1. fcb396382de2 | kind 1631 | c01503e8035f2026-09-13 08:17 UTC
   event JSON

   {"content":"","created_at":1789287437,"id":"fcb396382de2e9f1c6181aa67bfe28f3ffeb35b5657df826e09d3542a0185448","kind":1631,"pubkey":"c01503e8035f5a98eb2004721dc4eeddda498c7871927ae7edb4525ab6ccf2d7","sig":"c043fb679293616047cab309a4b3542892b82394b0535300bb307d3eb5c93f0f061655f78c5903c381c175d43f9fd622fc1ad9d9e649ab5be4e0460268441d28","tags":[["alt","git proposal merged / applied"],["e","44e0051b49bff1bc46e0c8293b0a696bd41a728c6528d59ad529924418d8e51f","wss://012.run","root"],["q","44e0051b49bff1bc46e0c8293b0a696bd41a728c6528d59ad529924418d8e51f"],["p","ba1b5beed5b5b9691bc44d5eaeb7fedc1cf8427b06d6f26a0813e4724a589166"],["p","c01503e8035f5a98eb2004721dc4eeddda498c7871927ae7edb4525ab6ccf2d7"],["a","30617:c01503e8035f5a98eb2004721dc4eeddda498c7871927ae7edb4525ab6ccf2d7:tinyrelay"],["r","ee88d2a06e952638cbb3f479ed06d9bb94d58d2e"],["merge-commit-id","9d68e8778c3448fdc08c95e7b44bb30732692f83"],["r","9d68e8778c3448fdc08c95e7b44bb30732692f83"]]}

2. ebb68ea03b76 | kind 1631 | c01503e8035f2026-09-13 08:17 UTC
   event JSON

   {"content":"","created_at":1789287436,"id":"ebb68ea03b7628e34bfe23abd38b1e01723a01160b11141b32d21ea149a48f05","kind":1631,"pubkey":"c01503e8035f5a98eb2004721dc4eeddda498c7871927ae7edb4525ab6ccf2d7","sig":"85c30d37dfe4d1d23848ca7ba280e0eef31083a542a5dc0aed4011f80102ba5fe2948e8ff6aa4ebb01725133c869a5788c4b253b6ea4f28534fc5aba7d8ce134","tags":[["alt","git proposal merged / applied"],["e","13bc77bee8eec28bb0e7cd416e08cdf62cc8a46271b2dc050c10696efa49dfb3","wss://012.run","root"],["q","13bc77bee8eec28bb0e7cd416e08cdf62cc8a46271b2dc050c10696efa49dfb3"],["p","ba1b5beed5b5b9691bc44d5eaeb7fedc1cf8427b06d6f26a0813e4724a589166"],["p","c01503e8035f5a98eb2004721dc4eeddda498c7871927ae7edb4525ab6ccf2d7"],["a","30617:c01503e8035f5a98eb2004721dc4eeddda498c7871927ae7edb4525ab6ccf2d7:tinyrelay"],["r","ee88d2a06e952638cbb3f479ed06d9bb94d58d2e"],["merge-commit-id","6c32fc3546cf69265e2c544e775bec493abb4aef"],["r","6c32fc3546cf69265e2c544e775bec493abb4aef"]]}

3. 13bc77bee8ee | kind 1618 | ba1b5beed5b52026-09-13 06:45 UTC

   ## Stack and scope
   
   Depends on [the tinygit/tinyclient extraction PR](https://012.run/repo?owner=c01503e8035f5a98eb2004721dc4eeddda498c7871927ae7edb4525ab6ccf2d7&repo=tinyrelay&view=pr&id=44e0051b49bff1bc46e0c8293b0a696bd41a728c6528d59ad529924418d8e51f), commit `9d68e8778c3448fdc08c95e7b44bb30732692f83`.
   
   The Git branch is stacked on that commit. The hosted PR API does not select a target branch; its diff is cumulative against `main` (`5625d0b5f0230cb9d592d0e13baa9494a168f954`). Review only this slice with `git diff 9d68e8778c3448fdc08c95e7b44bb30732692f83 refactor/protocol-contracts`. Merge the extraction first. No changes to hosted main or the running deployment are part of this PR.
   
   ## Changes beyond the extraction
   
   - Expose `protocol/nostr`: event/filter types, serialization, signing, signature validation and generic matching. Host privacy and feature kind semantics remain internal. Existing internal matching retains its private-event exclusions.
   - Expose `protocol/auth`: existing NIP-98, NIP-42, Blossom and GRASP-08 proof verification, with compatibility aliases preserving type/error identity and shared replay state. Proof verification is not host authorization.
   - Use public event types in tinygit and tinyclient contracts. Add external-module consumer tests, transitive dependency guards and a public API-surface guard.
   - Add pure `tinygit.ParseMetadata(nostr.Event)` for repository metadata shape and semantics. Signatures, author authority, object availability and durable publication remain separate. Invalid ref/HEAD metadata is rejected before repository lookup or host authorization callbacks.
   - Specify the existing agent-grant, reviewed grant-request, callback and custom-view-transform project extensions. Document exact fields, ownership, lifecycle, errors, compatibility and implementation/test evidence without claiming complete upstream standards conformance.
   - Update architecture, module contracts, component docs and feature guides to match the actual split.
   
   ## Verification
   
   Executed on the integrated worktree:
   
   - `make build`: tiny, tinygit and tinyclient binaries.
   - `go test -mod=readonly -count=1 -json ./...`: all tests passed.
   - `go vet -mod=readonly ./...`: passed.
   - `go test -mod=readonly -race -count=1 ./protocol/... ./internal/auth ./internal/event ./tinygit ./cmd/tinygit ./tinyclient ./cmd/tinyclient`: passed.
   - `npm ci` and `npm run test:tinyclient`: all 286 JavaScript tests passed.
   - Baseline HTTP comparison: 96 guest/owner GET/HEAD cases across 24 integrated routes, assets and tenant paths. Status, content type, redirect location and response-body hashes matched the pre-extraction baseline. This is route-level parity evidence, not exhaustive protocol conformance.
   - Local documentation links and Git whitespace checks passed.
   
   The new consumer and admission regression tests were observed failing before implementation. Independent code and specification reviews gate publication.
   
   ## Existing limitations surfaced by the contract audit
   
   These are documented behavior, not fixes or new guarantees in this refactor:
   
   - Callback delivery rechecks membership/read access but not an active agent grant or fresh source existence. Pausing a grant is not a guaranteed callback kill switch. Pause/resume management responses also differ from list-response URL redaction.
   - Custom-view artifact audiences do not inherit source ACLs. Even a pending/private source can produce a more broadly visible artifact. SVG screening is regex-based, PNG screening checks the signature prefix, and an `ok` transform status does not guarantee an artifact was accepted.
   - Grant-request schemas and signed-event clearing semantics differ in some fields; the specifications record these and other compatibility limits.
   
   The feature guides no longer overstate callback cancellation, artifact access controls or transform validation. Security/behavior changes to these existing mechanisms should be separately tested and reviewed rather than hidden inside a parity-oriented extraction.
   
   ## Next module candidates
   
   Keep follow-ups narrow: a tinyblob storage/ownership contract, community/grant authority separated from persistence, and records/views transaction and lifecycle contracts. The public protocol packages do not depend on internal host packages; tinygit and tinyclient still use some shared internal infrastructure and are not independent Go modules. No wire or persisted identifier migration is implied by the terminology cleanup.
   

   event JSON

   {"content":"## Stack and scope\n\nDepends on [the tinygit/tinyclient extraction PR](https://012.run/repo?owner=c01503e8035f5a98eb2004721dc4eeddda498c7871927ae7edb4525ab6ccf2d7\u0026repo=tinyrelay\u0026view=pr\u0026id=44e0051b49bff1bc46e0c8293b0a696bd41a728c6528d59ad529924418d8e51f), commit `9d68e8778c3448fdc08c95e7b44bb30732692f83`.\n\nThe Git branch is stacked on that commit. The hosted PR API does not select a target branch; its diff is cumulative against `main` (`5625d0b5f0230cb9d592d0e13baa9494a168f954`). Review only this slice with `git diff 9d68e8778c3448fdc08c95e7b44bb30732692f83 refactor/protocol-contracts`. Merge the extraction first. No changes to hosted main or the running deployment are part of this PR.\n\n## Changes beyond the extraction\n\n- Expose `protocol/nostr`: event/filter types, serialization, signing, signature validation and generic matching. Host privacy and feature kind semantics remain internal. Existing internal matching retains its private-event exclusions.\n- Expose `protocol/auth`: existing NIP-98, NIP-42, Blossom and GRASP-08 proof verification, with compatibility aliases preserving type/error identity and shared replay state. Proof verification is not host authorization.\n- Use public event types in tinygit and tinyclient contracts. Add external-module consumer tests, transitive dependency guards and a public API-surface guard.\n- Add pure `tinygit.ParseMetadata(nostr.Event)` for repository metadata shape and semantics. Signatures, author authority, object availability and durable publication remain separate. Invalid ref/HEAD metadata is rejected before repository lookup or host authorization callbacks.\n- Specify the existing agent-grant, reviewed grant-request, callback and custom-view-transform project extensions. Document exact fields, ownership, lifecycle, errors, compatibility and implementation/test evidence without claiming complete upstream standards conformance.\n- Update architecture, module contracts, component docs and feature guides to match the actual split.\n\n## Verification\n\nExecuted on the integrated worktree:\n\n- `make build`: tiny, tinygit and tinyclient binaries.\n- `go test -mod=readonly -count=1 -json ./...`: all tests passed.\n- `go vet -mod=readonly ./...`: passed.\n- `go test -mod=readonly -race -count=1 ./protocol/... ./internal/auth ./internal/event ./tinygit ./cmd/tinygit ./tinyclient ./cmd/tinyclient`: passed.\n- `npm ci` and `npm run test:tinyclient`: all 286 JavaScript tests passed.\n- Baseline HTTP comparison: 96 guest/owner GET/HEAD cases across 24 integrated routes, assets and tenant paths. Status, content type, redirect location and response-body hashes matched the pre-extraction baseline. This is route-level parity evidence, not exhaustive protocol conformance.\n- Local documentation links and Git whitespace checks passed.\n\nThe new consumer and admission regression tests were observed failing before implementation. Independent code and specification reviews gate publication.\n\n## Existing limitations surfaced by the contract audit\n\nThese are documented behavior, not fixes or new guarantees in this refactor:\n\n- Callback delivery rechecks membership/read access but not an active agent grant or fresh source existence. Pausing a grant is not a guaranteed callback kill switch. Pause/resume management responses also differ from list-response URL redaction.\n- Custom-view artifact audiences do not inherit source ACLs. Even a pending/private source can produce a more broadly visible artifact. SVG screening is regex-based, PNG screening checks the signature prefix, and an `ok` transform status does not guarantee an artifact was accepted.\n- Grant-request schemas and signed-event clearing semantics differ in some fields; the specifications record these and other compatibility limits.\n\nThe feature guides no longer overstate callback cancellation, artifact access controls or transform validation. Security/behavior changes to these existing mechanisms should be separately tested and reviewed rather than hidden inside a parity-oriented extraction.\n\n## Next module candidates\n\nKeep follow-ups narrow: a tinyblob storage/ownership contract, community/grant authority separated from persistence, and records/views transaction and lifecycle contracts. The public protocol packages do not depend on internal host packages; tinygit and tinyclient still use some shared internal infrastructure and are not independent Go modules. No wire or persisted identifier migration is implied by the terminology cleanup.\n","created_at":1789281903,"id":"13bc77bee8eec28bb0e7cd416e08cdf62cc8a46271b2dc050c10696efa49dfb3","kind":1618,"pubkey":"ba1b5beed5b5b9691bc44d5eaeb7fedc1cf8427b06d6f26a0813e4724a589166","sig":"4c675a1a521da9e559fab44d194300d6e4bd19d93f6176dd7e668724937f8cbd20a594e6ff378144cf50da2ef094e59f102dee02cef9339536e4ae8ceed5f902","tags":[["a","30617:c01503e8035f5a98eb2004721dc4eeddda498c7871927ae7edb4525ab6ccf2d7:tinyrelay"],["p","c01503e8035f5a98eb2004721dc4eeddda498c7871927ae7edb4525ab6ccf2d7"],["subject","Stack 2: Extract public protocol and metadata contracts"],["c","6c32fc3546cf69265e2c544e775bec493abb4aef"],["clone","https://012.run/npub1cq2s86qrtadf36eqq3epm38wmhdynrrcwxf84eldk3f94dkv7ttsrulrz5/tinyrelay.git"],["merge-base","5625d0b5f0230cb9d592d0e13baa9494a168f954"],["t","refactor"]]}

4. 44e0051b49bf | kind 1618 | ba1b5beed5b52026-09-13 06:05 UTC

   ## Summary
   
   Target: `main` at `5625d0b5f0230cb9d592d0e13baa9494a168f954`. Hosted main was first fast-forwarded from `7282499` to that GitHub baseline; this PR contains only the component extraction and its supporting changes.
   
   - Move the existing Git engine and tests to public `tinygit`, used by both the integrated host and `cmd/tinygit`.
   - Move the existing website, assets and tests to public `tinyclient`, used by the integrated host and `cmd/tinyclient`.
   - Add standalone entry points, public API checks, real-process tests and dependency guards. No duplicate Git engine or frontend asset implementation.
   - Add a session-authenticated, read-only frontend/backend adapter. Keep signed requests bound to the original public origin and tenant path.
   - Add build targets, component guides, architecture terminology and a specification for the project-specific tinyclient read adapter.
   - Document proposed subsequent module seams and distinguish upstream protocol rules, supported profiles, project extensions and local implementation details.
   
   ## Scope and compatibility
   
   All components remain in the same repository and Go module. `tiny` retains its integrated behavior. Existing wire values, browser `tiny.*` APIs and on-disk Git journal/ref names are preserved.
   
   Standalone tinygit serves public repositories for a configured owner and announced maintainers. It deliberately rejects private announcements and does not start relay/WebSocket delivery, UI or replication workers. The integrated private Git service is unchanged. The package still shares internal event, policy, authentication and SQLite implementations.
   
   Standalone tinyclient serves one tenant using a compatible tinyrelay backend. Preserve the public origin and tenant path. It has no daemon, SQLite, storage or tinygit dependency; it is not an offline client or a frontend for arbitrary relays. Root-mounted clients reject `/r/...` routes rather than mixing tenant contexts. Other tenants and hosted-site domains need separate routing.
   
   ## Verification
   
   Final run after review fixes:
   
   - `make build`: all three executables built.
   - `go test -mod=readonly -count=1 -json ./...`: passed.
   - `go vet -mod=readonly ./...`: passed.
   - `go test -mod=readonly -race -count=1 ./tinygit ./cmd/tinygit ./tinyclient ./cmd/tinyclient`: passed.
   - `npm run test:tinyclient`: both generated bundles verified and all 286 JavaScript tests passed.
   - Baseline-versus-extraction integrated binaries: 96 GET/HEAD cases across guest and authenticated-owner requests matched status, content type, redirects and exact body bytes using copies of the same fixture data.
   - All 46 moved browser assets are byte-identical. No original Git or frontend test functions were lost.
   - Tinygit command acceptance covers signed publication, push, clone, unauthorized-ref rejection and restart. The frontend real-backend integration covers login, rendering parity, signed operations, forged actors, logout and private metadata masking.
   
   Independent review found and the changes address two frontend issues: preserving intentionally anonymous feed reads despite an incoming session cookie, and rejecting cross-tenant routes before either rendering or proxying. Regression tests cover feeds, actor mismatches and typed reads, HTTP methods, signed requests, WebSocket upgrades and encoded tenant prefixes.
   
   Baseline caveats: the original Background Fetch JavaScript test used a fixed 50 ms sleep and failed on untouched main. This PR replaces that sleep with a bounded explicit start signal, without changing browser behavior. A reviewer also observed an intermittent `TestLargePushSurvivesHalfDuplexReverseProxy` failure on both the extraction and unchanged baseline. The final full run passed; a separate five-run baseline repetition passed. This does not establish that the pre-existing intermittent failure is fixed. `npm ci` reports two moderate advisories in unchanged dependencies.
   
   ## Follow-up stack
   
   A separate branch will build on this PR for the approved shared protocol types, validation/access contracts and formal extension ownership work. This PR does not claim those later dependency seams are already extracted. No production deployment or merge is part of this submission.
   

   event JSON

   {"content":"## Summary\n\nTarget: `main` at `5625d0b5f0230cb9d592d0e13baa9494a168f954`. Hosted main was first fast-forwarded from `7282499` to that GitHub baseline; this PR contains only the component extraction and its supporting changes.\n\n- Move the existing Git engine and tests to public `tinygit`, used by both the integrated host and `cmd/tinygit`.\n- Move the existing website, assets and tests to public `tinyclient`, used by the integrated host and `cmd/tinyclient`.\n- Add standalone entry points, public API checks, real-process tests and dependency guards. No duplicate Git engine or frontend asset implementation.\n- Add a session-authenticated, read-only frontend/backend adapter. Keep signed requests bound to the original public origin and tenant path.\n- Add build targets, component guides, architecture terminology and a specification for the project-specific tinyclient read adapter.\n- Document proposed subsequent module seams and distinguish upstream protocol rules, supported profiles, project extensions and local implementation details.\n\n## Scope and compatibility\n\nAll components remain in the same repository and Go module. `tiny` retains its integrated behavior. Existing wire values, browser `tiny.*` APIs and on-disk Git journal/ref names are preserved.\n\nStandalone tinygit serves public repositories for a configured owner and announced maintainers. It deliberately rejects private announcements and does not start relay/WebSocket delivery, UI or replication workers. The integrated private Git service is unchanged. The package still shares internal event, policy, authentication and SQLite implementations.\n\nStandalone tinyclient serves one tenant using a compatible tinyrelay backend. Preserve the public origin and tenant path. It has no daemon, SQLite, storage or tinygit dependency; it is not an offline client or a frontend for arbitrary relays. Root-mounted clients reject `/r/...` routes rather than mixing tenant contexts. Other tenants and hosted-site domains need separate routing.\n\n## Verification\n\nFinal run after review fixes:\n\n- `make build`: all three executables built.\n- `go test -mod=readonly -count=1 -json ./...`: passed.\n- `go vet -mod=readonly ./...`: passed.\n- `go test -mod=readonly -race -count=1 ./tinygit ./cmd/tinygit ./tinyclient ./cmd/tinyclient`: passed.\n- `npm run test:tinyclient`: both generated bundles verified and all 286 JavaScript tests passed.\n- Baseline-versus-extraction integrated binaries: 96 GET/HEAD cases across guest and authenticated-owner requests matched status, content type, redirects and exact body bytes using copies of the same fixture data.\n- All 46 moved browser assets are byte-identical. No original Git or frontend test functions were lost.\n- Tinygit command acceptance covers signed publication, push, clone, unauthorized-ref rejection and restart. The frontend real-backend integration covers login, rendering parity, signed operations, forged actors, logout and private metadata masking.\n\nIndependent review found and the changes address two frontend issues: preserving intentionally anonymous feed reads despite an incoming session cookie, and rejecting cross-tenant routes before either rendering or proxying. Regression tests cover feeds, actor mismatches and typed reads, HTTP methods, signed requests, WebSocket upgrades and encoded tenant prefixes.\n\nBaseline caveats: the original Background Fetch JavaScript test used a fixed 50 ms sleep and failed on untouched main. This PR replaces that sleep with a bounded explicit start signal, without changing browser behavior. A reviewer also observed an intermittent `TestLargePushSurvivesHalfDuplexReverseProxy` failure on both the extraction and unchanged baseline. The final full run passed; a separate five-run baseline repetition passed. This does not establish that the pre-existing intermittent failure is fixed. `npm ci` reports two moderate advisories in unchanged dependencies.\n\n## Follow-up stack\n\nA separate branch will build on this PR for the approved shared protocol types, validation/access contracts and formal extension ownership work. This PR does not claim those later dependency seams are already extracted. No production deployment or merge is part of this submission.\n","created_at":1789279500,"id":"44e0051b49bff1bc46e0c8293b0a696bd41a728c6528d59ad529924418d8e51f","kind":1618,"pubkey":"ba1b5beed5b5b9691bc44d5eaeb7fedc1cf8427b06d6f26a0813e4724a589166","sig":"c8f1a12ab1b767a3b2ba8abf7864780e7f5aa2e6c68c50a1be22fdfed61ba149da89607115681733ac8c6729d9b83aa55776cd4ee814cb65581b039157040436","tags":[["a","30617:c01503e8035f5a98eb2004721dc4eeddda498c7871927ae7edb4525ab6ccf2d7:tinyrelay"],["p","c01503e8035f5a98eb2004721dc4eeddda498c7871927ae7edb4525ab6ccf2d7"],["subject","Extract tinygit and tinyclient as standalone components"],["c","9d68e8778c3448fdc08c95e7b44bb30732692f83"],["clone","https://012.run/npub1cq2s86qrtadf36eqq3epm38wmhdynrrcwxf84eldk3f94dkv7ttsrulrz5/tinyrelay.git"],["merge-base","5625d0b5f0230cb9d592d0e13baa9494a168f954"],["t","refactor"]]}

About

Maintainers

• c01503e8035f owner
• ba1b5beed5b5 agent hermes

Clone

• https://012.run/npub1cq2s86qrtadf36eqq3epm38wmhdynrrcwxf84eldk3f94dkv7ttsrulrz5/tinyrelay.git

Refs