archipelagoandClaude Opus 5
762c72b4d0
Operator: "the AI Data Access settings are not persistent through sessions, often turns them all off." They were stored in localStorage, which is scoped to an ORIGIN — and a node answers on several: LAN address, Tailscale address, <host>.local, hostname. Granting Media over the LAN and returning over Tailscale showed every switch off again. Not reset: never set *there*. It also made a working content path look broken, because every scope silently returns nothing without a grant, so an ungranted permission is indistinguishable from an empty library — that is exactly what an empty films search turned out to be. The grant answers "what may the assistant read about THIS NODE", which is a property of the node, not of one browser at one address. New settings/ai_permissions.rs (same shape as session_policy: atomic temp+rename, sanitised on read and write, fails closed on a corrupt file — an unreadable grant file must never read as "everything allowed"). New ai.permissions.get / .set, absent from the unauthenticated allowlist so they require a session. Migration, not replacement: if this browser holds grants and the node holds none, the local set is pushed UP rather than wiped. Without that, upgrading would silently revoke the grants of everyone who set them before this change. The node still wins in every other direction, so a revocation made on one device takes effect everywhere — otherwise revoking would be impossible from a second device. Unknown category ids are stored verbatim rather than validated against a hardcoded list: a third copy of that list would silently drop a new category on upgrade. Storing a category grants nothing by itself — the broker checks before fetching and the node re-checks before answering (T-13-33). Hydration happens ONCE at broker start, not inside each permission gate: the gates are hot-path, and awaiting there adds an RPC to every content and context request. The first attempt did it per-gate and the existing broker tests caught it by failing on consumed mocks. Rust 7/7, store 18/18, broker 23/23. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Archipelago
Self-sovereign Bitcoin node OS and manifest-driven app platform.
Archipelago is a bootable personal server OS for Bitcoin infrastructure,
self-hosted apps, mesh communication, decentralized identity, and federation.
Apps are packaged as declarative manifest.yml files and run as rootless
Podman containers managed by the Rust backend.
What is here
core/- Rust workspace: backend API, container runtime, security, OpenWrt helpers, and performance/resource management.neode-ui/- Vue 3 + TypeScript frontend.apps/- app manifests and custom app container sources.docker/- supporting container build contexts for UI companion surfaces.image-recipe/- bootable image/ISO build inputs.Android/- Android companion app.scripts/- development, release, deployment, and validation tooling.docs/- architecture, app packaging, operations, API, and roadmap docs.
Platform model
Archipelago is built as a developer-ready app platform, not a fixed appliance:
- Apps are declared in
apps/<app-id>/manifest.yml. - The Rust parser in
core/container/src/manifest.rsis the canonical schema. - The orchestrator compiles manifests to rootless Podman/Quadlet runtime state.
- App data lives under
/var/lib/archipelago/<app-id>/. - Secrets are generated or read from
/var/lib/archipelago/secrets/and injected through Podman secrets rather than static environment values. - Release and app catalogs are signed and verified against a pinned trust anchor.
Start with:
- Architecture
- Developer Guide
- App Developer Guide
- App Manifest Spec
- Nostr Git Source Hosting Plan
- Operations Runbook
- Troubleshooting
Quick start
Frontend
cd neode-ui
npm install
npm start
The dev UI runs at http://localhost:8100 with a mock backend on :5959.
Backend
cd core
cargo build
cargo test --all-features
Linux is the supported backend runtime and release-build target. macOS is fine for frontend work and many Rust compile/test loops, but host integration tests that touch Podman, systemd, networking, or image build paths require Linux.
App manifests
./scripts/validate-app-manifest.sh apps/filebrowser/manifest.yml
python3 scripts/generate-app-catalog.py
python3 scripts/check-app-catalog-drift.py --release --strict
scripts/generate-app-catalog.py requires Python with PyYAML installed.
Documentation map
| Doc | Purpose |
|---|---|
| Architecture | System layers, crates, data paths, security model |
| Developer Guide | Local setup, code workflow, testing |
| API Reference | JSON-RPC API overview |
| App Developer Guide | How to package and test apps |
| App Manifest Spec | Manifest schema and validation rules |
| Nostr Git Source Hosting Plan | ngit/NIP-34 contribution workflow and maintainer model |
| Apps README | Packaged app catalog overview |
| Image Recipe | Bootable image build flow |
| Operations Runbook | Production operations and recovery |
| Open Source Readiness | Public-release cleanup checklist |
| Roadmap | Shipped, in-progress, and planned work |
| Unified Task Tracker | Launch hardening task list |
| Archive | Historical plans, audits, and handoffs |
Contributing
Read CONTRIBUTING.md before opening a pull request. For security issues, follow SECURITY.md and do not open a public issue.
License
Archipelago is licensed under the MIT License. Third-party notices are listed in NOTICE and generated license inventories in component release artifacts.