mirror of
https://github.com/vitorpamplona/amethyst.git
synced 2026-08-10 00:16:59 +00:00
Claude
26795fb9a8
Every path derived every channel's Chat Plane from the `community_root`, `private: true` ones included — at six independent call sites (plane registry, subscription planner, session re-fold, and three send paths). CORD-03 §1 keys a private channel by the per-member `channel_key` delivered in the kind-13302 bundle, at that channel's own epoch. The consequence was not a weakly-enforced ACL but no ACL at all: a private channel sat on an address every member of the community could derive, so it was readable *and postable* by people never granted its key. Symmetrically, a private channel created by a conformant client was addressed somewhere we never looked, which is the "renders an empty room" symptom. `privateChannel` had exactly one caller in the tree — a Quartz test — and `private` was consulted on no send or subscribe path. Introduce `ConcordChannelPlanner`: one resolver mapping (entry, folded state) to per-channel plane coordinates — a `write` plane and the `reads` that span held epochs. Public channels resolve off the root as before; private channels off the bundle key. Every consumer now reads it, so the choice of secret is made once rather than re-decided per call site. The epoch travels with the plane. A private channel's wraps bind to its channel epoch, so passing the root epoch would have rejected every one of them on arrival even with the right key — the session's current-plane map carries the epoch for the same reason. A private channel we hold no key for is omitted from the channel list and the Messages inbox, matching the reference client's `channelsView`, and no write coordinate exists for it, so no send path can fall back to the root. Reaching one anyway (a stale route) now yields `PostingGate.NoKey` instead of a composer that would publish nowhere valid. Migration: "private" channels created by earlier Amethyst builds keep their history on the root-derived plane, which is no longer read for a private channel. That history is orphaned deliberately — reading it would mean continuing to accept traffic on a plane the whole community can write to. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q3KXHjmCpUDzrSRyxatbyB