Pin nostr-sdk below 0.44, which the client code cannot build against

CI went red where the Tests workflow stayed green, and the reason is that the
two install from different lockfiles which had drifted apart: poetry.lock
held nostr-sdk 0.43.0, requirements.lock had resolved to 0.45.0 under the
unbounded `>=0.43`. Two lockfiles disagreeing about a protocol SDK is not a
CI quirk — it means the code was being tested against one version and shipped
against another.

0.44 removed NostrSigner's constructors, including the NostrSigner.keys the
client calls, and changed Client's constructor. Verified against 0.45.0:
NostrSigner is left with only get_public_key, sign_event and the nip04/nip44
methods, and Client.__init__ takes no arguments. So this is a real migration
touching signing and client setup, not a rename to be done in passing.

Bounded at <0.44 in all three places the constraint is declared, and both
lockfiles regenerated: requirements.lock resolves 0.43.1, poetry.lock keeps
0.43.0, and the relock changed exactly one line — the content hash — with no
version churn anywhere else. Confirmed 0.43.1 still exposes NostrSigner.keys
and a Client that takes an argument, since that is what CI will actually
install. pip-audit reports no advisory against the 0.43 line, so the bound
costs nothing today.

The migration is recorded in TODO.md rather than attempted here: it wants the
sync round-trip re-validated against a real relay, not folded into a CI fix.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01Vtx94nXDmNgXEeThUZP4QN

TODO.md

@@ -235,6 +235,24 @@ everything still open, in the order it should be tackled.
             It found one real defect — the config API accepting any key and
             any value, fixed in the same session — and one property worth
             recording rather than unilaterally changing, below.
+      - [ ] **Migrate `src/nostr/client.py` to nostr-sdk 0.44+.** The
+            dependency is pinned `>=0.43,<0.44` because 0.44 removed
+            `NostrSigner`'s constructors — `NostrSigner.keys(...)`, which
+            client.py:107 calls — and changed `Client`'s constructor, which
+            client.py:108 uses. Verified against 0.45.0: `NostrSigner` is left
+            with only `get_public_key`, `sign_event` and the nip04/nip44
+            methods, and `Client.__init__` takes no arguments.
+
+            This surfaced as CI red while the Tests workflow stayed green,
+            because the two install from different lockfiles and they had
+            drifted: `poetry.lock` held 0.43.0, `requirements.lock` had
+            resolved to 0.45.0 under the old unbounded `>=0.43`. Both are now
+            on the 0.43 line and agree. There is no advisory against 0.43, so
+            the bound costs nothing today — but it is a bound, and the
+            migration touches signing and client setup, so it wants doing
+            deliberately with the sync round-trip re-validated against a real
+            relay rather than folded into unrelated work.
+            (Found 2026-08-20 on the first CI run of this branch.)
       - [ ] **`textual` is an undeclared dependency, so the entire TUI test
             surface has never run in CI.** It appears in neither
             `[tool.poetry.dependencies]`, `[tool.poetry.extras]`, nor the dev

poetry.lock

@@ -3709,4 +3709,4 @@ gui-win = ["toga-winforms"]
 [metadata]
 lock-version = "2.1"
 python-versions = ">=3.10,<3.13"
-content-hash = "16864a37bf93ae5937963175fd1007e5420ef2d147823e14e3daddc34d724998"
+content-hash = "5ee2dfd080286da1852be627cfb93ab42827b0e649c2f927c23a4a3a98acb76a"

pyproject.toml

@@ -16,7 +16,7 @@ mnemonic = "*"
 aiohttp = ">=3.14.3"
 bcrypt = "*"
 portalocker = ">=2.8"
-nostr-sdk = ">=0.43"
+nostr-sdk = ">=0.43,<0.44"
 websocket-client = "1.7.0"
 websockets = ">=15.0.0"
 tomli = "*"
@@ -106,7 +106,7 @@ requires = [
     "aiohttp>=3.14.3",
     "bcrypt",
     "portalocker>=2.8",
-    "nostr-sdk>=0.43",
+    "nostr-sdk>=0.43,<0.44",
     "websocket-client==1.7.0",
     "websockets>=15.0.0",
     "tomli",

requirements.lock

@@ -1512,20 +1512,20 @@ mutmut==3.7.0 \
     --hash=sha256:1d2f9a1bfa4a474b2213df6b17223150b492bf4a85af0eda4fb322297337fb32 \
     --hash=sha256:dc93260fabb3a6fd3693aa8d1746825885cb6f9e66c7f9cc1a0f34fc6388e14a
     # via -r src/requirements.txt
-nostr-sdk==0.45.0 \
-    --hash=sha256:00da5e7e387515d1e12779eccfb2c794856f774b4534694200434aa0146a03ed \
-    --hash=sha256:15346b498f4df4bb42ef2987cecd9e97ba60294b9bc7bb486e1c4b6bee4f528e \
-    --hash=sha256:3b314b5160014bf70b39e95b3cf5cb059050e2fc2f782a0d9916c7ae1559e34f \
-    --hash=sha256:45ff1ae2f19fedfa9f91b0c81c1be755b706e2fd1e7865ea46612c2ad1d98a3e \
-    --hash=sha256:5a0fc63b69995bf2dac44e479aaec1ce1af71e687c9f4258891e429ed3db25e5 \
-    --hash=sha256:5bd1a6b972e9f5ae8c4f4448a148f668f124a3389b72eafb9de00f714e829059 \
-    --hash=sha256:78ccdb4766ae627ac9e2c10a7bb224d1e00da48fc7b61c7f48935ae23241fd64 \
-    --hash=sha256:8152945cb27b48bbf6f89d73d8560bfbadd202b8e5c165bf5b5532e91feed417 \
-    --hash=sha256:9d91d519a93c48ab4d689f975f406d8ee96e39d6876d2aeaaee58de7e66ded93 \
-    --hash=sha256:a20cb90f4fa225e57118431fc05d1d567a78a047dab54d34897365fcc5b82498 \
-    --hash=sha256:a7e0a886b427356dc94cd0b1bc8421b01eeb5aa9ea26e1b69c21f0a3cc1bc2ad \
-    --hash=sha256:b3904abc4d7e4ac46ed66c8aa528e89748f3f25023708e4bbab58bc81d3a99f7 \
-    --hash=sha256:e5cae5ef56411d6665de78c39822a4e80382231d44b4a6fc3db096b8b203ec26
+nostr-sdk==0.43.1 \
+    --hash=sha256:16d830574d74978cb01bd2464b319651d2d5e77f807eec8a17b154d305bca922 \
+    --hash=sha256:29f7c21ebbb2dc5d54aab30521e28da8bbcde8918ff9fdf519f9a30a6d6d6ed5 \
+    --hash=sha256:36fc37504912767493c642c0af1845fcd46eb2748eaed081cb31326a1ba4ad9c \
+    --hash=sha256:5a2b6d6a1bf46455b45fdf788ec9ff513e8b1de83eb39c8750a74ced56767986 \
+    --hash=sha256:6342d9aee9df7b26a8c570a0bbdec8a15307f19da72898bf2a2b52931c96fcef \
+    --hash=sha256:69009418f437f0df9b843757fc33344d0b849cf1c81b56f16e209301e30e133b \
+    --hash=sha256:6e432d3e10993447afabcf4dba39697ec07351660df1108fa9acc7787a7ee943 \
+    --hash=sha256:85f4ae5e98599e62564fc37c2e0b92692d823f2828b6b7bdbf198b11ca609fea \
+    --hash=sha256:8ddd0a90d728e4d8ee81f443043e6e2e8e090f4eebcb7b4f6f84a5459671629e \
+    --hash=sha256:9e37058e7c00b162418095d160bd2cc92bf3cbc81a439ba5c8baefa5a851d7b0 \
+    --hash=sha256:a43ade3ee1cf45452a981f324f2a87b20e11e2bdcb872c1ebe81e34521ae90e7 \
+    --hash=sha256:aa03f541ad64fcb332035f235a9b79d8fc0229740fb893beb26904d75859b43b \
+    --hash=sha256:f8fda6b129309d584f2e39b3152467f6a9001f767173f93632071f6c659cd9e1
     # via -r src/requirements.txt
 orjson==3.12.0 \
     --hash=sha256:010811c1b69773450a01cef97727a67b223242f350b77d4ca000e59a9ef2155a \

src/requirements.txt

@@ -11,7 +11,9 @@ pytest>=9.0.3,<10
 pytest-cov>=4,<7
 pytest-xdist>=3,<4
 portalocker>=2.8,<4
-nostr-sdk>=0.43,<1
+# 0.44 removed NostrSigner.keys and changed Client's constructor; the
+# client code does not build against it yet. See TODO.md.
+nostr-sdk>=0.43,<0.44
 websocket-client>=1.7,<2
 
 websockets>=15,<16