The orchestration test polls for the fixture's readiness marker with
existsSync and then reads the PID. The fixture published the marker with
a single writeFileSync, so a child descheduled between the internal open
and write exposed a zero-byte file; Number('') is 0 and process.kill(0, 0)
probes the caller's process group, so the protected ESRCH assertion failed
with "Missing expected exception" while the production SIGKILL plus
awaited-close teardown had demonstrably worked.
Publish through a staging file and renameSync, the same atomic pattern
as the blocker() fixture in credential-helper.test.ts, so a reader that
sees the marker always sees the complete owned PID. Assertions, poll
budget, timeout and production behavior are unchanged; negative controls
in the task triage report show broken kill or broken awaited-close still
fail the protected assertion.
Signed-off-by: Logan Johnson <loganj@squareup.com>
Bounded optional relay display name for the host-settings footer. One
unauthenticated NIP-11 document read per configured relay URL (4 s timeout,
32 KiB cap, no redirects, cancellable) supplies a terminal-sanitized name
shown before the exact configured URL and actual connection state. Missing,
failed, oversized or control-bearing names keep the truthful URL-only
footer; the name never changes reported connection state, blocks startup,
resets configuration, carries credentials or invents a name. A relay switch
aborts the in-flight read and a late completion is never applied to a new
relay. Installed smoke loader stubs the new HTTP path; no live relay is
contacted in tests.
Signed-off-by: Logan Johnson <loganj@squareup.com>
An authority-check exception after the accepted POST /events - while reading
the response or during the final latest-kind0 query - previously became the
host's generic failed receipt even though the relay may already hold the
signed event. publishPublicMetadata now maps authority-guard interruptions to
the dedicated metadataPublicationInterrupted result once a submission may be
live: after the /events response and across the final readback query entry
and post-body checks. Pre-send query checks and the /events entry remain
definitive refusals and the guard itself is unchanged. intents.ts maps the
metadata-only result to unknown, matching interrupted-reconcile-locally.
Signed-off-by: Logan Johnson <loganj@squareup.com>
fetchRelayTransport now acquires response bytes through the stream
reader and cancels it the moment the 256 KB cap is exceeded or the
stream fails, so a chunked body with no usable Content-Length is
rejected while it is still arriving instead of after response.text()
has already buffered it all. The injected host signer is an async
boundary like the transport: its await is raced against the same
per-request timeout and caller cancellation, so a signer that never
settles cannot hold a claim or evidence run open. Redirect refusal,
error redaction and abort semantics are unchanged.
Signed-off-by: Logan Johnson <loganj@squareup.com>
NIP-11 requirement discovery, host-keyed NIP-98 invite claim and
membership-gated /query evidence against the relay-signed kind 13534
roster, per the verified contract at block/buzz 051c3a2. Signer output
is re-verified before any request leaves; redirects, timeouts and
aborts are bounded; invite material never surfaces in errors.
Signed-off-by: Logan Johnson <loganj@squareup.com>
Recovery checkpoint, not completion: focused checks passed in surviving logs; installed normal journeys currently fail the newly added Restart revision observation (10 failures in focused-final-3-installed.log). Full final gate and refreshed drift probe remain pending.
Signed-off-by: Logan Johnson <loganj@squareup.com>
