mirror of
https://github.com/block/buzz.git
synced 2026-10-30 05:51:46 +00:00
## Why Thread-scoped ACP sessions from #6732 need an opt-in desktop rollout that preserves today’s channel policy by default. ## What - Add the default-off “Thread Scoped ACP Sessions” toggle under Settings → Experiments using the existing feature-override persistence. - Map the persisted setting to `BUZZ_ACP_SESSION_POLICY=channel|thread` for every local and provider-backed managed ACP launch. Changes apply when managed agents next start; DMs remain conversation-scoped by the backend. - Keep the desktop setting authoritative over descriptor environment and cover the UI, persistence, local spawn, provider payload, and existing Projects/Workflows experiments. ## Risk Assessment Low. The experiment defaults off and explicitly preserves `channel`; changes are limited to managed-agent launch configuration. Existing running agents are unchanged until their next start. ## Testing - `. ./bin/activate-hermit && just ci` — passed on the final restacked tree, including 5,674 desktop tests, 2,796 Tauri tests, and 1,860 mobile tests. - `cd desktop && pnpm build:e2e && pnpm exec playwright test tests/e2e/experimental-features.spec.ts --project=smoke` — 1 passed. - `. ./bin/activate-hermit && cargo test --manifest-path desktop/src-tauri/Cargo.toml session_policy --lib` — 4 passed. - `. ./bin/activate-hermit && cargo test --manifest-path desktop/src-tauri/Cargo.toml commands::agents::deploy::tests --lib` — 15 passed. - `. ./bin/activate-hermit && cargo test -p buzz-backend-kubernetes --test wire_fixtures` — 4 passed. ## Stack Info Stacked on #6732. This PR depends on #6732 and should merge after it. Generated with Codex --------- Signed-off-by: Salman Mohammed <smohammed@squareup.com> Signed-off-by: Leo <5faf251baee50ee6bcde338aef6acdd70bb3e60115664c2cd490d94a55dfc488@buzz.block.builderlab.xyz> Co-authored-by: Leo <5faf251baee50ee6bcde338aef6acdd70bb3e60115664c2cd490d94a55dfc488@buzz.block.builderlab.xyz>
Provider wire fixtures
The shared arbiter for the stdin/stdout contract between the desktop
(agents_deploy.rs) and this provider (spec §Provider Protocol).
Each *.request.json is a request the desktop can emit; each matching
*.response.json is the exact response this provider produces for it. The
provider side is asserted by tests/wire_fixtures.rs; the desktop side should
assert that its emitted payloads parse as the corresponding request.
Three rules keep these useful rather than decorative:
- Requests are recorded, not invented. A fixture that no caller emits
tests a contract nobody has. "Recorded" means executed and transcribed —
deploy-full-launch.request.jsonis the output of the desktop's realbuild_launch_block→deploy_payload_jsonpath, not a shape derived by reading those functions. Deriving it is how this fixture acquired four impossible values at once: arespond_tothat was a pubkey where the desktop serializes a kebab-caseRespondToenum, allowlist and owner values failingvalidate_respond_to_allowlist's 64-hex rule (types.rs:897), an inventedBUZZ_ACP_PARALLELISMwhere the emitter writesBUZZ_ACP_AGENTS(runtime.rs:729), and alaunch.envkey from no layer ofresolve_effective_harness_descriptor. - The provider cannot police this file, so the desktop must. Every field
above is one this provider is deliberately indifferent to —
respond_tois an opaqueOption<String>, the allowlist an opaqueVec<String>,policy_envan arbitrary map — sothe_full_desktop_payload_is_acceptedpasses on invented data exactly as happily as on recorded data. The enforcement is the desktop's whole-object equality test, which builds the payload and compares it to this file. A completeness guard (the case-list directory scan inwire_fixtures.rs) stops a case from going missing; it cannot tell you a case is false. - Responses are byte-compared after key-sorted re-serialization, so a
field rename or a type change fails here rather than in a desktop that
silently reads
undefined.
deploy-* fixtures cover only responses reachable without a cluster —
refusals and malformed input. A successful deploy needs an apiserver and is
covered by the conformance suite, not by a static fixture.