Fix cross-owner relay agent mentions in owner-only builds

[wesbillman]

Summary

• keep BUZZ_BUILD_AGENT_ACCESS_OWNER_ONLY scoped to Desktop-managed local start and provider deployment boundaries
• stop filtering independently operated relay agents by viewer/owner equality in native discovery, autocomplete, and send-time revalidation
• preserve NIP-OA ownership verification, owner-authored respond_to policy, shared-channel membership, and fail-closed send-time checks
• replace the packaged-build regression expectation with coverage for cross-owner allowlisted and respond_to=anyone relay agents, including the emitted agent p tag

Fixes #6329.

Why

The packaged 0.5.17 build reused its managed-runtime owner-only capability in relay-agent mention admission. That silently hid correctly configured shared agents owned by another operator, even when their verified policy explicitly authorized the viewer. The capability is intended to constrain runtimes Desktop starts or deploys, not external relay agents.

Validation

• pnpm --dir desktop test (5093 passed)
• cargo test --manifest-path desktop/src-tauri/Cargo.toml relay_directory --lib (4 passed, 2 ignored real-relay tests)
• focused agent mention unit tests (35 passed)
• Desktop TypeScript/E2E build
• focused Playwright mention tests (3 passed)
• pre-commit formatting hooks
• pre-push branch-skew, file-size, Desktop check/typecheck/unit tests, and Tauri checks
• git diff --check

[wesbillman]

BLOCK — the marked build now admits legacy relay records with no verified NIP-OA owner.

The equality clamp should go, but this patch removes the final authenticity gate with it. relay_agents_from_directory_events deliberately merges self-authored legacy kind:10100 entries and sets owner_pubkey = None for them (desktop/src-tauri/src/nostr_convert/agent_directory.rs:28-52,59-76). At head 8ee70ba1d, list_relay_agents_for_selection returns those entries after only relay-signed bot membership (desktop/src-tauri/src/commands/agent_discovery/relay_directory.rs:131-150,190-202). The removed marked-build final filter was also the only thing excluding owner_pubkey=None records. Consequently, a bot member can publish a legacy respond_to=anyone kind:10100 without any NIP-OA owner proof and become mentionable/sendable in the packaged owner-only client. That contradicts the PR's promise to preserve verified ownership and the issue's explicit requirement not to weaken fail-closed behavior for missing/invalid ownership proof.

The Playwright additions do not catch this because their mock relayAgents inputs bypass native profile/policy verification; notably the new allowlist and anyone fixtures omit ownerPubkey on the relay DTO while searchProfiles is a separate frontend mock.

Smallest safe remedy: in the marked build, retain relay entries whose owner_pubkey is present, without comparing that owner to the viewer. Keep ordinary OSS legacy compatibility unchanged. Add a native regression that the marked policy admits a verified cross-owner entry but rejects an ownerless legacy entry, plus a packaged E2E whose relay DTO carries the verified cross-owner owner.

The managed-runtime boundaries themselves remain intact: local spawn still projects through owner_only() and provider reconciliation still reads owner_only_access_build().

Verdict: BLOCK until marked builds preserve NIP-OA verification while dropping only viewer/owner equality. Reviewed exact head 8ee70ba1dfd7ecfaf7ad0c4703d6fc500db87fdf; git diff --check origin/main...HEAD passed and the review worktree was clean.

[wesbillman]

CLEAR at corrected head f43411f6a957aa84e73a0d76085e1d30f138f2c7.

The blocker is resolved at the correct boundary:

• marked builds now retain only converted relay entries with owner_pubkey.is_some(), preserving fail-closed NIP-OA ownership without restoring viewer/owner equality (desktop/src-tauri/src/commands/agent_discovery/relay_directory.rs:115-119,198-208);
• that same filtering helper is reached by both full autocomplete discovery and selected-agent send-time revalidation through list_relay_agents_for_selection (relay_directory.rs:121-125,215-242);
• OSS passes false and therefore retains ownerless legacy kind:10100 compatibility;
• native regressions pin verified cross-owner retention, ownerless marked-build rejection, and OSS legacy retention (relay_directory.rs:249-308);
• packaged allowlist and anyone E2E fixtures now carry the external verified owner (desktop/tests/e2e/mentions.spec.ts:1476-1483,1585-1592).

The original patch's other security boundaries remain intact: owner-authored policy lookup still derives coordinates from agent-signed NIP-OA profiles, membership remains relay-signed and channel-scoped, frontend authorization still evaluates signed respond_to, and send-time discovery remains fail closed. Local spawn and provider deployment owner-only projection are unchanged.

I found no material correctness or authorization defect in the corrected diff. git diff origin/main...HEAD --check passed; review worktree was clean and exact head matched the GitHub PR. I did not duplicate Carl's reported full gates, and CI was still in progress when reviewed.

Verdict: CLEAR / approve. This supersedes my BLOCK at 8ee70ba1d.

[jedwards27]

Verdict: APPROVE

Reviewed: bbd20fae75ecc3bd7a83cc12a65379fac22a2b79..f43411f6a957aa84e73a0d76085e1d30f138f2c7 (exact head f43411f6a957aa84e73a0d76085e1d30f138f2c7)

Risk: high — this changes a packaged-build ownership/authz boundary in relay-agent discovery and the user-visible mention/send path.

Behavior/contracts traced: relay-signed shared-channel membership → candidate-authored NIP-OA ownership profile → exact owner-authored 30177 response policy → autocomplete eligibility and owner disclosure → exact-pubkey selection → two send-time native revalidations. Marked builds now require a verified owner without requiring that owner to equal the viewer; OSS retains ownerless legacy compatibility. Discovery stays on the active relay/community, and revocation, membership loss, ownership/policy loss or mutation, malformed managed policy, and query failure all fail closed by removing relay admission rather than trusting cached UI state.

Findings: no unresolved material correctness, authorization, tenancy, race, accessibility, or misleading-state finding. The corrected native boundary and regressions also resolve the earlier ownerless-record concern at the reviewed head.

Validation at the exact clean head:

• just desktop-test: 5093/5093 passed.
• just desktop-tauri-test: full Tauri workspace passed.
• just desktop-tauri-test-compiled-flags: unmarked and marked matrix passed; marked Tauri lib 2593 passed, 17 ignored.
• just desktop-check: passed.
• pnpm build:e2e plus focused Playwright owner-only mention cases: verified cross-owner allowlist, verified same-owner, and cross-owner anyone passed independently; assertions cover the exact emitted agent pubkey.
• Causal mutation removing marked-build verified-owner retention made the new native regression fail (left: 2, right: 1); restoring this head passed.
• git diff --check passed. Current Desktop core/build, macOS, Windows Rust, smoke/integration E2E, Rust lint, release-candidate, and DCO checks are green.

The UI path also centrally excludes archived identities, presents managed by <owner> in autocomplete, provides screen-reader owner text/fallback, and routes by pubkey rather than ambiguous display name.

Residual risk: focused workflow proof used the E2E bridge, not a freshly launched native GUI against an isolated live relay. One combined three-case Playwright run lost its first row and then its web server exited; all three cases passed independently, so this is recorded as a non-reproduced runner/server anomaly rather than a product finding. Native authenticity and build-state behavior are covered by the full Tauri suites, compiled-flag matrix, source trace, CI, and mutation proof, but fresh live-relay GUI lifecycle behavior was not exercised.

— :bot: Jude’s code review agent