1 files changed, 61 insertions, 25 deletions

diff --git a/PLAN.md b/PLAN.md
index ab1ea9f..1911a20 100644
--- a/PLAN.md
+++ b/PLAN.md
@@ -1,25 +1,61 @@
-# grasp-mirror Bugfix Plan
-
-## Bugs Identified from VPS Logs
-
-### Bug 1: `remote 'push_target' already exists`
-- **Location**: `src/git_mirror.rs:137`
-- **Cause**: `repo.remote("push_target", target_url)` creates a new remote every cycle. On subsequent cycles, the bare repo already has a `push_target` remote, so `git2` returns `Exists (-4)`.
-- **Fix**: Use `repo.find_remote("push_target")` first. If it exists, call `repo.remote_set_url()` to update the URL. If not, create it.
-
-### Bug 2: Single repo failure aborts entire cycle
-- **Location**: `src/main.rs:mirror_cycle()` — the `mirror.mirror_repo_to_servers()` call uses `?` which propagates the error and aborts the loop.
-- **Cause**: When one repo (e.g. `market`) fails to clone from any server, the `?` operator returns early, skipping the remaining ~87 repos.
-- **Fix**: Replace `?` with a `match` that logs the error and continues to the next repo. Only the `discover_repos_from_relays` and `persist_discovered_repos` calls should be fatal (if relay queries fail, nothing works).
-
-## Checklist
-
-- [ ] Fix `push_mirror` in `src/git_mirror.rs` — reuse existing `push_target` remote
-- [ ] Fix `mirror_cycle` in `src/main.rs` — make per-repo errors non-fatal
-- [ ] Rebuild release binary (`cargo build --release`)
-- [ ] Push updated source to all 9 GRASP servers (`git push origin master`)
-- [ ] Redeploy via Ansible (`ansible-playbook playbooks/30-grasp-mirror.yml`)
-- [ ] Verify: `grasp-mirror status` shows repos tracked and sync records
-- [ ] Verify: `journalctl -u grasp-mirror` shows successful mirror cycles without `already exists` errors
-- [ ] Verify: spot-check `git ls-remote` against a few GRASP servers for repos from all 3 npubs
-- [ ] Verify: `https://git.orangesync.tech/api/mirror-health` returns `"status": "ok"`
+# grasp-mirror Plan
+
+## Completed
+
+- [x] Fix `push_mirror` in `src/git_mirror.rs` — reuse existing `push_target` remote via `remote_set_url`
+- [x] Fix `mirror_cycle` in `src/main.rs` — make per-repo errors non-fatal
+- [x] Add HTTP health endpoint (`/health`, `/api/mirror-health`) on port 7335
+- [x] Mirror repos from 3 npubs
+- [x] Ansible role, playbook, systemd unit, config templates
+- [x] Dashboard integration on `services.orangesync.tech`
+- [x] Watchdog integration
+
+## Phase 3: NIP-46 Remote Signing via Amber
+
+### Problem
+GRASP servers reject unauthenticated git pushes. Authorization requires a `kind:30618` state event signed by a maintainer's key. The daemon needs to sign these events but should never hold raw nsec keys.
+
+### Solution
+NIP-46 (Nostr Connect) remote signing via Amber on the user's phone. The daemon acts as a NIP-46 client, sends `sign_event:30618` requests to Amber, and waits for approval before pushing.
+
+### Architecture
+```
+VPS: grasp-mirror  ←→  relays  ←→  Amber (phone)
+     - discovers repos        - NIP-46 kind:24133
+     - builds state events    - sign_event:30618
+     - queues signing          - user approves
+     - publishes event        - returns signature
+     - git push
+
+services.orangesync.tech
+     - pairing UI + QR codes
+     - status display
+```
+
+### Config
+```toml
+[nip46]
+relays = ["wss://relay.orangesync.tech", "wss://ngit.orangesync.tech"]
+signing_timeout_secs = 604800  # 7 days
+```
+
+### Checklist
+
+- [ ] Add `nip46_sessions` and `signing_queue` tables to `src/db.rs`
+- [ ] Build `src/nip46.rs` — NIP-46 client with session management
+  - Generate client keypair per npub, persist to SQLite
+  - Build `nostrconnect://` URIs with `perms=sign_event:30618`
+  - Listen for `kind:24133` events on configured relays
+  - Handle connect/get_public_key/sign_event handshake
+  - `sign_state_event(npub, state_event) -> Result<SignedEvent>` method
+  - Auto-reconnect on session drop
+- [ ] Wire NIP-46 into `src/main.rs` daemon startup — connect sessions for all 3 npubs
+- [ ] Modify `src/git_mirror.rs` — before push, build `kind:30618` state event, request signature via NIP-46
+- [ ] Add pairing URI + NIP-46 status to health endpoint (`/api/mirror-health`)
+- [ ] Update dashboard HTML (`static/services/index.html`) with pairing UI + QR codes
+- [ ] Update Ansible config template with `[nip46]` section
+- [ ] Add `health_port` to `[storage]` in config template (already done)
+- [ ] Rebuild release binary
+- [ ] Push to all 9 GRASP servers
+- [ ] Redeploy via Ansible
+- [ ] End-to-end test: pair npub via Amber, verify signing flow works