Jan 8 Office Hours: capability-based access control with continuing invitations, IST incentives, ...

[dckc]

zoom recording
Passcode: 4UH=3&t5

Welcome, Agenda Building

Agoric - Deploy Secure DeFi in JavaScript

Office Hours · Agoric/agoric-sdk Wiki

How to find transactions that interacted with a particular contract

Jorge asked how to do it. @dckc recommended...

• SubQuery Indexing | Agoric Documentation
• Inside the Build: SubQuery (Indexing) - YouTube

for example, the vaults dashboard is built that way

• Vaults | Inter Protocol Dashboard

@tgrecojs noted a starter-project

• cosmos-subql-starter/Agoric/agoric-starter/project.ts at main · subquery/cosmos-subql-starter

capability-based access control with continuing invitations

Following up on a discord thread ...

• How do I make sure only the authorized party can do X? Where is the msg.sender address?

fennel re-stated his question: How do I make sure only the party that created a record can edit it?

@dckc explained a bit that msg.sender is an anti-pattern: identity-based access control lists.

• ACLs Don’t Tyler Close 2009

... and explained that instead, the Agoric architecture uses capability-based access control, where rights are reified as JavaScript objects. The pattern goes back to the erights.org web site and...

• An Ode to the Granovetter Diagram aka Capability-based
  Financial Instruments from 2000

A straightforward example is just a few lines long...

• Access Control with Objects | Agoric Documentation

To integrate with the blockchain and the smart wallet contract, the state-of-the-art is...

• continuing invitation pattern · Issue #667 · Agoric/documentation

This is the pattern that fennel is struggling with. Agoric doesn't have a simple example yet. We looked at some of fennel's code, and we started to review...

• Making an Offer - UI Tutorial - Agoric Documentation

Then @gacogo pointed out an example in a contract he's working on:

• onramp-price-registry/contract/src/onrampPriceRegistry.contract.js at main · gacogo/onramp-price-registry

fennel said that once he gets this working, he could perhaps write up a simple example.
@dckc said that would be fantastic! Pull requests on Agoric docs are more than welcome!
p.s. A quick show and tell discussion would be most welcome as well.

IST Liquidity Incentives and Community Pool Governance process

• Inter Protocol

@kennyrowe noted a lack of IST liquidity and suggested incentives. @dckc asked him to share some experience in that area and then noted that there's >4M BLD in the Agoric community pool, and we discussed the governance process around spending it.

• #50 proposal for funding the 2023 Economic Committee - Governance / Community Fund - Agoric Community Forum
• Proposal #50 Details - Agoric (BLD) Blockchain Explorer
• Cosmos Community-Spend Best Practices | by Gavin | Cosmos Ecosystem Blog

p.s. See, in particular...

• Agoric Community Fund Policy

bundle sizes and elideComments

• agoric run in Agoric CLI Reference | Agoric Documentation

• 9900 elide comments in bundles by turadg · Pull Request #9997 · Agoric/agoric-sdk

clean-up from an emerynet testnet problem

• Unbork Emerynet: Cleanup Auctioneers, PriceAuthorities, and QuoteNotifiers · Issue #10725 · Agoric/agoric-sdk

• don't reschedule auction's price notifier if we already have one by Chris-Hibbert · Pull Request #10615 · Agoric/agoric-sdk

devnet Instagoric

Holiday hacking with cloudflare workers (@dckc )

Time ran short, so rather than going into detail, @dckc recommended

• Why Workers environment variables contain live objects

which is cited from

• dckc/awesome-ocap: Awesome Object Capabilities and Capability Security