darkfi/openspec/changes/darkirc-delivery-status/tasks.md

Tasks: darkirc-delivery-status

1. Wire compatibility spike (blocks everything)

• 1.1 Verify unknown-message tolerance: using the event-graph test harness (src/event_graph/test_helpers.rs), connect two nodes where only one registers an EventPutStatus dispatch, send one from the other, and confirm the receiving channel stays up (no stop/strike/ panic). Record the outcome in the change notes; if unknown ids destabilize channels, stop and re-discuss gating before proceeding. Verify via a new test in src/event_graph/tests.rs.

2. Event-graph layer (src/event_graph)

• 2.1 Define EventPutStatus/EventPutResult/NackReason in proto.rs with explicit u8 discriminants, impl_p2p_message! with default metering, and register dispatch/subscription in ProtocolEventGraph::init. Verify make builds and clippy is clean.
• 2.2 Emit statuses from handle_event_put at every outcome per the design table (NotSynced, Has{false} duplicate, TooOld, Invalid, Busy, Has{true} inserted), unicast on the receiving channel; strike/flood paths unchanged and silent. Verify each emission point with a two-node test asserting the exact reply variant.
• 2.3 Add receipt_pub: Publisher<(EventPutStatus, ChannelPtr)> and receipt_subscribe() to EventGraph; republish every inbound status unfiltered from the per-channel handler. Verify with a test that receives both own-origin and relayed statuses on the subscription.
• 2.4 Decode hardening: unknown EventPutResult/NackReason variant or malformed body is dropped with a warning, no panic, no strike, channel stays connected. Verify with a fuzz-style unit test feeding truncated/random payloads through the decoder.

3. darkirc outbound tracking (bin/darkirc)

• 3.1 Add the darkirc_outbound kvdb tree and serializable record (uid, event id, plaintext Privmsg fields, state, attempts, ts, superseded_by), plus helpers to insert/close/update records. Verify with round-trip serialization + tree unit tests in server.rs.
• 3.2 Generate uid (16 bytes, OsRng) in the send path, and write the outbound record in publish_events before p2p.broadcast; close as Delivered on any Has. Verify with a unit test that a crash-restart (reopen kvdb) still finds the record Pending.

4. darkirc delivery monitor (bin/darkirc)

• 4.1 Receipt aggregation task: subscribe receipt_pub, filter to tracked ids, dedupe per (event id, channel address), update records. Verify with a unit test driving synthetic statuses through the aggregator.
• 4.2 Sweep + rebroadcast: periodic sweep gated by is_synced() && connection_count >= K, rebroadcasting the original EventPut (event + blob from local DAG) with backoff up to R_MAX rounds. Verify with a multi-node harness test that a peer which already has the event answers Has{inserted:false} and the record closes without recreation.
• 4.3 Recreate: on TooOld, all-nack, or R_MAX exhaustion, build a fresh event from stored plaintext (fresh nonce, same uid, fresh parents/timestamp), park on RLN BudgetExhausted, cap attempts at A_MAX, surface failure to the client on cap. Verify with harness tests: rotation-forced recreate reuses the uid; budget exhaustion parks (RLN test harness); attempt cap reaches Failed.
• 4.4 End-to-end darkirc scenario test: node A publishes while disconnected from B, A reconnects after DAG rotation, B must end up holding a recreate-generation event with the same uid. Verify the assertion holds in the multi-node harness.

5. Privmsg uid wire change (bin/darkirc/src/lib.rs)

• 5.1 Add uid behind Privmsg.version = 1 with a version-matched decoder (v0 decodes without uid). Verify with golden serialization tests for both versions, including a v0 peer ignoring an undecodable v1 payload without error propagation.
• 5.2 Re-check sequencing against darkirc-mod's rotating-content tag byte (same struct): confirm merge order or combined encoding in the change notes before merge. Verify by reviewing both deltas against the final Privmsg wire format.

6. App integration (bin/app)

• 6.1 Wrap handle_send with uid generation, outbound records, and the rebroadcast/recreate hooks (RLN-disabled path). Verify make compile-dev in bin/app succeeds.
• 6.2 Switch display dedup from ciphertext-hash msg_id() to uid (synthetic id for legacy v0 messages) and add the receipt_pub subscription mapping per-uid state to sending/delivered/failed with UI notification. Verify with an app-side test or manual dev-run showing state transitions and no double-render of a recreated message.

7. Hardening and review gate

• 7.1 Full workspace gates green: make, make clippy, make test (proofs + contracts built first per AGENTS.md), make fmt in bin/app; confirm no unwrap/expect/panic! on any new attacker-controlled decode path and no peer addresses logged with receipt state.
• 7.2 Invoke @anon-security-review on the full diff; treat FAIL as blocking and address findings before marking the change ready to apply. Verify the review verdict is recorded in the change notes.