lfg2025/archy

Files

T

archipelagoandClaude Opus 5 db60c3382d docs(marketplace-protocol): the DID signature layer is specified but not implemented

This doc is marked "Status: implemented ... shipped end-to-end" and then
describes a cryptographic verification chain that does not exist. On a repo
about to go public, that is the single worst kind of doc bug: it promises a
security property.

`signatures.manifest_hash` / `signatures.did_signature` appear exactly once in
the codebase — as two struct fields at `marketplace.rs:106-107`. Nothing reads
them. There is no hash comparison, no DID resolution, no signature check. The
authenticity actually delivered is the Nostr event's own NIP-01 Schnorr
signature, which proves the publishing key sent the event but says nothing about
the DID the manifest names.

Added a warning at the top, marked the "Manifest Signing (DID Layer)" section
and steps 3-6 of the verification flow as not implemented, and annotated steps
7-8 as advisory (validate_manifest returns scoring issues; it does not block
discovery or install).

The trust model was overstated in the same direction:
- "DID Verification | 30 | Manifest is signed by a valid DID key" is a
  `did.starts_with("did:")` string test. Any publisher can claim any DID and
  take the 30 points.
- "Relay Consensus | 20" is graduated and never zero (1 relay still scores 5).
- "Version History | 15 | multiple published versions (shows maintenance)" —
  nothing counts versions; it's 10 for a 3-part semver plus 5 for a non-empty
  repo_url.
Worked the arithmetic through: an unsigned manifest with a plausible DID string
and a pinned image scores 65, landing in the "Community" tier. Said so.

Other corrections:
- `marketplace.unpublish` is documented but was never implemented (the string
  appears nowhere); removed it and noted why NIP-33 makes it non-trivial. Added
  the two payment methods that do exist (`create-invoice`, `check-payment`).
- The schema section said marketplace manifests "follow the existing
  apps/{app-id}/manifest.yml schema", contradicting the header three paragraphs
  above. They are separate types.
- The security-enforcement list claimed a capability allow-list, a
  host-networking ban and system-path mount restrictions. Those rules are real
  but live in the runtime manifest parser for a different schema — marketplace
  validation checks four things and gates none of them.
- `run_as_user` documented as "> 1000" in two places while the code checks
  `>= 1000` and the doc's own example uses 1000.
- Data-storage tree listed `cache/trust-scores.json` and `config.json`; neither
  is ever written.
- The 15-minute cache TTL and 30-minute background refresh don't exist —
  discovery is RPC-triggered and the cache has no expiry.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-08-07 20:59:45 -04:00

adr

feat: identity lifecycle tests and ADR-011 DWN deprioritization

2026-03-15 05:01:06 +00:00

README.md

Archipelago documentation

Start here. This index groups the docs by what you're trying to do. The authoritative behaviour is always the code in core/; where a doc and the code disagree, the code wins and the doc is a bug.

Getting started

User Walkthrough — setting up and using a node, from hardware to daily use
Talking to your node — the conversational command surface
Seed Verification — independently verify your 24-word backup
Troubleshooting — common problems and how to resolve them
Gamepad / Controller Navigation — driving the UI from a controller
Pine voice commands — the voice-satellite phrase surface

Architecture

Architecture — the system at a glance
Multi-Node Architecture — how nodes relate across a fleet
API Reference — the JSON-RPC surface

Contributing to Archipelago itself

Developer Guide — building the workspace, the frontend, and an ISO
Contributor guide (CLAUDE.md) — invariants, build/verify, the production test gate
Bulletproof containers — why the reconciler is level-triggered
Release signing runbook — the ceremony and key handling
1.8.0 Release Hardening Plan — the release-blocking checklist
Third-party license audit — dependency licensing posture
Demo build info — operating the public demo sandbox

App development

App Developer Guide — build and package a containerized app
App Manifest Specification — the manifest schema, field by field
Manifest → Quadlet unit — how a manifest compiles to a systemd-owned container unit
Container lifecycle — the reconciler state machine: install/adopt/start/stop/self-heal
App secrets — declaring, generating and injecting per-install credentials
Registry-Distributed Manifests — how manifests reach nodes via the signed catalog
Decentralized Marketplace Protocol — publishing apps via an external registry
Bitcoin RPC Relay — letting an external wallet reach the node's Bitcoin RPC
Companion Pairing QR — the pairing handoff contract
TV input inside iframe apps — keyboard/gamepad routing into embedded apps

Design docs

These record why a thing is built the way it is. They are design records, not step-by-step guides, and some predate the current implementation.

Decisions (ADRs)

There is no ADR-010 — the number was never issued, so the gap is not a missing file.

Security

Security Policy — how to report a vulnerability
PSBT Signing Architecture
Bitcoin RPC Proxy Exposure
Entropy Enforcement (KEY-05)

Roadmap & history

Roadmap — where the project is going
archive/ — superseded design and status documents, kept for provenance