feat(purgatory): add broken purgatory implementation

3 files changed, 208 insertions, 1 deletions

diff --git a/src/nostr/policy/mod.rs b/src/nostr/policy/mod.rs
index 19db5f6..2a446fe 100644
--- a/src/nostr/policy/mod.rs
+++ b/src/nostr/policy/mod.rs
@@ -16,6 +16,8 @@ pub use related::{ReferenceResult, RelatedEventPolicy};
 pub use state::{AlignmentResult, StatePolicy, StateResult};
 
 use super::SharedDatabase;
+use crate::purgatory::Purgatory;
+use std::sync::Arc;
 
 /// Shared context for all sub-policies
 #[derive(Clone)]
@@ -23,6 +25,7 @@ pub struct PolicyContext {
     pub domain: String,
     pub database: SharedDatabase,
     pub git_data_path: std::path::PathBuf,
+    pub purgatory: Arc<Purgatory>,
 }
 
 impl PolicyContext {
@@ -30,11 +33,13 @@ impl PolicyContext {
         domain: impl Into<String>,
         database: SharedDatabase,
         git_data_path: impl Into<std::path::PathBuf>,
+        purgatory: Arc<Purgatory>,
     ) -> Self {
         Self {
             domain: domain.into(),
             database,
             git_data_path: git_data_path.into(),
+            purgatory,
         }
     }
 }
diff --git a/src/nostr/policy/pr_event.rs b/src/nostr/policy/pr_event.rs
index 53da369..c7602b0 100644
--- a/src/nostr/policy/pr_event.rs
+++ b/src/nostr/policy/pr_event.rs
@@ -19,6 +19,155 @@ impl PrEventPolicy {
         Self { ctx }
     }
 
+    /// Check if git data exists for a PR event
+    ///
+    /// This checks:
+    /// 1. If a placeholder exists (git-data-first scenario)
+    /// 2. If the commit exists in any relevant repository
+    ///
+    /// # Returns
+    /// - `Ok(true)` if git data ready (either placeholder found or commit exists)
+    /// - `Ok(false)` if git data missing (should add to purgatory)
+    /// - `Err(msg)` on errors
+    pub async fn check_git_data_exists(&self, event: &Event) -> Result<bool, String> {
+        let event_id = event.id.to_hex();
+
+        // Extract the `c` tag (commit hash) from the PR event
+        let commit = event.tags.iter().find_map(|tag| {
+            let tag_vec = tag.clone().to_vec();
+            if tag_vec.len() >= 2 && tag_vec[0] == "c" {
+                Some(tag_vec[1].clone())
+            } else {
+                None
+            }
+        });
+
+        let commit = match commit {
+            Some(c) => c,
+            None => {
+                return Err(format!("PR event {} has no 'c' tag", event_id));
+            }
+        };
+
+        // Check for placeholder first (git-data-first scenario)
+        if let Some(placeholder_commit) = self.ctx.purgatory.find_pr_placeholder(&event_id) {
+            if placeholder_commit == commit {
+                // Perfect match - git data arrived first with matching commit
+                tracing::debug!(
+                    "Found matching placeholder for PR event {} with commit {}",
+                    event_id,
+                    commit
+                );
+                // Remove placeholder - event processing will continue normally
+                self.ctx.purgatory.remove_pr(&event_id);
+                return Ok(true);
+            } else {
+                // Placeholder has different commit - incoming event supersedes
+                tracing::info!(
+                    "PR event {} supersedes placeholder: event expects commit {}, placeholder has {}",
+                    event_id,
+                    commit,
+                    placeholder_commit
+                );
+                // Remove placeholder with old commit data
+                self.ctx.purgatory.remove_pr(&event_id);
+                // TODO: Also remove git data (refs/nostr/<event-id>) - Phase 5
+                // Fall through to check if new commit exists
+            }
+        }
+
+        // Check if commit exists in any repository referenced by this PR
+        // Extract ALL `a` tags (repository references) from the PR event
+        let repo_refs: Vec<String> = event
+            .tags
+            .iter()
+            .filter_map(|tag| {
+                let tag_vec = tag.clone().to_vec();
+                if tag_vec.len() >= 2 && tag_vec[0] == "a" && tag_vec[1].starts_with("30617:") {
+                    Some(tag_vec[1].clone())
+                } else {
+                    None
+                }
+            })
+            .collect();
+
+        if repo_refs.is_empty() {
+            // No repo references - cannot check git data
+            // This is unusual but let it through (other validation will catch issues)
+            return Ok(true);
+        }
+
+        // Check each repository to see if commit exists
+        for repo_ref in repo_refs {
+            // Parse the repo reference: 30617:<pubkey>:<identifier>
+            let parts: Vec<&str> = repo_ref.split(':').collect();
+            if parts.len() < 3 {
+                continue;
+            }
+
+            let repo_pubkey = match PublicKey::from_hex(parts[1]) {
+                Ok(pk) => pk,
+                Err(_) => continue,
+            };
+            let identifier = parts[2];
+
+            // Look up repository announcement to get the npub for path
+            let filter = Filter::new()
+                .kind(Kind::from(KIND_REPOSITORY_ANNOUNCEMENT))
+                .author(repo_pubkey)
+                .custom_tag(
+                    SingleLetterTag::lowercase(Alphabet::D),
+                    identifier.to_string(),
+                );
+
+            let announcements: Vec<Event> = match self.ctx.database.query(filter).await {
+                Ok(events) => events.into_iter().collect(),
+                Err(e) => {
+                    tracing::warn!(
+                        "Failed to query for repository announcement for PR {}: {}",
+                        event_id,
+                        e
+                    );
+                    continue;
+                }
+            };
+
+            if announcements.is_empty() {
+                continue;
+            }
+
+            // Check each matching announcement
+            for announcement_event in announcements {
+                let announcement = match RepositoryAnnouncement::from_event(announcement_event) {
+                    Ok(a) => a,
+                    Err(_) => continue,
+                };
+
+                // Build repository path
+                let repo_path = self.ctx.git_data_path.join(announcement.repo_path());
+
+                // Check if commit exists
+                if git::commit_exists(&repo_path, &commit) {
+                    tracing::debug!(
+                        "Found commit {} for PR event {} in repository {}",
+                        commit,
+                        event_id,
+                        repo_path.display()
+                    );
+                    return Ok(true);
+                }
+            }
+        }
+
+        // No git data found - should add to purgatory
+        tracing::debug!(
+            "No git data found for PR event {} with commit {}",
+            event_id,
+            commit
+        );
+        Ok(false)
+    }
+
     /// Validate refs/nostr/<event-id> ref against a PR or PR Update event's `c` tag
     ///
     /// When a PR event (kind 1618) or PR Update event (kind 1619) is received,
diff --git a/src/nostr/policy/state.rs b/src/nostr/policy/state.rs
index 43349e2..5e749ed 100644
--- a/src/nostr/policy/state.rs
+++ b/src/nostr/policy/state.rs
@@ -66,6 +66,24 @@ impl StatePolicy {
         let state = RepositoryState::from_event(event.clone())
             .map_err(|e| format!("Failed to parse state: {}", e))?;
 
+        // Check if ANY git repositories exist for this identifier (regardless of authorization)
+        // This helps us distinguish "no git data yet" from "not authorized" or "not latest"
+        let has_any_git_data = self.has_git_data_for_identifier(&state.identifier);
+
+        if !has_any_git_data {
+            // No git data exists yet - add to purgatory
+            tracing::debug!(
+                "No git data found for identifier {}, adding state event {} to purgatory",
+                state.identifier,
+                event.id.to_hex()
+            );
+            self.ctx
+                .purgatory
+                .add_state(event.clone(), state.identifier.clone(), event.pubkey);
+            // Return 0 repos aligned, but this is not an error
+            return Ok(0);
+        }
+
         // Identify owner repositories for which this is the latest authorized state
         let owner_repos = self.identify_owner_repositories(&state).await?;
         let repo_count = owner_repos.len();
@@ -97,13 +115,48 @@ impl StatePolicy {
             );
         } else {
             tracing::debug!(
-                "No owner repos to align for state - git data not available yet or not latest"
+                "No owner repos to align for state - git data exists but author not authorized or not latest"
             );
         }
 
         Ok(total_aligned)
     }
 
+    /// Check if any git repositories exist for the given identifier
+    ///
+    /// Scans the git_data_path for any directories matching the pattern:
+    /// `<any-npub>/<identifier>.git`
+    ///
+    /// This is used to distinguish "no git data yet" from "not authorized".
+    fn has_git_data_for_identifier(&self, identifier: &str) -> bool {
+        let git_data_path = &self.ctx.git_data_path;
+
+        // Check if git_data_path exists
+        if !git_data_path.exists() {
+            return false;
+        }
+
+        // Scan for any npub directories
+        let read_dir = match std::fs::read_dir(git_data_path) {
+            Ok(dir) => dir,
+            Err(_) => return false,
+        };
+
+        for entry in read_dir.flatten() {
+            if let Ok(file_type) = entry.file_type() {
+                if file_type.is_dir() {
+                    // Check if <npub>/<identifier>.git exists
+                    let repo_path = entry.path().join(format!("{}.git", identifier));
+                    if repo_path.exists() {
+                        return true;
+                    }
+                }
+            }
+        }
+
+        false
+    }
+
     /// Check if this state event is the latest for its identifier among authorized authors
     ///
     /// A state is considered "latest" if no other state event in the database