Commit Graph
2113 Commits
Author SHA1 Message Date
Cea Stapleton Cordasco 872e1b59c2 fix(auth): update deny test provider
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-04 13:47:02 -05:00
Cea Stapleton Cordasco b3d3b1d084 fix(auth): update focused test adapters
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-04 13:39:26 -05:00
Cea Stapleton Cordasco 75e3ff935d fix(auth): bind delegation and session revisions
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-04 13:24:48 -05:00
Cea Stapleton Cordasco 9e670f6541 test(auth): expose shared contract gaps
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-04 13:10:37 -05:00
Cea Stapleton Cordasco a8f37953e3 test(auth): publish hosted O4 conformance selection
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-04 12:19:37 -05:00
Cea Stapleton Cordasco 3a682c6fc1 feat(relay): expose production authorization reachability
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-04 12:19:13 -05:00
Cea Stapleton Cordasco 592f267902 feat(auth): persist current client status projections
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-04 12:19:04 -05:00
Cea Stapleton Cordasco 6298645ed8 fix(auth): implement deny-protected fail-safe mode
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-04 12:18:58 -05:00
Cea Stapleton Cordasco d3293885ac feat(auth): install typed provider provenance
Canonical O4 slice: 09_provider_installation
Final-tree source: e45553ea65b66631771c16908513f983d3c0b881

Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-04 11:43:41 -05:00
Cea Stapleton Cordasco df4efac2f5 fix(auth): enforce server-owned enrollment policy
Canonical O4 slice: 08_enrollment_policy
Final-tree source: e45553ea65b66631771c16908513f983d3c0b881

Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-04 11:43:41 -05:00
Cea Stapleton Cordasco 19524a34ff feat(auth): converge revocation and invalidation
Canonical O4 slice: 07_revocation_invalidation
Final-tree source: e45553ea65b66631771c16908513f983d3c0b881

Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-04 11:43:40 -05:00
Cea Stapleton Cordasco 66c699acc9 fix(relay): enforce the protected route inventory
Canonical O4 slice: 06_protected_route_wiring
Final-tree source: e45553ea65b66631771c16908513f983d3c0b881

Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-04 11:43:40 -05:00
Cea Stapleton Cordasco ac767fc743 feat(relay): couple protected media git and audio transports
Canonical O4 slice: 05_protected_transports
Final-tree source: e45553ea65b66631771c16908513f983d3c0b881

Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-04 11:43:39 -05:00
Cea Stapleton Cordasco eedb356f3d feat(db): persist protected object authority
Canonical O4 slice: 04_protected_authority
Final-tree source: e45553ea65b66631771c16908513f983d3c0b881

Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-04 11:43:38 -05:00
Cea Stapleton Cordasco a137cacc47 fix(relay): bound JWKS degradation and metrics
Canonical O4 slice: 03_jwks_hard_age_metrics
Final-tree source: e45553ea65b66631771c16908513f983d3c0b881

Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-04 11:43:37 -05:00
Cea Stapleton Cordasco b199b6b744 fix(auth): bound assertion time and clock skew
Canonical O4 slice: 02_iat_clock_skew
Final-tree source: e45553ea65b66631771c16908513f983d3c0b881

Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-04 11:43:36 -05:00
Cea Stapleton Cordasco a95debaaf0 fix(auth): reject ambiguous protected identity evidence
Canonical O4 slice: 01_header_ambiguity
Final-tree source: e45553ea65b66631771c16908513f983d3c0b881

Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-04 11:43:36 -05:00
Cea Stapleton Cordasco 8b4da04e1e fix(identity): persist versioned enterprise bindings
Enforce verifier-owned enrollment, active-state lifecycle checks, stable lineage, server-controlled idempotency, and complete attribution for versioned enterprise identity bindings.

Includes separately attributed inherited compatibility fixes for cancellation-safe mesh validation and strict BIP-340 x-only public-key validation.

Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-04 07:05:18 -05:00
Cea Stapleton Cordasco 5571b1cc41 fix(auth): reject domain drift before authority I/O
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-03 17:05:52 -05:00
Cea Stapleton Cordasco cc9bc5361d fix(auth): seal capability finalization runtime
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-03 17:03:53 -05:00
Cea Stapleton Cordasco 4bd64092bc fix(auth): bind capability snapshots to enrollment policy
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-03 17:03:52 -05:00
Cea Stapleton Cordasco 23f98df72d fix(auth): revalidate provider decisions after I/O
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-03 17:03:52 -05:00
Cea Stapleton Cordasco d82afe9012 test(auth): expand provider negative coverage
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
(cherry picked from commit 12f6d2ec639ece2a669f7ea76d74ea4e72912209)
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-03 17:03:51 -05:00
Cea Stapleton Cordasco 33b11db767 fix(auth): preserve provider decision scope
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
(cherry picked from commit 26f64a507c3fe1cd4db3352998b2804b0cb80644)
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-03 17:03:50 -05:00
Cea Stapleton Cordasco edf28cca46 feat(auth): add authorization provider contract
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
(cherry picked from commit 93428020c84f477186f400952d403e33e6f2ab04)
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-03 17:03:50 -05:00
Cea Stapleton Cordasco 6db9d336fb fix(auth): validate embedded domains before authority
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-03 17:03:42 -05:00
Cea Stapleton Cordasco 4affe89a4d fix(auth): expose sealed finalizer evidence
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-03 16:31:15 -05:00
Cea Stapleton Cordasco 76f9b9f4cd fix(auth): enable sealed owner admission
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-03 16:28:40 -05:00
Cea Stapleton Cordasco 5a014bda25 fix(auth): seal authoritative adapter boundary
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-03 16:23:30 -05:00
Cea Stapleton Cordasco 8ea116a5d0 fix(auth): bind authoritative policy and binding evidence
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-03 15:31:57 -05:00
Cea Stapleton Cordasco c3c17cf850 fix(auth): enforce binding expiry contract
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-03 15:05:16 -05:00
Cea Stapleton Cordasco f5115171a3 feat(auth): add versioned authorization context
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
(cherry picked from commit 49af92663ec3aefd9552b1bd6decbdec876e4761)
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-03 14:46:42 -05:00
Cea Stapleton Cordasco bde90293c9 ci(identity): run auth boundary regressions
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-03 12:11:50 -05:00
Cea Stapleton Cordasco a28957d79b fix(audio): release failed admission lease
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-03 06:58:31 -05:00
Cea Stapleton Cordasco af657ea23b fix(identity): make private huddle admission atomic
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-03 06:58:30 -05:00
Cea Stapleton Cordasco 8921f6d7a8 fix(identity): restore CI gates
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-03 06:58:30 -05:00
Cea Stapleton Cordasco a11293a646 fix(identity): harden corporate identity lifecycle
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-03 06:58:29 -05:00
Cea Stapleton Cordasco bc2a16ff39 fix(identity): close auth boundary gaps
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-03 06:58:28 -05:00
Cea Stapleton Cordasco cb61ed5dbe chore(desktop): satisfy file size ratchet
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-03 06:58:28 -05:00
Cea Stapleton Cordasco e82d72d5c3 ci(identity): run lifecycle tests
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-03 06:58:27 -05:00
Cea Stapleton Cordasco 7b925279fd fix(identity): make verification provider-neutral
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-03 06:58:26 -05:00
Franco SolaandCea Stapleton Cordasco c52ae39085 fix(identity): authorize agents through owners
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-03 06:58:25 -05:00
Franco SolaandCea Stapleton Cordasco 923a592c3f fix(identity): refine verified badge
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-03 06:58:25 -05:00
Franco SolaandCea Stapleton Cordasco 3e761a7431 feat(identity): show binding in profile panel
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-03 06:58:24 -05:00
Franco SolaandCea Stapleton Cordasco 948cec8395 fix(identity): clarify verified profile labels
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-03 06:58:23 -05:00
Franco SolaandCea Stapleton Cordasco d4eb40fcb4 fix(identity): advertise stable dev relay key
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-03 06:58:22 -05:00
Franco SolaandCea Stapleton Cordasco e900decf6f feat(identity): show relay-verified profiles
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-03 06:58:21 -05:00
Franco SolaandCea Stapleton Cordasco b53bcfdd6d feat(relay): add corporate identity binding
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com>
2026-08-03 06:58:20 -05:00
2c0ac24674 fix(desktop): stop the create-agent provider config probe from erasing keystrokes (#4411)
## What

Fixes the create-agent dialog's "Run on" provider config fields eating
keystrokes — reported by Tyler in buzz-remote-agents (channel
`29414326`, thread `db76677a`): the Kubernetes **Kubeconfig context**
field would not accept typing.

## Why it happened (the Typewriter Eraser, shipped in #4289)

`WhereToRunSection`'s probe `useEffect` depended on the whole `draft`:

1. every keystroke changed the draft → effect re-fired → provider binary
re-probed;
2. each probe result is a fresh object written into the draft → the
effect re-triggered **itself**, respawning the provider binary in a loop
for as long as the dialog sat on a provider;
3. every probe resolution reset `providerConfig` to schema defaults —
erasing whatever was typed. A field with no schema default (`context`)
snapped back to empty, i.e. "won't let me type". Unrelated to how many
kubeconfig contexts you have.

## Fix

- **Probe once per provider selection**, keyed on the provider's stable
`binaryPath` — not the draft, not the provider object (a
`useBackendProvidersQuery` refresh must not reprobe an unchanged
selection).
- **Latest-state resolution** via `React.useEffectEvent` + a new pure
`applyProbeResult` helper: schema defaults merge **beneath** the current
`providerConfig`, so a probe landing after the user typed can never
clobber in-flight input (per Wren's pre-patch red-team: changing deps
alone leaves a stale closure).

Existing `cancelled` cleanup keeps provider-switch/unmount safe;
selection reset (`emptyWhereToRunDraft`) and the fail-closed probe-error
path are unchanged.

## Tests

- **Unit** (`whereToRunIntent.test.mjs`): `applyProbeResult` merge
semantics — defaults under typed values, user-cleared fields stay
cleared, schema-less results, unrelated fields preserved.
- **E2E** (new `where-to-run-config.spec.ts`, added to the smoke
project, **red-first verified**: all 3 fail against the unfixed
component):
- typing into a defaultless provider field sticks, and
`probe_backend_provider` fires exactly once per selection;
- the config form is gated on probe resolution (slow probe: no
half-rendered form, defaults prefill once);
  - provider → local → provider re-probes and resets cleanly.
- Mock bridge gains `backendProviders` / `backendProviderProbeResult` /
`backendProviderProbeDelayMs` seams (defaults preserve prior behavior).

## Verification at 8eb7680

- `pnpm check` + `tsc` clean, `pnpm test` 3926/3926;
- new spec 3/3 green (and 3/3 red on the unfixed component);
- pre-push lefthook: desktop-test, desktop-check, desktop-tauri-checks,
rust-tests, mobile-test all green.

---------

Signed-off-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz>
Co-authored-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz>
2026-08-03 07:36:13 -04:00
a5dbdf5e61 fix(mobile): recover and pace live subscriptions (#3053)
### What changed?

Mobile now recovers live subscriptions after retryable or rate-limited
relay `CLOSED` responses. It ports the existing desktop model: classify
terminal versus retryable closures, honor retry hints through a
session-owned rate-limit gate, retry with bounded backoff, and replay
visible-channel subscriptions first in bounded batches.

Channel refreshes also retain unchanged live subscriptions instead of
clearing and recreating them. This is desktop parity, not a new relay
policy.

### Why?

On reconnect or resume, mobile replayed its retained live subscriptions
while `channelsProvider` independently cleared and recreated roughly the
same set, alongside unread catch-up and open-channel requests. The relay
allows 50 REQs per 5 seconds, so users in many channels could
predictably exceed the budget. In live reproduction, 55 subscriptions
produced 9 rate-limit closures, 60 produced 18, and 80 produced 36.

Mobile then treated every live `CLOSED` as terminal, removed the
affected subscription, and never restored it. Channel updates could
remain dead until a later session reconstruction. This is the primary
causal chain behind
[BOT-1449](https://linear.app/squareup/issue/BOT-1449/buzz-mobile-posted-messages-dont-appear-until-leavingre-entering-the).

Desktop already handles this as normal transient pressure by classifying
closures, gating and backing off retries, pacing reconnect replay, and
retaining unchanged subscriptions. This change brings mobile to the same
recovery model while removing the avoidable request burst.

### How is it tested?

Full mobile suite: 721 passed, 1 skipped. Analyzer and formatting checks
pass. Required CI checks pass.

Added and updated tests cover `CLOSED` classification, retry hints,
rate-limit gating, bounded retry and reset behavior, terminal failures,
timer cleanup, history gating, visible-first batched replay, and
retention of unchanged subscriptions.

---------

Signed-off-by: Tom Brow <tomb@block.xyz>
Co-authored-by: npub1tquskdu6yc4h8l7xxtceculxw600grekeq0xg2ukqfrwl7vrzg3quz3gmp <58390b379a262b73ffc632f19c73e6769ef40f36c81e642b960246eff9831222@buzz.block.builderlab.xyz>
Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: npub1tu6ed4gf70jg7pvk8uhttlprexznhzpg74am2d3seqd3ececzgusy8hzac <5f3596d509f3e48f05963f2eb5fc23c9853b8828f57bb53630c81b1ce3381239@buzz.block.builderlab.xyz>
Co-authored-by: npub1w85l93z2dyetvaev42kvmgv3r5qsgc7rutrvgpqshqefj4sydqqskwstfm <71e9f2c44a6932b6772caaaccda1911d010463c3e2c6c40410b8329956046801@buzz.block.builderlab.xyz>
2026-08-02 18:54:58 -07:00