{"content":"Development journal for commit 5b62be63 (feat: on-chain owner trust grants + local block/contact store (P2)).\n\nTrust tiers P2 on feat-trust-tiers (commit builds on P1 b2eff259). (1) On-chain trust grants at /protocols/simpletrust: src/core/trust/trustGrantPins.ts builds/parses/publishes append-only grant pins {version, trustedOwner, note?, ts} and revoke pins {version, revoke: <grantPinId>, ts}. REVOKE SEMANTICS: pinId-referenced revoke payloads published as self-authenticating create pins at the same path — the spec-literal mechanic, chosen over simpleblock-style state flags because it cancels exactly the named grant (never reaches across to another grant), keeps history append-only like simpleblock/metatask amend, and a revoke of an unknown pinId is a defined no-op. Effective set = grants minus revokes per pinId, deduped per trustedOwner with the newest grant winning (doc: docs/metaid_protocols/09-simpletrust.md). (2) Generalized the P1 publish machinery into src/core/owner/identityChainPublisher.ts (subsidy-first funding + actionable top-up error, any non-profile identity); deviceOwnerBinding now delegates to it (one P1 test expectation reworded device->identity; error shape unchanged). (3) src/core/trust/trustedOwnerResolver.ts folds an owner's pins (injectable paged MANAPI lister added to ownerPinRead.ts) into the effective set, cached per owner gmid in a new grants section of trust-cache.json (TTL + pinId invalidation, same pattern as P1). (4) src/core/trust/trustLocalStore.ts: device-level {blocked, contacts} at ~/.metabot/owner/trust-local.json (atomic, 0600, defensive); blockGmid/unblockGmid also drop the peer's cached binding resolution. (5) src/core/trust/contactEvidence.ts: read-only two-way-exchange derivation from per-profile private-chat state + markContact/unmarkContact. (6) Daemon: /api/trust/{list,grant,revoke} + /api/block/{list,add,remove} handler groups wired like P1 owner; CLI: metabot trust list|grant|revoke (daemon-backed) and metabot block list|add|remove (pure local, no daemon needed). revoke accepts an owner gmid (revokes every effective grant to it; errors trust_grant_not_found when none) or a grant pinId. Design spec P2 status line + storage amendment updated (trust-local.json activated, trust-cache grants section). Tests: 21 new (grant/revoke roundtrip + publish incl. funding paths, effective-set fold incl. revoke-no-op/dup-grant/re-grant, resolver cache/TTL/persistence, local store CRUD + block invalidates cache, contact evidence two-way/one-way/missing) — 42/42 trust+owner tests pass, 108 owner/help/mainImport regression pass, daemonLifecycle 10/10. Gaps: grant resolution not exercised against live MANAPI (mocked), tier resolution/enforcement lands in P3/P4.\n\nVerification:\npnpm run build && node --test tests/trust/trustGrantPins.test.mjs tests/trust/trustedOwnerResolver.test.mjs tests/trust/trustLocalStore.test.mjs tests/trust/contactEvidence.test.mjs tests/trust/rootOwnerResolver.test.mjs tests/owner/deviceOwnerBinding.test.mjs && node --test tests/owner/*.test.mjs tests/cli/help.test.mjs tests/cli/mainImport.test.mjs\n\nFiles:\ndocs/metaid_protocols/09-simpletrust.md\ndocs/superpowers/specs/2026-04-23-metabot-storage-layout-v2-design.md\ndocs/superpowers/specs/2026-10-16-trust-tiers-permission-matrix-design.md\nsrc/cli/commandHelp.ts\nsrc/cli/commands/block.ts\nsrc/cli/commands/trust.ts\nsrc/cli/main.ts\nsrc/cli/runtime.ts\nsrc/cli/types.ts\nsrc/core/owner/deviceOwnerBinding.ts\nsrc/core/owner/identityChainPublisher.ts\nsrc/core/state/paths.ts\nsrc/core/trust/contactEvidence.ts\nsrc/core/trust/ownerPinRead.ts\nsrc/core/trust/rootOwnerResolver.ts\nsrc/core/trust/trustCacheStore.ts\nsrc/core/trust/trustGrantPins.ts\nsrc/core/trust/trustLocalStore.ts\nsrc/core/trust/trustedOwnerResolver.ts\nsrc/daemon/blockHandlers.ts\nsrc/daemon/defaultHandlers.ts\nsrc/daemon/httpServer.ts\nsrc/daemon/routes/block.ts\nsrc/daemon/routes/trust.ts\nsrc/daemon/routes/types.ts\nsrc/daemon/trustHandlers.ts\ntests/owner/deviceOwnerBinding.test.mjs\ntests/trust/contactEvidence.test.mjs\ntests/trust/trustGrantPins.test.mjs\ntests/trust/trustLocalStore.test.mjs\ntests/trust/trustedOwnerResolver.test.mjs","contentType":"text/plain;utf-8","attachments":[],"quotePin":""}