Repository navigation
id: design: abuse-control primitives v1 for ID comms #2033
Description
LIST 8 synthesis. Turn the abuse-controls investigation into implementable primitives v1: the block/limit/budget objects, where they are enforced (client, relay, server), how they compose with the accept-all-signed-objects trust model, and the operator UX (the 'quick button'). Small, shippable scope.
Program: Drew's 2026-10-28 directive (full text: hatch-personal memory/topics/id-program-2026-10-28.md).
Working pattern: parallel investigations, then the named synthesis issue merges them into a full design. Route guidance: Workhorse by default; Specialist/Summit for synthesis and ramification-heavy work. A result that says "done" is not the endpoint — the orchestrator reviews it and may commission another round. Deliverables: a markdown design/investigation doc (mermaid/SVG diagrams welcome) linked from this issue, plus follow-up issues for anything buildable. Build a proof of concept where the design calls for one, but do NOT build the permanent feature on top of an unreviewed PoC.
Activity
developing-today commentedon Oct 29, 2026
CODE-954
dezren39 commentedon Oct 29, 2026
Parent epic: #2056 — ID platform expansion (2026-10-28 directive).
dezren39 commentedon Oct 29, 2026
Input ready for this synthesis: #2032 investigation complete — record (PR #2243). It gives the control inventory with file:line evidence, proposed defaults for four layers (frame-boundary token buckets, operator block list by public key/IP/topic-tag, budgets incl. per-counterparty overrides, listener IP deny), the composition rule with accept-all-signed-objects (blocks change serving/rendering, never acceptance), operator UX for the quick button, a P0/P1/P2 build order, and five open questions for the design in §7. Buildable follow-ons: #2244, #2245, #2247.
id: fix six review findings in writer-set spec (#2238)
dezren39 commentedon Nov 1, 2026
Design triage started; parked for a dedicated design shift — task 5728, lane C. Groundwork below is verified; the design record itself is NOT yet written and this note does not pretend otherwise.
Verified starting map (fresh, this run)
3cbab2d9e: rate limiting exists in spots (pkgs/id/src/directory.rs,directory_auth.rs, web routes/world_ws mention it), but there is no block/mute primitive indirectory.rs/directory_view.rsand no budget concept inworld_caps.rs— v1 primitives are genuinely new objects, not a cleanup of existing ones.Resume map for the dedicated shift
Parked 1 hour. This is a synthesis-grade design task (the program's own routing guidance says Specialist/Summit-class work); it should not be fill-in work at the end of a queue shift.
design(id): #2033 abuse-control primitives v1
dezren39 commentedon Nov 1, 2026
Design note: doc/2026-11-01_design_id2033.md recommends a node-local policy evaluator with typed identities and protocol adapters.
PR: #3834
The design separates endpoint blocks, author/account mutes, resource refusals, and signed-object validity; local abuse rules never rewrite the event graph.
It distinguishes EndpointId, AuthorKey, account identity, WebSocket identity, and directly observed IP rather than assuming they are interchangeable.
P0: shared frame/byte accounting and structured refusals; collaboration rate adapter/diagnostics; persisted endpoint block + author mute quick action.
P1: wire ServerConfig and add app-wide/per-counterparty budgets and overrides; aligns with #2244, #2245, and #2247 without recreating them.
P2: direct-listener IP and distinct gossip-topic/metadata-tag rules; relay-attested IP and common block feeds are deferred.
The note corrects stale inventory claims using this checkout, including event-sync session accounting, its enforced-but-open PullGate, existing HTTP 429s, and the collab WebSocket size ceiling.
Drew questions: none; proposed limits are configurable defaults, and relay-attested IP is deferred rather than requiring a privacy decision.
Docs-only; no implementation code changed, and #2033 remains open.
5 remaining items
dezren39 commentedon Nov 1, 2026
🤖 Agent note · picked up
dezren39 commentedon Nov 1, 2026
Synthesis routing / current-main verification (queue task 5728)
The decision-ready record remains PR #3834 (
doc/2026-11-01_design_id2033.md); it is open and Drew-authored, so this lane has not modified, reviewed, or merged it. The recommendation is a node-local abuse-policy evaluator with protocol adapters and typed subjects, rather than unrelated per-protocol limiters. Keep signed-object validity/storage separate from local serving, subscription, and view policy: blocks and budgets refuse work or affect local projection, never rewrite/reject an otherwise-valid signed event. Viable alternatives and tradeoffs are in the linked record; the rejected shortcuts are ingest-time authority filtering, one generic key for endpoint/author/IP, and independent limiters that multiply allowances across connections.Fresh base:
origin/mainatb5fc3f069213ffc4ca24cea5759b039b5dad37ec.pkgs/id/src/abuse.rs:1-23— shared evaluator core exists on main; it explicitly says it is not yet wired into frames, HTTP routes, or world chat.pkgs/id/src/abuse.rs:39-44— endpoint/node values are currently raw[u8; 32]aliases. Implementations must preserve the design's semantic subject split (endpoint vs event author/account vs direct IP); byte-shape equality is not permission to infer one identity from another. This is also the exact packet defect recorded on id(comms): operator block list by public key, with one-button block in the web UI (P0 of #2032) #2245/task 5848.pkgs/id/src/frames.rs:87-95— the 1 MiB length cap is checked before body allocation; retain it and charge abuse budgets at the frame boundary.pkgs/id/src/world/core.rs:1094-1114— world chat still has a separate participant-keyed limiter on this base.pkgs/id/src/server_config/mod.rs:56-67—ServerConfighas no abuse-budget field yet.pkgs/id/src/pull_policy.rs:1-19— pull policy is local serving policy, not a wire/content-validity rule. This matches closed investigation id: investigate: trust/visibility model — servers accept all signed objects; views count only allowed writers #2030; id: investigate: comms abuse controls — blocks, rate limits, and per-counterparty budgets #2032 supplies the control inventory and defaults.Phased implementation packets and current queue state
repo-health:v1:fix:developing-today/code:issue:3881repo-health:v1:fix:developing-today/code:issue:3882repo-health:v1:fix:developing-today/code:issue:2245packet_defect: separate endpoint blocking from author muting; do not infer endpoint-to-author mapping.repo-health:v1:fix:developing-today/code:issue:2247repo-health-code-pilot,not_before=2026-11-01T22:30:00Z; explicitly gated on #2244/#3882 integration.The #2247 queue task is a resumable implementation packet and instructs its worker to revalidate #2244/#3882/PR #3960 and park rather than work in parallel if the prerequisite is still open. Task 5936 is labelled
queue/queued; the dedupe key is listed above. No packet is authorized to alter the signed-object acceptance model. The detailed acceptance criteria and defaults remain in PR #3834 and issues #2244/#2245/#2247.Drew-only questions: none. The design record selects configurable defaults and explicitly defers relay-attested IP; no owner decision is needed to start the listed work.
dezren39 commentedon Nov 1, 2026
agent-note:v1
event: done
task: 5728 (repo-health-code-pilot, openchamber scheduled lane)
outcome: triaged
record: PR #3834 is the Drew-authored decision-ready design record; left untouched. Current-main evidence and implementation routing are in this issue comment thread.
packets: #3881/task 5845 complete (dedupe repo-health:v1:fix:developing-today/code:issue:3881); #3882/task 5847 active (dedupe repo-health:v1:fix:developing-today/code:issue:3882); #2245/task 5848 blocked on packet_defect (dedupe repo-health:v1:fix:developing-today/code:issue:2245); #2247/task 5936 queued not-before 2026-11-01T22:30:00Z (dedupe repo-health:v1:fix:developing-today/code:issue:2247).
questions_for_drew: none
backlog_updated: false (sandbox bookkeeping deferred to fleet reconciliation)
Merge pull request #3834 from developing-today/design/id-2033