1 files changed, 93 insertions, 0 deletions

diff --git a/PROGRESS.md b/PROGRESS.md
new file mode 100644
index 0000000..abab7c4
--- /dev/null
+++ b/PROGRESS.md
@@ -0,0 +1,93 @@
+# GRASP Mirror Daemon — Progress Tracker
+
+## Current Status: **Running, discovery working, push blocked**
+
+The daemon is deployed and running on `23.182.128.226`. It discovers 75 repos across 3 npubs, clones them from source servers, but git push to `git.orangesync.tech` fails — likely needs authenticated `kind:30618` state event (requires NIP-46 pairing).
+
+---
+
+## Checklist
+
+### Phase 1: Build & Deploy
+- [x] Rust project structure created (`/tmp/grasp-mirror/`)
+- [x] All source modules implemented (config, db, git_mirror, nostr_mirror, discovery, health, nip46, signing)
+- [x] NIP-46 remote signing client (session management, NIP-04 encryption, relay listener)
+- [x] Fix compile errors (nip04/nip46 features, API mismatches, borrow checker)
+- [x] Fix `secret_key()` → `to_secret_hex()`, `EventBuilder::new` args, async map_err
+- [x] Build succeeds on VPS with Rust 1.95.0 (warnings only, no errors)
+- [x] Binary installed at `/usr/local/bin/grasp-mirror`
+- [x] Systemd service configured and enabled (`grasp-mirror.service`)
+- [x] Config at `/etc/grasp-mirror/config.toml`
+- [x] Env file at `/etc/grasp-mirror/env` with `MIRROR_NPUBS`
+
+### Phase 2: Discovery & Relay Connectivity
+- [x] Service starts and connects to relays
+- [x] NIP-46 sessions initialized (3 sessions, all unpaired)
+- [x] Health endpoint live at `http://localhost:7335/health`
+- [x] Fix: relay pool returns empty when most relays dead
+  - Root cause: `relay.orangesync.tech` and `ngit.orangesync.tech` have no event data
+  - Data lives on `git.orangesync.tech` (the GRASP server relay)
+  - Fix: use dedicated discovery client with only `wss://git.orangesync.tech`
+- [x] Fix: suppress noisy relay pool retry logs (`nostr_relay_pool=warn`)
+- [x] **75 repos discovered** (33 + 29 + 13 across 3 npubs)
+- [x] NIP-11 server verification: `git.orangesync.tech` verified (GRASP-01, GRASP-02, GRASP-05, v1.0.2)
+
+### Phase 3: Git Mirror (In Progress)
+- [x] Repos cloned from source URLs (some succeed, some fail — source URLs down)
+- [ ] **Git push to `git.orangesync.tech` failing** — all pushes rejected
+  - Likely cause: GRASP server requires authenticated push (kind:30618 state event)
+  - State event signing requires NIP-46 pairing (Amber)
+  - Error: `failed to push mirror to https://git.orangesync.tech/...`
+- [ ] Investigate GRASP server push auth requirements
+- [ ] Verify clone URL format matches what GRASP expects
+
+### Phase 4: NIP-46 Pairing (Blocked — requires user action)
+- [ ] Pair npub `c3e23eb5...` via Amber
+  - URI: `nostrconnect://2839411006e06e1c83b9cbd29a63ae7f58444e2fe03fa04e720e4eaff6e28fd2?metadata={"name":"grasp-mirror"}&relay=wss://relay.orangesync.tech&relay=wss://ngit.orangesync.tech`
+- [ ] Pair npub `2c8db3b4...` via Amber
+  - URI: `nostrconnect://92d7842be1b30c4ea627447c30ec6fe555b6b0139136436233e2ee0aaa72990f?metadata={"name":"grasp-mirror"}&relay=wss://relay.orangesync.tech&relay=wss://ngit.orangesync.tech`
+- [ ] Pair npub `56e9936d...` via Amber
+  - URI: `nostrconnect://9c273012cd08569fe3e8081643243b58a863707dff90c06cf156cf65703f50a4?metadata={"name":"grasp-mirror"}&relay=wss://relay.orangesync.tech&relay=wss://ngit.orangesync.tech`
+- [ ] Verify pairing in health endpoint (`connected: true`)
+- [ ] End-to-end test: sign kind:30618, push succeeds
+
+### Phase 5: Nostr Event Mirror
+- [ ] Forward repo events (kind:30617, issues, PRs, comments) to target servers
+- [ ] Sync all events for tracked npubs
+- [ ] Verify event persistence in target server relays
+
+### Phase 6: Production Hardening
+- [ ] Fix NIP-46 relay config (use `wss://git.orangesync.tech` instead of `relay.orangesync.tech`)
+- [ ] Add more GRASP servers when they come online
+- [ ] Test retry/backoff on failed clones
+- [ ] Add monitoring/alerting
+- [ ] Switch to Ansible-based deployment for ongoing updates
+
+---
+
+## Key Findings
+
+1. **Relay data location**: Event data for these npubs lives on `wss://git.orangesync.tech` (the GRASP server relay), NOT on `wss://relay.orangesync.tech` or `wss://ngit.orangesync.tech`. These relays appear to be different services (Tollgate Infrastructure Relay, ngit relay) that don't carry GRASP event data.
+
+2. **nostr-sdk pool behavior**: `fetch_events()` returns empty when most relays in the pool are dead. Use a separate client with only working relays, or use `fetch_events_from()` with known-good URLs.
+
+3. **Push auth**: GRASP servers likely require `kind:30618` state events for push authorization. Without NIP-46 pairing, the daemon can't sign state events, so all pushes fail.
+
+---
+
+## Architecture
+
+```
+VPS (23.182.128.226)
+├── grasp-mirror binary (/usr/local/bin/)
+├── config.toml (/etc/grasp-mirror/)
+├── env file (/etc/grasp-mirror/env)
+├── SQLite DB (/var/lib/grasp-mirror/mirror.db)
+├── Bare repos (/var/lib/grasp-mirror/repos/)
+└── systemd service (grasp-mirror.service)
+    ├── Polls every 300s
+    ├── Discovers repos via wss://git.orangesync.tech
+    ├── Clones from source URLs (relay.ngit.dev, gitnostr.com, etc.)
+    ├── Signs state events via NIP-46 (Amber on phone)
+    └── Pushes to target GRASP servers
+```