From cd8b6711a4e5fe67fa1f49290b349e63aad3817c Mon Sep 17 00:00:00 2001
From: Avi <avi@aiolabs.com>
Date: Wed, 23 Sep 2026 15:30:49 -0500
Subject: [PATCH] docs(checkpoint): kind-0 via signer at 6f4dbb2 (2026-09-23)

---
 CHECKPOINT-encryption.md | 55 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)

diff --git a/CHECKPOINT-encryption.md b/CHECKPOINT-encryption.md
index c47af2a..30a0f9d 100644
--- a/CHECKPOINT-encryption.md
+++ b/CHECKPOINT-encryption.md
@@ -1,3 +1,58 @@
+# Checkpoint — kind-0 publishes through Amber; name goes network-wide (2026-09-23 PM)
+
+## Where things are
+- Project: `/home/avi/Projects/Keynctr`
+- Branch: `master` @ **`6f4dbb2`** ("feat(nip46): publish kind-0 metadata
+  through the connected signer"). Previous: `327bf0f` (checkpoint),
+  `3d1c306` (silent poll).
+- Working tree: clean for tracked files. Untracked intentionally NOT
+  committed: `COSMIC_THEME.md`, `KeynectrAppIconPossibility02.jpeg`,
+  `deferred/` (stays deferred).
+- Release binary: **rebuilt at `6f4dbb2`**. Renderer rebuilt via
+  `npm run build`. Restart Electron before retesting.
+
+## What was completed this session
+1. **Closed the P2 kind-0 gap (`6f4dbb2`)**: the "Publish name" IPC path
+   now routes through the profile's `Signing` source (same pattern as
+   note publishing). Embedded profiles sign locally as before; a paired
+   profile's kind-0 (label/picture/nip05) is signed by the remote signer —
+   Amber shows an approval prompt — so the name becomes visible in every
+   Nostr client. Disconnected sessions fail closed, never with a local
+   fallback. CLI keeps the local-only path (no signer instances there).
+2. **E2E proof**: the strict-Amber test now also publishes kind-0 through
+   `App::signing_for` + `publish_metadata_signed` and asserts relay
+   acceptance — the exact GUI path, with identity validation. Along the way
+   fixed the test's production wiring (handle registered on `App`, as
+   `ensure_nip46_signer` does) after a `None`-handle failure poisoned the
+   shared env lock and cascaded to all 4 e2e tests.
+3. Rename modal copy now points remote profiles at "Publish name" (Amber
+   approval) instead of claiming the signer app publishes it.
+- Verification (all green at `6f4dbb2`): `cargo test` **212 unit + 4 e2e
+  passed / 0 failed**, `cargo clippy --all-targets` 0 warnings,
+  `cargo fmt --check` clean, `cargo build --release` green; frontend
+  `npm test` **120 passed**, `typecheck`, `lint`, `format:check`,
+  `electron:build`, `build` clean.
+
+## Commits added (newest first)
+- `6f4dbb2` feat(nip46): publish kind-0 metadata through the connected
+  signer
+
+## How to resume / reproduce
+- Restart Electron → Profiles → **Publish name** on the paired profile →
+  approve the `sign_event` (kind 0) prompt in Amber → per-relay report.
+  Check any Nostr client: the display name (your vault label) now appears
+  instead of the bare npub.
+- E2E: `cargo test --test nip46_e2e` (4 tests incl. kind-0-via-signer).
+
+## Outstanding / next steps
+1. **Live "Publish name" through real Amber** (e2e-proven, never live-run).
+2. **NIP-46 session restore on startup** (re-scan needed after restarts).
+3. Prune the 11 stale profileless `nip46_connections` rows (cosmetic).
+4. Remote picture/nip05 edits, KDF upgrade (Step 5), rename pass
+   (Step 7) — unchanged.
+
+---
+
 # Checkpoint — silent state poll + session-restore gap named (2026-09-23 PM)
 
 ## Where things are