openzoo 0.43.9 → 0.44.0

package/lib/namespace.js

@@ -15,26 +15,30 @@ import { loadOrCreateWallet } from './wallet.js';
  * restarts and reveal nothing. It is hashed again server-side, so the value on
  * the wire is not the address either.
  *
- * OPT-IN (OPENZOO_NAMESPACE=1), and off by default, deliberately.
+ * ALWAYS ON. There is no flag.
  *
- * Isolation is only sound if EVERY surface agrees on the namespace. In
- * practice they do not: the MCP server, the CLI and the proxy are separate
- * processes that a user upgrades at different times (npx happily serves a
- * stale cached build), so a corpus bound by a namespaced `zoo_bind` became
- * invisible to a chat sent through an older proxy — the context vanished,
- * every spill bind returned 400, and the gateway fell open and forwarded the
- * whole body at full price. MEASURED twice in one session, in both directions.
+ * It used to be opt-in and off, because a header the client merely ASSERTED
+ * was the wrong mechanism: the surfaces disagree in practice (the MCP server,
+ * the CLI and the proxy are separate processes upgraded at different times,
+ * and npx happily serves a stale cached build), so a corpus bound by a
+ * namespaced `zoo_bind` went invisible to a chat sent through an older proxy —
+ * the context vanished, spill binds 400'd, and the gateway fell open and
+ * forwarded the whole body at full price. MEASURED twice in one session.
  *
- * A header the client controls was the wrong mechanism: real isolation should
- * key off the settling payer, which the gateway already knows and cannot get
- * out of sync. Until that exists, defaulting off restores the behaviour that
- * always worked, and the gateway's fallback keeps namespaced contexts
- * reachable for anyone who opts in.
+ * That objection was about an UNVERIFIED claim and no longer holds: the value
+ * is signed (see signNamespace) and the gateway REQUIRES the signature,
+ * deriving the tenant from the proven signer. A flag was worse than useless
+ * here — off meant every caller shared one tenant, where a context is
+ * protected only by its id being unguessable and anyone may write into the
+ * same space, and a flag that is sometimes off is exactly the version skew
+ * that made contexts vanish. One behaviour, every surface, always.
+ *
+ * BREAKING: corpora bound before this lived in the shared tenant and are not
+ * reachable from a signed request. Re-bind them.
  */
 let cached = null;
 
 export function namespaceHeaderValue() {
-  if (process.env.OPENZOO_NAMESPACE !== '1') return '';
   if (cached) return cached;
   try {
     const w = loadOrCreateWallet();
@@ -86,16 +90,10 @@ function signNamespace(namespace) {
 export function withNamespace(headers = {}) {
   const ns = namespaceHeaderValue();
   if (!ns) return headers;
-  let proof = {};
-  try {
-    proof = signNamespace(ns);
-  } catch {
-    // Unsigned still works while the gateway is in soft launch. Sending the
-    // bare namespace is strictly better than sending nothing: it keeps the
-    // caller in their existing tenant instead of silently relocating every
-    // bound corpus to the shared one.
-  }
-  return { ...headers, 'x-openzoo-namespace': ns, ...proof };
+  // No unsigned fallback. The gateway REQUIRES the signature, so a bare
+  // namespace buys nothing — it would just be silently demoted to the shared
+  // tenant, which looks like "my corpus vanished" instead of a clear failure.
+  return { ...headers, 'x-openzoo-namespace': ns, ...signNamespace(ns) };
 }
 
 // Bitcoin-alphabet base58, matching what the gateway's bs58 decode expects.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openzoo",
-  "version": "0.43.9",
+  "version": "0.44.0",
   "description": "Local x402-paying proxy + MCP server for openzoo.fun — point any OpenAI-compatible harness (Cursor, Claude Code, aider, SDKs) at localhost and it pays per call from a local burner wallet. Solana and Base rails live; Robinhood experimental.",
   "license": "MIT",
   "type": "module",