78 lines
5.0 KiB
Plaintext
78 lines
5.0 KiB
Plaintext
Beta feedback — reviewed private draft and exact-event outbox
|
|
|
|
Source implementation only until isolated backend, project typecheck and installed
|
|
acceptance pass. Trigger placement remains deferred; no global feedback button.
|
|
No public issue or screenshot has been sent during qualification.
|
|
|
|
Authenticated admin feedback.collect/get/retain-reviewed/manage RPCs retain existing
|
|
CSRF and rate controls. collect selects an explicit public profile, rejecting node
|
|
identities and unavailable node identity information. It retains a private draft
|
|
with bounded diagnostics and an exact unsigned event preview. manage supports list,
|
|
prepare, screenshot-store/get/remove, upload-receipt, begin-send and finish-send.
|
|
|
|
Canonical target: signed kind30617 repository announcement d=archy owned by
|
|
npub1w3sqdkrhn0gyuvsex32effzgnfpyde6qrrc4u467flg5e9txh4wsfn5vjg.
|
|
NIP34 issue kind1621 uses exact a/p/subject tags and t="feedback from beta".
|
|
Reference: https://github.com/nostr-protocol/nips/blob/master/34.md
|
|
Only verified repository-announced relays and the selected public author's signed
|
|
kind10063 Blossom server list qualify destinations. No fallback store or mirroring.
|
|
|
|
Upstream GitWorkshop main checked 2026-11-10:
|
|
- src/factories/IssueFactory.ts retains supplied label strings as t tags and
|
|
accepts NIP-94 imeta through extraTags.
|
|
- src/components/LabelBadge.tsx displays the label directly.
|
|
- CreateIssueForm.tsx restricts manually entered labels to letters/numbers,
|
|
so the required spaced label cannot be entered through that input.
|
|
- useBlossomUpload.ts uses kind-10063 owner server lists and Blossom upload.
|
|
It also supplies fallback servers and mirrors in the background; those
|
|
behaviors must NOT be adopted for private feedback.
|
|
- Existing nsitePublishing.ts provides bounded receipt/readback and relay OK
|
|
acknowledgement patterns. Do not reuse website-project storage for reports.
|
|
|
|
Privacy and bounds:
|
|
Draft directories0700/files0600; atomic writes and fsync precede sends. Maximum20
|
|
reports,256KiB/report,24KiB description,64KiB public event,60s node-wide collection
|
|
and submission cooldowns,8 send attempts. No automatic eviction. Reads enforce
|
|
O_NOFOLLOW, regular files and byte limits, including existing screenshot paths.
|
|
No hostname/IP/onion/hardware unique identifier or wallet state belongs in public
|
|
diagnostics. Public journal/browser error output contains only fixed categories,
|
|
codes, numeric timestamps/priorities and counts; arbitrary MESSAGE strings are
|
|
never copied. Private operation correlation remains private; public diagnostics
|
|
show only method/code/presence. Human-authored prose still requires owner review.
|
|
|
|
Collector includes bounded OS/kernel/resource/disk/inode/restart/update/app status,
|
|
known app kinds with pseudonym slots, connectivity capability booleans, and a
|
|
bounded measured running-executable hash (not attestation). Probes have byte/time
|
|
limits; unavailable evidence is explicitly unavailable. Review can omit sections
|
|
without deleting the private capture. No raw logs are automatically public.
|
|
|
|
Reusable review UI selects author, descriptions, diagnostic sections and verified
|
|
destinations, displays exact event JSON, and requires explicit confirmation before
|
|
public action. Capture is explicit browser display permission with audio disabled;
|
|
tracks always stop. Crop/opaque mask editor and removal precede retained pixels.
|
|
At most3 PNG attachments,1MiB each,1920x1080; metadata rejected/removed. Users must
|
|
review pixels because image contents cannot be guaranteed anonymous automatically.
|
|
|
|
Uploads occur only after review to the selected owner-configured Blossom server,
|
|
with exact author-signed kind24242 hash/size/server/expiry authorization, cookies
|
|
omitted and redirects rejected. HTTP402 never triggers payment. Descriptor and
|
|
bounded readback must match exact bytes/hash before an upload receipt is retained.
|
|
An upload may remain public if a later step fails; errors say so.
|
|
|
|
The outbox verifies the complete retained repository/store signed proofs, author,
|
|
attachment metadata and reconstructed review digest on every load/begin/retry.
|
|
Retained event signature/id and exact pubkey/kind/content/tags/created_at must match
|
|
the reviewed preview. Timestamp binds the original draft/signing context, never a
|
|
fresh retry TTL. Browser revalidates retained bindings before uploads and after
|
|
begin-send. A retry sends the same event; it never signs a replacement issue.
|
|
Durable per-relay attempt receipts precede/record network action. Only matching
|
|
Nostr OK event IDs count as accepted. Lost ACK remains retryable with the same ID;
|
|
already accepted reports do not resend. Receipts are browser-observed, not native
|
|
independent relay attestations. Failed drafts remain private and resumable.
|
|
|
|
Remaining qualification: isolated native compile/tests; full project typecheck;
|
|
installed owner/CSRF/rate, screenshot/review and relay-failure acceptance; actual
|
|
GitWorkshop render/filter of the spaced label (source supports literal tags).
|
|
No public test issue without separate explicit authority. Trigger placement is
|
|
still a user decision and is not required to reuse the review component.
|