jerry/buzz

mirror of https://github.com/block/buzz.git synced 2026-10-30 22:11:36 +00:00

Files

Riley Crane 6c8b1c865a fix(accumulator): harden engine, CLI, and desktop seam after adversarial review

Engine (buzz-accumulator):
- Citations are always judged: a run shown no signals may cite nothing,
  so fabricated citations can no longer ride config-only reruns.
- Hex runs split into event ids only at exact multiples of 64 chars;
  a valid-id prefix with hex garbage appended now fails loudly.
- Oversized transcript lines keep a >=256-char tail or stay pending;
  a sliver can no longer seal an event as covered.
- Runs cap shown signals (250) and stall when the standing artifact
  exceeds a 40k-byte publish ceiling, keeping the NIP-44 65,535-byte
  plaintext cap a priced-before-spend stall instead of a post-spend
  publish failure. Empty selections with no prior stall too.
- Artifacts carry their selection and the chain-wide channel union;
  the cached-run shortcut now misses on selection edits.
- The subprocess runner leads a process group and group-kills on
  timeout, and pipe drains are joined with a deadline so a grandchild
  cannot orphan a billed model call or wedge the run.
- Selections canonicalize lowercase and validate UUID/pubkey/kind
  shapes; the unused freeform@v1 schema is gone.

CLI (buzz folds):
- share checks the artifact's channel provenance, not the live spec:
  history folded from another channel can never be laundered into a
  single-channel share by editing the selection.
- Artifact events publish without plaintext tags (fold names private).
- Signal fetches are exhaustive within the window and error on the
  --limit bound instead of silently keeping only the newest page.
- run salvages the paid-for model output to stdout on every
  post-spend failure (refusal, size ceiling, version fence, publish),
  and aborts before forking the chain if a concurrent run published.
- estimate reports the priced window so run can replay it exactly;
  the redundant --schema flag is gone.

Desktop:
- run_folds_cli scrubs ambient BUZZ_AUTH_TAG/BUZZ_API_TOKEN/
  NOSTR_PRIVATE_KEY, runs from home, leads a process group, and uses
  900s/120s timeouts with headroom over the CLI's own.
- The settings card pins Run to the preflight's priced window and
  re-locks Run when a run fails; dead kind consts removed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Riley Crane <rileycrane@squareup.com>

2026-09-04 10:04:35 -07:00