mirror of https://github.com/block/buzz.git synced 2026-08-18 06:50:31 +02:00

Files

T

npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7andWill Pfleger 80a68775d5 feat(desktop): wire fail-closed scope seam + import_identity scope semantics

Three storage chokepoints (managed_agents_store_path, teams_store_path,
global_config_path) now route through capture_active_scope() and fail with
a clear error when no workspace scope is active. There is no fallback to
the legacy unscoped root — returning a legacy path would recreate split-brain
storage.

apply_workspace acquires the workspace_transition lock (Layer 1 async
serialization) before entering spawn_blocking so scope transitions are
serialized against concurrent import_identity calls.

import_identity implements both scope modes per v4 plan:
- No-active-scope path (recovery/onboarding): persist identity, clear scope,
  bump generation. No scope is derived or claimed; the next apply_workspace
  performs adoption.
- Live-active path (membership-denied flow): drain managed-agent runtimes
  (delegates to shutdown_managed_agents), persist identity, clear scope,
  bump generation. Drain failures are logged but non-fatal; the frontend's
  re-apply restores agents.

Both paths bump the scope generation so in-flight operations see a new
generation and abort their commits. The fallback relay can never claim legacy
data — claims are only written inside apply_workspace's prepare stage.

All 2112 tests pass.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

2026-08-02 23:11:07 -04:00