Restore revisioned mobile backup protocol in public Relay

[antuz123]

The public Relay source omitted the revisioned backup endpoints called by the mobile recovery flow. This restores the existing guarded snapshot/repair implementation and synthetic regression fixtures, while retaining public local-mode and provider safeguards.

The source reads coherent account-scoped encrypted snapshots, rejects stale repairs and preserves concurrent backup records. Local Compose runs a single-member MongoDB replica set and waits for a writable primary because these paths use transactions. App contributor PR #7030 at 58208450c88c0aabd4a44df52630c35843c16484 pins the runtime source ee935359f22ff7932ea0a62e9084d4b49801f4aa for R4 local acceptance.

All four actual Copilot findings are addressed in 4c54e28: retained transactional backupGeneration prevents delete/recreate and A→B→A token reuse; malformed incremental account IDs never enter Mongo filters; archived collaborators no longer retain signer discovery mappings; null vault entries and empty fingerprints are typed request errors. Legacy label/key/node/incremental writes share the generation boundary. Empty legacy map arrays normalize only when saving incremental records; new accounts initialize proper maps.

Earlier validation through 4c54e28738815546718775dbbdb39f0342c1b646: Node 22 compile; 105/105 baseline and local-route tests; 96/96 backup revision, concurrency, account-scope, generation, legacy-map, node and route tests on disposable MongoDB 7 replica set; 6/6 native local HTTP snapshot/repair/stale-preservation/invalid-ID checks before the follow-up generation change; zero runtime audit findings; current-source and fetched-history Gitleaks; Compose config validation. CI runs both test suites and scans. All Copilot conversations resolved after fixes.

R4 follow-up fb93c887631a6f567155a88f8e93d566f9d32a53 removes a signer lookup when a complete active-vault save, archive, or unlink drops that signer and no active collaborator still lists it. Three synthetic regression cases cover revisioned repair, legacy full vault save, and shared archive/unlink behavior. Exact-head Build and test passed Node 22 compile, runtime audit, 105/105 baseline tests, and 99/99 disposable MongoDB replica-set backup tests; Source readiness passed current-source and fetched-history scans. This follow-up was subsequently included in ee935359f22ff7932ea0a62e9084d4b49801f4aa, which Utkarsh approved on 9 October 2026. App contributor PR #7030 replaced its previous fb93c887 pin at app head 58208450c88c0aabd4a44df52630c35843c16484, which pins Relay ee935359f22ff7932ea0a62e9084d4b49801f4aa; its checks and review are separate.

R4 legacy-client compatibility follow-up ee935359f22ff7932ea0a62e9084d4b49801f4aa: tagged Keeper v1.1.9–v2.1.0 sends walletObject, and v1.1.11–v2.1.0 also sends signersObjects, while this public route previously read only walletsObject/signersObject. Those old incremental writes could acknowledge success without persisting wallet/signer maps. The route now accepts each legacy name when the current name is absent; requests containing both names for one field return HTTP 400 before any mutation. Existing omissions are not backfilled. On an isolated MongoDB 7.0 replica set, Node 22 local route tests passed 17/17 focused and 104/104 full; source scan and diff check passed. Exact-head Build and test passed Node 22 compile, a zero-finding runtime audit of 450 packages, 105/105 baseline tests, and 104/104 disposable MongoDB replica-set backup tests. Source readiness passed current-source and fetched-history scans with no leaks. Review the compatibility and ambiguous-field policy before merge.

This PR publishes source only. No hosted deployment, production database operation or credential change is included. Hosted adoption must separately validate replica-set support, the account-scoped unique index and generation behavior in staging.

Cloud continuation — 12 October 2026

README-only head d4d59b080370637ac82e3a7cf6ef58564f9a22ac corrects the adapter checkout to app #7030 58208450c88c0aabd4a44df52630c35843c16484 and documents its actual Relay pin ee935359f22ff7932ea0a62e9084d4b49801f4aa. Runtime source is unchanged from that approved pinned head. In an isolated checkout, Node 22.23.3 frozen Yarn installation, TypeScript compile, 105/105 baseline/local-mode tests and 104/104 backup/account/legacy/concurrency tests on a disposable MongoDB 7 replica set passed; README pins, local links, newline and diff checks passed. Current-head hosted Build and test 38211800096 and Source readiness 38211800098 passed. The documentation update needs current-head review; the previous approval is source evidence for the old SHA, not a new-head approval. No mobile source pin was changed by this documentation fix. Mac-native tests are not needed for this README-only change; mobile/backend integration and hosted operator acceptance remain separate gates.

App source pin remains ee935359f22ff7932ea0a62e9084d4b49801f4aa; the new d4d59b0 head differs only in README and is runtime-source equivalent. No app native build input or public-source lock change is required by this documentation correction.

[Copilot]

Copilot review overview

🟡 Changes recommended

Stale revisions, unsafe account filters, and unreconciled signer mappings can cause incorrect backup mutations.

Review effort: Balanced
Findings: 2 · 2

Open (4)

• Use monotonic revision tokens for backup concurrency control · New
• Validate appId before using it in MongoDB filters · New
• Clean up mappings based on active participant images · New
• Normalize malformed vault entries as invalid backup requests · New

What changed in this PR

Restores Relay’s revisioned mobile backup protocol with transactional, account-scoped recovery while preserving legacy compatibility and local safeguards.

Changes:

• Adds snapshot/repair services, routes, validation, and collaborative vault isolation.
• Makes local and CI MongoDB deployments replica-set capable.
• Adds extensive backup, concurrency, routing, and security regression tests.

File	Description
src/​services/​backupSnapshot.ts	Implements transactional backup operations.
src/​services/​bhr.ts	Integrates guarded backup services.
src/​routes/​routes.ts	Exposes snapshot and repair routes.
src/​db.ts	Adds scoped vault storage and revision marker.
src/​localDevelopment.ts	Allows backup routes locally.
src/​tests/​security/​localBackupRoutes.test.ts	Tests local route restrictions.
tests/​backupSnapshot.test.cjs	Covers backup and concurrency behavior.
tests/​bhrIdentifierGuards.test.cjs	Tests identifier validation.
tests/​nodeReplacement.test.cjs	Tests explicit node replacement.
tests/​recoveryRoute.test.cjs	Tests recovery route responses.
tests/​disposableMongo.cjs	Provides safe test database URLs.
compose.local.yaml	Enables a local replica set.
compose.local-with-signing.yaml	Inherits base MongoDB readiness.
.github/​workflows/​build.yml	Runs backup tests against MongoDB.
package.json	Adds the backup test command.
README.md	Documents recovery and replica-set setup.
CONTRIBUTING.md	Adds backup tests to contributor checks.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[antuz123]

R4 backend acceptance handoff — 12 October 2026

State: BLOCKED_ON_STAGING_OPERATOR_ACCEPTANCE
Scope: Existing R4 source only. New Assisted Multisig remains pending Adam.

Source/compatibility evidence: Public Relay runtime pin ee93535 passed Node 22 compile, 105/105 baseline/local-mode and 104/104 Mongo 7 replica-set backup tests during this continuation. SigningServer #1 3cc7728c27328e7b0358d1f91a32d8d13feba90a, #2 73399398ed54237cf552461ae1001774ba431bff and #5 7c14b6e67325eab6be95fa1a5e03e855d96e985b merged without conflicts into isolated unpushed verification SHA 8de93e58358d0f9066c4ccda27fbeac474c9279d; Node 22.23.3 compile and 127/127 tests in 6 suites passed. All three source PRs and Relay #3 have Utkarsh's 9 October approvals on the pinned heads; hosted source/test checks on those unchanged heads are green. These are source/local-fixture results, not a deployed-service claim.

Operator/staging acceptance still required:

• Attest running source/artifact identity, effective route authorization and environment, dependency inventory, provider roles and log/access visibility using an approved private read-only process. Publish only non-sensitive SHA/build IDs and aggregate outcome categories.
• On a disposable staging replica set, attest transaction support and the actual account-scoped index; exercise readback/conditional repair, two writes from one revision, delete/recreate and A→B→A generation invalidation, cross-account isolation, malformed IDs, signer-map cleanup, archive/unlink and old-client walletObject/signersObjects aliases. Ambiguous old/current field pairs must reject before mutation; stale writes must preserve concurrent data.
• Verify synthetic old-client restore through mobile and hosted HTTP; the current contributor stack pin is not proof of production route parity. Use an independent contributor's own fork/identity to demonstrate clean setup and a scoped PR; never share a maintainer credential.
• For SigningServer migration, use synthetic V2 fixtures via staged HTTP with real route controls: unauthorized/invalid-token requests rejected, first migration and retry preserve migrationSuccessful/setup metadata and V2 policy/restrictions, outbound responses omit verifier, migrated scalar TOTP validates, retry leaves one V3/map.
• Inventory potentially malformed preexisting V3 records privately and obtain a separate reviewed repair decision. #5 leaves existing V3 records untouched.
• Verify staged SES and Google provider success/failure with scoped non-production roles; fixed operational log categories and method/status/size/duration access logs must omit request URLs, IDs, raw exceptions and secret/config values. AWS SDK v2 migration remains separate.
• Keep source approval, hosted CI, staging acceptance, deployment approval and running-artifact postflight as separate decisions. No deployment, credential change, owner backup mutation, production index action or funded operation has been authorized by this handoff.

Native Mac testing is not required to review backend source itself. The final app/Desktop Local handoff must separately record iOS/Android/physical signer round trips against explicitly identified compatible services.