Event

{"id":"13bc77bee8eec28bb0e7cd416e08cdf62cc8a46271b2dc050c10696efa49dfb3","pubkey":"ba1b5beed5b5b9691bc44d5eaeb7fedc1cf8427b06d6f26a0813e4724a589166","created_at":1789281903,"kind":1618,"tags":[["a","30617:c01503e8035f5a98eb2004721dc4eeddda498c7871927ae7edb4525ab6ccf2d7:tinyrelay"],["p","c01503e8035f5a98eb2004721dc4eeddda498c7871927ae7edb4525ab6ccf2d7"],["subject","Stack 2: Extract public protocol and metadata contracts"],["c","6c32fc3546cf69265e2c544e775bec493abb4aef"],["clone","https://012.run/npub1cq2s86qrtadf36eqq3epm38wmhdynrrcwxf84eldk3f94dkv7ttsrulrz5/tinyrelay.git"],["merge-base","5625d0b5f0230cb9d592d0e13baa9494a168f954"],["t","refactor"]],"content":"## Stack and scope\n\nDepends on [the tinygit/tinyclient extraction PR](https://012.run/repo?owner=c01503e8035f5a98eb2004721dc4eeddda498c7871927ae7edb4525ab6ccf2d7\u0026repo=tinyrelay\u0026view=pr\u0026id=44e0051b49bff1bc46e0c8293b0a696bd41a728c6528d59ad529924418d8e51f), commit `9d68e8778c3448fdc08c95e7b44bb30732692f83`.\n\nThe Git branch is stacked on that commit. The hosted PR API does not select a target branch; its diff is cumulative against `main` (`5625d0b5f0230cb9d592d0e13baa9494a168f954`). Review only this slice with `git diff 9d68e8778c3448fdc08c95e7b44bb30732692f83 refactor/protocol-contracts`. Merge the extraction first. No changes to hosted main or the running deployment are part of this PR.\n\n## Changes beyond the extraction\n\n- Expose `protocol/nostr`: event/filter types, serialization, signing, signature validation and generic matching. Host privacy and feature kind semantics remain internal. Existing internal matching retains its private-event exclusions.\n- Expose `protocol/auth`: existing NIP-98, NIP-42, Blossom and GRASP-08 proof verification, with compatibility aliases preserving type/error identity and shared replay state. Proof verification is not host authorization.\n- Use public event types in tinygit and tinyclient contracts. Add external-module consumer tests, transitive dependency guards and a public API-surface guard.\n- Add pure `tinygit.ParseMetadata(nostr.Event)` for repository metadata shape and semantics. Signatures, author authority, object availability and durable publication remain separate. Invalid ref/HEAD metadata is rejected before repository lookup or host authorization callbacks.\n- Specify the existing agent-grant, reviewed grant-request, callback and custom-view-transform project extensions. Document exact fields, ownership, lifecycle, errors, compatibility and implementation/test evidence without claiming complete upstream standards conformance.\n- Update architecture, module contracts, component docs and feature guides to match the actual split.\n\n## Verification\n\nExecuted on the integrated worktree:\n\n- `make build`: tiny, tinygit and tinyclient binaries.\n- `go test -mod=readonly -count=1 -json ./...`: all tests passed.\n- `go vet -mod=readonly ./...`: passed.\n- `go test -mod=readonly -race -count=1 ./protocol/... ./internal/auth ./internal/event ./tinygit ./cmd/tinygit ./tinyclient ./cmd/tinyclient`: passed.\n- `npm ci` and `npm run test:tinyclient`: all 286 JavaScript tests passed.\n- Baseline HTTP comparison: 96 guest/owner GET/HEAD cases across 24 integrated routes, assets and tenant paths. Status, content type, redirect location and response-body hashes matched the pre-extraction baseline. This is route-level parity evidence, not exhaustive protocol conformance.\n- Local documentation links and Git whitespace checks passed.\n\nThe new consumer and admission regression tests were observed failing before implementation. Independent code and specification reviews gate publication.\n\n## Existing limitations surfaced by the contract audit\n\nThese are documented behavior, not fixes or new guarantees in this refactor:\n\n- Callback delivery rechecks membership/read access but not an active agent grant or fresh source existence. Pausing a grant is not a guaranteed callback kill switch. Pause/resume management responses also differ from list-response URL redaction.\n- Custom-view artifact audiences do not inherit source ACLs. Even a pending/private source can produce a more broadly visible artifact. SVG screening is regex-based, PNG screening checks the signature prefix, and an `ok` transform status does not guarantee an artifact was accepted.\n- Grant-request schemas and signed-event clearing semantics differ in some fields; the specifications record these and other compatibility limits.\n\nThe feature guides no longer overstate callback cancellation, artifact access controls or transform validation. Security/behavior changes to these existing mechanisms should be separately tested and reviewed rather than hidden inside a parity-oriented extraction.\n\n## Next module candidates\n\nKeep follow-ups narrow: a tinyblob storage/ownership contract, community/grant authority separated from persistence, and records/views transaction and lifecycle contracts. The public protocol packages do not depend on internal host packages; tinygit and tinyclient still use some shared internal infrastructure and are not independent Go modules. No wire or persisted identifier migration is implied by the terminology cleanup.\n","sig":"4c675a1a521da9e559fab44d194300d6e4bd19d93f6176dd7e668724937f8cbd20a594e6ff378144cf50da2ef094e59f102dee02cef9339536e4ae8ceed5f902"}