mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
DuncanandWill Pfleger
59800a0fb6
Route every owner and managed-agent relay send through the owner_identity_egress admission layer so no code path can publish under an owner identity without a rate-limit-witnessed EgressLease. Privatize AppState.keys behind latch-gated checked accessors (signing_keys/current_pubkey), thread the EgressLease witness through all six explicit-key funnels plus the four git-workflow and four managed-agent sink sites, and rewrite the huddle STT task to re-resolve keys per send with a mid-huddle recovery-latch break. The C5 P25/P28 coordinator (journal + three-valued commit outcome + Indeterminate latch) and its egress-drain wiring stay deferred: each unreachable item carries a per-item allow(dead_code) naming C5 as its consumer, with semantics pinned by the owner_identity_egress unit tests until C5 makes them reachable from production paths. Co-authored-by: Will Pfleger <pfleger.will@gmail.com> Signed-off-by: Will Pfleger <pfleger.will@gmail.com>