[P2-10] gateway: social follow-graph routes (server-add for the visible Social tab)

No follow storage existed. Added runtime/social/follows.py (social_follows table:
follower, followee, created_at) + four routes:
  POST /social/follow · POST /social/unfollow (follower = X-Wallet-Address)
  GET /social/{address}/followers · GET /social/{address}/following

Postcondition: tests/test_social_follows.py 3 passed (store roundtrip, self-follow
ignored, live route follow->followers); seam clean; full suite green.

Author: Neo

gateway/server.py

@@ -712,6 +712,49 @@ async def handle_auth_verify(self, request: web.Request) -> web.Response:
             "expires_at": expires_at,
         })
 
+    # ─── Social follow graph (P2-10) ──────────────────────────────────────
+
+    def _follow_store(self):
+        from runtime.social.follows import FollowStore
+        return FollowStore(self.react_loop.memory.db)
+
+    async def handle_social_follow(self, request: web.Request) -> web.Response:
+        """POST /social/follow — {address}. Follower = X-Wallet-Address."""
+        follower = request.headers.get("X-Wallet-Address", "").strip()
+        try:
+            body = await request.json()
+        except json.JSONDecodeError:
+            return web.json_response({"error": "invalid JSON"}, status=400)
+        followee = str(body.get("address", "")).strip()
+        if not follower or not followee:
+            return web.json_response({"error": "address required"}, status=400)
+        await self._follow_store().follow(follower, followee)
+        return web.json_response({"success": True, "following": followee})
+
+    async def handle_social_unfollow(self, request: web.Request) -> web.Response:
+        follower = request.headers.get("X-Wallet-Address", "").strip()
+        try:
+            body = await request.json()
+        except json.JSONDecodeError:
+            return web.json_response({"error": "invalid JSON"}, status=400)
+        followee = str(body.get("address", "")).strip()
+        if not follower or not followee:
+            return web.json_response({"error": "address required"}, status=400)
+        await self._follow_store().unfollow(follower, followee)
+        return web.json_response({"success": True, "unfollowed": followee})
+
+    async def handle_social_followers(self, request: web.Request) -> web.Response:
+        address = request.match_info.get("address", "").strip()
+        followers = await self._follow_store().followers(address)
+        return web.json_response({"address": address, "followers": followers,
+                                  "count": len(followers)})
+
+    async def handle_social_following(self, request: web.Request) -> web.Response:
+        address = request.match_info.get("address", "").strip()
+        following = await self._follow_store().following(address)
+        return web.json_response({"address": address, "following": following,
+                                  "count": len(following)})
+
     # ─── Sign in with Apple (P1-8) ────────────────────────────────────────
 
     async def handle_apple_auth(self, request: web.Request) -> web.Response:
@@ -1786,6 +1829,11 @@ def create_app(self) -> web.Application:
         app.router.add_get("/social/trending", self.handle_social_trending)
         app.router.add_get("/social/actor/{wallet}", self.handle_social_actor)
         app.router.add_get("/social/stats", self.handle_social_stats)
+        # Follow graph (P2-10)
+        app.router.add_post("/social/follow", self.handle_social_follow)
+        app.router.add_post("/social/unfollow", self.handle_social_unfollow)
+        app.router.add_get("/social/{address}/followers", self.handle_social_followers)
+        app.router.add_get("/social/{address}/following", self.handle_social_following)
 
         # ── A2A commerce ──────────────────────────────────────────────
         app.router.add_get("/a2a/services", self.handle_a2a_services)

runtime/social/follows.py

@@ -0,0 +1,62 @@
+"""P2-10: minimal social follow-graph storage.
+
+Backs GET /social/{address}/followers|following and POST /social/follow|unfollow.
+Async sqlite, matching the feed_engine DB style.
+"""
+
+from __future__ import annotations
+
+import logging
+import time
+from typing import Any
+
+logger = logging.getLogger(__name__)
+
+_CREATE_TABLE = """
+CREATE TABLE IF NOT EXISTS social_follows (
+    follower   TEXT,
+    followee   TEXT,
+    created_at REAL,
+    PRIMARY KEY (follower, followee)
+)
+"""
+
+
+class FollowStore:
+    def __init__(self, db: Any) -> None:
+        self._db = db
+        self._ready = False
+
+    async def _ensure(self) -> None:
+        if not self._ready:
+            await self._db.execute(_CREATE_TABLE)
+            self._ready = True
+
+    async def follow(self, follower: str, followee: str) -> None:
+        await self._ensure()
+        if not follower or not followee or follower == followee:
+            return
+        await self._db.execute(
+            "INSERT OR IGNORE INTO social_follows (follower, followee, created_at) "
+            "VALUES (?, ?, ?)",
+            (follower, followee, time.time()),
+        )
+
+    async def unfollow(self, follower: str, followee: str) -> None:
+        await self._ensure()
+        await self._db.execute(
+            "DELETE FROM social_follows WHERE follower = ? AND followee = ?",
+            (follower, followee),
+        )
+
+    async def followers(self, address: str) -> list[str]:
+        await self._ensure()
+        rows = await self._db.fetchall(
+            "SELECT follower FROM social_follows WHERE followee = ?", (address,))
+        return [r[0] for r in rows]
+
+    async def following(self, address: str) -> list[str]:
+        await self._ensure()
+        rows = await self._db.fetchall(
+            "SELECT followee FROM social_follows WHERE follower = ?", (address,))
+        return [r[0] for r in rows]

tests/test_social_follows.py

@@ -0,0 +1,55 @@
+"""P2-10: social follow-graph store + routes."""
+
+import pytest
+
+from runtime.db.database import Database
+from runtime.social.follows import FollowStore
+
+
+@pytest.fixture
+def db(tmp_path):
+    return Database({"database": {"path": str(tmp_path / "follows.db")}})
+
+
+@pytest.mark.asyncio
+async def test_follow_unfollow_roundtrip(db):
+    store = FollowStore(db)
+    await store.follow("0xa", "0xb")
+    await store.follow("0xc", "0xb")
+    assert set(await store.followers("0xb")) == {"0xa", "0xc"}
+    assert await store.following("0xa") == ["0xb"]
+    await store.unfollow("0xa", "0xb")
+    assert await store.followers("0xb") == ["0xc"]
+
+
+@pytest.mark.asyncio
+async def test_self_follow_ignored(db):
+    store = FollowStore(db)
+    await store.follow("0xa", "0xa")
+    assert await store.followers("0xa") == []
+
+
+@pytest.mark.asyncio
+async def test_routes(aiohttp_client, tmp_path):
+    from tests.test_gateway import _build_mock_server
+    config = {
+        "platform": "0pnMatrx", "memory_dir": str(tmp_path / "m"),
+        "workspace": str(tmp_path), "timezone": "UTC",
+        "model": {"provider": "ollama", "providers": {}},
+        "agents": {"neo": {"enabled": True}},
+        "gateway": {"api_key": "", "rate_limit_rpm": 60, "rate_limit_burst": 10},
+        "security": {},
+    }
+    server = _build_mock_server(config)
+    server._app_attest = None
+    server._security_backend = "noop"
+    server.react_loop.memory.db = Database({"database": {"path": str(tmp_path / "g.db")}})
+    client = await aiohttp_client(server.create_app())
+
+    r = await client.post("/social/follow", json={"address": "0xbob"},
+                          headers={"X-Wallet-Address": "0xalice"})
+    assert r.status == 200 and (await r.json())["success"] is True
+
+    r = await client.get("/social/0xbob/followers")
+    body = await r.json()
+    assert body["followers"] == ["0xalice"] and body["count"] == 1