Merge pull request 'docs(backend): pin get_public_key as an intentional, load-bearing ACL exception (#26)' (#53) from fix/26-document-get-public-key-ungated into dev

Reviewed-on: #53

src/daemon/backend/index.ts

@@ -104,6 +104,29 @@ export class Backend {
                 return ok ? "pong" : undefined;
             }
             case "get_public_key":
+                // Intentionally UNGATED — do NOT route through pubkeyAllowed().
+                // This is a deliberate, documented exception to the "every
+                // request hits the ACL seam" rule (aiolabs/nsecbunkerd#26), not
+                // an oversight, and it is load-bearing — gating it breaks the
+                // live clients:
+                //   1. The pubkey isn't secret — it's the identity the bunker
+                //      openly signs as; disclosure leaks nothing a relay
+                //      observer couldn't already derive from published events.
+                //   2. NIP-46 mandates get_public_key as part of session
+                //      establishment (46.md overview step 5: the client requests
+                //      get_public_key to learn user-pubkey), called immediately
+                //      post-connect, before any policy-bearing method.
+                //   3. lnbits' `_ensure_policy` (remote_bunker.py
+                //      DEFAULT_POLICY_RULES + DEFAULT_POLICY_METHODS_NO_KIND)
+                //      grants only sign_event(kinds) + nip04/44 encrypt/decrypt
+                //      — there is NO get_public_key rule — so routing it through
+                //      checkIfPubkeyAllowed would return `undefined`, and the
+                //      client's spec-mandated post-connect get_public_key call
+                //      would stall on the admin-approval path → "signer
+                //      unavailable" (the outage class #41 addressed).
+                // Per-app gating/audit of identity disclosure, if ever wanted,
+                // must be co-designed with a policy rule the clients actually
+                // plant. See #26 for the full prior-art survey (NDK vs rust-nostr).
                 return this.pubkey;
             case "sign_event": {
                 const [eventString] = params;