c01d010 · hyper-proto-peer

hyper-proto-peer commits / c01d010

0.3.118: decouple the rotation-guard test from the operator's live secrets

The "a DID whose rotation key we do NOT hold" test hard-coded wj62's REAL rotation
key as its foreign example. That passed only while the key was missing from the
box -- and started failing the moment the vault was restored, because the check
then correctly reported held:true.

The code was right; the test was wrong. A test whose verdict depends on which
secrets happen to exist on the machine running it is not a test, and this one
would have gone red or green for reasons unrelated to the change under test.

Now derived from a different BIP39 vector, so it cannot collide with local
material on any machine.

Caught because 0.3.117 was committed while this was red -- a `;` instead of `&&`
in the verify chain let it through. The commit stands; this is the follow-up.

rotation-guard 6/6, 14/14 asserts.

Refs: hyper-social #47

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

c01d010f1031211a0753eb07236b90f8389cd947

by plankatron <fleeky@gmail.com> · 2026-08-18T00:33:33.000Z

Changed files (2) +6 -2

package.json +1 -1

…	…	@@ -1,6 +1,6 @@
1	1	{
2	2	"name": "hyper-proto-peer",
3		"version": "0.3.117",
	3	"version": "0.3.118",
4	4	"description": "Self-custody, P2P-native atproto peer \u2014 holds the user's key + content as Hypercores and authors+signs its own repo. The source of truth in the peer/bridge split (Model B); atproto-bridge projects it to bsky.",
5	5	"type": "module",
6	6	"main": "lib/peer.js",

test/rotation-guard.test.js +5 -1

…	…	@@ -44,7 +44,11 @@ test('it matches on EITHER derivation path, because genesis used the signing pat
44	44	})
45	45
46	46	test('a DID whose rotation key we do NOT hold reports held:false — the alarm', async (t) => {
47		const foreign = 'did:key:zQ3sheRHJoLgdiqjFjLyTnVF2sXbP1HNEXnANEwZGjGzCeeGy' // wj62's real one
	47	// Derived from a DIFFERENT BIP39 test vector, so it cannot collide with anything on the machine.
	48	// This previously hard-coded wj62's real rotation key as the "foreign" example — which passed only
	49	// while that key was missing from this box, and started failing (correctly!) the moment the vault
	50	// was restored. A test whose verdict depends on the operator's live secrets is not a test.
	51	const foreign = deriveAtprotoKey('legal winner thank year wave sausage worth useful legal winner thank yellow', ATPROTO_SIGNING_PATH).didKey
48	52	const r = (await collectRotationHeld({ cfg, fetchImpl: plc([foreign]) })).get(DID)
49	53	t.is(r.held, false, 'false, not null — this is a determined verdict')
50	54	t.ok(r.reason && r.reason.includes('no local secret'), 'and says why')