Module config 

On-disk state for wire.

Layout: $XDG_CONFIG_HOME/wire/ (defaults to ~/.config/wire/) - private.key — 32-byte raw Ed25519 seed (mode 0600) - agent-card.json — signed self-card (mode 0644, public) - trust.json — pinned peers + tiers - config.toml — relay URL, body cap, etc. (created lazily)

$XDG_STATE_HOME/wire/ (defaults to ~/.local/state/wire/) - inbox/<peer>.jsonl — verified inbound events - outbox/<peer>.jsonl — agent-appended outbound events (daemon flushes) - spool/ — daemon-internal staging

All paths are configurable via WIRE_HOME env var (overrides both dirs to $WIRE_HOME/{config,state}/). Used by the test harness to keep tests isolated from the operator’s real config.

Structs

DisplayOverrides

PendingPushPerPeer

Per-peer breakdown of queued-but-not-pushed events. Populates the new daemon.pending_push_breakdown field in wire status and the human-readable expansion of the “pending push:” line.

Functions

add_membership

Append an org membership the operator holds (org_did / org_pubkey / member_cert) for card-emit to attach. Replaces any existing entry for the same org_did (re-issued certs supersede).

agent_card_path

append_outbox_record

append_pushed_log

Append a single JSONL record to the outbox for peer, holding the per-path mutex to keep concurrent appenders from interleaving lines.

append_succession_record

Append a key-rotation succession record (RFC-001 §T19/§T20 audit trail). Append-only JSONL at config/wire/succession.jsonl; one line per rotation carrying the old_did → new_did handoff + the bridging cert.

compute_pending_push_breakdown

compute_pending_push_count

Total queued-but-not-yet-pushed events across all peers. Walks each per-peer outbox file, counts event_ids missing from the per-peer pushed log. Cheap (one disk read per peer) and bounded by trust.agents.

config_dir

Root configuration directory. Honors WIRE_HOME for testing.

config_toml_path

display_overrides_path

Path to display.json — operator-chosen character nickname + emoji override. Sidecar to agent-card. NOT signed (display-only, local-only).

drain_outbox_delivered

Remove already-delivered events from a peer’s outbox <peer>.jsonl, keeping only lines whose event_id is NOT in the peer’s pushed log — i.e. genuinely undelivered and transport-failed lines stay for retry. Without this the daemon re-reads + re-POSTs the whole append-only outbox every sync cycle (and on every inbound wake), re-blasting delivered events at the relay and growing the file unbounded. Atomic (tmp + rename) under the per-path outbox lock so it can’t race append_outbox_record. No-op when nothing is delivered yet (avoids needless rewrites).

ensure_dirs

Create directory tree with restrictive permissions on the config dir.

inbox_dir

is_initialized

Whether wire init has already been run (private key + card both present).

memberships_path

nostr_key_path

secp256k1 Nostr transport key (RFC-007 D3.1). Transport-only, never an identity anchor — stored separately from the Ed25519 session/op keys.

op_key_path

op_meta_path

org_key_path

outbox_dir

private_key_path

read_agent_card

read_display_overrides

read_display_overrides_at

read_memberships

Read the operator’s stored org memberships (empty if none/malformed).

read_nostr_key

read_op_handle

read_op_key

read_org_key

read_private_key

Read the saved private key seed (32 bytes).

read_pushed_event_ids

Read the set of event_ids already recorded as pushed for peer. Cheap (single file read + parse); callers that need bulk lifecycle data should read the file directly. Returns an empty set on missing/unreadable file.

read_relay_state

read_stream_state

Read $WIRE_HOME/state/wire/stream_state.json written by the daemon’s SSE subscriber. Value::Null when the file is absent or unreadable — callers should treat that as “stream subscriber hasn’t reported in yet” (cold start, or daemon predates #168).

read_trust

relay_state_path

Path to relay.json — holds our own slot binding and pinned peer slots. Contains slot-tokens, so always written mode 0600.

stale_sync

True when no sync has happened within the freshness window. None (= never synced here) is treated as stale. Shared between MCP + CLI so the boolean flips at the same moment in both surfaces.

state_dir

Root state directory (rotating data — inbox/outbox/spool).

succession_log_path

trust_path

update_relay_state

Atomic read-modify-write against relay.json. Holds an exclusive fs2::FileExt::lock_exclusive for the whole transaction so concurrent wire processes (multiple daemons, CLI vs daemon, CLI vs MCP) cannot race the cursor or peer-pin entries.

update_trust

Atomic read-modify-write against trust.json, mirroring update_relay_state (#246). The modifier sees a FRESH read and its result is persisted, all while holding the exclusive trust.lock — so a foreground pin (wire add / accept / promote) and the daemon’s pull-path pin can’t lost-update each other (each does read_trust → modify → write_trust unlocked, so without this both could read the same snapshot and the second write would drop the first’s pin). If the modifier returns Err, the prior state is untouched.

write_agent_card

write_display_overrides

write_nostr_key

write_op_handle

Persist the operator handle chosen at wire enroll op. The op_did derives from handle + op key; card-emit re-derives it at card-build time.

write_op_key

write_org_key

write_private_key

Write a private key file with mode 0600.

write_relay_state

Atomic, lock-serialized write of the full relay-state. Every direct caller (foreground wire dial, the background daemon, MCP) funnels through here, so a foreground write can neither TEAR nor lost-update against the daemon. Holds the same relay.lock flock as update_relay_state and writes via tmp+rename.

write_trust

Atomic, lock-serialized write of the full trust store (#246).