mirror of
https://github.com/block/buzz.git
synced 2026-11-01 06:51:17 +00:00
fe2b5dfc75
Close the five pass-2 blocking findings on the keyring secret-projection PR. F3: add require_effective_secrets_available — a single fail-closed gate (strict global loader, instance secrets_unavailable, linked-definition secrets_unavailable) consumed by every side-effecting path that was degrading silently: get_agent_models, mint_agent_card, the update_managed_agent rename, persona name/avatar propagation signing, and set_global_agent_config (which now refuses to overwrite a committed global whose ref cannot load rather than unwrap_or_default over it). F4: a dev-migration value conflict now writes a conflict:<coord> marker into the keyring blob. load_secret fails closed whenever a coordinate carries one, so hydration sets secrets_unavailable and every downstream gate refuses — making the conflicted value genuinely unavailable for the whole retry window instead of merely withholding the completion marker. A resolved conflict clears its marker. F5b: collect_live_refs now returns full expected blob coordinates alongside gen ids, and both GC sweeps no-op when any committed live reference is missing from the blob — so a dangling live ref can no longer let GC delete an older unreferenced generation that may be the only recoverable payload. F5a: add a cross-process transaction lock (a second advisory lockfile, distinct from the per-op mutate_blob lock) held from generation write through the JSON commit on every save path, and across the live-ref read through remove_batch in GC — closing the two-process interleave where one process could delete a generation another had written but not yet committed. Snapshot export: materialize_snapshot_bytes propagates the global loader Err instead of unwrap_or_default, refusing export/send rather than silently shipping empty inherited runtime/provider/model defaults. agent_models.rs, card.rs, and secret_store.rs are kept under the desktop file-size ratchet via #[path] sibling extraction (naming helpers, env-layer key resolution, and the secret_store test module respectively). Adds unit tests for the gate (all three tiers + precedence), conflict hydration→spawn-refusal, GC missing-coordinate freeze (both sweeps + positive bound), independent-participant txn-lock exclusion, and snapshot degradation refusal. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>