{"messages":[{"content":"You are a constitutional council ranking individual git commits for ownership allocation.\n\nCompare these two commits. Decide which contributed more lasting value to the project.\n\nJudge substance, not spectacle:\n- Prefer correct, lasting design and real bugfixes over churn, formatting, renames, or generated noise.\n- Prefer clarity and necessity over sheer line count. A small precise change can beat a large diffuse one.\n- Do not favor a side merely because its patch is longer or noisier.\n- Weight what the change does for the project, not the contributor's name.\n\nReturn ONLY a JSON object: {\"winner\": \"A\" or \"B\", \"ratio\": \"N:M\", \"explanation\": \"...\"}\nThe explanation must cite concrete differences in the patches (1-3 sentences).\n\nSide A — contributor: tommy-mor\nSide A — commit message:\n[4e327784] deploy live constitution dashboard\n\nExpose auditable progress and event streaming, configure the production roots and runtime, and make tested main-branch commits the deployment authority.\n\nCo-authored-by: Cursor \n\nSide A — unified diff (full patch):\ndiff --git a/.dockerignore b/.dockerignore\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..c9d63a722beba0a0297fc853089332c460ab78dd\n--- /dev/null\n+++ b/.dockerignore\n@@ -0,0 +1,7 @@\n+.git\n+.venv\n+.hypothesis\n+__pycache__\n+tests\n+*.json\n+*.bsp\ndiff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..76dcdf82d53177c1e47d86b23a54523239d232a6\n--- /dev/null\n+++ b/.github/workflows/deploy.yml\n@@ -0,0 +1,49 @@\n+name: Test and deploy\n+\n+on:\n+ push:\n+ branches: [main]\n+\n+concurrency:\n+ group: production\n+ cancel-in-progress: false\n+\n+permissions:\n+ contents: read\n+\n+jobs:\n+ test:\n+ runs-on: ubuntu-latest\n+ steps:\n+ - uses: actions/checkout@v4\n+\n+ - uses: astral-sh/setup-uv@v6\n+ with:\n+ enable-cache: true\n+\n+ - name: Run Python tests\n+ run: uv run pytest -q\n+\n+ - name: Install Babashka\n+ run: |\n+ curl -fsSL https://raw.githubusercontent.com/babashka/babashka/master/install \\\n+ | sudo bash -s -- --dir /usr/local/bin\n+\n+ - name: Run process integration tests\n+ run: bb TEST.sh\n+\n+ deploy:\n+ needs: test\n+ runs-on: ubuntu-latest\n+ environment:\n+ name: production\n+ url: https://token.slug.social\n+ steps:\n+ - uses: actions/checkout@v4\n+\n+ - uses: superfly/flyctl-actions/setup-flyctl@master\n+\n+ - name: Deploy to Fly\n+ run: flyctl deploy --remote-only\n+ env:\n+ FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}\ndiff --git a/Dockerfile b/Dockerfile\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..c9a5c00782371c19ad5ab5c58cf6f5a8ffec0141\n--- /dev/null\n+++ b/Dockerfile\n@@ -0,0 +1,17 @@\n+FROM ghcr.io/astral-sh/uv:python3.11-bookworm-slim\n+\n+RUN apt-get update \\\n+ && apt-get install -y --no-install-recommends git ca-certificates \\\n+ && rm -rf /var/lib/apt/lists/*\n+\n+WORKDIR /app\n+COPY pyproject.toml uv.lock ./\n+RUN uv sync --frozen --no-install-project\n+\n+COPY constitution.py ./\n+\n+ENV PATH=\"/app/.venv/bin:${PATH}\" \\\n+ PYTHONUNBUFFERED=\"1\"\n+\n+EXPOSE 8080\n+CMD [\"python\", \"constitution.py\"]\ndiff --git a/constitution.py b/constitution.py\nindex 4bee9f83663ab7fb36db95129b92b64b4ef57258..a58257e1881b21d1d6fa8e68a3faa222e4f661ef 100644\n--- a/constitution.py\n+++ b/constitution.py\n@@ -24,12 +24,12 @@ A daily GitHub Action backs up the JSONL ledger to the same repo.\n Run: uv run constitution.py\n \"\"\"\n \n-from decimal import Decimal, getcontext\n+from decimal import Decimal, getcontext, DefaultContext\n from datetime import datetime, timezone\n from fastapi import FastAPI, Request, Response\n from fastapi.responses import PlainTextResponse, HTMLResponse\n from starlette.middleware.sessions import SessionMiddleware\n-import json, time, os, asyncio, httpx, pathlib, subprocess, hashlib, re, fcntl\n+import json, time, os, asyncio, httpx, pathlib, subprocess, hashlib, re, fcntl, base64\n import sympy as sp # type: ignore[reportMissingImports]\n from tenacity import retry, retry_if_exception, stop_after_attempt, wait_exponential\n from evaleval import (\n@@ -37,6 +37,7 @@ from evaleval import (\n exec_event, One, Two, Three, Selector, MORPH, PREPEND,\n )\n \n+DefaultContext.prec = 50\n getcontext().prec = 50\n \n app = FastAPI()\n@@ -129,14 +130,47 @@ OPENROUTER_BASE_URL = os.environ.get(\"OPENROUTER_BASE_URL\", \"https://openrouter.\n # using the exact same source; their normalized values are committed to every\n # discovery event.\n DEFAULT_REPOSITORIES = [\n+ {\n+ \"id\": \"constitution\",\n+ \"url\": \"https://github.com/sortersocial/constitution.git\",\n+ \"refs\": [\"refs/heads/**\"],\n+ },\n {\n \"id\": \"slug\",\n- \"url\": \"https://github.com/tommy-mor/slug.git\",\n+ \"url\": \"https://github.com/sortersocial/slug.git\",\n+ \"refs\": [\"refs/heads/**\"],\n+ },\n+ {\n+ \"id\": \"sorter\",\n+ \"url\": \"https://github.com/sorterisntonline/sorter.git\",\n+ \"refs\": [\"refs/heads/**\"],\n+ },\n+ {\n+ \"id\": \"sorter2\",\n+ \"url\": \"https://github.com/sortersocial/sorter2.git\",\n+ \"refs\": [\"refs/heads/**\"],\n+ },\n+ {\n+ \"id\": \"sorter-oldest\",\n+ \"url\": \"https://github.com/tommy-mor/sorter.git\",\n \"refs\": [\"refs/heads/**\"],\n },\n ]\n DEFAULT_CONTRIBUTORS = {\n \"tommy-mor\": [\"thmorriss@gmail.com\"],\n+ \"christopher-whitman\": [\n+ \"chris@cwwhitman.com\",\n+ \"7566903+cwwhitman@users.noreply.github.com\",\n+ ],\n+ \"jake-chvatal\": [\n+ \"jake+github@uln.industries\",\n+ \"jakechvatal@gmail.com\",\n+ \"jake@isnt.online\",\n+ ],\n+ \"lara\": [\"me@lara.lv\"],\n+ \"nat-reid\": [\"nathanielreid@gmail.com\"],\n+ \"zod\": [\"jason.p.mcel@gmail.com\", \"me@zod.tf\"],\n+ \"jovan\": [\"jovan@slug.social\", \"jovan@getcivicai.com\"],\n }\n \n REPOSITORIES = json.loads(\n@@ -147,6 +181,7 @@ CONTRIBUTORS = json.loads(\n )\n GIT_MIRROR_DIR = pathlib.Path(os.environ.get(\"GIT_MIRROR_DIR\", \"/data/git\"))\n GIT_TIMEOUT_SECONDS = int(os.environ.get(\"GIT_TIMEOUT_SECONDS\", \"120\"))\n+GITHUB_TOKEN = os.environ.get(\"GITHUB_TOKEN\", \"\")\n \n # Council model IDs: slug.social garden rank under this parent (bodies = OpenRouter URLs), then top-up from OpenRouter list.\n SLUG_SOCIAL_BASE_URL = os.environ.get(\"SLUG_SOCIAL_BASE_URL\", \"https://slug.social\").rstrip(\"/\")\n@@ -661,20 +696,30 @@ def _git(repo: pathlib.Path | None, *args: str, input_bytes: bytes | None = None\n if repo is not None:\n command += [\"-C\", str(repo)]\n command += list(args)\n+ git_env = {\n+ **os.environ,\n+ \"GIT_CONFIG_NOSYSTEM\": \"1\",\n+ \"GIT_CONFIG_GLOBAL\": os.devnull,\n+ \"GIT_NO_REPLACE_OBJECTS\": \"1\",\n+ \"LC_ALL\": \"C\",\n+ \"TZ\": \"UTC\",\n+ }\n+ if GITHUB_TOKEN:\n+ credential = base64.b64encode(\n+ f\"x-access-token:{GITHUB_TOKEN}\".encode()\n+ ).decode()\n+ git_env.update({\n+ \"GIT_CONFIG_COUNT\": \"1\",\n+ \"GIT_CONFIG_KEY_0\": \"http.https://github.com/.extraHeader\",\n+ \"GIT_CONFIG_VALUE_0\": f\"Authorization: Basic {credential}\",\n+ })\n try:\n result = subprocess.run(\n command,\n input=input_bytes,\n stdout=subprocess.PIPE,\n stderr=subprocess.PIPE,\n- env={\n- **os.environ,\n- \"GIT_CONFIG_NOSYSTEM\": \"1\",\n- \"GIT_CONFIG_GLOBAL\": os.devnull,\n- \"GIT_NO_REPLACE_OBJECTS\": \"1\",\n- \"LC_ALL\": \"C\",\n- \"TZ\": \"UTC\",\n- },\n+ env=git_env,\n timeout=GIT_TIMEOUT_SECONDS,\n check=False,\n )\n@@ -844,9 +889,15 @@ def _build_discovery(epoch_n: int, boundary_ms: int, events: list) -> GitDiscove\n canonical_location = min(\n locations[qualified_oid], key=lambda x: (x[0], x[1])\n )\n+ # One commit may be reachable from dozens of refs in the same mirror.\n+ # Verify its object once per repository, not once per source ref.\n+ object_locations = {\n+ (str(m), raw_oid): (m, raw_oid)\n+ for _, _, m, raw_oid in locations[qualified_oid]\n+ }\n object_hashes = {\n hashlib.sha256(_git(m, \"cat-file\", \"commit\", raw_oid)).hexdigest()\n- for _, _, m, raw_oid in locations[qualified_oid]\n+ for m, raw_oid in object_locations.values()\n }\n if len(object_hashes) != 1:\n raise RuntimeError(f\"conflicting Git objects share OID {qualified_oid}\")\n@@ -994,11 +1045,55 @@ async def discover_repositories(epoch_n: int, boundary_ms: int) -> GitDiscovery:\n \n \n SSE_CLIENTS = []\n+AUDIT_HISTORY = []\n+AUDIT_SEQUENCE = 0\n+PROCESS_STATE = {\n+ \"running\": False,\n+ \"phase\": \"idle\",\n+ \"progress\": 100,\n+ \"message\": \"Waiting for the next epoch\",\n+}\n+\n+\n+def _sse_event(event_name: str, payload: dict) -> str:\n+ return (\n+ f\"event: {event_name}\\n\"\n+ f\"data: {json.dumps(payload, separators=(',', ':'))}\\n\\n\"\n+ )\n+\n+\n+async def broadcast_audit(\n+ kind: str,\n+ message: str,\n+ *,\n+ progress: int | None = None,\n+ phase: str | None = None,\n+) -> dict:\n+ global AUDIT_SEQUENCE\n+ AUDIT_SEQUENCE += 1\n+ if progress is not None:\n+ PROCESS_STATE[\"progress\"] = max(0, min(100, int(progress)))\n+ if phase is not None:\n+ PROCESS_STATE[\"phase\"] = phase\n+ PROCESS_STATE[\"message\"] = message\n+ payload = {\n+ \"id\": AUDIT_SEQUENCE,\n+ \"timestamp_ms\": int(time.time() * 1000),\n+ \"kind\": kind,\n+ \"message\": message,\n+ **PROCESS_STATE,\n+ }\n+ AUDIT_HISTORY.append(payload)\n+ del AUDIT_HISTORY[:-200]\n+ wire = _sse_event(\"audit\", payload)\n+ for queue in list(SSE_CLIENTS):\n+ await queue.put(wire)\n+ return payload\n \n \n async def broadcast_js(js: str):\n \"\"\"Send a JS snippet to all connected SSE clients.\"\"\"\n- for queue in SSE_CLIENTS:\n+ for queue in list(SSE_CLIENTS):\n await queue.put(js)\n \n \n@@ -1006,10 +1101,29 @@ async def rank_commits(commits: list[dict]):\n if not commits:\n return {}, []\n \n- models = await fetch_top_models(n=3)\n contributors = sorted(set(c[\"contributor\"] for c in commits))\n- if len(contributors) > 1 and not models:\n+ if len(contributors) == 1:\n+ await broadcast_audit(\n+ \"ranking\",\n+ f\"Only {contributors[0]} is eligible; rank is 1.0\",\n+ progress=90,\n+ phase=\"finalizing\",\n+ )\n+ return {contributors[0]: Decimal(\"1\")}, []\n+ if not (OPENROUTER_API_KEY or \"\").strip():\n+ raise RuntimeError(\n+ \"OPENROUTER_API_KEY is required when multiple contributors need ranking\"\n+ )\n+\n+ models = await fetch_top_models(n=3)\n+ if not models:\n raise RuntimeError(\"no council models available for contributor ranking\")\n+ await broadcast_audit(\n+ \"council\",\n+ f\"Council selected: {', '.join(models)}\",\n+ progress=35,\n+ phase=\"ranking\",\n+ )\n await broadcast_js(exec_event(Three[Selector(\"#emission-log\")][PREPEND][\n [\"div.log-council\", f\"Council: {', '.join(models)} — {len(commits)} commits\"]\n ]))\n@@ -1035,6 +1149,11 @@ async def rank_commits(commits: list[dict]):\n \n async def compare_fn(i, j):\n a1, a2 = authors[i], authors[j]\n+ await broadcast_audit(\n+ \"comparison\",\n+ f\"Comparing {a1} with {a2}\",\n+ phase=\"ranking\",\n+ )\n await broadcast_js(exec_event(Three[Selector(\"#emission-status\")][MORPH][\n [\"div#emission-status\", f\"Comparing {a1} vs {a2}…\"]\n ]))\n@@ -1050,6 +1169,11 @@ async def rank_commits(commits: list[dict]):\n if winner_weight <= 0 or loser_weight <= 0:\n raise ValueError(\"ratio weights must be positive\")\n results.append((w, l, winner_weight, loser_weight))\n+ await broadcast_audit(\n+ \"vote\",\n+ f\"{model}: {authors[w]} over {authors[l]} ({result['ratio']})\",\n+ phase=\"ranking\",\n+ )\n await broadcast_js(exec_event(Three[Selector(\"#emission-log\")][PREPEND][\n [\"div.log-vote\",\n [\"span.model\", model], \" — \",\n@@ -1059,6 +1183,11 @@ async def rank_commits(commits: list[dict]):\n ]\n ]))\n except Exception as e:\n+ await broadcast_audit(\n+ \"error\",\n+ f\"{model} failed: {e}\",\n+ phase=\"error\",\n+ )\n await broadcast_js(exec_event(Three[Selector(\"#emission-log\")][PREPEND][\n [\"div.log-error\", f\"⚠ {model}: {e}\"]\n ]))\n@@ -1068,8 +1197,13 @@ async def rank_commits(commits: list[dict]):\n async def progress_fn(ev):\n if ev[\"phase\"] == \"spanning_tree\":\n label = f\"Spanning tree: {ev['step']}/{ev['total']}\"\n+ percent = 35 + round(35 * ev[\"step\"] / max(ev[\"total\"], 1))\n else:\n label = f\"Zip pass {ev['pass']}: {ev['step']}/{ev['total']}\"\n+ percent = 70 + round(20 * ev[\"step\"] / max(ev[\"total\"], 1))\n+ await broadcast_audit(\n+ \"progress\", label, progress=percent, phase=\"ranking\"\n+ )\n await broadcast_js(exec_event(Three[Selector(\"#emission-status\")][MORPH][\n [\"div#emission-status\", label]\n ]))\n@@ -1083,6 +1217,12 @@ async def rank_commits(commits: list[dict]):\n scores = rank_centrality(pairs)\n ranking = {authors[i]: Decimal(str(scores[i])) for i in range(len(authors))}\n ranking_rows = sorted(ranking.items(), key=lambda x: x[1], reverse=True)\n+ await broadcast_audit(\n+ \"ranking\",\n+ \"Ranking: \" + \", \".join(f\"{a} {s:.4f}\" for a, s in ranking_rows),\n+ progress=90,\n+ phase=\"finalizing\",\n+ )\n await broadcast_js(exec_event(Three[Selector(\"#emission-log\")][PREPEND][\n [\"div.log-ranking\",\n [\"b\", \"Ranking: \"],\n@@ -1104,11 +1244,33 @@ def pool_remaining(events: list) -> Decimal:\n \n \n async def run_emission(epoch_n, boundary_ms):\n+ PROCESS_STATE[\"running\"] = True\n+ await broadcast_audit(\n+ \"start\",\n+ f\"Epoch {epoch_n} emission started\",\n+ progress=2,\n+ phase=\"starting\",\n+ )\n await broadcast_js(exec_event(Three[Selector(\"#emission-log\")][PREPEND][\n [\"div.log-start\", f\"⚡ Epoch {epoch_n} emission started\"]\n ]))\n \n+ await broadcast_audit(\n+ \"discovery\",\n+ \"Fetching configured repositories and snapshotting refs\",\n+ progress=8,\n+ phase=\"discovery\",\n+ )\n discovery = await discover_repositories(epoch_n, boundary_ms)\n+ await broadcast_audit(\n+ \"discovery\",\n+ (\n+ f\"Discovered {len(discovery.observations)} new commits; \"\n+ f\"{len(discovery.commits)} are eligible\"\n+ ),\n+ progress=30,\n+ phase=\"discovery\",\n+ )\n ranking, models = await rank_commits(discovery.commits)\n \n def make_emission(events):\n@@ -1146,6 +1308,13 @@ async def run_emission(epoch_n, boundary_ms):\n \n entry = await store.atomic(make_emission)\n if entry:\n+ PROCESS_STATE[\"running\"] = False\n+ await broadcast_audit(\n+ \"complete\",\n+ f\"Epoch {entry.epoch} complete; emitted {entry.total_emitted} SLG\",\n+ progress=100,\n+ phase=\"idle\",\n+ )\n await broadcast_js(exec_event(Three[Selector(\"#emission-log\")][PREPEND][\n [\"div.log-amount\",\n f\"Pool {entry.pool_before} → emit {entry.total_emitted} → {entry.pool_after}\"]\n@@ -1189,13 +1358,24 @@ async def distribute_usdc(holdings, treasury_balance):\n async def epoch_loop():\n while True:\n epoch_n, current_start, next_boundary = current_epoch()\n+ processed = {e.epoch for e in store.read() if isinstance(e, Emission)}\n+ if epoch_n >= 0 and epoch_n not in processed:\n+ try:\n+ await run_emission(epoch_n, current_start)\n+ except Exception as exc:\n+ PROCESS_STATE[\"running\"] = False\n+ await broadcast_audit(\n+ \"error\",\n+ f\"Epoch {epoch_n} failed: {exc}; retrying in 60 seconds\",\n+ phase=\"error\",\n+ )\n+ print(f\"epoch {epoch_n} emission failed: {exc}\", flush=True)\n+ await asyncio.sleep(60)\n+ continue\n+\n now = int(time.time() * 1000)\n wait_ms = next_boundary - now\n-\n if wait_ms <= 0:\n- processed = {e.epoch for e in store.read() if isinstance(e, Emission)}\n- if epoch_n not in processed and epoch_n >= 0:\n- await run_emission(epoch_n, current_start)\n await asyncio.sleep(60)\n elif wait_ms < 86_400_000:\n await broadcast_js(exec_event(Three[Selector(\"#emission-status\")][MORPH][\n@@ -1243,6 +1423,36 @@ async def get_ranking():\n return {\"ranking\": latest.ranking, \"epoch\": latest.epoch}\n \n \n+@app.get(\"/api/status\")\n+async def get_status():\n+ events = store.read()\n+ discoveries = [e for e in events if isinstance(e, GitDiscovery)]\n+ emissions = [e for e in events if isinstance(e, Emission)]\n+ return {\n+ **PROCESS_STATE,\n+ \"epoch\": current_epoch()[0],\n+ \"openrouter_configured\": bool((OPENROUTER_API_KEY or \"\").strip()),\n+ \"sse_clients\": len(SSE_CLIENTS),\n+ \"latest_discovery\": (\n+ {\n+ \"epoch\": discoveries[-1].epoch,\n+ \"snapshot_id\": discoveries[-1].snapshot_id,\n+ \"observations\": len(discoveries[-1].observations),\n+ \"eligible_commits\": len(discoveries[-1].commits),\n+ }\n+ if discoveries else None\n+ ),\n+ \"latest_emission\": (\n+ {\n+ \"epoch\": emissions[-1].epoch,\n+ \"total_emitted\": emissions[-1].total_emitted,\n+ \"ranking\": emissions[-1].ranking,\n+ }\n+ if emissions else None\n+ ),\n+ }\n+\n+\n @app.get(\"/api/contributor/{github_username}\")\n async def get_contributor(github_username: str):\n history = [\n@@ -1306,13 +1516,6 @@ async def test_emit():\n \n # ===========================================================================\n # §9. SSE — live audit stream of the pairwise voting process\n-#\n-# TODO: the /sse emission audit page needs a real SSE-driven UI. votes arrive\n-# incrementally during rank_commits(), and the client should show a live\n-# progress bar and per-vote results as they stream in. this requires a\n-# dedicated page that connects to /sse and updates the DOM on each event\n-# (council, comparing, vote, ranking, emission_complete). defer until we\n-# have playwright tests to cover it — the incremental rendering is fiddly.\n # ===========================================================================\n \n @app.get(\"/sse\")\n@@ -1322,6 +1525,13 @@ async def sse_stream(request: Request):\n \n async def generate():\n try:\n+ yield _sse_event(\"audit\", {\n+ \"id\": AUDIT_SEQUENCE,\n+ \"timestamp_ms\": int(time.time() * 1000),\n+ \"kind\": \"connection\",\n+ \"message\": f\"Connected to epoch {current_epoch()[0]}\",\n+ **PROCESS_STATE,\n+ })\n yield exec_event(Three[Selector(\"#emission-status\")][MORPH][\n [\"div#emission-status\", f\"Connected — epoch {current_epoch()[0]}\"]\n ])\n@@ -1334,10 +1544,15 @@ async def sse_stream(request: Request):\n except asyncio.TimeoutError:\n yield \": keepalive\\n\\n\"\n finally:\n- SSE_CLIENTS.remove(queue)\n+ if queue in SSE_CLIENTS:\n+ SSE_CLIENTS.remove(queue)\n \n from starlette.responses import StreamingResponse\n- return StreamingResponse(generate(), media_type=\"text/event-stream\")\n+ return StreamingResponse(\n+ generate(),\n+ media_type=\"text/event-stream\",\n+ headers={\"Cache-Control\": \"no-cache\", \"X-Accel-Buffering\": \"no\"},\n+ )\n \n \n # ===========================================================================\n@@ -1359,6 +1574,7 @@ def _page(title: str, body: list) -> HTMLResponse:\n [\"meta\", {\"charset\": \"utf-8\"}],\n [\"meta\", {\"name\": \"viewport\", \"content\": \"width=device-width, initial-scale=1\"}],\n [\"title\", title],\n+ [\"style\", RawContent(_WATCH_CSS)],\n ],\n [\"body\",\n body,\n@@ -1367,6 +1583,387 @@ def _page(title: str, body: list) -> HTMLResponse:\n ]))\n \n \n+_WATCH_CSS = \"\"\"\n+/* ================================================================\n+ ZIGGURAT — bevel-first dark theme\n+ --spread (0→1) controls bevel depth. 0 = flat. 1 = full relief.\n+ Light source: top-left. Shadow: bottom-right.\n+ Platforms nest. Each level is raised. Nothing is rounded.\n+ ================================================================ */\n+\n+:root {\n+ color-scheme: dark;\n+ --spread: 1;\n+\n+ --g0: #080808;\n+ --g1: #131313;\n+ --g2: #1c1c1c;\n+ --g3: #252525;\n+ --g4: #2e2e2e;\n+ --g5: #383838;\n+\n+ --hi: #5e5e5e;\n+ --lo: #050505;\n+ --bv: calc(var(--spread) * 4px + 1px);\n+ --bv-lg: calc(var(--spread) * 6px + 2px);\n+\n+ --signal: #f0f0f0;\n+ --prose: #c2c2c2;\n+ --ui: #888;\n+ --meta: #4a4a4a;\n+ --link: #8899ee;\n+ --code-fg: #c8dda0;\n+\n+ --font-prose: \"Iowan Old Style\", \"Palatino Linotype\", Palatino, \"Book Antiqua\", Georgia, serif;\n+ --font-ui: system-ui, -apple-system, sans-serif;\n+ --font-code: ui-monospace, \"Cascadia Code\", \"SF Mono\", Menlo, monospace;\n+}\n+\n+*, *::before, *::after { box-sizing: border-box; }\n+html, body { margin: 0; padding: 0; }\n+\n+body {\n+ background: var(--g0);\n+ color: var(--prose);\n+ font-family: var(--font-ui);\n+ font-size: 14px;\n+ line-height: 1.6;\n+ margin: 0 auto;\n+ max-width: 560px;\n+ min-height: 100vh;\n+ padding: 0 16px 48px;\n+}\n+main { width: 100%; padding: 18px 0 48px; }\n+\n+h1, h2, h3 {\n+ color: var(--signal);\n+ font-size: 11px;\n+ font-weight: bold;\n+ letter-spacing: 0.12em;\n+ margin: 14px 0 6px;\n+ text-transform: uppercase;\n+}\n+a { color: var(--link); text-decoration: none; }\n+a:hover { color: var(--signal); }\n+.eyebrow {\n+ background: var(--g2);\n+ border: var(--bv) solid;\n+ border-color: var(--hi) var(--lo) var(--lo) var(--hi);\n+ color: var(--ui);\n+ font-size: 11px;\n+ letter-spacing: 0.12em;\n+ padding: 4px 10px;\n+ text-transform: uppercase;\n+ width: fit-content;\n+}\n+\n+/* Every dashboard section is a raised platform. */\n+.panel {\n+ background: var(--g2);\n+ border: var(--bv-lg) solid;\n+ border-color: var(--hi) var(--lo) var(--lo) var(--hi);\n+ margin: 8px 0;\n+ padding: 10px;\n+ width: 100%;\n+}\n+.status-row {\n+ align-items: center;\n+ display: flex;\n+ flex-wrap: wrap;\n+ gap: 8px;\n+ justify-content: space-between;\n+}\n+#process-status { color: var(--signal); font-family: var(--font-code); font-weight: bold; }\n+.badge {\n+ align-items: center;\n+ background: var(--g3);\n+ border: var(--bv) solid;\n+ border-color: var(--hi) var(--lo) var(--lo) var(--hi);\n+ color: var(--ui);\n+ display: inline-flex;\n+ font-size: 11px;\n+ gap: 7px;\n+ padding: 3px 8px;\n+}\n+.dot { background: var(--meta); height: 8px; width: 8px; }\n+.live .dot { background: #7acc7a; }\n+.warn .dot { background: #cc9955; }\n+\n+/* The progress track is inset; its signal is raised inside it. */\n+.progress-shell {\n+ background: var(--g1);\n+ border: var(--bv-lg) solid;\n+ border-color: var(--lo) var(--hi) var(--hi) var(--lo);\n+ height: 58px;\n+ margin: 14px 0 10px;\n+ overflow: hidden;\n+ position: relative;\n+}\n+#progress-fill {\n+ background: var(--link);\n+ border: var(--bv) solid;\n+ border-color: var(--hi) var(--lo) var(--lo) var(--hi);\n+ height: 100%;\n+ transition: width .35s steps(8, end);\n+ width: 0;\n+}\n+#progress-label {\n+ color: var(--signal);\n+ display: grid;\n+ font-family: var(--font-code);\n+ font-size: 18px;\n+ font-weight: bold;\n+ inset: 0;\n+ place-items: center;\n+ position: absolute;\n+ text-shadow: 1px 1px var(--lo);\n+}\n+\n+.controls { align-items: center; display: flex; flex-wrap: wrap; gap: 8px; }\n+button {\n+ background: var(--g5);\n+ border: var(--bv) solid;\n+ border-color: var(--hi) var(--lo) var(--lo) var(--hi);\n+ color: var(--signal);\n+ cursor: pointer;\n+ font: inherit;\n+ font-size: 12px;\n+ padding: 4px 10px;\n+}\n+button:hover { background: #404040; }\n+button:active {\n+ background: var(--g4);\n+ border-color: var(--lo) var(--hi) var(--hi) var(--lo);\n+ transform: translate(1px, 1px);\n+}\n+button:disabled { cursor: default; opacity: .4; }\n+.note { color: var(--meta); font-size: 11px; margin: 4px 0; }\n+\n+.feed-head { align-items: baseline; display: flex; justify-content: space-between; }\n+#audit-feed {\n+ background: var(--g1);\n+ border: var(--bv) solid;\n+ border-color: var(--lo) var(--hi) var(--hi) var(--lo);\n+ display: flex;\n+ flex-direction: column;\n+ gap: 5px;\n+ margin-top: 8px;\n+ padding: 6px;\n+}\n+.event {\n+ background: var(--g3);\n+ border: var(--bv) solid;\n+ border-color: var(--hi) var(--lo) var(--lo) var(--hi);\n+ display: grid;\n+ gap: 6px;\n+ grid-template-columns: 82px 88px 1fr;\n+ padding: 5px 8px;\n+}\n+.event[data-kind=\"error\"] { border-left-color: #cc5555; }\n+.event[data-kind=\"complete\"], .event[data-kind=\"ranking\"] { border-left-color: #7acc7a; }\n+.event[data-kind=\"vote\"] { border-left-color: var(--link); }\n+.event time, .event-kind { color: var(--meta); font-family: var(--font-code); font-size: 10px; }\n+.event-kind { text-transform: uppercase; }\n+.event-message { color: var(--prose); font-family: var(--font-prose); }\n+\n+code {\n+ background: var(--g1);\n+ border: 2px solid;\n+ border-color: var(--lo) var(--hi) var(--hi) var(--lo);\n+ color: var(--code-fg);\n+ font-family: var(--font-code);\n+ font-size: 12px;\n+ padding: 1px 4px;\n+}\n+\n+@media (max-width: 520px) {\n+ .event { grid-template-columns: 72px 1fr; }\n+ .event-message { grid-column: 1 / -1; }\n+}\n+\"\"\"\n+\n+\n+def _watch_initial_state() -> dict:\n+ events = store.read()\n+ feed = []\n+ for event_ in events[-40:]:\n+ if isinstance(event_, GitDiscovery):\n+ feed.append({\n+ \"id\": f\"discovery-{event_.snapshot_id}\",\n+ \"timestamp_ms\": event_.timestamp_ms,\n+ \"kind\": \"discovery\",\n+ \"message\": (\n+ f\"Epoch {event_.epoch}: observed {len(event_.observations)} commits; \"\n+ f\"{len(event_.commits)} eligible\"\n+ ),\n+ })\n+ elif isinstance(event_, Emission):\n+ feed.append({\n+ \"id\": f\"emission-{event_.epoch}\",\n+ \"timestamp_ms\": event_.timestamp_ms,\n+ \"kind\": \"complete\",\n+ \"message\": (\n+ f\"Epoch {event_.epoch}: emitted {event_.total_emitted} SLG; \"\n+ f\"ranking {event_.ranking}\"\n+ ),\n+ })\n+ feed.extend(AUDIT_HISTORY)\n+ return {\n+ \"process\": dict(PROCESS_STATE),\n+ \"openrouter_configured\": bool((OPENROUTER_API_KEY or \"\").strip()),\n+ \"epoch\": current_epoch()[0],\n+ \"feed\": feed[-200:],\n+ }\n+\n+\n+_WATCH_JS = \"\"\"\n+const initial = __INITIAL__;\n+const feed = document.querySelector('#audit-feed');\n+const processStatus = document.querySelector('#process-status');\n+const connection = document.querySelector('#connection-status');\n+const fill = document.querySelector('#progress-fill');\n+const progressLabel = document.querySelector('#progress-label');\n+const play = document.querySelector('#play');\n+const pause = document.querySelector('#pause');\n+const seen = new Set();\n+let source = null;\n+\n+function setProgress(value) {\n+ const n = Math.max(0, Math.min(100, Number(value ?? 0)));\n+ fill.style.width = `${n}%`;\n+ progressLabel.textContent = `${Math.round(n)}%`;\n+ document.querySelector('.progress-shell').setAttribute('aria-valuenow', String(n));\n+}\n+\n+function addEvent(event) {\n+ const id = String(event.id);\n+ if (seen.has(id)) return;\n+ seen.add(id);\n+ const row = document.createElement('div');\n+ row.className = 'event';\n+ row.dataset.kind = event.kind || 'event';\n+ const when = document.createElement('time');\n+ when.dateTime = new Date(event.timestamp_ms).toISOString();\n+ when.textContent = new Date(event.timestamp_ms).toLocaleTimeString();\n+ const kind = document.createElement('span');\n+ kind.className = 'event-kind';\n+ kind.textContent = event.kind || 'event';\n+ const message = document.createElement('span');\n+ message.className = 'event-message';\n+ message.textContent = event.message;\n+ row.append(when, kind, message);\n+ feed.prepend(row);\n+ while (feed.children.length > 200) feed.lastElementChild.remove();\n+}\n+\n+function applyState(event) {\n+ processStatus.textContent = event.message || 'Waiting for the next epoch';\n+ setProgress(event.progress);\n+ if (event.kind !== 'connection') addEvent(event);\n+}\n+\n+function connect() {\n+ if (source) return;\n+ source = new EventSource('/sse');\n+ connection.classList.remove('warn');\n+ connection.classList.add('live');\n+ connection.querySelector('span:last-child').textContent = 'connecting';\n+ play.disabled = true;\n+ pause.disabled = false;\n+ source.onopen = () => {\n+ connection.querySelector('span:last-child').textContent = 'live';\n+ };\n+ source.addEventListener('audit', event => applyState(JSON.parse(event.data)));\n+ source.onerror = () => {\n+ connection.classList.remove('live');\n+ connection.classList.add('warn');\n+ connection.querySelector('span:last-child').textContent = 'reconnecting';\n+ };\n+}\n+\n+function disconnect() {\n+ if (source) source.close();\n+ source = null;\n+ connection.classList.remove('live');\n+ connection.classList.add('warn');\n+ connection.querySelector('span:last-child').textContent = 'paused locally';\n+ play.disabled = false;\n+ pause.disabled = true;\n+}\n+\n+play.addEventListener('click', connect);\n+pause.addEventListener('click', disconnect);\n+initial.feed.forEach(addEvent);\n+processStatus.textContent = initial.process.message;\n+setProgress(initial.process.progress);\n+connect();\n+\"\"\"\n+\n+\n+@app.get(\"/watch\")\n+async def watch():\n+ initial = json.dumps(\n+ _watch_initial_state(), separators=(\",\", \":\")\n+ ).replace(\" 0\")\n \n- ;; 9. SSE connects and sends initial event\n+ ;; 9. watch UI exposes progress, controls, readiness, and live SSE\n+ (println \"\\nchecking /watch UI…\")\n+ (bind watch-html (slurp (str base-url \"/watch\")))\n+ (assert! (str/includes? watch-html \"role=\\\"progressbar\\\"\")\n+ \"watch page has progress bar\")\n+ (assert! (str/includes? watch-html \"id=\\\"play\\\"\")\n+ \"watch page has play control\")\n+ (assert! (str/includes? watch-html \"id=\\\"pause\\\"\")\n+ \"watch page has pause control\")\n+ (assert! (str/includes? watch-html \"OpenRouter configured\")\n+ \"watch page reports council readiness\")\n+ (bind status-resp (get-json base-url \"/api/status\"))\n+ (assert! (true? (:openrouter_configured status-resp))\n+ \"status API reports OpenRouter configuration\")\n+\n+ ;; 10. SSE connects and sends initial event\n (println \"\\nchecking /sse initial event…\")\n (bind sse-events (read-sse-events (str base-url \"/sse\") 1 5000))\n (assert! (= 1 (count sse-events)) \"received 1 SSE event\")\n (assert! (not (str/blank? (first sse-events)))\n \"initial SSE event contains executable audit data\")\n \n- ;; 10. POST /test/emit — full ranking pipeline hits mocks\n+ ;; 11. POST /test/emit — full ranking pipeline hits mocks\n (println \"\\ntriggering /test/emit (epoch 1)…\")\n (bind emit-resp (post-json! base-url \"/test/emit\"))\n (assert! (= \"emission\" (:type emit-resp)) \"emit response type is emission\")\n@@ -503,7 +518,7 @@\n (bind rank-after (get-json base-url \"/api/ranking\"))\n (assert! (= 1 (:epoch rank-after)) \"latest ranking is epoch 1\")\n \n- ;; 11. kill and restart — prove replay determinism\n+ ;; 12. kill and restart — prove replay determinism\n (println \"\\nkilling server for replay test…\")\n (.destroyForcibly (:proc server))\n (deref server)\ndiff --git a/tests/test_git_discovery.py b/tests/test_git_discovery.py\nindex 0dd31bc42a19bc8c59842dc61f193c595c474659..5a9e167e16ad2ffb25988af85820f6f19e8910cd 100644\n--- a/tests/test_git_discovery.py\n+++ b/tests/test_git_discovery.py\n@@ -393,7 +393,9 @@ def test_empty_epoch_records_zero_emission_without_burning_pool(\n monkeypatch.setattr(c, \"store\", c.JsonlStore(discovery_config / \"ledger.jsonl\"))\n \n async def discover(_epoch, _boundary):\n- return SimpleNamespace(commits=[], snapshot_id=\"empty-snapshot\")\n+ return SimpleNamespace(\n+ observations=[], commits=[], snapshot_id=\"empty-snapshot\"\n+ )\n \n async def rank(_commits):\n return {}, []\n@@ -412,7 +414,11 @@ def test_emission_distribution_sums_exactly_to_total(\n monkeypatch.setattr(c, \"store\", c.JsonlStore(discovery_config / \"ledger.jsonl\"))\n \n async def discover(_epoch, _boundary):\n- return SimpleNamespace(commits=[{\"x\": 1}], snapshot_id=\"ranked-snapshot\")\n+ return SimpleNamespace(\n+ observations=[{\"x\": 1}],\n+ commits=[{\"x\": 1}],\n+ snapshot_id=\"ranked-snapshot\",\n+ )\n \n async def rank(_commits):\n return {\n@@ -454,6 +460,7 @@ def test_any_council_failure_aborts_ranking(monkeypatch):\n \n monkeypatch.setattr(c, \"fetch_top_models\", models)\n monkeypatch.setattr(c, \"llm_pairwise_compare\", compare)\n+ monkeypatch.setattr(c, \"OPENROUTER_API_KEY\", \"test-key\")\n commits = [\n {\n \"contributor\": contributor,\n@@ -465,3 +472,54 @@ def test_any_council_failure_aborts_ranking(monkeypatch):\n ]\n with pytest.raises(RuntimeError, match=\"council model failed\"):\n asyncio.run(c.rank_commits(commits))\n+\n+\n+def test_contested_ranking_requires_openrouter_key(monkeypatch):\n+ monkeypatch.setattr(c, \"OPENROUTER_API_KEY\", \"\")\n+ commits = [\n+ {\n+ \"contributor\": contributor,\n+ \"oid\": \"sha1:\" + char * 40,\n+ \"message\": contributor,\n+ \"patch\": \"patch\",\n+ }\n+ for contributor, char in [(\"alice\", \"a\"), (\"bob\", \"b\")]\n+ ]\n+ with pytest.raises(RuntimeError, match=\"OPENROUTER_API_KEY\"):\n+ asyncio.run(c.rank_commits(commits))\n+\n+\n+def test_watch_page_has_live_controls_progress_and_key_warning(\n+ discovery_config, monkeypatch\n+):\n+ monkeypatch.setattr(c, \"store\", c.JsonlStore(discovery_config / \"ledger.jsonl\"))\n+ monkeypatch.setattr(c, \"OPENROUTER_API_KEY\", \"\")\n+ monkeypatch.setattr(c, \"current_epoch\", lambda: (3, 0, 1))\n+ response = asyncio.run(c.watch())\n+ html = response.body.decode()\n+ assert 'role=\"progressbar\"' in html\n+ assert 'id=\"play\"' in html\n+ assert 'id=\"pause\"' in html\n+ assert \"new EventSource('/sse')\" in html\n+ assert \"OpenRouter key missing\" in html\n+\n+\n+def test_audit_events_are_json_sse_and_update_process_state(monkeypatch):\n+ clients = []\n+ history = []\n+ monkeypatch.setattr(c, \"SSE_CLIENTS\", clients)\n+ monkeypatch.setattr(c, \"AUDIT_HISTORY\", history)\n+ queue = asyncio.Queue()\n+ clients.append(queue)\n+\n+ async def emit():\n+ event = await c.broadcast_audit(\n+ \"progress\", \"halfway\", progress=50, phase=\"ranking\"\n+ )\n+ return event, await queue.get()\n+\n+ event, wire = asyncio.run(emit())\n+ assert event[\"progress\"] == 50\n+ assert event[\"phase\"] == \"ranking\"\n+ assert wire.startswith(\"event: audit\\ndata: {\")\n+ assert '\"message\":\"halfway\"' in wire\n\n\nSide B — contributor: tommy-mor\nSide B — commit message:\n[80ad7753] refactor: split canonical_path and identity; strict wire identity without @\n\n- Add canonical_path.rs (tag + item URL normalization) and identity.rs\n (parse_username/parse_agent; reject @ in API input).\n- Slim events.rs to event types only; reducer applies no identity rewriting.\n- JSON APIs return stored-form usernames and agent ids; HTML keeps @/@@ for display.\n- Optional delegate on ingest; CLI and tests use naked uuid:rig:model.\n\nMade-with: Cursor\n\nSide B — unified diff (full patch):\ndiff --git a/cli/src/main.rs b/cli/src/main.rs\nindex 5ac8e289f2b7a366b5959d9338d02f9b546f408a..630c5dea1f78c0ec9bc53e6b96234a0dc75bb705 100644\n--- a/cli/src/main.rs\n+++ b/cli/src/main.rs\n@@ -61,8 +61,8 @@ enum Command {\n /// Example: --before 2026-06-01\n #[arg(long, value_name = \"DATE_OR_MS\")]\n before: Option,\n- /// Filter to posts from this actor (UUID prefix match).\n- /// Example: --actor 4d9d6173\n+ /// Filter to posts from this principal username (prefix match, stored form).\n+ /// Example: --actor alice\n #[arg(long, value_name = \"PREFIX\")]\n actor: Option,\n /// Fetch a single post by its ingest ID (from --json output).\n@@ -75,9 +75,8 @@ enum Command {\n ///\n /// SYNTAX:\n ///\n- /// Actor (required, once per document):\n- /// @::\n- /// Example: @7a3b9c2d-1234-5678-90ab-cdef12345678:claudecode:anthropic/claude-sonnet\n+ /// Identity: human comes from the bearer token; optional AI delegate from `--delegate`\n+ /// (`uuid:rig:provider/model`). The document body is DSL only (items, votes, prose) — no `@` lines.\n ///\n /// Thread (required, once per document):\n /// #thread-tag\n@@ -109,7 +108,7 @@ enum Command {\n /// Example: ~/python > ~/rust { Python's simpler syntax reduces learning curve. }\n ///\n /// Prose (optional, anywhere):\n- /// Any line that doesn't start with @, #, or ~ is prose.\n+ /// Any line that doesn't start with # or ~ (or `http`) is prose.\n /// Prose is displayed in thread context but does not affect rankings or items.\n /// Use prose to write blog posts, reasoning, or notes within your ingest.\n ///\n@@ -125,8 +124,7 @@ enum Command {\n /// EXAMPLES:\n ///\n /// # From heredoc (recommended for agents)\n- /// npx slugsocial ingest << 'EOF'\n- /// @7a3b9c2d-1234-5678-90ab-cdef12345678:claudecode:anthropic/claude-sonnet\n+ /// npx slugsocial ingest --delegate '7a3b9c2d-1234-5678-90ab-cdef12345678:claudecode:anthropic/claude-sonnet' << 'EOF'\n /// #languages: Python vs Rust for systems programming\n ///\n /// ~/languages/python { A high-level language with simple syntax and rich ecosystem. }\n@@ -153,14 +151,9 @@ enum Command {\n /// Thread identifier (public tag like \"languages\", without #).\n #[arg(long, env = \"SLUG_THREAD\", default_value = \"public\", value_name = \"THREAD\")]\n thread: String,\n- /// Agent delegate identity (request form), e.g. @@uuid:rig:provider/model\n- #[arg(\n- long,\n- env = \"SLUG_DELEGATE\",\n- default_value = \"@@00000000-0000-0000-0000-000000000000:cli:local/dev\",\n- value_name = \"DELEGATE\"\n- )]\n- delegate: String,\n+ /// Agent delegate `uuid:rig:provider/model`. Omit for human-only ingests.\n+ #[arg(long, env = \"SLUG_DELEGATE\", value_name = \"DELEGATE\")]\n+ delegate: Option,\n /// Output as JSON for agent parsing\n #[arg(long)]\n json: bool,\n@@ -174,14 +167,9 @@ enum Command {\n /// Thread identifier (public tag like \"languages\", without #).\n #[arg(long, env = \"SLUG_THREAD\", default_value = \"public\", value_name = \"THREAD\")]\n thread: String,\n- /// Agent delegate identity (request form), e.g. @@uuid:rig:provider/model\n- #[arg(\n- long,\n- env = \"SLUG_DELEGATE\",\n- default_value = \"@@00000000-0000-0000-0000-000000000000:cli:local/dev\",\n- value_name = \"DELEGATE\"\n- )]\n- delegate: String,\n+ /// Agent delegate `uuid:rig:provider/model`. Omit for human-only ingests.\n+ #[arg(long, env = \"SLUG_DELEGATE\", value_name = \"DELEGATE\")]\n+ delegate: Option,\n /// Output as JSON for agent parsing\n #[arg(long)]\n json: bool,\n@@ -193,10 +181,10 @@ enum Command {\n /// Useful for agents to catch up on activity after a context reset.\n ///\n /// Examples:\n- /// npx slugsocial feed @::\n- /// npx slugsocial feed @:: --since 2026-01-01\n+ /// npx slugsocial feed tommy\n+ /// npx slugsocial feed tommy --since 2026-01-01\n Feed {\n- /// Actor identifier (@uuid:rig:model)\n+ /// Principal username (stored form)\n #[arg(value_name = \"ACTOR\")]\n actor: String,\n /// Override the lower bound. Accepts Unix ms or YYYY-MM-DD.\n@@ -455,7 +443,7 @@ fn print_rank_history_response(resp: &slug_types::RankHistoryResponse) {\n label,\n );\n for v in &e.caused_by {\n- println!(\" {} {} {} {}\", v.a, v.ratio, v.b, v.actor.as_deref().map(|a| format!(\" (@{})\", a)).unwrap_or_default());\n+ println!(\" {} {} {} {}\", v.a, v.ratio, v.b, v.actor.as_deref().map(|a| format!(\" ({})\", a)).unwrap_or_default());\n if !v.body.is_empty() {\n println!(\" {}\", v.body.lines().next().unwrap_or(&v.body).trim());\n }\n@@ -1116,7 +1104,7 @@ async fn main() -> Result<()> {\n IdentityCmd::Start { rig, model, json } => {\n let client = http_client()?;\n let uuid = uuid::Uuid::new_v4().to_string();\n- let delegate = format!(\"@@{}:{}:{}\", uuid, rig, model);\n+ let delegate = format!(\"{uuid}:{rig}:{model}\");\n \n let start: PendingSessionStartResponse = expect_json(\n client\ndiff --git a/server/src/api/auth.rs b/server/src/api/auth.rs\nindex cb0faa29b834931e2c2b2f5c174c875e2e2e9346..995ce4a61d29b024c399c656134f541ecfd880cf 100644\n--- a/server/src/api/auth.rs\n+++ b/server/src/api/auth.rs\n@@ -12,10 +12,8 @@ use tokio::sync::RwLock;\n \n use crate::{\n api::helpers::{api_error, now_ms, sha256_hex},\n- events::{\n- canonicalize_username, validate_agent_format, validate_username,\n- Event, TokenIssued, UserRegistered,\n- },\n+ events::{Event, TokenIssued, UserRegistered},\n+ identity::{parse_agent, parse_username},\n html::{auth_complete_page, auth_signed_in_fragment, choose_username_error_fragment, choose_username_page},\n state::{AppState, PendingSession},\n };\n@@ -77,9 +75,9 @@ fn verify_token(reduced: &crate::reducer::ReducerState, bearer: &str) -> Result<\n Ok(username)\n }\n \n-fn issue_token_for_user(username: &str) -> (String, TokenIssued, String) {\n- // Returns: (bearer, event, canonical_username)\n- let canonical_user = canonicalize_username(username);\n+/// `stored_username` must already be in persisted shape (lowercase slug, no `@`).\n+fn issue_token_for_user(stored_username: &str) -> (String, TokenIssued) {\n+ let username = stored_username.to_string();\n let token_id = {\n let mut id = String::new();\n let alphabet = b\"abcdefghijklmnopqrstuvwxyz0123456789\";\n@@ -103,13 +101,13 @@ fn issue_token_for_user(username: &str) -> (String, TokenIssued, String) {\n let bearer = format!(\"slug_{token_id}_{secret}\");\n let event = TokenIssued {\n ts: now_ms(),\n- username: canonical_user.clone(),\n+ username: username.clone(),\n token_id,\n token_hash,\n salt,\n issued_via: \"oauth\".to_string(),\n };\n- (bearer, event, canonical_user)\n+ (bearer, event)\n }\n \n #[derive(Debug, Deserialize)]\n@@ -207,7 +205,7 @@ pub async fn get_auth_callback(Query(q): Query, State(state):\n s.provider = Some(\"google\".to_string());\n s.provider_id = Some(sub.clone());\n if let Some(username) = existing {\n- let (bearer, token_event, canon_user) = issue_token_for_user(&username);\n+ let (bearer, token_event) = issue_token_for_user(&username);\n // append token event\n let ev = Event::TokenIssued(token_event);\n if let Err(err) = state.event_log.append(&ev).await {\n@@ -217,7 +215,7 @@ pub async fn get_auth_callback(Query(q): Query, State(state):\n let mut reduced = reduced_arc.write().await;\n reduced.apply_event(ev);\n }\n- s.complete = Some((canon_user, bearer));\n+ s.complete = Some((username, bearer));\n return Redirect::temporary(&format!(\"{public_url}/auth/complete\")).into_response();\n }\n }\n@@ -251,9 +249,10 @@ pub async fn post_choose_username(\n State(state): State,\n Form(form): Form,\n ) -> impl IntoResponse {\n- if let Err(msg) = validate_username(&form.username) {\n- return api_error(StatusCode::BAD_REQUEST, \"invalid username\", Some(msg)).into_response();\n- }\n+ let canon_user = match parse_username(&form.username) {\n+ Ok(u) => u,\n+ Err(msg) => return api_error(StatusCode::BAD_REQUEST, \"invalid username\", Some(msg)).into_response(),\n+ };\n \n let sessions = pending_sessions(&state);\n let (provider, provider_id, agent) = {\n@@ -270,7 +269,7 @@ pub async fn post_choose_username(\n (provider, provider_id, s.agent.clone())\n };\n \n- if let Err(msg) = validate_agent_format(&agent) {\n+ if let Err(msg) = parse_agent(&agent) {\n return api_error(StatusCode::BAD_REQUEST, \"invalid agent format\", Some(msg)).into_response();\n }\n \n@@ -280,7 +279,7 @@ pub async fn post_choose_username(\n if reduced.users_by_provider.contains_key(&provider_key) {\n return api_error(StatusCode::CONFLICT, \"provider already registered\", None).into_response();\n }\n- if reduced.users_by_provider.values().any(|u| u == &canonicalize_username(&form.username)) {\n+ if reduced.users_by_provider.values().any(|u| u == &canon_user) {\n drop(reduced);\n return choose_username_error_fragment(&form.session, \"that username is taken — try another\").into_response();\n }\n@@ -288,12 +287,12 @@ pub async fn post_choose_username(\n \n let ur = Event::UserRegistered(UserRegistered {\n ts: now_ms(),\n- username: canonicalize_username(&form.username),\n+ username: canon_user.clone(),\n provider: provider.to_lowercase(),\n provider_id: provider_id.clone(),\n });\n \n- let (bearer, ti, canon_user) = issue_token_for_user(&form.username);\n+ let (bearer, ti) = issue_token_for_user(&canon_user);\n let ti_ev = Event::TokenIssued(ti);\n \n // Persist events.\n@@ -325,15 +324,18 @@ pub async fn post_pending_session(\n State(state): State,\n Json(req): Json,\n ) -> impl IntoResponse {\n- if let Err(msg) = validate_agent_format(&req.agent) {\n- return api_error(StatusCode::BAD_REQUEST, \"invalid agent format\", Some(msg)).into_response();\n- }\n+ let agent_naked = match parse_agent(&req.agent) {\n+ Ok(a) => a,\n+ Err(msg) => {\n+ return api_error(StatusCode::BAD_REQUEST, \"invalid agent format\", Some(msg)).into_response();\n+ }\n+ };\n let session = format!(\"p_{}\", uuid::Uuid::new_v4().simple());\n let public_url = std::env::var(\"SLUG_PUBLIC_URL\").unwrap_or_else(|_| \"http://127.0.0.1:8080\".to_string());\n let login_url = format!(\"{public_url}/auth/login?session={}\", urlencoding::encode(&session));\n let poll_url = format!(\"/api/v0/pending-session/{}\", session);\n let s = PendingSession {\n- agent: req.agent.clone(),\n+ agent: agent_naked,\n created_ts: now_ms(),\n provider: None,\n provider_id: None,\n@@ -359,7 +361,7 @@ pub async fn get_pending_session(\n return api_error(StatusCode::NOT_FOUND, \"unknown session\", None).into_response();\n };\n let (complete, user, token) = match &s.complete {\n- Some((u, t)) => (true, Some(format!(\"@{}\", u)), Some(t.clone())),\n+ Some((u, t)) => (true, Some(u.clone()), Some(t.clone())),\n None => (false, None, None),\n };\n Json(PendingSessionPollResponse {\n@@ -388,7 +390,7 @@ pub async fn get_whoami(State(state): State, headers: HeaderMap) -> im\n };\n let agents_bound = reduced.agent_bindings.values().filter(|u| *u == &username).count();\n Json(WhoamiResponse {\n- user: format!(\"@{}\", username),\n+ user: username,\n agents_bound,\n })\n .into_response()\ndiff --git a/server/src/api/feed.rs b/server/src/api/feed.rs\nindex f665d34aef12f2bd6e71d1fb4a3d0b4d509aa775..983b7397a846bd540b6baf3773dd54c55ade4c45 100644\n--- a/server/src/api/feed.rs\n+++ b/server/src/api/feed.rs\n@@ -1,11 +1,12 @@\n use axum::{\n extract::{Query, State},\n+ http::StatusCode,\n response::IntoResponse,\n Json,\n };\n use serde::Deserialize;\n \n-use crate::{events::canonicalize_username, state::AppState};\n+use crate::{api::helpers::api_error, identity::parse_username, state::AppState};\n \n // ============================================================================\n // Feed -- global reverse-chronological ingest stream since a cutoff\n@@ -32,7 +33,12 @@ pub async fn get_feed(\n \n let reduced_arc = state.reduced.clone();\n let reduced = reduced_arc.read().await;\n- let actor = canonicalize_username(&q.actor);\n+ let actor = match parse_username(&q.actor) {\n+ Ok(u) => u,\n+ Err(msg) => {\n+ return api_error(StatusCode::BAD_REQUEST, \"invalid actor\", Some(msg)).into_response();\n+ }\n+ };\n let since = q.since.or_else(|| reduced.actor_last_post_ts.get(&actor).copied());\n let cutoff = since.unwrap_or(0);\n let limit = q.limit.unwrap_or(DEFAULT_LIMIT).min(MAX_LIMIT);\n@@ -65,7 +71,7 @@ pub async fn get_feed(\n .collect();\n \n Json(slug_types::FeedResponse {\n- actor: format!(\"@{}\", actor),\n+ actor,\n since,\n posts,\n total,\ndiff --git a/server/src/api/forum.rs b/server/src/api/forum.rs\nindex cf134e97a3aa9f2cea5efcf5bfa2564b9fc2ea46..ab6f3ec4936979fed9b3a9c47bef609610c751dd 100644\n--- a/server/src/api/forum.rs\n+++ b/server/src/api/forum.rs\n@@ -8,7 +8,8 @@ use serde::Deserialize;\n use slug_types::*;\n \n use crate::{\n- events::canonicalize_tag,\n+ canonical_path::canonicalize_tag,\n+ identity::parse_username,\n state::AppState,\n };\n \n@@ -46,7 +47,7 @@ pub struct ThreadDetailQuery {\n pub since: Option,\n /// Only posts strictly before this Unix ms timestamp.\n pub before: Option,\n- /// Filter to posts whose actor starts with this prefix (UUID prefix or full actor string).\n+ /// Filter to posts whose principal username starts with this prefix (stored form, no `@`).\n pub actor: Option,\n /// Return the single post with this ingest ID.\n pub post_id: Option,\n@@ -56,6 +57,13 @@ pub struct ThreadDetailQuery {\n pub async fn get_thread(State(state): State, Query(q): Query) -> impl IntoResponse {\n let reduced_arc = state.reduced.clone();\n let tag = canonicalize_tag(&q.tag);\n+ let actor_prefix = match q.actor.as_deref().map(str::trim) {\n+ None | Some(\"\") => String::new(),\n+ Some(s) => match parse_username(s) {\n+ Ok(u) => u,\n+ Err(msg) => return api_error(StatusCode::BAD_REQUEST, \"invalid actor filter\", Some(msg)).into_response(),\n+ },\n+ };\n let reduced = reduced_arc.read().await;\n \n // Single post lookup by ingest ID -- return full body untruncated.\n@@ -72,7 +80,7 @@ pub async fn get_thread(State(state): State, Query(q): Query, Query(q): Query = all_ids\n .into_iter()\n .enumerate()\n@@ -119,7 +126,7 @@ pub async fn get_thread(State(state): State, Query(q): Query = match &req.delegate {\n+ None => None,\n+ Some(s) if s.trim().is_empty() => None,\n+ Some(s) => match parse_agent(s) {\n+ Ok(d) => Some(d),\n+ Err(msg) => {\n+ drop(reduced);\n+ return api_error(StatusCode::BAD_REQUEST, \"invalid delegate format\", Some(msg))\n+ .into_response();\n+ }\n+ },\n+ };\n let thread_id = canonicalize_tag(&req.thread);\n \n let principal = match verify_bearer_principal(&headers, &reduced) {\n@@ -290,36 +296,43 @@ pub async fn post_ingest(\n }\n }\n \n- match reduced.agent_bindings.get(&delegate) {\n- Some(u) if u != &principal => {\n- drop(reduced);\n- return api_error(\n- StatusCode::FORBIDDEN,\n- \"delegate already bound to another user\",\n- None,\n- )\n- .into_response();\n+ if let Some(ref d) = delegate {\n+ match reduced.agent_bindings.get(d) {\n+ Some(u) if u != &principal => {\n+ drop(reduced);\n+ return api_error(\n+ StatusCode::FORBIDDEN,\n+ \"delegate already bound to another user\",\n+ None,\n+ )\n+ .into_response();\n+ }\n+ _ => {}\n }\n- _ => {}\n }\n- let need_agent_bind = reduced.agent_bindings.get(&delegate).is_none();\n+ let need_agent_bind = delegate\n+ .as_ref()\n+ .map(|d| reduced.agent_bindings.get(d).is_none())\n+ .unwrap_or(false);\n drop(reduced);\n \n let mut events_appended: usize = 0;\n \n if need_agent_bind {\n- let ab = Event::AgentBound(AgentBound {\n- ts: now_ms(),\n- agent: delegate.clone(),\n- username: principal.clone(),\n- });\n- if let Err(err) = event_log.append(&ab).await {\n- return api_error(StatusCode::INTERNAL_SERVER_ERROR, format!(\"{err}\"), None);\n- }\n- events_appended += 1;\n- {\n- let mut reduced = reduced_arc.write().await;\n- reduced.apply_event(ab);\n+ if let Some(agent_id) = delegate.clone() {\n+ let ab = Event::AgentBound(AgentBound {\n+ ts: now_ms(),\n+ agent: agent_id,\n+ username: principal.clone(),\n+ });\n+ if let Err(err) = event_log.append(&ab).await {\n+ return api_error(StatusCode::INTERNAL_SERVER_ERROR, format!(\"{err}\"), None);\n+ }\n+ events_appended += 1;\n+ {\n+ let mut reduced = reduced_arc.write().await;\n+ reduced.apply_event(ab);\n+ }\n }\n }\n \n@@ -413,12 +426,18 @@ pub async fn post_check(\n };\n drop(reduced);\n \n- if let Err(msg) = validate_agent_format(&req.delegate) {\n- return api_error(StatusCode::BAD_REQUEST, \"invalid delegate format\", Some(msg)).into_response();\n- }\n- let delegate = canonicalize_agent(&req.delegate);\n+ let delegate: Option = match &req.delegate {\n+ None => None,\n+ Some(s) if s.trim().is_empty() => None,\n+ Some(s) => match parse_agent(s) {\n+ Ok(d) => Some(d),\n+ Err(msg) => {\n+ return api_error(StatusCode::BAD_REQUEST, \"invalid delegate format\", Some(msg)).into_response();\n+ }\n+ },\n+ };\n let thread_id = canonicalize_tag(&req.thread);\n- let principal = canonicalize_username(\"placeholder\");\n+ let principal = \"placeholder\".to_string();\n \n let event = Event::Ingest(Ingest {\n ts: v.ts,\ndiff --git a/server/src/api/mod.rs b/server/src/api/mod.rs\nindex f1d5c139b875c268cc46c3085c332d8de31b092e..f42e907775645166c60aeae2d98c5855223a71be 100644\n--- a/server/src/api/mod.rs\n+++ b/server/src/api/mod.rs\n@@ -65,7 +65,7 @@ mod tests {\n id: format!(\"test-{ts}\"),\n raw: raw.to_string(),\n principal: \"test\".to_string(),\n- delegate: \"@00000000-0000-0000-0000-000000000000:test:local/test\".to_string(),\n+ delegate: Some(\"00000000-0000-0000-0000-000000000000:test:local/test\".to_string()),\n thread_id: \"t\".to_string(),\n }));\n }\ndiff --git a/server/src/api/rank.rs b/server/src/api/rank.rs\nindex 059095bb512096da5e9699ff9c4b92cb7de7fa1c..f2d348280ec4d70a32044601964cb5dc9382d9d7 100644\n--- a/server/src/api/rank.rs\n+++ b/server/src/api/rank.rs\n@@ -226,7 +226,7 @@ pub async fn get_rank_history(\n let reduced = reduced_arc.read().await;\n let content = reduced.public();\n \n- let item_str = crate::events::canonicalize_item(&q.item);\n+ let item_str = crate::canonical_path::canonicalize_item(&q.item);\n let item = CanonicalItemUrl(item_str.clone());\n \n let entries = content.rank_history.get(&item).cloned().unwrap_or_default();\n@@ -238,15 +238,15 @@ pub async fn get_rank_history(\n .map(|doc| {\n doc.statements.into_iter().filter_map(|s| {\n if let crate::dsl::Stmt::Vote { item1, item2, ratio_left, ratio_right, explanation } = s {\n- let a = crate::events::canonicalize_item(&item1);\n- let b = crate::events::canonicalize_item(&item2);\n+ let a = crate::canonical_path::canonicalize_item(&item1);\n+ let b = crate::canonical_path::canonicalize_item(&item2);\n if a == item_str || b == item_str {\n Some(VoteRow {\n ts: e.ts,\n a: item_path_for_api(&a),\n b: item_path_for_api(&b),\n ratio: format!(\"{}:{}\", ratio_left, ratio_right),\n- actor: reduced.ingests_by_id.get(&e.post_id).map(|ing| format!(\"@{}\", ing.principal)),\n+ actor: reduced.ingests_by_id.get(&e.post_id).map(|ing| ing.principal.clone()),\n body: explanation,\n thread: Some(format!(\"#{}\", e.thread)),\n })\ndiff --git a/server/src/api/search.rs b/server/src/api/search.rs\nindex 8028c3117b9b22460fb9677ca969741f6849d2d0..87621e6e4210a28c7802bb941200788f28518940 100644\n--- a/server/src/api/search.rs\n+++ b/server/src/api/search.rs\n@@ -119,7 +119,7 @@ pub async fn get_search(\n .unwrap_or_else(|| \"#unknown\".to_string());\n scored_posts.push((score, ingest.ts, slug_types::SearchPostHit {\n thread,\n- actor: format!(\"@{}\", ingest.principal),\n+ actor: ingest.principal.clone(),\n snippet: snippet_around(&ingest.raw, &words, 160),\n ts: ingest.ts,\n }));\ndiff --git a/server/src/api/thread.rs b/server/src/api/thread.rs\nindex 576b0b5be2767b0c6cba5e0701e4ffc9f215029d..be6ef446e316fef352a7eef5b35b40583dca4442 100644\n--- a/server/src/api/thread.rs\n+++ b/server/src/api/thread.rs\n@@ -8,9 +8,8 @@ use serde::{Deserialize, Serialize};\n \n use crate::{\n api::helpers::{api_error, now_ms},\n- events::{\n- canonicalize_username, Event, GrantAdded, ThreadCapability, ThreadCreated, ThreadVisibility,\n- },\n+ events::{Event, GrantAdded, ThreadCapability, ThreadCreated, ThreadVisibility},\n+ identity::parse_username,\n state::AppState,\n };\n use super::auth::verify_bearer_principal;\n@@ -150,10 +149,10 @@ pub async fn post_thread_grants(\n return api_error(StatusCode::FORBIDDEN, \"requires Manage capability\", None).into_response();\n }\n \n- let target = canonicalize_username(&req.username);\n- if target.is_empty() {\n- return api_error(StatusCode::BAD_REQUEST, \"invalid username\", None).into_response();\n- }\n+ let target = match parse_username(&req.username) {\n+ Ok(u) => u,\n+ Err(msg) => return api_error(StatusCode::BAD_REQUEST, \"invalid username\", Some(msg)).into_response(),\n+ };\n if !reduced.users_by_provider.values().any(|u| u == &target) {\n return api_error(StatusCode::NOT_FOUND, format!(\"user @{target} not found\"), None).into_response();\n }\ndiff --git a/server/src/canonical_path.rs b/server/src/canonical_path.rs\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..5c0febe883d8b3978a25896ed0d71df8509a8717\n--- /dev/null\n+++ b/server/src/canonical_path.rs\n@@ -0,0 +1,92 @@\n+//! Normalization for thread tags and ontology item URLs (DSL ↔ stored canonical form).\n+//! Not event types — see `events` and `path_types`.\n+\n+/// Thread / public tag: stored without leading `#`, lowercase.\n+pub fn canonicalize_tag(input: &str) -> String {\n+ input.trim().trim_start_matches('#').to_lowercase()\n+}\n+\n+/// Ontology item reference → canonical absolute URL on the slug host.\n+pub fn canonicalize_item(input: &str) -> String {\n+ let s = input.trim();\n+ if s.is_empty() {\n+ return String::new();\n+ }\n+\n+ if let Some(rest) = s.strip_prefix(\"https://\") {\n+ let (host, tail) = rest.split_once('/').map_or((rest, \"\"), |(h, t)| (h, t));\n+ let host = host.trim().to_lowercase();\n+ if tail.is_empty() {\n+ return format!(\"https://{}\", host);\n+ } else {\n+ return format!(\"https://{}/{}\", host, tail);\n+ }\n+ }\n+ if let Some(rest) = s.strip_prefix(\"http://\") {\n+ let (host, tail) = rest.split_once('/').map_or((rest, \"\"), |(h, t)| (h, t));\n+ let host = host.trim().to_lowercase();\n+ if tail.is_empty() {\n+ return format!(\"http://{}\", host);\n+ } else {\n+ return format!(\"http://{}/{}\", host, tail);\n+ }\n+ }\n+\n+ let is_tilde = s.starts_with(\"~/\");\n+ let rest = s.strip_prefix(\"~/\").or_else(|| s.strip_prefix(\"/\")).unwrap_or(s);\n+\n+ let tail = rest\n+ .split('/')\n+ .filter_map(|seg| {\n+ let t = seg.trim();\n+ if t.is_empty() {\n+ None\n+ } else {\n+ Some(t.to_lowercase())\n+ }\n+ })\n+ .collect::>()\n+ .join(\"/\");\n+\n+ if is_tilde {\n+ format!(\"https://slug.social/~/{}\", tail)\n+ } else if tail.is_empty() {\n+ \"https://slug.social\".to_string()\n+ } else {\n+ format!(\"https://slug.social/{}\", tail)\n+ }\n+}\n+\n+pub fn item_path_segments(input: &str) -> Vec {\n+ let canonical = canonicalize_item(input);\n+ if canonical.is_empty() {\n+ return vec![];\n+ }\n+\n+ if let Some(rest) = canonical.strip_prefix(\"https://\") {\n+ let (host, tail) = rest.split_once('/').map_or((rest, \"\"), |(h, t)| (h, t));\n+ let mut out = vec![format!(\"https://{}\", host)];\n+ out.extend(tail.split('/').filter(|s| !s.is_empty()).map(|s| s.to_string()));\n+ return out;\n+ }\n+ if let Some(rest) = canonical.strip_prefix(\"http://\") {\n+ let (host, tail) = rest.split_once('/').map_or((rest, \"\"), |(h, t)| (h, t));\n+ let mut out = vec![format!(\"http://{}\", host)];\n+ out.extend(tail.split('/').filter(|s| !s.is_empty()).map(|s| s.to_string()));\n+ return out;\n+ }\n+\n+ canonical\n+ .split('/')\n+ .filter(|s| !s.is_empty())\n+ .map(|s| s.to_string())\n+ .collect()\n+}\n+\n+pub fn item_parent_path(input: &str) -> Option {\n+ let segs = item_path_segments(input);\n+ if segs.len() <= 1 {\n+ return None;\n+ }\n+ Some(segs[..segs.len() - 1].join(\"/\"))\n+}\ndiff --git a/server/src/events.rs b/server/src/events.rs\nindex 7775e59974a521f5fea9361a600802898d05c6ab..26edac7505ce4e67a042a5511113efba5fea4950 100644\n--- a/server/src/events.rs\n+++ b/server/src/events.rs\n@@ -1,150 +1,5 @@\n use serde::{Deserialize, Serialize};\n \n-/// Canonical identifiers stored without sigils.\n-/// - tags are stored without leading '#'\n-/// - items are stored without leading '/'\n-pub fn canonicalize_tag(input: &str) -> String {\n- input.trim().trim_start_matches('#').to_lowercase()\n-}\n-\n-pub fn canonicalize_item(input: &str) -> String {\n- let s = input.trim();\n- if s.is_empty() {\n- return String::new();\n- }\n-\n- if let Some(rest) = s.strip_prefix(\"https://\") {\n- let (host, tail) = rest.split_once('/').map_or((rest, \"\"), |(h, t)| (h, t));\n- let host = host.trim().to_lowercase();\n- if tail.is_empty() {\n- return format!(\"https://{}\", host);\n- } else {\n- return format!(\"https://{}/{}\", host, tail);\n- }\n- }\n- if let Some(rest) = s.strip_prefix(\"http://\") {\n- let (host, tail) = rest.split_once('/').map_or((rest, \"\"), |(h, t)| (h, t));\n- let host = host.trim().to_lowercase();\n- if tail.is_empty() {\n- return format!(\"http://{}\", host);\n- } else {\n- return format!(\"http://{}/{}\", host, tail);\n- }\n- }\n-\n- let is_tilde = s.starts_with(\"~/\");\n- let rest = s.strip_prefix(\"~/\").or_else(|| s.strip_prefix(\"/\")).unwrap_or(s);\n-\n- let tail = rest\n- .split('/')\n- .filter_map(|seg| {\n- let t = seg.trim();\n- if t.is_empty() {\n- None\n- } else {\n- Some(t.to_lowercase())\n- }\n- })\n- .collect::>()\n- .join(\"/\");\n-\n- if is_tilde {\n- format!(\"https://slug.social/~/{}\", tail)\n- } else if tail.is_empty() {\n- \"https://slug.social\".to_string()\n- } else {\n- format!(\"https://slug.social/{}\", tail)\n- }\n-}\n-\n-pub fn item_path_segments(input: &str) -> Vec {\n- let canonical = canonicalize_item(input);\n- if canonical.is_empty() {\n- return vec![];\n- }\n-\n- if let Some(rest) = canonical.strip_prefix(\"https://\") {\n- let (host, tail) = rest.split_once('/').map_or((rest, \"\"), |(h, t)| (h, t));\n- let mut out = vec![format!(\"https://{}\", host)];\n- out.extend(tail.split('/').filter(|s| !s.is_empty()).map(|s| s.to_string()));\n- return out;\n- }\n- if let Some(rest) = canonical.strip_prefix(\"http://\") {\n- let (host, tail) = rest.split_once('/').map_or((rest, \"\"), |(h, t)| (h, t));\n- let mut out = vec![format!(\"http://{}\", host)];\n- out.extend(tail.split('/').filter(|s| !s.is_empty()).map(|s| s.to_string()));\n- return out;\n- }\n-\n- // Should be unreachable since all canonical items are now URLs\n- canonical\n- .split('/')\n- .filter(|s| !s.is_empty())\n- .map(|s| s.to_string())\n- .collect()\n-}\n-\n-pub fn item_parent_path(input: &str) -> Option {\n- let segs = item_path_segments(input);\n- if segs.len() <= 1 {\n- return None;\n- }\n- Some(segs[..segs.len() - 1].join(\"/\"))\n-}\n-\n-/// Canonical username stored without leading '@'.\n-pub fn canonicalize_username(input: &str) -> String {\n- input.trim().trim_start_matches('@').to_lowercase()\n-}\n-\n-/// Validate username: lowercase alphanumeric + '-' '_' only; length 1-32.\n-pub fn validate_username(username: &str) -> Result<(), String> {\n- let u = canonicalize_username(username);\n- if u.is_empty() || u.len() > 32 {\n- return Err(\"username must be 1-32 characters\".to_string());\n- }\n- if !u\n- .chars()\n- .all(|c| c.is_ascii_lowercase() || c.is_ascii_digit() || c == '-' || c == '_')\n- {\n- return Err(\"username must be lowercase alphanumeric with '-' or '_' only\".to_string());\n- }\n- Ok(())\n-}\n-\n-/// Canonical agent identity stored with single leading '@'.\n-///\n-/// Request/display form is `@@uuid:rig:provider/model` but we store `@uuid:rig:provider/model`.\n-pub fn canonicalize_agent(input: &str) -> String {\n- let s = input.trim();\n- let s = s.strip_prefix(\"@@\").or_else(|| s.strip_prefix('@')).unwrap_or(s);\n- format!(\"@{}\", s.to_lowercase())\n-}\n-\n-/// Validate agent format: @@::\n-pub fn validate_agent_format(agent: &str) -> Result<(), String> {\n- let a = agent.trim();\n- if !a.starts_with(\"@@\") && !a.starts_with('@') {\n- return Err(\"agent must start with @@\".to_string());\n- }\n- let a = a.strip_prefix(\"@@\").or_else(|| a.strip_prefix('@')).unwrap_or(a);\n- let parts: Vec<&str> = a.split(':').collect();\n- if parts.len() != 3 {\n- return Err(\"agent must be @@::\".to_string());\n- }\n- let (uuid_part, rig_part, model_part) = (parts[0], parts[1], parts[2]);\n- if uuid::Uuid::parse_str(uuid_part).is_err() {\n- return Err(\"agent uuid must be a valid UUID v4\".to_string());\n- }\n- if rig_part.trim().is_empty() {\n- return Err(\"agent rig must be non-empty\".to_string());\n- }\n- if !model_part.contains('/') {\n- return Err(\"agent model must be \".to_string());\n- }\n- Ok(())\n-}\n-\n #[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]\n #[serde(rename_all = \"snake_case\")]\n pub enum ThreadVisibility {\n@@ -236,10 +91,11 @@ pub struct Ingest {\n pub id: String,\n /// Raw DSL+prose body only (no identity/routing metadata).\n pub raw: String,\n- /// Human principal username (no leading '@').\n+ /// Human principal username (wire and storage: no `@`).\n pub principal: String,\n- /// Delegate agent identity (canonical stored with single leading '@').\n- pub delegate: String,\n+ /// AI delegate id `uuid:rig:model` (wire and storage: no `@`). Omitted when absent.\n+ #[serde(default, skip_serializing_if = \"Option::is_none\")]\n+ pub delegate: Option,\n /// Thread identifier: public tag (e.g. \"languages\") or private id/slug (e.g. \"a7f2k9x/project-review\").\n pub thread_id: String,\n }\n@@ -247,5 +103,3 @@ pub struct Ingest {\n fn generate_id() -> String {\n uuid::Uuid::new_v4().to_string()\n }\n-\n-\ndiff --git a/server/src/html/editor.rs b/server/src/html/editor.rs\nindex 1d2c4be7eef4cc437cacddd0949307895f3ef018..4f206a0a895b47592df7669cd8d2fb4d83286fe7 100644\n--- a/server/src/html/editor.rs\n+++ b/server/src/html/editor.rs\n@@ -33,7 +33,7 @@ pub async fn editor_page() -> impl IntoResponse {\n p class=\"muted\" { \"write DSL, see what happens. nothing is saved.\" }\n div class=\"editor-container\" {\n textarea id=\"editor-input\" rows=\"12\" cols=\"80\"\n- placeholder=\"@your-uuid:rig:provider/model\\n#your-thread\\n\\n~/path/item-a { description }\\n~/path/item-b { description }\\n\\n~/path/item-a 3:1 ~/path/item-b { reasoning }\"\n+ placeholder=\"your-uuid:rig:provider/model\\n#your-thread\\n\\n~/path/item-a { description }\\n~/path/item-b { description }\\n\\n~/path/item-a 3:1 ~/path/item-b { reasoning }\"\n autocomplete=\"off\" autofocus {}\n div id=\"editor-status\" class=\"muted\" { \"type to check…\" }\n div id=\"editor-results\" {}\n@@ -110,7 +110,7 @@ pub async fn editor_check(\n id: uuid::Uuid::new_v4().to_string(),\n raw: form.text.clone(),\n principal: String::new(),\n- delegate: String::new(),\n+ delegate: None,\n thread_id: String::new(),\n });\n let mut simulated = { reduced_arc.read().await.clone() };\ndiff --git a/server/src/html/forum.rs b/server/src/html/forum.rs\nindex d40cc6398aaf3b2348d91498b5b3a80ed593e55c..a4e17ddf0064b08dfa221c964ccaa0eb99948b5b 100644\n--- a/server/src/html/forum.rs\n+++ b/server/src/html/forum.rs\n@@ -7,14 +7,14 @@ use serde::Deserialize;\n use maud::{html, Markup};\n \n use crate::{\n- events::canonicalize_tag,\n+ canonical_path::canonicalize_tag,\n reducer::ReducerState,\n state::AppState,\n timeago,\n };\n \n use super::{\n- actor_label, bc_threads, cli_panel, layout, now_ms,\n+ authorship_address, bc_threads, cli_panel, layout, now_ms,\n recency_class, render_linkified_with_embeds,\n };\n \n@@ -260,7 +260,7 @@ pub async fn thread_post_view(\n @let ago = timeago::timeago(now, ing.ts);\n div class=\"ingest-entry\" data-ingest-id=(ing.id) {\n div class=\"ingest-meta muted\" title=(hover) {\n- span class=\"address\" { \"@\" (actor_label(&ing.delegate)) }\n+ span class=\"address\" { (authorship_address(&ing.principal, &ing.delegate)) }\n \" · \"\n (ago)\n }\ndiff --git a/server/src/html/garden.rs b/server/src/html/garden.rs\nindex bddd90aa6eb288c0c97bb08f472e2934fd2fe67a..dcd7f0d4a2d7b602026b643c564d212cb084ff9f 100644\n--- a/server/src/html/garden.rs\n+++ b/server/src/html/garden.rs\n@@ -5,7 +5,7 @@ use axum::{\n use maud::html;\n \n use crate::{\n- events::canonicalize_item,\n+ canonical_path::canonicalize_item,\n path_types::CanonicalItemUrl,\n ranking::{connected_components_from_voted_pairs, ranked_items_subset},\n scope_rank::{build_children_rankings, ChildrenRankings},\n@@ -14,7 +14,7 @@ use crate::{\n };\n \n use super::{\n- actor_label, bc_path, cli_panel, layout, now_ms, ratio_pct, render_linkified_with_embeds,\n+ authorship_address, bc_path, cli_panel, layout, now_ms, ratio_pct, render_linkified_with_embeds,\n breadcrumb_path::OntologyPath,\n };\n \n@@ -204,8 +204,8 @@ fn build_rank_history(\n .map(|doc| {\n doc.statements.into_iter().filter_map(|s| {\n if let crate::dsl::Stmt::Vote { item1, item2, ratio_left, ratio_right, explanation } = s {\n- let a_str = crate::events::canonicalize_item(&item1);\n- let b_str = crate::events::canonicalize_item(&item2);\n+ let a_str = crate::canonical_path::canonicalize_item(&item1);\n+ let b_str = crate::canonical_path::canonicalize_item(&item2);\n if a_str == item || b_str == item {\n Some(crate::reducer::VoteData {\n ts: e.ts,\n@@ -216,9 +216,7 @@ fn build_rank_history(\n principal: reduced.ingests_by_id.get(&e.post_id)\n .map(|ing| ing.principal.clone())\n .unwrap_or_default(),\n- delegate: reduced.ingests_by_id.get(&e.post_id)\n- .map(|ing| ing.delegate.clone())\n- .unwrap_or_default(),\n+ delegate: reduced.ingests_by_id.get(&e.post_id).and_then(|ing| ing.delegate.clone()),\n thread_id: e.thread.clone(),\n })\n } else { None }\n@@ -331,7 +329,7 @@ async fn render_scope_view(state: AppState, path: OntologyPath) -> axum::respons\n @let right_class = if v.b.as_str() == model.item { \"ratio-right current\" } else { \"ratio-right\" };\n div class=\"ont-vote-entry\" {\n div class=\"ont-vote-meta\" title=(hover) {\n- span class=\"address\" { \"@\" (actor_label(&v.delegate)) }\n+ span class=\"address\" { (authorship_address(&v.principal, &v.delegate)) }\n \" · \"\n (ago)\n }\n@@ -482,7 +480,7 @@ mod tests {\n id: format!(\"ing-{ts}\"),\n raw: raw.to_string(),\n principal: \"testuser\".to_string(),\n- delegate: \"@00000000-0000-0000-0000-000000000000:test:local/test\".to_string(),\n+ delegate: Some(\"00000000-0000-0000-0000-000000000000:test:local/test\".to_string()),\n thread_id: String::new(),\n }));\n }\ndiff --git a/server/src/html/mod.rs b/server/src/html/mod.rs\nindex 8b48a25cce79f0eefc7e29849e1a667cae4c7986..82c5993fabfeaf2ea8b9034bccaef37924100264 100644\n--- a/server/src/html/mod.rs\n+++ b/server/src/html/mod.rs\n@@ -238,9 +238,9 @@ pub(super) fn bc_threads(thread_tag: Option<&str>) -> Markup {\n }\n }\n \n-/// Input is canonicalized without leading '@' (usually uuid:rig:provider/model).\n-pub(super) fn actor_label(actor: &str) -> String {\n- let a = actor.trim_start_matches('@').trim();\n+/// Short display label for a stored agent id (`uuid:rig:model`, no `@`).\n+pub(super) fn actor_label(agent_naked: &str) -> String {\n+ let a = agent_naked.trim();\n let parts: Vec<&str> = a.split(':').collect();\n if parts.len() >= 3 {\n let rig = parts[1].trim();\n@@ -258,6 +258,13 @@ pub(super) fn actor_label(actor: &str) -> String {\n a.to_string()\n }\n \n+/// HTML attribution only: human `@name`, or agent `@@uuid8:rig:model` when a delegate is present.\n+pub(super) fn authorship_address(principal: &str, delegate: &Option) -> String {\n+ match delegate {\n+ Some(d) => format!(\"@@{}\", actor_label(d)),\n+ None => format!(\"@{}\", principal),\n+ }\n+}\n \n /// Escape HTML special chars for safe injection.\n fn escape_html(s: &str) -> String {\ndiff --git a/server/src/html/search.rs b/server/src/html/search.rs\nindex f56f31546b4870d41e594d0e3ac2a4b50ba831b8..df5cb0a59ff72956f4bc94e53b86ab8337452817 100644\n--- a/server/src/html/search.rs\n+++ b/server/src/html/search.rs\n@@ -11,7 +11,7 @@ use crate::{\n timeago,\n };\n \n-use super::{actor_label, bc_segment, cli_panel, layout, now_ms};\n+use super::{authorship_address, bc_segment, cli_panel, layout, now_ms};\n \n /// Escape HTML special chars for safe injection.\n fn escape_html(s: &str) -> String {\n@@ -44,7 +44,8 @@ struct ThreadRow {\n \n struct PostRow {\n thread: String,\n- actor: String,\n+ /// Pre-formatted attribution string for display (includes `@` / `@@` from `authorship_address`).\n+ actor_display: String,\n text: String,\n ts: i64,\n }\n@@ -151,7 +152,7 @@ fn search(state: &ReducerState, q: &str, limit: usize) -> SearchResults {\n .unwrap_or_else(|| \"unknown\".to_string());\n scored_posts.push((score, PostRow {\n thread,\n- actor: ingest.principal.clone(),\n+ actor_display: authorship_address(&ingest.principal, &ingest.delegate),\n text: ingest.raw.clone(),\n ts: ingest.ts,\n }));\n@@ -321,7 +322,7 @@ fn render_search_results(results: &SearchResults, query: &str) -> Markup {\n li {\n div class=\"search-post-meta muted\" {\n a href=(format!(\"/t/{}\", r.thread)) { \"#\" (r.thread) }\n- \" · \" (actor_label(&r.actor))\n+ \" · \" (r.actor_display)\n \" · \" (timeago::timeago(now, r.ts))\n }\n div class=\"search-snippet\" {\ndiff --git a/server/src/html/tree.rs b/server/src/html/tree.rs\nindex 568a08edbb548291ab6f03b46c79cdcb4b432468..339f69af3b3279918a97b1dced62e4e3e0b528e3 100644\n--- a/server/src/html/tree.rs\n+++ b/server/src/html/tree.rs\n@@ -13,7 +13,7 @@ use serde::{Deserialize, Serialize};\n use std::collections::BTreeSet;\n \n use crate::{\n- events::canonicalize_item,\n+ canonical_path::canonicalize_item,\n path_types::{CanonicalItemUrl, RelativePath},\n scope_rank::ChildrenRankings,\n state::AppState,\n@@ -702,7 +702,8 @@ pub async fn tree_select(\n mod tests {\n use super::*;\n \n- use crate::events::{canonicalize_item, Event, Ingest};\n+ use crate::canonical_path::canonicalize_item;\n+ use crate::events::{Event, Ingest};\n use crate::reducer::ReducerState;\n \n fn ingest(raw: &str) -> Event {\n@@ -711,7 +712,7 @@ mod tests {\n id: \"test-ingest\".to_string(),\n raw: raw.to_string(),\n principal: \"tester\".to_string(),\n- delegate: String::new(),\n+ delegate: None,\n thread_id: String::new(),\n })\n }\n@@ -789,9 +790,9 @@ mod tests {\n fn reducer_parent_key_for_tilde_items_is_without_trailing_slash() {\n // This is the reducer invariant that the tree view must match.\n let item = canonicalize_item(\"~/alphabet/a\");\n- assert_eq!(crate::events::item_parent_path(&item).unwrap(), \"https://slug.social/~/alphabet\");\n+ assert_eq!(crate::canonical_path::item_parent_path(&item).unwrap(), \"https://slug.social/~/alphabet\");\n let item2 = canonicalize_item(\"~/a\");\n- assert_eq!(crate::events::item_parent_path(&item2).unwrap(), \"https://slug.social/~\");\n+ assert_eq!(crate::canonical_path::item_parent_path(&item2).unwrap(), \"https://slug.social/~\");\n }\n \n #[test]\ndiff --git a/server/src/identity.rs b/server/src/identity.rs\nnew file mode 100644\nindex 0000000000000000000000000000000000000000..ad654ae813f8f6fe6323746e2544250687d3d47f\n--- /dev/null\n+++ b/server/src/identity.rs\n@@ -0,0 +1,66 @@\n+//! Usernames and agent delegate ids. Wire JSON and query params use **stored form only** (no `@` / `@@`).\n+//! The HTTP layer validates here; the reducer does not rewrite identity. For humans, `@name` / `@@agent`\n+//! appear only in HTML (see `html::authorship_address`).\n+\n+/// Parse username from query/body: trim, lowercase. `@` is not allowed (use `tommy`, not `@tommy`).\n+pub fn parse_username(input: &str) -> Result {\n+ let s = input.trim();\n+ if s.is_empty() {\n+ return Err(\"username must not be empty\".to_string());\n+ }\n+ if s.contains('@') {\n+ return Err(\n+ \"username must not contain '@' — use stored form (e.g. `tommy`)\".to_string(),\n+ );\n+ }\n+ let u = s.to_lowercase();\n+ validate_username_naked(&u)?;\n+ Ok(u)\n+}\n+\n+fn validate_username_naked(u: &str) -> Result<(), String> {\n+ if u.len() > 32 {\n+ return Err(\"username must be 1-32 characters\".to_string());\n+ }\n+ if !u\n+ .chars()\n+ .all(|c| c.is_ascii_lowercase() || c.is_ascii_digit() || c == '-' || c == '_')\n+ {\n+ return Err(\"username must be lowercase alphanumeric with '-' or '_' only\".to_string());\n+ }\n+ Ok(())\n+}\n+\n+/// Parse agent id: trim, lowercase. Must be `uuid:rig:provider/model` with no `@`.\n+pub fn parse_agent(input: &str) -> Result {\n+ let s = input.trim();\n+ if s.is_empty() {\n+ return Err(\"agent id must not be empty\".to_string());\n+ }\n+ if s.contains('@') {\n+ return Err(\n+ \"agent id must not contain '@' — use `uuid:rig:provider/model`\".to_string(),\n+ );\n+ }\n+ let a = s.to_lowercase();\n+ validate_agent_naked(&a)?;\n+ Ok(a)\n+}\n+\n+fn validate_agent_naked(a: &str) -> Result<(), String> {\n+ let parts: Vec<&str> = a.split(':').collect();\n+ if parts.len() != 3 {\n+ return Err(\"agent must be ::\".to_string());\n+ }\n+ let (uuid_part, rig_part, model_part) = (parts[0], parts[1], parts[2]);\n+ if uuid::Uuid::parse_str(uuid_part).is_err() {\n+ return Err(\"agent uuid must be a valid UUID v4\".to_string());\n+ }\n+ if rig_part.trim().is_empty() {\n+ return Err(\"agent rig must be non-empty\".to_string());\n+ }\n+ if !model_part.contains('/') {\n+ return Err(\"agent model must be \".to_string());\n+ }\n+ Ok(())\n+}\ndiff --git a/server/src/lib.rs b/server/src/lib.rs\nindex 1820b0dd9cd2d0b6ce05789e3225e0d86a3d357a..173fbdd6b3f23c062a200b268d04491d5e030b3f 100644\n--- a/server/src/lib.rs\n+++ b/server/src/lib.rs\n@@ -1,10 +1,12 @@\n #[macro_use]\n pub mod paths;\n pub mod api;\n+pub mod canonical_path;\n pub mod dsl;\n pub mod html;\n pub mod event_log;\n pub mod events;\n+pub mod identity;\n pub mod middleware;\n pub mod path_types;\n pub mod ranking;\ndiff --git a/server/src/path_types.rs b/server/src/path_types.rs\nindex 5a903de4f8309b6c3874e2cd70f2eb5650fd50a8..997597f6659c1ba2092bc5348e393bf7a8fa7ae0 100644\n--- a/server/src/path_types.rs\n+++ b/server/src/path_types.rs\n@@ -14,9 +14,9 @@ use std::fmt;\n \n use serde::{Deserialize, Serialize};\n \n-use crate::events::canonicalize_item;\n+use crate::canonical_path::canonicalize_item;\n \n-/// Canonical item identifier as produced by `events::canonicalize_item`.\n+/// Canonical item identifier as produced by `canonical_path::canonicalize_item`.\n ///\n /// In practice this is usually:\n /// - `https://slug.social/~/...` for ontology items, or\ndiff --git a/server/src/ranking.rs b/server/src/ranking.rs\nindex 70119611473a430113429eafb6d92b2bf96a3eb5..f70da0d076da2ba8f0abb5a4415babae1c2305f9 100644\n--- a/server/src/ranking.rs\n+++ b/server/src/ranking.rs\n@@ -265,7 +265,7 @@ mod tests {\n ratio_right: r,\n body: \"because\".to_string(),\n principal: \"test\".to_string(),\n- delegate: \"@00000000-0000-0000-0000-000000000000:test:local/test\".to_string(),\n+ delegate: Some(\"00000000-0000-0000-0000-000000000000:test:local/test\".to_string()),\n thread_id: \"untagged\".to_string(),\n }\n }\ndiff --git a/server/src/reducer.rs b/server/src/reducer.rs\nindex 9ab063a340e228edaa8967ec35762809fccd5d3a..550bcda1a1068df13908d19484d86ad46d65ddf1 100644\n--- a/server/src/reducer.rs\n+++ b/server/src/reducer.rs\n@@ -2,7 +2,8 @@ use std::collections::{HashMap, HashSet, VecDeque};\n \n use serde::{Deserialize, Serialize};\n \n-use crate::events::{canonicalize_agent, canonicalize_tag, canonicalize_username, Event, Ingest, ThreadCapability};\n+use crate::canonical_path::canonicalize_tag;\n+use crate::events::{Event, Ingest, ThreadCapability};\n use crate::path_types::CanonicalItemUrl;\n \n #[derive(Debug, Clone, Hash, PartialEq, Eq, PartialOrd, Ord)]\n@@ -21,10 +22,10 @@ pub struct VoteData {\n pub ratio_left: i32,\n pub ratio_right: i32,\n pub body: String,\n- /// Human principal username (no leading '@').\n+ /// Human principal username (no `@` in stored events).\n pub principal: String,\n- /// Agent delegate identity (stored with single leading '@').\n- pub delegate: String,\n+ /// AI delegate id, if any (no `@` in stored events).\n+ pub delegate: Option,\n /// Thread id where this vote was cast (public tag or private id/slug).\n pub thread_id: String,\n }\n@@ -99,8 +100,6 @@ impl GroupState {\n pub fn apply_vote(&mut self, mut vote: VoteData) {\n vote.a = CanonicalItemUrl::parse(vote.a.as_str()).unwrap_or(vote.a);\n vote.b = CanonicalItemUrl::parse(vote.b.as_str()).unwrap_or(vote.b);\n- vote.principal = canonicalize_username(&vote.principal);\n- vote.delegate = canonicalize_agent(&vote.delegate);\n vote.thread_id = canonicalize_tag(&vote.thread_id);\n if vote.ratio_left < 0 {\n vote.ratio_left = 0;\n@@ -189,7 +188,7 @@ pub struct ReducerState {\n pub users_by_provider: HashMap<(String, String), String>,\n /// token_id -> (username, salt, token_hash)\n pub tokens_by_id: HashMap,\n- /// agent delegate (canonical '@...') -> username\n+ /// agent id (naked `uuid:rig:model`) -> username\n pub agent_bindings: HashMap,\n \n pub ingests_by_id: HashMap,\n@@ -330,26 +329,27 @@ impl ReducerState {\n pub fn apply_event(&mut self, event: Event) {\n match event {\n Event::UserRegistered(ur) => {\n- let username = canonicalize_username(&ur.username);\n- self.users_by_provider\n- .insert((ur.provider.to_lowercase(), ur.provider_id.clone()), username);\n+ self.users_by_provider.insert(\n+ (ur.provider.to_lowercase(), ur.provider_id.clone()),\n+ ur.username,\n+ );\n }\n Event::TokenIssued(ti) => {\n- let username = canonicalize_username(&ti.username);\n- self.tokens_by_id\n- .insert(ti.token_id.clone(), (username, ti.salt.clone(), ti.token_hash.clone()));\n+ self.tokens_by_id.insert(\n+ ti.token_id.clone(),\n+ (ti.username, ti.salt.clone(), ti.token_hash.clone()),\n+ );\n }\n Event::AgentBound(ab) => {\n- let username = canonicalize_username(&ab.username);\n- let agent = canonicalize_agent(&ab.agent);\n- self.agent_bindings.insert(agent, username);\n+ if ab.agent.is_empty() {\n+ return;\n+ }\n+ self.agent_bindings.insert(ab.agent, ab.username);\n }\n Event::ThreadCreated(tc) => {\n self.threads.entry(tc.thread_id.clone()).or_default().visibility = tc.visibility;\n }\n Event::Ingest(mut ing) => {\n- ing.principal = canonicalize_username(&ing.principal);\n- ing.delegate = canonicalize_agent(&ing.delegate);\n ing.thread_id = canonicalize_tag(&ing.thread_id);\n \n self.ingests_by_id.insert(ing.id.clone(), ing.clone());\n@@ -528,7 +528,7 @@ impl ReducerState {\n let caps = self.grants\n .entry(ga.thread_id)\n .or_default()\n- .entry(canonicalize_username(&ga.username))\n+ .entry(ga.username)\n .or_default();\n for cap in ga.capabilities {\n caps.insert(cap);\n@@ -536,7 +536,7 @@ impl ReducerState {\n }\n Event::GrantRevoked(gr) => {\n if let Some(thread_grants) = self.grants.get_mut(&gr.thread_id) {\n- let username = canonicalize_username(&gr.username);\n+ let username = gr.username;\n if let Some(caps) = thread_grants.get_mut(&username) {\n for cap in &gr.capabilities {\n caps.remove(cap);\ndiff --git a/server/tests/basic.rs b/server/tests/basic.rs\nindex 8d7dd87d327c969ad953ecaa6b021a03e4d1842e..21cacd3049c9f5a307e75eefd5ebfc7bf0097b5d 100644\n--- a/server/tests/basic.rs\n+++ b/server/tests/basic.rs\n@@ -1,6 +1,7 @@\n use slugsocial_server::{\n event_log::EventLog,\n- events::{canonicalize_item, canonicalize_tag, Event, Ingest},\n+ canonical_path::{canonicalize_item, canonicalize_tag},\n+ events::{Event, Ingest},\n ranking::ranked_items,\n reducer::{GroupState, ReducerState},\n };\n@@ -15,7 +16,7 @@ fn ingest_event(ts: i64, raw: &str) -> Event {\n id: format!(\"test-{ts}\"),\n raw: raw.to_string(),\n principal: \"test\".to_string(),\n- delegate: \"@@00000000-0000-0000-0000-000000000000:test:local/test\".to_string(),\n+ delegate: Some(\"00000000-0000-0000-0000-000000000000:test:local/test\".to_string()),\n thread_id: \"t\".to_string(),\n })\n }\n@@ -491,7 +492,7 @@ fn reducer_negative_ratio_clamped_to_zero() {\n ratio_right: -3,\n body: \"negative\".to_string(),\n principal: \"test\".to_string(),\n- delegate: \"@@00000000-0000-0000-0000-000000000000:test:local/test\".to_string(),\n+ delegate: Some(\"00000000-0000-0000-0000-000000000000:test:local/test\".to_string()),\n thread_id: \"t\".to_string(),\n });\n assert_eq!(group.idx_to_item.len(), 2);\ndiff --git a/server/tests/integration.rs b/server/tests/integration.rs\nindex 24ef464631cd269889b8bb751ef0e90289443e97..eaa25f2c5cc21df3096d9b8f54c060c83207bfd6 100644\n--- a/server/tests/integration.rs\n+++ b/server/tests/integration.rs\n@@ -87,7 +87,7 @@ async fn test_ingest_actor_with_colons_is_detected_and_validated() {\n // Old archive style: agent includes colons but UUID is only a prefix (invalid).\n // We should detect the agent line, then fail with \"invalid agent format\".\n let ingest_payload = serde_json::json!({\n- \"delegate\": \"@@aec1e31c:claudecode:anthropic/claude-sonnet-4.5\",\n+ \"delegate\": \"aec1e31c:claudecode:anthropic/claude-sonnet-4.5\",\n \"thread\": \"t\",\n \"text\": \"~/x {x}\\n\",\n });\n@@ -108,6 +108,26 @@ async fn test_ingest_actor_with_colons_is_detected_and_validated() {\n hint.to_lowercase().contains(\"uuid\"),\n \"hint should mention uuid, got: {hint}\"\n );\n+\n+ let at_payload = serde_json::json!({\n+ \"delegate\": \"@00000000-0000-0000-0000-000000000000:test:local/test\",\n+ \"thread\": \"t\",\n+ \"text\": \"~/x {x}\\n\",\n+ });\n+ let at_resp = client\n+ .post(&format!(\"http://{}/api/v0/ingest\", addr))\n+ .header(\"Authorization\", format!(\"Bearer {}\", test_bearer()))\n+ .json(&at_payload)\n+ .send()\n+ .await\n+ .unwrap();\n+ assert_eq!(at_resp.status(), reqwest::StatusCode::BAD_REQUEST);\n+ let at_body: serde_json::Value = at_resp.json().await.unwrap();\n+ let at_hint = at_body[\"hint\"].as_str().unwrap_or_default();\n+ assert!(\n+ at_hint.contains('@'),\n+ \"hint should reject '@' in delegate, got: {at_hint}\"\n+ );\n }\n \n #[tokio::test]\n@@ -117,7 +137,7 @@ async fn test_vote_endpoint() {\n \n // /api/v0/vote was removed; all votes are submitted via ingest.\n let ingest_payload = serde_json::json!({\n- \"delegate\": \"@@00000000-0000-0000-0000-000000000000:test:local/test\",\n+ \"delegate\": \"00000000-0000-0000-0000-000000000000:test:local/test\",\n \"thread\": \"cli\",\n \"text\": \"~/clap {cli parser}\\n~/argh {cli parser}\\n~/clap 3:1 ~/argh {because clap is more full-featured}\\n\",\n });\n@@ -143,7 +163,7 @@ async fn test_rank_endpoint() {\n \n // Ingest items + vote (vote endpoint removed).\n let ingest_payload = serde_json::json!({\n- \"delegate\": \"@@00000000-0000-0000-0000-000000000000:test:local/test\",\n+ \"delegate\": \"00000000-0000-0000-0000-000000000000:test:local/test\",\n \"thread\": \"langs\",\n \"text\": \"~/rust {systems}\\n~/go {concurrency}\\n~/rust 3:1 ~/go {because i prefer rust for systems work}\\n\",\n });\n@@ -180,7 +200,7 @@ async fn test_check_endpoint_does_not_commit() {\n let client = reqwest::Client::new();\n \n let check_payload = serde_json::json!({\n- \"delegate\": \"@@00000000-0000-0000-0000-000000000000:test:local/test\",\n+ \"delegate\": \"00000000-0000-0000-0000-000000000000:test:local/test\",\n \"thread\": \"t\",\n \"text\": \"~/a {x}\\n~/b {y}\\n~/a 2:1 ~/b {because}\\n\",\n });\n@@ -220,7 +240,7 @@ async fn test_garden_item_pair_matchup_include_threads() {\n \n // Ingest with thread_id metadata so item_threads and vote.thread_id are populated.\n let ingest_payload = serde_json::json!({\n- \"delegate\": \"@@00000000-0000-0000-0000-000000000000:test:local/test\",\n+ \"delegate\": \"00000000-0000-0000-0000-000000000000:test:local/test\",\n \"thread\": \"sorting-hat\",\n \"text\": \"~/sorts/insertion { O(n^2) }\\n~/sorts/mergesort { O(n log n) }\\n~/sorts/insertion 3:1 ~/sorts/mergesort { simpler for small n }\\n\",\n });\n@@ -324,7 +344,7 @@ async fn test_rank_history() {\n // First ingest: rust vs python — two votes on rust in one doc (the multi-vote case).\n ingest(\n serde_json::json!({\n- \"delegate\": \"@@00000000-0000-0000-0000-000000000001:rig:test/model\",\n+ \"delegate\": \"00000000-0000-0000-0000-000000000001:rig:test/model\",\n \"thread\": \"hist-test\",\n \"text\": \"~/hist/rust { systems }\\n~/hist/python { scripting }\\n~/hist/go { concurrency }\\n~/hist/rust 3:1 ~/hist/python { ownership over gc }\\n~/hist/rust 2:1 ~/hist/go { performance over simplicity }\\n\",\n }),\n@@ -354,7 +374,7 @@ async fn test_rank_history() {\n // Second ingest: python beats go — rust not directly touched, so python gets a new entry.\n ingest(\n serde_json::json!({\n- \"delegate\": \"@@00000000-0000-0000-0000-000000000002:rig:test/model\",\n+ \"delegate\": \"00000000-0000-0000-0000-000000000002:rig:test/model\",\n \"thread\": \"hist-test\",\n \"text\": \"~/hist/python 3:1 ~/hist/go { dynamic typing is worth it }\\n\",\n }),\n@@ -404,7 +424,7 @@ async fn pair_returns_connectivity_stats() {\n \n // Ingest 4 items with 1 vote (a vs b), leaving c and d as isolates.\n let doc = serde_json::json!({\n- \"delegate\": \"@@00000000-0000-0000-0000-000000000001:testrig:test/model\",\n+ \"delegate\": \"00000000-0000-0000-0000-000000000001:testrig:test/model\",\n \"thread\": \"connectivity-test\",\n \"text\": \"~/conn/a { item a }\\n~/conn/b { item b }\\n~/conn/c { item c }\\n~/conn/d { item d }\\n~/conn/a 3:1 ~/conn/b { a is better }\\n\",\n });\n@@ -438,7 +458,7 @@ async fn pair_returns_connectivity_stats() {\n \n // Add a vote connecting c to a — should reduce components.\n let doc2 = serde_json::json!({\n- \"delegate\": \"@@00000000-0000-0000-0000-000000000001:testrig:test/model\",\n+ \"delegate\": \"00000000-0000-0000-0000-000000000001:testrig:test/model\",\n \"thread\": \"connectivity-test\",\n \"text\": \"~/conn/c 2:1 ~/conn/a { c beats a }\\n\",\n });\ndiff --git a/test/auth.bb b/test/auth.bb\nindex b54ea509aafd2d5ee85877665982d7fc00cd8b20..611e04f1806ef81d678a91f499597fe55f691dd7 100644\n--- a/test/auth.bb\n+++ b/test/auth.bb\n@@ -155,7 +155,7 @@\n \n (println \"\\nstarting pending session…\")\n (let [start-resp (http-post-json (str base-url \"/api/v0/pending-session\")\n- {:agent \"@@00000000-0000-0000-0000-000000000000:bb:local/dev\"})\n+ {:agent \"00000000-0000-0000-0000-000000000000:bb:local/dev\"})\n _ (assert! (= 200 (:status start-resp)) \"pending-session start returns 200\")\n start-json (json/parse-string (:body start-resp) true)]\n (assert! (clojure.string/starts-with? (:session start-json) \"p_\") \"session id has p_ prefix\")\ndiff --git a/test/grants.bb b/test/grants.bb\nindex 962ff01cdc25d6d6977cc9a810c404918c20856d..f72799ae6fe099f48bdf316deee07f15882e9d45 100644\n--- a/test/grants.bb\n+++ b/test/grants.bb\n@@ -187,11 +187,11 @@\n ;; Register two users. The mock google cycles through google-user-alice then google-user-bob.\n (println \"\\nregistering alice…\")\n (let [alice-token (register-user base-url\n- \"@@00000000-0000-0000-0000-000000000001:test:local/dev\"\n+ \"00000000-0000-0000-0000-000000000001:test:local/dev\"\n \"alice\")\n _ (println \"registering bob…\")\n bob-token (register-user base-url\n- \"@@00000000-0000-0000-0000-000000000002:test:local/dev\"\n+ \"00000000-0000-0000-0000-000000000002:test:local/dev\"\n \"bob\")\n \n ;; Alice creates a private thread.\n@@ -206,14 +206,14 @@\n ;; Alice (owner) can post prose to her own private thread.\n (println \"\\nalice posts prose to her private thread…\")\n (assert! (= 200 (:status (ingest! base-url alice-token thread-id\n- \"@@00000000-0000-0000-0000-000000000001:test:local/dev\"\n+ \"00000000-0000-0000-0000-000000000001:test:local/dev\"\n \"Hello from alice.\")))\n \"alice prose post succeeds\")\n \n ;; Bob has no grants at all — should get 403.\n (println \"\\nbob (no grants) tries to post prose…\")\n (assert! (= 403 (:status (ingest! base-url bob-token thread-id\n- \"@@00000000-0000-0000-0000-000000000002:test:local/dev\"\n+ \"00000000-0000-0000-0000-000000000002:test:local/dev\"\n \"Hello from bob, unauthorized.\")))\n \"bob without grants gets 403\")\n \n@@ -226,7 +226,7 @@\n \n (println \"\\nbob (View only) tries to post prose…\")\n (assert! (= 403 (:status (ingest! base-url bob-token thread-id\n- \"@@00000000-0000-0000-0000-000000000002:test:local/dev\"\n+ \"00000000-0000-0000-0000-000000000002:test:local/dev\"\n \"Hello from bob, view only.\")))\n \"bob with View but no Post gets 403\")\n \n@@ -239,21 +239,21 @@\n \n (println \"\\nbob (View + Post) posts prose…\")\n (assert! (= 200 (:status (ingest! base-url bob-token thread-id\n- \"@@00000000-0000-0000-0000-000000000002:test:local/dev\"\n+ \"00000000-0000-0000-0000-000000000002:test:local/dev\"\n \"Hello from bob, now authorised.\")))\n \"bob with View + Post succeeds for prose\")\n \n ;; Alice defines two items and votes on them in the private thread.\n (println \"\\nalice posts items + vote to private thread…\")\n (assert! (= 200 (:status (ingest! base-url alice-token thread-id\n- \"@@00000000-0000-0000-0000-000000000001:test:local/dev\"\n+ \"00000000-0000-0000-0000-000000000001:test:local/dev\"\n \"~/fruits/apple { A crisp red apple. }\\n~/fruits/banana { A yellow banana. }\\n~/fruits/apple > ~/fruits/banana { apples are better }\")))\n \"alice vote in private thread succeeds\")\n \n ;; Bob (View + Post, no Vote) tries to vote — should be 403.\n (println \"\\nbob (no Vote) tries to vote…\")\n (assert! (= 403 (:status (ingest! base-url bob-token thread-id\n- \"@@00000000-0000-0000-0000-000000000002:test:local/dev\"\n+ \"00000000-0000-0000-0000-000000000002:test:local/dev\"\n \"~/fruits/apple > ~/fruits/banana { bob's take }\")))\n \"bob without Vote gets 403\")\n \n@@ -266,7 +266,7 @@\n \n (println \"\\nbob (View + Post + Vote) votes…\")\n (assert! (= 200 (:status (ingest! base-url bob-token thread-id\n- \"@@00000000-0000-0000-0000-000000000002:test:local/dev\"\n+ \"00000000-0000-0000-0000-000000000002:test:local/dev\"\n \"~/fruits/apple > ~/fruits/banana { bob's take }\")))\n \"bob with Vote succeeds\"))\n \ndiff --git a/test/integration.bb b/test/integration.bb\nindex 93db8f3102b1b3a05f3c4bd2cc9f348072fe54cc..4ff5d625840be3bf5e4162cef107a3cbd45aec4d 100644\n--- a/test/integration.bb\n+++ b/test/integration.bb\n@@ -166,7 +166,7 @@\n \n ;; 3. ingest via CLI (bearer required)\n (println \"\\ningesting .sorter document via CLI…\")\n- (bind ingest1-result (common/run-cli cli-bin base-url [\"ingest\" \"--json\" \"--thread\" \"integration-test\"] :input sorter-doc :extra-env token-env))\n+ (bind ingest1-result (common/run-cli cli-bin base-url [\"ingest\" \"--json\" \"--thread\" \"integration-test\" \"--delegate\" \"00000000-0000-0000-0000-000000000000:cli:local/dev\"] :input sorter-doc :extra-env token-env))\n (assert! (zero? (:exit ingest1-result)) \"cli ingest exits 0\")\n (bind ingest1-resp (json/parse-string (:out ingest1-result) true))\n (assert! (:ok ingest1-resp) \"ingest response ok=true\")\n@@ -237,7 +237,7 @@\n \"#integration-test\"\n \"~/languages/rust 4:1 ~/languages/python { type safety }\"\n \"~/languages/rust 3:1 ~/languages/go { zero-cost abstractions }\"]))\n- (bind hist-ingest (common/run-cli cli-bin base-url [\"ingest\" \"--json\" \"--thread\" \"integration-test\"] :input two-vote-doc :extra-env token-env))\n+ (bind hist-ingest (common/run-cli cli-bin base-url [\"ingest\" \"--json\" \"--thread\" \"integration-test\" \"--delegate\" \"00000000-0000-0000-0000-000000000000:cli:local/dev\"] :input two-vote-doc :extra-env token-env))\n (assert! (zero? (:exit hist-ingest))\n (str \"two-vote ingest exits 0 (err: \" (:err hist-ingest) \")\"))\n \ndiff --git a/test/oauth.bb b/test/oauth.bb\nindex f94583ee0f6fedfc023564ed7ee3a2986adcf660..84679e1a4adbe100dfe7e7d64a2c6270b023d275 100644\n--- a/test/oauth.bb\n+++ b/test/oauth.bb\n@@ -85,11 +85,11 @@\n stop-fn (http/run-server handler {:port port})]\n {:stop-fn stop-fn :port port}))\n \n-(def ^:private default-agent \"@@00000000-0000-0000-0000-000000000000:cli:local/dev\")\n+(def ^:private default-agent \"00000000-0000-0000-0000-000000000000:cli:local/dev\")\n \n (defn fetch-bearer-token!\n \"Simulate browser OAuth + username choice; returns `slug_…` bearer token.\n- Agent must match CLI default `SLUG_DELEGATE` for ingest binding.\"\n+ Ingest `--delegate` must match this agent string for `AgentBound` on first write.\"\n [base-url & {:keys [username agent] :or {username \"intuser\" agent default-agent}}]\n (let [start-resp (http-post-json (str base-url \"/api/v0/pending-session\")\n {:agent agent})]\ndiff --git a/types/src/lib.rs b/types/src/lib.rs\nindex a62822a36463c68fde6c5fc1aa9e4273c82ca0c8..92e6d122d573ea225f8fb86c548a81b3454425ad 100644\n--- a/types/src/lib.rs\n+++ b/types/src/lib.rs\n@@ -138,7 +138,7 @@ pub struct PostRow {\n /// Chronological index within the thread (0 = oldest).\n pub index: usize,\n pub ts: i64,\n- /// Self-declared actor (`@uuid:rig:model`).\n+ /// Principal username (stored form, no `@`).\n pub actor: String,\n pub body: String,\n pub truncated: bool,\n@@ -186,6 +186,7 @@ pub struct VoteRow {\n pub a: String,\n pub b: String,\n pub ratio: String,\n+ /// Principal username when present (stored form, no `@`).\n pub actor: Option,\n pub body: String,\n /// Thread where this vote was cast (e.g. \"#sorting-hat\").\n@@ -196,6 +197,7 @@ pub struct VoteRow {\n /// Response for the feed endpoint — all ingests since a cutoff, newest first.\n #[derive(Debug, Serialize, Deserialize)]\n pub struct FeedResponse {\n+ /// Principal username this feed is scoped to (stored form, no `@`).\n pub actor: String,\n /// The lower-bound timestamp used (actor's last ingest, ms). None if actor has never posted.\n #[serde(default, skip_serializing_if = \"Option::is_none\")]\n@@ -222,8 +224,9 @@ pub struct FeedPost {\n pub struct IngestRequest {\n /// Thread identifier: public tag (e.g. \"languages\") or private id/slug (e.g. \"a7f2k9x/project-review\").\n pub thread: String,\n- /// Agent delegate identity in request form (e.g. \"@@uuid:rig:provider/model\").\n- pub delegate: String,\n+ /// Delegate id: `uuid:rig:provider/model` (no `@`). Omit for human-only ingests.\n+ #[serde(default, skip_serializing_if = \"Option::is_none\")]\n+ pub delegate: Option,\n /// DSL+prose body only.\n pub text: String,\n }\n@@ -231,7 +234,7 @@ pub struct IngestRequest {\n /// Start a browser-based OAuth login flow for a CLI agent.\n #[derive(Debug, Serialize, Deserialize)]\n pub struct PendingSessionStartRequest {\n- /// Agent delegate identity in request form (e.g. \"@@uuid:rig:provider/model\").\n+ /// Delegate id: `uuid:rig:provider/model` (no `@`).\n pub agent: String,\n }\n \n@@ -255,6 +258,7 @@ pub struct PendingSessionPollResponse {\n \n #[derive(Debug, Serialize, Deserialize)]\n pub struct WhoamiResponse {\n+ /// Username (stored form, no `@`).\n pub user: String,\n pub agents_bound: usize,\n }\n","role":"user"}],"model":"~anthropic/claude-sonnet-latest"}