jerry/buzz

mirror of https://github.com/block/buzz.git synced 2026-11-01 06:51:17 +00:00

Files

Duncan fe2b5dfc75 fix(desktop): resolve Thufir r2 — one secret-availability gate, conflict hydration refusal, GC live-ref + cross-process lock

Close the five pass-2 blocking findings on the keyring secret-projection PR.

F3: add require_effective_secrets_available — a single fail-closed gate
(strict global loader, instance secrets_unavailable, linked-definition
secrets_unavailable) consumed by every side-effecting path that was
degrading silently: get_agent_models, mint_agent_card, the
update_managed_agent rename, persona name/avatar propagation signing, and
set_global_agent_config (which now refuses to overwrite a committed global
whose ref cannot load rather than unwrap_or_default over it).

F4: a dev-migration value conflict now writes a conflict:<coord> marker into
the keyring blob. load_secret fails closed whenever a coordinate carries one,
so hydration sets secrets_unavailable and every downstream gate refuses —
making the conflicted value genuinely unavailable for the whole retry window
instead of merely withholding the completion marker. A resolved conflict
clears its marker.

F5b: collect_live_refs now returns full expected blob coordinates alongside
gen ids, and both GC sweeps no-op when any committed live reference is missing
from the blob — so a dangling live ref can no longer let GC delete an older
unreferenced generation that may be the only recoverable payload.

F5a: add a cross-process transaction lock (a second advisory lockfile,
distinct from the per-op mutate_blob lock) held from generation write through
the JSON commit on every save path, and across the live-ref read through
remove_batch in GC — closing the two-process interleave where one process
could delete a generation another had written but not yet committed.

Snapshot export: materialize_snapshot_bytes propagates the global loader Err
instead of unwrap_or_default, refusing export/send rather than silently
shipping empty inherited runtime/provider/model defaults.

agent_models.rs, card.rs, and secret_store.rs are kept under the desktop
file-size ratchet via #[path] sibling extraction (naming helpers, env-layer
key resolution, and the secret_store test module respectively).

Adds unit tests for the gate (all three tiers + precedence), conflict
hydration→spawn-refusal, GC missing-coordinate freeze (both sweeps + positive
bound), independent-participant txn-lock exclusion, and snapshot degradation
refusal.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

2026-08-10 21:48:54 -04:00