78:Tc84,Route 2 from #1661, built to the outline in the closing comment there. ## What changes - **Transport.** `BLEAnnounceHandler` now reports its two signing-key rejections through a new `reportRefusedSigningKey` environment closure: the trust-on-first-use pin (`.pinnedKey`) and the key bound inside an authenticated Noise session (`.authenticatedKey`). `keyMismatch` stays log-only. `BLEService` turns the report into `TransportEvent.signingKeyRefused(peerID:noisePublicKey:signingPublicKey:reason:)` through `emitTransportEvent`, so it takes the same panic-gated main-actor hop as other transport events. - **Chat.** `ChatViewModel` routes the event to `ChatPeerIdentityCoordinator.warnOfRefusedSigningKey`, which adds a system notice to the chat already held with that contact: the open chat if it is theirs, otherwise the first with messages under the mesh ID, the full Noise key, or the bridged Nostr key. Nothing is migrated or trusted, and with no chat nothing is created. The chat is marked unread unless it is open. - **Name.** The notice names the contact through `resolveNickname(for:)`, from the local petname, the registry, or the persisted identity. The refused announce reached none of them, so the nickname it carried can't appear. - **De-dup.** The notice's ID is a fixed prefix plus the refused key, so the conversation store's per-chat ID index keeps it to one notice per offending key, with no new state to track or wipe. Signing keys cost nothing to generate, so per-key de-dup alone would let a stream of fresh keys fill the chat. No notice is added while the newest message already is one. - **Copy.** New key `system.identity.signing_key_refused`, translated into all 30 locales: "someone presented a different key for %@, and bitchat refused it. this chat keeps the key it already had." The translator comment says to keep it as refused, not changed. Left log-only on purpose: the registry's in-barrier refusal in `upsertVerifiedAnnounce`. It fires only when another announce wrote the pin between the trust check and the barrier. An established contact is caught by the trust check itself, which now reports. It's a one-line addition if you'd rather cover the race too. ## Tests - **Handler, on the real rejection paths** (modelled on `signingKeyMismatchWithPinnedKeySkipsUpsertAndIdentityPersistence`): both rejections report the refused key and their reason; a Noise-key mismatch and a verified announce report nothing. - **Service:** an announce that replays a seeded peer's Noise identity with another, validly self-signed signing key, injected into a real `BLEService`, reaches the event delegate as `.signingKeyRefused`. - **View model:** the event lands in the contact's chat. - **Coordinator:** one notice per key under the known name; fresh keys can't flood the chat; nothing is created without a chat; an open chat stays read; chats held under the Noise or Nostr key are found. Each test fails when its behavior is reverted (12 mutations, one per behavior). Locally, with xcodebuild, the full suites pass: macOS (2,211 Swift Testing and 214 XCTest tests) and the iOS 26.5 simulator (2,214 and 214). 🤖 Generated with [Claude Code](https://claude.com/claude-code) 79:T4d1, ## Codex Review Summary This comment shows the latest Codex review activity on this pull request. | Review | Status | Commit | Review trigger | | --- | --- | --- | --- | | 📝 **Code Review** | ⚠️ **Failed** 2026-10-26T00:14:51.068887Z
We couldn’t complete this review. Comment `@codex review` to try again. | `7864808` | PR opened |

ℹ️ About Codex in GitHub

[Your team has set up Codex to review pull requests in this repo](https://chatgpt.com/codex/cloud/settings/general). Reviews are triggered when you - Open a pull request for review - Mark a draft as ready - Comment "@codex review" or "@codex security review". Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

7a:T77f,Warn in the chat when bitchat refuses a different key for a contact An announce that carried a known peer's Noise identity with a signing key other than the one bound to it was refused and logged, and nothing else saw it. The two signing-key rejections in BLEAnnounceHandler now report the refusal: against the trust-on-first-use pin (.pinnedKey) and against the key bound inside an authenticated Noise session (.authenticatedKey). A Noise-key mismatch stays log-only. BLEService turns the report into a new TransportEvent.signingKeyRefused through the same panic-gated main-actor hop as other events, and ChatViewModel hands it to ChatPeerIdentityCoordinator. The coordinator warns in the chat already held with that contact: the open one if it is theirs, else the first with messages under the mesh ID, the full Noise key, or the bridged Nostr key. Nothing is migrated or trusted, and with no chat nothing is created. The copy says what happened: someone presented a different key for the contact, bitchat refused it, and the chat keeps the key it had. The name comes from what this device already knows, never from the refused announce. The notice's ID carries the refused key, so the store's per-chat ID index keeps it to one notice per offending key. Signing keys cost nothing to generate, so no notice is added while the newest message already is one; a stream of fresh keys cannot flood the chat. Tests: the handler reports both rejections with their reason and the refused key, and nothing for a Noise-key mismatch or a verified announce; a refused announce injected into a real BLEService reaches the event delegate; the view model routes the event into the contact's chat; and the coordinator warns once per key, holds against fresh keys, creates nothing without a chat, leaves an open chat read, and finds chats held under the Noise or Nostr key. Co-Authored-By: Claude Opus 5.5 62:["$","$L75",null,{"entries":[{"key":["platform",{"userId":"anon"},"pulls","page",{"owner":"permissionlesstech","repo":"bitchat","pullNumber":1820}],"data":{"repositoryId":"1517","detail":{"author":{"avatarUrl":"https://cdn.trylle.com/media/images/769234ff2584b2af0ef3a8f2b6f606ad?key=AWgh7%2BJK6RDET%2BM4HZIW31jy7qRQWLuBlrpE3A9VERz5QisYmjNzM8VvLL0O61hqh%2Bc%2FBJRsrTm%2B3n3DZD9riQwWs11HixBU%2F9l0KAAsQKlJvSAiynRVJ9pdqjLY3%2Bz5%2F3qBFUfXqCnBIk4IcfPhkMLJFUx55HYBm0geKfB%2FOjRS7eNidwMZauaHSl0%3D","externalProvider":"github","login":"RodsF1","type":"User","url":"https://github.com/RodsF1"},"authorId":"166758014","baseRefName":"main","closedAt":null,"comments":1,"createdAt":"2026-10-26T00:13:54Z","headRefName":"unknown repository","id":"4957441","isDraft":false,"labels":[],"number":1820,"repository":{"name":"bitchat","owner":"permissionlesstech","provider":"forgejo"},"state":"open","title":"Warn in the chat when bitchat refuses a different key for a contact","updatedAt":"2026-10-26T00:30:28Z","url":"https://trylle.com/permissionlesstech/bitchat/pulls/1820","body":"$78","additions":670,"deletions":0,"changedFiles":10,"commits":2,"reviewComments":0,"headSha":"d52d1ebd7ed323bc7d5c7f87a75d751f9300133d","baseSha":"04995f68e470a18d1fc99f86fa326c2a87bab4f2","headRepoOwner":"permissionlesstech","headRepoName":"bitchat","isMerged":false,"mergeCommitSha":null,"mergedBy":null,"mergeable":true,"mergeableState":"clean","conflictingFiles":null,"requestedTeams":[],"requestedReviewers":[],"graphqlId":"issue:1820"},"comments":[{"id":27021088,"graphqlId":"27021088","body":"$79","createdAt":"2026-10-26T00:14:06Z","author":{"avatarUrl":"https://cdn.trylle.com/media/images/fdedb714e9add836fd78428365411061?key=AbTl84PUpcB4AQFwbMXuaKdUswwUmlivTOVSlxm3nEp0jqDQNNmsjqx0pi8Gv5DD6U88zm8KvjR%2B2dq3EuWbeQbbulrG%2BlcEiJ5GsJS7eQphSJmBFHIx4QT60r62zC1isNJWQJxzZY0LYUmSwyBvW%2BiCNKisU%2BSqP%2Bj2mf0aULYPwb3WpCDJRPYTyYg%3D","externalProvider":"github","login":"chatgpt-codex-connector[bot]","type":"Bot","url":"https://github.com/apps/chatgpt-codex-connector"}}],"commits":[{"sha":"d52d1ebd7ed323bc7d5c7f87a75d751f9300133d","message":"Keep the context default's doc comment on its extension\n\nThe refused-key block landed between the doc comment for the\nChatPeerIdentityContext default and its extension, which SwiftLint\nflags as orphaned_doc_comment.\n\nCo-Authored-By: Claude Opus 5.5 \n","createdAt":"2026-10-25T17:30:25-07:00","author":{"avatarUrl":"","login":"","name":"Rod Bahmanyari","type":"User","url":""},"verification":{"verified":false,"reason":"gpg.error.not_signed_commit"}},{"sha":"7864808bea4ba1a2cdd6ef4ecf89c8feb5d422e6","message":"$7a","createdAt":"2026-10-25T16:43:04-07:00","author":{"avatarUrl":"","login":"","name":"Rod Bahmanyari","type":"User","url":""},"verification":{"verified":false,"reason":"gpg.error.not_signed_commit"}}],"events":[],"reviews":[],"stackEvents":[],"commentPagination":{"totalCount":1,"perPage":30,"loadedPages":[1]},"eventPagination":{"loadedPages":[1],"hasMore":false},"headRefDeleted":false},"fetchedAt":1793414478723}],"children":"$L7b"}] 64:null 6b:[["$","title","0",{"children":"Commits · Warn in the chat when bitchat refuses a different key for a contact · permissionlesstech/bitchat | Trylle"}],["$","meta","1",{"name":"description","content":"Commits on Warn in the chat when bitchat refuses a different key for a contact (#1820) in permissionlesstech/bitchat."}],["$","meta","2",{"name":"application-name","content":"Trylle"}],["$","link","3",{"rel":"manifest","href":"/manifest.json","crossOrigin":"$undefined"}],["$","meta","4",{"name":"keywords","content":"Commits · Warn in the chat when bitchat refuses a different key for a contact · permissionlesstech/bitchat, permissionlesstech/bitchat, permissionlesstech/bitchat repository, bitchat, Swift repository, source code, trylle, agent-native git platform, git platform for agents and humans, git platform for ai agents, coding agent pull requests, ai code review, repository automation, stacked pull requests, two-way github sync, github-compatible actions, try cli"}],["$","meta","5",{"name":"robots","content":"index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1"}],["$","meta","6",{"name":"mobile-web-app-capable","content":"yes"}],["$","meta","7",{"name":"googlebot","content":"index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1"}],["$","meta","8",{"name":"twitter:domain","content":"trylle.com"}],["$","meta","9",{"name":"twitter:url","content":"https://trylle.com/permissionlesstech/bitchat/pulls/1820/commits"}],["$","link","10",{"rel":"canonical","href":"https://trylle.com/permissionlesstech/bitchat/pulls/1820/commits"}],["$","meta","11",{"name":"format-detection","content":"telephone=no"}],["$","meta","12",{"name":"mobile-web-app-capable","content":"yes"}],["$","meta","13",{"name":"apple-mobile-web-app-title","content":"Trylle"}],["$","meta","14",{"name":"apple-mobile-web-app-status-bar-style","content":"black-translucent"}],["$","meta","15",{"property":"og:title","content":"Commits · Warn in the chat when bitchat refuses a different key for a contact · permissionlesstech/bitchat | Trylle"}],["$","meta","16",{"property":"og:description","content":"Commits on Warn in the chat when bitchat refuses a different key for a contact (#1820) in permissionlesstech/bitchat."}],["$","meta","17",{"property":"og:url","content":"https://trylle.com/permissionlesstech/bitchat/pulls/1820/commits"}],["$","meta","18",{"property":"og:site_name","content":"Trylle"}],["$","meta","19",{"property":"og:locale","content":"en_US"}],["$","meta","20",{"property":"og:image","content":"https://trylle.com/api/og.png?kind=repo&owner=permissionlesstech&repo=bitchat"}],["$","meta","21",{"property":"og:image:secure_url","content":"https://trylle.com/api/og.png?kind=repo&owner=permissionlesstech&repo=bitchat"}],["$","meta","22",{"property":"og:image:type","content":"image/png"}],["$","meta","23",{"property":"og:image:width","content":"1200"}],["$","meta","24",{"property":"og:image:height","content":"630"}],["$","meta","25",{"property":"og:image:alt","content":"permissionlesstech/bitchat repository preview on Trylle"}],["$","meta","26",{"property":"og:type","content":"website"}],["$","meta","27",{"name":"twitter:card","content":"summary_large_image"}],["$","meta","28",{"name":"twitter:site","content":"@trylle"}],["$","meta","29",{"name":"twitter:title","content":"Commits · Warn in the chat when bitchat refuses a different key for a contact · permissionlesstech/bitchat | Trylle"}],["$","meta","30",{"name":"twitter:description","content":"Commits on Warn in the chat when bitchat refuses a different key for a contact (#1820) in permissionlesstech/bitchat."}],["$","meta","31",{"name":"twitter:image","content":"https://trylle.com/api/og.png?kind=repo&owner=permissionlesstech&repo=bitchat"}],["$","meta","32",{"name":"twitter:image:alt","content":"permissionlesstech/bitchat repository preview on Trylle"}],["$","link","33",{"rel":"icon","href":"/favicon.png","type":"image/png"}],"$L7c","$L7d","$L7e"]

Commits on Sun, Oct 25, 2026

Commits on Mon, Oct 26, 2026