Weekly Pulse #2: Holochain makes direct signals require a committed grant

A migration service merged a notary-attestation flow on 30 September, allowing an app to fetch a committed closing summary and open on a successor DNA. Holochain merged a separate change to sign and verify actions with their authors on 29 September; desktop and mobile app tools merged a change to keep each window on the site it first loads on 30 September.

@ThetaSinner merged the change on 1 October; the sender’s capability secret now travels inside the signed message, preventing a relaying peer from stripping or swapping it.

Direct signals let agents push updates instead of relying only on polling, and the grant gives app developers a way to choose which agents may send them. Each receiver must commit permission for the sender; permission for a zome call does not cover a signal, and the receiver’s own key gets no automatic access. A coordinator zome must commit the grant, so a DNA with no zomes cannot receive direct signals under this change.

The migration service is an off-chain pipeline for unyt DNA migration. On 30 September, @zo-el merged a flow in which notaries check a closing summary before the old chain closes, then attest the committed close.

An app can fetch the committed closing-summary package over HTTP and open on the successor DNA with the attestations, instead of manually calling zomes on another person’s conductor. The author reports a live round trip with 3 daemons and 2 required attestations, with the successor accepting the open. The router returns a close only once enough notaries have attested it. The author also says the router must not reach main before its matching app release because it refuses v1 daemons.

Requests and Offers is a peer-to-peer board for requests and offers of services and resources. On 29 September, @AlchemicalSpiralizer merged an end-to-end hREA mirror: listings appear as proposals, accepted exchanges as agreements with commitments, and each side’s completion as an event that marks its commitment finished.

The author says the mirror was verified live on 2 peers, including completion events for both sides and the reciprocal commitment update.

The desktop and mobile tools support deploying Holochain apps with Tauri. On 30 September, @zippy merged a change after which a link cannot replace an app’s interface with a remote page that retains access to app functions.

The policy allows blob links from the same site so an interface can hand a file to the user. On desktop, links that try to open a new window open nothing; on Android, they load in the same view and face the navigation check, while iOS opens nothing. The first loaded site is observed from the web view, including the first page load on Android, so the app can use its actual loaded address.

@veeso merged a backport on 29 September that prevents agents from forging chain-closing actions by naming themselves as migration targets; it also checks signatures on agent activity and warrants received from peers.

Holochain merged #5999, backporting membrane-proof workflows to the 0.7 line, #6001, which checks signatures on validation receipts and drops invalid ones, and #6006, a backport of #6001. Wind-tunnel, a Holochain performance-testing project, merged #733 to report peer-connection test results, including connection times and errors.

AD4M, a framework for social networks, merged #1187 to change event and signal routing, listener subscriptions and listener handling; it also merged #1230 to queue overlapping language calls and make a test independent of result order. Requests and Offers merged #259 so either side of an exchange can mark its part complete first. Moss, a toolkit for group collaboration spaces, merged #249 for local speech-to-text in tools and #252 to fix message-protocol defects between applets and their host. AD4M’s #1168, by @HexaField, remains under review; it would make authentication fail closed when a token stops working.

ProofPoll, a desktop app for verified polls, published proofpoll-v0.4.0-beta.1 on 26 September, proofpoll-v0.4.0-beta.4 on 27 September and proofpoll-v0.4.0 on 28 September. Presence, a peer-to-peer video calling app, published v0.16.0 on 25 September.

Counted on 2 October, the ecosystem recorded 349 commits and 11 releases in the 7 days to 2 October. The 30-day totals were 92 releases and 106 active code bases; 46 people contributed in the 90 days to 2 October. The activity count, tallied on 3 October, was 26 pull requests merged by people and 30 automated updates in the 7 days to 2 October.

Commits per day were 19 on 26 September, 9 on 27 September and 52 on 28 September; the peak in the week was 68 on 29 September, followed by 44 on 30 September.