Adopt hzrd149 napplelets as a signed interoperability and design-practice corpus

[jodobear]

Parent: #9

User-provided upstream: https://github.com/hzrd149/napplelets/

Context

Uzel relies heavily on Good Morning as its positive-path napplet fixture. That leaves independent-producer interoperability, zero-capability rendering, storage/configuration, subscription cleanup, resizing, and wider domain behavior under-tested.

hzrd149/napplelets is also a strong design reference: runtime-owned injection, OUTBOX-first social access, explicit relay-local exceptions, lifecycle-bound subscriptions/object URLs, shell-owned storage/config/resources, strict single-file builds, and refusal to invent app-local NAP wire domains.

This corpus is interoperability evidence and design reference—not Uzel's protocol authority. NAP behavior remains governed by napplet/naps; Nostr data behavior remains NMP-owned.

Exact audit baseline

• Source: hzrd149/napplelets@aa4dc7a0799d95e3066b50055b29685d6e376045 (2026-07-26)
• License: MIT; attribution required for copied source
• Eight source napplets; pnpm/Turbo monorepo; local build/unit/type/conformance scripts; no GitHub Actions workflows
• Locked package resolution: @napplet/core/@napplet/nap 0.28.0, SDK 0.24.4, conformance CLI 0.2.15, Kehto CLI 0.2.16
• Published kind-35129 author: 266815e0c9210dfa324c6cba3573b14bee49da4209a9456f9484e5106cd408a5
• Live events signature-verified with pinned nak; Ditto, Primal, and nos.lol answered; Damus returned HTTP 503 during the probe
• All eight audited artifacts fetched from cdn.hzrd149.com; every byte SHA-256 matched its signed path tag
• Source commit and audited publication are only temporally associated. There is no source-commit attestation or independently proven reproducible source-to-artifact link.

A kind-35129 naddr is a replaceable coordinate. Deterministic tests must freeze the resolved event ID, author, d, required domains, path hash, aggregate hash, and artifact bytes—not trust the coordinate, title, relay hint, or HTTPS host alone.

Initial layered corpus

Napplet	Purpose	Boundary
Good Morning	Existing identity/OUTBOX/resource/link/theme control	Keep as overlap/control
Rubik Cube	Zero-grant iframe, resize, input, WebGL stress	Safest new positive case; large artifact
Nap Feed	Read-only config plus query/subscription lifecycle	Requires working config provider; useful/empty/explicit-error accepted
WiFi Map	Storage, OUTBOX subscription, resize, link boundary	Never automate outbound-link click

Defer Nostr Bubbles until relay-local ownership is explicit. Exclude Comic Upload and Article Highlights from automated tests because they expose upload/publication flows. dsui-gm-proto mostly duplicates Good Morning.

Recommended coordinates:

• Good Morning: naddr1qqxxwmm0vskk6mmjde5kuecpzemhxue69uhhyetvv9ujuurjd9kkzmpwdejhgq3qye5ptcxfyyxl5vjvdjar2ua3f0hynkjzpx552mu5snj3qmx5pzjsxpqqqzynjsul3vr
• Rubik Cube: naddr1qq98yatzd94j6cm4vfjsz9nhwden5te0wfjkccte9ec8y6tdv9kzumn9wspzqfngzhsvjggdlgeycm96x4emzjlwf8dyyzdfg4hefp89zpkdgz99qvzqqqyf8y9pvhkw
• Nap Feed: naddr1qqyxucts94nx2etyqyt8wumn8ghj7un9d3shjtnswf5k6ctv9ehx2aqzyqnxs90qeyssm73jf3kt5dtnk997ujw6ggy6j3t0jjzw2yrv6sy22qcyqqqgjwglxcuwy
• WiFi Map: naddr1qqy8w6txdykk6ctsqyt8wumn8ghj7un9d3shjtnswf5k6ctv9ehx2aqzyqnxs90qeyssm73jf3kt5dtnk997ujw6ggy6j3t0jjzw2yrv6sy22qcyqqqgjwggda37g

Relay hints are discovery hints only and do not change coordinate identity.

Required work

• Add a data-only external-corpus lock/registry.
• Resolve and fetch through production napd/NMP ownership; no renderer relay access.
• Verify signature, kind, author, d, path SHA-256, aggregate hash, exact bytes, and declared capabilities before review/install.
• Reject event/artifact drift until an explicit refresh PR revalidates it.
• Launch only through Uzel's strict-CSP opaque-origin iframe path.
• Exercise each fixture without upload, signing, publishing, or outbound navigation.
• Cover review, confirmation, NAP-SHELL, focus/input, narrow/short resizing, screenshot, cleanup, restart reconciliation, direct-network denial, and native-bridge isolation.
• Preserve append-only ignored success/failure evidence.
• Keep live corpus tests separate from deterministic mocked renderer acceptance and Uzel-owned fixtures.
• Adopt useful practices only through separate focused PRs; no wholesale framework/theme import.

Acceptance

• Good Morning remains green.
• Rubik Cube launches with zero grants and no native/network capability.
• Nap Feed reaches a useful loaded, empty, or explicit-error state and closes subscriptions.
• WiFi Map proves storage/subscription lifecycle without opening external links.
• At least one case contributes real rendered-image/resource evidence after Verify profile pictures through NAP-RESOURCE to rendered WebKit pixels #17.
• All four tolerate narrow and short frame sizes without shell layout failure.
• Hostile direct-network and native-bridge sentinels remain zero.
• Any resolved-event or hash drift fails closed with actionable diagnostics.
• All surfaces, subscriptions, object URLs, and harness processes are cleaned.
• No signer secret/private relay credential enters logs or Git.

Non-goals

• No bundled app store or automatic arbitrary publisher execution.
• No Kehto/Paja product dependency.
• No floating dependency ranges; Uzel retains exact pins.
• No copying publisher signer/keychain design.
• No source-to-binary reproducibility claim until independently proven.
• MIT repo license does not automatically settle every embedded third-party asset.

Dependencies

• Build a committed UI acceptance harness with reproducible screenshots #10 renderer acceptance baseline
• Complete signed-naddr loader UX and committed lifecycle coverage #13 signed naddr UX
• Verify profile pictures through NAP-RESOURCE to rendered WebKit pixels #17 real rendered-image proof
• Build and validate the nampplets merged-main successor before repinning Uzel #11 before any nampplets pin change

This does not block #19 and must not be implemented inside another issue branch.

[jodobear]

Audit follow-up: immutable baseline and execution split

No contradiction was found between this issue and the external-corpus audit. Add the following immutable tuples to the corpus registry rather than relying on each replaceable naddr alone:

Napplet	Event ID	Artifact path SHA-256	Aggregate SHA-256	Required domains
Good Morning	caef62ea8feb506d621f7f4c514fcb4322280cf3041d9e4801354b5d615f9d3b	ffd35eea5c84d03cdda74c23e1bbb2c40500f503833503aa688036faa52f3808	828a6df02afd56782ea20f805084acce65c53f7c37554948c1e0a64aa5a2b0a8	identity,inc,link,outbox,resource,theme
Rubik Cube	312bbf17fef533107d24c5682a9d58a62b7582252e912f90fb41d8d283038706	12057b8de4b76b931bd880e408630eb5bab58e269a5d8f9711c7ea03cb978ab8	e7906e9dc98f8f35359d5b6bf52eb8fd69a0726ad4a7c440c43ee14998ee8821	none
Nap Feed	e4445830b411d920e1f5fa4f74f58144f085a43e370ed39703e60207be9c7c9d	a3f03bc23808522d4f5c0c19b7b9567444173ce9105b8eef8ed50880836d28ea	4e1248038e9cfb6998a7981d08f5ea30ce21ecbe9b1d14f82c8a30fa18468dd1	config,identity,outbox,theme
WiFi Map	49e111745256e32af6a5b3dd02e54b731cd8848a2951e0cf6de0888ab52e1b99	3961e34469c74b0e194d260f9ae06e39535bd30d3bd207d28062cbc0833992fb	4b5a81c828423aaad3ee146e6a849cf39438f7f25ddf0a93d50362b21b41fbc9	link,outbox,storage,theme

The audited events were created at 2026-07-26T11:52:04Z; source commit aa4dc7a0799d95e3066b50055b29685d6e376045 followed 22 seconds later. This is strong temporal association, not reproducible-build proof.

Parallel execution boundary

Data-only corpus locking, provenance recording, artifact verification, and verifier tests may begin independently now. Signed-naddr launch integration waits for #13. Rendered resource/image acceptance waits for #17. Any nampplets pin change waits for #11.

Result classification

• Relay or artifact server unavailable: external-infrastructure failure; preserve evidence and do not misreport a Uzel trust violation.
• Invalid signature, wrong coordinate, unexpected event replacement, path mismatch, aggregate mismatch, or capability drift: security/trust failure; fail closed.
• Live discovery and deterministic replay must remain separately reported.

Interpretation limits

• Kehto deriving grants from requires is current compatibility behavior, not normative optional-domain semantics.
• Paja's development iframe.src/HMR path is not production iframe-isolation evidence.
• If parent Work 07: post-PR #8 live acceptance and coherent debugging #9 requires two distinct publishers rather than two independently released artifacts, this single-publisher corpus cannot satisfy that criterion; add another audited publisher.