Three confirmed defects from adversarial review of the per-relay inbound
pipeline (PR #1352):
- MEDIUM-2: a detached gift-wrap decrypt spawned just before a panic wipe
strongly captures the pre-wipe Nostr private key and could deliver
plaintext into ChatViewModel after the wipe. Add a per-pipeline
monotonic wipe generation (NostrInboundPipeline.wipeGeneration), bumped
from panicClearAllData via invalidateInFlightDecrypts(); spawn sites
capture it and every main-actor hop drops the task's result on
mismatch. The account-mailbox path (processNostrMessage) had the same
pre-existing hazard and gets the identical guard, capturing the
generation atomically with the identity fetch.
- MEDIUM-1: the per-relay stream cap bounds FRAMES (256) but not BYTES;
with the URLSession default of 1 MiB per WebSocket frame a hostile
relay could pile up ~256 MiB. Set URLSessionWebSocketTask
.maximumMessageSize to TransportConfig.nostrInboundMaxFrameBytes
(512 KiB — an order of magnitude above any legitimate Nostr event or
gift wrap we produce or expect), halving the worst case to 128 MiB,
and correct the "cannot exhaust memory" comments to state the actual
cap × maxFrameBytes bound.
- LOW-5: three NostrRelayManagerTests gated on messagesReceived (first
main hop) then immediately asserted delivery-side state that only
lands after off-main verification plus a second main hop. Wait on the
delivery-side state (receivedIDs / duplicate-drop counts) directly,
keeping all assertions.
Also: brief comment documenting pendingGiftWrapIDs growth (LOW-6) and a
regression test that a panic wipe issued after spawn drops the decrypted
result while leaving the pipeline usable.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Every inbound relay event was Schnorr-verified TWICE, both times on the
main actor: once in NostrRelayManager.handleParsedMessage and again in
each NostrInboundPipeline / GeoPresenceTracker handler. Each
verification re-serializes the event JSON, hashes it, and runs a
secp256k1 Schnorr verify, so busy geohashes paid double crypto on the
UI thread. Geohash gift-wrap NIP-17 decryption (two ECDH+ChaCha layers)
also ran on the main actor.
Changes:
- NostrRelayManager now owns a serial off-main inbound pipeline
(AsyncStream + single consumer task): frames are parsed and verified
in arrival order off the main actor, preserving per-subscription
delivery order. This is the single verification point for the whole
inbound path; downstream handlers only ever see verified events.
- Dedup stays two-phase and unpoisonable: a cheap main-actor duplicate
LOOKUP runs before verification (duplicate fan-in from several relays
never pays for crypto — previously every duplicate was verified), and
events are RECORDED as seen only after the signature verifies, so a
forged-signature copy can never suppress the genuine event.
- NostrInboundPipeline and GeoPresenceTracker drop their redundant
re-verification; geohash gift-wrap decryption moves off the main
actor following the existing account-mailbox Task.detached pattern
(atomic main-actor check-and-record, then decrypt off-main, then hop
back for state updates).
- Tests: relay-level coverage for tampered gift wraps and for in-order
delivery of back-to-back frames; pipeline-level tampered-signature
tests move to the relay boundary where the invariant now lives; the
mock relay connection queues frames emitted before receive re-arms.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Mesh and geohash timelines are now store conversations. All public
mutation sites flow through store intents; PublicMessagePipeline keeps
its 80ms UI batching but commits batches via store appends with each
buffered entry carrying its destination conversation (a mid-batch
channel switch now flushes instead of dropping the buffer).
ChatViewModel.messages becomes a cached get-only view of the active
conversation, invalidated through the change subject. The mesh
late-insert threshold is consciously removed: it only ever ordered the
non-rendered messages copy, so strict timestamp insertion makes the
working set agree with rendered order. PublicTimelineStore and the
per-message full-array legacy sync are deleted; the coalescing bridge
mirrors public conversations for the remaining legacy readers.
pipeline.publicIngest: 6.6k -> 9.5k msg/s (+45%); private steady;
store.append 237k/s.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
NotificationService.shared and FavoritesPersistenceService.shared
accesses across nine coordinators/components consolidate into
ChatViewModel witnesses behind intent-named context members
(notifyPrivateMessage, notifyMention, favoriteRelationship(forNoiseKey:),
allFavoriteRelationships, postLocalNotification, ...). Singleton reach
from coordinators is now zero; nine new tests cover previously
untestable notification/favorites flows.
Also root-causes the long-flaky gift-wrap dedup test: parallel tests
share LocationChannelManager.shared, so channel-switch tests trigger
clearProcessedNostrEvents() on every live ChatViewModel, wiping the
dedup record mid-test. The invariant (forged-signature copies never
poison dedup) now lives as a deterministic NostrInboundPipeline
mock-context test; two Schnorr concurrency probes added along the way
stay as regression guards for the P256K shared-context assumptions.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The 1,109-line coordinator becomes a 187-line facade wiring three
components, each with its own narrow context protocol:
GeohashSubscriptionManager (384 lines - subscription IDs + relay
lifecycle, the only NostrRelayManager toucher), NostrInboundPipeline
(490 lines - the hot event path, dedup-before-verify ordering preserved
verbatim), and GeoPresenceTracker (192 lines - teleport detection,
sampling LRU, notification cooldowns, now directly tested).
Perf baselines confirm the hot path is unchanged: fresh events
2,131 -> 2,138/sec, duplicates ~1.41M/sec.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
nostrKeyMapping, sentGeoDeliveryAcks/sentReadReceipts dedupe,
isBatchingPublic, geo subscription lifecycle, and private-chat selection
hand-off now mutate through single intent operations on ChatViewModel,
with backing storage locked down via private(set) so the single-writer
property is compiler-enforced. Context protocols downgrade to read-only
access where reads remain. 8 new contract tests.
Known remaining writers outside the protocols: sentReadReceipts is
passed inout to PrivateChatManager.syncReadReceiptsForSentMessages and
un-marked by ChatTransportEventCoordinator on disconnect.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
BLEService's per-packet-type orchestration moves into owned, tested
components (BLEAnnounceHandler, BLEPublicMessageHandler,
BLENoisePacketHandler, BLEFileTransferHandler, BLEFragmentHandler),
each taking an environment struct of closures so every queue hop stays
in BLEService and the handlers are synchronously testable. Behavior is
preserved verbatim, including Noise session recovery on decrypt failure
and single-block UI event ordering. handleLeave/handleRequestSync stay
in place as already-thin delegations. BLEService drops to 3393 lines.
Four coordinators (delivery, private conversation, Nostr, public
conversation) drop their unowned/weak ChatViewModel back-references for
narrow @MainActor context protocols, with ChatViewModel conformances as
single shared witnesses for overlapping members. Their true coupling is
now an explicit, reviewable surface, and each gains a mock-context test
suite covering flows previously testable only through the full view
model. Delivery/read acks now also clear the router's retained-send
outbox via the delivery context.
New LargeTopologyTests exercise production-shaped meshes with the
in-memory harness: an 8-peer relay chain with per-hop TTL decay, a
14-peer cyclic mesh with exactly-once delivery, partition/heal, and
topology churn.
App-layer runtime/model files updated alongside.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
