From 07532a0d9503142a9a6b397ce4ef5031886412d4 Mon Sep 17 00:00:00 2001
From: Padreug <padreug@aiolabs.dev>
Date: Wed, 27 May 2026 19:22:38 +0200
Subject: [PATCH] nsecbunker: build from aiolabs/nsecbunkerd dev worktree +
 debug-transport env
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two changes to the local regtest's bunker service, both tied to the
#7-diagnosis effort on aiolabs/nsecbunkerd:

1. Build context now defaults to ~/dev/nsecbunkerd/dev (the dev worktree)
   instead of ~/dev/nsecbunkerd/master. The dev branch carries the
   diagnosis series — wrong-kind error response fix, prisma migration
   entrypoint, nix flake corrections, transport instrumentation. The
   master worktree stays clean at the pre-diagnosis baseline (e39eaa6)
   for reference; once dev is merged to master, this default can swap
   back. NSECBUNKER_SRC override unchanged.

2. NSEC_BUNKER_DEBUG_TRANSPORT env passthrough. Set to '1' to enable
   per-relay PUBLISHED / PUBLISH_FAILED + REQUEST_IN / RESPONSE_SENT
   instrumentation in the bunker. Default off so day-to-day regtest
   logs stay quiet.

See coordination log entries 2026-05-27T14:30Z (full #7 diagnosis) and
T16:30Z (dev branch hand-off).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 docker-compose.dev.yml | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml
index f0e2ae7..9716e65 100644
--- a/docker-compose.dev.yml
+++ b/docker-compose.dev.yml
@@ -116,10 +116,13 @@ services:
   #      should show "✅ adminNpubs: npub1..."
   nsecbunker:
     # Builds from the aiolabs/nsecbunkerd fork checkout at
-    # ${NSECBUNKER_SRC:-~/dev/nsecbunkerd/master} — carries all our
-    # upstream-rot patches (#1-#5, #8) so the build works from a clean
-    # clone. See aiolabs/nsecbunkerd for the catalog of patches.
-    build: ${NSECBUNKER_SRC:-/home/padreug/dev/nsecbunkerd/master}
+    # ${NSECBUNKER_SRC:-~/dev/nsecbunkerd/dev}. The `dev` worktree
+    # carries the #7-diagnosis series (kind-fix, db migration entrypoint,
+    # nix flake fixes, transport instrumentation) on top of the master
+    # baseline (upstream-rot patches #1-#5, #8). Once dev is merged to
+    # master, this default can swap back to `master/`. See aiolabs/
+    # nsecbunkerd dev branch and ~/dev/coordination/log.md 2026-05-27.
+    build: ${NSECBUNKER_SRC:-/home/padreug/dev/nsecbunkerd/dev}
     hostname: nsecbunker
     restart: on-failure
     pids_limit: 100
@@ -128,6 +131,10 @@ services:
     environment:
       DATABASE_URL: "file:/app/config/nsecbunker.db"
       ADMIN_NPUBS: ${NSECBUNKER_ADMIN_NPUBS}
+      # Per-relay publish-status diagnostic logging for aiolabs/nsecbunkerd#7.
+      # Set to '1' in .env or shell to enable REQUEST_IN / RESPONSE_SENT /
+      # PUBLISHED / PUBLISH_FAILED instrumentation. Default off.
+      NSEC_BUNKER_DEBUG_TRANSPORT: ${NSEC_BUNKER_DEBUG_TRANSPORT:-0}
     volumes:
       - ./data/nsecbunker:/app/config