From 176fa6f3b11bef4465b3823ef96d73bc700560ed Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 7 May 2026 23:19:13 +0000 Subject: [PATCH] docs(geode): plan reflects VerifyAuthOnlyPolicy split MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Tier 3 used to say operators "must omit VerifyPolicy from their policy chain" when parallelVerify is on — that turned out to be the AUTH-verify regression caught in the audit. Updated the plan to describe the real wiring: VerifyPolicy was split into a parameterised base with two singletons, and composePolicy swaps in VerifyAuthOnlyPolicy so AUTH commands keep signature verification even when the IngestQueue takes EVENT verify. --- .../2026-05-07-event-ingestion-batching.md | 25 +++++++++++++------ 1 file changed, 18 insertions(+), 7 deletions(-) diff --git a/geode/plans/2026-05-07-event-ingestion-batching.md b/geode/plans/2026-05-07-event-ingestion-batching.md index 08a8d88f7..eb7d8d9d1 100644 --- a/geode/plans/2026-05-07-event-ingestion-batching.md +++ b/geode/plans/2026-05-07-event-ingestion-batching.md @@ -95,13 +95,24 @@ verifies pre-mark `Rejected` and skip the insert. Wired through `NostrServer(parallelVerify = ...)` and `geode.Relay(parallelVerify = ...)`, controlled by `[options].parallel_verify` in the relay config (default `true`) -and `--no-parallel-verify` on the CLI. Operators that flip it on -must omit `VerifyPolicy` from their policy chain — `Main.kt` does -this automatically; `composePolicy` is told to skip the -`VerifyPolicy` piece when `parallelVerify` is true. Internal -direct callers of `NostrServer` (tests, library users) are -opt-in: the flag defaults to `false` to keep existing -`VerifyPolicy`-in-chain semantics unchanged. +and `--no-parallel-verify` on the CLI. Internal direct callers of +`NostrServer` (tests, library users) are opt-in: the flag defaults +to `false` to keep existing `VerifyPolicy`-in-chain semantics +unchanged. + +`VerifyPolicy` was split into a parameterised +`VerifyEventsAndAuthPolicy(verifyEvents)` with two singletons: + +- `VerifyPolicy` (default): verifies both `EVENT` and `AUTH`. +- `VerifyAuthOnlyPolicy`: verifies `AUTH` only, used when the + `IngestQueue` is doing the EVENT verify. + +When `parallelVerify` is on, `composePolicy` swaps `VerifyPolicy` +for `VerifyAuthOnlyPolicy` so EVENTs aren't verified twice while +AUTH commands — which bypass the queue entirely — keep their +signature check. Without this split, removing `VerifyPolicy` from +the chain would let a forged AUTH event mark a pubkey as +authenticated. Expected: ≈CPU_COUNT× verify-step speed-up on burst publishes from a single connection, where verify was previously serial on