officerdev/platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

design: notifications from every server one app is signed into

Browse Source 
The good news survives checking. An APNs auth key belongs to the developer account, not a machine, and
a device token belongs to the app, not a server — so N installs holding the same .p8 all push to one
phone with no coordination, and the app posting its token per server is something the multi-server
manager does anyway.

One field is missing: the payload carries no origin. That breaks the deep link (a session id is
meaningful only on the server that issued it), and threading, and — least obviously and most
expensively — `mv`. That is a content hash of THAT server's catalogue, and the client's rule is
`mv !== version → resync`. One stored catalogue and five servers means every push from B invalidates
what was synced from A, forever. It would present as a battery and data problem rather than a bug.

Where the identifier comes from is deliberately left to the sign-on design: the multi-server manager
already needs a key per server, and notifications should adopt it rather than invent a second identity
that drifts the first time a host is renamed.

Records what stays per server on purpose — devices, per-chat mute preferences, the catalogue itself —
because the app is what joins them, which is the same shape as the sign-on work.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
pastilhas
2026-08-21 03:19:17 +00:00
co-authored by Claude Opus 5
parent 4984fdc3a2
commit bcf8df9d32
3 changed files with 124 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
TODO.md
+9
View File
@@ -12,6 +12,15 @@ below that proposed deleting it have been removed rather than left to mislead th
What did NOT reverse: `execution` permissions (terminal, chat, tasks, files, desktop, browser) run as
the owner's OS user and can never be granted. Indirection there really is accidental complexity.
## Notifications
- [ ] **A push payload does not say which server sent it**, which is fine for one and breaks three things
for several — the deep link resolves a session id against the wrong server, threading can collapse
two servers' chats into one banner, and `mv` (a per-server catalogue hash) makes the app resync
forever, always against whichever server pushed last. Blocks the multi-server sign-on work.
**Settle the server identifier with that design rather than inventing one here.**
See `docs/multi-server-push.md`.
## Affordances
- [ ] **No way to see which affordances are reaching your agents, or to turn one off.** They are global: