feat(desktop): add agent attention and recovery

[oscarlehuu]

Summary

• separate observer liveness (lastSeenAt) from meaningful progress (lastSubstantiveProgressAt), so heartbeat/token/usage/raw-log traffic cannot hide a stalled turn
• project Needs you, Failed, Lost contact, Telemetry unavailable, Possibly stalled, and Ready to review consistently across Mission Inbox and thread surfaces
• preserve source timestamps through replay/restore, reflect EOSE/retry/CLOSED truthfully, and scope observer failures to the affected agent
• keep stalls local while backing user-input requests, terminal receipts, and explicit owner review with durable Buzz/Nostr events
• enforce the 46040 → 46041/46042 signer/owner/request relationship in SDK builders, ACP emission, relay ingest, and an independent desktop projection
• exhaustively page durable recovery history and preserve receipt root/thread targets across restart and community reset
• add adjacent recovery controls (Respond, Inspect, Wait 10m, existing Stop/Retry, Mark reviewed, and in-thread Request changes)
• reserve managed receipt emission configuration so a descriptor cannot disable the 46043 authority seam

User flows

1. A live agent whose heartbeats continue without meaningful progress becomes Possibly stalled; the owner can inspect it, stop it through the existing thread control, or snooze the warning for 10 minutes.
2. Observer failure becomes Telemetry unavailable or Lost contact, never a false stall. One agent's decode/observer failure does not contaminate healthy agents.
3. An owned agent's durable kind 46040 input request remains Needs you until an authorized durable 46041 answer or 46042 resolution arrives. Forged authors, targets, and relationship tags are rejected/ignored.
4. A durable kind 46043 terminal receipt becomes Ready to review. Opening the thread does not review it; only an explicit reaction from the agent's verified owner does.
5. Selecting a receipt-backed Mission Inbox row opens its exact root thread. Request changes starts a reply in that thread, preserving the existing session/worktree routing seam.

Authority and durability

• 46040: registered owned agent → intended owner
• 46041: intended owner or verified same-owner sibling → known request/requesting agent
• 46042: requesting agent → known request/intended owner
• 46043: registered agent terminal receipt; review uses channel-scoped standard NIP-25 last-valid-e semantics
• unresolved requests and unreviewed receipts hydrate across every relay page rather than a fixed recent-event cap
• permission prompts remain on the ACP permission path and do not enter the durable user-input lifecycle

Verification

• exact-head canonical just ci (Rust fmt/clippy/tests, desktop checks/tests, web/admin-web, mobile 1,275 tests)
• desktop typecheck, Biome, file-size, zoom-text, and pubkey-truncation gates
• Exact-head focused authority/reliability suites: 76/76 passed
• SDK user-input builders: 3/3 passed
• relay user-input authority tests: 2/2 passed
• ACP compile check
• managed-agent Tauri test filter: 1,055 passed
• production E2E build
• Mission Inbox smoke E2E: 4/4 passed
  • owned and forged durable Needs You projection
  • heartbeat-only Possibly stalled + recovery actions
  • telemetry unavailable is not mislabeled stalled
  • durable receipt review, exact-thread navigation, and in-thread Request changes
• working-tree Tauri standalone build and native app launch
• two independent exact-head fail-closed reviews (running on d2f549161)

Visual evidence

Current production-E2E captures cover:

• Needs attention / Ready to review / In flight grouping
• Possibly stalled + Inspect / Wait 10m
• Ready-to-review receipt + Mark reviewed / Request changes
• Telemetry unavailable + Inspect

All five captures have distinct SHA-256 hashes and passed visual inspection for legibility, clipping, hierarchy, and adjacent recovery actions.

Closes #105

[oscarlehuu]

Mission Inbox priority sections

Durable Needs you, Ready to review, and In flight are separated by authority and urgency.

Channel-safe navigation fallback

Action rows retain their channel and conversation context when no root event exists.

Possibly stalled recovery

Heartbeat-only activity keeps liveness visible without resetting meaningful progress; recovery actions stay beside the exception.

Durable receipt actions

Ready to review, explicit owner review, and Request changes are receipt-backed and remain in the original thread.

Telemetry unavailable

Observer transport failure stays distinct from a progress stall and offers the appropriate recovery action.

[oscarlehuu]

Final attention/recovery hardening

Follow-up to independent fail-closed security, durability, and reliability reviews:

• restricts kind 46041 answers to the request's intended verified owner across relay, ACP, and desktop projections;
• derives owned agents only from verified profile ownership, so local managed inventory cannot authorize another identity;
• validates receipt parent/root/channel/agent relationships in both relay ingest and desktop projection before showing Ready to review;
• prevents newer foreign or stale receipts from shadowing the owner's current thread status;
• makes receipt/review projection commutative when the owner reaction arrives before the receipt;
• makes reconnect replay exhaustive for durable attention kinds, drains dense same-second buckets by event-id prefix, and projects requests before transitions despite clock skew;
• preserves recovery targets when liveness arrives before a delayed turn_started frame;
• scopes watermarks to observer sessions, resets clock calibration on producer-session rollover, rejects retired-session frames, and requires current-session per-agent live contact before telemetry is healthy;
• keeps durable hydration exhaustive, overlap-safe, deterministic, and cancellation-safe.

Verification on the final working tree:

• just ci — passed with immutable before/after diff hash c5714508287490428a887b197b8867418a9167c41da0f6e3f4f36f90ec94c24c
• desktop Mission Inbox production smoke — 4/4 passed
• desktop full unit suite — 4,942 tests, 4,941 passed, 1 todo, 0 failed
• focused desktop authority, hydration, reconnect, receipt, telemetry, and thread-status regressions — passed
• focused relay ingest suite — 177 passed
• cargo test -p buzz-acp — 803 passed (794 library + 9 lifecycle)
• cargo test -p buzz-sdk — 265 passed
• cargo clippy -p buzz-relay -p buzz-acp --all-targets -- -D warnings — passed
• real worktree Tauri acceptance — dev profile built and target/debug/buzz-desktop launched on Vite port 12215
• git diff --check — passed

[oscarlehuu]

Final SDK/relay authority seam hardening

A stale fail-closed review of committed head d2f549161 exposed one producer/validator mismatch that was not part of the previous desktop remediation commit: SDK-built 46041 answers and 46042 resolutions lacked the p relationship now required by relay ingest.

This follow-up closes that seam end to end:

• build_agent_user_input_answer now requires and emits p=requesting_agent_pubkey.
• build_agent_user_input_resolved now requires and emits p=intended_owner_pubkey.
• Desktop and CLI answer commands fetch the signed request, verify its id, kind, signature, content channel, h channel, and single intended-owner p before deriving the requesting agent.
• ACP pending state retains the request's intended owner and uses that exact authority for answer acceptance and terminal resolution, instead of re-deriving it later. The runtime independently requires exactly one matching e, h, and p relationship plus the owner author and pending channel before accepting an answer.
• Relay authority tests now validate events produced by the real SDK builders rather than only hand-built envelopes.
• CLI and Tauri tests cover signed request lookup and owner/requesting-agent binding with distinct agent and owner identities.

Verification on exact committed head e0849ef2c00f6e64d3f9e5bbf9a97fc918cb8eb3:

• focused SDK producer tests: 3/3 passed
• focused ACP elicitation/runtime tests: 12/12 passed
• SDK-produced relay authority seam: passed
• CLI request-authority lookup: passed
• Tauri request-authority lookup: passed
• exact-tree just ci: passed, including the full Rust/desktop/Tauri/mobile gates
• immutable before/after diff hash: 09ec1a65de578a2bf4d6ac64b05465ba257d1046d0272260e8d956b1c3a2f600