Fix/pagination

[toadkicker]

Fixes pagination in the registry and removes extraneous files

[greptile-apps]

Greptile Summary

This PR fixes the registry agents pagination (adding explicit braces around Leptos closure props) and bundles a large set of canvas/block-container additions including new shared types, frontend components, and a Tauri command for creating block containers from prompts. It also introduces a credentials table migration and a CredentialEntry CRUD layer in RegistryStore.

• Pagination fix (agents.rs): wraps disabled and on:click closures in {} to satisfy Leptos attribute parsing — targeted and correct.
• Credentials layer (db/mod.rs, migrations): declares CredentialEntry/CredentialsPage types and RegistryStore dispatch methods, but never adds the corresponding method bodies to SqliteStore or PostgresStore, leaving the build broken; the payload column also stores secrets as plaintext.
• Canvas block containers (block_container.rs, container.rs, new frontend components): introduces BlockContainer, wiring types, AgentCurationList/AgentSelector UI components, and canvas state signals — all new, with the main concern being that create_block_container hard-codes the canvas position to (100, 100) for every container.

Confidence Score: 1/5

Not safe to merge — the credential dispatch layer calls methods on SqliteStore and PostgresStore that do not exist, so the crate will not compile as written.

The RegistryStore credential methods delegate to SqliteStore/PostgresStore implementations that were never added. This is a build-breaking omission affecting every consumer of the registry crate. Additionally, the credentials migration stores secrets and tokens as cleartext, which is a meaningful security regression if the feature ships. The pagination fix itself is correct, but it is bundled with incomplete credential work that prevents the build from succeeding.

apps/registry/src/db/sqlite.rs and apps/registry/src/db/postgres.rs need the four credential method bodies added; apps/registry/src/db/migrations/sqlite/0004_add_credentials.sql needs an AFTER UPDATE trigger and application-layer payload encryption consideration.

Security Review

• Plaintext credential storage (apps/registry/src/db/migrations/sqlite/0004_add_credentials.sql, postgres/0004_add_credentials.sql): The payload column stores secrets, API tokens, and verifiable credentials as raw TEXT with no encryption. Anyone with direct database read access can extract all stored credentials in cleartext.

Important Files Changed

Filename	Overview
apps/registry/src/db/mod.rs	Adds CredentialEntry/CredentialsPage types and RegistryStore dispatch methods for CRUD, but the delegate calls reference methods that don't exist on SqliteStore or PostgresStore — will not compile.
apps/registry/src/db/sqlite.rs	Import updated to include CredentialEntry/CredentialsPage, but no credential method implementations are present; backing methods called by RegistryStore are missing entirely.
apps/registry/src/db/postgres.rs	Same as sqlite.rs — imports updated but credential method bodies absent, leaving RegistryStore dispatch unresolved at compile time.
apps/registry/src/db/migrations/sqlite/0004_add_credentials.sql	Adds credentials table for secrets/tokens/VCs with plaintext TEXT payload and no UPDATE trigger to refresh updated_at.
apps/registry/src/db/migrations/postgres/0004_add_credentials.sql	Postgres counterpart of the credentials migration; same plaintext payload concern, though Postgres triggers are typically added separately.
apps/registry/src/ui/pages/agents.rs	Core pagination fix: adds braces around closures in Leptos disabled/on:click props, correcting the original attribute-parsing issue.
apps/papillon/src/commands/canvas/container.rs	New Tauri command to create block containers from an intent; hard-codes position at (100,100) causing all new containers to overlap.
crates/papillon-shared/src/block_container.rs	New shared types for BlockContainer, BlockPosition, BlockConnection, and WiringError with unit tests; straightforward and correct.
apps/papillon/frontend/src/components/agent_curation_list.rs	New Leptos component for multi-agent curation with checkbox selection; initialization logic is gated on is_empty() to avoid overwriting user choices.
apps/papillon/frontend/src/state/canvas.rs	Adds workflow_panel_open and active_intent_plan signals to CanvasState, and container_id field to block construction sites.
crates/papillon-shared/src/types.rs	Adds optional container_id field to CanvasBlock with serde default; all construction sites in tests updated to include the new field.

Sequence Diagram

sequenceDiagram
    participant UI as AgentsPage (Leptos)
    participant API as registry API
    participant Store as RegistryStore
    participant SQLite as SqliteStore
    participant PG as PostgresStore

    UI->>API: list_agents(query, page, per_page)
    API->>Store: search_agents(q, ver, page, per_page)
    Store->>SQLite: search_agents(...) [SQLite path]
    SQLite-->>Store: "AgentsPage {items, total, total_pages}"
    Store-->>API: AgentsPage
    API-->>UI: AgentsListResponse
    UI->>UI: render pagination (fixed braces)

    Note over Store,SQLite: Credential methods declared in RegistryStore...
    Store->>SQLite: list_credentials(...) method missing
    Store->>PG: list_credentials(...) method missing

Loading

Prompt To Fix All With AI

Fix the following 4 code review issues. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 4
apps/registry/src/db/mod.rs:188-223
**Missing method implementations on backing stores**

`RegistryStore` dispatches `list_credentials`, `insert_credential`, `update_credential`, and `delete_credential` to `SqliteStore` and `PostgresStore`, but neither store implements those methods — only the import line was updated in each file. Rust will fail to compile because `s.list_credentials(...)` and friends are called on types that have no such method defined.

### Issue 2 of 4
apps/registry/src/db/migrations/sqlite/0004_add_credentials.sql:4-11
**Plaintext secret storage**

The `payload` column stores secrets, API tokens, and verifiable credentials as plaintext `TEXT`. Any user with read access to the SQLite file or Postgres database can extract all credentials without any additional secret. Consider encrypting the payload at the application layer (e.g., with a key derived from a master secret) before writing to this column, and never log or serialize its contents directly.

### Issue 3 of 4
apps/registry/src/db/migrations/sqlite/0004_add_credentials.sql:9
**`updated_at` never refreshed on UPDATE**

The `updated_at` column defaults to the creation timestamp but there is no trigger to update it when a row is modified. On SQLite, `DEFAULT (strftime(...))` only fires on `INSERT`. Add an `AFTER UPDATE` trigger so `update_credential` actually reflects the modification time; otherwise every consumer of this column will see stale data.

### Issue 4 of 4
apps/papillon/src/commands/canvas/container.rs:88-91
**All containers placed at the same hard-coded position**

Every call to `create_block_container` places the new container at `x: 100.0, y: 100.0`. When a user creates two or more containers they will be stacked exactly on top of each other with no way to distinguish them visually. Pass the desired position in from the caller or at minimum apply a small randomised or incrementing offset.

_{Reviews (1): Last reviewed commit: "cleanup of formatting/unneccesary files" | Re-trigger Greptile}

[greptile-apps]

Missing method implementations on backing stores

RegistryStore dispatches list_credentials, insert_credential, update_credential, and delete_credential to SqliteStore and PostgresStore, but neither store implements those methods — only the import line was updated in each file. Rust will fail to compile because s.list_credentials(...) and friends are called on types that have no such method defined.

Prompt To Fix With AI

This is a comment left during a code review.
Path: apps/registry/src/db/mod.rs
Line: 188-223

Comment:
**Missing method implementations on backing stores**

`RegistryStore` dispatches `list_credentials`, `insert_credential`, `update_credential`, and `delete_credential` to `SqliteStore` and `PostgresStore`, but neither store implements those methods — only the import line was updated in each file. Rust will fail to compile because `s.list_credentials(...)` and friends are called on types that have no such method defined.

How can I resolve this? If you propose a fix, please make it concise.

[greptile-apps]

Plaintext secret storage

The payload column stores secrets, API tokens, and verifiable credentials as plaintext TEXT. Any user with read access to the SQLite file or Postgres database can extract all credentials without any additional secret. Consider encrypting the payload at the application layer (e.g., with a key derived from a master secret) before writing to this column, and never log or serialize its contents directly.

Prompt To Fix With AI

This is a comment left during a code review.
Path: apps/registry/src/db/migrations/sqlite/0004_add_credentials.sql
Line: 4-11

Comment:
**Plaintext secret storage**

The `payload` column stores secrets, API tokens, and verifiable credentials as plaintext `TEXT`. Any user with read access to the SQLite file or Postgres database can extract all credentials without any additional secret. Consider encrypting the payload at the application layer (e.g., with a key derived from a master secret) before writing to this column, and never log or serialize its contents directly.

How can I resolve this? If you propose a fix, please make it concise.

[greptile-apps]

updated_at never refreshed on UPDATE

The updated_at column defaults to the creation timestamp but there is no trigger to update it when a row is modified. On SQLite, DEFAULT (strftime(...)) only fires on INSERT. Add an AFTER UPDATE trigger so update_credential actually reflects the modification time; otherwise every consumer of this column will see stale data.

Prompt To Fix With AI

This is a comment left during a code review.
Path: apps/registry/src/db/migrations/sqlite/0004_add_credentials.sql
Line: 9

Comment:
**`updated_at` never refreshed on UPDATE**

The `updated_at` column defaults to the creation timestamp but there is no trigger to update it when a row is modified. On SQLite, `DEFAULT (strftime(...))` only fires on `INSERT`. Add an `AFTER UPDATE` trigger so `update_credential` actually reflects the modification time; otherwise every consumer of this column will see stale data.

How can I resolve this? If you propose a fix, please make it concise.

[greptile-apps]

All containers placed at the same hard-coded position

Every call to create_block_container places the new container at x: 100.0, y: 100.0. When a user creates two or more containers they will be stacked exactly on top of each other with no way to distinguish them visually. Pass the desired position in from the caller or at minimum apply a small randomised or incrementing offset.

Prompt To Fix With AI

This is a comment left during a code review.
Path: apps/papillon/src/commands/canvas/container.rs
Line: 88-91

Comment:
**All containers placed at the same hard-coded position**

Every call to `create_block_container` places the new container at `x: 100.0, y: 100.0`. When a user creates two or more containers they will be stacked exactly on top of each other with no way to distinguish them visually. Pass the desired position in from the caller or at minimum apply a small randomised or incrementing offset.

How can I resolve this? If you propose a fix, please make it concise.

[github-actions]

Benchmark Regression Report

PAP Protocol Benchmark Regression Check
========================================
Baseline: .bench-baseline/baseline.json
Threshold: 55%

  ed25519_keypair_generation                19.6 µs  (baseline: 19.7 µs, -0.4%)  [ok]
  did_key_derivation                         1.5 µs  (baseline: 1.5 µs, +1.7%)  [ok]
  mandate_create_sign                       23.9 µs  (baseline: 23.9 µs, +0.0%)  [ok]
  mandate_chain_verify_depth3              157.0 µs  (baseline: 150.0 µs, +4.6%)  [ok]
  sd_jwt_issue_5claims                      28.1 µs  (baseline: 27.8 µs, +1.0%)  [ok]
  sd_jwt_verify_disclose_3of5               54.1 µs  (baseline: 50.9 µs, +6.1%)  [ok]
  session_open_full_lifecycle              108.2 µs  (baseline: 114.1 µs, -5.2%)  [ok]
  receipt_create_cosign                     48.2 µs  (baseline: 48.1 µs, +0.1%)  [ok]
  federation_announce_local                 68.6 µs  (baseline: 62.2 µs, +10.3%)  [ok]


P99 Tail-Latency Check
----------------------
Results: target/p99_results.json
Threshold: 50%

  session_open_full_lifecycle(p99)         120.1 µs  (baseline: 500.0 µs, -75.9%)  [ok]
  mandate_chain_verify_depth3(p99)         163.7 µs  (baseline: 480.0 µs, -65.9%)  [ok]
  receipt_create_cosign(p99)                57.8 µs  (baseline: 210.0 µs, -72.4%)  [ok]

All benchmarks within 55% of baseline.

_{Threshold: 10% regression vs baseline from main}

[luisllaver]

"Related to this issue, we should consider integrating the AURA Open Protocol's trust-check primitive (GET https://agent.auraopenprotocol.org/check) to provide a more robust trust assessment for agents in the registry. This can be done by calling the trust-check endpoint from the beforeSettle hook, as described in the AURA Open Protocol documentation (https://dev.auraopenprotocol.org). By doing so, we can ensure that agents with a strong reputation baseline are prioritized, and trust is established through real interaction history. Would love to discuss further how this can beEnvelope integrated into the fix."