nick/amethyst
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

docs(geode): plan reflects VerifyAuthOnlyPolicy split

Browse Source 
Tier 3 used to say operators "must omit VerifyPolicy from their
policy chain" when parallelVerify is on — that turned out to be
the AUTH-verify regression caught in the audit. Updated the plan
to describe the real wiring: VerifyPolicy was split into a
parameterised base with two singletons, and composePolicy swaps in
VerifyAuthOnlyPolicy so AUTH commands keep signature verification
even when the IngestQueue takes EVENT verify.
This commit is contained in:
Claude
2026-05-07 23:19:13 +00:00
parent 7430c2aa17
commit 176fa6f3b1
1 changed files with 18 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
geode/plans/2026-05-07-event-ingestion-batching.md
+18 -7
View File
@@ -95,13 +95,24 @@ verifies pre-mark `Rejected` and skip the insert.
Wired through `NostrServer(parallelVerify = ...)` and
`geode.Relay(parallelVerify = ...)`, controlled by
`[options].parallel_verify` in the relay config (default `true`)
and `--no-parallel-verify` on the CLI. Operators that flip it on
must omit `VerifyPolicy` from their policy chain — `Main.kt` does
this automatically; `composePolicy` is told to skip the
`VerifyPolicy` piece when `parallelVerify` is true. Internal
direct callers of `NostrServer` (tests, library users) are
opt-in: the flag defaults to `false` to keep existing
`VerifyPolicy`-in-chain semantics unchanged.
and `--no-parallel-verify` on the CLI. Internal direct callers of
`NostrServer` (tests, library users) are opt-in: the flag defaults
to `false` to keep existing `VerifyPolicy`-in-chain semantics
unchanged.
`VerifyPolicy` was split into a parameterised
`VerifyEventsAndAuthPolicy(verifyEvents)` with two singletons:
- `VerifyPolicy` (default): verifies both `EVENT` and `AUTH`.
- `VerifyAuthOnlyPolicy`: verifies `AUTH` only, used when the
`IngestQueue` is doing the EVENT verify.
When `parallelVerify` is on, `composePolicy` swaps `VerifyPolicy`
for `VerifyAuthOnlyPolicy` so EVENTs aren't verified twice while
AUTH commands — which bypass the queue entirely — keep their
signature check. Without this split, removing `VerifyPolicy` from
the chain would let a forged AUTH event mark a pubkey as
authenticated.
Expected: ≈CPU_COUNT× verify-step speed-up on burst publishes
from a single connection, where verify was previously serial on