| … | … | @@ -104,13 +104,76 @@ favela-peer depend on pgv3's. That choice is real; the security model is not. |
| 104 | 104 | ⚠ Corrected in passing: an earlier version of §5 cited |
| 105 | 105 | `packages/hyper-identity/lib/device-linker.js` at the repo root. It is under `hyper-fleeky/packages/`. |
| 106 | 106 | |
| 107 | ### 4.3 The 28 parameters, classified |
| 108 | |
| 109 | Classified from **usage in `device-node.js`**, not from names. Counts are *mentions* — a proxy for |
| 110 | entanglement, not precise call counts. |
| 111 | |
| 112 | **GENERIC — favela-peer keeps (11)** |
| 113 | |
| 114 | | param | ~mentions | what it is | |
| 115 | |---|---|---| |
| 116 | | `swarm` / `swarmOpts` | 44 / 7 | networking | |
| 117 | | `shared` | 43 | the shared corestore for multi-tenancy | |
| 118 | | `storage` | 31 | the daemon's storage root | |
| 119 | | `control` | 22 | the control socket | |
| 120 | | `deviceProof` | 11 | the attestation chain — *"NEVER the root"*. Now central, per §4.2 | |
| 121 | | `deviceMnemonic` | 10 | the device's own seed | |
| 122 | | `rootIdentityKey` | 9 | the identity root — the `favela://` authority | |
| 123 | | `members` | 6 | *"members-only room secrets"* — a **room** concept | |
| 124 | | `writers` | 5 | the autobase writer set | |
| 125 | | `onRelease` | 5 | OTA hook | |
| 126 | |
| 127 | **ATPROTO — moves to `bridge:bsky` or evaporates (11)** |
| 128 | |
| 129 | | param | ~mentions | | |
| 130 | |---|---|---| |
| 131 | | **`did`** | **74** | ★ the highest of any parameter — more than `swarm` (44) or `shared` (43) | |
| 132 | | `records` | 26 | CAR import — `listRecords(car)` | |
| 133 | | `adopt` | 23 | adopting an existing commit chain | |
| 134 | | `signingKey` | 12 | the shared `#atproto` key | |
| 135 | | `handle` | 10 | atproto handle | |
| 136 | | `pdsUrl`, `signIntervalMs` | 5, 5 | PDS URL; the sign loop | |
| 137 | | `appPasswordHash`, `jwtSecret` | 4, 4 | *"so the membrane serve can answer"* — session auth | |
| 138 | | `federationHeartbeatMs` | 3 | federation | |
| 139 | | `projectRepoCore` | 3 | *"comes straight off the DID's conf"* | |
| 140 | |
| 141 | **SCAR — migration and recovery; each needs a survive/delete decision (6)** |
| 142 | |
| 143 | | param | ~mentions | why it exists | |
| 144 | |---|---|---| |
| 145 | | `resyncStore` | 15 | the fresh-corestore re-join (§4.1) | |
| 146 | | `joiner` | 12 | *"a booting creator's silently flips the role"* — a role-detection fix | |
| 147 | | `primary` | 7 | *"this DID predates the cutover"* | |
| 148 | | `storeBackend` | 6 | flag-gating the overlay store against the legacy Hyperbee one | |
| 149 | | `resetFirehose` | 6 | *"ONE-TIME firehose repair"* | |
| 150 | | `forceCreator` | 4 | forcing the creator role during resync | |
| 151 | |
| 152 | ### 4.3.1 What the classification says |
| 153 | |
| 154 | **11 generic / 11 atproto / 6 scar** — the fission is close to an even split, with a fifth of the |
| 155 | signature being neither half. |
| 156 | |
| 157 | ★ **`did` at 74 mentions is the finding.** It is threaded through the boot path more heavily than the |
| 158 | swarm or the shared store. That is *"the DID is the identity root"* measured as a code fact rather |
| 159 | than asserted as a design one — and it is why `identity.md` §4's demotion is a large change rather |
| 160 | than a rename. |
| 161 | |
| 162 | **The scar column is where the real decisions are.** Four of the six (`primary`, `storeBackend`, |
| 163 | `resetFirehose`, `forceCreator`) are one-time migration flags whose migrations have already happened; |
| 164 | they are deletable on evidence, not on design. `resyncStore` and `joiner` are not — they answer to |
| 165 | §4.1's genesis-derivation question, which is L2 and survives the fission unless that derivation |
| 166 | changes. |
| 167 | |
| 168 | ⚠ **Not measured:** whether the four one-time flags are still reachable in the live fleet. That is a |
| 169 | config read on three hosts, not an argument. |
| 170 | |
| 107 | 171 | ## 5. What must be measured before building |
| 108 | 172 | |
| 109 | 173 | In order, and none of it is design work: |
| 110 | 174 | |
| 111 | 175 | 1. ~~**`DeviceLinker`**~~ ✅ **DONE — §4.2.** |
| 112 | | 2. **`bootSwarmDevice`'s 28 parameters** — classify each as atproto / generic / scar. That single |
| 113 | | classification is most of the fission. |
| 176 | 2. ~~**`bootSwarmDevice`'s 28 parameters**~~ ✅ **DONE — §4.3.** 11 generic / 11 atproto / 6 scar. |
| 114 | 177 | 3. **`favela-node`** — read it; it may fold in, become a bridge, or be deleted. |
| 115 | 178 | 4. **A sample of the ~120 call sites** — enough to tell a mechanical rename from a model change. |
| 116 | 179 | |