Claude 401f36ee82 fix(geode): mirror trust bound to origin relay; reconnect advances since watermark ...

Two mirror hardening fixes from the audit:

- Trust leak: the skip-verify decision was keyed on the subscription id,
  but the client pool dispatches EVENTs by subscription id alone and
  every [[mirror]] upstream shares one client. A hostile untrusted
  upstream could answer with the trusted upstream's subscription id and
  ride its skip-verify into the store. startDown now drops any event
  whose delivering relay isn't the one that subscription dialed
  (relay != up.url). New MirrorWorkerTrustOriginTest injects a foreign
  subId frame from a hostile relay and asserts it never lands.

- Reconnect replay: `since` was frozen at boot, so a long-lived daemon
  re-streamed the whole backfill window on every upstream flap. The down
  path now tracks the newest ingested created_at and, on the
  connected->disconnected edge, advances the REQ's since to
  watermark - overlap before the reconnect re-sends it. Advancing only on
  disconnect means a stable link never re-queries. The reconnect test now
  asserts the watermark advanced.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TtDNpayEYvJH7QuPswND3A

2026-07-04 02:32:21 +00:00

..

plans

docs(geode): SQLite knobs A/B verdict — no winner, knobs stay off by default

2026-07-04 00:50:37 +00:00

src

fix(geode): mirror trust bound to origin relay; reconnect advances since watermark

2026-07-04 02:32:21 +00:00

build.gradle.kts

feat(geode): [[mirror]] upstream streaming with relay-to-relay trust

2026-07-03 21:22:46 +00:00

config.example.toml

feat(geode): mirror directions — dir = "down" | "up" | "both" (strfry-router parity)

2026-07-04 01:32:18 +00:00