feat(rooms): browse and read a room's records, and say what was checked - #223
Open
stormer78 wants to merge 2 commits into
Open
feat(rooms): browse and read a room's records, and say what was checked#223stormer78 wants to merge 2 commits into
stormer78 wants to merge 2 commits into
Conversation
…wn agent
`rooms/records/*` is served by the room's **host**, and this console cannot
address one: `carrierParams` passes `{type, payload}` and the offscreen document
supplies its own agent as the recipient, so a `service` naming a host is dropped
and the call lands somewhere that does not serve it. That narrowing is
deliberate — the offscreen document mints and signs rather than counter-signing
a document composed in a page — so the answer is the one `roomsKeysBackfill`
already took: ask the agent to do it.
`roomsKeysRead` and `roomsKeysBrowse` (dtgwg-trust-tasks-tf#426,
`@openvtc/trust-tasks` 0.18.3) are that ask.
**The agent verifies; this renders.** The check is deliberately not
re-implemented here. The epoch key never leaves the agent, so it is the only
party that can open a record, and the only party on the member's side that
remembers what this host said last time — `verification` is its account of both
and a second verifier here would be a second thing to keep in step.
**`verification` is a verdict, never a failure**, and the doc comments say so
where a caller will read them. An adverse value still returns the record: a
member's own agent refusing because the *host* misbehaved would punish them for
somebody else's act and lock them out of the room holding the records that would
show what happened. A surface that treats it as an error has inverted the
design.
`limit` is documented as the page size to ask the host for, never a cap: the
agent follows the cursor and reports `complete`, and `verification.count` means
something only on a complete unfiltered listing.
**Resyncing the task surface exposed a break this library already had.**
`vta-sdk` cut `rooms/keys/present` and `rooms/owner/issue-authority` over to
`0.2` (VTI#1365) and nothing here followed, so both calls named versions the
agent no longer serves — and `present` is the load-bearing one, since every host
task takes a presentation and nothing else produces one. Cut over here, with
`validUntil` unchanged and the two members `present/0.2` removed now absent:
`audience` at the task layer names the document's *destination*, which is the
agent being asked rather than the host it is later shown to, and a room
presentation needs no `nonce` because a host binds it to whoever signed the
envelope.
The test that asserted `nonce` was sent now asserts it is **not**, which is the
same test doing the same job against the shape that exists.
`npm run build` clean; 1,188 tests, 0 failures.
The last rooms UI piece. A room's records are served by its host, which this
console cannot address — so `rooms/keys/{browse,read}` ask the wallet's own agent
to make the call, being the party with a channel to the host, the credentials,
and the only copy of the epoch key.
**The verdict is the feature, and it is copy before it is code.** Every answer
carries what the agent checked, and the rule those checks feed — a client that
catches a host serves reads and refuses writes — is one nobody would guess. A
member shown a warning icon dismisses it; a member later refused a write with no
explanation concludes their own agent is broken. A detection attributed to the
wrong party is worse than no detection.
So `Verdict` says what was OBSERVED, never how alarmed to be, and always says
both halves of what follows:
- two roots at one version — "two different answers about this room… one of them
is wrong, and a write would explain neither, because a write moves the
version"; reading still works, writing will be refused;
- a short listing — the count it served against the count it committed to, which
is a contradiction inside a single answer and needs no anchor and no second
member to catch;
- a trace that does not reach its own root — "either its bookkeeping is broken or
the path was made up, and from here those look the same".
The reassuring side is where the other failure lives, and it is guarded too: a
verified trace says the record is under the root the host asserted and **nothing
about whether that root is the room's**, because a host serving a private view of
a room traces every record in it perfectly. The pane never lets it stand alone —
`a_verified_trace_never_stands_alone` asserts the qualification is on screen.
A host that keeps no tree is reported as making no claim rather than as failing,
with why it matters: a record it left out would look exactly like a room that
never held one.
Six render tests, every one against the words rather than the props — a pane that
computed the right verdict and drew none of it would pass a test written the
other way. A retracted record is included because a tombstone is an answer, and a
member told only "no body" reads a retraction as a fault.
`npm run build` clean; 1,194 tests, 0 failures.
🛡️ AI Agentic Security Code Review🔎 A manual security review is recommended before merging. Please contact the Security team for specifics and remediation guidance.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The last rooms UI piece. A room's records are served by its host, which this console cannot address — so
rooms/keys/{browse,read}ask the wallet's own agent to make the call, being the party with a channel to the host, the credentials, and the only copy of the epoch key.Stacked on #222, which adds the client functions.
The verdict is the feature, and it is copy before it is code
Every answer carries what the agent checked. The rule those checks feed — a client that catches a host serves reads and refuses writes — is one nobody would guess. A member shown a warning icon dismisses it; a member later refused a write with no explanation concludes their own agent is broken. A detection the member attributes to the wrong party is worse than no detection.
So
Verdictsays what was observed, never how alarmed to be, and always says both halves of what follows:Each ends with the same two sentences: reading still works, writing to this host will be refused.
The other failure is on the reassuring side
A verified trace says the record is under the root the host asserted and nothing about whether that root is the room's — a host serving a private view of a room builds a consistent tree over it and traces every record in it perfectly.
The pane never lets it stand alone.
a verified trace never stands alone as though it settled the questionasserts the qualification is on screen, and that the alarming words are not.A host that keeps no tree is reported as making no claim rather than as failing, with why that matters: a record it left out would look exactly like a room that never held one.
Tests
Six render tests, every one against the words rather than the props — a pane that computed the right verdict and drew none of it would pass a test written the other way. That is the same reasoning
rooms-pane.render.test.mtsalready gives for asserting the three standings on screen rather than againststanding().Included deliberately: a retracted record. A tombstone is an answer, and a member told only "no body" reads a retraction as a fault.
Also asserted: every call made from this pane goes to the wallet's own agent. A host verb from here would be dropped by the bridge and land somewhere that does not serve it, which is the defect this whole shape exists to avoid.
Checks
npm run build— cleannpm test— 1,194 tests, 0 failuresDepends on VTI serving
rooms/keys/{read,browse}(in flight).