Rewire hub from samod access-policy fork to upstream samod 0.16.0 (#917)

* Rewire hub from samod access-policy fork to upstream samod 0.16.0 (bd-jvag5d4w)

Dependency source: samod + samod-core move from the quarto-dev/samod
`access-policy` branch (0.14.0 + one commit, git+ source in Cargo.lock)
to crates.io samod 0.16.0 (registry source; the lockfile diff is only
the two packages' version/source/checksum lines). automerge stays a
single 0.12.0 and no transitive deps are added or removed — no new
native-tls/openssl edges. quarto-hub, quarto-hub-provider and
quarto-preview switch in lockstep so the crates unify to one copy.

API migration:
- The fork's synchronous `AccessPolicy` patch and `AnnouncePolicy`
  (`NeverAnnounce`) are replaced by upstream's `SharePolicy` seam. The
  hub installs a constant `ShareConfig::read_write().with_announce(false)`
  through a named `hub_share_policy()` seam, pinned by a unit test that
  asserts the fields (access=ReadWrite, announce=false) rather than
  comparing against the upstream constructor — the security-critical
  announce-off behavior, so the hub serves only documents an
  authenticated peer actively requests instead of advertising every
  loaded document ID.
- `accept_axum(socket)` becomes `accept_axum(socket, None)` (the 0.15
  signature). `None` is safe because nothing in the hub authorizes on a
  peer ID; bd-07kbzn1d tracks `Transport::with_expected_peer_id` for any
  future policy that does.

Audit logging: REMOVED, not ported. The pre-migration spike showed
SharePolicy subscription is eager per (loaded doc, connected peer):
share() fires at connection establishment for every locally loaded
document, before any find(), so a policy-driven "Document accessed"
line would emit phantom accesses for documents the user never opened.
The security audit also found the peer_emails map — keyed by the
client-chosen peer ID — was a misattribution vector (a client claiming
another user's peer ID overwrote, then deleted, that user's entry).
Session-granularity events on the existing quarto_hub::audit target
replace it: `ws_connect` when the upgrade completes (before samod sees
the socket) and `ws_disconnect` when the connection ends, carrying the
samod reason or "stream_closed"; both carry sub/credential_kind and are
emitted only when auth is enabled, matching auth_ok. bd-tfribfyy
records the loss and the design constraints for any replacement.

Also inherits samod 0.15's protocol hardening for free: direct messages
whose sender differs from the handshake identity, or that are addressed
to another peer, are now rejected before dispatch.

Verification: three-crate suite 840/840 (baseline 844 − 7 deleted
access_policy tests + 3 new); clippy/fmt clean; workspace suite
17291/17292 (sole failure a proven worktree-nesting artifact, passes in
the main checkout); JS↔Rust interop 5/5 against the migrated binary;
on-disk smoke loads the pre-migration index without re-init; zero
"Document accessed" lines under -v; two-client ephemeral/presence
check through the hub passes both directions. cargo xtask verify
passes with the npm legs skipped (no node_modules in the worktree, as
in the July migration) and rust-tests/feature-sets covered in-phase.

Plan: claude-notes/plans/2026-10-26-samod-0-16-share-policy.md
Follow-ups: bd-tfribfyy (audit-log loss), bd-07kbzn1d
(with_expected_peer_id), bd-e2l028k4 (cargo deny baseline).

* Plan + braid bookkeeping: mark commit item done (a1dcd15), strand closed

* Simplify ws handler follow-ups from bd-jvag5d4w review

Review follow-ups to a1dcd15 (samod 0.16 SharePolicy rewire):

- Drop the now-dead peer_info.clone() in the ClientConnected arm — it
  existed to keep peer_info alive for the removed connected_peer_id
  move; nothing uses peer_info afterwards anymore.
- format_peer_info takes Option<&PeerInfo> instead of &Option<PeerInfo>
  (idiomatic borrow; unit tests updated).
- ws_disconnect reason is now "repo_stopped" when the repo refuses the
  socket, instead of the misleading "stream_closed"; ops doc updated.
  This arm is compile-covered only — the test harness has no path to a
  stopped repo, same as the pre-existing warn! there.

No snapshot changes. cargo nextest -p quarto-hub: 504/504; clippy
--all-targets -D warnings and fmt clean.

Author: shikokuchuo

.braid/snapshot.jsonl

@@ -97,9 +97,10 @@
 #   can use `install.sh --from-source`.
 # - The linux legs still build with `--features vendored-openssl` so
 #   the binary has no runtime libssl dependency. openssl reaches q2
-#   only through our samod fork's tungstenite/native-tls wiring;
-#   bd-r7s13dfb tracks moving that to rustls, which would let this
-#   feature (and the openssl build entirely) go away.
+#   only through samod's tungstenite/native-tls wiring (the upstream
+#   crate's `tungstenite` feature); bd-r7s13dfb tracks moving that to
+#   rustls, which would let this feature (and the openssl build
+#   entirely) go away.
 #
 # Signing key: MINISIGN_SECRET_KEY repo secret; the public half is pinned
 # in install.sh (MINISIGN_PUBKEY) and README. The sign step verifies its

.github/workflows/release-pipeline.yml

@@ -13,10 +13,10 @@ name = "quarto_hub_provider"
 path = "src/lib.rs"
 
 [dependencies]
-# Automerge sync via the same samod fork the hub uses. Must match quarto-hub's
-# version/branch exactly, else samod (and its automerge) resolve to a second copy
-# and DocHandle types no longer unify across the crate boundary.
-samod = { version = "0.14.0", git = "https://github.com/quarto-dev/samod.git", branch = "access-policy", features = ["tokio", "tungstenite"] }
+# Automerge sync via the same crates.io samod the hub uses. Must match
+# quarto-hub's version exactly, else samod (and its automerge) resolve to a
+# second copy and DocHandle types no longer unify across the crate boundary.
+samod = { version = "0.16.0", features = ["tokio", "tungstenite"] }
 # Reused index-document model (file list, capture sidecar) for the join+list path.
 quarto-hub = { path = "../quarto-hub" }
 # Read file documents out of the VFS during materialization (must match the

Cargo.lock

@@ -10,7 +10,7 @@ use std::str::FromStr;
 use std::time::Duration;
 
 use quarto_hub::index::IndexDocument;
-use samod::{BackoffConfig, DocumentId, NeverAnnounce, Repo};
+use samod::{BackoffConfig, DocumentId, Repo, ShareConfig};
 use tokio::net::TcpListener;
 
 async fn spawn_relay() -> (Repo, url::Url) {
@@ -20,7 +20,7 @@ async fn spawn_relay() -> (Repo, url::Url) {
 async fn spawn_relay_never_announce() -> (Repo, url::Url) {
     spawn_relay_with(
         Repo::build_tokio()
-            .with_announce_policy(NeverAnnounce)
+            .with_share_policy(ShareConfig::read_write().with_announce(false))
             .load()
             .await,
     )
@@ -104,7 +104,7 @@ async fn peer_b_syncs_a_doc_created_by_peer_a_through_the_relay() {
 async fn peer_b_syncs_through_a_never_announce_relay() {
     // The real servers (quarto-hub, sync.automerge.org) do NOT proactively
     // announce docs to a connecting peer. If peer B still can't sync A's doc
-    // here, we've pinned the provider's "0 file(s)" bug to a NeverAnnounce
+    // here, we've pinned the provider's "0 file(s)" bug to an announce-off
     // relay — B must actively request/pull, not wait to be announced to.
     let (_relay, url) = spawn_relay_never_announce().await;
 
@@ -133,5 +133,5 @@ async fn peer_b_syncs_through_a_never_announce_relay() {
         }
         tokio::time::sleep(Duration::from_millis(250)).await;
     }
-    assert_eq!(last, 2, "peer B never synced through a NeverAnnounce relay");
+    assert_eq!(last, 2, "peer B never synced through an announce-off relay");
 }

claude-notes/plans/2026-10-26-samod-0-16-share-policy.md

@@ -46,8 +46,8 @@ time = "0.3"
 # Without this, the Rust default is UnicodeCodePoint, which disagrees with JS on
 # non-BMP characters (emoji etc.) — each emoji is 1 code point but 2 UTF-16 code units.
 automerge = { version = "0.12.0", features = ["utf16-indexing"] }
-# samod fork carrying the synchronous AccessPolicy trait.
-samod = { version = "0.14.0", git = "https://github.com/quarto-dev/samod.git", branch = "access-policy", features = ["tokio", "axum", "tungstenite"] }
+# Automerge sync (samod).
+samod = { version = "0.16.0", features = ["tokio", "axum", "tungstenite"] }
 
 # Async streams (for samod event handling)
 futures = "0.3"