@idleware/ringi 0.6.1 → 0.7.1

package/target/dts/index.d.ts

@@ -1,7 +1,6 @@
 import './composition/index.ts';
 export * from './core/hub/protocol/index.ts';
 export * from './core/hub/work/index.ts';
-export * as decide from './core/hub/decisions/index.ts';
 export * as signals from './core/hub/signals/index.ts';
 export type { Store, Transport, Descriptor, StoredRoom, StoredMessage, SignalRecord, Rev } from './core/hub/ports/store.ts';
 export { openHub, openRoom, createHub, contractAt } from './core/hub/rooms/index.ts';

package/target/esm/adapters/host-posix/index.js

@@ -1,35 +1,33 @@
-// host-posix: macOS/Linux process facts and launch control behind ProcessHost (core/agents/ports/host.ts). Its handles belong
-// only to this instance. A bounded observation never grants authority to stop an otherwise running process.
-import { fail } from '../../lib/fail.js';
-import { treeCpu } from './stats.js';
-import { launch } from './launch.js';
-import { alive, ancestors, snapshot, supported } from './probes.js';
-const systemClock = { wall: () => Date.now(), monotonic: () => performance.now() };
-const observe = (done, deadline, clock) => {
-    if (deadline !== undefined && !Number.isFinite(deadline))
-        fail('a process observation deadline must be finite');
-    const held = setInterval(() => { }, 1000);
-    if (deadline === undefined)
-        return done.finally(() => clearInterval(held));
-    return new Promise((resolve, reject) => {
-        const timer = setTimeout(() => { clearInterval(held); resolve(null); }, Math.max(0, deadline - clock.monotonic()));
-        const clear = () => { clearTimeout(timer); clearInterval(held); };
-        done.then(value => { clear(); resolve(value); }, error => { clear(); reject(error); });
-    });
+// host-posix: what macOS and Linux say about a process, and a detached start, behind ProcessHost
+// (core/agents/ports/host.ts). Elsewhere every probe says nothing rather than guess.
+import { spawn, spawnSync } from 'node:child_process';
+import path from 'node:path';
+const supported = process.platform === 'darwin' || process.platform === 'linux';
+// A process of another user that we may not signal still exists.
+const alive = (pid) => {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (e) {
+        return e.code === 'EPERM';
+    }
 };
-export const hostPosix = (clock = systemClock) => {
-    const processes = new WeakMap();
-    const own = (handle) => processes.get(handle) ?? fail('this process handle belongs to another host');
-    return {
-        supported, clock, alive, ancestors, snapshot,
-        inspect: (pid, rows = snapshot()) => ({ alive: supported ? alive(pid) : null, cpu: treeCpu(pid, rows) }),
-        start: request => {
-            const handle = {};
-            processes.set(handle, launch(request, clock));
-            return handle;
-        },
-        stop: handle => own(handle).stop(),
-        awaitQuiescence: (handle, deadline) => observe(own(handle).done, deadline, clock),
-    };
+// Up to twelve parents by name, from one `ps` call each; a sandbox that denies `ps` gets none.
+const ancestors = (first) => {
+    const result = [];
+    for (let pid = first, i = 0; i < 12 && pid > 1; i++) {
+        const r = spawnSync('ps', ['-o', 'ppid=,comm=', '-p', String(pid)], { encoding: 'utf8' });
+        const m = r.status === 0 ? /^\s*(\d+)\s+(.*)$/.exec(String(r.stdout ?? '').trim()) : null;
+        if (!m)
+            break;
+        result.push({ pid, name: path.basename(m[2].trim()).toLowerCase() });
+        pid = Number(m[1]);
+    }
+    return result;
 };
+export const hostPosix = () => ({
+    supported, alive, ancestors,
+    start: ({ file, args, env }) => { spawn(file, [...args], { detached: true, stdio: 'ignore', env }).unref(); },
+});
 //# sourceMappingURL=index.js.map

package/target/esm/adapters/transport-git/branches.js

@@ -1,5 +1,5 @@
 // branches: a room is one linear branch from its genesis. What its commits are (messages or control records), the
-// room's control files, and the room's life: create, archive, delete.
+// room's control files, and the room's life: create, delete.
 import { fail } from '../../lib/index.js';
 import * as Remote from './remote.js';
 import { ZERO } from './run.js';
@@ -9,17 +9,17 @@ import { ID_RE, parse } from '../../core/hub/protocol/index.js';
 const ROOT = 'operator';
 export const CONTROL_FILES = new Set(['ROOM.md', 'members.json', 'profile.json', 'allowed_signers']);
 export class Branches extends Repo {
-    ref(name) { return name.includes('@') ? `refs/archive/${name}` : `refs/heads/${name}`; }
+    ref(name) { return `refs/heads/${name}`; }
     tip(name) { return this.rev(this.ref(name)); }
     // Every branch but the contract's, by name.
     roomBranches() {
         return this.git(['for-each-ref', '--format=%(refname:lstrip=2)', 'refs/heads/']).split('\n').filter(b => b && b !== 'main');
     }
-    // Every branch but the contract's is a room; an archive is `<room>@<genesis8>`.
-    roomNames(archived) {
-        const prefix = archived ? 'refs/archive/' : 'refs/heads/';
+    // Every branch but the contract's is a room.
+    roomNames() {
+        const prefix = 'refs/heads/';
         const names = this.git(['for-each-ref', '--format=%(refname)', prefix]).split('\n').filter(Boolean).map(r => r.slice(prefix.length))
-            .filter(n => ID_RE.test(n.split('@')[0]) && n !== 'main' && n.includes('@') === archived);
+            .filter(n => ID_RE.test(n) && n !== 'main');
         return names.sort();
     }
     // A control record: the room's genesis, or a root commit of Kind: room.
@@ -42,7 +42,7 @@ export class Branches extends Repo {
     // On a signed hub the branch's verification says which commits are control records, and why the others that are no
     // valid message are skipped; a commit off the branch's first parents is never a message (remote.ts).
     judged(room, tip, entries) {
-        if (this.trust !== 'signed' || room.archived)
+        if (this.trust !== 'signed')
             return entries;
         const b = Remote.branch(this.h, { name: room.name, ref: this.ref(room.name), genesis: room.genesis }, tip);
         const control = new Set(b.control);
@@ -63,11 +63,10 @@ export class Branches extends Repo {
             return null;
         const genesis = this.git(['rev-list', '--first-parent', '--reverse', tip, '^refs/heads/main']).split('\n')[0]
             || this.git(['rev-list', '--first-parent', '--reverse', tip]).split('\n').filter(Boolean).at(-1);
-        const archived = name.includes('@');
-        if (this.trust === 'signed' && !archived && this.h.remoteAlarms?.[ref])
+        if (this.trust === 'signed' && this.h.remoteAlarms?.[ref])
             fail(`ALARM ${this.h.remoteAlarms[ref]}; room ${name} is quarantined`);
-        const control = this.entries({ name, genesis, archived }, tip).filter(e => e.control).map(e => ({ rev: e.sha, text: e.text }));
-        return { name, archived, head: control.at(-1).rev, genesis, tip, base: this.rev(`${genesis}^`) ?? ZERO, control };
+        const control = this.entries({ name, genesis }, tip).filter(e => e.control).map(e => ({ rev: e.sha, text: e.text }));
+        return { name, head: control.at(-1).rev, genesis, tip, base: this.rev(`${genesis}^`) ?? ZERO, control };
     }
     // Control files are read at a control record, never at the branch's tip.
     controlFile(room, name, rev) {
@@ -93,13 +92,7 @@ export class Branches extends Repo {
     refsUnder(prefix) {
         return this.git(['for-each-ref', '--format=%(refname) %(objectname)', prefix]).split('\n').filter(Boolean).map(l => l.split(' '));
     }
-    // The branch moves under the archive; its signals stay where they are, on its commits.
-    archiveRoom(room, as) {
-        const tip = this.rev(this.ref(room.name)) ?? fail(`room ${room.name} is gone`);
-        this.git(['update-ref', `refs/archive/${as}`, tip, ZERO]);
-        this.git(['update-ref', '-d', this.ref(room.name), tip]);
-    }
-    // Every ref of the room in one transaction: its branch (or archive), every tag on its commits (signals, heartbeats,
+    // Every ref of the room in one transaction: its branch, every tag on its commits (signals, heartbeats,
     // anyone's), what the store keeps under its genesis (pins, evidence) and its unpublished commits. Objects are left to
     // the repository.
     deleteRoom(room) {
@@ -114,10 +107,10 @@ export class Branches extends Repo {
         this.git(['update-ref', '--stdin'], { input: ['start', ...refs.map(r => `delete ${r}`), 'prepare', 'commit', ''].join('\n') });
     }
     remote(room) {
-        return { name: room.name, ref: this.ref(room.name), head: room.head, genesis: room.genesis, archived: room.archived };
+        return { name: room.name, ref: this.ref(room.name), head: room.head, genesis: room.genesis };
     }
     roster(room) {
-        if (this.trust !== 'signed' || room.archived)
+        if (this.trust !== 'signed')
             return null;
         const v = Remote.verifyRoom(this.h, this.remote(room));
         return { members: v.members, signers: v.entries };

package/target/esm/adapters/transport-git/index.js

@@ -4,7 +4,6 @@
 //                                         (the root's, on top of main); then every message is a commit by its author, and
 //                                         every control record (Kind: room) a commit by the root
 //   refs/tags/<agent>.<signal>.<message12>   signals: annotated tags without text on the message's commit
-//   refs/archive/<room>@<genesis8>        an archived room, read-only
 //   refs/ringi/accepted/<genesis>/<reader>/<author>   readers' pins of each author's accepted last message
 // A member's log is its own commits in the room's branch, in branch order. The control files at the root of a room's
 // tree (members, profile, signers) change only in the root's control records.
@@ -23,10 +22,13 @@ import { CONTROL_FILES } from './branches.js';
 import { Marks } from './marks.js';
 export { runGit } from './run.js';
 import { TEXT_MAX, checkOutgoing } from '../../core/hub/protocol/index.js';
+import { signingContext } from './remote/keys.js';
 export class GitStore extends Marks {
     type = 'git';
     static create(hubDir, d, connection, contract, text) {
         const { home, signing } = typeof connection === 'string' ? { home: connection, signing: undefined } : connection;
+        if (d.trust === 'signed')
+            signingContext({ name: d.name, signing });
         const dir = path.join(hubDir, d.store.path, '.git');
         // A signed hub's repository already exists: rootFor made it with the root key.
         if (!fs.existsSync(dir)) {
@@ -44,10 +46,11 @@ export class GitStore extends Marks {
     }
     // A new signed hub: the root key is generated on this machine and pinned in the descriptor.
     static rootFor(hubDir, d, home, signing) {
+        signingContext({ name: d.name, signing });
         const dir = path.join(hubDir, d.store.path, '.git');
         mkdirIn(home, path.dirname(dir));
         init(dir, home);
-        return Remote.setupSigned({ name: d.name, dir, d, signing }, home, d.store.remote).root;
+        return Remote.setupSigned({ name: d.name, dir, d, signing }, d.store.remote).root;
     }
     logIds(room) { return [...new Set(this.live(room).map(e => e.author))]; }
     logHead(room, id) { return this.live(room).filter(e => e.author === id).at(-1)?.sha ?? null; }
@@ -85,8 +88,6 @@ export class GitStore extends Marks {
     }
     // One message on top of the room's branch.
     append(room, who, text, entries) {
-        if (room.archived)
-            fail(`room ${room.name} is archived: read-only`);
         if (checkOutgoing(text, s => this.isRef(s)).trailers['ringi-files'])
             fail('Ringi-Files is store metadata; supply attachments instead');
         const own = entries.find(e => CONTROL_FILES.has(e.path));
@@ -103,8 +104,7 @@ export class GitStore extends Marks {
         return this.trust === 'signed' ? Remote.verify(this.h, this.remote(room), id, head) : null;
     }
     pin(room, reader, id, rev) {
-        if (!room.archived)
-            this.git(['update-ref', `refs/ringi/accepted/${room.genesis}/${reader}/${id}`, rev]);
+        this.git(['update-ref', `refs/ringi/accepted/${room.genesis}/${reader}/${id}`, rev]);
     }
     unpin(room, reader, id) {
         this.gitOk(['update-ref', '-d', `refs/ringi/accepted/${room.genesis}/${reader}/${id}`]);
@@ -118,11 +118,10 @@ export class GitStore extends Marks {
             .map(b => /^\d+ blob [0-9a-f]+ +(\d+)\t(.*)$/s.exec(b.toString('utf8'))).filter((x) => !!x)
             .filter(([, , p]) => wanted.has(p)).map(([, n, p]) => [p, Number(n)]));
     }
-    admit(room, who, key) { return Remote.roomAdmit(this.h, this.remote(room), who, key, this.home); }
-    joinKey(room, who) { return Remote.join(this.h, this.remote(room), who, this.home); }
+    admit(room, who, key) { return Remote.roomAdmit(this.h, this.remote(room), who, key); }
+    joinKey(room, who) { return Remote.join(this.h, this.remote(room), who); }
     // A room's transport alarm is the room's, whichever author the operator forgets.
     forgetLog(room, _id) { Remote.forget(this.h, this.remote(room)); }
-    rootKey() { return this.d.root ?? fail(`hub ${this.d.name} has no pinned root`); }
     rootRoster() { return Remote.rootRoster(this.h); }
 }
 //# sourceMappingURL=index.js.map

package/target/esm/adapters/transport-git/marks.js

@@ -2,7 +2,7 @@
 // one mutable tag `<agent>.heartbeat.<genesis12>` per agent and room, replaced on every beat.
 import * as Remote from './remote.js';
 import { signedTag } from './signing.js';
-import { ZERO, frames, ident, runGitRaw } from './run.js';
+import { ZERO, frames, runGitRaw } from './run.js';
 import { signalTags, tagObject } from './tags.js';
 import { Branches } from './branches.js';
 import { fail, note } from '../../lib/index.js';
@@ -15,7 +15,7 @@ export class Marks extends Branches {
     heartbeat(room, who, target, text) {
         const ref = Remote.heartbeatRef(who, room.genesis), name = ref.slice('refs/tags/'.length);
         const old = this.rev(`${ref}^{tag}`) ? this.git(['rev-parse', ref]).trim() : null;
-        const obj = this.trust === 'signed' ? Remote.makeHeartbeat(this.h, this.remote(room), who, target, text, this.home)
+        const obj = this.trust === 'signed' ? Remote.makeHeartbeat(this.h, this.remote(room), who, target, text)
             : this.git(['mktag'], { input: `object ${target}\ntype commit\ntag ${name}\ntagger ${who} <${who}@ringi> ${Math.floor(Date.now() / 1000)} +0000\n\n${text}` }).trim();
         if (this.gitOk(['update-ref', ref, obj, old ?? ZERO]).status !== 0)
             fail(`${name} moved meanwhile; the next beat writes it`);
@@ -45,13 +45,7 @@ export class Marks extends Branches {
             Remote.push(this.h, ref);
             return;
         }
-        if (this.h.signing)
-            this.git(['update-ref', ref, signedTag(this.h, who, tag, target, this.home), ZERO]);
-        else {
-            const sign = Remote.sign(this.h, who, this.home);
-            const key = sign[0]?.slice(2);
-            this.git([...(key ? ['-c', `user.signingkey=${key}`] : []), 'tag', key ? '-s' : '-a', '-F', '-', tag, target], { input: '', env: ident(who) });
-        }
+        this.git(['update-ref', ref, signedTag(this.h, who, tag, target), ZERO]);
         Remote.push(this.h, ref);
     }
     // The tags named `<actor>.<signal>.<message12>`, with the objects they name; a heartbeat is no signal (heartbeats()).
@@ -75,7 +69,7 @@ export class Marks extends Branches {
                 return [];
             return [{ ref: t.ref, object: t.object, name: t.name, actor: t.actor, target: o?.target ?? '', tagger: o?.tagger ?? '', text: o?.text ?? '' }];
         });
-        if (this.trust !== 'signed' || room.archived)
+        if (this.trust !== 'signed')
             return records;
         return Remote.withVerification(this.h, () => records.filter(s => {
             const why = Remote.verifySignal(this.h, this.remote(room), s.ref, s.object);

package/target/esm/adapters/transport-git/remote/admit.js

@@ -3,13 +3,13 @@ import * as C from '../../../lib/index.js';
 import * as P from '../../../core/hub/protocol/index.js';
 import { branch, verifyRoom } from './branch.js';
 import { git, id, ident, isRemote, locked, rev } from './git.js';
-import { keyInput, identityKey, sign, signerLine } from './keys.js';
+import { keyInput, identityKey, signerLine } from './keys.js';
 import { signCommit } from '../signing.js';
 import { push } from './push.js';
 import { CONTROL_FILES, ROOT } from './types.js';
-export const join = (H, R, who, home) => {
+export const join = (H, R, who) => {
     const room = verifyRoom(H, R);
-    const key = locked(H, () => identityKey(H, who, home, true));
+    const key = locked(H, () => identityKey(H, who, true));
     const admitted = !!room.entries.find(e => e.principal === who && e.key.line === key.line);
     return { publicKey: key.line, fingerprint: key.fp, admitted };
 };
@@ -30,14 +30,14 @@ const treeWith = (H, base, control, patches) => {
     return git(H, ['mktree'], { input: [...files].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([, line]) => line).join('\n') + '\n' }).trim();
 };
 // The root's control record admitting a member, on top of the room's branch: the key and the member go in together.
-export const roomAdmit = (H, R, who, publicKey, home) => {
+export const roomAdmit = (H, R, who, publicKey) => {
     const key = admissionKey(H, R, who, publicKey);
     for (let attempt = 0; attempt < 8; attempt++) {
         const tip = rev(H, R.ref) ?? C.fail('room branch is missing');
         const room = branch(H, R, tip), head = room.control.at(-1);
         if (room.entries.some(e => e.principal === who || e.key.fp === key.fp))
             C.fail('principal or key is already admitted; key rotation is not implemented');
-        const { sha, members } = admissionCommit({ H, R, who, home, tip, head, room, key });
+        const { sha, members } = admissionCommit({ H, R, who, tip, head, room, key });
         if (git(H, ['update-ref', R.ref, sha, tip], { ok: true }).status !== 0)
             continue;
         if (!push(H, R.ref, { behind: true }))
@@ -48,14 +48,14 @@ export const roomAdmit = (H, R, who, publicKey, home) => {
     }
     return C.fail('room kept moving while admitting; retry');
 };
-const admissionCommit = ({ H, who, home, tip, head, room, key }) => {
+const admissionCommit = ({ H, who, tip, head, room, key }) => {
     const members = { ...room.members, [who]: { role: 'member', since: new Date().toISOString() } };
     const roster = [...room.entries.map(e => signerLine(e.principal, e.key)), signerLine(who, key)].join('');
     const tree = treeWith(H, tip, head, { 'members.json': JSON.stringify(members, null, 2) + '\n', allowed_signers: roster });
-    const sha = git(H, ['commit-tree', ...(H.signing ? [] : sign(H, ROOT, home)), tree, '-p', tip], {
+    const sha = git(H, ['commit-tree', tree, '-p', tip], {
         input: P.compose(`admit ${who}`, [['To', '*'], ['Kind', 'room'], ['Key', key.fp]]), env: ident(ROOT),
     }).trim();
-    return { sha: signCommit(H, ROOT, sha, home), members };
+    return { sha: signCommit(H, ROOT, sha), members };
 };
 const admissionKey = (H, R, who, publicKey) => {
     id(who);
@@ -63,8 +63,6 @@ const admissionKey = (H, R, who, publicKey) => {
         C.fail('room admit is for signed hubs; local membership is added by join');
     if (who === ROOT)
         C.fail('the root is already pinned; root replacement requires a separate trust transition');
-    if (R.archived)
-        C.fail('cannot admit into an archived room');
     const key = keyInput(publicKey);
     return key;
 };

package/target/esm/adapters/transport-git/remote/heartbeat-push.js

@@ -5,7 +5,7 @@ import { checkHeartbeat, heartbeatRef } from './heartbeat.js';
 import { checkUrl } from './keys.js';
 import { SHA, TAG_ACCEPT, TAG_TRACK, TAGS } from './types.js';
 // Publish only the actor's exact heartbeat with an explicit old OID. A racing beat is ordinary contention, never a
-// signal rewrite alarm. Neither success nor failure changes immutable acceptance pins or budget/history state.
+// signal rewrite alarm. Neither success nor failure changes immutable acceptance pins or history state.
 export const pushHeartbeat = (H, R, who, sha, expected) => {
     const ref = heartbeatRef(who, R.genesis);
     if (!SHA.test(sha) || (expected !== null && !SHA.test(expected)))

package/target/esm/adapters/transport-git/remote/heartbeat.js

@@ -24,9 +24,9 @@ export const verifyHeartbeat = (H, R, ref, sha) => {
         return reason(e);
     }
 };
-// Keep the transport's existing call contract while object construction has one named input.
-export const makeHeartbeat = (...[H, R, who, target, text, home]) => createHeartbeat({ H, R, who, target, text, home });
-const createHeartbeat = ({ H, R, who, target, text, home }) => {
+// Object construction has one named input; signing needs no custody path.
+export const makeHeartbeat = (...[H, R, who, target, text]) => createHeartbeat({ H, R, who, target, text });
+const createHeartbeat = ({ H, R, who, target, text }) => {
     const ref = heartbeatRef(who, R.genesis);
     if (!SHA.test(target))
         C.fail('heartbeat target must be a full commit id');
@@ -35,7 +35,7 @@ const createHeartbeat = ({ H, R, who, target, text, home }) => {
     const body = `Room: ${R.genesis}\n${text.trimEnd()}\n`;
     heartbeatBody(body);
     const raw = `object ${target}\ntype commit\ntag ${ref.slice(TAGS.length)}\ntagger ${who} <${who}@ringi> ${Math.floor(Date.now() / 1000)} +0000\n\n${body}`;
-    const signature = signBytes(H, who, raw, home);
+    const signature = signBytes(H, who, raw);
     const sha = git(H, ['mktag'], { input: raw + signature }).trim();
     if (isRemote(H))
         checkHeartbeat(H, R, ref, sha);

package/target/esm/adapters/transport-git/remote/keys.js

@@ -1,10 +1,8 @@
 // keys: public keys as given and pinned, a signed hub's root and its signers, and which key signs for a principal.
 import crypto from 'node:crypto';
 import fs from 'node:fs';
-import path from 'node:path';
 import * as C from '../../../lib/index.js';
-import { config, id, isRemote, mkdir, rev } from './git.js';
-import { command } from './process.js';
+import { id, rev } from './git.js';
 import { ROOT } from './types.js';
 export const parseKey = (value) => {
     const text = String(value || '').trim();
@@ -20,47 +18,24 @@ export const parseKey = (value) => {
 export const keyInput = (value) => parseKey(fs.existsSync(value) && fs.statSync(value).isFile() ? fs.readFileSync(value, 'utf8') : value);
 export const rootKey = (H) => parseKey(H.d.root || C.fail(`hub ${H.name} has no out-of-band root pin; use hub add --root <public-key|file>`));
 export const signerLine = (who, key) => `${who} namespaces="git" ${key.line}\n`;
-const keyPath = (H, who, home) => path.join(home, 'keys', id(H.name), id(who));
-const localKey = (H, who, home, create = false) => {
-    const file = keyPath(H, who, home);
-    if (!fs.existsSync(file)) {
-        if (!create)
-            C.fail(`no private key for ${who} on this machine; ${who === ROOT ? 'root keys are never obtained from a hub' : 'join here to generate one, then ask the root to admit its public key'}`);
-        mkdir(path.dirname(file));
-        command('ssh-keygen', ['-q', '-t', 'ed25519', '-N', '', '-C', `${who}@ringi`, '-f', file]);
-    }
-    // Derive from the private key instead of trusting a mutable .pub sidecar.
-    const key = parseKey(command('ssh-keygen', ['-y', '-f', file]));
-    return { ...key, file };
+export const signingContext = (H) => H.signing ?? C.fail(`hub ${H.name}: signed writes require an injected Signer`);
+export const identityKey = (H, who, create = false) => {
+    const context = signingContext(H);
+    return parseKey(context.signer.publicIdentity(context.resolve(id(H.name), id(who), create)).key);
 };
-export const identityKey = (H, who, home, create = false) => H.signing
-    ? parseKey(H.signing.signer.publicIdentity(H.signing.resolve(id(H.name), id(who), create)).key)
-    : localKey(H, who, home, create);
-export const setupSigned = (H, home, url) => {
+export const setupSigned = (H, url) => {
     id(H.name);
     if (rev(H, 'refs/heads/main'))
         C.fail('setupSigned only initializes an empty hub; it cannot replace an existing trust anchor');
-    const key = identityKey(H, ROOT, home, true);
+    const key = identityKey(H, ROOT, true);
     H.d.trust = 'signed';
     H.d.root = key.line;
-    config(H, 'gpg.format', 'ssh');
-    config(H, 'gpg.ssh.program', 'ssh-keygen');
     if (url) {
         checkUrl(url);
         H.d.store.remote = url;
     }
     return { root: key.line, allowedSigners: signerLine(ROOT, key) };
 };
-export const sign = (H, who, home) => {
-    if (!isRemote(H))
-        return [];
-    const key = localKey(H, who, home);
-    if (who === ROOT && key.line !== rootKey(H).line)
-        C.fail('the local operator key does not match this hub\'s pinned root');
-    config(H, 'gpg.format', 'ssh');
-    config(H, 'gpg.ssh.program', 'ssh-keygen');
-    return [`-S${key.file}`];
-};
 export const rootRoster = (H) => signerLine(ROOT, rootKey(H));
 const supportedUrl = (url) => {
     const malformed = /[\r\n\0]/.test(url) || url.startsWith('-');

package/target/esm/adapters/transport-git/remote/main.js

@@ -1,7 +1,7 @@
 // main: the hub's contract branch verified: every commit signed by the root since the pinned genesis.
 import * as C from '../../../lib/index.js';
 import { memo } from './cache.js';
-import { git, isRemote, rev } from './git.js';
+import { isRemote, rev } from './git.js';
 import { parseKey, rootKey } from './keys.js';
 import { blobText } from './roster.js';
 import { chain, checkSignature, linear } from './signature.js';
@@ -34,8 +34,5 @@ const checkContract = (H, sha, key) => {
     const meta = C.strictJson(blobText(H, sha, name), name);
     if (meta.schema !== 'ringi-hub' || meta.trust !== 'signed' || parseKey(meta.root).line !== key.line)
         C.fail(`${name} must declare signed trust and the pinned root key`);
-    const authority = git(H, ['cat-file', '-e', `${sha}:authority.json`], { ok: true });
-    if (authority.status === 0)
-        C.strictJson(blobText(H, sha, 'authority.json'), 'authority.json');
 };
 //# sourceMappingURL=main.js.map

package/target/esm/adapters/transport-git/remote.js

@@ -1,7 +1,7 @@
 export { withVerification } from './remote/cache.js';
 export { gitEnv, gitTimeout, checkGitTimeout } from './remote/process.js';
 export { isRemote } from './remote/git.js';
-export { parseKey, setupSigned, sign, rootRoster } from './remote/keys.js';
+export { parseKey, setupSigned, rootRoster } from './remote/keys.js';
 export { verifyHub } from './remote/main.js';
 export { readCommits } from './remote/commits.js';
 export { branch, verifyRoom, verify } from './remote/branch.js';

package/target/esm/adapters/transport-git/repo.js

@@ -8,6 +8,7 @@ import { mkdirIn } from '../fs/index.js';
 import * as Remote from './remote.js';
 import { ZERO, ident, runGit, runGitOk } from './run.js';
 import { signCommit } from './signing.js';
+import { signingContext } from './remote/keys.js';
 // The store is a repository whose work tree holds the contract (`main`) as it is now, so Git clients (SourceTree, IDEs)
 // open `store/` without errors, on the contract, with every room's branch beside it; `git status` stays clean.
 export const init = (dir, home) => runGit(['init', '-q', '-b', 'main', path.dirname(dir)], { where: home });
@@ -24,6 +25,8 @@ export class Repo {
         this.trust = d.trust;
         this.dir = path.join(hubDir, d.store.path, '.git');
         this.h = { name: d.name, dir: this.dir, d, ...(d.trust === 'signed' && signing ? { signing } : {}) };
+        if (this.trust === 'signed')
+            signingContext(this.h);
         if (!fs.existsSync(this.dir))
             fail(`hub ${d.name}: no git store at ${this.dir}`);
         this.openable();
@@ -82,8 +85,8 @@ export class Repo {
     }
     // Every commit is made here: on a signed hub, signed by its author's key on this machine.
     commit(who, text, tree, parents) {
-        const sha = this.git(['commit-tree', ...(this.h.signing ? [] : Remote.sign(this.h, who, this.home)), tree, ...parents.flatMap(p => ['-p', p])], { input: text, env: ident(who) }).trim();
-        return signCommit(this.h, who, sha, this.home);
+        const sha = this.git(['commit-tree', tree, ...parents.flatMap(p => ['-p', p])], { input: text, env: ident(who) }).trim();
+        return signCommit(this.h, who, sha);
     }
     advance(ref, sha, old) {
         if (this.gitOk(['update-ref', ref, sha, old ?? ZERO]).status !== 0)
@@ -102,7 +105,6 @@ export class Repo {
         const r = this.gitOk(['show', `${rev}:${name}`]);
         return r.status === 0 ? r.stdout : null;
     }
-    contractFiles(rev) { return this.git(['ls-tree', '-r', '--name-only', rev]).split('\n').filter(Boolean); }
     amendContract(who, text, files) {
         const head = this.contractHead();
         const sha = this.commit(who, text, this.tree(`${head}^{tree}`, Object.entries(files).map(([p, c]) => ({ path: p, content: c, mode: '100644' }))), [head]);

package/target/esm/adapters/transport-git/signing.js

@@ -1,18 +1,13 @@
 // GitSigningBridge: Signer signs the exact unsigned Git object. Tags append its SSH armor; commits fold it into
-// gpgsig. Custody is injected; only legacy direct entrypoints retain their previous file-key signing default.
+// gpgsig. All signing and public identity come from the injected Signer; custody stays outside the transport.
 import { fail } from '../../lib/index.js';
 import { git, id, ident, isRemote } from './remote/git.js';
-import { identityKey, parseKey, rootKey, sign } from './remote/keys.js';
-import { command } from './remote/process.js';
+import { identityKey, parseKey, rootKey, signingContext } from './remote/keys.js';
 import { checkSignature } from './remote/signature.js';
-export const signBytes = (H, who, payload, home) => {
+export const signBytes = (H, who, payload) => {
     if (!isRemote(H))
         return '';
-    if (!H.signing) {
-        const file = sign(H, who, home)[0].slice(2);
-        return command('ssh-keygen', ['-Y', 'sign', '-n', 'git', '-f', file], { input: payload });
-    }
-    const context = H.signing, key = context.resolve(id(H.name), id(who));
+    const context = signingContext(H), key = context.resolve(id(H.name), id(who));
     const identity = context.signer.publicIdentity(key), publicKey = parseKey(identity.key);
     if (who === 'operator' && publicKey.line !== rootKey(H).line)
         fail('the local operator key does not match this hub\'s pinned root');
@@ -21,24 +16,24 @@ export const signBytes = (H, who, payload, home) => {
         fail('the signer returned an incompatible signature identity or format');
     return Buffer.from(signature.bytes).toString('utf8');
 };
-// The legacy constructor path already asked Git to sign; only an injected provider uses the neutral byte bridge.
-export const signCommit = (H, who, sha, home) => {
-    if (!H.signing || !isRemote(H))
+export const signCommit = (H, who, sha) => {
+    if (!isRemote(H))
         return sha;
     const raw = git(H, ['cat-file', 'commit', sha], { raw: true }), end = raw.indexOf('\n\n');
     if (end < 0)
         fail('malformed unsigned commit');
-    const signature = signBytes(H, who, raw, home).trimEnd().replace(/\n/g, '\n ');
+    const signature = signBytes(H, who, raw).trimEnd().replace(/\n/g, '\n ');
     const body = Buffer.concat([raw.subarray(0, end), Buffer.from(`\ngpgsig ${signature}\n\n`), raw.subarray(end + 2)]);
     const signed = git(H, ['hash-object', '-t', 'commit', '-w', '--stdin'], { input: body }).trim();
-    checkSignature(H, signed, who, identityKey(H, who, home));
+    checkSignature(H, signed, who, identityKey(H, who));
     return signed;
 };
-export const signedTag = (H, who, tag, target, home) => {
+export const signedTag = (H, who, tag, target) => {
     const tagger = git(H, ['var', 'GIT_COMMITTER_IDENT'], { env: ident(who) }).trim();
     const raw = `object ${target}\ntype commit\ntag ${tag}\ntagger ${tagger}\n\n`;
-    const signed = git(H, ['mktag'], { input: raw + signBytes(H, who, raw, home) }).trim();
-    checkSignature(H, signed, who, identityKey(H, who, home), 'tag');
+    const signed = git(H, ['mktag'], { input: raw + signBytes(H, who, raw) }).trim();
+    if (isRemote(H))
+        checkSignature(H, signed, who, identityKey(H, who), 'tag');
     return signed;
 };
 //# sourceMappingURL=signing.js.map

package/target/esm/adapters/transport-git/transport.js

@@ -1,12 +1,12 @@
 // transport: the git store as a store type: a hub's repository is `store/.git` in the hub's directory; a signed hub's
-// root key is made here (remote/keys.ts) and a published hub is replicated by bootstrap (remote/bootstrap.ts).
-import path from 'node:path';
+// root identity comes from Signer and a published hub is replicated by bootstrap (remote/bootstrap.ts).
+import { fail } from '../../lib/index.js';
 import { GitStore } from './index.js';
 import * as Remote from './remote.js';
 const context = (d, opt) => d.trust === 'signed'
-    ? typeof opt.signer === 'function' ? opt.signer() : opt.signer
+    ? (typeof opt.signer === 'function' ? opt.signer() : opt.signer) ?? fail('signed hubs require an injected Signer')
     : undefined;
-// `home`: where this machine keeps its state; the git store keeps its keys and scratch indexes there.
+// `home`: where this machine keeps its state and scratch indexes; Signer owns key custody.
 export const gitTransport = (home, opt = {}) => ({
     // One branch per room with its messages and control records, signals as tags on them (hub-1, Layout).
     layout: 'git/2',
@@ -15,13 +15,13 @@ export const gitTransport = (home, opt = {}) => ({
     open: (at, d) => new GitStore(at, d, home, context(d, opt)),
     create: (at, d, genesis) => {
         const signing = context(d, opt);
-        if (d.trust === 'signed')
+        if (signing)
             d.root = GitStore.rootFor(at, d, home, signing);
         const g = genesis(d);
         const store = GitStore.create(at, d, { home, signing }, g.files, g.text);
         if (d.trust === 'signed')
             d.genesis = store.contractHead();
-        const custody = d.trust !== 'signed' ? null : signing ? signing.custody?.(d.name, 'operator') ?? null : path.join(home, 'keys', d.name, 'operator');
+        const custody = signing?.custody?.(d.name, 'operator') ?? null;
         return { store, custody };
     },
     attach: (name, url, pins) => { Remote.hubAdd({ home, name, url, ...pins }); },

package/target/esm/clients/cli/agent/index.js

@@ -1,9 +1,9 @@
-// agent: the commands only an agent runs, as the agent its session is bound to (`ringi agent inbox`, whoami, card,
-// ping, wait, take); joining and leaving a room are session.ts.
+// agent: the commands only an agent runs, as the agent its session is bound to (`ringi agent inbox`, whoami, wait,
+// take); joining and leaving a room are session.ts.
 import * as Agent from '../../../core/agents/sessions/agent.js';
 import { asJson, render } from '../../../core/hub/usecases/view.js';
-import { fail, short, when } from '../../../lib/index.js';
-import { dump, flag, list, opt, out, textOf } from '../args.js';
+import { fail, short } from '../../../lib/index.js';
+import { dump, flag, opt, out } from '../args.js';
 import { scopeLine, waiting } from '../shared/index.js';
 const options = (o) => ({ peek: flag(o, 'peek'), limit: opt(o, 'limit') ? Number(opt(o, 'limit')) : undefined });
 export const showInbox = ({ R, me, s }, res, o) => {
@@ -31,12 +31,6 @@ export const whoami = (a) => {
     const { session: s, profile, members } = Agent.whoami(a);
     out(`${s.agent} in ${s.hub}/${s.room} (genesis ${short(s.genesis)}, profile ${profile}), session ${s.handle}, ${s.state}\nscope: ${scopeLine(s, a.R.quorum !== null)}\nmembers: ${members.join(', ')}`);
 };
-export const card = (a, o) => out(`card ${short(Agent.card(a, textOf(o)))}`);
-export const ping = (a, o) => {
-    const r = Agent.ping(a, { to: o._[0] ?? fail('usage: ringi agent ping <id> [-m <note>] [--next <s>] [--re <msg>]'),
-        text: list(o, 'm').length ? list(o, 'm').join('\n\n') : undefined, next: opt(o, 'next') ? Number(opt(o, 'next')) : undefined, re: opt(o, 're') });
-    out(`ping ${short(r.id)} to ${r.to}${r.previous ? (r.previous.answeredAt !== null ? `; ${r.to} answered the previous one at ${when(r.previous.answeredAt)}` : `; no pong to the previous one (${short(r.previous.id)})`) : ''}`);
-};
 export const wait = async (a, o) => {
     const r = await Agent.wait(a, { ...options(o), max: opt(o, 'max') === undefined ? undefined : Number(opt(o, 'max')) });
     if (r.inbox)