From 38612a4a935cc8c24f3d0766e0584716c42ba2a3 Mon Sep 17 00:00:00 2001
From: Avi <avi@aiolabs.com>
Date: Thu, 1 Oct 2026 13:32:21 -0500
Subject: [PATCH] docs(checkpoint): Step 4 approval-time kind scope @ d09c4ec

---
 CHECKPOINT-encryption.md | 61 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 61 insertions(+)

diff --git a/CHECKPOINT-encryption.md b/CHECKPOINT-encryption.md
index 3691a54..8c5ac00 100644
--- a/CHECKPOINT-encryption.md
+++ b/CHECKPOINT-encryption.md
@@ -1,3 +1,64 @@
+# Checkpoint — Step 4 finished: interactive kind scope at approval (2026-10-01)
+
+## Where things are
+- Project: `/home/avi/Projects/Keynctr`, branch `master` @ **`d09c4ec`**
+  ("feat(signer): interactive kind scope in the approval prompt (Step 4 finish)").
+  Previous: `8ffeb42` + `d1622a0` (checkpoint updates, pushed), `83f5940`
+  (placeholder kind-0 fix), `e8d2abb` (grant kind-editing UI).
+- Working tree: clean for tracked files (always-untracked: COSMIC_THEME.md,
+  icon jpeg, deferred/). Push status in Next steps.
+- Release binary rebuilt from d09c4ec at 13:30 (real 30s build, mtime verified).
+
+## What was completed (user-facing)
+**Step 4 remainder — kind scope chosen AT approval time:**
+1. Signer screen and Signer Mode screen: on a pending `sign_event`
+   request, "Always allow…" opens an inline kind editor prefilled with the
+   request's own event kind; Allow records the grant with exactly the
+   edited kinds (sorted+deduped, empty = all kinds = explicit broadening),
+   Cancel leaves the request pending. Non-signing methods keep the plain
+   "Always allow" button (no kind dimension).
+2. Backend: `Nip46Approve`/`SignerApprove` gained `grant_kinds`
+   (`serde(default) Option<Vec<u16>>` — old payloads stay valid).
+   `respond_to_approval_with_always(.., grant_kinds)`: `Some(list)` stores
+   the edited scope verbatim; `None` keeps the old fallback (kind of the
+   request being approved). Legacy vault rows untouched.
+3. `nip46_status_as_bunker_json` now includes each pending request's
+   `details`, so the legacy Signer screen can prefill the editor too.
+4. Shared `parseKindsInput()` in `lib/permissions.ts` (used by both the
+   approval editor and the existing grant editor); grant editor refactored
+   onto it — behaviour unchanged.
+5. Latent bug fixed: `AppProvider.signerApprove` dropped the `always`
+   argument, so the legacy "Always allow" button never recorded a grant.
+
+## Commits this session (newest first)
+- `d09c4ec` feat(signer): interactive kind scope in the approval prompt (Step 4 finish)
+- `8ffeb42` docs(checkpoint): 8070dfc..d1622a0 pushed to origin/master
+- (earlier today) `d1622a0`, `83f5940`, `e8d2abb` — see checkpoint below
+
+## Verification (all green, 2026-10-01)
+- `cargo test` → 227 unit + 6 e2e, 0 failed · `cargo clippy --all-targets` → 0 warnings
+- `cargo fmt --check` clean · `cargo build --release` rebuilt 13:30 from d09c4ec
+- frontend: vitest 148/19 files (6 new: 3 approval-editor tests, 3
+  parseKindsInput units); `typecheck`, `lint`, `format:check`, `build`,
+  `electron:build` all green.
+
+## How to verify in the app
+1. Fully quit and relaunch Keynctr (new backend, 13:30).
+2. Have the connected app request a signature → Signer screen →
+   "Always allow…" on the pending request → edit kinds → Allow.
+   The "Always-allow permissions" card shows the scoped grant; a later
+   request of an UNcovered kind prompts again.
+3. e2e-mechanics are covered by the 3 new SignerScreen tests.
+
+## Next steps
+- PUSHED 2026-10-01 after this checkpoint (see git remote readback);
+  token per-use, not stored (revoke when convenient).
+- User live pass: relaunch, rename npub1p437… + Publish name, try the new
+  approval-time kind editor with Amber.
+- Optional: remove /tmp/kn-base worktree when done.
+
+---
+
 # Checkpoint — placeholder kind-0 fix + grant editing UI (2026-10-01)
 
 ## Where things are