worklog.md

Worklog

Append-only. Newest at the bottom. One entry per work session. Never edit past entries — correct course with a new entry. Template + rules in README.md.

---

2026-06-03 — Scaffold the companion daemon

• Did: Created the dinner repo and a localhost axum daemon: /health, a reverse proxy, and a stubbed proving route.
• Why: Stand up the on-device proving companion idea as a real service.
• Commits: 34c745b
• Verified: Built + smoke-tested /health and the proxy.
• Next: Decouple proving behind a seam so the app is buildable end-to-end.

2026-06-04 — Prover seam + generic reframe

• Did: Added a Prover trait with a mock backend so the whole flow works without a real prover. Then generalized dinner from a Hexposed-specific tool to a generic proving companion: dropped join/disclose/player_id/SNIP-9 and the read-proxy; generic POST /v1/prove → job → poll; opaque payloads.
• Why: dinner should prove any payload, not just Hexposed's. Secret stays in the browser (sent in the payload), per the custody decision.
• Commits: d86b5c7, 38c427c
• Verified: Smoke-tested arbitrary payloads queued → proving → succeeded.
• Next: Give it a UI (Tauri).

2026-06-04 — Tauri desktop scaffold + lib refactor

• Did: Refactored the core into a library + thin binary; built a Tauri 2 app under desktop/ (tray + Status/Activity/Settings, IPC commands) reusing the core. Dropped the heavy hexposed-sdk dep (core builds < 1s).
• Why: Ship a self-contained, installable companion (no Docker).
• Commits: 33fff45
• Verified: Core builds; desktop/ excluded from the root workspace. Tauri app not built (no Node/webview in the sandbox).
• Next: Network-awareness, settings, storage, API docs.

2026-06-04 — Networks, settings, storage, self-describing API

• Did: Made proving network-aware (mainnet/testnet); added editable per-network settings (RPC + remote prover + API key) persisted to settings.json, managed via IPC only; added local storage of every job (payload + proof + metadata) with stats/clear; added GET /openapi.json (OpenAPI 3.1). Built the real Settings UI.
• Why: Direct feature requests; enable real proving on both networks and make the API agent-consumable.
• Commits: bb69635
• Verified: Core builds; smoke-tested /openapi.json, testnet prove, and the on-disk storage record (prove_ms recorded). UI not compiled.
• Next: Build the desktop app locally; adapt the remote prover to the async job protocol.

2026-06-04 — Documentation

• Did: Created the docs/ tree (architecture, code reference, project management) and wired it into the README.
• Why: Make the project navigable and resumable.
• Commits: 0c554d1
• Verified: N/A (docs).
• Next: First real desktop build (Backlog #1).

2026-06-04 — Menu-bar app behavior + tray fix

• Did: Made the desktop app a macOS menu-bar app — no Dock icon (Accessory policy), window-close hides instead of quitting, tray left-click shows window / right-click Open|Quit. Fixed the tray icon not appearing by retaining the tray handle (app.manage(tray)). Generated a placeholder app-icon.png.
• Why: User wants it to live in the menu bar, not the Dock.
• Commits: 417257d, 8452a27
• Verified: Not compiled in-sandbox (no Tauri toolchain); user-tested.
• Next: Real proving backend.

2026-06-04 — Docker prover backend (isolated, removable)

• Did: Added src/docker_prover.rs — a self-contained Prover backend that runs the official x86_64 SNIP-36 prover image (prove virtual-os) to produce mainnet-valid proofs. Selected via DINNER_PROVER=docker; one match arm in build_state; the only Docker/SNIP-36-aware code. Payload contract: { transaction, block_number? } + network; RPC from settings.
• Why: Need real mainnet-valid proofs now; native arm64 is blocked on the stwo bug. Container is the clean interim per the decision; built to be removed cleanly later.
• Commits: (this change)
• Verified: Core builds; backend selection + no-RPC error path smoke-tested. Container run NOT yet verified (no Docker in sandbox).
• Next: User verifies end-to-end (pull image, set RPC, prove a real Tx A).

2026-06-04 — Docker route verified end-to-end

• Did: Pulled the x86_64 image; cooked a fresh Tx A (0-STRK self-transfer signed by the mainnet prover account, nonce 0x2) via a throwaway SDK example (hexposed-sdk/.../examples/cook_tx.rs); proved it through dinner's Docker backend. Fixed two container-env gaps along the way: the CLI requires STARKNET_RPC_URL + STARKNET_ACCOUNT_ADDRESS + STARKNET_PRIVATE_KEY (passed RPC for real, dummies for the account/key — real key never enters the container); and the proving RPC must be spec ≥ 0.8 (lava's plain endpoint lacked state_diff_commitment; switched to an Alchemy v0_10 endpoint).
• Why: Confirm the interim real-proving path actually works on Apple Silicon.
• Result: ✅ ~400 KB stwo proof in ~29 s (emulated); proof_facts[2] = 0x3e98c2d7… (mainnet-accepted SNOS hash). Storage record persisted with prove_ms.
• Commits: (this change — docker_prover.rs env vars + docs)
• Notes: User's ~/.dinner mainnet RPC (lava) is too old for proving — must set a spec ≥ 0.8 endpoint. cook_tx.rs left uncommitted in hexposed-sdk as a dev helper.
• Next: Desktop backend-selection toggle (Backlog #1).

2026-06-04 — Backend toggle in Settings

• Did: Added a persisted prover_backend to Settings (companion/docker), editable from the Settings UI. build_state reads it (sync) and it overrides the DINNER_PROVER env; applied on restart. Added a selector + "restart to apply" note in the UI.
• Why: A packaged app can't rely on a launch-time env var; users need to pick the backend in-app.
• Commits: (this change)
• Verified: Core builds; with prover_backend:"docker" in settings and no env var, /health reports docker. UI not compiled (no Node).
• Next: Build the desktop app for real (Backlog #1) / wire a real consumer.

2026-06-05 — Native backend; arch theory was wrong (dependency skew)

• Did: Root cause of the INVALID_PROOF rejections was dependency skew, not arm64: the deps/sequencer prover stack is a one-time side-clone that was stuck at RC.3 (May) while the verifier moved to RC.6. With the side-clone updated + rebuilt (native arm64, Jun 5), added a native backend (src/native_prover.rs, DINNER_PROVER=native) that runs the local snip36 CLI directly — no Docker. Factored shared logic into src/snip36.rs (preflight, nonce check, env, output parsing); docker + native both use it. Native is now the recommended backend (Settings selector + default); Docker is a fallback. Set ~/.dinner to native.
• Why: Achieves the original self-contained, no-Docker goal once the real (version, not arch) cause was understood.
• Verified: native arm64 prove of a real mainnet tx → ~398 KB proof in ~30 s, proof_facts[2] = 0x3e98c2d7…, zero containers. Nonce preflight + l2_to_l1 messages confirmed working through the shared path.
• Commits: (this change)
• Corrected: the two 2026-06-04 x86_64/Docker decisions are marked SUPERSEDED; docker-prover.md reframed as fallback; native-prover.md added.
• Next: bundle the native prover into the app (Backlog #3); first real desktop build.

2026-06-05 — Native prover bundling mechanism

• Did: Built the mechanism to ship the native prover inside the app. Mapped the exact runtime set (snip36 CLI + sequencer runner + sierra compiler + deps/sequencer/crates/**/resources/**), excluding the ~9.6 GB of build intermediates → ~286 MB. Added desktop/scripts/stage-prover.sh, a tauri.conf.json resources entry, and Tauri glue that resolves the bundled prover from the resource dir at startup and sets DINNER_SNIP36_BIN/WORK_DIR (no-op in dev → sibling-checkout fallback). Gitignored the staged dir.
• Verified: staged the lean set to a temp dir and proved a real mainnet tx against ONLY that bundle (no checkout) → ~407 KB proof, SNOS hash 0x3e98c2d7…. So the bundle contents are confirmed complete. Core builds; the Tauri glue + tauri build are NOT compiled here (no Node/Tauri toolchain).
• Commits: (this change)
• Next: real tauri build + validate the runner launches from the installed .app (exec bit / macOS signing); per-platform staging.

2026-06-05 — Activity tab shows generated proofs

• Did: Wired the Activity tab to the persistent storage records (not just the live job feed). Storage::list() returns per-proof metadata (newest first) and get_record() the full record; exposed as IPC list_proofs / proof_detail. The tab now shows each generated proof — status, network, proof-generation time, size, time-ago — with a click-to-expand detail (timestamp, proof_facts count, L2→L1 message count), plus any in-progress jobs at the top from the live feed.
• Why: Make the generated proofs explorable (was stats-only).
• Verified: core builds; confirmed real stored records carry the exact fields the list extracts (e.g. succeeded/mainnet/27.6s/388 KB/8 facts). Frontend not compiled here (no Node/Tauri).
• Commits: (this change)
• Next: first real desktop build to see it live.

2026-06-05 — Self-describing API (simpler agent onboarding)

• Did: Added GET / returning self-describing usage (how to prove: submit + poll, payload shape, rules) so an agent pointed at the base URL needs no prompt instructions. /health now carries a usage: "/" pointer; the prove 202 adds a next hint. Documented / in openapi + simplified the http-api.md agent quickstart.
• Why: Move the "how to use me" guidance into the API (versioned with the code) instead of duplicating it in every agent prompt.
• Verified: GET / and /health return the expected guidance; core builds.
• Commits: (this change)

2026-06-05 — UI polish, remote rename, + resume snapshot

• Did: Activity tab now lists generated proofs from storage (status/network/ gen-time/size/time + expandable detail). Made the API self-describing (GET / returns usage; /health points to it; prove 202 has a next hint) so an agent needs only the base URL. Added a copy-paste agent prompt to the Status tab. Removed the "proven on this device" line (untrue for the remote backend). Renamed the companion backend to remote (UI + value + /health; legacy companion still accepted).
• Commits: 896e137, 7e72728, 1d871e4, eb1a032, 02257ba.

Resume snapshot (state as of this commit)

• What dinner is: generic local proving companion. POST a signed Starknet tx to /v1/prove, poll status_url. Three backends behind one seam (prover::Prover): native (local snip36 CLI, no Docker — recommended, default on this machine), docker (x86_64 container fallback), remote (a configured gateway, else mock). Selected via Settings prover_backend (overrides DINNER_PROVER env); applied on restart.
• Proven working: native arm64 + docker both produce mainnet-valid proofs (~30s, SNOS hash 0x3e98c2d7…). The old "arm64 is broken" theory was wrong — it was dependency skew (see decisions.md 2026-06-05 + [[hexposed-prover-toolchain]]).
• Invariants to keep: dinner never holds a private key (signed tx only); settings/secrets are IPC-only, never HTTP; RPC must return state_diff_commitment (~spec 0.10); the deps/sequencer side-clone must be re-provisioned after a prover pin bump (not git-tracked).
• Top next items (see status.md): real desktop tauri build (+ validate the bundled prover launches from the installed .app); real remote-prover async job protocol; persisted jobs.
• Can't be done in the sandbox here: anything needing Node/Tauri toolchain (the desktop UI build) or Docker — those are run on the host.

2026-06-05 — Fix storage record collisions across restarts

• Bug: Settings→Storage size grew but record count didn't. Job ids (p{n}) came from an in-memory counter that reset to 0 on every restart, and records are stored as <job_id>.json — so each restart overwrote p0.json, p1.json, … (count flat, contents/size changed, earlier proofs silently lost).
• Fix: Storage::max_seq() finds the highest existing p{n} record; build_state seeds the Jobs counter to max+1 so ids (and filenames) never collide with prior records. Jobs::new(start_seq).
• Verified: with 3 existing records, a new proof got p3 (not p0); count went 3 → 4.
• Note: proofs overwritten before this fix are unrecoverable; records accumulate correctly from here. The in-progress live feed is still in-memory (acceptable).
• Commits: (this change)

2026-06-05 — Elapsed timer (#1) + fix port-9900 collision

• #1 elapsed timer: Job/Activity now carry started_at_ms (set at create); the Activity tab's in-progress rows show a live ticking elapsed time (1s clock) instead of "working…".
• Port-9900 fix: the native CLI spawns its runner on a fixed port 9900, so a leaked runner (interrupted proof / dinner restart mid-prove) or two concurrent proofs collided ("port 9900 already in use"). The native backend now assigns a free port per prove (free_port() → --port), so it never clashes. (Docker is unaffected — each container is network-isolated.)
• Verified: core builds; a native prove succeeded with started_at_ms populated and ran on an assigned port (no 9900 collision).
• Commits: (this change)

2026-06-05 — RPC resilience: incidents 1–4 from the brief (dinner-side)

• #1 error clarity: shared snip36::http_client() with redirect::Policy::none() (a 301 no longer silently turns the JSON-RPC POST into a GET); rpc_call() now reports redirects, non-2xx (status + body snippet), and non-JSON bodies; classify_prover_error() maps CLI failures (429 / state_diff_commitment / port) to actionable job errors. Verified: an http:// 301 RPC fails fast with a clear "use the https URL" message instead of expected value at line 1 column 1.
• #2 settings reload: SettingsStore reloads settings.json on get()/ for_network() when its mtime changes — external edits + desktop IPC writes both take effect with no restart. Verified live via /health.
• #3 /health config echo: adds data_dir, pid, and per-network rpc_host/ rpc_configured (+ remote prover) — host only, never the full URL/keys (would leak over permissive-CORS HTTP). Tells you which process/config owns the port.
• #4 process-group + timeout: native/docker run in their own process group (unix); run_and_parse times out (DINNER_PROVE_TIMEOUT_SECS, default 900) and kills the group on timeout/failure so the runner can't outlive the job and leak its port. (Free-port-per-prove landed earlier in ecdd8ba.) libc dep, unix-only.
• Verified: happy-path native prove still succeeds through the new spawn path.
• Next: the upstream root fix — retry/backoff + rate-limit + class caching in the prover stack's RPC client → PR to snip-36-prover-backend.

2026-06-16/17 — Downloadable release + bundled, on-chain-verifiable prover

• Did: Shipped the v0.1.0 downloadable release. Added a tagged release pipeline (.github/workflows/release.yml): push v* → builds the Tauri app for macOS (Apple Silicon) + Linux x86_64 → attaches .dmg/.app.tar.gz/ .deb/.AppImage/.rpm to a draft release a human publishes. Bundled a real, self-contained prover.
  • Hit a proof-format skew: the latest backend (v1.2.1/deps-v5) emits PROOF1, rejected by the live Sepolia gateway (still RC.6/PROOF0) — deps-v5's sequencer bump (RC.6→ac43943) ran ahead of the verifier.
  • Re-pinned to v1.1.3 (RC.6/PROOF0). Its prebuilt binaries bake the CI path for sierra-compile and can't relocate, so we build it from source and apply patch-sequencer-relocatable.py (current_exe()-relative out_dir()). stage-prover-source.sh: snip36 setup → patch → rebuild runner → stage; the patched runner is staged under both runner_bin() names.
• Why: Let people download dinner instead of building it, with a prover whose proofs the live verifier actually accepts.
• Commits/PRs: #1 (release CI + arm64 doc fixes), #2 (ubuntu-24.04 glibc + drop empty signing env), #3 (from-source RC.6/PROOF0 + relocatability patch).
• Verified: CI green on both platforms; the shipped .app, run from a relocated path, proved PROOF0; that proof verified on-chain on Sepolia (proof-carrying verify_move_forward, tx 0x62b1a2e7…, ACCEPTED_ON_L2/SUCCEEDED). Round-trip ran key-safe through the strkd wallet.
• Scope/limits: macOS Apple Silicon + Linux x86_64 only (no prebuilt prover for Windows/Intel-mac). Unsigned (macOS: right-click → Open) — signing is a follow-up. Build is ~30-40 min/platform from source (CI cache deferred).
• Next: publish the v0.1.0 draft; optional macOS signing+notarization; optional CI build cache. Re-verify on-chain before ever bumping the prover pin (see decisions.md 2026-06-17).