mirror of
https://github.com/block/buzz.git
synced 2026-11-01 15:01:12 +00:00
fcdaf22232
Add `managed_agents::migration::driver`, the transport half of the relay-canonical migration seam. It is the only code that moves a retained aggregate across the wire: it consumes one immutable row from `managed_agent_aggregates`, POSTs the row's `request_json` verbatim to `/api/managed-agents/aggregate` with fresh owner-signed NIP-98 auth, strict-deserializes the corrected `migration::AggregateResponse`, verifies it through `verify_promotion`, and flips the durable row to synced only after a fully verified read-back. Design invariants: - Exact bytes on the wire. The body is `request_json` verbatim; the driver never re-serializes it, so the stored request and the request the relay authenticates are the same bytes. The verification source (`MigrationCandidate`) is reconstructed from those same bytes — parse the three signed events, decrypt the head under the owner key — so the candidate and the wire request cannot diverge and no build-side crypto is duplicated. - Fresh owner NIP-98 per attempt via `build_nip98_auth_header_for_keys` (unique nonce), so a retry never replays a stale token. Mirrors the `/events` submit path: egress guard, rate-limit wait, `classify_request_error` / `relay_error_message` / `parse_json_response`. - Only the exact retained (generation, private_event_id) is marked synced. Beyond `verify_promotion`'s response-vs-candidate checks, the driver binds the *durable row's* coordinate to the verified evidence, so a row whose columns disagree with its own request_json (and thus the verified head) is never confirmed. - Errors preserve retry. Every failure path — transport, non-2xx, malformed body, reconstruction, verification, coordinate mismatch — persists an exact-attempt diagnostic via `record_managed_agent_aggregate_error` and leaves `pending_sync = 1`. Nothing here clears retry except a verified read-back. Transport tests use a loopback axum stub in the shape of the aggregate route (6, all green): faithful read-back marks the exact generation synced and posts verbatim; conflict status preserves retry; malformed success body preserves retry; tampered read-back fails verification and preserves retry; row coordinate disagreeing with the verified head is not synced; no pending row is a no-op with no network submission. Pure transport confined to the new module + one `mod` line; no delete/tombstone, docs, or relay-crate changes. `managed_agents::` suite: 1026 passed, 0 failed; `cargo check --lib` clean. Co-authored-by: Mongo <5c25403eab7271f9f94ddd4f2b270e8cac2c92e2c830c51877cca6ec974ffb3f@buzz.block.builderlab.xyz> Signed-off-by: Wes <wesbillman@users.noreply.github.com>