jerry/buzz

mirror of https://github.com/block/buzz.git synced 2026-10-31 06:21:34 +00:00

Files

ss-dev-00 1938c1dbbd broker: verify inbound frames and deliver signed results

Closes the loop from a signed relay event to a signed result frame. The
pipeline was already testable in isolation; this attaches the transport and
the host's real parts, so nothing above the ingress layer learns what Tauri
or the relay look like.

`ingress::verify_frame` derives every trusted field from the frame rather
than from anything a caller could assert. Owner, requester, and relay scope
are transport-derived, which is why the wire envelope has no field for them:
a payload that could name its own owner would be a payload that could pick
its own authority. Verification refuses duplicate routing tags — a frame with
two `agent` tags has two readings, and the one this host picks would not have
to match the one the relay routed on. Freshness is re-checked here rather
than trusted from the relay, because bounding replay of an old signed frame
is not a hop this host controls.

A frame that fails verification gets no answer at all. Emitting a signed
refusal at an unverified sender would make any host a signing oracle aimed at
a target of the sender's choosing. Frames that are simply not broker traffic —
the overwhelming majority, since ordinary telemetry arrives on this same
subscription — are ignored cheaply.

`host.rs` keeps the command a transport hand-off rather than an authority
hand-off: it takes a raw signed event and nothing else, so the renderer cannot
say who is asking or which owner to act as. The return value is deliberately
thin, since the requester's real answer travels in a signed frame; reporting
an outcome through IPC would make the reply path look like a return value it
is not. Results publish over the relay WebSocket because kind-24200 is
rejected on the HTTP bridge, and as the owner's own identity with no NIP-OA
auth tag — an auth tag is how a managed agent proves owner backing, and the
owner is not one.

On the TypeScript side the renderer forwards the *signed event*, never the
decrypted plaintext, so the host verifies and decrypts independently. The
routing check is shallow on purpose: it decides only whether a payload claims
to be a broker request, not whether it is valid, so an ill-formed request
still reaches the host and earns a structured refusal instead of silence. A
broker request also returns before the session journal, because a payload with
no seq, timestamp, or kind must not be filed as a transcript entry.
Forwarding is fault-isolated: a broker host fault is not an observer transport
fault, and must not be reported as one or tear down telemetry for every agent
over a single failed mutation.

`VerifiedRequest` gets a hand-written `Debug` that redacts the payload to a
byte count. Decrypted request content includes system prompts, and a derived
`Debug` would put them into any error or test failure that formats a request.

Verified at this tree: 2916 desktop Tauri Rust tests (74 broker, 18 ingress),
5311 desktop TS tests, workspace clippy and both fmt gates clean. The two
`buzz-pair-relay` integration failures are a pre-existing timing flake,
reproduced on clean origin/main at 074561233 and independent of these crates.

Signed-off-by: ss-dev-00 <a02c4e0850e5e612b4ddf95dbe2f5c56467cf27c6552203bc833ff438fb31971@buzz.block.builderlab.xyz>
Co-authored-by: Bradley Axen <baxen@squareup.com>
Signed-off-by: Bradley Axen <baxen@squareup.com>

2026-08-21 19:55:51 -07:00