| … | … | @@ -3,19 +3,39 @@ |
| 3 | 3 | The **shared room engine** for co-owned atproto identities — the substrate behind a multi-device |
| 4 | 4 | [hyper-proto-peer](../hyper-proto-peer) and a co-owned Favela community |
| 5 | 5 | ([favela-node](../favela-node)). This is the **multiswarm-PDS pattern**: N attested writers co-own one |
| 6 | | autobase; a single lease-elected signer produces byte-identical signed output, so authority is shared with |
| 6 | autobase; a single presence-elected signer produces byte-identical signed output, so authority is shared with |
| 7 | 7 | no single point of key custody and no fork on failover. |
| 8 | 8 | |
| 9 | ## Install |
| 10 | |
| 11 | ```sh |
| 12 | npm install atproto-room |
| 13 | ``` |
| 14 | |
| 15 | Consumed as a sibling `file:` dependency by [hyper-proto-peer](../hyper-proto-peer) and |
| 16 | [favela-node](../favela-node) rather than from a registry. |
| 17 | |
| 18 | ## Test |
| 19 | |
| 20 | ```sh |
| 21 | npm test # bare test/all.js |
| 22 | npm run test:units |
| 23 | ``` |
| 24 | |
| 25 | Bare runtime — `postinstall` runs `scripts/bare-deps.mjs`. |
| 26 | |
| 9 | 27 | ## Pieces (`lib/`) |
| 10 | 28 | |
| 11 | 29 | | Module | Role | |
| 12 | 30 | |---|---| |
| 13 | 31 | | `state-base.js` (`StateBaseV3`) | attestation-gated, **encrypted** multi-writer room (Autobase + HyperDB view). Admission is cryptographic + in-apply: a joiner proves it's a device attested to the room's root identity, then is `addWriter`ed. | |
| 14 | 32 | | `membership.js` | binary attestation admission (keet-identity-key root→device chains) — the N devices of ONE DID, all role-equal. | |
| 15 | | | `lease.js` (`Lease`) | one active signer at a time; TTL failover-safe. | |
| 16 | | | `signer.js` | the lease-holder materializes the linearized record view into ONE canonical signed atproto commit under the shared `#atproto` key (RFC6979-deterministic → byte-identical across holders). | |
| 33 | | `signer-presence.js` (`SignerPresence`) | **elects the signer.** Lowest-keyed device among currently-CONNECTED co-owners, computed in RAM, appending nothing. A `graceMs` window (15 s) absorbs blips; a currency filter stops a behind co-owner winning, which would freeze the chain against the forward-only sign gate. | |
| 34 | | `lease.js` (`Lease`) | **legacy.** The `__lease__` ts-heartbeat wrote a wall-clock timestamp to the append-only log every ~8 s forever (~20 MB/day, unreclaimable) — which is why it was replaced. Still present and still reported by diag, but it does not gate signing. | |
| 35 | | `pairing.js` | device pairing. | |
| 36 | | `signer.js` | the elected signer materializes the linearized record view into ONE canonical signed atproto commit under the shared `#atproto` key (RFC6979-deterministic → byte-identical across holders). | |
| 17 | 37 | | `repo-base.js` (`RepoBase`) | the atproto repo op layer over the shared state (put/del/list records). | |
| 18 | | | `label-base.js` / `label-room.js` / `label-signer.js` | the **co-authored labeler**: N mods append label intents; the lease-holder signs them into a shared `__label__` log; `projectTo` serves a byte-identical `com.atproto.label` feed from any node. | |
| 38 | | `label-base.js` / `label-room.js` / `label-signer.js` | the **co-authored labeler**: N mods append label intents; the elected signer signs them into a shared `__label__` log; `projectTo` serves a byte-identical `com.atproto.label` feed from any node. | |
| 19 | 39 | | `serve-membrane.js` | project the shared `__commit__` log + records into served cores (what the keyless membrane fronts). | |
| 20 | 40 | |
| 21 | 41 | ## Design invariants |
| … | … | @@ -30,3 +50,7 @@ no single point of key custody and no fork on failover. |
| 30 | 50 | |
| 31 | 51 | Lineage: reskinned from keet-daemon / hyper-tps per-room `StateBaseV3`; extracted here as the engine |
| 32 | 52 | consumed by hyper-proto-peer (repo devices) and the co-authored labeler. |
| 53 | |
| 54 | ## License |
| 55 | |
| 56 | Not yet declared. |