Skip to content

upstream(sync): Tier 1 reliability — reconnect, rosters, auth challenges (#6415, #3320, #5765, #6251) - #309

Merged
oscarlehuu merged 5 commits into
mainfrom
devin/issue-280-tier1-reliability
Aug 23, 2026
Merged

upstream(sync): Tier 1 reliability — reconnect, rosters, auth challenges (#6415, #3320, #5765, #6251)#309
oscarlehuu merged 5 commits into
mainfrom
devin/issue-280-tier1-reliability

Conversation

@devin-ai-integration

@devin-ai-integration devin-ai-integration Bot commented Aug 22, 2026

Copy link
Copy Markdown

Summary

Ports the four upstream Buzz Tier 1 reliability PRs (0.5.18 sync stack, meta #285) onto Crew main, as one upstream cherry-pick per PR plus one Crew adaptation commit:

Commit Upstream PR What
583b500c2 block#5765 Complete channel member rosters: keyset-paginate kind 39002 snapshot builds past the 1,000-row page cap (buzz-db::channel, buzz-admin, roster e2e script)
e578f44e5 block#3320 Preserve early relay AUTH challenges: inbound frames are buffered until auth arming completes instead of being dropped at boot (relayInboundBuffer, relayAuthPolicy)
a196b6f04 block#6415 Lossless reconnect repair: new get_channel_reconnect_repair Tauri command runs fixed-kind, #h-scoped keyset pagination ((until, before_id), 500/page) over the relay after reconnect, with generation-scoped live/repair dedup so no message in the local window is lost or double-delivered
1afb5ce35 block#6251 Repair stale large roster snapshots: migration 0032 adds a guard_channel_roster_snapshot trigger + advisory-lock ordering so mixed-version pods can't publish a stale kind 39002 snapshot; relay side-effects revalidate roster tags
9256c8315 Crew adaptations (below)

Crew divergences / adaptations (kept Crew behaviour)

  • Kept Crew's Tauri invoke architecture: new commands registered via desktop/src-tauri/src/invoke.rs (desktop_invoke_handler!), not upstream's inline generate_handler!.
  • Kept Crew's live-event buffering (relayLiveEventBuffer with replay context + subscription-identity re-lookup) and layered upstream's connection-generation staleness check and reconnect-replay dedup onto it, instead of replacing it with upstream's flushEvents.
  • Kept Crew's recovery barrier / rate-limit-gated history replay in relayReconnectReplay.ts and added upstream's native repair pagination beside it (requestRepair preferred, Crew's requestHistory REQ path retained as fallback).
  • Added Crew's agent receipt kind 46043 to CHANNEL_REPAIR_KINDS (Rust + E2E bridge) so repair coverage matches Crew's live channel filter (upstream has no such kind).
  • File-size ratchet: recorded relayClientSession.ts 1067→1076 lines as upstream-owned growth per the ratchet's upstream-sync rule (no MAX_LINES change).
  • Pre-existing stale assertions repaired (they fail on main today because CI path-filters skipped these crates): buzz-db migration inventory (count 30→32; migration 0008 substring missed wiki kinds 30023/30623 from feat: Crew Wiki (relay-native repo + company wiki, two doors, Ask Plan-to-thread) #210) and buzz-cli inventory tests (missing org group, missing agents call from Agent-to-agent call by name (CoS wakes specialists; no founder Wake) #230/feat(cli): buzz agents call wakes specialists by name (#230) #240). Without these the required just test-unit gate cannot pass; no production code was changed for them.

Channel-first IA (#278) untouched — no UI/IA changes in this PR.

Related issue

Fixes #280

Testing

TDD evidence (full logs in the issue session):

  • RED: ported regression tests run against pre-port main (worktree at 9bffb8cab) fail — relayReconnectReplay.test.mjs / relayInboundBuffer.test.mjs cannot even resolve the new modules/exports (relayInboundBuffer.ts missing, DB_CREATED_AT_FLOOR_SECS unexported): fail 2, pass 0.
  • GREEN: pnpm --filter buzz test5544 pass, 0 fail, 1 skipped.

Gates (all run locally under hermit, Node 24.15.0 / pnpm 11.4.0; just _ensure-sidecar-stubs before Rust checks):

  • pnpm --filter buzz check — pass
  • pnpm --filter buzz typecheck — pass
  • pnpm --filter buzz test — pass (5544/0)
  • just test-unit — pass (all crates)
  • just check-compile — pass

Not verified here (needs live relay + agents): buzz agents call mention delivery and a manual network-blip reconnect; covered by the ported unit/coupling tests and upstream's relay-reconnect.spec.ts E2E in CI. No UI-visible change, so no screenshots.

E2E test results (desktop mock bridge)

Built with pnpm --filter buzz build:e2e; committed regression spec relay-reconnect.spec.ts: 16/16 passed (headless xvfb, --project=smoke --workers=1), including the ported lossless-reconnect regression (260 missed messages backfilled past the live subscription limit) and both early-AUTH-challenge tests.

Recorded golden-path + reconnect smoke (headed):

  • App boots connected; #general timeline renders.
  • Live-injected message and UI-sent message each render exactly once (generation/dedup regression).
  • After a forced websocket disconnect with 5 messages emitted while offline, reconnect backfills all 5 in order — no drops, no duplicates.

Reconnect backfill: missed-demo 1..5 all present, in order, once each

Live receive + UI send before disconnect / boot state / recording

Live + sent messages rendered exactly once

Boot: sidebar + channel timeline

E2E smoke recording

## NOTES (handover)

DONE

  • All four upstream Tier 1 reliability ports are implemented, committed (DCO-signed) and pushed on devin/issue-280-tier1-reliability (5 commits, 583b500c29256c8315); nothing is uncommitted:
  • Tests added/ported: relayReconnectReplay.test.mjs (native repair pagination, dedup, generation barriers), relayInboundBuffer.test.mjs, repair-kind coupling test, upstream relay-reconnect.spec.ts E2E additions.
  • Gates run locally (hermit, Node 24.15.0 / pnpm 11.4.0) — all pass: pnpm --filter buzz check, pnpm --filter buzz typecheck, pnpm --filter buzz test (5544 pass / 0 fail / 1 skipped), just _ensure-sidecar-stubs, just test-unit, just check-compile.
  • E2E verified: relay-reconnect.spec.ts 16/16 (headless smoke), plus a recorded golden-path reconnect smoke — full-viewport screenshots and recording are embedded in the Testing section above (boot, exactly-once live/send, 5-message lossless backfill). TDD RED/GREEN logs captured (~/evidence-280/red-desktop-test.log, green-desktop-test.log, gate-*.log on the session box; attached to the session).

IN PROGRESS

  • Nothing. No half-done code; the working tree is clean and identical to the pushed branch head 9256c8315.

TODO / NEXT

Link to Devin session: https://app.devin.ai/sessions/a7cd8ffe3bdf41fc970e3466c83c352a
Requested by: @oscarlehuu

@devin-ai-integration

Copy link
Copy Markdown
Author

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

  • Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
  • Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

  • Disable automatic comment, CI, and merge conflict monitoring

@devin-ai-integration

Copy link
Copy Markdown
Author

NOTES (handover)

DONE

  • All four upstream Tier 1 reliability ports are implemented, committed (DCO-signed) and pushed on devin/issue-280-tier1-reliability (5 commits, 583b500c29256c8315); nothing is uncommitted:
  • Tests added/ported: relayReconnectReplay.test.mjs (native repair pagination, dedup, generation barriers), relayInboundBuffer.test.mjs, repair-kind coupling test, upstream relay-reconnect.spec.ts E2E additions.
  • Gates run locally (hermit, Node 24.15.0 / pnpm 11.4.0) — all pass: pnpm --filter buzz check, pnpm --filter buzz typecheck, pnpm --filter buzz test (5544 pass / 0 fail / 1 skipped), just _ensure-sidecar-stubs, just test-unit, just check-compile.
  • E2E verified: relay-reconnect.spec.ts 16/16 (headless smoke), plus a recorded golden-path reconnect smoke — full-viewport screenshots and recording are embedded in the Testing section above (boot, exactly-once live/send, 5-message lossless backfill). TDD RED/GREEN logs captured (~/evidence-280/red-desktop-test.log, green-desktop-test.log, gate-*.log on the session box; attached to the session).

IN PROGRESS

  • Nothing. No half-done code; the working tree is clean and identical to the pushed branch head 9256c8315.

TODO / NEXT

wesbillman and others added 5 commits August 23, 2026 00:44
## Summary

- return complete channel rosters instead of truncating at 1,000 members
- chunk `event_mentions` inserts inside one transaction so large kind
`39002` snapshots remain discoverable by every `p` tag
- add a targeted `buzz-admin reconcile-channels --channel <uuid>`
force-republish path for stale discovery snapshots
- cover a 1,501-member roster, 11,000-tag mention index, and kind
`39002` tag construction past member 1,000

## Why

The relay builds NIP-29 discovery and several authorization decisions
from `get_members()`, but that helper silently returned only the first
1,000 active members. Desktop then counted the truncated kind `39002`
event, while late members could be rejected by roster-scanning member
actions.

Removing the roster cap exposes PostgreSQL's 65,535 bind-parameter
ceiling in mention indexing, so the insert is chunked transactionally to
preserve all-or-nothing indexing.

The existing reconcilers only fill missing discovery events. The
targeted admin option bypasses the separately known 1,000-channel
reconciliation-list ceiling and replaces an existing channel snapshot
using the configured production relay key.

## Attribution

This supersedes and builds on block#3166 by @LordMelkor. Thank you for
identifying the roster boundary and contributing the original
complete-roster and mention-index patch. The production roster/query
changes and the two PostgreSQL regressions retain that work's shape;
this PR rebases it onto current `main`, adds relay coverage, and adds
the targeted repair operation requested for rollout.

## Validation

Exact pushed head: `24d02e4f3824150ed84913c9d230e675502e5b12`

- `cargo check -p buzz-db -p buzz-admin`
- `cargo test -p buzz-db
channel::tests::get_members_returns_full_roster_beyond_1000 -- --ignored
--exact --nocapture`
- `cargo test -p buzz-db
feed::tests::insert_mentions_indexes_rosters_past_bind_parameter_cap --
--ignored --exact --nocapture`
- `cargo test -p buzz-relay --lib
handlers::side_effects::tests::group_members_snapshot_keeps_members_past_one_thousand
-- --exact`
- `cargo run -q -p buzz-admin -- reconcile-channels --help`
- mandatory pre-push hook: branch-skew, desktop checks/typecheck/tests,
mobile tests, Rust tests, and desktop Tauri checks all passed on the
pushed head

## Rollout

1. Deploy the relay/backend build.
2. Run `buzz-admin reconcile-channels --channel <general-channel-uuid>`
with `BUZZ_RELAY_PRIVATE_KEY` configured.
3. Verify the replacement kind `39002` roster count matches the active
database membership count.

No schema migration or desktop release is required.

Fixes block#3156
Supersedes block#3166

---------

Signed-off-by: Wes <wesbillman@users.noreply.github.com>
Co-authored-by: Carl <c7ebe626f000404285d3686e1dc74cc07cc60a9754a150041ba132e14bd3e2ec@buzz.block.builderlab.xyz>
(cherry picked from commit e094092)
Signed-off-by: Cursor Agent <cursoragent@cursor.com>
- buffer native WebSocket frames until `plugin:websocket|connect`
returns the socket ID and the NIP-42 auth waiter is installed
- drain those frames in order before normal inbound handling begins
- add a deterministic E2E seam and regression for an AUTH challenge
delivered before connect resolves

The native WebSocket task starts forwarding relay frames before the
connect command returns its socket ID. Buzz relay sends the NIP-42 AUTH
challenge immediately on connection, so Desktop could process that
challenge while `wsId` and `authRequest` were still unset. The challenge
was discarded, the cold connection failed authentication, and the first
plain-text send failed. Channel history still appeared because it loads
through the Tauri channel-window command rather than this frontend
WebSocket.

- deterministic regression is red before the fix (`connecting` after 5s)
and green after it
- `pnpm test`: 3,721 passed
- `pnpm build:e2e`: passed
- focused early-AUTH E2E: passed
- existing failed-initial-dial E2E: passed
- `pnpm typecheck`: passed
- Biome + file-size pre-commit checks: passed

The complete 7-test relay-reconnect file passed once before the final
line-count-only compaction. After that compaction, two full-file reruns
each had the same unrelated startup-seam flake in the existing
initial-dial test; both the new test and that existing test pass
independently at the committed HEAD.

---------

Signed-off-by: npub1jh9wn95s0472h86ahapupaf7m6kx4v9sx2n0atj2hltcfer8k06s5n3pyf <95cae996907d7cab9f5dbf43c0f53edeac6ab0b032a6feae4abfd784e467b3f5@buzz.block.builderlab.xyz>
Signed-off-by: Wren <5217c5c2f7bfb4333e46d17c98a9255a52dadee18dcd43a43536b95e6776dfa0@buzz.block.builderlab.xyz>
Co-authored-by: npub1jh9wn95s0472h86ahapupaf7m6kx4v9sx2n0atj2hltcfer8k06s5n3pyf <95cae996907d7cab9f5dbf43c0f53edeac6ab0b032a6feae4abfd784e467b3f5@buzz.block.builderlab.xyz>
Co-authored-by: Wren <5217c5c2f7bfb4333e46d17c98a9255a52dadee18dcd43a43536b95e6776dfa0@buzz.block.builderlab.xyz>
(cherry picked from commit 6ea7a2b)
Signed-off-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Signed-off-by: Cursor Agent <cursoragent@cursor.com>
- repair exact-channel reconnect gaps from a source-coupled 1,865-second
floor (`900` seconds of relay future tolerance + `960` seconds of DB
created-at floor + `5` seconds of fence margin)
- page the existing authenticated `POST /query` bridge losslessly with
`(until, before_id)`, including dense timestamp boundaries and an
unbounded first page that does not trust the renderer clock
- keep the restored live REQ unchanged while deduplicating live/repair
overlap until both live EOSE and repair completion for the active
connection generation

The wider repair applies only to live subscriptions containing the exact
channel-event kind set and one `#h`. Profile, read-state, global,
channel-less, and other subscription behavior is unchanged. Failed or
stale repairs retain their pinned lower bound for the next reconnect.

This intersects the replay path described in block#3215, but does not claim
to fix that issue. Desktop already has a bounded notification-side
event-ID guard; this PR adds transport dispatch dedupe for the
restored-live/repair overlap. Notification behavior should remain a
focused regression check while this wider repair window rolls out.

- `cd desktop && pnpm typecheck`
- `cd desktop && pnpm biome check
src/shared/api/channelReconnectRepair.ts
src/shared/api/relayClientSession.ts src/shared/api/relayClientShared.ts
src/shared/api/relayClosedRecovery.ts
src/shared/api/relayReconnectReplay.ts
src/shared/api/relayReconnectReplay.test.mjs src/testing/e2eBridge.ts`
- `cd desktop && node --test
src/shared/api/relayReconnectReplay.test.mjs` (26 passed)
- `cargo test --manifest-path desktop/src-tauri/Cargo.toml
channel_reconnect_repair` (2 passed)
- pre-push hooks passed at `743283439eb6be7969e19951cbb6720c5e493a04`

---------

Signed-off-by: Wes <wesbillman@users.noreply.github.com>
Co-authored-by: Carl <32a2e2c9d428ee08902cab75d956da2c1d235a22d4766b0dd4138bf6e2e5db1d@buzz.block.builderlab.xyz>
(cherry picked from commit 06e8be9)
Signed-off-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Signed-off-by: Cursor Agent <cursoragent@cursor.com>
- detect relay-authored NIP-29 kind 39002 roster snapshots truncated by
the former 1,000-member query cap and repair stale large rosters during
relay startup
- serialize canonical roster capture and replacement with membership
writes, preserving tenant, channel, signer, pubkey, and role boundaries
through mixed-version deployments
- install migration 0032's fail-closed roster fence on the partitioned
events table and verify its catalog shape plus behavior before opening
relay listeners

Migration 0032 is a hard schema-before-code compatibility boundary.
Apply migrations before rolling this relay version. Startup refuses to
open listeners when the parent/partition triggers are missing, disabled,
mis-shaped, or behaviorally inert. For large installations, prefer
`buzz-admin migrate` and monitor lock acquisition as documented in the
chart README.

Exact head: `bcbba271f54bc0046a6683007e5a2b70403a11d5`

- rebased onto `569308c23c9c2bf620dd3a9a5e4baecbcfa22e16`; the nine-file
feature patch is byte-identical to pre-rebase head
`be8ea0084f4d4c78c7c2550baad4399e4df8ce73`
- pre-push hook passed at exact head: branch-skew, file-size, full Rust
unit suite, Desktop Tauri clippy, and Desktop Tauri tests
- `cargo fmt --all -- --check`
- `cargo test -p buzz-relay
group_members_snapshot_keeps_members_past_one_thousand -- --nocapture`
- focused CI-mode Playwright regression: `selected relay agents revoked
after the invite prompt cause no side effects` passed at exact head
- prior exact-patch validation:
`large_roster_reconciliation_candidates_respect_snapshot_count_and_signer`,
mixed-writer locking/rollback, migration admission, partition trigger
coverage, and desired-schema parity regressions

Independent DB/relay review found no blocking issues in the exact
feature patch. The concurrency fence holds the established replacement
and membership locks on one transaction/connection through replacement;
failures roll back both soft-delete and insert. Reconciliation remains
tenant/channel/signer scoped and validates exact normalized
pubkey-plus-role membership.

The prior red Desktop shard was unrelated to this backend-only diff: its
mocked mention test exercises no relay, database, or migration path. It
reproduced as a timing flake on the old head, passed on retry/base, and
now passes locally after rebasing onto current main.

---------

Signed-off-by: Wes <wesbillman@users.noreply.github.com>
Co-authored-by: Carl <32a2e2c9d428ee08902cab75d956da2c1d235a22d4766b0dd4138bf6e2e5db1d@buzz.block.builderlab.xyz>
Signed-off-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Signed-off-by: Cursor Agent <cursoragent@cursor.com>
- Include Crew's agent receipt kind (46043) in the reconnect repair
  filter so lossless repair covers Crew's live channel filter kinds.
- Record relayClientSession.ts line count after rebase onto main
  (AUTH inbound buffer + lossless reconnect + toRelayFrames merge).

Signed-off-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-Authored-By: Oscar Le <oscar.lehuu@gmail.com>
Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: oscarlehuu <oscarlehuu@users.noreply.github.com>
@cursor
cursor Bot force-pushed the devin/issue-280-tier1-reliability branch from 9256c83 to 3dd950a Compare August 23, 2026 00:45
@oscarlehuu
oscarlehuu merged commit 344f65a into main Aug 23, 2026
9 of 15 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

upstream(sync): Tier 1 reliability — reconnect, rosters, auth challenges (#6415, #3320, #5765, #6251)

3 participants