upstream(sync): Tier 1 reliability — reconnect, rosters, auth challenges (#6415, #3320, #5765, #6251) - #309
Merged
Merged
Conversation
Author
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
Author
NOTES (handover)DONE
IN PROGRESS
TODO / NEXT
|
## Summary - return complete channel rosters instead of truncating at 1,000 members - chunk `event_mentions` inserts inside one transaction so large kind `39002` snapshots remain discoverable by every `p` tag - add a targeted `buzz-admin reconcile-channels --channel <uuid>` force-republish path for stale discovery snapshots - cover a 1,501-member roster, 11,000-tag mention index, and kind `39002` tag construction past member 1,000 ## Why The relay builds NIP-29 discovery and several authorization decisions from `get_members()`, but that helper silently returned only the first 1,000 active members. Desktop then counted the truncated kind `39002` event, while late members could be rejected by roster-scanning member actions. Removing the roster cap exposes PostgreSQL's 65,535 bind-parameter ceiling in mention indexing, so the insert is chunked transactionally to preserve all-or-nothing indexing. The existing reconcilers only fill missing discovery events. The targeted admin option bypasses the separately known 1,000-channel reconciliation-list ceiling and replaces an existing channel snapshot using the configured production relay key. ## Attribution This supersedes and builds on block#3166 by @LordMelkor. Thank you for identifying the roster boundary and contributing the original complete-roster and mention-index patch. The production roster/query changes and the two PostgreSQL regressions retain that work's shape; this PR rebases it onto current `main`, adds relay coverage, and adds the targeted repair operation requested for rollout. ## Validation Exact pushed head: `24d02e4f3824150ed84913c9d230e675502e5b12` - `cargo check -p buzz-db -p buzz-admin` - `cargo test -p buzz-db channel::tests::get_members_returns_full_roster_beyond_1000 -- --ignored --exact --nocapture` - `cargo test -p buzz-db feed::tests::insert_mentions_indexes_rosters_past_bind_parameter_cap -- --ignored --exact --nocapture` - `cargo test -p buzz-relay --lib handlers::side_effects::tests::group_members_snapshot_keeps_members_past_one_thousand -- --exact` - `cargo run -q -p buzz-admin -- reconcile-channels --help` - mandatory pre-push hook: branch-skew, desktop checks/typecheck/tests, mobile tests, Rust tests, and desktop Tauri checks all passed on the pushed head ## Rollout 1. Deploy the relay/backend build. 2. Run `buzz-admin reconcile-channels --channel <general-channel-uuid>` with `BUZZ_RELAY_PRIVATE_KEY` configured. 3. Verify the replacement kind `39002` roster count matches the active database membership count. No schema migration or desktop release is required. Fixes block#3156 Supersedes block#3166 --------- Signed-off-by: Wes <wesbillman@users.noreply.github.com> Co-authored-by: Carl <c7ebe626f000404285d3686e1dc74cc07cc60a9754a150041ba132e14bd3e2ec@buzz.block.builderlab.xyz> (cherry picked from commit e094092) Signed-off-by: Cursor Agent <cursoragent@cursor.com>
- buffer native WebSocket frames until `plugin:websocket|connect` returns the socket ID and the NIP-42 auth waiter is installed - drain those frames in order before normal inbound handling begins - add a deterministic E2E seam and regression for an AUTH challenge delivered before connect resolves The native WebSocket task starts forwarding relay frames before the connect command returns its socket ID. Buzz relay sends the NIP-42 AUTH challenge immediately on connection, so Desktop could process that challenge while `wsId` and `authRequest` were still unset. The challenge was discarded, the cold connection failed authentication, and the first plain-text send failed. Channel history still appeared because it loads through the Tauri channel-window command rather than this frontend WebSocket. - deterministic regression is red before the fix (`connecting` after 5s) and green after it - `pnpm test`: 3,721 passed - `pnpm build:e2e`: passed - focused early-AUTH E2E: passed - existing failed-initial-dial E2E: passed - `pnpm typecheck`: passed - Biome + file-size pre-commit checks: passed The complete 7-test relay-reconnect file passed once before the final line-count-only compaction. After that compaction, two full-file reruns each had the same unrelated startup-seam flake in the existing initial-dial test; both the new test and that existing test pass independently at the committed HEAD. --------- Signed-off-by: npub1jh9wn95s0472h86ahapupaf7m6kx4v9sx2n0atj2hltcfer8k06s5n3pyf <95cae996907d7cab9f5dbf43c0f53edeac6ab0b032a6feae4abfd784e467b3f5@buzz.block.builderlab.xyz> Signed-off-by: Wren <5217c5c2f7bfb4333e46d17c98a9255a52dadee18dcd43a43536b95e6776dfa0@buzz.block.builderlab.xyz> Co-authored-by: npub1jh9wn95s0472h86ahapupaf7m6kx4v9sx2n0atj2hltcfer8k06s5n3pyf <95cae996907d7cab9f5dbf43c0f53edeac6ab0b032a6feae4abfd784e467b3f5@buzz.block.builderlab.xyz> Co-authored-by: Wren <5217c5c2f7bfb4333e46d17c98a9255a52dadee18dcd43a43536b95e6776dfa0@buzz.block.builderlab.xyz> (cherry picked from commit 6ea7a2b) Signed-off-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Signed-off-by: Cursor Agent <cursoragent@cursor.com>
- repair exact-channel reconnect gaps from a source-coupled 1,865-second floor (`900` seconds of relay future tolerance + `960` seconds of DB created-at floor + `5` seconds of fence margin) - page the existing authenticated `POST /query` bridge losslessly with `(until, before_id)`, including dense timestamp boundaries and an unbounded first page that does not trust the renderer clock - keep the restored live REQ unchanged while deduplicating live/repair overlap until both live EOSE and repair completion for the active connection generation The wider repair applies only to live subscriptions containing the exact channel-event kind set and one `#h`. Profile, read-state, global, channel-less, and other subscription behavior is unchanged. Failed or stale repairs retain their pinned lower bound for the next reconnect. This intersects the replay path described in block#3215, but does not claim to fix that issue. Desktop already has a bounded notification-side event-ID guard; this PR adds transport dispatch dedupe for the restored-live/repair overlap. Notification behavior should remain a focused regression check while this wider repair window rolls out. - `cd desktop && pnpm typecheck` - `cd desktop && pnpm biome check src/shared/api/channelReconnectRepair.ts src/shared/api/relayClientSession.ts src/shared/api/relayClientShared.ts src/shared/api/relayClosedRecovery.ts src/shared/api/relayReconnectReplay.ts src/shared/api/relayReconnectReplay.test.mjs src/testing/e2eBridge.ts` - `cd desktop && node --test src/shared/api/relayReconnectReplay.test.mjs` (26 passed) - `cargo test --manifest-path desktop/src-tauri/Cargo.toml channel_reconnect_repair` (2 passed) - pre-push hooks passed at `743283439eb6be7969e19951cbb6720c5e493a04` --------- Signed-off-by: Wes <wesbillman@users.noreply.github.com> Co-authored-by: Carl <32a2e2c9d428ee08902cab75d956da2c1d235a22d4766b0dd4138bf6e2e5db1d@buzz.block.builderlab.xyz> (cherry picked from commit 06e8be9) Signed-off-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Signed-off-by: Cursor Agent <cursoragent@cursor.com>
- detect relay-authored NIP-29 kind 39002 roster snapshots truncated by the former 1,000-member query cap and repair stale large rosters during relay startup - serialize canonical roster capture and replacement with membership writes, preserving tenant, channel, signer, pubkey, and role boundaries through mixed-version deployments - install migration 0032's fail-closed roster fence on the partitioned events table and verify its catalog shape plus behavior before opening relay listeners Migration 0032 is a hard schema-before-code compatibility boundary. Apply migrations before rolling this relay version. Startup refuses to open listeners when the parent/partition triggers are missing, disabled, mis-shaped, or behaviorally inert. For large installations, prefer `buzz-admin migrate` and monitor lock acquisition as documented in the chart README. Exact head: `bcbba271f54bc0046a6683007e5a2b70403a11d5` - rebased onto `569308c23c9c2bf620dd3a9a5e4baecbcfa22e16`; the nine-file feature patch is byte-identical to pre-rebase head `be8ea0084f4d4c78c7c2550baad4399e4df8ce73` - pre-push hook passed at exact head: branch-skew, file-size, full Rust unit suite, Desktop Tauri clippy, and Desktop Tauri tests - `cargo fmt --all -- --check` - `cargo test -p buzz-relay group_members_snapshot_keeps_members_past_one_thousand -- --nocapture` - focused CI-mode Playwright regression: `selected relay agents revoked after the invite prompt cause no side effects` passed at exact head - prior exact-patch validation: `large_roster_reconciliation_candidates_respect_snapshot_count_and_signer`, mixed-writer locking/rollback, migration admission, partition trigger coverage, and desired-schema parity regressions Independent DB/relay review found no blocking issues in the exact feature patch. The concurrency fence holds the established replacement and membership locks on one transaction/connection through replacement; failures roll back both soft-delete and insert. Reconciliation remains tenant/channel/signer scoped and validates exact normalized pubkey-plus-role membership. The prior red Desktop shard was unrelated to this backend-only diff: its mocked mention test exercises no relay, database, or migration path. It reproduced as a timing flake on the old head, passed on retry/base, and now passes locally after rebasing onto current main. --------- Signed-off-by: Wes <wesbillman@users.noreply.github.com> Co-authored-by: Carl <32a2e2c9d428ee08902cab75d956da2c1d235a22d4766b0dd4138bf6e2e5db1d@buzz.block.builderlab.xyz> Signed-off-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Signed-off-by: Cursor Agent <cursoragent@cursor.com>
- Include Crew's agent receipt kind (46043) in the reconnect repair filter so lossless repair covers Crew's live channel filter kinds. - Record relayClientSession.ts line count after rebase onto main (AUTH inbound buffer + lossless reconnect + toRelayFrames merge). Signed-off-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-Authored-By: Oscar Le <oscar.lehuu@gmail.com> Signed-off-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: oscarlehuu <oscarlehuu@users.noreply.github.com>
cursor
Bot
force-pushed
the
devin/issue-280-tier1-reliability
branch
from
August 23, 2026 00:45
9256c83 to
3dd950a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Ports the four upstream Buzz Tier 1 reliability PRs (0.5.18 sync stack, meta #285) onto Crew
main, as one upstream cherry-pick per PR plus one Crew adaptation commit:583b500c239002snapshot builds past the 1,000-row page cap (buzz-db::channel,buzz-admin, roster e2e script)e578f44e5relayInboundBuffer,relayAuthPolicy)a196b6f04get_channel_reconnect_repairTauri command runs fixed-kind,#h-scoped keyset pagination ((until, before_id), 500/page) over the relay after reconnect, with generation-scoped live/repair dedup so no message in the local window is lost or double-delivered1afb5ce350032adds aguard_channel_roster_snapshottrigger + advisory-lock ordering so mixed-version pods can't publish a stale kind39002snapshot; relay side-effects revalidate roster tags9256c8315Crew divergences / adaptations (kept Crew behaviour)
desktop/src-tauri/src/invoke.rs(desktop_invoke_handler!), not upstream's inlinegenerate_handler!.relayLiveEventBufferwith replay context + subscription-identity re-lookup) and layered upstream's connection-generation staleness check and reconnect-replay dedup onto it, instead of replacing it with upstream'sflushEvents.relayReconnectReplay.tsand added upstream's native repair pagination beside it (requestRepairpreferred, Crew'srequestHistoryREQ path retained as fallback).46043toCHANNEL_REPAIR_KINDS(Rust + E2E bridge) so repair coverage matches Crew's live channel filter (upstream has no such kind).relayClientSession.ts1067→1076 lines as upstream-owned growth per the ratchet's upstream-sync rule (noMAX_LINESchange).maintoday because CI path-filters skipped these crates):buzz-dbmigration inventory (count 30→32; migration0008substring missed wiki kinds30023/30623from feat: Crew Wiki (relay-native repo + company wiki, two doors, Ask Plan-to-thread) #210) andbuzz-cliinventory tests (missingorggroup, missingagents callfrom Agent-to-agent call by name (CoS wakes specialists; no founder Wake) #230/feat(cli): buzz agents call wakes specialists by name (#230) #240). Without these the requiredjust test-unitgate cannot pass; no production code was changed for them.Channel-first IA (#278) untouched — no UI/IA changes in this PR.
Related issue
Fixes #280
Testing
TDD evidence (full logs in the issue session):
main(worktree at9bffb8cab) fail —relayReconnectReplay.test.mjs/relayInboundBuffer.test.mjscannot even resolve the new modules/exports (relayInboundBuffer.tsmissing,DB_CREATED_AT_FLOOR_SECSunexported):fail 2, pass 0.pnpm --filter buzz test→ 5544 pass, 0 fail, 1 skipped.Gates (all run locally under hermit, Node 24.15.0 / pnpm 11.4.0;
just _ensure-sidecar-stubsbefore Rust checks):pnpm --filter buzz check— passpnpm --filter buzz typecheck— passpnpm --filter buzz test— pass (5544/0)just test-unit— pass (all crates)just check-compile— passNot verified here (needs live relay + agents):
buzz agents callmention delivery and a manual network-blip reconnect; covered by the ported unit/coupling tests and upstream'srelay-reconnect.spec.tsE2E in CI. No UI-visible change, so no screenshots.E2E test results (desktop mock bridge)
Built with
pnpm --filter buzz build:e2e; committed regression specrelay-reconnect.spec.ts: 16/16 passed (headless xvfb,--project=smoke --workers=1), including the ported lossless-reconnect regression (260 missed messages backfilled past the live subscription limit) and both early-AUTH-challenge tests.Recorded golden-path + reconnect smoke (headed):
#generaltimeline renders.Live receive + UI send before disconnect / boot state / recording
DONE
devin/issue-280-tier1-reliability(5 commits,583b500c2…9256c8315); nothing is uncommitted:crates/buzz-db/src/channel.rs,feed.rs,buzz-admin,scripts/e2e-large-channel-roster.sh)desktop/src/shared/api/relayInboundBuffer.ts,relayAuthPolicy.ts)get_channel_reconnect_repairTauri command,relayReconnectReplay.ts,relayClosedRecovery.ts,relayLiveEventBuffer.ts,relayClientSession.ts, E2E bridge +relay-reconnect.spec.ts)migrations/0032_channel_roster_snapshot_fence.sql,buzz-relayside effects,schema/schema.sql)46043in repair kinds; Crew invoke architecture/live-buffer/recovery-barrier preserved; stalebuzz-db/buzz-cliinventory assertions repaired (details in Summary above).relayReconnectReplay.test.mjs(native repair pagination, dedup, generation barriers),relayInboundBuffer.test.mjs, repair-kind coupling test, upstreamrelay-reconnect.spec.tsE2E additions.pnpm --filter buzz check,pnpm --filter buzz typecheck,pnpm --filter buzz test(5544 pass / 0 fail / 1 skipped),just _ensure-sidecar-stubs,just test-unit,just check-compile.relay-reconnect.spec.ts16/16 (headless smoke), plus a recorded golden-path reconnect smoke — full-viewport screenshots and recording are embedded in the Testing section above (boot, exactly-once live/send, 5-message lossless backfill). TDD RED/GREEN logs captured (~/evidence-280/red-desktop-test.log,green-desktop-test.log,gate-*.logon the session box; attached to the session).IN PROGRESS
9256c8315.TODO / NEXT
9bffb8cab; main has since gained2c26b74bf(upstream(sync): Mobile UI — upstream 0.5.12–0.5.18 parity #305, mobile-only) — no conflicts expected, but a rebase before merge may be wanted.channel-mute.spec.ts(muted channel dimmed),composer-selection-formatting.spec.ts(Buzz theme selection color),edit-agent.spec.ts(baked defaults ×2),entity-link-recipient-cards.spec.ts,inbox-reactions.spec.ts(refetch persistence). Evidence: identical failure sets on sibling PRs upstream(sync): Tier 1 perf/CPU — mounted-view, Rust hot paths, relay traffic (#6198, #6024, #5879, #5897, #6330) #279/perf(desktop): liveness observer frames bump global active-turns generation — app-wide re-render per streamed token #286/perf(desktop): bound observer-event memory — uncapped archive window, idle-agent retention, O(n²) archive append #293, and all reproduce locally at pre-port main9bffb8cab; main's own latest CI run skipped these shards via path filters, so the breakage landed undetected. Remaining shards/jobs were cancelled by the parent's CI serialization. Whoever picks this up should fix those tests on main separately, then re-run CI here.buzz agents callmention delivery in a large project channel and a real network-blip reconnect were not run (need a live relay + agents); covered by the ported unit/E2E regression tests.Link to Devin session: https://app.devin.ai/sessions/a7cd8ffe3bdf41fc970e3466c83c352a
Requested by: @oscarlehuu