status-and-testing.md

Iris Stack status and test ownership

This is an engineering assessment as of 2026-07-17. It complements the architecture overview: the overview explains the intended system, while this page distinguishes implemented foundations from integration work and assigns tests to the repository that owns each failure.

Overall assessment

The stack has the essential building blocks for permissionless identity, authenticated connectivity, reliable streams, decentralized real-time events, verified storage and content routing, viewer-local social policy, and permissionless settlement. Decentralized compute is not required to make those capabilities useful. If it becomes useful, it can be introduced later as a metered service route rather than inserted into every layer.

The principal risk is now integration complexity, not a missing universal protocol. The architecture stays tractable when it enforces four rules:

1. One repository owns each wire contract and its resource bounds.
2. Capability cores do not depend on product repositories or the stack lab.
3. Products remain standalone and retain their application-owned outbound links when same-host peers appear or disappear.
4. A shared abstraction should delete more policy and failure modes than it adds; similar-looking code is not enough reason to merge semantics.

The economic loop is less mature than the protocol loop. The stack lab composes Cashu service credit, receipts, a real local CDK mint, an offline failure, payer replacement, exact-token replay, double-spend rejection, and settlement recovery across operating-system processes. Paid forwarding and paid storage still need product-specific gates that bind an authenticated service effect to the receipt and receiver acknowledgement before they should be described as a deployed market.

Dependency direction

flowchart TB
    Nostr["Nostr identity and signed events"]
    Fips["FIPS\nauthenticated datagrams"]
    Tcp["fips-tcp\nreliable streams"]
    Pubsub["nostr-pubsub\nreal-time events"]
    Tree["Hashtree\nverified content and HTL routing"]
    Graph["nostr-social-graph\nfacts and local policy"]
    Cashu["cashu-service\ncredit and settlement"]
    Adapters["thin integration adapters"]
    Products["Chat · Drive · VPN · Git · other apps"]
    Lab["iris-stack-lab\nblack-box released-product tests"]

    Nostr --> Fips
    Nostr --> Pubsub
    Nostr --> Graph
    Fips --> Tcp
    Fips --> Adapters
    Tcp --> Adapters
    Pubsub --> Adapters
    Tree --> Adapters
    Graph --> Adapters
    Cashu --> Adapters
    Adapters --> Products
    Products --> Lab

Loading

Optional adapters may join capabilities; they must not invert the arrows. In particular, nostr-pubsub announces events and content references but is not a blob-routing layer. FIPS transports authenticated traffic but does not own Hashtree HTL or settlement policy.

Component status

Area	Evidence as of 2026-07-17	Remaining integration risk
FIPS	Rust 0.4.6 and TypeScript runtime 0.0.26 provide authenticated links, fixed loopback UDP rendezvous, capability exchange, routing, and multiple carriers. The same-host identity hint is proved by the ordinary authenticated handshake. The cross-language Chromium matrix passed 16/16 plus five sequential replacement-page repetitions against native 0.4.5.	Continue cross-carrier churn, bounded-admission, and mobile lifecycle gates. A local peer must never become a mandatory daemon or implicit egress owner.
fips-tcp	Rust crates 0.2.0 provide reliable ordered streams over FIPS and cross-language wire fixtures.	Reset, retransmission, acknowledgment, backpressure, and long loss/reordering simulations belong here. Application record delivery is a separate semantic layer.
nostr-pubsub	Core 0.1.11 and FIPS adapter 0.3.1 share the standard REQ/EVENT/CLOSE service and have simulator, stress, role-blind discovery, and Cashu-incentive gates.	Browser and native consumers must use the shared carrier instead of product-private endpoint namespaces. Offline history remains a storage concern.
Hashtree	Core 0.2.86, LMDB 0.2.85, network 0.2.87, FIPS transport 0.4.6, CLI 0.2.100, and embedded runtime 0.2.86 provide one adaptive read-only BlobRouter, a read-routed/write-explicit RoutedStore, and one application-owned adaptive PoolStore with bounded temperature balancing. Network 0.2.87 owns exactly one HTL decrement per Hashtree mesh forward; FIPS hops and terminal routes do not consume HTL. Legacy DataRequest framing, duplicate peer selection, WebRTC stubs, and mesh pubsub are removed; release binaries retain FIPS-owned WebRTC and prove it from each packaged artifact. Multiprocess crash/resize/pin/GC, bounded multi-terabyte metadata behavior, HTL, corruption, provider churn, and native product gates pass.	Keep exercising multi-hop churn and bounded recovery through released artifacts.
Social graph and facts	Signed facts, graph traversal, social policy, UUID identity tools, exact fact lookup, and the nostr-identity 0.4.0 crate exist.	Unify fact-name search and recovery UX; gate FIPS identity bindings and resource-policy inputs without creating a global reputation score.
Cashu service layer	Published cashu-service 0.3.1 owns bounded peer credit, useful-service receipts, Cashu transfer, and settlement adapters. The stack process gate uses its real loopback CDK mints and SQLite wallets to prove offline failure, payer death/replacement, exact-token recovery, second-receiver rejection, receiver-ACK completion, and conservation.	Bind the generic recovery path to authenticated paid bandwidth and storage effects. Mint trust and cross-mint settlement remain explicit policy.
Iris Chat	Native 0.1.40 uses the canonical FIPS Nostr relay adapter for roster-authorized device links, shared decentralized pub/sub, paged device synchronization, and one BlobRouter over its cache, authenticated Hashtree providers, and Blossom. Its application owns the primary store and TCP/FIPS transport; RoutedStore supplies verified routed reads without routing writes. The released Stack fixture calls its production attachment reader.	Keep native and browser device-sync fixtures byte-compatible, and test connection loss after local stream acceptance so resynchronization—not wishful delivery—is the recovery mechanism.
Nostr VPN	Version 4.0.96 at 81c1dee7664a85af4d153f856bc0f4f277ba2e29 has a canonical two-process Docker gate: explicit application-owned UDP roster links carry bidirectional traffic while a signed kind-37196 event crosses shared TCP/FIPS pubsub. It pins FIPS 0.4.6, fips-tcp 0.2.0, and nostr-pubsub-fips 0.3.1. Iris Stack pins and delegates to that owner test.	Keep the VPN topology owner-local. Do not delegate VPN routes, roster policy, or egress to a same-host process.
Iris Drive	Hashtree full-history commit dbf43b2f49fe75f44ab19044a6040f68b3d22cb8 and byte-identical GitHub snapshot 97be0058df6c2a66dff9cb7303f172034e03420d pin the corrected adaptive Hashtree/FIPS tuple. The product and Stack gates prove exact roster ACLs, relay-only WebRTC bootstrap, provider death and replacement, standalone retrieval, and preservation of Drive-owned outbound links.	Keep the released-product gate in the cross-platform matrix and extend it to larger multi-frame trees under sustained churn.
Iris Git	Web release 0.1.9 at 88fa708c pins immutable Hashtree v0.2.100 plus the TypeScript 0.5.1 tuple. Its ordered browser gate performs a real extracted-artifact htree://self push, retrieval, edit, and exact-provider FIPS read.	Treat paid repository storage as a product integration, not a reason to fork Hashtree transport or Git object semantics.

Versions identify the verified native release boundary on the stated date; the repository sources and package registries remain the authority for later versions.

Reproducible native release evidence

• FIPS Rust v0.4.6 is commit 7c5100a2e076e58dfeafa3c80341e295e65e8d39. The published fips-core 0.4.6 crate checksum is 12cc0df5e04a1aae16efa85313976e87eb037d6e7955b8a035febd91b00383dc; the published fips-endpoint 0.4.6 checksum is 510adeaf1aa5ecacf71064750502a3e7d8f4b58c22e98ea8b3adbff260cf96e0.
• FIPS TypeScript runtime-v0.0.26 is commit 7295a1243ec1d9ea48cf713eb7594e6f365850dc: core 0.0.26, browser 0.0.8, WebRTC 0.0.42, Ethernet 0.0.25, and memory 0.0.6. Its full native-0.4.5 Chromium matrix passed 16/16 and the sequential replacement path passed another 5/5 repetitions.
• Hashtree v0.2.100 is commit f2d3426ab2191784f944aea591f566119bc10361. Published checksums are 574476b1fe122bddc7783ba0346dca42ec673a241128b0edf9e38166c1bb800f for core 0.2.86, e61f72986fce9c84f9fd03c72c581af092e25ea698e8b7bc54ddc18fe821286b for LMDB 0.2.85, aa83a68204dfbdc10f2fa9e810740c981e6f87c114a763ee56d8823df02c077e for network 0.2.87, 3817b451831f915787090cb1ca33dac2e5313bc1e5afd2da515f0e57bb0c997f for FIPS transport 0.4.6, and eb8ee2266a43e58b4182da07c8829fa06b0e27e32d66164d6385ccedd6de2e89 for CLI 0.2.100, and 28482b66ec409702a50ceeac1a49f5fae42b141326822f394ad66a6ebc37562f for embedded runtime 0.2.86.
• Iris Chat source commit 4e1fe4fbced6bccfd806c4cfce0d348f30f4eac5 released iris-chat 0.1.40 with checksum 6fee11a9da20fddd2af3c52cad14588ec947d347c95470e1c1d0b61d10c44ce5. Its iris-chat-protocol 0.1.8 dependency has checksum a61f94d5ee8bdd2115588a202c95636011046293c05a3082b7c1840431e190c0. Its registry package, all-target/all-feature tests, strict Clippy, and real roster-authorized relay process test passed.
• Iris Git v0.1.9 is commit 88fa708c2fdc93169d3babf16a8dd3f2323a138e. Its 74-case ordered Chromium gate uses the immutable Hashtree macOS arm64 archive with SHA-256 c60eea1f0b47f08c64093d95843419904830096bbce0ea402ca1ec1cb7fe590e.
• WebVM v2.0.2 is commit d29273a578ed51b077bf08ece4745e3f1b9d8148. Its production gate composes nVPN 4.0.96, FIPS 0.4.6, and immutable nostr-pubsub TypeScript 0.3.1; Cloudflare production version 5c7ec187-aa93-48ee-8669-b11a18187594 passed all four production scenarios.
• nostr-identity 0.4.0 was released from the social-graph repository at commit d8faabd1bf865f4cf95c9d56eddf99de31436862; its published crate checksum is 95fd048871579a175d1c38d1ea947f1034206d93696ea7ac74d140979e8022bb.
• cashu-service source commit b45a7e16744928b2ebae54e42e8f62c1d7eabdcb is available from both its Hashtree and GitHub remotes. The published cashu-service 0.3.1 checksum is c339af6a3c7a748230e980df1e89c4199532b33222d3c47e0cf148ab4d15498f; the published cashu-credit 0.3.0 checksum is c35743015747540d9c912284f10ccf89c40ded00c51fd3710c08c60700c71339. The cashu_payment_product process gate consumes those registry artifacts; it proves the generic service-payment failure/replay/resumption boundary, not a paid Iris product meter.
• Nostr VPN 4.0.96 at 81c1dee7664a85af4d153f856bc0f4f277ba2e29 owns scripts/e2e-connect-docker.sh. Its two real processes preserve explicit UDP roster traffic in both directions while delivering a signed kind-37196 paid-exit event through the shared TCP/FIPS pubsub service. Iris Stack's scripts/vpn-product-lab.sh fetches that exact snapshot and invokes the owner harness without copying its protocol or topology.

Repository organization

Keep the capability repositories separate. Their state machines, release cadence, fuzz targets, language implementations, and downstream consumers are different enough that a monorepo would hide rather than remove coupling.

Repository	Owns	Must not own
nostr-protocol/nips	Portable public-key identity and the signed-event format	Application authorization, event distribution, social interpretation, or transport
fips / fips-ts	Public-key-addressed links, Noise authentication, carriers, routing, discovery, admission, authenticated capability roster	Reliable application streams, blob HTL, event subscription policy, product egress policy
fips-tcp	Reliable ordered byte streams and their Rust/TypeScript wire contract	Product record schemas or application commit semantics
nostr-pubsub	Nostr subscription/event protocol, source policy, deduplication, carrier adapters	Blob transfer, durable mailbox/history, product-specific event formats
nostr-double-ratchet	End-to-end encrypted 1:1 sessions, group sender keys, and multi-device session management	General event distribution, product conversation state, or UI
hashtree	Blob/tree formats, verification, cache policy, BlobRoute, HTL forwarding, and Git/release data; the route boundary for a future paid provider	FIPS link routing, Nostr event distribution, product UI, or claims that paid blob retrieval is already implemented
@hashtree/index / @hashtree/collection	Immutable B-tree indexes, canonical records, derived search roots, and collection manifests	Source completeness, global query policy, or mutable database authority
nostr-social-graph	Signed fact interpretation, graph traversal, contextual names, reputation and policy inputs	A global name registry or global trust score
cashu-service	Credit, receipts, transfer and settlement primitives	Product pricing, access policy, or claims of globally trusted mints
Product repositories	Startup, authorization, durable product effects, user policy, explicit peers and outbound links	Copies of capability carriers, discovery protocols, or retry state machines
iris-kit	Shared web integration and UI packages	Capability wire contracts or product-owned policy
iris-stack	Durable public architecture, machine-readable ownership map, and black-box process/released-artifact lab	Another implementation of FIPS, TCP/FIPS, pub/sub, Hashtree, or product logic

iris-stack-lab therefore belongs in this repository. It is a consumer-only integration lab and must never become a dependency of a capability or product.

Test ownership

Tests should be placed where the failed invariant can be fixed without editing an unrelated layer.

Repository	Required gates
fips	Noise identity proof; capability authenticity; route and carrier churn; fixed-loopback bind/rebind; admission/resource bounds; every app retaining independent direct links
fips-tcp	Loss, duplication, reordering, reset, marker acknowledgment, flow control, concurrent streams, bounded buffers, and Rust/TypeScript vectors/process interop
nostr-pubsub	Codec vectors; inventory/want convergence; deduplication; role-blind discovery; malicious peers; simulator scale; real FIPS and Cashu adapters
nostr-double-ratchet	TypeScript/Rust interop; 1:1 ratchet recovery; group sender-key rotation; multi-device authorization; replay and malformed-event handling
hashtree	Local hit/miss; exact HTL decrement; multi-hop and cycles; bounded fan-out; route-local NoResult; timeout/error distinction; corrupt reply rejection; cache population; provider replacement; paid-route behavior when a production adapter exists
nostr-social-graph	Deterministic graph and fact interpretation; key/device binding; local-policy boundaries; malicious or conflicting claims
cashu-service	Credit limits; idempotent receipts; double-spend/replay rejection; partial settlement; mint outage; restart recovery; real local-mint processes
Product repositories	Standalone startup; explicit outbound links; authorization; durable effects; app protocol recovery; graceful and forced dependency death
iris-stack	Released-artifact compatibility; several real product processes on one host; same-host discovery; provider churn; direct egress preservation; generic Cashu failure/replay/recovery and product crash matrices; paid product routes when implemented

Simulators should run production state machines, not simplified copies. Deterministic protocol simulations stay with their owner; cross-repository black-box simulations stay here. Release gates should prefer registry artifacts and consumer lockfiles. Path dependencies are useful during development but cannot prove that published packages compose.

Redundancy and complexity audit

The desired direction is one implementation per semantic responsibility:

• One fixed-loopback FIPS UDP rendezvous mechanism. No parallel filesystem, TCP, Ethernet-only, daemon-election, or shared-egress protocol.
• One authenticated FSP capability roster. The plaintext loopback exchange is only an identity hint and carries no capabilities or policy.
• One Hashtree blob request/reply contract for local stores, same-host providers, remote mesh routes, cloud adapters, and future paid wrappers. NoResult means only that one bounded route produced no data.
• One Hashtree HTL router. FIPS hops and terminal adapters do not consume HTL.
• One standard Nostr pub/sub service. Large bytes travel through Hashtree, not through a second pub/sub blob protocol.
• Product-owned control and synchronization schemas remain product-owned until an extraction removes meaningful code and preserves their different retry, authorization, resync, and commit semantics.

The native Hashtree migration removed thousands of lines of duplicate carrier code, including the CLI DataRequest framing and WebRTC compatibility stub, after equivalent owner-level coverage passed. Similar cleanup in products is valuable when it deletes a private transport, but a tiny common frame codec alone is not automatically a simplification: if the shared package plus language parity adds more code than the consumers remove, wait for stronger semantic convergence or a third user. Iris Stack must not grow replacement shims for the deleted paths.

Priority test backlog

1. Bind paid FIPS forwarding and paid Hashtree storage to the verified generic Cashu recovery gate. Inject product-effect rejection, timeout, duplicate receipt, crash, restart, and eventual receiver acknowledgement.
2. Enforce the same native/TypeScript fixtures in owner-repository release gates, including browser constraints where native loopback UDP is not available.
3. Add long-running loss, churn, bounded-memory, file-descriptor, and process death tests using production state machines.
4. Gate exact authenticated capability and service-port selection so an arbitrary connected peer can never be mistaken for a provider.
5. Treat record acceptance, TCP acknowledgment, and application commit as distinct states in product protocols; make reset/resync behavior explicit.
6. Add Iris Git only after the shared content and event paths are sufficient; do not create Git-specific copies of discovery or blob routing.

This backlog deliberately does not include a generic decentralized compute substrate. It can be evaluated later against a concrete workload, proof model, resource market, and failure contract.