mirror of https://github.com/block/buzz.git synced 2026-08-18 06:50:31 +02:00

Files

T

DuncanandWill Pfleger 887793ce04 feat(desktop): add cross-workspace agent-library data model (Phase 1)

The Phase 0 seam made every persona writer merge-preserving; Phase 1 lands
the data model that seam was built for: `library.json` and the scope-local
crash journals, plus their quarantine-preserving IO. No operation mutates
them yet — share, edit, materialize, delete, and deploy land in Phases 2-5.

`library.rs` models the versioned document envelope, `SharedDefinition`
(the allowlisted content a share may carry — credentials, identity,
`env_vars`, activation, and projection metadata are structurally absent),
`LibraryEntry` with its per-scope `ProjectionState` machine, verified
`IdentityBinding`s, and the permanent `DeferredArchive`/`RemovalManifest`
retirement markers. `load_library` classifies per §2.1: an absent file is a
valid empty library, whole-document corruption is preserved as `.invalid`
and blocks all mutation, an unknown version is read-only fail, and a single
malformed / semantically invalid / identity-colliding entry is quarantined
raw while healthy siblings stay usable. Identity collisions on `library_id`,
a live origin, or a non-terminal `(scope, slug)` claim group-quarantine every
collider — never first-wins.

`library/journals.rs` adds the scope-local `pending-agent-keys.json` and
`deploy-intents.json`, which share the owning workspace's failure domain
rather than the library's so a broken `library.json` never blocks a
workspace-local create or deploy. Their failure domains are asymmetric: a
pending-keys failure degrades only that scope's create/import path, while a
deploy-intents failure — unknown version, syntax error, or a duplicate-pubkey
mutex violation validated on read — fails the scope's destructive and deploy
paths closed.

`apply_shared_definition` is the sole writer of shared content onto a scoped
keyless record, assigning exactly the shared slots plus revision/timestamp and
mirroring `into_agent_record` so a populated record is byte-identical to a
freshly projected one. `ManagedAgentRecord` gains
`last_completed_deploy_attempt_id`, the deploy-provenance stamp that forms an
inseparable pair with `backend_agent_id` in `copy_runtime_state`.

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

2026-08-11 06:06:20 -04:00