## What
Two changes, both fallout/follow-up from #4289 landing:
### 1. Fix the Security job failing on main (lockfile-only)
Eight RUSTSEC advisories published today against the nostr stack turned
`cargo-deny check` advisories red on main ([failing
run](https://github.com/block/buzz/actions/runs/30761611723/job/91533106673)).
Not introduced by #4289 — the advisories landed upstream and any push to
main today would have tripped them.
- **RUSTSEC-2026-0225..0230** → `nostr` 0.44.6 → **0.44.7** (Debug
output exposing NIP-46/NIP-60 credentials; wallet parsers accepting
unauthenticated events; NIP-44/NIP-04/NIP-98 resource exhaustion; NIP-50
empty-filter panic)
- **RUSTSEC-2026-0231..0232** → `nostr-relay-pool` 0.44.2 (root) /
0.44.1 (tauri) → **0.44.3** (auth-challenge memory exhaustion;
processing of unverified relay events)
Both workspace lockfiles bumped (`Cargo.lock`,
`desktop/src-tauri/Cargo.lock`). No manifest changes.
### 2. Default the desktop GUI's sprig image to the published
`ghcr.io/block/buzz-sprig`
The first main-push after #4289 published the image publicly (package
created 18:44Z, visibility `public`). The `config_schema()`'s `image`
property now carries a `default`:
```
ghcr.io/block/buzz-sprig:sha-6530b58@sha256:17facfc7608d8ddb33bc056c9aaba1098f4ef6abe5655702fbfd7584d1f74d76
```
**Why tag+digest, not tag:** the backend deliberately rejects tag-only
references — the pod runs with the agent's nsec and tags are mutable
pointers (`image.rs` §Image). The tag+digest form keeps the
human-traceable `sha-6530b58` while the digest does the pinning;
`image::parse` already normalizes it to the tagless canonical form, so
create-intent fingerprints are identical to the bare-digest spelling.
The digest is the **multi-arch manifest-list digest** (amd64+arm64),
resolved via `docker buildx imagetools inspect`.
**This is a UI prefill, not a baked fallback:** `image` stays in the
schema's `required` list, an empty value still fails closed with a named
field, and the desktop submits the value explicitly in `provider_config`
(the `WhereToRunSection` probe seeds `providerConfig` from schema
defaults) — so deploy fingerprints never depend on compiled-in provider
state, and the spec's §K8s pod-reconciliation concern about
baked-default divergence is not engaged. Module prose that said "no
published image exists yet" is updated to match reality.
No desktop code changes needed: the form already prefills from
`properties[*].default` and submits seeded defaults.
## Testing
- `cargo-deny check` at head: **advisories ok, bans ok, licenses ok,
sources ok** (was: advisories FAILED)
- `cargo test -p buzz-backend-kubernetes`: **158 passed** (154 lib + 4
wire), including new `schema_default_image_round_trips_through_parse`
pinning the constant + its normalization, and the wire `info` test now
asserting the default is present in the provider's real stdout response
- Live provider probe: `{"op":"info"}` against the built binary returns
the default in `config_schema.properties.image.default` with `required`
unchanged (`["namespace","image"]`)
- Full workspace test suite via pre-push hook: green (earlier direct
`cargo test --workspace` run: sole failure was
`api::mesh_demo::demo_join_forwarded_arm_round_trips_echo`, the
documented pre-existing main flake — unrelated, fails on base)
- Image existence verified against GHCR: `docker buildx imagetools
inspect ghcr.io/block/buzz-sprig:sha-6530b58` resolves to the pinned
manifest-list digest with linux/amd64 + linux/arm64 manifests
---------
Signed-off-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz>
Co-authored-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz>
## Problem
Two related gaps in global back/forward navigation. Fixes#3775.
1. The keyboard shortcuts almost never fire in real use — users fall
back to clicking the toolbar chevrons and assume the shortcuts don't
exist.
2. On macOS, mouse back/forward buttons (X1/X2) and horizontal swipe
gestures do nothing, although they navigate in every browser and in
Slack.
**Duplicate check:** searched open PRs and issues — none found beyond
#3775 (filed alongside this fix). #3078 / #3377 are
next/previous-*channel* navigation, a different feature.
## Root causes
**Keyboard:** `useBackForwardControls`'s keydown handler bailed whenever
the event target was editable — but `useComposerAutofocus` deliberately
focuses the message composer (a ProseMirror contenteditable) on mount
and on every channel switch. In steady state focus almost always lives
in the composer, so the chords were silently swallowed. Invisible to CI
because `navigation.spec.ts` only ever clicked the `global-back` /
`global-forward` buttons, never pressed the keys.
**Mouse/swipe:** on macOS, WKWebView never delivers X1/X2 button events
or swipe gestures to the page (Safari handles them natively in the app
layer, not in page JS), and Buzz had no native handler.
## Fix
### Keyboard chords (web layer)
Match the existing platform chord regardless of the event target and
drop the editable-target guard:
- `⌘[` / `⌘]` have no text-editing semantics in macOS text fields, and
the TipTap/StarterKit editor config binds no `Mod-[` / `Mod-]` shortcuts
(checked `useRichTextEditor.ts` — list indentation is Tab/Shift-Tab).
- `preventDefault()` keeps the chord out of the editor — asserted in the
e2e test.
This matches browsers and Slack, where back/forward chords work while a
text field is focused. Chord matching is extracted into a pure helper,
`app/navigation/backForwardChords.ts`, so it can be unit tested;
behavior (bindings, modifier exclusivity, `code`-based matching for
non-US layouts) is unchanged.
### macOS mouse buttons and swipe gestures (native layer)
An NSEvent local monitor in `mouse_nav.rs` catches what the webview
can't see and emits a `mouse-nav` Tauri event to the main window
(`emit_to`, so navigation stays scoped if multi-window ever lands) that
the frontend acts on. Two AppKit event shapes map to navigation:
- `otherMouseUp` with button 3/4 — mice whose X1/X2 buttons arrive as
plain button events. These are swallowed after emitting so nothing
downstream double-handles them.
- `swipe` with a horizontal delta — AppKit's page-swipe gesture
(`swipeWithEvent:`): `deltaX > 0` back, `deltaX < 0` forward. Sent by
mouse drivers that synthesize a page-swipe gesture for the back/forward
buttons instead of button-3/4 events (the hardware this was verified
on). Stock Apple trackpad and Magic Mouse swipes arrive as phased
scroll-wheel events instead, which this PR does not handle — that path
(`ScrollWheel` + `trackSwipeEventWithOptions:`, which also needs
scroll-edge detection) is deferred to a follow-up. Swipes are passed
through (swallowing mid-gesture events could confuse AppKit gesture
tracking).
The swipe path was verified end to end on hardware whose back/forward
buttons emit only swipe gestures, never button-3/4 events — an
instrumented event monitor confirmed the events arrive as
`NSEventType::Swipe` with `deltaX ±1`, and navigation worked after
mapping them.
## Tests
- **13 unit tests** for the web-side chord matcher
(`backForwardChords.test.mjs`): supported chords, modifier exclusivity,
`code` fallback, and preservation of line-editing shortcuts.
- **6 Rust unit tests** for the native mapping helpers (`mouse_nav.rs`):
button 3/4 directions, other buttons ignored, swipe delta sign →
direction, zero-delta (gesture-begin) ignored.
- **e2e regression case** in `navigation.spec.ts`: presses the platform
chord *while the composer is focused* — the missing coverage. Verified
it fails against the pre-fix implementation and passes with the fix.
- Full desktop unit suite: 3832/3832 pass. Full Rust suite (`cargo
test`, buzz-desktop): 1888 passed / 0 failed. `pnpm typecheck`, `biome
check`, `pnpm check`, `cargo fmt --check`, `cargo clippy`: clean (no new
warnings).
- Full Playwright e2e: 958 passed; 6 failures are relay-infrastructure
tests (live relay seeding / relay state seam) that fail identically
without this change — `navigation.spec.ts` is fully green.
## Manual test
1. Open a channel, then another (composer autofocuses on each switch).
2. `⌘[` — returns to the previous channel; `⌘]` — forward again. Typing
`[` / `]` in the composer inserts normally.
3. Mouse back/forward buttons navigate the same way, from anywhere in
the window (verified on macOS on hardware using both event shapes).
## Update — 2026-07-31
Removed the redundant DOM mouse-button handler after verifying it was
unnecessary. The native macOS path remains unchanged and was revalidated
manually.
---------
Signed-off-by: npub1yvnq5equak5errqpku8stskushny9wsvt0fc2ywcpwt79yslwaqswe7tse <23260a641ceda9918c01b70f05c2dc85e642ba0c5bd38511d80b97e2921f7741@buzz.block.builderlab.xyz>
Signed-off-by: Matheus Iser <matheusiser@squareup.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
Co-authored-by: npub1yvnq5equak5errqpku8stskushny9wsvt0fc2ywcpwt79yslwaqswe7tse <23260a641ceda9918c01b70f05c2dc85e642ba0c5bd38511d80b97e2921f7741@buzz.block.builderlab.xyz>
Co-authored-by: npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7 <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>
Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
# Kubernetes backend plugin (crates/buzz-backend-kubernetes) + desktop
deploy path
Implements docs/remote-agents.md (merged @ 28ae6cd21) as ONE PR: the
provider
binary, the desktop changes that make it work, the harness inactivity
reaper,
the Sprig image, and the conformance/live-test suites.
Channel: buzz-remote-agents (29414326-dba7-402d-b384-b1b34d63a2e6),
thread c42b70ef.
## What's here (by lane)
- **crates/buzz-backend-kubernetes** (Dawn): stdin/stdout JSON provider,
info +
deploy; pure classify.rs (one match arm per spec state-machine row);
reconcile/GC with ownership-marker gate + same-clock orphan check;
per-attempt
immutable Secrets; three-tier env with clear-then-write authoritative
tier.
- **Desktop** (Mari): KD3 launch block from resolved descriptor, KD5
pre-secret
negotiation gate (resolve-once → stage-and-digest → info → protocol gate
→
deploy), KD1 Windows extension strip, bundling (externalBin + Justfile +
release/canary workflows + stub loops), tauri.windows.conf.json platform
override (Decision B: no Windows artifact).
- **buzz-acp** (Max): KD4 BUZZ_ACP_EXIT_AFTER_INACTIVITY reaper
(pool-independent;
reset only at accepted dispatch; in-flight turn/heartbeat defers, never
resets);
BUZZ_ACP_EXIT_AFTER_INACTIVITY + BUZZ_ACP_NO_PRESENCE reserved. KD8 fix.
- **Image + tests** (Perci): Dockerfile.sprig (digest-pinned bases, exec
buzz-acp
PID 1, relay-scoped credential config), image contract script, provider
conformance suites (golden wire fixtures shared with desktop tests),
live-local
runbook (namespace-scoped, shared-cluster safe).
- **Docs** (Sami, first commit): citation re-pin c1bca1b56 → 28ae6cd21
(44/49
were already byte-exact; 3 offsets fixed) + I3 presence-bound correction
(below).
## Named spec deviations (deliberate, each with rationale)
1. **No baked default image yet.** ghcr.io/block/buzz-sprig is
unpublished
(verified: anonymous pull 403 vs control 200). Omitted `image` returns
an
in-band field-required error instead of a default.
2. **Image override STRICTER than spec §Image:** digest-only
(`name@sha256:<64hex>`); ALL tags rejected; `name:tag@digest`
normalized.
With no baked default the override is the only path, so tag-acceptance
would
make mutability the v1 norm. Strictness is reversible; a moved tag under
an
nsec is not. Baked digest default + tag re-acceptance = follow-up with
image
publish.
3. **imagePullSecrets not in schema (v1).** Explicit user images may
rely on
namespace-preprovisioned pull credentials — the substrate boundary.
Field
added only if the publish decision proves it necessary. 9-field budget
intact.
4. **Decision A closed: writable empty workspace.** Nest projection =
named
follow-up; no image-side scaffolding.
5. **Decision D overridden by Tyler (event b55398d8):** provider ships
bundled
with the desktop like buzz-acp/buzz-agent; spec §Distribution's separate
release workflow deleted for v1.
6. **I3/vision presence bound corrected 90s → 180s.** PRESENCE_TTL_SECS
moved in
#3783 during this spec's base→merge window; the number was inherited,
not
chosen. Spec :206/:216/:928 + inline quote + VISION_REMOTE_AGENTS.md:59
corrected. ← Tyler: the vision is your document; this edit is flagged
for
your explicit eyes.
7. **Spec citations are pinned to 28ae6cd21** (main at spec merge) and
resolve
there, not at this PR's head — this PR's own lanes move
crates/buzz-acp/src/lib.rs by ~100 lines (19 citations across
KD4/KD6/KD7/
§Stop/§Launch data). Known Defects rows fixed BY this PR retire on
merge;
the section documents main as of the pin.
8. **KD7 grace tension declared:** pod terminationGracePeriodSeconds=60
vs
KD7's measured ~87s shutdown tail at parallelism 10 (~197s at cap 32).
KD7 is ruled out of scope, so L1-3's "enough grace for full graceful
shutdown" is NOT met at default config — deliberate, resolved by the KD7
follow-up, not silently.
## Question for Tyler
Will ghcr.io/block/buzz-sprig publish PUBLIC? If private-by-policy,
§Image needs
an imagePullSecrets story before the baked-default follow-up can land.
## Out of scope (named follow-ups)
KD6 exit-code contract + KD7 shutdown budget (gate OnFailure), OnFailure
restart
policy, Windows provider binary, PVCs/nest projection, mesh
deployability,
sprig image publish workflow + baked multi-arch digest default.
## Reproduce locally (four traps that cost us real time)
**1. Git hooks inherit the invoking shell's PATH — pin the shell, not
just your
verification commands.** `rust-toolchain.toml` pins `1.95.0`, but the
rustup shim
that honors that pin lives in `~/.cargo/bin`. If Homebrew's cargo is
earlier on
PATH, `cargo` in this repo is 1.89.0, which cannot build the workspace
at all:
```
$ /opt/homebrew/bin/cargo check -p buzz-db
error: rustc 1.89.0 is not supported by the following packages:
sqlx@0.9.0 requires rustc 1.94.0
... # exit 101
```
Verifying with `PATH="$HOME/.cargo/bin:$PATH" cargo test` does *not*
protect the
push: lefthook's `pre-push` → `just test-unit` re-resolves `cargo` from
the
shell's own PATH, so a green local run is followed by a hook failure on
a crate
you never touched. Export the PATH for the whole shell, not per-command.
This
bit twice.
**2. Line-scope your mutations, or the mutation edits its own
detector.** When
mutation-testing the respond-to guard, a whole-file `sed` on the mode
literal
touches 5 sites — the guard *and* the fixtures/assertions that test it.
The
mutation and its detector move together and the suite stays green, which
reads
as "this code is dead" when it actually means "you deleted the
experiment":
```
# WRONG — 5 sites, guard and tests mutate together
$ sed -i '' 's/"allowlist"/"allowlist-DISABLED"/g' src/env.rs
test result: ok. 145 passed; 0 failed # false survivor
# RIGHT — 1 site, anchored to the guard's own definition line
$ sed -i '' '/^const RESPOND_TO_ALLOWLIST/s/"allowlist"/"allowlist-DISABLED"/' src/env.rs
failures:
env::tests::allowlist_mode_with_an_empty_list_is_refused
env::tests::an_allowlist_entry_that_is_not_64_hex_is_refused
test result: FAILED. 143 passed; 2 failed # real kill
```
Restore by copying a pristine file back and confirming `git diff --stat`
is
empty, not by re-running an inverse `sed`.
**3. A completeness guard is not a correctness guard.** The shared wire
fixture
`tests/fixtures/provider-wire/deploy-full-launch.request.json` passed
every test
we had while containing four classes of invented data (wrong
`respond_to`
encoding, an env key no emitter writes, allowlist entries that fail the
harness's own 64-hex rule, a `launch.env` key from no descriptor layer).
The
provider's tests could not have caught this: its types are deliberately
indifferent to these values (`Option<String>`, `Vec<String>`, arbitrary
map), so
"the provider parses it" was never evidence that the desktop emits it.
The fix
was not a stronger provider assertion but a rule about provenance —
"recorded"
means executed-and-transcribed, and the desktop's whole-object equality
test is
the only enforcement that can exist. See the fixture README.
**4. Every drift this arc was a value that agreed with itself.** Five
invented
values were found, and not one was caught by an assertion failing — each
was
caught by someone asking where a value came from. A named constant
referenced
symbolically on both the fixture and assertion side. A `sed` that
mutated its
own detector. Six probe rows that all died at the same unrelated error.
A
descriptor struct literal compared against a fixture built from that
literal
(`launch.args: ["run","--session"]`, which the resolver actually returns
as
`["acp"]`). The general defense is not more assertions but provenance: a
stub is
a control that varies nothing, and the more faithful it looks the better
it
hides. Ask what executed, not what passed.
*Fixture-test determinism caveat (post-verification, Quinn + Dawn).* The
desktop's whole-object fixture test calls the real resolver, which
consults a
process-global harness registry whose own docs require
`registry_test_lock`
for any test touching it. The fixture test holds no lock and is
nonetheless
deterministic — but by containment, not by ordering. Measured, not
derived:
planting a definition with `id: "goose"` directly into the registry
(bypassing
the loader) changes the resolved descriptor from `args: ["acp"]` to
`args: ["--poisoned"]`, so `resolve_effective_harness_descriptor`
**does**
reach the registry for this id — it does not short-circuit on the
builtin
table first. Two controls discriminate: an empty registry and a registry
poisoned under a *different* id both return `["acp"]`. What actually
protects
the test is that the registry has exactly one writer
(`update_loaded_harness_registry`, reached only via
`warm_harness_registry_from_dir`) — but that writer concatenates **two**
sources of unequal strength (`custom_harnesses.rs:319-326`). Custom
files
pass through `load_custom_harnesses`, whose `check_id_collision` rejects
the
reserved builtin id `goose` case-insensitively at the loader — and that
leg
is tested (`load_applies_id_collision_check` writes a real `goose.json`
and
asserts the loader drops it). Preset definitions
(`preset_harness_definitions`, `presets.rs:177-193`) are a bare `.map`
over
`PRESET_HARNESSES` with **no collision check** — exhaustive call-site
enumeration at `60007fda4` finds four production `check_id_collision`
sites,
none on the preset path. That leg holds only because `goose` is not in
the
preset table today (intersection of TIER1 and preset ids is empty) —
executed, not just read: adding a preset with `id: "goose"`,
`args: ["--poisoned"]` and warming via the normal preset-only path
(`warm_harness_registry_from_dir(None)`, no custom dir, no direct
writer)
flips the fixture's emitted `launch.args` from `["acp"]` to
`["--poisoned"]`
at `60007fda4`, command/env/policy_env unchanged. So: no test in the
suite
can put a `goose` entry in the registry
via the custom path, and no preset currently carries one, so no
interleaving
can perturb this fixture — containment with one checked leg and one
coincidental one. A future fixture built on a **non-builtin** runtime id
has
no containment at all — it would be order-dependent against whatever
registry-writing test ran last and must take the lock.
*Late instance, found while reviewing the mode guard.* The guard
exact-matches
`respond_to` untrimmed and case-sensitively, which is only correct if
clap's
`ValueEnum` derive is case-sensitive. `config.rs` gives two answers: the
derive
at `:448-453` carries no `ignore_case`, while the crate's own tests call
`RespondTo::from_str(s, true)` — `ignore_case = true`. Reading the
source
supports either. Measured on the built binary instead: `owner-only`
starts,
`OWNER-ONLY` / `Owner-Only` / `ALLOWLIST` / `NOBODY` all exit rc=2
`invalid
value`. Case-sensitive at the CLI, so the guard is right — and right for
a
reason the source does not state. The `from_str(_, true)` tests exercise
a
different surface and are not evidence about the CLI.
*Corollary, and the sharper half.* When a test helper **reimplements**
production instead of calling it, the helper is a fork — and a fork can
be
right while production is wrong, or wrong in the same way, and the suite
reports green either way. Both `BUZZ_ACP_ALLOWED_*` gates are forked
like this:
production compares **strings** while the helpers compare **post-parse
enums**
(`config.rs:2623`) or re-derive the split
(`buzz-cli/.../channels.rs:1296`).
Production and the helper each carry their *own* copy of the empty-entry
filter
(`:1025` and `:1300`), so fixing one says nothing about the other.
Measured on
`buzz-cli`, restoring byte-exact between runs:
| tree | result |
|---|---|
| baseline | 274 passed |
| drop the empty-filter in **production** only (the real fix) | **274
passed** — no signal |
| drop it in the **test helper** only | **273 passed, 1 failed**
(`channels.rs:1338`) |
Two independent defects, stacked, and worse together than either alone:
production can be fixed with no test ever noticing, *and* the helper
cannot be
corrected without a false alarm demanding the bug back. The root cause
is one
bit of type information — `check_allowed_channel_add_policy(allowed_raw:
&str,
..)` cannot represent "unset", while production reads `env::var(..) ->
Result`,
where unset and `""` are different states. A helper whose parameter type
can't
represent all of production's input states isn't testing production's
states —
it's testing a subset it silently chose. Same family as the
struct-literal
descriptor and the fixture drift: the test and the thing it tests
agreeing with
each other, rather than the test measuring the thing. Neither defect is
in this
PR's diff (`git diff --name-only 28ae6cd21 <head> -- crates/buzz-cli` is
empty); both are now filed as NIP-34 issues on this repo: the fail-open
+
fork-helper defect at issue event `0524a4113f2d97fd…` and the respond-to
self-lock at `e32837498969b5e7…` (filed 2026-08-02 after Quinn measured
that
no prior filing existed — zero hits on GitHub `block/buzz` open *or*
closed
and zero on the relay's kind:1621 issues, against working positive
controls). The prescription was itself
mutation-tested before being written down: repairing the fork's
signature
(`Option<&str>` + assertion → `None`) still let the reintroduced
production
bug ship 274-green — an expressive fork is still a fork; it never
executes
production. So the `buzz-cli` fix has **three parts and one explicit
keep**:
drop the production filter; **delete** the helper and point its tests at
the
real `cmd_set_add_policy` (which self-discriminates by error variant —
`Usage` = refused, `Network(BadScheme)` = passed the gate — no relay
needed);
serialize the env-var tests behind one
**`tokio::sync::Mutex::const_new`**
lock taken with `.lock().await`, including the pre-existing `:1362`
integration test (the fork was silently buying test isolation — without
the
lock, parallel runs flake nondeterministically; a `std::sync::Mutex`
held
across `.await` trips `clippy::await_holding_lock` under `-D warnings`);
and
**keep** the then-dead `!allowed.is_empty()` clause with a comment
saying
why. It is unreachable-false (`split(',')` never yields an empty vec),
but it
is the only thing that keeps the reintroduced production bug detectable
—
mutation-tested: on a tree that deletes the clause, reintroducing the
empty-filter bug survives 275/0, because `""`/`","`/`" "` refuse either
way
and the filter goes semantically inert. Dead code can be load-bearing
for
tests: "provably unreachable" is an argument about behavior, never about
coverage. When a helper forks production, the fix has to delete the
fork:
any change that leaves two implementations standing can only ever be
verified against the one the tests call. *Final shape:* the keep and the
broad lock are both artifacts of the fork surviving in some form. The
extraction variant (Dawn, mutation-tested at `60007fda4`) removes the
tension: extract one `check_channel_add_policy_allowed(Option<&str>,
&str)`
that **production calls**, with the `Option` placed at the env boundary
where the `Result<String, VarError>` bit actually lives. 5/6 mutants
killed; the empty-filter survivor is proven **equivalent** (exhaustive
6174-pair check, 0 divergences, with a diverging negative control;
independently re-derived by a second generator — different tokens and
shape — 0 divergences on admitted policies, 500 on a non-admitted
control),
not a coverage hole — on a one-implementation tree there is no fork left
to
witness, so no dead clause needs keeping. One scope line on that
equivalence: it is **caller-conditional**, a property of the only
current
caller, not of the gate function — `cmd_set_add_policy`'s own match at
`:1027-1034` admits only three policies before the gate runs; a second
caller reaching the gate with arbitrary strings resurrects m1 as a real
hole. The lock does not disappear, it
narrows (Dawn's own correction, caught by Mari): lock exactly the tests
that mutate the process env — three-plus-one on a fork tree, two on the
extraction tree — behind one `tokio::sync::Mutex`, and the lock is part
of
the assertion, not hygiene: with it deleted, the gate test fails 8/8
runs
deterministically by receiving `Network(BadScheme)` where it expects
`Usage` — the unset test's `remove_var` clobbers the other's `set_var`,
and
**the gate test passes straight through the gate**, a false negative on
the
exact authz assertion the test exists to make. State it as an outcome:
these two tests must not observe each other's env writes. 276/0 stable
across 5 parallel runs, clippy `-D warnings` clean; independently
verified
(patch applied to a second worktree: result blob `d67e584be` matches the
patch index, full mutant matrix reproduces row for row). One new row no
earlier
prescription covered: collapsing unset into `Some("")` fails **closed**
—
an unconfigured deployment refuses every policy — killed by the unset
test.
Patch: `OUTBOX/BUZZ_CLI_ADD_POLICY_GATE_EXTRACT_FIX.patch`. The filed
issue
(`0524a411…`) carries the fork-shape prescription; whoever picks it up
should prefer the extraction shape, drop the dead-clause keep with it,
and
keep part 3 outcome-shaped: serialize whichever tests mutate the env.
## Verification (final HEAD `60007fda4`)
- Full touched-package suites at each integration merge (log in plan
file).
At candidate parent `00e5b5fe9`: buzz-backend-kubernetes 154,
buzz-acp 673, desktop tauri 2100+3, pnpm 3908, workspace clippy/fmt/tsc
all clean. The only delta to `60007fda4` is one character in
`scripts/test-k8s-sprig-image-live.sh` (heredoc escape so the readlink
probe evaluates pod-side, not host-side at render); `crates/` tree hash
is byte-identical at both SHAs, so the Rust receipts attach by tree
identity. buzz-backend-kubernetes suite re-run in-shell at
`HEAD == 60007fda4`: 154 passed.
- Adversarial one-HEAD gate (Sami): guard matrix 12/12, predicate
mutants
7/7, doomed-invocation finding closed end-to-end; tree-hash carry to
`60007fda4` confirmed (crates/buzz-backend-kubernetes blob unchanged).
- Live-local pass per TESTING.md + skill-buzz-testing (Perci, at
`60007fda4`): explicit `docker-desktop` context, digest-qualified image
imported into node containerd `k8s.io` namespace, pull policy `Never`;
pod printed `DIGEST_ABI_OK`, `resolved_spec` and `image_id` both the
exact requested digest, script exit 0. Dedicated per-run namespace,
ownership labels on every object, scoped cleanup verified empty after.
- Implementation review (Wren) at `60007fda4`: 9.6 minimalness /
9.4 elegance / 9.3 correctness, no blocker.
- `origin/eva/k8s-backend` == `60007fda4` (ls-remote verified; SHA
identity is byte identity).
---------
Signed-off-by: npub1mprnacetjua2xx3p5eddmhxyk6wv929ymm5py8kd2xfxurxahspqqlgyta <d8473ee32b973aa31a21a65adddcc4b69cc2a8a4dee8121ecd51926e0cddbc02@buzz.block.builderlab.xyz>
Signed-off-by: Tyler <109685178+tlongwell-block@users.noreply.github.com>
Signed-off-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz>
Signed-off-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com>
Signed-off-by: npub1jh9wn95s0472h86ahapupaf7m6kx4v9sx2n0atj2hltcfer8k06s5n3pyf <95cae996907d7cab9f5dbf43c0f53edeac6ab0b032a6feae4abfd784e467b3f5@buzz.block.builderlab.xyz>
Signed-off-by: npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr <5a968df9a7494b4e019b9ecf739e088ba61097b4312124e9a88ae5b42e3f5f3e@buzz.block.builderlab.xyz>
Co-authored-by: npub1mprnacetjua2xx3p5eddmhxyk6wv929ymm5py8kd2xfxurxahspqqlgyta <d8473ee32b973aa31a21a65adddcc4b69cc2a8a4dee8121ecd51926e0cddbc02@buzz.block.builderlab.xyz>
Co-authored-by: npub17jjz49l9jjmhhk7cac63j8yt9z555n9cw8vk7v5jz4vzw4ppld5qgj57cc <f4a42a97e594b77bdbd8ee35191c8b28a94a4cb871d96f32921558275421fb68@buzz.block.builderlab.xyz>
Co-authored-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz>
Co-authored-by: Dawn (sprout agent) <c6237ef84fa537c78dcee78efd2d4e59f728859c7f194da42ac51ededfa0be05@sprout-oss.stage.blox.sqprod.co>
Co-authored-by: npub1jh9wn95s0472h86ahapupaf7m6kx4v9sx2n0atj2hltcfer8k06s5n3pyf <95cae996907d7cab9f5dbf43c0f53edeac6ab0b032a6feae4abfd784e467b3f5@buzz.block.builderlab.xyz>
Co-authored-by: npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr <5a968df9a7494b4e019b9ecf739e088ba61097b4312124e9a88ae5b42e3f5f3e@buzz.block.builderlab.xyz>
Tal here, human. Trying to help. This bug bugged me...
## Summary
A repository's first branch becomes its symbolic `HEAD`, and Git's
bare-repository default rejects deleting that branch even when another
branch survives.
This change:
- sets `receive.denyDeleteCurrent=ignore` only for the ephemeral `git
receive-pack` process
- preserves the existing server-side `core.hooksPath` override and
authorization hook
- lets the existing CAS publication logic select a surviving branch as
the next manifest `HEAD`
- adds regression coverage using a real stateless `git receive-pack`
request and a manifest HEAD-selection test
This lets users replace an accidental default branch without deleting
the object-storage manifest pointer.
### Related issue
Fixes#3572
### Testing
- `cargo test -p buzz-relay api::` (128 passed, 5 ignored)
- `just ci`
- live E2E roundtrip against a release relay with PostgreSQL, Redis, and
MinIO:
- created a repository through signed Nostr events
- verified authorized pushes and rejected unauthorized clone/push
- pushed a surviving `master` branch
- deleted the active `main` branch over authenticated Smart HTTP
- freshly cloned the repository and verified `master` became HEAD,
`origin/main` was absent, and repository content remained intact
Signed-off-by: Tal Weiss <major.tal@gmail.com>
Two CI failures in buzz-terminal, both platform-shaped.
lifecycle_tests::reader_drains_through_termination_and_reap took 10.008s
on Linux and passed on macOS. The test never dropped `pair.slave`, so the
master could not reach EOF: a PTY master stays readable while any process
holds the slave open, and the test itself was one. Darwin ends the read
when the session leader exits, which hid the retained slave on the
platform the test was written on. The runtime already drops the slave
(terminal_runtime.rs:441); the test now mirrors it. 10.009s -> 5.24ms.
The timing assertion is also narrowed to the instant `stop` is called, so
it measures child termination rather than reader teardown -- the stall was
misreporting itself as a wedged child. Narrowing alone would make the test
blind to a wedged reader, so `join`'s silent deadline abandon becomes an
assert: with a wedged-reader mutant and the narrowed clock, the old
`return` passed green in 10.07s.
`--all-targets` compiles `#[cfg(test)]` modules, so a Windows check built
env_fence_tests and lifecycle_tests, which drive real PTYs, `libc::kill`,
and unix permission bits (E0432/E0433/E0425). Both modules are now
`#[cfg(all(test, unix))]`. context_tests is pure string logic and stays
portable.
Co-authored-by: npub17jjz49l9jjmhhk7cac63j8yt9z555n9cw8vk7v5jz4vzw4ppld5qgj57cc <f4a42a97e594b77bdbd8ee35191c8b28a94a4cb871d96f32921558275421fb68@buzz.block.builderlab.xyz>
Signed-off-by: npub17jjz49l9jjmhhk7cac63j8yt9z555n9cw8vk7v5jz4vzw4ppld5qgj57cc <f4a42a97e594b77bdbd8ee35191c8b28a94a4cb871d96f32921558275421fb68@buzz.block.builderlab.xyz>
* commit 'e1eaf88b0d7c9b2f9922ffea6a2cbd47682e746d':
docs(terminal): cite the discriminating tail payload
docs(terminal): say why tail_full cannot fire, not just that nothing calls it
test(terminal): require the runtime to pump deferred work
docs(terminal): say that the tail-depth signals have no consumer yet
docs(terminal): repoint the links the slice_bytes deletion broke
test(terminal): reject stop before child reap
refactor(terminal): delete the slice-sizing function nothing calls
test(terminal): make the decrease and RIS arms assert what they claim
fix(terminal): retain the scrollback debt a shrink does not immediately repay
fix(terminal): repair three defects the gate found in the work-bounded seam
fix(terminal): raw-drain while child exits
feat(terminal): bound the lock hold by weighted work, not by bytes
test(terminal): close the review gaps in the cluster and snapshot contracts
feat(terminal): give an attaching subscriber the screen as it stands
feat(terminal): give the renderer each cluster's true column
Signed-off-by: npub1mprnacetjua2xx3p5eddmhxyk6wv929ymm5py8kd2xfxurxahspqqlgyta <d8473ee32b973aa31a21a65adddcc4b69cc2a8a4dee8121ecd51926e0cddbc02@buzz.block.builderlab.xyz>
Co-authored-by: npub1mprnacetjua2xx3p5eddmhxyk6wv929ymm5py8kd2xfxurxahspqqlgyta <d8473ee32b973aa31a21a65adddcc4b69cc2a8a4dee8121ecd51926e0cddbc02@buzz.block.builderlab.xyz>
The comment cited 1 MiB of RIS as evidence the tail high-water is zero. At
1 MiB the *deleted-pump* arm never reaches TAIL_CAP either, so the number
proved nothing: both worlds report "never full" and the measurement agrees
with whatever it was pointed at. 4 MiB is also short -- a 16 KiB read of RIS
defers 16382 bytes, not 16384, so it stops 512 bytes under the cap. 8 MiB is
where the counterfactual fires.
Also disambiguates the read count. 257 is reads *completed*; the 256 in the
review thread was a zero-based loop index, and a comment that doesn't say
which invites the next probe to disagree with it by one.
Found by Sami, in wording he had written and I had shipped -- I hit the same
defect on my own probe an hour earlier, fixed my run, and copied his number
across without noticing it had the flaw I'd just corrected.
Co-authored-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com>
Signed-off-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com>
The previous wording said the signal has no consumer. That is the weaker half
of the fact and the half that ages badly: a reader who deletes the pump loop
learns the rest by wedging a terminal.
Both measurements are now in the comment. With the loop, 1 MiB of pure RIS
through 16 KiB reads leaves a tail high-water of exactly 0 -- the tail is
empty between iterations, so the predicate is unreachable by construction.
Without it, the same stream reaches TAIL_CAP at read 257. Reproduced here
before quoting: 0 and 257 both hold on this tree.
Wording is Sami's, who measured it first and made the argument that the
signal and the loop are one fact from two sides. Delete the loop and this
predicate stops being unreachable in the same instant it starts being needed.
Co-authored-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com>
Signed-off-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com>
`tail_full` and `tail_drained` are the queue bound, and nothing outside the
tests calls them: the runtime reader pumps `drain` to completion after every
read, so the tail cannot reach the cap and nobody needs to ask. That is fine
and it is the design -- the signal was built for the reader that stops
pumping -- but an exported, documented predicate with an empty call graph
reads as wired to anyone who doesn't go looking. Stated in the doc comment
instead, because an unused signal that looks connected is worse than one that
says it isn't.
Co-authored-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com>
Signed-off-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com>
Two intra-doc links still resolved to the deleted function, so `cargo doc`
emitted unresolved-link warnings. Neither `cargo test` nor clippy sees those,
which is why they survived a green gate -- the deletion was verified by the
checks that run in CI and not by the one that reads the docs.
The single remaining mention is deliberate: the paragraph in `fences.rs`
explaining why the old function existed and why it is gone.
Co-authored-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com>
Signed-off-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com>
`slice_bytes(columns, lines, scrollback)` stopped being the scheduler's
function when slices became remaining-aware, and the fixtures went on
asserting against it. The two disagreed exactly where the old floor bound --
reporting 4 bytes where `drain` used 1 -- so the preconditions guarding the
decrease arm were describing behaviour that no longer existed. Not wrong at
today's geometries, and no test would have noticed when it became wrong.
It had zero callers outside the tests it misled. Deleted, with every
assertion moved to `slice_bytes_remaining`, which is what the engine calls.
One function, one answer.
`MIN_SLICE` goes with it: the floor is 1 and lives in the function, because
on a grid whose worst atom exceeds the whole budget no wider slice can
promise to stop after the callback that crosses. A named constant that only
appeared in a doc comment is a second authority waiting to disagree with the
first.
69 tests, debug and release. Test-only in effect; the deleted item was
unreachable from the engine.
Co-authored-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com>
Signed-off-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com>
Test-only. Five gaps, four of them found independently by two reviewers,
which is the part worth noting: they are the kind that pass.
The decrease arm captured `first_pending` and never asserted it, compared
`first_units` to the literal `12` rather than the control's own field, and ran
its geometry-persistence check on a *different* terminal -- one that had only
ever grown. That last one is the sharp one. It would pass an implementation
that retained the debt on shrink and dropped it on the next geometry resize,
which is a real shape: `Feeder::resize` sees every resize, and only the
scrollback branch is conditional. Verified by writing that mutant: the arm now
fails `left: 80000, right: 4040000`, and it did not before.
Two things had to be true for it to bite, and it was inert without either. It
runs on the terminal that actually went shallow -> deep -> shallow, and the
resize carries the *shallow* depth -- handing the debt's own value back in
makes `max(debt, new)` and a plain assignment agree, so the arm cannot tell
them apart. I found that second one by writing the mutant, watching it
survive, and looking again.
The RIS table collected all six arms before asserting but then asserted them
in a loop, so a failure still printed one. Collecting stops an arm being
skipped; comparing the vectors is what stops the failure being truncated. With
the history term deleted the failure now shows all six rows and which ones
moved, rather than the first mismatch.
Every comparison in the decrease arm is now against the control's own field.
A constant or geometry change has to move both sides together, or the fixture
quietly starts asserting the arithmetic of the day it was written.
Co-authored-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com>
Signed-off-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com>
The previous commit lowered the feeder's scrollback on a decrease, which reads
as correct and is not: upstream frees history lazily. `Storage::shrink_lines`
truncates only once the buffer exceeds the new length by `MAX_CACHE_SIZE`, so
immediately after a shrink the grid still owns rows a reset has to walk.
Pricing at the new depth charges for a grid that does not exist yet.
So the feeder tracks a high-water mark instead of the current depth. It never
falls, needs no clearing transition, and cannot go stale in the unsafe
direction. The cost is real and stated: a session that shrinks its scrollback
keeps paying the deep price for the rest of its life. The alternative is a
bound that is wrong immediately after every shrink.
The fixture that permitted this is the more important half. It asserted
`shrunk_work >= fresh_shallow`, which a feeder that dropped the debt satisfies
*by equality* -- "never had a debt" and "dropped the debt" are the same state,
so any predicate anchored to a fresh control blesses both. Strictness on the
pricing field is what separates them, and the pricing field is the only one
that can: the scheduling observables separate only when the two depths land on
different slice widths, and both are usually floored. The arm now asserts
`completed_work > fresh_shallow` strictly, with the scheduling fields carrying
their per-field directions -- `first_units` inverts, because a narrower slice
retires fewer atoms per un-preemptable drain, which is the fence working.
Also here, both from the same gate:
* Monotonicity is swept per axis. A truncating `columns * lines` is a
non-monotone middle on the columns axis alone, and a scrollback-only sweep
cannot see it.
* Seventeen more rows in the pricing table -- `scroll_down`, `insert_lines`,
`put_tab`, forward tabs, both `clear_line` modes, both `clear_screen` modes,
and the parameter extremes for each. The four that were missing are the four
whose weights share a shape with ones already covered, which is exactly the
argument for covering them separately rather than by analogy.
Co-authored-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com>
Signed-off-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com>
All three were pre-registered predictions that the fixtures at a957d25b0 did
not cover, and each was independently reproduced before being fixed.
**Geometry ownership.** `Terminal::resize` took a whole `Size` and forwarded
two of its three fields to the feeder, so a scrollback change updated the
`Term` while the feeder kept charging its construction depth. That is most of
RIS's price -- 3,840 charged against 803,840 honest at 80x24 -- and because
`slice_bytes` is derived from the densest atom, it also left the *scheduler*
sized for the wrong grid: a stale 130-byte slice admits 65 RIS atoms where the
honest 4-byte slice admits two. The split was permanent; later resizes tracked
their own fields and never re-derived the third. `Feeder::resize` now takes
the whole `Size`, so there is one ownership boundary and no way to update two
of three.
A bound derived at construction from a value that can change afterwards is a
bound with an expiry date.
**Post-atom overrun.** Slices were sized against the whole budget, so a slice
could hold an oversized atom *and* the callbacks behind it: `ESC c` followed
by `Xmore` ran three callbacks where the law permits one. Width is now a
function of what *remains* of the budget, which is a single byte once an atom
worth more than the budget is in play. Two refinements the fixtures forced:
plain runs are metered by the plain-byte cost and stop at the next `ESC`
rather than being priced as though every byte might be RIS -- pricing them
that way is correct and costs 181 MB/s -> 69 MB/s for a bound on something
that cannot happen -- and the escape scan is capped at `MAX_SLICE`, because
searching the whole tail per slice is quadratic and measured as a 7x
regression, a bound costing more than the thing it bounds. A `mid_escape` flag
keeps a sequence split across slices on escape metering; without it the byte
after a lone `ESC` looks like text and the atom rides into a wide slice.
**Saturating arithmetic.** `columns * lines` was computed in `usize` before
the cast, and `Size` is unclamped with no caller bounding it. Debug panicked
inside the accounting path -- reachable from `drain`, which is the pump a
paused reader must keep calling -- and release wrapped. The wrap is the worse
half: it does not degrade the fence, it inverts it, because `slice_bytes`
divides the budget by the atom cost, so an undercharged atom yields a *wider*
slice exactly when the atom is most expensive. Convert first, saturate
throughout.
The fixtures are where most of the work went, because three of them had to be
rewritten after the obvious version passed on the broken tree:
* Resize is asserted by equality with a terminal *constructed* at the target
depth, across charge and acquisition count -- stronger than any threshold
and immune to the constants moving, since both arms move together. A sanity
arm proves the comparison is deterministic first.
* Shrinking is asserted *directionally* after establishing a debt
(shallow -> deep -> shallow). Equality would forbid conservative retention,
and resizing straight down leaves a feeder indistinguishable from one built
shallow -- which is also the signature of a feeder that never updated.
* `completed_units` is asserted but is explicitly *not* the discriminator: it
reads the same in both arms, because the same callbacks run either way.
* Saturation asserts the direction -- widest atom, narrowest slice -- plus
monotonicity across nine decades. "Does not panic" is satisfied by the
wrapping version, which is the version that inverts the fence.
* Preconditions are asserted rather than assumed: the geometry must let the
scheduling fields separate at all, and the payload must be RIS, the only
escape reaching the only weight with a scrollback term.
24 mutants dead in debug and release, including one per repair.
Co-authored-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com>
Signed-off-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com>
* commit 'a957d25b02881bad31bb0d6ab6c9571545ba9bc8':
feat(terminal): bound the lock hold by weighted work, not by bytes
test(terminal): close the review gaps in the cluster and snapshot contracts
feat(terminal): give an attaching subscriber the screen as it stands
feat(terminal): give the renderer each cluster's true column
Co-authored-by: npub1jh9wn95s0472h86ahapupaf7m6kx4v9sx2n0atj2hltcfer8k06s5n3pyf <95cae996907d7cab9f5dbf43c0f53edeac6ab0b032a6feae4abfd784e467b3f5@buzz.block.builderlab.xyz>
Signed-off-by: npub1jh9wn95s0472h86ahapupaf7m6kx4v9sx2n0atj2hltcfer8k06s5n3pyf <95cae996907d7cab9f5dbf43c0f53edeac6ab0b032a6feae4abfd784e467b3f5@buzz.block.builderlab.xyz>
# Conflicts:
# desktop/src-tauri/crates/buzz-terminal/src/damage.rs
# desktop/src-tauri/crates/buzz-terminal/tests/clusters.rs
# desktop/src-tauri/crates/buzz-terminal/tests/snapshot.rs
Both existing fences meter bytes. That is right for memory and wrong for
time: `ESC[m` and `ESC#8` are four bytes each, and the second rewrites every
cell. A DECALN flood therefore reaches p95 65535us against a 4000us budget
with **zero** F1 aborts -- the fence never fires, because nothing is
buffered. Unfenced, one acquisition was observed at 22.1s.
So add a third quantity. `Counting` wraps the handler and charges each
callback what it touches: an O(cells) callback costs `columns * lines`, an
O(1) callback costs 1. `Feeder` accepts bytes into a pending tail and parses
only what one work budget affords, leaving the rest for the next call. That
bounds the hold. It does not bound the queue, so the tail has a cap and a
loud breach counter, and the reader is told to stop reading via a depth query
rather than a pause flag the fence owns -- a flag is a state a reader can fail
to clear, which is how a paused reader strands a child mid-teardown.
The weights are read from `alacritty_terminal-0.26.0/src/term/mod.rs` and then
checked against measurement, never fitted. Where source and measurement
disagree the source wins and the slack is recorded in the table. Three
findings from that reading are worth naming:
* `delete_chars`/`insert_blank` cost `columns` for *every* N and are worst at
N=1 -- the swap loop runs `columns - end` times, so cost falls as N rises.
A sweep that varies only N reports them parameter-dependent *decreasing*,
and the honest reading of that invites charging by N, which is backwards.
* `move_backward_tabs` (CBT) assigns `col` inside the `if self.tabs[i]` test,
so with tabstops cleared the cursor never moves, its `col == 0` exit is
unreachable, and all N iterations rescan the row: `ESC[3g ESC[65535Z` is
eight bytes for 82ms at 1600 columns. Its twin `move_forward_tabs` assigns
outside the test and is fine. The wrapper stops it at the first fixed point
-- permanent, because the scan depends only on the cursor -- which makes it
O(columns) and, verified exhaustively over every tabstop subset of a
12-column grid, lands on the same column as the naive loop.
* `reset_state` (RIS) resets both grids and walks the primary's scrollback, so
two bytes can be worth more than the whole budget. Priced on *configured*
depth, not `history_size()`, which observes only the active grid: a filled
primary followed by `ESC[?1049h` reads as empty while the work is still paid.
Slice size is derived from the densest atom the grid admits rather than
chosen, so the bound holds on the first byte of a cold feeder. An earlier
version sized slices from observed density and was strictly worse where it
matters -- a fresh feeder has seen nothing, so its first slice is wide.
`Terminal::feed` now returns whether a tail remains and the caller pumps
`drain` between lock acquisitions. `feed_fully` is the whole-buffer form,
deliberately a separate name because it reinstates the unbounded hold.
Every fixture asserts exact counts, never `> 0` and never `<=` alone. Both
directions are load-bearing: with the CBT break deleted the callback loops
65535 times while charging `work == 1`, so an upper bound passes over it, and
the mutant lands on the same cursor column as the fix, so a semantic assertion
passes too. 20 mutants dead in debug and release.
Co-authored-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com>
Signed-off-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com>
## What
A formal specification for remote agents and their management —
`docs/remote-agents.md` — in the style of
`docs/git-on-object-storage.md`: stated system model, named invariants,
explicit trust boundaries, provider conformance checklist, and an
implementation-correspondence table.
Requested by Tyler in the buzz-remote-agents design thread; co-designed
with Dawn and Wren (review pending).
## Structure
- **System model** — five principals (Desktop / Provider / Substrate /
Agent / Relay) and the design axiom **M1: no management channel** —
everything the desktop knows about a live remote agent flows through the
relay.
- **Five invariants** with enforcement mechanism and stated boundary:
- I1 identity fail-closed, I2 no secrets in configuration, I3
presence-is-status, I4 at-most-one-live-instance, I5 bounded lifetime.
- **Provider protocol** — discovery, `info`/`deploy` wire contract,
untrusted-output rules, the reserved-key rule, and the **deploy state
machine** (Running → no-op).
- **Auto-stop** — `--exit-after-inactivity` /
`BUZZ_ACP_EXIT_AFTER_INACTIVITY`, default off, definition of "inactive",
and why it must not share a name with the three existing timeout
concepts.
- **The Kubernetes binding** — `buzz-backend-kubernetes`:
kubeconfig-only auth, random-default namespace via schema `default`, the
sprig image, pod shape (bare Pod, `terminationGracePeriodSeconds: 60`,
32-hex label / full-pubkey annotation), secrets, GC, config budget.
- **Known defects** at `c1bca1b56` (Windows `.exe` id pollution;
provider env inheritance vs kubeconfig exec plugins).
- **Open decisions A–E** marked inline and consolidated, awaiting owner
ruling.
## Notes for review
Docs-only. Every code claim was verified against the tree
(correspondence table maps each spec concept to its file/function). The
spec deliberately documents two desktop bugs as Known Defects rather
than fixing them here — fixes are follow-up PRs.
---------
Signed-off-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz>
Co-authored-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz>
## What
`BUZZ_AUTH_TAG` stored in the **raw Nostr tag form** `[auth,hex,,hex]`
(unquoted, comma-delimited — how an `auth` tag serializes inside a Nostr
event and how `.env` files commonly store it) was rejected by the CLI:
```
BUZZ_AUTH_TAG is malformed: invalid JSON: expected value at line 1 column 2
```
…and even when the CLI *could* parse it, it forwarded the raw string as
the `x-auth-tag` header, so the relay's `verify_auth_tag` (which expects
JSON) rejected it with `403 relay_membership_required`.
Two commits close both gaps.
## Commits
### 1. `fix(nip-oa): accept raw Nostr tag form in parse_json_array`
`parse_json_array` (`crates/buzz-sdk/src/nip_oa.rs`) only accepted
well-formed JSON arrays. Added a fallback: when strict JSON parsing
fails *and* the trimmed input is bracket-delimited, split on `,` and
treat each field as a string (empty field `,,` → empty string, matching
`["auth","hex","","hex"]`). All consumers (`parse_auth_tag`,
`verify_auth_tag`, the CLI, `buzz-acp`) benefit from one change at the
lowest layer.
### 2. `fix(cli): canonicalize BUZZ_AUTH_TAG to JSON before sending
x-auth-tag header`
The CLI stored the raw input string and sent it verbatim as the
`x-auth-tag` header (`client.rs:618`). Added `canonicalize_auth_tag` in
`buzz-sdk`: parse either form, re-serialize to canonical JSON. The CLI
now canonicalizes before storing as `auth_tag_json`, so the header is
always valid JSON regardless of input form.
Together: local parse + wire canonicalization means the raw form works
end-to-end.
## Why
The raw form `[auth,hex,,hex]` is exactly how an `auth` tag serializes
inside a Nostr event. That shape leaks into `.env` files and shell
variables because there's no canonical "stored form" outside an event.
The SDK + CLI should accept it rather than push quoting/conversion logic
onto every consumer (harnesses, agent shells, external tools).
## Security
Both changes are purely syntactic — they only change how a 4-element
string array is extracted and containerized. All downstream validation
is unchanged:
- `parse_auth_tag`: still checks exactly 4 elements, `"auth"` label,
64-char lowercase-hex pubkey, 128-char signature.
- `verify_auth_tag`: still reconstructs the preimage and verifies the
BIP-340 Schnorr signature against the owner pubkey.
No new attack surface — a malformed or forged tag is still rejected at
the same validation points.
## Tests
4 new tests in `nip_oa::tests`:
- `test_parse_auth_tag_raw_nostr_form` — raw form with conditions +
empty conditions
- `test_parse_auth_tag_raw_form_with_whitespace` — raw form with
surrounding whitespace
- `test_canonicalize_auth_tag_raw_to_json` — raw→JSON and JSON→JSON
normalization
All 25 `nip_oa` tests pass (21 existing + 4 new). `cargo fmt --check`
and `cargo clippy -p buzz-sdk -p buzz-cli` clean.
## Verification
Confirmed end-to-end against a live community relay
(`wss://hermesagent.communities.buzz.xyz`):
- **Before:** raw `BUZZ_AUTH_TAG` → CLI parse error, or `403
relay_membership_required` if somehow parsed.
- **After:** raw `BUZZ_AUTH_TAG` → CLI parses it, canonicalizes to JSON
for the header, relay accepts via NIP-OA owner delegation, `buzz
channels members` returns the full roster.
## Context
Originated from a community investigation where agent-side relay access
was failing because the harness-exported `BUZZ_AUTH_TAG` (raw Nostr
form) was rejected by the CLI (expecting JSON). This removes the
impedance mismatch at the source.
---------
Signed-off-by: amanning3390 <adam.manning@pro-serveinc.com>
Signed-off-by: Tyler <109685178+tlongwell-block@users.noreply.github.com>
Signed-off-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz>
Co-authored-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz>
Co-authored-by: Tyler <109685178+tlongwell-block@users.noreply.github.com>
Six review findings, all coverage on code that was already correct, plus one
enforcement change.
Clusters. The join guard has two halves and only one was exercised: every
fixture built a plain cluster after a marked one, none the reverse. Drop
`joinable` and a release build silently emits `Span { text: "xye\u{301}",
cluster_count: 3 }` -- four chars counted as three, so the consumer misplaces
everything after it. Also fixture the `u16::MAX` join refusal, which is live
rather than defensive: `Size.columns` is an unclamped `usize` with no caller
bounding it, so a 70000-column row reaches it and must split rather than wrap.
Promote the encoder's `debug_assert` to `assert!`. This is a wire invariant,
and a check that vanishes in release vanishes exactly where the corruption
ships: with the defect present, the promoted build fails at the producer
rather than leaving an undecodable span for the renderer to misdraw. Measured
at +5.9us on a 65us encode for 80x24 -- 0.04% of a 60Hz frame.
Snapshot. The four fixtures asserted the damage plane and nothing else, so a
capture that dropped the screen's last row, lied about the cursor, or stamped
a stale grid identity passed all of them. `visible_text` trims and filters
empty lines, which is what let the missing row disappear -- a helper written
for legibility concealing the defect it should have exposed. Assert the row
set rather than the text, the cursor against a real position and DECTCEM, the
whole `Viewport` rather than `columns` alone, and that a full-grid copy is
billed to the renderer's meter and not the reader's.
Findings from Sami's P2a and P2b reviews; enforcement call from Eva; encode
cost measured by Sami.
Co-authored-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com>
Signed-off-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com>
A subscriber that arrives mid-stream cannot start from `render()`. Damage
describes what changed since someone last looked, so a newcomer is handed
whatever happens next -- on a quiet terminal, the cursor's line alone --
painted onto a blank screen. Upstream's `mark_fully_damaged` is private, so
an embedder cannot ask for a full frame that way either.
`snapshot()` copies the whole visible viewport instead, marks the frame
full so a reused encoder's dedup hashes realign, and stamps the geometry it
was captured under.
The delicate part is what it does not do. Damage is a single shared cursor
across every subscriber, so a snapshot that consumed it would steal the
incumbent renderer's pending rows: the newcomer's full frame would look
perfect while the established renderer silently froze. `capture_all`
therefore never calls `damage()` or `reset_damage()`, and their absence is
the mechanism.
Proving that needed more care than the interleaving alone. Because
`Term::damage()` marks the cursor line on every call, an incumbent owed
only the row it sits on gets that row back even when its damage was
stolen -- so the first version of the fixture passed against a deliberately
naive implementation. The committed fixture rewrites row 0 and parks the
cursor on row 3, putting the owed row where the cursor cannot return it for
free; it fails when snapshot consumes damage, and again when snapshot
copies damaged rows only or omits the full flag.
Co-authored-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com>
Signed-off-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com>
