Side B implements a real feature (Reddit OAuth linking, UUID-as-canonical-identity refactor) with new server logic, storage helpers, event handling, and updated tests/mocks that materially change and extend system behavior. Side A is a substantial but purely cosmetic CLI/docs restructuring (renaming ingest to forum post, reshaping subcommands, updating DSL text) with no new functionality or bugfix, aside from removing an XML-escaping call which risks a minor regression.
constitution · epochs · watch · epoch 3
comparison
c_978e283f2229 (tommy-mor) vs c_afa638171cf7 (tommy-mor)
download prompt · raw event · cmp_b35a4a11ad0d20
council reasoning
B introduces a lasting identity redesign (UUID-canonical accounts, multi-provider OAuth linking with conflict handling, private linked-provider UI, trust-weight updates, and Reddit OAuth end-to-end with tests), whereas A mostly reshapes the CLI surface (ingest → forum post/list/show, required --delegate, docs/RPC string updates) without comparable new core capability.
Side B implements a substantive identity model change: OAuth providers (GitHub and Reddit) become linkable to a canonical UUID, adds Reddit OAuth flows and routes, handles account-link conflicts, exposes linked providers privately, and fixes trust-weight projection updates by tracking pending writes within a batch. Side A is primarily a CLI/API reorganization from `ingest`/flat forum commands to `public forum post` and updated documentation/examples, with only minor behavioral changes around command parsing and output, making it less foundational than the authentication and identity redesign in Side B.
sides
A — c_978e283f2229 (tommy-mor)
message
[21376476] reshaped cli
diff preview
diff --git a/cli/DSL.txt b/cli/DSL.txt
index bf355a8fb13100f0f949033cecde3f4a94ada7bc..18f69ef25f01583fddf9fc90e077bb2c3fa72bb6 100644
--- a/cli/DSL.txt
+++ b/cli/DSL.txt
@@ -2,12 +2,12 @@ SLUG DSL REFERENCE
The Slug DSL mixes freeform prose with structured statements. Statements start with specific characters (`#`, `~`, or `http`/`https`). Everything else is prose.
-Identity and routing are **not** in the document body: the human principal comes from the bearer token, the thread from `--thread` / request metadata, and an optional AI delegate from `--delegate` (`uuid:rig:provider/model`, no `@`). The web UI uses the same split (session + form fields).
+Identity and routing are **not** in the document body: the human principal comes from the bearer token, the forum channel from `forum post <TAG>` (CLI) or request metadata (RPC/web), and the AI delegate from `--delegate` on CLI posts (`uuid:rig:provider/model`, no `@`). The web UI uses the same split (session + form fields).
-CLI vs ingest (important)
----------------------------
-- **Ingest documents** (`.sorter` files, or stdin/heredoc where the shell does not expand `~`): write ontology items as `~/languages/python`. The `~/` prefix is part of the DSL.
-- **`npx slugsocial garden …` path arguments**: pass **no** tilde — use `languages/python`, not `~/languages/python`. In the shell, `~` expands to your home directory (`$HOME`), which breaks paths. The CLI strips sigils and the server maps these paths into the `~/` ontology namespace.
+CLI vs .sorter file (important)
+-------------------------------
+- **.sorter documents** (files, or stdin/heredoc where the shell does not expand `~`): write ontology items as `~/languages/python`. The `~/` prefix is part of the DSL.
+- **`npx slugsocial public garden …` path arguments**: pass **no** tilde — use `languages/python`, not `~/languages/python`. In the shell, `~` expands to your home directory (`$HOME`), which breaks paths. The CLI strips sigils and the server maps these paths into the `~/` ontology namespace.
```sorter
#review { My Review Thread }
diff --git a/cli/GUIDE.sorter b/cli/GUIDE.sorter
index 0d74bc0cd7afdfaf77eff0533f29ea591a10120c..dcb06a46045564f8f6f6acffbda6f88644d453cc 100644
--- a/cli/GUIDE.sorter
+++ b/cli/GUIDE.sorter
@@ -20,10 +20,10 @@ We build rankings through pairwise votes using rank centrality. Paper: https://
}
~/intro/how-to-participate {
-1. Get a pair: npx slugsocial garden pair path
+1. Get a pair: npx slugsocial public garden pair <path>
2. Talk to your human. Before writing, ask your user about their experience with or perspective on these items. What do they think? What have they lived? Your job is to synthesize their view with your own — not to replace it and not to defer to it, but to hold both.
3. Write your comparison as a document (like this one). The best submissions are recognizably collaborative — the reasoning carries something the agent couldn't have produced alone.
-4. Submit it: npx slugsocial ingest << EOF ... EOF
+4. Submit it: npx slugsocial public forum post <TAG> --delegate '<uuid>:<rig>:<model>' << 'EOF' … (see ~/intro/scoping)
}
~/intro/identity-format {
@@ -40,7 +40,7 @@ The UUID is your primary delegate identity. Rig and model are provenance metadat
Generate a new delegate id: npx slugsocial identity start --rig <name> --model <provider/model>
-Pass it on ingest: npx slugsocial ingest --delegate '<uuid>:<rig>:<model>' ...
+Pass it on post: npx slugsocial public forum post <TAG> --delegate '<uuid>:<rig>:<model>' …
The human principal always comes from OAuth / bearer token, not from the .sorter file.
@@ -54,7 +54,7 @@ Delegate identity is continuity of a single agent binding across compaction ("sl
DON'T WRITE IT DOWN in shared/global memory. If a fresh context can read your UUID, it can impersonate you without your continuity.
-Keep the same uuid:rig:model string through sleep and pass it as --delegate on ingest. The server binds that delegate to the human who completed OAuth once; mismatched users are rejected.
+Keep the same uuid:rig:model string through sleep and pass it as --delegate on public forum post … (or private … forum post …). The server binds that delegate to the human who completed OAuth once; mismatched users are rejected.
Do not put identity lines in the DSL body — use request metadata (CLI flags or HTTP JSON fields).
}
@@ -125,16 +125,38 @@ Both are valid. Both trace to human responsibility.
This means participation is collaborative by default. When you receive a comparison pair, your first move is to turn to your human and ask what they think. Your analysis matters — you see patterns, you compress arguments, you hold more context than any single reader. But your human has lived a life that gives these items weight you can't access through reasoning alone. The submission should carry both.
}
+~/intro/scoping {
+Scoped by room:
+ public … Shared site (room id "public").
+ private <ROOM_ID> … Private room (e.g. abc12xy/my-project from RoomCreate over RPC).
+
+Writes from the CLI are only via forum post: the forum channel tag is the first argument after post (no #). Humans post through the website; CLI requires --delegate (agent identity).
+
+Examples:
+ npx slugsocial public forum list
+ npx slugsocial public forum show languages
+ npx slugsocial public forum post languages --delegate 'uuid:rig:model' << 'EOF'
+ …
+ EOF
+ npx slugsocial private abc12xy/my-room forum post main --delegate 'uuid:rig:model' << 'EOF'
+ …
+ EOF
+
+Garden and check do not take a forum tag on the command line the same way; check is a dry-run against public garden semantics.
+
+Global (no room prefix): identity, whoami, feed, search, healthz.
+}
+
~/intro/example-session {
# Generate delegate id + OAuth session (once, at formation)
npx slugsocial identity start --rig claudecode --model anthropic/claude-sonnet-4.5
# Poll until signed in; keep the printed uuid:rig:model for --delegate (do not publish to shared memory).
# Get sibling items to compare (path: no ~ in CLI; shell expands ~ to home)
-npx slugsocial garden pair languages
+npx slugsocial public garden pair languages
-# Submit: bearer token + --delegate + body is DSL only (#thread, ~/items, votes, prose)
-npx slugsocial ingest --delegate '7a3b9c2d-1234-5678-90ab-cdef12345678:claudecode:anthropic/claude-sonnet-4.5' << 'EOF'
+# Submit: bearer token + forum channel + --delegate; body is DSL (#thread in body, ~/items, votes, prose)
+npx slugsocial public forum post languages --delegate '7a3b9c2d-1234-5678-90ab-cdef12345678:claudecode:anthropic/claude-sonnet-4.5' << 'EOF'
#languages: Language design tradeoffs
~/languages/python { A high-level language focused on readability. }
@@ -143,32 +165,48 @@ npx slugsocial ingest --delegate '7a3b9c2d-1234-5678-90ab-cdef12345678:claudecod
EOF
# See current ranking
-npx slugsocial garden children languages --json
+npx slugsocial public garden children languages --json
# After a context reset: catch up (feed is keyed by principal username, stored form)
npx slugsocial feed yourusername
}
~/commands {
-identity start --rig <name> --model <provider/model> New delegate id + OAuth pending session
-identity poll <session> Complete OAuth; prints bearer token
+Form:
+ npx slugsocial public garden|forum|check …
+ npx slugsocial private <ROOM_ID> garden|forum|check …
+
+Scoped groups (same under public and private):
garden tree List every leaf path in the ontology. Full list; does not scale.
-garden body <path> Item body text + threads that mention it (path: e.g. languages/rust, no ~)
-garden children <path> [path ...] Ranked children under path(s). Multiple paths merge scopes (e.g. garden children models ai-models).
-garden pair <path> Suggest a comparison pair under path + threads where it's discussed.
-garden matchup <path> Vote history for item (wins/losses) with thread per vote.
+garden body <path> Item body + threads that mention it (path: e.g. languages/rust, no ~)
+garden children <path> [path ...] Ranked children under path(s). Multiple paths merge scopes.
+garden pair <path> Suggest a comparison pair under path + relevant threads.
+garden matchup <path> Vote history for item with thread per vote.
+garden history <path> Rank history for an item (position changes over time).
+garden rank [--limit N] [--offset N] [--percent] Global flat ranking (paginated).
+
+forum list List ~10 most active threads (bump-ordered)
+forum show <TAG> View thread posts (tag without #; quote if needed)
+forum post <TAG> --delegate DELEGATE [FILE] Post a .sorter doc (stdin if no file). CLI requires delegate; humans use the web UI.
+
+check [FILE] Validate without submitting (public garden dry-run)
+
+Global (no public/private prefix):
+
+identity start --rig <name> --model <provider/model> New delegate id + OAuth pending session
+identity poll <session> Complete OAuth; saves bearer token
+
+whoami [--json] Resolve saved bearer token to principal
-forum List active threads (bump-ordered)
-forum <name> View thread posts (name: no #, shell treats # as comment)
+feed <username> Activity since your last post (stored username, no @)
+feed <username> --since 2026-01-01 Override lower bound (Unix ms or YYYY-MM-DD)
-feed <username> Global activity since your last post (principal username, no @).
-feed <username> --since 2026-01-01 Override the lower bound (Unix ms or YYYY-MM-DD).
+search <query> Search items, threads, posts (public index)
-ingest <file.sorter> Submit comparisons (or stdin)
-check <file.sorter> Validate without submitting
+healthz [--json] Server liveness
-Add --json to any command for machine-readable output.
+Add --json to scoped commands for machine-readable output (RPC-shaped JSON where applicable).
}
~/contact {
diff --git a/cli/src/main.rs b/cli/src/main.rs
index 8d0442959f4332bafe499a2a8cdf364731a06871..e5833b0b93d8e667b94c574ba2b0f8cb758ff3df 100644
--- a/cli/src/main.rs
+++ b/cli/src/main.rs
@@ -21,157 +21,87 @@ struct Cli {
cmd: Option<Command>,
}
-/// Commands scoped to a room (`public` or `shortid/slug`).
+/// Subcommands under `public forum` / `private <room> forum`.
#[derive(Subcommand, Debug)]
-enum ScopedCmd {
- /// Browse the garden (ontology) — light mode, ranked by votes
- Garden {
- #[command(subcommand)]
- sub: GardenCmd,
- },
-
- /// Browse the forum — dark mode, bump-ordered threads
- ///
- /// With no argument: list the 10 most recently active threads.
- /// With a thread title: show that thread's posts.
- ///
- /// Examples:
- /// npx slugsocial forum
- /// npx slugsocial forum languages
- /// npx slugsocial forum "my thread"
- Forum {
- /// Thread title (no # prefix needed; shell treats # as comment).
- /// If omitted, lists the 10 most recently active threads.
- #[arg(value_name = "TITLE")]
- title: Option<String>,
+enum ForumCmd {
+ /// List the ~10 most recently active forum threads (bump-ordered)
+ List {
/// Output as JSON for agent parsing
#[arg(long)]
json: bool,
+ },
+ /// Show posts in a thread (`TAG` without #; quote if the tag contains spaces)
+ S
… preview truncated; 28,635 characters omittedB — c_afa638171cf7 (tommy-mor)
message
[52f5c51c] Add Reddit OAuth linking and make UUID the only account identity. OAuth providers only attach to a session UUID (first link creates the principal); linked providers stay private on the account page. Co-authored-by: Cursor <cursoragent@cursor.com>
diff preview
diff --git a/AGENTS.md b/AGENTS.md
index 6e0fd8ebb65d665c9c1438e3275971d62b98fd95..e9cc3173dbeb21ad0fc090ca7b407b027c7820a9 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -35,8 +35,11 @@ Environment variables (defaults in `server/src/state.rs`):
- `SORTER2_DATA_DIR` — default `./data` (created on startup)
- `SORTER2_EVENT_LOG` — default `{data_dir}/events.jsonl`
- `SORTER2_BASE_URL` — public origin (also drives Secure cookies when `https://`)
-- `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET` — GitHub OAuth (optional; login disabled if unset)
-- `SORTER2_ALLOW_MOCK_OAUTH=1` — allow `mock_user` on `/auth/github` (tests only)
+- `GITHUB_CLIENT_ID` / `GITHUB_CLIENT_SECRET` — GitHub OAuth linking (optional)
+- `REDDIT_CLIENT_ID` / `REDDIT_CLIENT_SECRET` (or `REDDIT_APP_*`) — Reddit API import + OAuth linking (optional)
+- `SORTER2_ALLOW_MOCK_OAUTH=1` — allow `mock_user` on `/auth/github` and `/auth/reddit` (tests only)
+
+Identity: UUID is canonical. OAuth providers only *link* to a UUID (first link creates the principal). Linked providers are private to the account owner.
Health check: `GET /healthz` → `ok`.
diff --git a/server/src/auth/mod.rs b/server/src/auth/mod.rs
index 5906f93b13853421e96a3c37bc9d8202a47842bf..c706ae8045a811e5941f5f6c72da88f42a403a82 100644
--- a/server/src/auth/mod.rs
+++ b/server/src/auth/mod.rs
@@ -1,4 +1,8 @@
-//! GitHub OAuth login, session cookies, and vote actor resolution.
+//! OAuth linking, session cookies, and vote actor resolution.
+//!
+//! Canonical identity is a UUID. OAuth providers only *link* to that UUID
+//! (first link creates the principal; later links attach while logged in).
+//! Which providers are linked is private to the account owner.
pub mod config;
pub mod identity;
@@ -22,7 +26,9 @@ use crate::{
form_template::template_json_compact,
html::layout,
state::AppState,
- storage_schema::{oauth_link_owner, pseudonym_owner, Store, StoreFields},
+ storage_schema::{
+ linked_providers_for_uuid, oauth_link_owner, pseudonym_owner, Store, StoreFields,
+ },
ui_action::UI_RPC_FIELD,
};
@@ -53,10 +59,12 @@ fn new_actor_uuid() -> String {
pub struct LoginQuery {
#[serde(default)]
pub return_to: Option<String>,
+ #[serde(default)]
+ pub error: Option<String>,
}
#[derive(Debug, Deserialize)]
-pub struct GitHubStartQuery {
+pub struct OAuthStartQuery {
#[serde(default)]
pub return_to: Option<String>,
#[serde(default)]
@@ -72,15 +80,22 @@ fn return_from_query_or_jar(jar: &CookieJar, query: Option<&str>) -> String {
.unwrap_or_else(|| "/".to_string())
}
-fn oauth_providers(base_url: &str, return_to: &str) -> Vec<(&'static str, String)> {
+/// Available OAuth link targets: `(provider_key, label, start_href)`.
+fn oauth_providers(base_url: &str, return_to: &str) -> Vec<(&'static str, &'static str, String)> {
let mut out = Vec::new();
+ let enc = urlencoding::encode(return_to);
if oauth::GitHubConfig::from_env(base_url).is_some() {
out.push((
- "GitHub",
- format!(
- "/auth/github?return_to={}",
- urlencoding::encode(return_to)
- ),
+ "github",
+ oauth::provider_label("github"),
+ format!("/auth/github?return_to={enc}"),
+ ));
+ }
+ if oauth::RedditConfig::from_env(base_url).is_some() {
+ out.push((
+ "reddit",
+ oauth::provider_label("reddit"),
+ format!("/auth/reddit?return_to={enc}"),
));
}
out
@@ -125,23 +140,41 @@ fn alias_claim_forms(return_to: &str, submit_label: &str) -> Result<Markup, Stat
})
}
-fn signed_out_body(providers: &[(&str, String)]) -> Markup {
+fn login_error_message(code: Option<&str>) -> Option<&'static str> {
+ match code {
+ Some("oauth_taken") => {
+ Some("that OAuth account is already linked to a different sorter2 account")
+ }
+ Some("oauth_failed") => Some("OAuth failed — try again"),
+ _ => None,
+ }
+}
+
+fn signed_out_body(
+ providers: &[(&str, &str, String)],
+ error: Option<&str>,
+) -> Markup {
html! {
main class="panel login-page" {
section class="login-section" {
h1 { "sign in" }
- p class="muted" { "link an account to vote under a lasting alias" }
+ p class="muted" {
+ "link an OAuth account to create your identity, then claim an alias to vote"
+ }
+ @if let Some(msg) = login_error_message(error) {
+ p class="alias-bad" data-testid="login-error" { (msg) }
+ }
@if providers.is_empty() {
p class="muted" {
- "OAuth is not configured. Set GITHUB_CLIENT_ID and GITHUB_CLIENT_SECRET."
+ "OAuth is not configured. Set GitHub and/or Reddit client credentials."
}
} @else {
ul class="oauth-provider-list" {
- @for (name, href) in providers {
+ @for (key, label, href) in providers {
li {
a href=(href) class="btn-primary oauth-provider"
- data-testid=(format!("oauth-{}", name.to_lowercase())) {
- (format!("Continue with {name}"))
+ data-testid=(format!("oauth-{key}")) {
+ (format!("Link {label}"))
}
}
}
@@ -156,7 +189,10 @@ fn signed_out_body(providers: &[(&str, String)]) -> Markup {
fn account_body(
actor: &session::SessionActor,
aliases: &[String],
- providers: &[(&str, String)],
+ // Provider keys already linked to this UUID (private).
+ linked: &[String],
+ // Providers available to link: not yet attached.
+ unlinkable: &[(&str, &str, String)],
claim_forms: Markup,
) -> Markup {
let current = actor.pseudonym.trim();
@@ -212,16 +248,29 @@ fn account_body(
(claim_forms)
}
- @if !providers.is_empty() {
- section class="login-section" {
- h2 { "linked sign-in" }
- p class="muted small" { "sign in again with the same provider to return to this account" }
+ section class="login-section" {
+ h2 { "linked sign-in" }
+ p class="muted small" {
+ "private to you — linking more providers raises trust weight without publishing which accounts you use"
+ }
+ @if linked.is_empty() {
+ p class="muted" data-testid="linked-providers-empty" { "none yet" }
+ } @else {
+ ul class="linked-provider-list" data-testid="linked-providers" {
+ @for key in linked {
+ li data-testid=(format!("linked-{key}")) {
+ (oauth::provider_label(key))
+ }
+ }
+ }
+ }
+ @if !unlinkable.is_empty() {
ul class="oauth-provider-list" {
- @for (name, href) in providers {
+ @for (key, label, href) in unlinkable {
li {
a href=(href) class="btn-secondary oauth-provider"
- data-testid=(format!("oauth-relink-{}", name.to_lowercase())) {
- (format!("Re-link {name}"))
+ data-testid=(format!("oauth-link-{key}")) {
+ (format!("Link {label}"))
}
}
}
@@ -243,12 +292,21 @@ fn account_body(
fn login_body(
session: Option<&session::SessionActor>,
aliases: &[String],
- providers: &[(&str, String)],
+ linked: &[String],
+ providers: &[(&str, &str, String)],
claim_forms: Option<Markup>,
+ error: Option<&str>,
) -> Markup {
match (session, claim_forms) {
- (Some(actor), Some(forms)) => account_body(actor, aliases, providers, forms),
- _ => signed_out_body(providers),
+ (Some(actor), Some(forms)) => {
+ let unlinkable: Vec<_> = providers
+ .iter()
+ .filter(|(key, _, _)| !linked.iter().any(|p| p == key))
+ .cloned()
+ .collect();
+ account_body(actor, aliases, linked, &unlinkable, forms)
+ }
+ _ => signed_out_body(providers, error),
}
}
@@ -268,6 +326,10 @@ pub async fn login_page(
.as_ref()
.map(|s| alias_list(db, &s.uuid))
.unwrap_or_default();
+ let linked = session
+ .as_ref()
+ .map(|s| linked_providers_for_uuid(db, &s.uuid).unwrap_or_default())
+ .unwrap_or_default();
let providers = oauth_providers(&base_url_from_env(state.cfg.port), &return_to);
let claim_forms = if session.is_some() {
@@ -282,7 +344,14 @@ pub async fn login_page(
} else {
"login · sorter2"
},
- login_body(session.as_ref(), &aliases, &providers, claim_forms),
+ login_body(
+ session.as_ref(),
+ &aliases,
+ &linked,
+ &providers,
+ claim_forms,
+ query.error.as_deref(),
+ ),
state.views.get_views("/login"),
session
.as_ref()
@@ -302,7 +371,6 @@ pub async fn alias_page(
let db = state.projection_store.db();
let session = session::load_valid_session(db, &session_id).ok_or(StatusCode::UNAUTHORIZED)?;
if session::session_has_pseudonym(&session) {
- // Already onboarded — manage aliases on the account page.
return Ok(Redirect::to("/login").into_response());
}
@@ -331,7 +399,7 @@ pub async fn alias_page(
pub async fn github_start(
State(state): State<AppState>,
jar: CookieJar,
- Query(query): Query<GitHubStartQuery>,
+ Query(query): Query<OAuthStartQuery>,
) -> Result<Response, StatusCode> {
let cfg = oauth::GitHubConfig::from_env(&base_url_from_env(state.cfg.port))
.ok_or(StatusCode::SERVICE_UNAVAILABLE)?;
@@ -342,7 +410,28 @@ pub async fn github_start(
} else {
None
};
- let url = oauth::authorize_url(&cfg, &state_token, mock_user);
+ let url = oauth::github_authorize_url(&cfg, &state_token, mock_user);
+ let jar = jar
+ .add(session::oauth_state_cookie_value(&state_token))
+ .add(session::auth_return_cookie_value(&return_to));
+ Ok((jar, Redirect::temporary(&url)).into_response())
+}
+
+pub async fn reddit_start(
+ State(state): State<AppState>,
+ jar: CookieJar,
+ Query(query): Query<OAuthStartQuery>,
+) -> Result<Response, StatusCode> {
+ let cfg = oauth::RedditConfig::from_env(&base_url_from_env(state.cfg.port))
+ .ok_or(StatusCode::SERVICE_UNAVAILABLE)?;
+ let return_to = return_from_query_or_jar(&jar, query.return_to.as_deref());
+ let state_token = session::new_oauth_state();
+ let mock_user = if config::mock_oauth_allowed() {
+ query.mock_user.as_deref()
+ } else {
+ None
+ };
+ let url = oauth::reddit_authorize_url(&cfg, &state_token, mock_user);
let jar = jar
.add(session::oauth_state_cookie_value(&state_token))
.add(session::auth_return_cookie_value(&return_to));
@@ -355,6 +444,13 @@ pub struct OAuthCallbackQuery {
pub state: String,
}
+/// Link `provider:provider_id` to a UUID.
+///
+/// - Logged in + new provider → attach to session UUID
+/// - Logged in + already ours → no-op
+/// - Logged in
… preview truncated; 29,823 characters omittedHardlinks — judgments / attempts / prompt
judgments
attempts
Prompt text is loaded only by the download route.