Remove public relay signing key fallback - #6729
Merged
Merged
Conversation
Signed-off-by: Jordan Mecom <jm@squareup.com>
jmecom
force-pushed
the
security/remove-public-relay-fallback-key
branch
from
August 24, 2026 22:25
3179fc1 to
ceb38fd
Compare
jmecom
marked this pull request as ready for review
August 24, 2026 22:46
baxen
approved these changes
Aug 25, 2026
baxen
left a comment
baxen
left a comment
Contributor
There was a problem hiding this comment.
Traced every non-dev path that launches buzz-relay to confirm the hard requirement on BUZZ_RELAY_PRIVATE_KEY changes nothing outside local dev:
- Helm chart (Block prod / any k8s deploy):
deploy/charts/buzz/templates/deployment.yaml:177always injectsBUZZ_RELAY_PRIVATE_KEYfrom the env secret. Withsecrets.existingSecret(required for prod per chart README) the operator supplies it; without it,secret-chart.yaml:27-32autogenerates a 64-hex key and persists it vialookup+resource-policy: keep. The live relay already advertises a stableselfin NIP-11 (76aa9d…, not the old0x01dev pubkey), which only happens when the key is configured. - Docker Compose (
deploy/compose):.env.exampleshipsBUZZ_RELAY_PRIVATE_KEY=CHANGE_ME…andrun.shrefuses to start while anyCHANGE_MEremains — the key was already mandatory there. - Railway one-click template (
hmseeb/buzz-railway):railway.template.jsonsetsBUZZ_RELAY_PRIVATE_KEYwithdefaultValue: ${{secret(64,'abcdef0123456789')}}and the image runsBUZZ_REQUIRE_AUTH_TOKEN=true, so it was already on the required path pre-PR. - Dockerfile: no relay-key
ENV, defers to runtime env — unchanged. - Harbor benchmark (
benchmarks/harbor-buzz-orchestra/scripts/benchmark.py:222) and mesh lifecycle smoke (scripts/ci-mesh-lifecycle-smoke.sh:73) both generate and pass their own key. - CI: this PR adds the key to the two inline relay launches in
ci.ymlplus every launcher script; all checks green.
The only callers that relied on the removed fallback were BUZZ_REQUIRE_AUTH_TOKEN=false dev/test launches, and this PR covers each of them. Nice cleanup.
wpfleger96
pushed a commit
that referenced
this pull request
Aug 25, 2026
…picker * origin/main: Remove public relay signing key fallback (#6729) Signed-off-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>
wpfleger96
pushed a commit
that referenced
this pull request
Aug 25, 2026
…r-contracts * origin/main: Remove public relay signing key fallback (#6729) docs(nest): make commit attribution policy-neutral (#6707) fix(desktop-messages): preserve inline agent mentions with persistent addressing (#6793) Signed-off-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>
salman1993
added a commit
that referenced
this pull request
Aug 25, 2026
…-layers * origin/main: chore(release): release Buzz Desktop version 0.5.19 (#6828) Remove public relay signing key fallback (#6729) docs(nest): make commit attribution policy-neutral (#6707) fix(desktop-messages): preserve inline agent mentions with persistent addressing (#6793) Signed-off-by: Salman Mohammed <smohammed@squareup.com>
wpfleger96
pushed a commit
that referenced
this pull request
Aug 25, 2026
…-history * origin/main: feat(desktop): add KLIPY GIF search to composers (#5554) fix(desktop): respect automatic mention preference after send (#6837) fix(release): attribute desktop candidates to the operator (#6831) fix(ci): check out source in docker.yml merge job (#6833) chore(release): release Buzz Desktop version 0.5.19 (#6828) Remove public relay signing key fallback (#6729) docs(nest): make commit attribution policy-neutral (#6707) fix(desktop-messages): preserve inline agent mentions with persistent addressing (#6793) Signed-off-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>
salman1993
added a commit
that referenced
this pull request
Aug 26, 2026
…cp-sessions * origin/main: (31 commits) fix(desktop): stop pulsing addressed agents on send (#6873) fix(desktop): prioritize sidebar channel status (#6861) feat(desktop): hyperlink selected composer text on link paste (#6684) chore(release): release Buzz Desktop version 0.5.20 (#6839) feat(desktop): add KLIPY GIF search to composers (#5554) fix(desktop): respect automatic mention preference after send (#6837) fix(release): attribute desktop candidates to the operator (#6831) fix(ci): check out source in docker.yml merge job (#6833) chore(release): release Buzz Desktop version 0.5.19 (#6828) Remove public relay signing key fallback (#6729) docs(nest): make commit attribution policy-neutral (#6707) fix(desktop-messages): preserve inline agent mentions with persistent addressing (#6793) Qualify canonical relay images for staged delivery (#6781) feat(desktop): persist agent addressing across composer messages (#6714) feat: navigate images across message threads (#6705) Add database pressure observability (#6700) revert fixed mention highlight (#6716) highlight search terms in results and messages (#6702) fix(desktop): make lightbox zoom controls interactive (#6710) Support community deletion in versioned media buckets (#6738) ... Signed-off-by: Salman Mohammed <smohammed@squareup.com>
brow
added a commit
that referenced
this pull request
Aug 26, 2026
…ignment * origin/main: (33 commits) feat(desktop): restore message quick reactions (#6892) Use paired tags for standing & per-turn context (#6701) fix(cli): preserve signatures in event reads (#6884) refactor(db): finish replaceable event store extraction (#6777) Fix Admin feedback filter overflow (#6825) fix(desktop): stop pulsing addressed agents on send (#6873) fix(desktop): prioritize sidebar channel status (#6861) feat(desktop): hyperlink selected composer text on link paste (#6684) chore(release): release Buzz Desktop version 0.5.20 (#6839) feat(desktop): add KLIPY GIF search to composers (#5554) fix(desktop): respect automatic mention preference after send (#6837) fix(release): attribute desktop candidates to the operator (#6831) fix(ci): check out source in docker.yml merge job (#6833) chore(release): release Buzz Desktop version 0.5.19 (#6828) Remove public relay signing key fallback (#6729) docs(nest): make commit attribution policy-neutral (#6707) fix(desktop-messages): preserve inline agent mentions with persistent addressing (#6793) Qualify canonical relay images for staged delivery (#6781) feat(desktop): persist agent addressing across composer messages (#6714) feat: navigate images across message threads (#6705) ... Signed-off-by: Tom Brow <tomb@block.xyz> # Conflicts: # .env.example # crates/buzz-db/src/push.rs # mobile/lib/shared/profile/user_cache_provider.dart
tucktuck101
added a commit
to launchpad-26/buzz
that referenced
this pull request
Aug 31, 2026
chore: sync launchpad with upstream block/buzz main (204 commits) this is to update our repo with upstream so we can have all the changes. below is a generated impact assesment we acknowledge the risks of doing so. # Software Change Impact Assessment — PR #1923 ## 1. Change Identification Assessment ID: CIA-2026-08-31-PR1923 Assessment date: 2026-08-31 (evidence captured 2026-08-31 UTC) Prepared by: Claude Code (agent), for @tucktuck101 Source repository: `block/buzz` (remote `upstream`) Source branch: `main` Source revision (SHA): `eed74bde2f4797714335ac10c56c0b0244c1def4` Downstream repository: `launchpad-26/buzz` Downstream branch: `launchpad` (fork default) Downstream revision (SHA): `338b4d0cf2dd76cc43964bb717ce9f0a94a9c7a5` Change under assessment: PR #1923, head `d555ec95feb3a8bc5126385a1272d55aa051fe85` — a **no-squash two-parent merge commit**; parents verified as exactly `338b4d0cf` (downstream) and `eed74bde` (upstream HEAD). Baseline/common revision (merge-base): `f8692fa9b52ddcfeb4b95fb4862109983509f131` Comparison scope and commands: - `git log -1 --format='%H %P' d555ec9` (parent verification) - `git diff --stat/--name-status 338b4d0...eed74bd` (incoming shape) - `comm -12` of `diff --name-only` vs each parent (resolution surface) - `git diff eed74bd d555ec9` / `git diff 338b4d0 d555ec9` (per-file resolution reading) - `git grep <symbol> d555ec9` (upstream-symbol survival checks) - `gh pr checks 1923`, `gh run view --job <id> --log-failed` (CI evidence) Evidence availability: `AVAILABLE` for Git, GitHub checks and job logs. `UNAVAILABLE` for local build/test execution and for the live cohort VPS `.env`. --- ## 2. Executive Summary Overall Risk: `HIGH` Assessment: `PROCEED WITH SPECIFIC ATTENTION` PR #1923 advances the fork default branch across 204 upstream commits (1,856 files, +284,745 / −45,172). The **merge mechanics are of high quality** — the resolutions read as deliberate and, in the one case where upstream refactored code the fork had relocated, upstream's semantics were correctly re-applied into the fork's split file rather than lost. The risk is not in the merge craft. It is that (a) a policy gate fails and cascades, so **almost none of the 204 commits are actually exercised by CI**, and (b) the drop carries **nine auto-applied schema migrations and a relay startup-contract change** into a fork whose job is to operate a live relay. Key findings: - `[CIA-CICD-001]` The `Detect Changed Paths` job fails on `just file-size-check`, and every downstream job is `skipping`. Desktop, Unit Tests, Rust Lint, Security, Relay E2E, Mobile, Web, Build — all skipped. `Desktop` and `Desktop E2E Integration` then fail their own gate checks *because* their dependencies skipped. **The 204-commit drop currently has no green test evidence at all.** (`CONFIRMED`) - `[CIA-CICD-002]` Root cause of that failure is a merge-awareness gap, not a code defect: the desktop ratchet compares against `HEAD^1` (the downstream parent), so an upstream file that grew 947→1001 lines *inside the imported history* registers as growth introduced by this PR. `desktop/src-tauri/src/commands/agent_models_tests.rs`, upstream commit `a7c7414a7f`. (`CONFIRMED`) - `[CIA-DATA-001]` Nine new migrations (`0032`–`0040`), auto-applied on relay startup. `0033` executes `ALTER TABLE events DROP COLUMN search_tsv` and rebuilds it — the migration's own comment says "not free on large databases". This is the single most operationally consequential item in the drop. (`CONFIRMED`) - `[CIA-SEC-001]` Upstream `block#6729` removes the public relay signing-key fallback: `BUZZ_RELAY_PRIVATE_KEY` is now **required on every startup**, and startup fails immediately if it is missing or invalid. The cohort's config templates do set it, so this is a verify-before-deploy item, not a known break. (`CONFIRMED` upstream; cohort live value `UNKNOWN`) - `[CIA-SEC-002]` The `audit` gate fails with 11 gitleaks findings and 6 tracked sensitive files. Provenance verified independently: every flagged path is upstream-owned test material absent from the downstream parent (APNs `.pem` fixtures arrived with `c432a111c` push-notifications MVP). These are inherited fixtures, not cohort-introduced secrets — but the gate is red and the fork's `.gitleaks.toml` does not yet allowlist upstream's fixture paths. (`CONFIRMED`) - `[CIA-CFG-001]` `BUZZ_ADMIN_TOKEN` is removed upstream (ignored with a startup warning); admin auth becomes NIP-98 or explicitly `disabled`, and **any unrecognised `BUZZ_ADMIN_AUTH` value aborts startup**. Cohort impact is low: `BUZZ_ADMIN_HOST` appears only under `launchpad/deploy/archived/`, and the documented production posture leaves it unset. (`STRONGLY_SUPPORTED`) - `[CIA-CICD-003]` The merged `ci.yml` drops upstream's `- '!desktop/src-tauri/**'` negation from the `desktop` path filter. The downstream parent never had it; the resolution kept the fork's shape. Effect is broader-than-necessary CI triggering, not lost coverage. Not described by the PR body's "additions are unioned" framing. (`CONFIRMED`, low significance) - `[CIA-PROC-001]` The `check` gate fails on one PR-body formatting rule: "Every 'Deferred blockers' line must reference its issue as '#<n>'. Offending line: 'none'". Trivially fixable. (`CONFIRMED`) Primary areas requiring attention: - Getting real CI signal on the drop — currently there is none. - The `0033` FTS column rebuild against the live relay database. - Deciding the `.gitleaks.toml` allowlist posture for upstream fixtures. Unknowns: - Whether the 204 upstream commits are individually sound. Not assessed; upstream's own CI is the authority and this fork does not develop them. - The live cohort VPS `.env` contents (only repo templates are visible from here). --- ## 3. Change Scope Incoming commits: 204 Changed files: 1,856 (GitHub reports 1,855 for the PR) Files added: 846 · modified: 971 · removed: 16 · renames: 23 Lines added: 284,745 · removed: 45,172 Affected areas (top, by file count): | Area | Files | |---|---| | `desktop/src` | 818 | | `desktop/src-tauri` | 237 | | `mobile/lib` | 212 | | `mobile/test` | 83 | | `benchmarks/` | 85 | | `desktop/tests` | 65 | | `crates/buzz-db` | 38 | | `crates/buzz-relay` | 34 | | `crates/buzz-push-gateway` | 24 (new crate) | | `deploy/charts` | 17 | Commit themes by conventional-commit scope: 44 `fix(desktop)`, 14 `chore(deps)`, 12 `feat(desktop)`, 9 `perf(desktop)`, 5 `chore(release)`, 4 `feat(workflows)`, plus relay/db/mobile/cli work. **Volume is context only** — the drop is dominated by upstream desktop iteration the fork does not develop. **Resolution surface** (files differing from *both* parents — i.e. genuine merge edits): 13. `.github/workflows/ci.yml`, `.github/workflows/docker.yml`, `AGENTS.md`, `CONTRIBUTING.md`, `Dockerfile`, `Justfile`, `lefthook.yml`, `deploy/compose/.env.example`, `crates/buzz-cli/src/lib.rs`, and four `desktop/src-tauri/src/managed_agents/*` files. The PR body declares "six merge conflicts". The 13-file resolution surface includes deliberate non-conflict edits (notably re-applying upstream's summary changes into the fork's split file). Not a defect — a documentation gap between what the body describes and what the tree shows. ## 4. Significant Functional Changes ### New functionality (upstream, inherited) - **Push notifications MVP** — new `crates/buzz-push-gateway` crate, migration `0040_push_message_kinds.sql`, mobile integration (`c432a111c`). - **Relay operator/moderator roster and admin action pipeline** — migrations `0035`–`0039`: `relay_operators`, `relay_admin_actions`, outbox lease + claim token, operator audit log. A new privileged control plane in the relay. - **Private managed-agent FTS** (`0033`), **channel roster snapshot fence** (`0032`), **community deletion in versioned media buckets**. ### Changed behaviour - Relay startup now hard-requires `BUZZ_RELAY_PRIVATE_KEY` (§12). - Admin dashboard auth model replaced (§8). - Desktop managed-agent spawn path refactored around a bound relay scope with `bound_runtime_key`, plus `ANTHROPIC_MODEL`/effort-env authority at spawn. ### Removed or deprecated - Public relay signing-key fallback (removed outright). - `BUZZ_ADMIN_TOKEN` (ignored, warns). - One upstream revert is carried: `Revert "fix(acp): gate relay-signed workflow messages on their attributed author"` (`block#6311`). ## 5. Architecture and Technical Impact The material architectural change for this fork is the relay gaining a **privileged operator/moderator control plane** persisted in Postgres (`0035`–`0039`) with its own audit table and an outbox with leases and claim tokens. That is a new trust boundary inside a service the cohort actually runs. Desktop-side, upstream tightened relay scoping so a spawn consumes the caller's bound workspace-relay read rather than re-reading a mutable override — precisely the area the fork carries a local repair in (§14). ## 6. API and Interface Impact | Interface | Compatibility | Evidence | |---|---|---| | Relay env/config contract | `BREAKING` | `BUZZ_RELAY_PRIVATE_KEY` required; invalid `BUZZ_ADMIN_AUTH` aborts startup | | `BUZZ_ADMIN_TOKEN` | `BREAKING` (removed) | `deploy/compose/.env.example` | | `buzz pack inspect` | `COMPATIBLE` | fork adds `--format human\|json`, default `human` byte-for-byte unchanged (`crates/buzz-cli/src/lib.rs`) | | Nostr event kinds / relay protocol | `UNKNOWN` | not individually assessed; upstream-owned | | NIP-11 document | changed (additive `admin_api` field) | `.env.example` note | ## 7. Data and Schema Impact `CONFIRMED` — nine migrations, auto-applied on relay startup (per `CLAUDE.md`). | Migration | Notable DDL | |---|---| | `0032_channel_roster_snapshot_fence` | `DROP TRIGGER IF EXISTS` + re-create guard trigger on `events` | | `0033_private_managed_agent_fts` | **`ALTER TABLE events DROP COLUMN search_tsv`** then rebuild; own comment warns it "is not free on large databases" | | `0034_replica_heartbeat_vacuum_truncate` | `ALTER TABLE replica_heartbeat SET (vacuum_truncate = false)` | | `0035_relay_operators` | new table; **drops** `moderation_reports_status_check` and re-adds a widened constraint | | `0036`–`0039` | new admin-action, outbox lease, claim-token, operator-audit tables | | `0040_push_message_kinds` | push kinds | Reversibility: no down-migrations were observed. `0033` is the sharp edge — dropping and rebuilding a `tsvector` column on `events` rewrites the table's largest index territory while the relay is starting, i.e. **during startup, before the service is serving**. On a small cohort database this is seconds; the cost scales with event volume and it is not something to discover during a live cutover. ## 8. Configuration Impact - `BUZZ_ADMIN_AUTH` introduced (`nip98` default | `disabled`); unrecognised values **abort startup**. - `BUZZ_ADMIN_TOKEN` removed. - `RELAY_OPERATOR_PUBKEYS`, `RELAY_OWNER_PUBKEY`, `RELAY_OPERATOR_API_ORIGIN` introduced. - Fork divergence correctly retained: `BUZZ_IMAGE` stays pinned to `ghcr.io/launchpad-26/buzz:sha-CHANGE_ME_FULL_40_CHARACTER_GIT_COMMIT` rather than reverting to upstream's `ghcr.io/block/buzz:main`. This is the cohort's image-provenance policy and the resolution preserved it — a correct and non-obvious call. - Cohort exposure to the admin-auth change is limited: `BUZZ_ADMIN_HOST` appears only under `launchpad/deploy/archived/`, and the hardening spec records production leaving it unset. ## 9. Dependency and Supply-Chain Impact - `Cargo.lock`: +103 / −213 in the merge, and the merged file is **byte-identical to upstream's** — the regeneration converged on upstream rather than inventing a fork-local resolution. Good outcome. - `pnpm-lock.yaml` +113 / −112; `mobile/pubspec.lock` +50 / −2; `Cargo.toml` +4 / −1. - All GitHub Actions introduced upstream are **SHA-pinned** with version comments (`actions/*`, `docker/*`, `cashapp/activate-hermit`, `Swatinem/rust-cache`, `rui314/setup-mold`, `openai/codex-action@86365089…` v1.12). No floating tags observed. - `openai/codex-action` is a new third-party action in the inherited security-review workflow. Upstream documents it as last-step, no persisted GitHub credential, no write permission, API key held behind the action's local proxy. Not independently verified here — `POTENTIAL`, worth one read before the cohort relies on it. - No dependency resolution, `cargo audit`, or license scan was executed. Status `UNAVAILABLE`, **not** "clean". ## 10. Build and Toolchain Impact `bin/.lefthook-2.1.3.pkg` → `bin/.lefthook-2.1.10.pkg` (Hermit lefthook bump, R100). `Dockerfile` resolution is +4/−4 vs upstream (fork divergence retained) and +8/−0 vs the downstream parent. `Justfile` gains upstream's `file-size-check` recipe covering desktop, web, **and** mobile. ## 11. CI/CD Impact This is where the drop currently stands or falls. **Actual check state (`gh pr checks 1923`): 5 fail, 23 skipping, 12 pass.** The failure chain is: `just file-size-check` fails inside `Detect Changed Paths` → that job is the fan-out gate → 23 downstream jobs report `skipping` → `Desktop` and `Desktop E2E Integration` aggregator steps fail with `Desktop Core finished with: skipped`. So `audit` and `check` aside, the red marks are one root cause plus its cascade. What passed is real but peripheral to the drop: Docker `Build (linux/amd64)` and `(linux/arm64)`, `Relay-Driven Mesh Lifecycle Smoke` (26m40s), `Python tests and lint`, `adr-boundary`, chart lint/render, `Dead Token Reference Guard`. **Unit Tests, Rust Lint, Security, Relay E2E, Desktop Core, Mobile, Web and Server Cross-Compile never ran.** Coverage check on the ratchet consolidation: the merge removes the fork's standalone `node mobile/scripts/check-file-sizes.mjs` step and its path-filter entries, adopting upstream's `just file-size-check`. Verified that the recipe (`Justfile:106-110`) runs the core unit test plus desktop, web **and** mobile ratchets — mobile coverage is preserved, not dropped. ## 12. Security Impact - `[CIA-SEC-001]` Signing-key fallback removal (`ee6ca5fa2`, `block#6729`) is a **security improvement** — no more shared public fallback identity — delivered as a startup hard-fail. Cohort templates (`launchpad/deploy/archived/ansible/roles/relay_config/templates/env.j2`, `deploy/compose/.env.example:28`) already set `BUZZ_RELAY_PRIVATE_KEY`, so the expected outcome is fine. The live VM's `.env` is `UNKNOWN` from here. - `[CIA-SEC-002]` The fork's own `launchpad security audit` (`python3 launchpad/scripts/security_audit.py`) reports `3 pass, 2 fail`: `gitleaks-secret-scan` (11 findings) and `tracked-sensitive-files` (6 files). Each flagged path was checked against both parents rather than accepting the PR body's account: `crates/buzz-push-gateway/tests/fixtures/*.pem`, `crates/buzz-auth/src/nip_fi/verifier/tests.rs`, `crates/buzz-db/src/runtime/tests.rs` all exist upstream and **do not exist in the downstream parent**. The body's claim holds. `ignore-coverage` and `agent-surface-secret-scan` still pass. - New privileged surface: operator/moderator roles, admin outbox with claim tokens, operator audit log. Not code-reviewed here — upstream-owned, but it is the part of the drop most worth a targeted read before the cohort exposes any admin surface. - Trust boundaries otherwise unchanged by the *resolutions* themselves: none of the 13 resolved files introduces a credential, network exposure, or privilege change. ## 13. Operational and Observability Impact The deploy sequence for this drop is: new image → relay restart → **nine migrations auto-apply** → relay requires a valid `BUZZ_RELAY_PRIVATE_KEY` or exits. Two independent startup-time failure modes, both new, both before the service answers. Rollback is complicated by the fact that `0033` has already dropped and rebuilt `events.search_tsv` by the time anything else is observable — a code rollback does not undo it. ## 14. Downstream Impact ### Downstream-specific modifications affected The fork carries a repair that dials the **configured** relay rather than `key.relay_url` (the loopback-normalized identity), in `restore.rs` and `runtime_commands.rs`. Upstream refactored exactly this area (scoped relay, `bind_expected_relay_scope`, `bound_runtime_key`). The resolution ported the fork's repair through the refactor and added an explanatory comment at both sites. `relay_url` was verified in scope at each — a `let` binding at `restore.rs:301` and a function parameter in `start_pair` (also used for `ManagedAgentRuntimeKey::new`). Compile-safe. ### Overlap — the highest-risk resolution, verified sound The fork had previously split `build_managed_agent_summary` out of upstream's `runtime.rs` into a downstream-only `runtime/summary.rs`. Upstream then edited that function in `runtime.rs` (38+/35−) — the classic way a vendor drop silently loses an upstream fix. The merge re-applied upstream's changes **into the fork's split file**: the new `teams: &[TeamRecord]` parameter, the removal of the redundant `load_global_agent_config` read in favour of the passed-in `global_config`, the hoisted `load_teams`, and the new `owner_only_access_build()` argument. Verified by symbol survival across the merged tree: `apply_effort_env`, `apply_claude_model_env`, `owner_only_access_build`, `bound_runtime_key`, `enforced_owner_only` and `mod spawn_key` are all present. **No dropped upstream semantics detected in the resolution surface.** ### Changed assumptions Cohort deploy docs describing `BUZZ_ADMIN_TOKEN`-era admin auth are now stale, though they live under `launchpad/deploy/archived/`. ## 15. Conflict Assessment ### Textual conflicts `CONFIRMED` — six declared by the author, resolved; `mergeable: MERGEABLE` at assessment time. Resolution surface measured at 13 files (§3). ### Semantic conflicts `NONE DETECTED` in the resolution surface, on the evidence checked — a stronger statement than usual here, because the one high-risk case (the `summary.rs` split) was verified positively rather than assumed. `POTENTIAL` elsewhere: the 204 commits' interaction with cohort deployment is **untested**, because the test lanes never ran (§11). ### Policy conflicts `CONFIRMED` but inherited, not introduced: - File-size policy (≤1000 lines) violated by an upstream file the fork declines to split. Declining is consistent with `CLAUDE.md` ("we operate Buzz; we do not develop it") — but the guard's instruction is "split the file — never bump the limit", and this PR does neither, so the gate stays red. - Secret-scanning policy violated by upstream test fixtures the fork's `.gitleaks.toml` does not allowlist. Both are the fork's own policies meeting upstream's content for the first time. That is a governance decision, not a code defect. ## 16. Risk Assessment Overall risk: `HIGH` Rationale: The dominant driver is **absence of verification, not presence of defect**. The merge craft is good and the one resolution most likely to lose upstream behaviour demonstrably did not. But a 204-commit, 1,856-file drop into an operated service is landing with its Rust, desktop, mobile, web and relay-E2E lanes never having executed, while carrying nine auto-applied migrations (one of which rewrites a column on `events`) and a new relay startup hard-fail. Blast radius is the whole product surface; verification difficulty is currently total, since the gate that would produce evidence is the gate that is failing. | Risk | Likelihood | Impact | Rating | Confidence | Evidence | |---|---|---|---|---|---| | Drop merges with no test evidence (23 jobs skipped) | High (already true) | High | HIGH | `CONFIRMED` | `gh pr checks 1923` | | `0033` FTS column rebuild stalls or locks relay startup | Medium | High | HIGH | `CONFIRMED` (DDL) / `UNKNOWN` (data volume) | `migrations/0033:40` | | Relay startup aborts on missing/invalid `BUZZ_RELAY_PRIVATE_KEY` | Low | High | MEDIUM | `STRONGLY_SUPPORTED` | `ee6ca5fa2`; cohort templates set it | | Upstream regression reaches cohort users undetected | Medium | Medium | MEDIUM | `POTENTIAL` | 44 `fix(desktop)` + 12 `feat(desktop)` unexercised | | Secret-scan gate stays red, normalising override | Medium | Medium | MEDIUM | `CONFIRMED` | `audit` job log | | Dropped upstream semantics in resolutions | Low | High | LOW | `CONFIRMED` negative | symbol-survival + `summary.rs` diff | | Broader CI triggering from dropped path negation | High | Very low | LOW | `CONFIRMED` | `ci.yml` §11 | ## 17. Required Attention and Verification 1. **Make the ratchet merge-aware, or scope it.** The `HEAD^1` base makes every vendor drop fail by construction — this will recur on every future drop, not just this one. Options: use the merge-base against upstream for merge commits, or exempt merge commits whose second parent is `upstream/main`. Highest-leverage fix, because it unblocks all 23 skipped jobs. 2. **Then re-read CI.** Nothing else in this assessment should be treated as settled until Unit Tests, Rust Lint, Security, Relay E2E, Desktop Core, Mobile and Web have actually run. 3. **Rehearse `0033` before production.** Restore a snapshot of the cohort relay database, run the migration, time it. Confirm the `events` row count makes the rebuild trivial — or discover that it doesn't, off the critical path. 4. **Confirm the live VM `.env` carries a valid `BUZZ_RELAY_PRIVATE_KEY`** before restarting the relay on the new image. Repo templates are not the deployed file. 5. **Decide the `.gitleaks.toml` posture** deliberately: allowlist upstream's fixture paths (`crates/buzz-push-gateway/tests/fixtures/*.pem`, the two test files) as an explicit, commented upstream-fixture exemption. Do not blanket-suppress the rule. 6. **Fix the PR-body `Deferred blockers` line** to use `#<n>` — one line, clears the `check` gate. 7. Note the `ci.yml` path-filter negation drop in the PR body so it is a recorded divergence rather than a silent one. ## 18. Unknowns and Limitations - No local build, test, `cargo audit`, or license scan was run for this assessment. Those statuses are `UNAVAILABLE`, never "clean". - The 204 upstream commits were **not** individually reviewed. Assessment focused on the resolution surface, the categories that touch fork operations, and CI reality. - The live cohort VPS environment file, database size, and current relay version are `UNKNOWN` from this checkout. - `openai/codex-action`'s isolation claims are taken from upstream's in-workflow comment, not independently verified. - Migration timing under real data volume is `UNKNOWN`. - Point-in-time: PR head `d555ec95`, checks read 2026-08-31. ## 19. Assessment Recommendation Recommendation: **`PROCEED WITH SPECIFIC ATTENTION`** — the merge itself is sound; the gating and deployment path are not yet ready. Rationale: No evidence of lost upstream semantics, no fork divergence incorrectly discarded, and a `Cargo.lock` that converged cleanly on upstream. The resolutions are better than the PR body claims for them. What is missing is evidence: a policy gate designed for feature PRs is failing a vendor drop by construction, and it has silenced the entire test matrix. Landing on that basis would mean adopting 204 commits into an operated relay on the strength of a Docker build and a smoke test. Fix the gate, get the matrix green, rehearse `0033`, then land. Advisory only; this report does not authorize or execute the change, and does not approve, merge, or deploy anything. ## 20. Evidence Baseline: merge-base `f8692fa9b52ddcfeb4b95fb4862109983509f131` Incoming: `eed74bde2f4797714335ac10c56c0b0244c1def4` (upstream/main HEAD, 2026-08-29) Downstream: `338b4d0cf2dd76cc43964bb717ce9f0a94a9c7a5` PR head: `d555ec95feb3a8bc5126385a1272d55aa051fe85` (parents verified) Relevant commits: `ee6ca5fa28bce04dfecb6717de65b08a57f2ac47` (`block#6729` signing-key fallback removal); `c432a111c` (`block#6269` push MVP, source of flagged `.pem` fixtures); `a7c7414a7f` (grew `agent_models_tests.rs` to 1001 lines) Relevant PRs: #1923 (OPEN, MERGEABLE, BLOCKED); refs PRD #273 Relevant files: the 13-file resolution surface (§3); `migrations/0032`–`0040`; `Justfile:106-110`; `deploy/compose/.env.example`; `desktop/src-tauri/src/managed_agents/runtime/summary.rs` CI evidence: runs `33341386172`, `33341386136`, `33341707392`, `33341386150`; failing jobs `99337537054` (file-size policy), `99337614742` (desktop aggregator), `99337536509` (security audit), `99338397889` (PR body) Dependency evidence: `Cargo.lock` identical to upstream at PR head; lock numstats §9. Scanner output `UNAVAILABLE`. Security evidence: `launchpad security audit` job log — 3 pass / 2 fail, findings enumerated Test evidence: `INCOMPLETE` — 12 pass, 23 skipped, 5 fail Documentation / ADR / policy evidence: `CLAUDE.md` (fork operating scope, migration auto-apply, file-size policy), `launchpad/deploy/archived/runbooks/hardening-spec.md` (production leaves `BUZZ_ADMIN_HOST` unset), PR #1923 body Evidence availability: `AVAILABLE` (Git, GitHub checks, job logs); `UNAVAILABLE` (local builds/tests, dependency & license scans, live VPS state)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Require
BUZZ_RELAY_PRIVATE_KEYon every relay startup and remove the shared public fallback key completely.For local development,
just bootstrapnow generates a random key once in the gitignored.envfile. Re-running bootstrap preserves that key, so relay-authored events retain the same identity across restarts. The local relay recipes reload.env, while isolated CI and E2E launchers pass explicit per-run keys.Startup fails immediately when the key is missing or invalid, before connecting to Postgres or Redis. Deployed relays continue to receive their stable key from the existing chart-managed secret.
Validated with:
./scripts/test-ensure-local-relay-key.shcargo test -p buzz-relay --bin buzz-relaycargo clippy -p buzz-relay --bin buzz-relay -- -D warningscargo fmt --all -- --checkshellcheck scripts/ensure-local-relay-key.sh scripts/test-ensure-local-relay-key.sh