fix(admin): allow cold storage worker DB startup - #7770
Merged
Merged
Conversation
Signed-off-by: Ravneet Arora <rarora@squareup.com>
🔐 Codex Security Review
|
Signed-off-by: Ravneet Arora <rarora@squareup.com>
Contributor
Author
|
@buzz-security-review aa200bb |
bradseiler
approved these changes
Sep 22, 2026
wpfleger96
pushed a commit
that referenced
this pull request
Sep 22, 2026
…-history * origin/main: fix(admin): allow cold storage worker DB startup (#7770) Signed-off-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>
wpfleger96
pushed a commit
that referenced
this pull request
Sep 22, 2026
…c-agent-commit-identity * origin/main: fix(desktop): bound startup request bursts and recover quota refusals (#7790) fix(audit): frame hash inputs with TLV (#7492) fix(admin): allow cold storage worker DB startup (#7770) Signed-off-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>
brow
added a commit
that referenced
this pull request
Sep 22, 2026
…-dev * origin/main: fix(desktop): bound startup request bursts and recover quota refusals (#7790) fix(audit): frame hash inputs with TLV (#7492) fix(admin): allow cold storage worker DB startup (#7770) feat(relay): add admin HTTP routes for member restriction management (#7302) fix(relay): fire kick live side effects at convergence; persist target; fence re-add race with held lock (#7298) feat(relay): add atomic complete read-state snapshots (#7572) fix(desktop): register macOS badges for new and existing installs (#7783) fix(mobile): avoid opening empty threads on message tap (#7756) fix(workflows): make deletion persistent and retryable (#7735) fix(mobile): preserve thread replies through refresh failures (#7757) fix(mobile): keep iOS message menu actions responsive after rebuilds (#7758) fix(relay): exclude ephemeral activity from message quota (#7736) release: push gateway chart 0.3.1 (#7749) fix(push): label plaintext push gateway service as HTTP (#7717) Replace personal and internal data in desktop test fixtures (#7748) Add mobile VISION (#7710) fix(mobile): keep relay sessions stable during push lease updates (#7745) Signed-off-by: Tom Brow <tomb@block.xyz>
wpfleger96
pushed a commit
that referenced
this pull request
Sep 22, 2026
…n-surface * origin/main: docs(nip-fi): clarify federated identity amendments (#7803) fix(desktop): refresh channels after access-revoked closure (#7784) fix(desktop): bound startup request bursts and recover quota refusals (#7790) fix(audit): frame hash inputs with TLV (#7492) fix(admin): allow cold storage worker DB startup (#7770) Signed-off-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>
wpfleger96
pushed a commit
that referenced
this pull request
Sep 22, 2026
…-hardening * origin/main: docs(nip-fi): clarify federated identity amendments (#7803) fix(desktop): refresh channels after access-revoked closure (#7784) fix(desktop): bound startup request bursts and recover quota refusals (#7790) fix(audit): frame hash inputs with TLV (#7492) fix(admin): allow cold storage worker DB startup (#7770) Signed-off-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>
wpfleger96
added a commit
that referenced
this pull request
Sep 22, 2026
NIP-FI admin disconnect/deny API implementation, rebased onto origin/main (c213d90) after main advanced past the original merge-base (77729ab). No buzz-relay production code changed by main's 3 new commits (#7770, #7492, #7790) — rebase is conflict-free. Squash of all commits from 2a42ddf through 360150d97: Production: - Deny-map JWT verifier and command installer (S4) - Disconnect endpoint and route wiring - Admin HTTP routes for deny/undeny, expiry TTL - WS connection admission: deny-map check wired in - Audio pre-writer send bounding (1s timeout policy) - nip_fi_session.rs: bounded pre-registration pairing sends - handler.rs MINOR: Ok(Ok(())) success check replaces is_err() Witnesses (Thufir round-5 required corrections): - R2: drain_terminal!() race witness (before_not_a_member_drain_terminal hook + cancel_race_test_hook; falsification: remove lifecycle_cancel() → frame-1 timeout RED) - F3: real admission → 48101 JOIN wire bytes → handle_huddle_liveness_req oracle → authoritative generation == wire generation - F4: valid future deadline + cancel-while-held (not already-expired); falsification: already-expired → hook timeout RED - F5: {"kinds":[13534]} REQ skips DB lookup, reaches after_req_permit_acquired; AUTH OK(true) check; real Postgres+Redis pools; canonical denial frame + 1008 close; zero global+channel refcounts asserted - F6: ENV_TEST_MUTEX synchronization for Config::from_env() - F7: 10s bounded consumer threads; entry-hook Drop guards - R1: reason-published/before-enqueue witness - F1/F2: LifecycleClosed transition primitives Evidence inventory corrections per Thufir's requirement: root raw cancels follow pairing_deny_terminal/auth_deny_terminal; audio pre-registration pairing sends direct denial/close; post-registration deny-set/expired paths send directly then raw-cancel; wrapper cancellation exists before AND after run(control).await. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
wpfleger96
added a commit
that referenced
this pull request
Sep 22, 2026
NIP-FI admin disconnect/deny API implementation, rebased onto origin/main (c213d90) after main advanced past the original merge-base (77729ab). No buzz-relay production code changed by main's 3 new commits (#7770, #7492, #7790) — rebase is conflict-free. Squash of all commits from 2a42ddf through 360150d97: Production: - Deny-map JWT verifier and command installer (S4) - Disconnect endpoint and route wiring - Admin HTTP routes for deny/undeny, expiry TTL - WS connection admission: deny-map check wired in - Audio pre-writer send bounding (1s timeout policy) - nip_fi_session.rs: bounded pre-registration pairing sends - handler.rs MINOR: Ok(Ok(())) success check replaces is_err() Witnesses (Thufir round-5 required corrections): - R2: drain_terminal!() race witness (before_not_a_member_drain_terminal hook + cancel_race_test_hook; falsification: remove lifecycle_cancel() → frame-1 timeout RED) - F3: real admission → 48101 JOIN wire bytes → handle_huddle_liveness_req oracle → authoritative generation == wire generation - F4: valid future deadline + cancel-while-held (not already-expired); falsification: already-expired → hook timeout RED - F5: {"kinds":[13534]} REQ skips DB lookup, reaches after_req_permit_acquired; AUTH OK(true) check; real Postgres+Redis pools; canonical denial frame + 1008 close; zero global+channel refcounts asserted - F6: ENV_TEST_MUTEX synchronization for Config::from_env() - F7: 10s bounded consumer threads; entry-hook Drop guards - R1: reason-published/before-enqueue witness - F1/F2: LifecycleClosed transition primitives Evidence inventory corrections per Thufir's requirement: root raw cancels follow pairing_deny_terminal/auth_deny_terminal; audio pre-registration pairing sends direct denial/close; post-registration deny-set/expired paths send directly then raw-cancel; wrapper cancellation exists before AND after run(control).await. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
wpfleger96
added a commit
that referenced
this pull request
Sep 22, 2026
NIP-FI admin disconnect/deny API implementation, rebased onto origin/main (c213d90) after main advanced past the original merge-base (77729ab). No buzz-relay production code changed by main's 3 new commits (#7770, #7492, #7790) — rebase is conflict-free. Squash of all commits from 2a42ddf through 360150d97: Production: - Deny-map JWT verifier and command installer (S4) - Disconnect endpoint and route wiring - Admin HTTP routes for deny/undeny, expiry TTL - WS connection admission: deny-map check wired in - Audio pre-writer send bounding (1s timeout policy) - nip_fi_session.rs: bounded pre-registration pairing sends - handler.rs MINOR: Ok(Ok(())) success check replaces is_err() Witnesses (Thufir round-5 required corrections): - R2: drain_terminal!() race witness (before_not_a_member_drain_terminal hook + cancel_race_test_hook; falsification: remove lifecycle_cancel() → frame-1 timeout RED) - F3: real admission → 48101 JOIN wire bytes → handle_huddle_liveness_req oracle → authoritative generation == wire generation - F4: valid future deadline + cancel-while-held (not already-expired); falsification: already-expired → hook timeout RED - F5: {"kinds":[13534]} REQ skips DB lookup, reaches after_req_permit_acquired; AUTH OK(true) check; real Postgres+Redis pools; canonical denial frame + 1008 close; zero global+channel refcounts asserted - F6: ENV_TEST_MUTEX synchronization for Config::from_env() - F7: 10s bounded consumer threads; entry-hook Drop guards - R1: reason-published/before-enqueue witness - F1/F2: LifecycleClosed transition primitives Evidence inventory corrections per Thufir's requirement: root raw cancels follow pairing_deny_terminal/auth_deny_terminal; audio pre-registration pairing sends direct denial/close; post-registration deny-set/expired paths send directly then raw-cancel; wrapper cancellation exists before AND after run(control).await. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
wpfleger96
added a commit
that referenced
this pull request
Sep 23, 2026
NIP-FI admin disconnect/deny API implementation, rebased onto origin/main (c213d90) after main advanced past the original merge-base (77729ab). No buzz-relay production code changed by main's 3 new commits (#7770, #7492, #7790) — rebase is conflict-free. Squash of all commits from 2a42ddf through 360150d97: Production: - Deny-map JWT verifier and command installer (S4) - Disconnect endpoint and route wiring - Admin HTTP routes for deny/undeny, expiry TTL - WS connection admission: deny-map check wired in - Audio pre-writer send bounding (1s timeout policy) - nip_fi_session.rs: bounded pre-registration pairing sends - handler.rs MINOR: Ok(Ok(())) success check replaces is_err() Witnesses (Thufir round-5 required corrections): - R2: drain_terminal!() race witness (before_not_a_member_drain_terminal hook + cancel_race_test_hook; falsification: remove lifecycle_cancel() → frame-1 timeout RED) - F3: real admission → 48101 JOIN wire bytes → handle_huddle_liveness_req oracle → authoritative generation == wire generation - F4: valid future deadline + cancel-while-held (not already-expired); falsification: already-expired → hook timeout RED - F5: {"kinds":[13534]} REQ skips DB lookup, reaches after_req_permit_acquired; AUTH OK(true) check; real Postgres+Redis pools; canonical denial frame + 1008 close; zero global+channel refcounts asserted - F6: ENV_TEST_MUTEX synchronization for Config::from_env() - F7: 10s bounded consumer threads; entry-hook Drop guards - R1: reason-published/before-enqueue witness - F1/F2: LifecycleClosed transition primitives Evidence inventory corrections per Thufir's requirement: root raw cancels follow pairing_deny_terminal/auth_deny_terminal; audio pre-registration pairing sends direct denial/close; post-registration deny-set/expired paths send directly then raw-cancel; wrapper cancellation exists before AND after run(control).await. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com> Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
wpfleger96
added a commit
that referenced
this pull request
Sep 23, 2026
NIP-FI admin disconnect/deny API implementation, rebased onto origin/main (c213d90) after main advanced past the original merge-base (77729ab). No buzz-relay production code changed by main's 3 new commits (#7770, #7492, #7790) — rebase is conflict-free. Squash of all commits from 2a42ddf through 360150d97: Production: - Deny-map JWT verifier and command installer (S4) - Disconnect endpoint and route wiring - Admin HTTP routes for deny/undeny, expiry TTL - WS connection admission: deny-map check wired in - Audio pre-writer send bounding (1s timeout policy) - nip_fi_session.rs: bounded pre-registration pairing sends - handler.rs MINOR: Ok(Ok(())) success check replaces is_err() Witnesses (Thufir round-5 required corrections): - R2: drain_terminal!() race witness (before_not_a_member_drain_terminal hook + cancel_race_test_hook; falsification: remove lifecycle_cancel() → frame-1 timeout RED) - F3: real admission → 48101 JOIN wire bytes → handle_huddle_liveness_req oracle → authoritative generation == wire generation - F4: valid future deadline + cancel-while-held (not already-expired); falsification: already-expired → hook timeout RED - F5: {"kinds":[13534]} REQ skips DB lookup, reaches after_req_permit_acquired; AUTH OK(true) check; real Postgres+Redis pools; canonical denial frame + 1008 close; zero global+channel refcounts asserted - F6: ENV_TEST_MUTEX synchronization for Config::from_env() - F7: 10s bounded consumer threads; entry-hook Drop guards - R1: reason-published/before-enqueue witness - F1/F2: LifecycleClosed transition primitives Evidence inventory corrections per Thufir's requirement: root raw cancels follow pairing_deny_terminal/auth_deny_terminal; audio pre-registration pairing sends direct denial/close; post-registration deny-set/expired paths send directly then raw-cancel; wrapper cancellation exists before AND after run(control).await. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
wpfleger96
pushed a commit
that referenced
this pull request
Sep 23, 2026
…rcement * origin/main: fix(hooks): strip repo-local git env from pre-push test lanes (#7841) fix(mobile-infra): render push grant lifetimes as decimal in chart 0.3.2 (#7820) fix(agent): preserve Databricks Opus UC reasoning and tool continuation (#7840) feat(canvas): add version history with atomic restore (#6780) chore(release): release Buzz Desktop version 0.5.24 (#7817) test(desktop): stabilize unread and audio release smoke fixtures (#7821) fix(desktop): remember Inbox unread-only choice (#7672) feat(mobile-infra): support development App Attest (#7744) docs(nip-fi): clarify federated identity amendments (#7803) fix(desktop): refresh channels after access-revoked closure (#7784) fix(desktop): bound startup request bursts and recover quota refusals (#7790) fix(audit): frame hash inputs with TLV (#7492) fix(admin): allow cold storage worker DB startup (#7770) Signed-off-by: Hayt <211b96e6a2b7f45fd4047988976c7bbbeeda0c15f3ae7b32eec20834b5a55118@buzz.block.builderlab.xyz> # Conflicts: # crates/buzz-relay/src/api/bridge.rs
ravarora2
added a commit
that referenced
this pull request
Sep 23, 2026
## Summary Make the relay read completed storage-accounting snapshots from PostgreSQL by default. An environment with no snapshot emits no storage metrics. When a worker publishes its first result, the relay picks it up on the next successful leader usage tick, without a restart or configuration change. This changes how storage usage is measured and reported. **S3 remains the object store. PostgreSQL stores the completed counts, byte totals, community breakdown, and calculation metadata—not the objects themselves.** ### Why move relay storage accounting entirely to database reads? Today the relay supports two sources: its own S3 scan (`inline`, the default) and the worker's saved snapshot (`external`). That requires operators to deploy a worker and then coordinate a separate relay-mode change in each environment. The worker already owns the S3 listing and calculation. It runs in a separate process with its own object cap, memory limit, and deadline. Keeping a second scan inside the serving relay retains the resource pressure and failure modes that this isolation is meant to remove. PostgreSQL provides a durable handoff. The worker replaces one completed snapshot atomically after a successful calculation. The relay reads that row and exposes its values through the existing metrics endpoint. A relay restart or leadership change can load the last completed result without scanning the bucket again. There is deliberately no S3 fallback when a snapshot is absent or a read fails. Such a fallback would put the expensive scan back in the relay precisely when a worker is absent or unhealthy. It would also leave two calculation paths with different resource limits and freshness behavior. ### What happens if no worker exists? **A worker that has never published is a normal, successful inactive state.** The snapshot table must exist through the normal database schema, but it may contain zero rows. The reader returns success, emits no storage totals or failed-load gauge, and checks again on the next usage tick. It does not exit the relay, start a worker, or list S3. The relay checks for a completed database row; it does not inspect Kubernetes Jobs or CronJobs. Worker presence and snapshot presence are therefore different: | Situation | Storage-reader behavior | |---|---| | No worker and no snapshot row | Return success, emit no storage metrics, and query again next tick. | | Worker starts later and publishes its first row | Read and emit it on the next successful leader usage tick; no restart or mode change. | | Worker is removed or fails, but its last valid row remains | Continue reporting the last completed totals with their increasing age. | | Query succeeds but a previously present row has been removed | Clear the cache and stop refreshing storage series; existing exporter series expire through the idle timeout. | | Database read fails, times out, or returns an invalid snapshot | Log a warning, set `buzz_storage_snapshot_load_ok=0`, retain any last-good cached totals, and retry next tick. | | Snapshot table is missing | Treat this as a schema error, not normal worker absence; follow the failed-read behavior above. | | `BUZZ_STORAGE_METRICS=off` | Skip the snapshot query and all storage metric emission. | No row means “not measured,” not zero bytes. A valid completed snapshot of an empty bucket can report zero. If a read fails before any good snapshot has been cached, only failed-load health is emitted. These reads happen in the existing background metrics task, not the relay startup path. A storage-read failure does not request process exit or change readiness directly. A wider database outage can still affect the relay's existing database-dependent operations and readiness. ### Read, parse, and emit path ```text Worker: S3 listing -> BucketSnapshot -> JSON -> PostgreSQL Relay: PostgreSQL -> JSON -> BucketSnapshot -> existing metric gauges Collector: relay /metrics endpoint -> Datadog ``` 1. `main.rs::run_storage_sweep_tick` calls the reader from the existing leader-only usage task. The default interval remains 300 seconds. 2. `storage_sweep.rs::run_storage_metrics_tick` coordinates the read, cache update, failure health, and metric emission. 3. `refresh_persisted_snapshot` calls the existing `Db::load_storage_accounting_snapshot()` method. A five-second timeout covers pool acquisition and the query. It uses the relay's existing pool. 4. The existing query in `buzz-db/src/store/storage_accounting.rs` reads `snapshot`, `completed_at`, `duration_ms`, `max_objects`, and `code_sha` from the singleton row. 5. `serde_json::from_value(stored.snapshot)` decodes the JSON into the existing `buzz_media::BucketSnapshot` type. Rust infers that type from `cache_persisted_snapshot`'s argument. The generated `Deserialize` implementation handles all fields, including the UUID-keyed `per_community` map. 6. `emit_cached_storage_metrics` sets the existing physical/logical totals and community byte/object gauges. The existing Prometheus exporter exposes them for Datadog collection; this code does not send snapshot JSON to Datadog. The worker's `BucketSnapshot`/`CommunityStorage` structures, JSON field names, SQL publication method, and database schema are unchanged. The old external-mode JSON conversion moves out of `main.rs` into the reader helper. No new format or hand-written field parser is needed. Duration and object-cap metadata are validated before replacing the cache. The five-second relay read timeout is separate from the worker's 30-second startup acquisition budget introduced in #7770. This PR does not change the worker's pool or startup logic. ### Configuration and code changes | Configuration | Before | After | |---|---|---| | Unset, `inline`, or `on` | Relay-local S3 scan | Read completed database snapshots. `inline` logs one migration warning. | | `external` or `snapshot` | Read completed database snapshots | Continue reading snapshots. | | `off` | Disabled | Disabled. | | Unknown or empty value | Disabled with a configuration error | Same. | Existing `inline` settings intentionally become reader aliases. Merely changing the default would leave older deployments on their explicit `inline` setting and preserve the need for coordinated configuration PRs. Remove relay-local scan scheduling, in-flight scan state, scan configuration, and obsolete scan-attempt tests and health metrics. Preserve the physical/logical total and per-community metric names, leader-only emission, community scope filtering, and cleanup of old community labels. The shared relay-state field remains in place; its comment now describes a cached worker result. The Helm chart defaults to `relayMode: external` while leaving `storageAccounting.enabled: false`. Its rendering test verifies that the reader is configured even when no worker is created. The reader regression tests cover missing rows, later publication, updates, invalid data, timeout, removal, reactivation, and the explicit off switch. `docs/storage-accounting.md` describes this operating model. ### Freshness and rollout impact `buzz_storage_snapshot_age_seconds` uses the worker's original completion timestamp. Re-reading an old row never makes it fresh. `buzz_storage_snapshot_load_ok=1` means the row was read and decoded; it does not prove that the worker's latest attempt succeeded. Monitor snapshot age against the worker's schedule and allowed runtime, and monitor Job failures separately. The old relay scan-attempt health gauges are retired because the relay no longer runs those scans. Deploy this relay version through the usual release process. Once it reaches an environment, workers can be enabled independently. Already-released charts that still set `inline` work with the new binary; future chart releases default explicitly to `external`. An intentional `off` override still requires an operator to enable the reader. **Environments with no completed snapshot lose relay-calculated storage totals after this upgrade.** That is the intended tradeoff for removing scans from the serving process. Environments with a prior snapshot continue showing its last completed totals and age. This PR does not install workers in additional environments or deploy the new relay image. ### Related issue Related to #4601. Follows the worker startup fix in #7770. The separate fleet-usage collector work in #7176 overlaps this code and may need reconciliation when it merges. ### Testing Built and ran the relay locally against isolated PostgreSQL and Redis with the legacy `inline` setting, five-second usage ticks, and a 15-second metric idle timeout. The same process was exercised through these steps: 1. Start with an empty snapshot table: relay becomes ready and exposes no storage series. 2. Publish a snapshot containing 123 bytes: the community gauge becomes 123. 3. Replace it with 456 bytes: the gauge becomes 456. 4. Remove the row: storage series expire without fabricating a zero-byte measurement. 5. Publish 789 bytes: metrics reactivate without restarting the relay; readiness remains healthy. The local S3 endpoint recorded zero requests. The unrelated Git conformance startup probe was disabled for this isolated reader check; the test covers storage accounting, not every other use of S3 in the relay. No new relay image was deployed to staging or production during this test. The broad local integration run also hit an existing `p0_pool_acquisitions_use_typed_operation_pairs_without_other` failure in `buzz-db/tests/observability_source.rs`. The same source-only test fails on unmodified `main` at `0ef7a2222`; this PR changes neither the test nor its failing source. The full local `just ci` run stopped at mobile native-asset setup: the `objective_c` build hook received no SDK path from `xcrun`. Mobile tests did not run. Generated with Codex Signed-off-by: Ravneet Arora <rarora@squareup.com>
wpfleger96
added a commit
that referenced
this pull request
Sep 23, 2026
NIP-FI admin disconnect/deny API implementation, rebased onto origin/main (c213d90) after main advanced past the original merge-base (77729ab). No buzz-relay production code changed by main's 3 new commits (#7770, #7492, #7790) — rebase is conflict-free. Squash of all commits from 2a42ddf through 360150d97: Production: - Deny-map JWT verifier and command installer (S4) - Disconnect endpoint and route wiring - Admin HTTP routes for deny/undeny, expiry TTL - WS connection admission: deny-map check wired in - Audio pre-writer send bounding (1s timeout policy) - nip_fi_session.rs: bounded pre-registration pairing sends - handler.rs MINOR: Ok(Ok(())) success check replaces is_err() Witnesses (Thufir round-5 required corrections): - R2: drain_terminal!() race witness (before_not_a_member_drain_terminal hook + cancel_race_test_hook; falsification: remove lifecycle_cancel() → frame-1 timeout RED) - F3: real admission → 48101 JOIN wire bytes → handle_huddle_liveness_req oracle → authoritative generation == wire generation - F4: valid future deadline + cancel-while-held (not already-expired); falsification: already-expired → hook timeout RED - F5: {"kinds":[13534]} REQ skips DB lookup, reaches after_req_permit_acquired; AUTH OK(true) check; real Postgres+Redis pools; canonical denial frame + 1008 close; zero global+channel refcounts asserted - F6: ENV_TEST_MUTEX synchronization for Config::from_env() - F7: 10s bounded consumer threads; entry-hook Drop guards - R1: reason-published/before-enqueue witness - F1/F2: LifecycleClosed transition primitives Evidence inventory corrections per Thufir's requirement: root raw cancels follow pairing_deny_terminal/auth_deny_terminal; audio pre-registration pairing sends direct denial/close; post-registration deny-set/expired paths send directly then raw-cancel; wrapper cancellation exists before AND after run(control).await. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
wpfleger96
added a commit
that referenced
this pull request
Sep 23, 2026
NIP-FI admin disconnect/deny API implementation, rebased onto origin/main (c213d90) after main advanced past the original merge-base (77729ab). No buzz-relay production code changed by main's 3 new commits (#7770, #7492, #7790) — rebase is conflict-free. Squash of all commits from 2a42ddf through 360150d97: Production: - Deny-map JWT verifier and command installer (S4) - Disconnect endpoint and route wiring - Admin HTTP routes for deny/undeny, expiry TTL - WS connection admission: deny-map check wired in - Audio pre-writer send bounding (1s timeout policy) - nip_fi_session.rs: bounded pre-registration pairing sends - handler.rs MINOR: Ok(Ok(())) success check replaces is_err() Witnesses (Thufir round-5 required corrections): - R2: drain_terminal!() race witness (before_not_a_member_drain_terminal hook + cancel_race_test_hook; falsification: remove lifecycle_cancel() → frame-1 timeout RED) - F3: real admission → 48101 JOIN wire bytes → handle_huddle_liveness_req oracle → authoritative generation == wire generation - F4: valid future deadline + cancel-while-held (not already-expired); falsification: already-expired → hook timeout RED - F5: {"kinds":[13534]} REQ skips DB lookup, reaches after_req_permit_acquired; AUTH OK(true) check; real Postgres+Redis pools; canonical denial frame + 1008 close; zero global+channel refcounts asserted - F6: ENV_TEST_MUTEX synchronization for Config::from_env() - F7: 10s bounded consumer threads; entry-hook Drop guards - R1: reason-published/before-enqueue witness - F1/F2: LifecycleClosed transition primitives Evidence inventory corrections per Thufir's requirement: root raw cancels follow pairing_deny_terminal/auth_deny_terminal; audio pre-registration pairing sends direct denial/close; post-registration deny-set/expired paths send directly then raw-cancel; wrapper cancellation exists before AND after run(control).await. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
wpfleger96
added a commit
that referenced
this pull request
Sep 23, 2026
NIP-FI admin disconnect/deny API implementation, rebased onto origin/main (c213d90) after main advanced past the original merge-base (77729ab). No buzz-relay production code changed by main's 3 new commits (#7770, #7492, #7790) — rebase is conflict-free. Squash of all commits from 2a42ddf through 360150d97: Production: - Deny-map JWT verifier and command installer (S4) - Disconnect endpoint and route wiring - Admin HTTP routes for deny/undeny, expiry TTL - WS connection admission: deny-map check wired in - Audio pre-writer send bounding (1s timeout policy) - nip_fi_session.rs: bounded pre-registration pairing sends - handler.rs MINOR: Ok(Ok(())) success check replaces is_err() Witnesses (Thufir round-5 required corrections): - R2: drain_terminal!() race witness (before_not_a_member_drain_terminal hook + cancel_race_test_hook; falsification: remove lifecycle_cancel() → frame-1 timeout RED) - F3: real admission → 48101 JOIN wire bytes → handle_huddle_liveness_req oracle → authoritative generation == wire generation - F4: valid future deadline + cancel-while-held (not already-expired); falsification: already-expired → hook timeout RED - F5: {"kinds":[13534]} REQ skips DB lookup, reaches after_req_permit_acquired; AUTH OK(true) check; real Postgres+Redis pools; canonical denial frame + 1008 close; zero global+channel refcounts asserted - F6: ENV_TEST_MUTEX synchronization for Config::from_env() - F7: 10s bounded consumer threads; entry-hook Drop guards - R1: reason-published/before-enqueue witness - F1/F2: LifecycleClosed transition primitives Evidence inventory corrections per Thufir's requirement: root raw cancels follow pairing_deny_terminal/auth_deny_terminal; audio pre-registration pairing sends direct denial/close; post-registration deny-set/expired paths send directly then raw-cancel; wrapper cancellation exists before AND after run(control).await. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
bradseiler
pushed a commit
that referenced
this pull request
Sep 23, 2026
…in-gate * origin/main: (30 commits) feat(agents): humanize uncurated Databricks model ids with a label grammar (#7844) fix: route databricks claude fqns to anthropic messages (#7829) feat(relay): add opt-in newest-first thread windows (#7823) refactor: move agent Git bootstrap into ACP harness (#7819) Use worker snapshots for relay storage metrics (#7845) fix(hooks): strip repo-local git env from pre-push test lanes (#7841) fix(mobile-infra): render push grant lifetimes as decimal in chart 0.3.2 (#7820) fix(agent): preserve Databricks Opus UC reasoning and tool continuation (#7840) feat(canvas): add version history with atomic restore (#6780) chore(release): release Buzz Desktop version 0.5.24 (#7817) test(desktop): stabilize unread and audio release smoke fixtures (#7821) fix(desktop): remember Inbox unread-only choice (#7672) feat(mobile-infra): support development App Attest (#7744) docs(nip-fi): clarify federated identity amendments (#7803) fix(desktop): refresh channels after access-revoked closure (#7784) fix(desktop): bound startup request bursts and recover quota refusals (#7790) fix(audit): frame hash inputs with TLV (#7492) fix(admin): allow cold storage worker DB startup (#7770) feat(relay): add admin HTTP routes for member restriction management (#7302) fix(relay): fire kick live side effects at convergence; persist target; fence re-add race with held lock (#7298) ... Signed-off-by: coder 1 <a93f3b1decd199cec83848f116ff60c20776cdd03861b9bba2610acae7c9eeeb@buzz.block.builderlab.xyz>
michaelneale
added a commit
that referenced
this pull request
Sep 24, 2026
* origin/main: feat(agents): humanize uncurated Databricks model ids with a label grammar (#7844) fix: route databricks claude fqns to anthropic messages (#7829) feat(relay): add opt-in newest-first thread windows (#7823) refactor: move agent Git bootstrap into ACP harness (#7819) Use worker snapshots for relay storage metrics (#7845) fix(hooks): strip repo-local git env from pre-push test lanes (#7841) fix(mobile-infra): render push grant lifetimes as decimal in chart 0.3.2 (#7820) fix(agent): preserve Databricks Opus UC reasoning and tool continuation (#7840) feat(canvas): add version history with atomic restore (#6780) chore(release): release Buzz Desktop version 0.5.24 (#7817) test(desktop): stabilize unread and audio release smoke fixtures (#7821) fix(desktop): remember Inbox unread-only choice (#7672) feat(mobile-infra): support development App Attest (#7744) docs(nip-fi): clarify federated identity amendments (#7803) fix(desktop): refresh channels after access-revoked closure (#7784) fix(desktop): bound startup request bursts and recover quota refusals (#7790) fix(audit): frame hash inputs with TLV (#7492) fix(admin): allow cold storage worker DB startup (#7770) Signed-off-by: Michael Neale <michael.neale@gmail.com>
wpfleger96
added a commit
that referenced
this pull request
Sep 24, 2026
NIP-FI admin disconnect/deny API implementation, rebased onto origin/main (c213d90) after main advanced past the original merge-base (77729ab). No buzz-relay production code changed by main's 3 new commits (#7770, #7492, #7790) — rebase is conflict-free. Squash of all commits from 2a42ddf through 360150d97: Production: - Deny-map JWT verifier and command installer (S4) - Disconnect endpoint and route wiring - Admin HTTP routes for deny/undeny, expiry TTL - WS connection admission: deny-map check wired in - Audio pre-writer send bounding (1s timeout policy) - nip_fi_session.rs: bounded pre-registration pairing sends - handler.rs MINOR: Ok(Ok(())) success check replaces is_err() Witnesses (Thufir round-5 required corrections): - R2: drain_terminal!() race witness (before_not_a_member_drain_terminal hook + cancel_race_test_hook; falsification: remove lifecycle_cancel() → frame-1 timeout RED) - F3: real admission → 48101 JOIN wire bytes → handle_huddle_liveness_req oracle → authoritative generation == wire generation - F4: valid future deadline + cancel-while-held (not already-expired); falsification: already-expired → hook timeout RED - F5: {"kinds":[13534]} REQ skips DB lookup, reaches after_req_permit_acquired; AUTH OK(true) check; real Postgres+Redis pools; canonical denial frame + 1008 close; zero global+channel refcounts asserted - F6: ENV_TEST_MUTEX synchronization for Config::from_env() - F7: 10s bounded consumer threads; entry-hook Drop guards - R1: reason-published/before-enqueue witness - F1/F2: LifecycleClosed transition primitives Evidence inventory corrections per Thufir's requirement: root raw cancels follow pairing_deny_terminal/auth_deny_terminal; audio pre-registration pairing sends direct denial/close; post-registration deny-set/expired paths send directly then raw-cancel; wrapper cancellation exists before AND after run(control).await. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com> Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
wpfleger96
added a commit
that referenced
this pull request
Sep 24, 2026
NIP-FI admin disconnect/deny API implementation, rebased onto origin/main (c213d90) after main advanced past the original merge-base (77729ab). No buzz-relay production code changed by main's 3 new commits (#7770, #7492, #7790) — rebase is conflict-free. Squash of all commits from 2a42ddf through 360150d97: Production: - Deny-map JWT verifier and command installer (S4) - Disconnect endpoint and route wiring - Admin HTTP routes for deny/undeny, expiry TTL - WS connection admission: deny-map check wired in - Audio pre-writer send bounding (1s timeout policy) - nip_fi_session.rs: bounded pre-registration pairing sends - handler.rs MINOR: Ok(Ok(())) success check replaces is_err() Witnesses (Thufir round-5 required corrections): - R2: drain_terminal!() race witness (before_not_a_member_drain_terminal hook + cancel_race_test_hook; falsification: remove lifecycle_cancel() → frame-1 timeout RED) - F3: real admission → 48101 JOIN wire bytes → handle_huddle_liveness_req oracle → authoritative generation == wire generation - F4: valid future deadline + cancel-while-held (not already-expired); falsification: already-expired → hook timeout RED - F5: {"kinds":[13534]} REQ skips DB lookup, reaches after_req_permit_acquired; AUTH OK(true) check; real Postgres+Redis pools; canonical denial frame + 1008 close; zero global+channel refcounts asserted - F6: ENV_TEST_MUTEX synchronization for Config::from_env() - F7: 10s bounded consumer threads; entry-hook Drop guards - R1: reason-published/before-enqueue witness - F1/F2: LifecycleClosed transition primitives Evidence inventory corrections per Thufir's requirement: root raw cancels follow pairing_deny_terminal/auth_deny_terminal; audio pre-registration pairing sends direct denial/close; post-registration deny-set/expired paths send directly then raw-cancel; wrapper cancellation exists before AND after run(control).await. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com> Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
wpfleger96
added a commit
that referenced
this pull request
Sep 24, 2026
NIP-FI admin disconnect/deny API implementation, rebased onto origin/main (c213d90) after main advanced past the original merge-base (77729ab). No buzz-relay production code changed by main's 3 new commits (#7770, #7492, #7790) — rebase is conflict-free. Squash of all commits from 2a42ddf through 360150d97: Production: - Deny-map JWT verifier and command installer (S4) - Disconnect endpoint and route wiring - Admin HTTP routes for deny/undeny, expiry TTL - WS connection admission: deny-map check wired in - Audio pre-writer send bounding (1s timeout policy) - nip_fi_session.rs: bounded pre-registration pairing sends - handler.rs MINOR: Ok(Ok(())) success check replaces is_err() Witnesses (Thufir round-5 required corrections): - R2: drain_terminal!() race witness (before_not_a_member_drain_terminal hook + cancel_race_test_hook; falsification: remove lifecycle_cancel() → frame-1 timeout RED) - F3: real admission → 48101 JOIN wire bytes → handle_huddle_liveness_req oracle → authoritative generation == wire generation - F4: valid future deadline + cancel-while-held (not already-expired); falsification: already-expired → hook timeout RED - F5: {"kinds":[13534]} REQ skips DB lookup, reaches after_req_permit_acquired; AUTH OK(true) check; real Postgres+Redis pools; canonical denial frame + 1008 close; zero global+channel refcounts asserted - F6: ENV_TEST_MUTEX synchronization for Config::from_env() - F7: 10s bounded consumer threads; entry-hook Drop guards - R1: reason-published/before-enqueue witness - F1/F2: LifecycleClosed transition primitives Evidence inventory corrections per Thufir's requirement: root raw cancels follow pairing_deny_terminal/auth_deny_terminal; audio pre-registration pairing sends direct denial/close; post-registration deny-set/expired paths send directly then raw-cancel; wrapper cancellation exists before AND after run(control).await. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com> Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
wpfleger96
added a commit
that referenced
this pull request
Sep 24, 2026
NIP-FI admin disconnect/deny API implementation, rebased onto origin/main (c213d90) after main advanced past the original merge-base (77729ab). No buzz-relay production code changed by main's 3 new commits (#7770, #7492, #7790) — rebase is conflict-free. Squash of all commits from 2a42ddf through 360150d97: Production: - Deny-map JWT verifier and command installer (S4) - Disconnect endpoint and route wiring - Admin HTTP routes for deny/undeny, expiry TTL - WS connection admission: deny-map check wired in - Audio pre-writer send bounding (1s timeout policy) - nip_fi_session.rs: bounded pre-registration pairing sends - handler.rs MINOR: Ok(Ok(())) success check replaces is_err() Witnesses (Thufir round-5 required corrections): - R2: drain_terminal!() race witness (before_not_a_member_drain_terminal hook + cancel_race_test_hook; falsification: remove lifecycle_cancel() → frame-1 timeout RED) - F3: real admission → 48101 JOIN wire bytes → handle_huddle_liveness_req oracle → authoritative generation == wire generation - F4: valid future deadline + cancel-while-held (not already-expired); falsification: already-expired → hook timeout RED - F5: {"kinds":[13534]} REQ skips DB lookup, reaches after_req_permit_acquired; AUTH OK(true) check; real Postgres+Redis pools; canonical denial frame + 1008 close; zero global+channel refcounts asserted - F6: ENV_TEST_MUTEX synchronization for Config::from_env() - F7: 10s bounded consumer threads; entry-hook Drop guards - R1: reason-published/before-enqueue witness - F1/F2: LifecycleClosed transition primitives Evidence inventory corrections per Thufir's requirement: root raw cancels follow pairing_deny_terminal/auth_deny_terminal; audio pre-registration pairing sends direct denial/close; post-registration deny-set/expired paths send directly then raw-cancel; wrapper cancellation exists before AND after run(control).await. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
wpfleger96
added a commit
that referenced
this pull request
Sep 24, 2026
NIP-FI admin disconnect/deny API implementation, rebased onto origin/main (c213d90) after main advanced past the original merge-base (77729ab). No buzz-relay production code changed by main's 3 new commits (#7770, #7492, #7790) — rebase is conflict-free. Squash of all commits from 2a42ddf through 360150d97: Production: - Deny-map JWT verifier and command installer (S4) - Disconnect endpoint and route wiring - Admin HTTP routes for deny/undeny, expiry TTL - WS connection admission: deny-map check wired in - Audio pre-writer send bounding (1s timeout policy) - nip_fi_session.rs: bounded pre-registration pairing sends - handler.rs MINOR: Ok(Ok(())) success check replaces is_err() Witnesses (Thufir round-5 required corrections): - R2: drain_terminal!() race witness (before_not_a_member_drain_terminal hook + cancel_race_test_hook; falsification: remove lifecycle_cancel() → frame-1 timeout RED) - F3: real admission → 48101 JOIN wire bytes → handle_huddle_liveness_req oracle → authoritative generation == wire generation - F4: valid future deadline + cancel-while-held (not already-expired); falsification: already-expired → hook timeout RED - F5: {"kinds":[13534]} REQ skips DB lookup, reaches after_req_permit_acquired; AUTH OK(true) check; real Postgres+Redis pools; canonical denial frame + 1008 close; zero global+channel refcounts asserted - F6: ENV_TEST_MUTEX synchronization for Config::from_env() - F7: 10s bounded consumer threads; entry-hook Drop guards - R1: reason-published/before-enqueue witness - F1/F2: LifecycleClosed transition primitives Evidence inventory corrections per Thufir's requirement: root raw cancels follow pairing_deny_terminal/auth_deny_terminal; audio pre-registration pairing sends direct denial/close; post-registration deny-set/expired paths send directly then raw-cancel; wrapper cancellation exists before AND after run(control).await. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
wpfleger96
added a commit
that referenced
this pull request
Sep 24, 2026
NIP-FI admin disconnect/deny API implementation, rebased onto origin/main (c213d90) after main advanced past the original merge-base (77729ab). No buzz-relay production code changed by main's 3 new commits (#7770, #7492, #7790) — rebase is conflict-free. Squash of all commits from 2a42ddf through 360150d97: Production: - Deny-map JWT verifier and command installer (S4) - Disconnect endpoint and route wiring - Admin HTTP routes for deny/undeny, expiry TTL - WS connection admission: deny-map check wired in - Audio pre-writer send bounding (1s timeout policy) - nip_fi_session.rs: bounded pre-registration pairing sends - handler.rs MINOR: Ok(Ok(())) success check replaces is_err() Witnesses (Thufir round-5 required corrections): - R2: drain_terminal!() race witness (before_not_a_member_drain_terminal hook + cancel_race_test_hook; falsification: remove lifecycle_cancel() → frame-1 timeout RED) - F3: real admission → 48101 JOIN wire bytes → handle_huddle_liveness_req oracle → authoritative generation == wire generation - F4: valid future deadline + cancel-while-held (not already-expired); falsification: already-expired → hook timeout RED - F5: {"kinds":[13534]} REQ skips DB lookup, reaches after_req_permit_acquired; AUTH OK(true) check; real Postgres+Redis pools; canonical denial frame + 1008 close; zero global+channel refcounts asserted - F6: ENV_TEST_MUTEX synchronization for Config::from_env() - F7: 10s bounded consumer threads; entry-hook Drop guards - R1: reason-published/before-enqueue witness - F1/F2: LifecycleClosed transition primitives Evidence inventory corrections per Thufir's requirement: root raw cancels follow pairing_deny_terminal/auth_deny_terminal; audio pre-registration pairing sends direct denial/close; post-registration deny-set/expired paths send directly then raw-cancel; wrapper cancellation exists before AND after run(control).await. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The standalone S3 accounting worker can exit before its scan begins because database startup inherits the relay’s three-second connection budget. A cold DNS probe took about five seconds.
Give
buzz-admin storage-snapshotits own pool: one connection, no minimum idle connections, and a 30-second acquisition budget. Retry startup timeouts and transport failures at most twice, after two and five seconds. Total startup wait is bounded to 97 seconds. Configuration, authentication, TLS, and protocol errors fail immediately.Log each startup attempt’s elapsed time and error category without connection credentials. Relay defaults stay unchanged. Retries stop before lock acquisition; the same lock-owning database session still publishes the completed snapshot.
Related issue
Follow-up to #7543. No duplicate startup fix found.
Testing
Archived-command check: built a nextest archive, temporarily moved
target/debug/buzz-adminout of the checkout, and ranscripts/postgres-test-run.sh --archive-file <archive>. Both tests failed before the path fix and passed afterward. The tests use nextest’s relocated executable path, with the original Cargo path retained for local runs.Manually restored the old startup call and ran
scripts/postgres-test-run.sh -p buzz-admin --test postgres_storage_snapshot -E 'test(storage_snapshot_retries_then)'. It failed before reaching S3; restoring the fix passed. This confirms the test exercises the actual worker command.Local
just cipassed all stages before mobile tests, which stopped at SDK discovery in theobjective_cnative hook. The default Xcode tools report an unaccepted license. Two existing PostgreSQL tests hit connection timeouts in the parallel run and passed individually.After merge, build a worker image and repeat the cold-pod staging smoke test through snapshot publication before changing relay metrics mode.
Generated with Codex