jerry/buzz

mirror of https://github.com/block/buzz.git synced 2026-11-01 15:01:12 +00:00

Files

Wes fcdaf22232 desktop: PMA aggregate submit/retry driver

Add `managed_agents::migration::driver`, the transport half of the
relay-canonical migration seam. It is the only code that moves a retained
aggregate across the wire: it consumes one immutable row from
`managed_agent_aggregates`, POSTs the row's `request_json` verbatim to
`/api/managed-agents/aggregate` with fresh owner-signed NIP-98 auth,
strict-deserializes the corrected `migration::AggregateResponse`, verifies it
through `verify_promotion`, and flips the durable row to synced only after a
fully verified read-back.

Design invariants:
- Exact bytes on the wire. The body is `request_json` verbatim; the driver
never re-serializes it, so the stored request and the request the relay
authenticates are the same bytes. The verification source
(`MigrationCandidate`) is reconstructed from those same bytes — parse the
three signed events, decrypt the head under the owner key — so the candidate
and the wire request cannot diverge and no build-side crypto is duplicated.
- Fresh owner NIP-98 per attempt via `build_nip98_auth_header_for_keys` (unique
nonce), so a retry never replays a stale token. Mirrors the `/events`
submit path: egress guard, rate-limit wait, `classify_request_error` /
`relay_error_message` / `parse_json_response`.
- Only the exact retained (generation, private_event_id) is marked synced.
Beyond `verify_promotion`'s response-vs-candidate checks, the driver binds
the *durable row's* coordinate to the verified evidence, so a row whose
columns disagree with its own request_json (and thus the verified head) is
never confirmed.
- Errors preserve retry. Every failure path — transport, non-2xx, malformed
body, reconstruction, verification, coordinate mismatch — persists an
exact-attempt diagnostic via `record_managed_agent_aggregate_error` and leaves
`pending_sync = 1`. Nothing here clears retry except a verified read-back.

Transport tests use a loopback axum stub in the shape of the aggregate route
(6, all green): faithful read-back marks the exact generation synced and posts
verbatim; conflict status preserves retry; malformed success body preserves
retry; tampered read-back fails verification and preserves retry; row
coordinate disagreeing with the verified head is not synced; no pending row is
a no-op with no network submission.

Pure transport confined to the new module + one `mod` line; no delete/tombstone,
docs, or relay-crate changes. `managed_agents::` suite: 1026 passed, 0 failed;
`cargo check --lib` clean.

Co-authored-by: Mongo <5c25403eab7271f9f94ddd4f2b270e8cac2c92e2c830c51877cca6ec974ffb3f@buzz.block.builderlab.xyz>
Signed-off-by: Wes <wesbillman@users.noreply.github.com>

2026-08-05 13:21:54 -06:00