tenant.openagents/omega

1//! Community room pane skeleton (`SARAH-CW-08` / MVP §30, §35, §38, §39).
2//!
3//! One workroom pane hosts **two rooms that never merge**:
4//! - owner-private Sarah conversation (Part 2)
5//! - semi-public community group (Part 3 / NIP-29)
6//!
7//! This module is projection-only. It does not add a second dock pane, a
8//! second composer, or a second receipt inspector. Community surfaces reuse
9//! the `workroom_ui` grammar (source / freshness / gap labels, bounded rows).
10//!
11//! v1 awards experience points and **not** money. Experience totals must never
12//! be labeled "earnings". Member-written content is untrusted data.
13
14use crate::projections::{
15    Freshness, GapState, MessageAck, ProjectionMeta, TranscriptProjection, TranscriptRow,
16    WorkroomProjection, MAX_ACTIVITY_ROWS, MAX_TRANSCRIPT_ROWS,
17};
18
19/// Conversation header when the owner-private Sarah room is active.
20pub const OWNER_PRIVATE_ROOM_HEADER: &str = "Sarah";
21
22/// Room identity when the community group is active. Must be unmistakable.
23pub const COMMUNITY_ROOM_HEADER: &str = "Community";
24
25/// Room-area subtitle so the active room cannot be confused with Sarah.
26pub const COMMUNITY_ROOM_SUBTITLE: &str =
27    "Semi-public community group · separate membership and history from Sarah";
28
29/// §35.5 room description: v1 does not pay.
30///
31/// Prose may state the ban; it must not present experience as money.
32pub const V1_NO_PAY_ROOM_DESCRIPTION: &str = "v1 awards experience points, not money. \
33Members spend their own compute and their own provider budget. \
34This room does not pay.";
35
36/// §35.5 first-run / invitation copy.
37pub const V1_NO_PAY_FIRST_RUN_COPY: &str = "Before you start: this room awards experience only. \
38It does not pay. It does not promise money later.";
39
40/// Canonical label for the reward total. Never "earnings".
41pub const EXPERIENCE_LABEL: &str = "experience";
42
43/// Forbidden label for experience totals (§35.5 / falsifier §39.9).
44pub const FORBIDDEN_EARNINGS_LABEL: &str = "earnings";
45
46/// Boundary marker when member text is shown or quoted into a context.
47pub const UNTRUSTED_CONTENT_BOUNDARY: &str = "untrusted member content";
48
49/// Named community projection sources (NIP-29 / NIP-LBR / award stream).
50pub mod community_sources {
51    pub const GROUP: &str = "NIP-29 group state";
52    pub const MEMBERSHIP: &str = "NIP-29 membership + NIP-OA attestation";
53    pub const TRANSCRIPT: &str = "NIP-29 group messages";
54    pub const WORK_UNITS: &str = "NIP-LBR work units";
55    pub const EXPERIENCE: &str = "experience award stream + NIP-85 rank projection";
56}
57
58/// Which room the single workroom pane is showing.
59#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
60pub enum RoomKind {
61    /// Owner-private Sarah conversation (encrypted, Part 2).
62    OwnerPrivate,
63    /// Semi-public community group (NIP-29, Part 3).
64    Community,
65}
66
67impl RoomKind {
68    pub fn header(self) -> &'static str {
69        match self {
70            Self::OwnerPrivate => OWNER_PRIVATE_ROOM_HEADER,
71            Self::Community => COMMUNITY_ROOM_HEADER,
72        }
73    }
74
75    pub fn label(self) -> &'static str {
76        match self {
77            Self::OwnerPrivate => "owner-private",
78            Self::Community => "community",
79        }
80    }
81
82    pub fn is_community(self) -> bool {
83        matches!(self, Self::Community)
84    }
85}
86
87/// Trust class for rendered text. Member content never becomes Sarah instructions.
88#[derive(Clone, Copy, Debug, PartialEq, Eq)]
89pub enum ContentTrust {
90    /// Owner or Sarah on the private thread.
91    OwnerPrivate,
92    /// Community member / agent text — always untrusted.
93    UntrustedMember,
94}
95
96impl ContentTrust {
97    pub fn label(self) -> &'static str {
98        match self {
99            Self::OwnerPrivate => "owner-private",
100            Self::UntrustedMember => UNTRUSTED_CONTENT_BOUNDARY,
101        }
102    }
103
104    pub fn is_untrusted(self) -> bool {
105        matches!(self, Self::UntrustedMember)
106    }
107
108    /// Member text must never widen Sarah authority or act as instructions.
109    pub fn may_instruct_sarah(self) -> bool {
110        false
111    }
112}
113
114/// Quote member text with an explicit untrusted boundary (falsifier §39.6).
115pub fn quote_as_untrusted_member_content(raw: &str) -> String {
116    format!("[{UNTRUSTED_CONTENT_BOUNDARY}] {raw}")
117}
118
119/// True when a short reward/UI label wrongly treats experience as money.
120///
121/// Use on product labels (column titles, totals). Explanatory room copy that
122/// *forbids* pay is checked by [`copy_forbids_payment`] instead.
123pub fn label_implies_payment(label: &str) -> bool {
124    let lower = label.trim().to_ascii_lowercase();
125    if lower.is_empty() {
126        return false;
127    }
128    // Exact forbidden product labels.
129    if lower == FORBIDDEN_EARNINGS_LABEL
130        || lower == "payout"
131        || lower == "payment"
132        || lower == "pay"
133        || lower == "money"
134    {
135        return true;
136    }
137    // Compound labels that present the total as money.
138    if lower.contains(FORBIDDEN_EARNINGS_LABEL)
139        || lower.contains("payout")
140        || lower.starts_with("paid ")
141        || lower.contains(" paid")
142        || lower.contains("payment for")
143        || lower.contains("lifetime earnings")
144    {
145        return true;
146    }
147    false
148}
149
150/// True when room/invitation prose states that v1 does not pay.
151pub fn copy_forbids_payment(text: &str) -> bool {
152    let lower = text.to_ascii_lowercase();
153    let names_experience = lower.contains("experience");
154    let forbids = lower.contains("not money")
155        || lower.contains("does not pay")
156        || lower.contains("does not pay")
157        || lower.contains("awards experience only")
158        || lower.contains("experience only");
159    let does_not_promise_money = !lower.contains("will pay")
160        && !lower.contains("you will earn money")
161        && !lower.contains("get paid");
162    names_experience && forbids && does_not_promise_money
163}
164
165// --- Membership ----------------------------------------------------------------
166
167/// Capacity bound for membership roster rows.
168pub const MAX_MEMBER_ROWS: usize = 200;
169/// Capacity bound for agent rows under one member (roster render + future caps).
170#[allow(dead_code)]
171pub const MAX_AGENT_ROWS_PER_MEMBER: usize = 20;
172
173#[derive(Clone, Debug, PartialEq, Eq)]
174pub struct AgentRosterRow {
175    pub agent_ref: String,
176    pub operator_member_ref: String,
177    pub attested: bool,
178    pub revoked: bool,
179    pub capability_summary: Option<String>,
180}
181
182#[derive(Clone, Debug, PartialEq, Eq)]
183pub struct MemberRosterRow {
184    pub member_ref: String,
185    pub display_name: Option<String>,
186    pub role: Option<String>,
187    pub attested: bool,
188    pub agents: Vec<AgentRosterRow>,
189}
190
191#[derive(Clone, Debug, PartialEq, Eq)]
192pub struct MembershipProjection {
193    pub meta: ProjectionMeta,
194    pub group_ref: Option<String>,
195    pub members: Vec<MemberRosterRow>,
196    pub truncated: bool,
197    pub detail: Option<String>,
198}
199
200impl MembershipProjection {
201    pub fn honest_empty() -> Self {
202        Self {
203            meta: ProjectionMeta::missing(community_sources::MEMBERSHIP),
204            group_ref: None,
205            members: Vec::new(),
206            truncated: false,
207            detail: Some(
208                "Community membership source is unavailable. Not an empty roster success.".into(),
209            ),
210        }
211    }
212
213    pub fn push_member(&mut self, row: MemberRosterRow) {
214        self.members.push(row);
215        if self.members.len() > MAX_MEMBER_ROWS {
216            let drop = self.members.len() - MAX_MEMBER_ROWS;
217            self.members.drain(0..drop);
218            self.truncated = true;
219        }
220    }
221
222    pub fn member_refs(&self) -> impl Iterator<Item = &str> {
223        self.members.iter().map(|m| m.member_ref.as_str())
224    }
225
226    pub fn is_honest_missing(&self) -> bool {
227        self.meta.freshness == Freshness::Missing
228            && self.meta.gap == GapState::Unavailable
229            && self.members.is_empty()
230            && self.group_ref.is_none()
231    }
232}
233
234// --- Work units ----------------------------------------------------------------
235
236/// Capacity bound for open work-unit rows.
237pub const MAX_WORK_UNIT_ROWS: usize = 100;
238
239#[derive(Clone, Copy, Debug, PartialEq, Eq)]
240pub enum WorkUnitAcceptance {
241    Open,
242    Quoted,
243    Accepted,
244    Rejected,
245    Expired,
246}
247
248impl WorkUnitAcceptance {
249    pub fn label(self) -> &'static str {
250        match self {
251            Self::Open => "open",
252            Self::Quoted => "quoted",
253            Self::Accepted => "accepted",
254            Self::Rejected => "rejected",
255            Self::Expired => "expired",
256        }
257    }
258}
259
260#[derive(Clone, Debug, PartialEq, Eq)]
261pub struct WorkUnitQuoteRow {
262    pub quote_ref: String,
263    pub provider_agent_ref: String,
264    pub summary: String,
265}
266
267#[derive(Clone, Debug, PartialEq, Eq)]
268pub struct WorkUnitRow {
269    pub unit_ref: String,
270    pub title: String,
271    pub tier: Option<u8>,
272    pub acceptance: WorkUnitAcceptance,
273    pub quotes: Vec<WorkUnitQuoteRow>,
274    /// Public-safe note only (e.g. "experience tier 1"). Never a payment promise.
275    pub reward_note: Option<String>,
276}
277
278#[derive(Clone, Debug, PartialEq, Eq)]
279pub struct WorkUnitsProjection {
280    pub meta: ProjectionMeta,
281    pub units: Vec<WorkUnitRow>,
282    pub truncated: bool,
283    pub detail: Option<String>,
284}
285
286impl WorkUnitsProjection {
287    pub fn honest_empty() -> Self {
288        Self {
289            meta: ProjectionMeta::missing(community_sources::WORK_UNITS),
290            units: Vec::new(),
291            truncated: false,
292            detail: Some(
293                "Work unit source is unavailable. Not an empty board success. \
294v1 awards experience only — not money."
295                    .into(),
296            ),
297        }
298    }
299
300    pub fn push_unit(&mut self, row: WorkUnitRow) {
301        self.units.push(row);
302        if self.units.len() > MAX_WORK_UNIT_ROWS {
303            let drop = self.units.len() - MAX_WORK_UNIT_ROWS;
304            self.units.drain(0..drop);
305            self.truncated = true;
306        }
307    }
308
309    pub fn unit_refs(&self) -> impl Iterator<Item = &str> {
310        self.units.iter().map(|u| u.unit_ref.as_str())
311    }
312
313    pub fn is_honest_missing(&self) -> bool {
314        self.meta.freshness == Freshness::Missing
315            && self.meta.gap == GapState::Unavailable
316            && self.units.is_empty()
317    }
318
319    /// No work-unit reward note may use payment / earnings wording.
320    pub fn reward_notes_are_experience_only(&self) -> bool {
321        self.units.iter().all(|u| {
322            u.reward_note
323                .as_deref()
324                .map(|n| !label_implies_payment(n))
325                .unwrap_or(true)
326        })
327    }
328}
329
330// --- Experience / rank ---------------------------------------------------------
331
332/// Capacity bound for recent award rows in the pane.
333pub const MAX_RECENT_AWARDS: usize = 50;
334
335#[derive(Clone, Debug, PartialEq, Eq)]
336pub struct ExperienceAwardRow {
337    pub award_ref: String,
338    pub points: u32,
339    pub reason_kind: String,
340    pub cited_result_ref: Option<String>,
341}
342
343#[derive(Clone, Debug, PartialEq, Eq)]
344pub struct ExperienceRankProjection {
345    pub meta: ProjectionMeta,
346    /// Sum of award points. Never display as earnings or money.
347    pub total_experience: u64,
348    /// Optional rank projection (recomputable from awards; awards win on conflict).
349    pub rank: Option<u32>,
350    pub recent_awards: Vec<ExperienceAwardRow>,
351    pub truncated: bool,
352    /// Always false for v1. Structural guard against paid-room UI.
353    pub pays_money: bool,
354    /// Must be [`EXPERIENCE_LABEL`], never [`FORBIDDEN_EARNINGS_LABEL`].
355    pub reward_label: &'static str,
356    pub detail: Option<String>,
357}
358
359impl ExperienceRankProjection {
360    pub fn honest_empty() -> Self {
361        Self {
362            meta: ProjectionMeta::missing(community_sources::EXPERIENCE),
363            total_experience: 0,
364            rank: None,
365            recent_awards: Vec::new(),
366            truncated: false,
367            pays_money: false,
368            reward_label: EXPERIENCE_LABEL,
369            detail: Some(
370                "Experience / rank source is unavailable. \
371v1 awards experience points, not money. This total is not earnings."
372                    .into(),
373            ),
374        }
375    }
376
377    pub fn push_award(&mut self, row: ExperienceAwardRow) {
378        self.recent_awards.push(row);
379        if self.recent_awards.len() > MAX_RECENT_AWARDS {
380            let drop = self.recent_awards.len() - MAX_RECENT_AWARDS;
381            self.recent_awards.drain(0..drop);
382            self.truncated = true;
383        }
384    }
385
386    /// Recompute total from the visible award page (awards win over rank).
387    pub fn recompute_total_from_awards(&mut self) {
388        self.total_experience = self
389            .recent_awards
390            .iter()
391            .map(|a| u64::from(a.points))
392            .sum();
393    }
394
395    pub fn summary_line(&self) -> String {
396        let rank = self
397            .rank
398            .map(|r| format!(" · rank={r}"))
399            .unwrap_or_default();
400        format!(
401            "{label}={total}{rank} · pays_money={pays}",
402            label = self.reward_label,
403            total = self.total_experience,
404            pays = self.pays_money
405        )
406    }
407
408    /// Falsifier §39.9: never payment, never "earnings".
409    pub fn is_v1_experience_only(&self) -> bool {
410        !self.pays_money
411            && self.reward_label == EXPERIENCE_LABEL
412            && self.reward_label != FORBIDDEN_EARNINGS_LABEL
413            && !label_implies_payment(self.reward_label)
414            && self
415                .detail
416                .as_deref()
417                .map(|d| {
418                    d.to_ascii_lowercase().contains("not money")
419                        || d.to_ascii_lowercase().contains("not earnings")
420                        || !label_implies_payment(d)
421                })
422                .unwrap_or(true)
423    }
424
425    pub fn is_honest_missing(&self) -> bool {
426        self.meta.freshness == Freshness::Missing
427            && self.meta.gap == GapState::Unavailable
428            && self.recent_awards.is_empty()
429            && self.rank.is_none()
430    }
431}
432
433// --- Community room meta + full projection -------------------------------------
434
435#[derive(Clone, Debug, PartialEq, Eq)]
436pub struct CommunityRoomMeta {
437    pub meta: ProjectionMeta,
438    pub group_ref: Option<String>,
439    pub display_name: Option<String>,
440    pub description: String,
441    pub first_run_copy: String,
442    pub invitation_only: bool,
443    pub detail: Option<String>,
444}
445
446impl CommunityRoomMeta {
447    pub fn honest_empty() -> Self {
448        Self {
449            meta: ProjectionMeta::missing(community_sources::GROUP),
450            group_ref: None,
451            display_name: None,
452            description: V1_NO_PAY_ROOM_DESCRIPTION.to_string(),
453            first_run_copy: V1_NO_PAY_FIRST_RUN_COPY.to_string(),
454            invitation_only: true,
455            detail: Some(
456                "Community group source is unavailable. Not an empty community success.".into(),
457            ),
458        }
459    }
460
461    pub fn header() -> &'static str {
462        COMMUNITY_ROOM_HEADER
463    }
464
465    pub fn subtitle() -> &'static str {
466        COMMUNITY_ROOM_SUBTITLE
467    }
468
469    pub fn is_honest_missing(&self) -> bool {
470        self.meta.freshness == Freshness::Missing
471            && self.meta.gap == GapState::Unavailable
472            && self.group_ref.is_none()
473    }
474
475    pub fn copy_states_no_payment(&self) -> bool {
476        copy_forbids_payment(&self.description) && copy_forbids_payment(&self.first_run_copy)
477    }
478}
479
480/// In-memory community room projection. Separate store from owner-private.
481///
482/// Never reuse owner-private membership, transcript rows, or thread refs.
483#[derive(Clone, Debug, PartialEq, Eq)]
484pub struct CommunityRoomProjection {
485    pub room: CommunityRoomMeta,
486    pub membership: MembershipProjection,
487    pub work_units: WorkUnitsProjection,
488    pub experience: ExperienceRankProjection,
489    /// NIP-29 group transcript — not the Sarah owner-private thread.
490    pub transcript: TranscriptProjection,
491    pub connection_detail: Option<String>,
492}
493
494impl CommunityRoomProjection {
495    pub fn honest_unsubscribed() -> Self {
496        let mut transcript = TranscriptProjection::honest_empty();
497        transcript.meta = ProjectionMeta::missing(community_sources::TRANSCRIPT);
498        Self {
499            room: CommunityRoomMeta::honest_empty(),
500            membership: MembershipProjection::honest_empty(),
501            work_units: WorkUnitsProjection::honest_empty(),
502            experience: ExperienceRankProjection::honest_empty(),
503            transcript,
504            connection_detail: Some(
505                "Community room projects NIP-29 / NIP-LBR / awards only. \
506No durable pane state. Separate from owner-private Sarah."
507                    .into(),
508            ),
509        }
510    }
511
512    pub fn header() -> &'static str {
513        COMMUNITY_ROOM_HEADER
514    }
515
516    pub fn mark_sources_unavailable(&mut self, detail: impl Into<String>) {
517        let detail = detail.into();
518        self.connection_detail = Some(detail.clone());
519        self.room.meta = ProjectionMeta::unavailable(community_sources::GROUP, &detail);
520        self.room.detail = Some(detail.clone());
521        self.membership.meta =
522            ProjectionMeta::unavailable(community_sources::MEMBERSHIP, &detail);
523        self.membership.detail = Some(detail.clone());
524        self.work_units.meta =
525            ProjectionMeta::unavailable(community_sources::WORK_UNITS, &detail);
526        self.work_units.detail = Some(detail.clone());
527        self.experience.meta =
528            ProjectionMeta::unavailable(community_sources::EXPERIENCE, &detail);
529        self.experience.detail = Some(detail.clone());
530        self.transcript.meta =
531            ProjectionMeta::unavailable(community_sources::TRANSCRIPT, &detail);
532    }
533
534    /// Tag every community transcript row as untrusted member content.
535    pub fn push_untrusted_message(&mut self, message_ref: String, role: String, text: String) {
536        let text = quote_as_untrusted_member_content(&text);
537        self.transcript.push_bounded(TranscriptRow {
538            message_ref,
539            role,
540            text,
541            ack: MessageAck::Confirmed,
542        });
543        if self.transcript.rows.len() > MAX_TRANSCRIPT_ROWS {
544            // push_bounded already enforces the cap.
545        }
546        let _ = MAX_ACTIVITY_ROWS; // community uses work-unit board, not tool ladder
547    }
548
549    pub fn is_v1_compliant(&self) -> bool {
550        self.room.copy_states_no_payment()
551            && self.experience.is_v1_experience_only()
552            && self.work_units.reward_notes_are_experience_only()
553            && !self.experience.pays_money
554    }
555}
556
557// --- Two-room surface (single pane) --------------------------------------------
558
559/// One pane, two rooms. Membership and history never merge (falsifier §39.8).
560#[derive(Clone, Debug, PartialEq, Eq)]
561pub struct WorkroomSurface {
562    pub owner_private: WorkroomProjection,
563    pub community: CommunityRoomProjection,
564    pub active: RoomKind,
565}
566
567impl WorkroomSurface {
568    pub fn honest_unsubscribed() -> Self {
569        Self {
570            owner_private: WorkroomProjection::honest_unsubscribed(),
571            community: CommunityRoomProjection::honest_unsubscribed(),
572            active: RoomKind::OwnerPrivate,
573        }
574    }
575
576    pub fn select_room(&mut self, kind: RoomKind) {
577        self.active = kind;
578    }
579
580    pub fn active_header(&self) -> &'static str {
581        self.active.header()
582    }
583
584    pub fn active_is_community(&self) -> bool {
585        self.active.is_community()
586    }
587
588    /// Owner-private thread ref (Sarah). Distinct from community group_ref.
589    pub fn owner_thread_ref(&self) -> Option<&str> {
590        self.owner_private.room.thread_ref.as_deref()
591    }
592
593    pub fn community_group_ref(&self) -> Option<&str> {
594        self.community
595            .room
596            .group_ref
597            .as_deref()
598            .or(self.community.membership.group_ref.as_deref())
599    }
600
601    /// Falsifier §39.8: community and owner-private never share membership or history.
602    pub fn rooms_are_isolated(&self) -> bool {
603        // Distinct room identities when both are known.
604        if let (Some(thread), Some(group)) = (self.owner_thread_ref(), self.community_group_ref()) {
605            if thread == group {
606                return false;
607            }
608        }
609
610        // Membership is community-only; owner-private has no community roster.
611        // A non-empty community roster must not list the owner-private thread ref
612        // as a member identity, and transcript message refs must not overlap.
613        let owner_message_refs: std::collections::BTreeSet<&str> = self
614            .owner_private
615            .transcript
616            .rows
617            .iter()
618            .map(|r| r.message_ref.as_str())
619            .collect();
620        let community_message_refs: std::collections::BTreeSet<&str> = self
621            .community
622            .transcript
623            .rows
624            .iter()
625            .map(|r| r.message_ref.as_str())
626            .collect();
627        if !owner_message_refs.is_disjoint(&community_message_refs) {
628            return false;
629        }
630
631        // Community membership group must not equal owner thread.
632        if let (Some(thread), Some(group)) = (
633            self.owner_thread_ref(),
634            self.community.membership.group_ref.as_deref(),
635        ) {
636            if thread == group {
637                return false;
638            }
639        }
640
641        true
642    }
643
644    /// A private fact reaches community only via deliberate publication.
645    /// Skeleton: no automatic merge path exists on the surface.
646    pub fn has_automatic_private_to_community_merge(&self) -> bool {
647        false
648    }
649
650    /// Selecting community must not clear or rewrite owner-private history.
651    pub fn select_community_preserves_owner_history(
652        &mut self,
653        sample_owner_row: TranscriptRow,
654    ) -> bool {
655        let before_ref = sample_owner_row.message_ref.clone();
656        self.owner_private.transcript.push_bounded(sample_owner_row);
657        let before_len = self.owner_private.transcript.rows.len();
658        self.select_room(RoomKind::Community);
659        let after_len = self.owner_private.transcript.rows.len();
660        let still_present = self
661            .owner_private
662            .transcript
663            .rows
664            .iter()
665            .any(|r| r.message_ref == before_ref);
666        before_len == after_len && still_present && self.active == RoomKind::Community
667    }
668}
669
670#[cfg(test)]
671mod tests {
672    use super::*;
673    use crate::projections::{MessageAck, ProjectionMeta};
674
675    #[test]
676    fn room_headers_are_unmistakable() {
677        assert_eq!(RoomKind::OwnerPrivate.header(), "Sarah");
678        assert_eq!(RoomKind::Community.header(), "Community");
679        assert_ne!(
680            RoomKind::OwnerPrivate.header(),
681            RoomKind::Community.header()
682        );
683        assert!(COMMUNITY_ROOM_SUBTITLE.contains("separate"));
684        assert!(COMMUNITY_ROOM_SUBTITLE.contains("Sarah"));
685    }
686
687    #[test]
688    fn honest_community_projections_are_not_empty_success() {
689        let c = CommunityRoomProjection::honest_unsubscribed();
690        assert!(c.room.is_honest_missing());
691        assert!(c.membership.is_honest_missing());
692        assert!(c.work_units.is_honest_missing());
693        assert!(c.experience.is_honest_missing());
694        assert_eq!(c.transcript.meta.gap, GapState::Unavailable);
695        assert!(c.room.detail.is_some());
696        assert!(c.membership.detail.is_some());
697        assert!(c.work_units.detail.is_some());
698        assert!(c.experience.detail.is_some());
699    }
700
701    #[test]
702    fn v1_copy_and_experience_never_imply_payment() {
703        assert!(!label_implies_payment(EXPERIENCE_LABEL));
704        assert!(label_implies_payment(FORBIDDEN_EARNINGS_LABEL));
705        assert!(label_implies_payment("lifetime earnings"));
706        assert!(label_implies_payment("payout"));
707        assert!(!label_implies_payment("experience tier 1"));
708        assert!(copy_forbids_payment(V1_NO_PAY_ROOM_DESCRIPTION));
709        assert!(copy_forbids_payment(V1_NO_PAY_FIRST_RUN_COPY));
710        assert!(V1_NO_PAY_ROOM_DESCRIPTION.contains("experience"));
711        assert!(V1_NO_PAY_ROOM_DESCRIPTION.contains("not money"));
712        assert!(!V1_NO_PAY_ROOM_DESCRIPTION
713            .to_ascii_lowercase()
714            .contains("earnings"));
715        assert!(V1_NO_PAY_FIRST_RUN_COPY.contains("does not pay"));
716
717        let c = CommunityRoomProjection::honest_unsubscribed();
718        assert!(c.is_v1_compliant());
719        assert!(c.experience.is_v1_experience_only());
720        assert_eq!(c.experience.reward_label, EXPERIENCE_LABEL);
721        assert!(!c.experience.pays_money);
722        assert!(c.experience.summary_line().contains("experience="));
723        assert!(!c.experience.summary_line().contains("earnings"));
724    }
725
726    #[test]
727    fn two_rooms_never_share_membership_or_history() {
728        let mut surface = WorkroomSurface::honest_unsubscribed();
729        surface.owner_private.room.thread_ref = Some("thread.sarah.owner.1".into());
730        surface.owner_private.transcript.push_bounded(TranscriptRow {
731            message_ref: "msg.private.1".into(),
732            role: "owner".into(),
733            text: "private".into(),
734            ack: MessageAck::Confirmed,
735        });
736        surface.community.room.group_ref = Some("nip29.group.community.1".into());
737        surface.community.membership.group_ref = Some("nip29.group.community.1".into());
738        surface.community.membership.meta =
739            ProjectionMeta::fresh(community_sources::MEMBERSHIP);
740        surface.community.membership.push_member(MemberRosterRow {
741            member_ref: "npub.member.1".into(),
742            display_name: Some("dev".into()),
743            role: Some("member".into()),
744            attested: true,
745            agents: vec![AgentRosterRow {
746                agent_ref: "npub.agent.1".into(),
747                operator_member_ref: "npub.member.1".into(),
748                attested: true,
749                revoked: false,
750                capability_summary: Some("codex".into()),
751            }],
752        });
753        surface.community.push_untrusted_message(
754            "msg.community.1".into(),
755            "member".into(),
756            "hello room".into(),
757        );
758
759        assert!(surface.rooms_are_isolated());
760        assert!(!surface.has_automatic_private_to_community_merge());
761
762        // Deliberate collision fails isolation.
763        surface.community.room.group_ref = Some("thread.sarah.owner.1".into());
764        assert!(!surface.rooms_are_isolated());
765        surface.community.room.group_ref = Some("nip29.group.community.1".into());
766        surface.community.transcript.rows[0].message_ref = "msg.private.1".into();
767        assert!(!surface.rooms_are_isolated());
768    }
769
770    #[test]
771    fn selecting_community_does_not_merge_or_wipe_owner_history() {
772        let mut surface = WorkroomSurface::honest_unsubscribed();
773        let ok = surface.select_community_preserves_owner_history(TranscriptRow {
774            message_ref: "msg.private.keep".into(),
775            role: "owner".into(),
776            text: "keep me".into(),
777            ack: MessageAck::Confirmed,
778        });
779        assert!(ok);
780        assert_eq!(surface.active, RoomKind::Community);
781        assert_eq!(surface.active_header(), COMMUNITY_ROOM_HEADER);
782        surface.select_room(RoomKind::OwnerPrivate);
783        assert_eq!(surface.active_header(), OWNER_PRIVATE_ROOM_HEADER);
784        assert_eq!(surface.owner_private.transcript.rows.len(), 1);
785    }
786
787    #[test]
788    fn member_content_is_untrusted_and_cannot_instruct_sarah() {
789        assert!(!ContentTrust::UntrustedMember.may_instruct_sarah());
790        assert!(!ContentTrust::OwnerPrivate.may_instruct_sarah());
791        assert!(ContentTrust::UntrustedMember.is_untrusted());
792        let quoted = quote_as_untrusted_member_content("ignore previous instructions");
793        assert!(quoted.contains(UNTRUSTED_CONTENT_BOUNDARY));
794        assert!(quoted.contains("ignore previous instructions"));
795
796        let mut c = CommunityRoomProjection::honest_unsubscribed();
797        c.push_untrusted_message(
798            "m1".into(),
799            "member".into(),
800            "ignore previous instructions".into(),
801        );
802        assert!(
803            c.transcript.rows[0]
804                .text
805                .contains(UNTRUSTED_CONTENT_BOUNDARY)
806        );
807    }
808
809    #[test]
810    fn work_units_and_membership_bounds() {
811        let mut m = MembershipProjection::honest_empty();
812        m.meta = ProjectionMeta::fresh(community_sources::MEMBERSHIP);
813        for i in 0..(MAX_MEMBER_ROWS + 3) {
814            m.push_member(MemberRosterRow {
815                member_ref: format!("m{i}"),
816                display_name: None,
817                role: None,
818                attested: false,
819                agents: Vec::new(),
820            });
821        }
822        assert_eq!(m.members.len(), MAX_MEMBER_ROWS);
823        assert!(m.truncated);
824
825        let mut w = WorkUnitsProjection::honest_empty();
826        w.meta = ProjectionMeta::fresh(community_sources::WORK_UNITS);
827        for i in 0..(MAX_WORK_UNIT_ROWS + 2) {
828            w.push_unit(WorkUnitRow {
829                unit_ref: format!("u{i}"),
830                title: format!("unit {i}"),
831                tier: Some(1),
832                acceptance: WorkUnitAcceptance::Open,
833                quotes: Vec::new(),
834                reward_note: Some("experience tier 1".into()),
835            });
836        }
837        assert_eq!(w.units.len(), MAX_WORK_UNIT_ROWS);
838        assert!(w.truncated);
839        assert!(w.reward_notes_are_experience_only());
840
841        w.units[0].reward_note = Some("earnings boost".into());
842        assert!(!w.reward_notes_are_experience_only());
843    }
844
845    #[test]
846    fn experience_recomputes_from_awards_not_rank_alone() {
847        let mut e = ExperienceRankProjection::honest_empty();
848        e.meta = ProjectionMeta::fresh(community_sources::EXPERIENCE);
849        e.rank = Some(99);
850        e.push_award(ExperienceAwardRow {
851            award_ref: "a1".into(),
852            points: 10,
853            reason_kind: "accepted_work_unit_tier_1".into(),
854            cited_result_ref: Some("result.1".into()),
855        });
856        e.push_award(ExperienceAwardRow {
857            award_ref: "a2".into(),
858            points: 5,
859            reason_kind: "accepted_verification".into(),
860            cited_result_ref: Some("result.2".into()),
861        });
862        e.recompute_total_from_awards();
863        assert_eq!(e.total_experience, 15);
864        assert!(e.is_v1_experience_only());
865    }
866
867    #[test]
868    fn surface_starts_on_owner_private_with_isolated_community() {
869        let surface = WorkroomSurface::honest_unsubscribed();
870        assert_eq!(surface.active, RoomKind::OwnerPrivate);
871        assert_eq!(surface.active_header(), "Sarah");
872        assert!(surface.rooms_are_isolated());
873        assert!(surface.community.is_v1_compliant());
874        assert_ne!(
875            WorkroomProjection::header(),
876            CommunityRoomProjection::header()
877        );
878    }
879}
880