mirror of
https://relay.ngit.dev/npub15qydau2hjma6ngxkl2cyar74wzyjshvl65za5k5rl69264ar2exs5cyejr/ngit-grasp.git
synced 2026-10-30 11:07:33 +00:00
DanConwayDev
f63400671f
The v3.0.9 security guidance must provide an executable repair path for data accepted before sync verified payloads independently. Add an offline event-integrity-check command with JSON-lines reporting and explicit --execute. Scan the main, tombstone, holding and replacement-history databases, plus purgatory and rejected-event checkpoints, without skipping timestamp ties or expired LMDB payloads. Purge only invalid payloads and their linked internal metadata. Reuse deletion lifecycle request removal, but never create a NIP-09 tombstone for an untrusted claimed ID or follow forged tags into Git/cascade deletion. Preserve valid copies in other stores and pending placeholders. Reset payload-free negative caches because their decisions cannot be verified and could block recovery. The relay must be stopped for both modes; this deliberately avoids adding a live repair race or startup option. Checkpoints are parsed before mutation and rewritten atomically. Partial runs are retryable. Git side-effect reconstruction and policy authorization of correctly signed events remain separate concerns. Document backup, scan, purge and rescan commands alongside this change in the Unreleased changelog, including the existing Git integrity repair command. Validation: 1,010 library tests passed during development; the final five audit regressions, seven binary tests, and two real-command integration tests pass. All-target workspace Clippy with warnings denied, formatting and diff checks pass. Coverage includes forgery recovery, lifecycle metadata removal, expired payloads, timestamp ties, valid-copy preservation, checkpoint cache repair, missing paths and malformed-checkpoint refusal. Assisted-by: GPT-6