diff options
Diffstat (limited to 'CLAUDE.md')
| -rw-r--r-- | CLAUDE.md | 13 |
1 files changed, 13 insertions, 0 deletions
@@ -369,6 +369,19 @@ anything that assumes one key per person. directives, not text — the same mistake as reading a CSP out of the comment above the meta tag +- **The device's hub key lives in the main process, never in the renderer.** + Generated, stored and used there; the interface asks for a signature over + `meshbay:user_auth:<username>:<ts>` and is never handed a key. Same rule as + the save dialog, for the same reason: the renderer parses decrypted content + from nodes, which is attacker-controlled input. It is **not** a per-node + identity key — nothing here correlates a person across operators + +- **A local hub is the way to test hub changes.** `uvicorn meshbay_hub.app:create_app + --factory` with a SQLite URL and a throwaway key runs the current code on + loopback in seconds. meshbay.org runs whatever was last deployed — it reported + MNP 0.2 and 405 on the Stage-C endpoints while the tree had 0.3 — so testing + against it proves what is deployed, not what is written + ## Two lessons that cost four rounds of live testing - **`QE/deploy/e2e.py` cannot test `app.js`.** It is a second implementation of the |