diff options
| -rw-r--r-- | CLAUDE.md | 12 | ||||
| -rw-r--r-- | docs/MESHBAY_DESIGN.md | 7 |
2 files changed, 19 insertions, 0 deletions
@@ -144,6 +144,18 @@ These are about working on the tree rather than about the design: - **The SPA served in production may be older than this tree.** Check the served `/a/<hash>/` against `meshbay_hub.api.webapp.ASSET_V` before concluding a fix is missing. `site/` and the Caddy config have never been deployed +- **`test_sticky_header.py[firefox]` needs no Firefox instance on the machine, + and says nothing about the code when one is there.** The harness launches + `firefox --headless --screenshot` with `HOME` pointed at a throwaway + directory, which isolates the *profile* and not snap's single instance: with + any Firefox already up it prints "Firefox is already running, but is not + responding", never loads the page, and the fixture times out at 60 s — eleven + errors at setup that look like a regression and are not. Neither + `--no-remote` nor `--new-instance` changes it; a failed run also appears to + leave a process behind, which blocks the next one. Before reading anything + into these: `ps -eo pid,etimes,args | grep firefox`, and re-run against a + stashed tree. The `[chrome]` half of the same file covers the same geometry + and is the one to trust meanwhile - **One UI source.** `packages/meshbay-hub/src/meshbay_hub/static/` is the interface, for the web and the app alike; `packages/meshbay-client/scripts/ sync-ui.js` copies it (`npm run sync-ui`) and CI fails if the copy drifts — diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md index 68b9fa9..32d688b 100644 --- a/docs/MESHBAY_DESIGN.md +++ b/docs/MESHBAY_DESIGN.md @@ -2771,6 +2771,13 @@ account recovery, and the Windows port through packaging. | Forward secrecy in group chat | **Given up deliberately and on the record** (§4.5). If it becomes a requirement it belongs in 1:1 DM | | Metadata at the hub | Membership, and who posted in which group and when. A known leak, not a solved problem (§7.1) | | The exact-hash content check | Structural, not functional (§7.5) | +| **The packaged install** | Built and never installed. `build-packages.sh` produces four `.deb` that carry the migrations and a relocatable entry point, and no machine has been taken from those packages to a running hub and node. Every packaging defect found so far was found the first time somebody tried | +| **QUIC** | Off by default, and **not at parity**: it serves the index and file chunks with no transfer lease, no leaseless ceiling and no root-availability check, does its file I/O on the event loop, and returns exception text to the peer (**L3**). No client speaks it. Either it comes to parity or it goes; until then §5.1's "chat is the only gap" is the one sentence here that overstates the code | +| **The relay registry** | `/v1/relays` register/list/approve exist and nothing in the tree calls them, node or client — and §11.1 measured two ISPs with no TURN relay needed. Kept code that nothing calls is what **L7** says not to keep | +| **Free-text third-party search** | `tmdb_search_req` takes a member's query and spends the operator's per-credential quota with no rate limit and no per-member bound, where link previews carry both. §6.5's standing rule — a bound and a named adversary in the same commit — was not applied here | +| **Disk I/O on the node's event loop** | A chunk read-and-encrypt and every upload chunk write run in the message handler. On a spun-down or network-mounted root that stalls every group, every stream and the hub socket, which is `AV9`'s lesson with the disk in place of the mail server | +| **Node announcements are not bounded** | One account may announce unlimited distinct node keys, each a row plus an IP-log row under a one-year retention. Proof of possession is checked (**M8**); the count is not | +| **Migrations run on SQLite only** | The chain reaches head and agrees with the models there (§12), which is not where it ships. A default or a constraint PostgreSQL refuses would still reach a deploy | --- |