feat(swarm): migration 070 — nodes table for cryptographic identity (#75)

[Dewinator]

Closes #75. Second step of the Swarm Foundation Plan v1 — the cryptographic identity row that every later swarm phase depends on.

Summary

• New migration supabase/migrations/070_node_identity.sql creates nodes (node_id PK, pubkey BYTEA, display_name, is_self, created_at). Schema-only — no DROP, no DELETE, no data backfill.
• Partial unique index nodes_only_one_self ON nodes ((1)) WHERE is_self enforces "at most one row may carry is_self=true".
• Sibling TS contract test mcp-server/src/__tests__/migration-070-node-identity.test.ts pins the canonical SQL (column types, defaults, partial predicate) so any drift fails before the migration ever hits a real database.

Research summary

• Issue Swarm Phase 0: SWARM_SPEC.md — wire-format spec for the decentralized mycelium swarm #74 (Phase 0, docs/SWARM_SPEC.md) is closed — NodeAdvertisement is the canonical wire format this row backs, so no dependency note needed.
• Recent migration style (055, 061, 066) uses uppercase SQL keywords, TIMESTAMPTZ, BYTEA, BOOLEAN. Adopted.
• Tests live in mcp-server/src/__tests__/ and run via npm test (tsc && node --test). There is no pre-existing tests/sql/ directory — the existing pattern is TS contract pins (e.g. affect-recalled-event-type.test.ts). The test for migration 070 follows that pattern: read the raw SQL file, normalise whitespace + case, assert the structural contracts via regex. We cannot RUN the migration from tests (autonomy loop is forbidden from executing migrations — Reed runs them by hand after merge), so static contract pins are the right tool.

What this does NOT do

• Does NOT execute the migration. The file is committed only; Reed runs it manually.
• Does NOT include the keypair-generation script or the ~/.mycelium/node.key writer — that is Phase 1b (separate issue).
• Does NOT implement the node_identity_get MCP tool — also Phase 1b.
• Does NOT implement signature services — Phase 2.
• Does NOT touch any other migration file or any CI/CD configuration.

Constitution affirmation

Pillar 1 — Decentralized, networked AI / Souveränität. This is the touched pillar, and this PR strengthens it: the table schema deliberately stores only the public key and the derived node_id. The private key is excluded from the database by design and lives in a chmod-600 file at ~/.mycelium/node.key (documented in the migration header). A DB compromise alone cannot yield the secret. No other pillar (Reproduction, Swarm Intelligence, Microtransactions, Experts in the Swarm, Cyber Security) is weakened — Cyber Security is reinforced by the same separation.

Test plan

• cd mcp-server && npm test passes (259 tests; 9 of them new for migration 070).
• After merge, Reed runs cd scripts && bash migrate.sh (or applies 070_node_identity.sql directly) and confirms:
  • \d nodes shows columns node_id text PK, pubkey bytea NOT NULL, display_name text, is_self boolean NOT NULL DEFAULT false, created_at timestamptz NOT NULL DEFAULT now().
  • \di nodes_only_one_self shows the partial unique index with WHERE is_self.
  • INSERT INTO nodes (node_id, pubkey, is_self) VALUES ('x', '\x00', true); succeeds; a second INSERT INTO nodes (node_id, pubkey, is_self) VALUES ('y', '\x01', true); fails with a unique-violation on nodes_only_one_self.

🤖 Generated with Claude Code