVE_MAX left at 6, now backed by an on-device memory reading (4 cycles, 11 tabs, JS heap fluctuating 10-21MB, no monotonic growth) rather than the FA-D estimate
  • [Phase ?]: 02-08: archy-x250-dev offline for the entire plan (checked 3x); archi-dev-box (D-11's named target) is the only dev-pair node this phase reached
  • [Phase ?]: 02-08: the harness's remount-probe field is confounded for main tabs once real KeepAlive keeps multiple instances alive simultaneously; corrected via an independent, reproduced-twice verification rather than editing the frozen 02-01 harness — revealed Server.vue genuinely does not survive a round-trip (open gap, not hidden)
  • [Phase ?]: 02-08: a user-reported Cloud first-visit navigation regression was treated as release-blocking, not known-open, per explicit direction — root-caused to content.browse-peer's unbounded, untimed-enough per-peer RPC fan-out starving Chromium's connection pool; fixed via a concurrency cap + shortened timeout, verified 5/5, user-approved on-node
  • [Phase ?]: 02-08: 4 other user-reported UX issues (Paid Files window.open, PiP not closing lightbox, missing loader on Paid Files item-open, PiP not surviving tab changes) classified as pre-existing (predate phase 2 via git history) and captured into UIFIX-04/05/06, not fixed
  • [Phase ?]: 02-09: /dashboard/server's (and Web5's) 'genuinely remounts' reading was a proven probe-measurement artifact (generic .view-container selector can't disambiguate the foreground tab from other still-connected cached tabs) — confirmed via document.elementFromPoint() hit-test contradicting the naive verdict across device runs; no source change needed, pinned with vm.$.uid-based regression tests instead
  • [Phase ?]: 02-09: committed neode-ui/e2e/perf/keepalive-remount-probe.spec.ts as a re-runnable, instrumented probe covering every KEEP_ALIVE_PATHS tab, replacing the ad-hoc 02-08 probe so this class of false positive cannot recur
  • [Phase ?]: [Phase 2, gap closure 02-10]: Wallet/send-flow's timing regression cleared as environmental noise (re-measure at/below baseline); Discover/Server/Web5/AppDetails/OpenWrtGateway confirmed as real, phase-2-caused client-side render/reactivation regressions via 3-run dispersion + git bisection, recorded as accepted deviations (not fixed — deploy blocked mid-session by a shared-tree hazard with concurrent security-follow-up and BotFights sessions)
  • [Phase 2, gap closure 02-11]: Real cause of the six regressions was NOT compute-bound render cost (CPU profile: 86-99% idle/program, <10% JS self-time everywhere) — it was three background pollers (useFleetData.ts 60s, FipsNetworkCard.vue 15s, Web5Monitoring.vue 30s) armed in onMounted and never disarmed once their owning views joined KEEP_ALIVE_PATHS in 02-04, invisible to that audit because it grepped the top-level view files, not the child composables they delegate to. Gated to onActivated/onDeactivated, mirroring 02-04's own established pattern. Fixed: web5 275ms (was 566ms baseline/1329ms regressed), server 574ms (was 738/1239), fleet 790ms (was 330/2631)
  • [Phase 2, gap closure 02-11]: Discover (1389ms, worst remaining) has a SECOND, distinct cause: card-stagger/showStagger entrance-animation classes are baked into the DOM at first mount and never programmatically removed, so every KeepAlive detach/reattach cycle restarts the CSS animation on reactivation — replaying the full entrance cascade on every revisit. Confirmed via a diagnostic (DOM card count doubling transiently on every revisit) and an extended animation-event log. NOT fixed — blast radius spans 5+ files outside 02-11's scope (Apps.vue, Marketplace.vue, Home.vue, several Web5 sub-cards), needs its own real-device verification budget; recommended as a dedicated follow-up
  • [Phase 2, gap closure 02-11]: openwrt-gateway unmeasurable in the final re-measure (Chromium "Target crashed" cascading from an unrelated surface, cloud-folder, earlier in the same harness run) — recorded as not-measurable, not written in as data. Separately confirmed the prior baseline/after/remeasure numbers were measuring a real, substantive disconnected-state UI (OpenWrtGateway.vue's h1 is unconditional; a "No router configured" RPC error deterministically renders a real Connect-to-Router form, not a blank/error page) — the six-surface regression count is not retracted, but the numbers reflect one specific code branch (no OpenWrt device has ever been connected to archi-dev-box)
  • [Phase ?]: 01-01: record_peer_transport and update_node routed through FEDERATION_STORE_LOCK via *_inner; tombstone-write-failure test added; full-suite verify blocked by a concurrent agent's uncommitted install.rs edit (unrelated file, not fixed per scope boundary)
  • [Phase ?]: UIFIX-02: connected-nodes card height tracks row sibling via xl:flex-1 xl:basis-0 (zero-basis flex-grow) instead of flex-auto, with an xl:min-h-[40rem] floor for a short sibling (discovery disabled), tuned from an initial 20rem guess per Dorian's live feedback
  • [Phase ?]: 13-07: media_roots = filebrowser/Music + purchased-content (both D-13 sources as local roots); music.reindex incremental:true wires refresh_incremental to a production caller; one comparator everywhere with TrackId (source,path) tiebreak
  • [Phase ?]: [Phase 13, 13-08]: System prompt rewritten to make the model call destructive tools directly rather than text-asking for confirmation — the original wording ('every write requires a human confirmation') read as 'collect consent in text first', which skipped the tool call and dropped the user's typed 'confirmed' into a void on the next stateless turn
  • [Phase ?]: [Phase 13, 13-08]: CONFIRM_TIMEOUT raised 120s->300s and the full HTTP timeout chain (rpcClient, assistant.chat 420s, AIUI bridge 180s->430s) raised past it, so transport can no longer time out a human reading the confirm dialog before the confirm gate itself does
  • [Phase ?]: [Phase 13, 13-08]: Declined actions remembered per-turn in ToolExecCtx, keyed by the same action_key the approval nonce binds; execute_tool refuses a re-ask for that exact action before the gate reopens, closing a retry loop where a declined action kept re-prompting (T-13-50 mechanized)
  • [Phase ?]: [Phase 13, 13-10]: OllamaBackend leads the D-04 chain via POST /api/chat (never assist.rs's /api/generate); model_supports_tools() probes /api/show and process-caches the answer, turning AI-SPEC's qwen2.5-coder [ASSUMED] tool-capability note into a runtime fact; FallbackChain falls through to Claude on a transport error mid-turn, not just at initial selection
  • [Phase ?]: [Phase 13, 13-10]: history.rs persists the full ChatMessage transcript per CallerScope-derived HistoryKey under data_dir, atomic (temp+rename) and 0600, with wallet/files-category tool-call arguments redacted before disk (verified against raw bytes, not just the struct); chat() persists but does not yet feed prior turns back into live model context (deliberately scoped out, needs Claude tool_use/tool_result id-pairing test budget as a follow-up)
  • [Phase ?]: [Phase 13, 13-10]: detect_ollama() and its two containing modules bumped to pub(crate) (api/rpc/mod.rs, api/rpc/mesh/mod.rs, api/rpc/mesh/assistant.rs) so assistant::backends could reuse the existing Ollama probe rather than writing a second one; run_loop (loop_.rs) now returns (answer, full_history) instead of just the answer, both Rule-3 deviations structurally required by the plan's own stated intent
  • [Phase ?]: 13-11: kind:'library' content:request routes to music.list-tracks (not content.) via a new contextBroker.ts fetchLibraryContent branch — Rule 2 deviation, contextBroker.ts's diff-clean acceptance criterion could not hold alongside genuine music. wiring (ContentItem has no artist/album/duration field at all)
  • [Phase ?]: 13-11: closed the plan's GAP-FOUND must_have — useArchy.ts's init() now fires requestArchyContent + requestArchyLibrary automatically as a live init-time event, and useContentPanel.ts's setArchyContent opens the panel/sets tabs for non-empty content, instead of leaving the fetch merely callable with nothing in the UI ever invoking it (13-06's own documented Known Limitation)
  • [Phase ?]: 13-12: wrap_untrusted's per-call token is drawn fresh from rand on every call (never a module constant) — a forged closing boundary using a guessed/fixed token can never match, defeating EV-11 by construction; no pattern-stripping filter added anywhere in assistant/ (D-10 rejects that approach by name)
  • [Phase ?]: 13-12: assistant.chat's G-B3 rate limit is keyed by authenticated SESSION id (not client IP) via a new session_requests map on the existing EndpointRateLimiter — 13-AI-SPEC §6 is explicit that per-session, not per-IP, is the guardrail's own spec
  • [Phase ?]: 13-12: screen_outbound (G-B1/G-B2) wired into backends/claude.rs's send() and the assistant.chat rate limit wired into api/rpc/assistant_chat.rs — both Rule 3 deviations outside their task's declared file list, since the plan's own stated behavior (run on the Claude leg / rate-limited per session) had no real call site otherwise
  • [Phase 13, 13-13 Task 1 (2026-08-05, operator via AskUserQuestion)]: Routstr decision = proceed-docs-with-probe-first (0/9 protocol claims independently confirmed per 13-ROUTSTR-FINDINGS.md — no live provider was reachable during the 13-03 spike). Implemented against docs.routstr.com's cited shape (kind 38421, Authorization: Bearer cashuA…, OpenAI-shape chat completions); the first live HTTP call to any provider doubles as the capability probe and fails loudly (real status/body, or "no choices array") on any wrong guess rather than silently misbehaving. D-04's chain is now complete: Ollama -> Claude -> Routstr
  • [Phase 13, 13-13]: D-05's budget ceiling (AssistantBudget) is computed ONLY from persisted allowance_sats/spent_sats — never from anything model/tool/provider-influenced; BudgetExhausted (typed, anyhow-downcastable) stops run_loop with a plain-language message, no retry/re-price/partial-spend/fallthrough. Verified load-bearing by fault injection: temporarily replacing the terminating return with continue made zero_budget_stops_loop_without_retry go red (8 retries to MAX_TURNS, generic error) before being restored
  • [Phase 13, 13-13]: egress.rs's message_is_turn_own (13-12's G-B2 check) was Claude-shape-only and would have silently stripped Routstr's OpenAI-shape system prompt + tool results out of every outbound request — fixed with explicit "system"/"tool"-role handling (Rule 1 bug, found while wiring screen_outbound into routstr.rs)

Pending Todos

  • [blocker/ui] Keep FIPS/Tor pills on cloud files and show them on mobile (.planning/todos/pending/2026-07-30-keep-fips-tor-pills-on-cloud-files-and-show-them-on-mobile.md)
  • [blocker/security] Fedimint gateway must not install with a pre-set password — tracked as FED-07 / Phase 1 gap plan (.planning/todos/pending/2026-07-30-fedimint-gateway-must-not-install-with-preset-password.md)
  • [blocker/ui] Connected-nodes list must scroll at row-matched height, not grow to fit (.planning/todos/pending/2026-07-30-connected-nodes-list-must-scroll-at-row-matched-height.md)
  • [blocker/ui] Onboarding tickbox hidden below fold on short screens — make it beautifully obvious (.planning/todos/pending/2026-07-30-onboarding-tickbox-hidden-below-fold-on-short-screens.md)
  • [major/ui] Paid Files pictures open in browser tab, not the app lightbox — UIFIX-04 (.planning/todos/pending/2026-07-30-peer-files-pictures-open-in-tab-not-lightbox.md)
  • [major/ui] PiP should close the lightbox with a fluid animation — UIFIX-05 (.planning/todos/pending/2026-07-30-pip-should-close-lightbox-with-fluid-animation.md)
  • [major/ui] Missing loader states on slow opens — UIFIX-06 (.planning/todos/pending/2026-07-30-missing-loader-states-on-slow-opens.md)

Blockers/Concerns

  • [Phase 1] Federation tombstone fix touches trust code — fix carefully, re-verify with tests/multinode/smoke.sh, don't patch blind
  • [Phase 3] Multinode gate on archy-x250-beta was launched 2026-07-01 (log on-node); verify outcome before re-running
  • [Phase 5] Fleet registry flip awaits explicit user authorization + timing call
  • [Phase 6] Strengthened ADR-009 validation may reject existing catalog apps — audit manifests before enforcement lands
  • [Global] Live OTA fleet: deploy to the dev pair before any OTA; gate re-runs required after orchestrator changes; some verification is user/hardware-gated (radios, on-device tests)
  • cloud.ts's navigate() needs a TTL gate to fully satisfy 'no new RPC within TTL' for CloudFolder.vue — currently always re-fetches on revisit (just doesn't block paint)
  • [Phase 2, RESOLVED by 02-09] Server.vue does not survive a tab round-trip despite KEEP_ALIVE_PATHS registration — retracted: proven a probe-measurement artifact (shared generic .view-container selector couldn't disambiguate the foreground tab from other cached tabs), not a real defect. Server.vue's (and Web5.vue's) instance genuinely survives; pinned with vm.$.uid-based regression tests immune to the same ambiguity. Checkpoint approved on real hardware.
  • [Phase 2, RESOLVED by 02-11] Timing regressions on Discover/Web5/Fleet/AppDetails/OpenWrtGateway — root cause found (three leaked background pollers, not compute-bound render cost) and fixed for web5/server/fleet, each proven with a real before/after number on archi-dev-box. AppDetails restored to at/near its own pre-phase-2 baseline (pre-existing per-mount cost, not a new defect). OpenWrtGateway not measurable this pass (browser crash); prior numbers stand with a data-integrity note (measuring a real disconnected-device UI, not an empty page).
  • [Phase 2, follow-up needed] Discover (1389ms, worst remaining named surface) has a second, evidenced, phase-2-caused defect: KeepAlive'd entrance-stagger animations (card-stagger/showStagger) never get their class removed from the DOM after first play, so every reactivation replays the full CSS animation cascade. Fix requires touching 5+ files outside 02-11's scope (Apps.vue, Marketplace.vue, Home.vue, Web5Wallet.vue/Web5Identities.vue/Web5NodeVisibility.vue/Web5NostrRelays.vue) with its own real-device visual-regression verification budget (the same class of risk 02-02's original KeepAlive rollout hit on its first checkpoint attempt) — needs a dedicated follow-up plan, not squeezed into a gap-closure pass.

Quick Tasks Completed

# Description Date Commit Directory
260729-fw7 improve mesh message hop graphic/animation: balanced desktop sizing, vertical mobile layout, archipelago branding 2026-07-29 ac09fc5d 260729-fw7-improve-mesh-message-hop-graphic-animati
260729-gjd demo: indee.tx1138.com in app iframe (:2101 whole-origin proxy), auto nostr signer sign-in, IndeeHub pre-installed on fresh session 2026-07-29 d00ca624 260729-gjd-demo-make-indee-tx1138-com-work-in-the-a
260729-hj1 peer-files media batch: Wavlake paid tracks + purchases + dedupe + real photos (demo); lightbox/player open routing + free-image lightbox fix (both builds) 2026-07-29 f52c5407 260729-hj1-peer-files-media-batch-wavlake-paid-trac
260729-je5 connected-nodes list fills card height (constant footer gap); companion app skips demo intro 2026-07-29 d54517cf 260729-je5-ui-fixes-connected-nodes-scrollable-list

Deferred Items

Category Item Status Deferred At
Distribution DIST-01 DHT/iroh backbone (workstream D) v2 2026-07-29
Fleet FLEET-01 Bitcoin multi-version fleet OTA (user-gated) v2 2026-07-29
Fleet FLEET-02 per-app deep health assertions (~34 apps) v2 2026-07-29
Fleet FLEET-03 LUKS2 data-partition encryption v2 2026-07-29

Release SHIPPED — v1.7.120-alpha (2026-08-03)

LIVE. signature PRESENT (did:key:z6Mkkid…q7ur), both assets HTTP 200 at exactly their manifest byte counts, tag pushed. Two release-process traps hit and documented in memory: create-release.sh commits the manifest BEFORE signing (fleet refuses unsigned), and gitea-vps2 is the SAME server as gitea-ai (vps2 token is dead).

Staging record (kept for the evidence trail)

Built from 4d67f56b (release profile, 15m15s, exit 0), deployed to archi-dev-box, .bak rollback at /opt/archipelago/rollback/archipelago.bak.

Verified on the node: both security gates 401 unauthenticated from a non-loopback address; CORS origin-scoped; AIUI assets 200 AFTER the frontend rsync (the deploy that would have wiped a copied-file fix); mesh.lightning-peers/send-lightning-info answer correctly; system.stats host_secrets = per-node; served bundle sha256-matches the build on all three chunks; 31 containers up, none down, no restart loop.

NOT verified, deliberately: the new torrc SocksPort/SocksPolicy block. regenerate_torrc only fires on a Tor services change, so the live torrc still reads only SocksPort 9050. Gateway detection was proven in isolation (10.89.0.1 10.89.0.0/24; missing network exits non-zero -> stays loopback-only). The change is INERT this release since bitcoind has no -onion flag yet (Phase 12), so forcing a torrc regeneration would risk bouncing every onion service for zero benefit.

Frontend is a proven no-op this cycle — built chunks are byte-identical to those already served — so a fleet node only changes binary + the two app-UI images + nginx.

Remaining to ship: operator go/no-go, then scripts/create-release.sh 1.7.120-alpha (stops at the signing prompt — reads the master mnemonic interactively, operator-only), then publish-release-assets.sh to gitea-vps2, then push tags. CHANGELOG.md already carries curated v1.7.120-alpha notes (create-release.sh hard-fails without them). The 5x lifecycle gate was NOT run.

Session Continuity

Last session: 2026-08-06T05:40:00.000Z Stopped at: Completed 13-13-PLAN.md (Routstr backend adapter — Nostr discovery, OpenAI chat, Cashu payment via auto_pay_token; AssistantBudget D-05 arithmetic ceiling, BudgetExhausted hard-stop verified by fault injection; D-04 chain complete: Ollama -> Claude -> Routstr). Next: 13-14. Resume file: None.

Prior (13-12) stop note, retained for history: Completed 13-12-PLAN.md (D-10 untrusted-content boundary, G-B1/G-B2 cloud-egress screen, G-B3 read-only-loop rate limit + owner notices). assistant:: tests incl. approval_nonce_binds_to_exact_action individually; dispatcher.rs untouched; fc09d7a2's tools.rs/grants.rs/backends/mod.rs diffs confirmed rustfmt-only, no behavior change). Task 2 (ToolConfirmModal.vue, contextBroker.ts, Chat.vue mount, toolConfirm.test.ts) was already complete in fc09d7a2 — all 10 toolConfirm.test.ts cases pass, pre-existing contextBroker/chatAiuiEmbed suites (28 tests) still green, vue-tsc clean, all acceptance-criteria greps pass. fc09d7a2 stands as commit of record for both Task 1 and Task 2. STOPPED at Task 3 (checkpoint:human-verify, gate=blocking) — on-device dialog verification on archi-dev-box is required before 13-08-SUMMARY.md can be written. Resume: build+deploy per Task 3's how-to-verify, then re-invoke the 13-08 executor with the operator's "approved" signal. Resume file: None

Open on this thread (all recorded as broken windows, none blocking):

  • Window 15 CLOSED 2026-08-02 20:02 — f6b5245b's reconcile path proven on archi-dev-box by a controlled test: stale conf installed + container restarted (probe 200, genuinely re-exposed), daemon started, reconcile repaired it unaided at 20:02:19 with the expected warn line, probe 401, conf byte-identical to the known-good. Both halves now proven on hardware.

  • Windows 11/12: host-secret rotation on three fleet nodes sharing SSH host keys — detect-only so far; rotation is USER-GATED and deliberately not actioned.

  • Credential rotation DECIDED AGAINST 2026-08-02 (operator): no LND macaroon rotation, no Bitcoin RPC password rotation — no evidence of exploitation and the vulnerability is being closed rather than lived with. rotate-lnd-macaroon.sh stays as a tool, exercised in detect mode only, never run against a node. Do not re-litigate; see docs/security/BITCOIN-RPC-PROXY-EXPOSURE.md.

  • Dev-pair verification is archi-dev-box ONLY, by operator instruction 2026-08-02. Do not raise archy-x250-dev as a blocker again.

Reference in New Issue View Git Blame Copy Permalink