feat(holon): entity DNA, place-safe multi-host agents (Remote Agents + R0–R5)

.github/workflows/ci.yml

@@ -1023,7 +1023,7 @@ jobs:
           git log -1 --format=%s | grep -qx smoke
           echo "Host bash resolved and functional; git commit round-trip passed"
       - name: Check (Tauri crate)
-        run: cargo check --manifest-path desktop/src-tauri/Cargo.toml --target $env:TARGET
+        run: cargo check --manifest-path desktop/src-tauri/Cargo.toml --workspace --all-targets --target $env:TARGET
         env:
           CMAKE_POLICY_VERSION_MINIMUM: "3.5"
       - name: Test (Tauri crate)

.github/workflows/desktop-release-cache-proof.yml

@@ -0,0 +1,164 @@
+name: Desktop release cache tag-scope proof
+
+# Dispatch from a cache-proof-* tag at the same trusted-main SHA warmed by all
+# four canaries. Every job restores only and requires an exact cache hit.
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  macos:
+    name: Prove macOS ${{ matrix.target }} cache visibility
+    if: github.repository == 'block/buzz'
+    runs-on: macos-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - target: aarch64-apple-darwin
+            features: mesh-llm
+          - target: x86_64-apple-darwin
+            features: default
+    steps:
+      - name: Require cache proof tag
+        run: '[[ "$GITHUB_REF" == refs/tags/cache-proof-* ]] || { echo "::error::Expected cache-proof-* tag; got $GITHUB_REF"; exit 1; }'
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+      - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
+      - name: Patch proof dependency graph
+        run: |
+          cd desktop && node scripts/set-version-from-tag.mjs "0.0.0-cache-proof"
+          cd src-tauri && cargo update --workspace
+      - name: Resolve native toolchain identity
+        id: native_toolchain
+        run: echo "id=$(scripts/desktop-native-toolchain-id.sh macos)" >> "$GITHUB_OUTPUT"
+      - name: Compute exact release cache key
+        id: rust_cache_key
+        env:
+          CACHE_TARGET: ${{ matrix.target }}
+          CACHE_FEATURES: ${{ matrix.features }}
+          NATIVE_TOOLCHAIN_ID: ${{ steps.native_toolchain.outputs.id }}
+        run: |
+          KEY=$(scripts/desktop-release-cache-key.py --platform "$RUNNER_OS" --target "$CACHE_TARGET" --features "$CACHE_FEATURES" --native-inputs "$NATIVE_TOOLCHAIN_ID")
+          echo "key=$KEY" >> "$GITHUB_OUTPUT"
+      - name: Restore exact default-branch cache from tag
+        id: rust_cache
+        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+            desktop/src-tauri/target
+            !desktop/src-tauri/target/**/release/bundle
+          key: ${{ steps.rust_cache_key.outputs.key }}
+      - name: Require exact cache hit
+        env:
+          CACHE_HIT: ${{ steps.rust_cache.outputs.cache-hit }}
+          CACHE_KEY: ${{ steps.rust_cache.outputs.cache-primary-key }}
+          EXPECTED_KEY: ${{ steps.rust_cache_key.outputs.key }}
+        run: '[[ "$CACHE_HIT" == true && "$CACHE_KEY" == "$EXPECTED_KEY" ]] || { echo "::error::Exact tag cache miss (hit=$CACHE_HIT restored=$CACHE_KEY expected=$EXPECTED_KEY)"; exit 1; }'
+
+  linux:
+    name: Prove Linux cache visibility
+    if: github.repository == 'block/buzz'
+    runs-on: ubuntu-latest
+    container: ubuntu:24.04@sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90
+    timeout-minutes: 15
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Require cache proof tag and install release native tools
+        run: |
+          [[ "$GITHUB_REF" == refs/tags/cache-proof-* ]] || { echo "::error::Expected cache-proof-* tag; got $GITHUB_REF"; exit 1; }
+          apt-get update
+          apt-get install -y --no-install-recommends build-essential ca-certificates curl git libasound2-dev libayatana-appindicator3-dev libgtk-3-dev librsvg2-dev libssl-dev libwebkit2gtk-4.1-dev libxdo-dev patchelf pkg-config
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+      - run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+      - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
+      - name: Patch proof dependency graph
+        run: |
+          cd desktop && node scripts/set-version-from-tag.mjs "0.0.0-cache-proof"
+          cd src-tauri && cargo update --workspace
+      - name: Resolve native toolchain identity
+        id: native_toolchain
+        run: echo "id=$(scripts/desktop-native-toolchain-id.sh linux)" >> "$GITHUB_OUTPUT"
+      - name: Compute exact release cache key
+        id: rust_cache_key
+        env:
+          NATIVE_TOOLCHAIN_ID: ${{ steps.native_toolchain.outputs.id }}
+        run: |
+          KEY=$(scripts/desktop-release-cache-key.py --platform "$RUNNER_OS" --target x86_64-unknown-linux-gnu --features mesh-llm --native-inputs "$NATIVE_TOOLCHAIN_ID")
+          echo "key=$KEY" >> "$GITHUB_OUTPUT"
+      - name: Restore exact default-branch cache from tag
+        id: rust_cache
+        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+            desktop/src-tauri/target
+            !desktop/src-tauri/target/**/release/bundle
+          key: ${{ steps.rust_cache_key.outputs.key }}
+      - name: Require exact cache hit
+        env:
+          CACHE_HIT: ${{ steps.rust_cache.outputs.cache-hit }}
+          CACHE_KEY: ${{ steps.rust_cache.outputs.cache-primary-key }}
+          EXPECTED_KEY: ${{ steps.rust_cache_key.outputs.key }}
+        run: '[[ "$CACHE_HIT" == true && "$CACHE_KEY" == "$EXPECTED_KEY" ]] || { echo "::error::Exact tag cache miss (hit=$CACHE_HIT restored=$CACHE_KEY expected=$EXPECTED_KEY)"; exit 1; }'
+
+  windows:
+    name: Prove Windows cache visibility
+    if: github.repository == 'block/buzz'
+    runs-on: windows-latest
+    timeout-minutes: 15
+    steps:
+      - name: Require cache proof tag
+        shell: bash
+        run: '[[ "$GITHUB_REF" == refs/tags/cache-proof-* ]] || { echo "::error::Expected cache-proof-* tag; got $GITHUB_REF"; exit 1; }'
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+      - name: Patch proof dependency graph
+        shell: bash
+        run: |
+          cd desktop && node scripts/set-version-from-tag.mjs "0.0.0-cache-proof"
+          cd src-tauri && cargo update --workspace
+      - name: Resolve native toolchain identity
+        id: native_toolchain
+        shell: bash
+        run: echo "id=$(scripts/desktop-native-toolchain-id.sh windows)" >> "$GITHUB_OUTPUT"
+      - name: Compute exact release cache key
+        id: rust_cache_key
+        shell: bash
+        env:
+          NATIVE_TOOLCHAIN_ID: ${{ steps.native_toolchain.outputs.id }}
+        run: |
+          KEY=$(scripts/desktop-release-cache-key.py --platform "$RUNNER_OS" --target x86_64-pc-windows-msvc --features default --native-inputs "$NATIVE_TOOLCHAIN_ID")
+          echo "key=$KEY" >> "$GITHUB_OUTPUT"
+      - name: Restore exact default-branch cache from tag
+        id: rust_cache
+        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+            desktop/src-tauri/target
+            !desktop/src-tauri/target/**/release/bundle
+          key: ${{ steps.rust_cache_key.outputs.key }}
+      - name: Require exact cache hit
+        shell: bash
+        env:
+          CACHE_HIT: ${{ steps.rust_cache.outputs.cache-hit }}
+          CACHE_KEY: ${{ steps.rust_cache.outputs.cache-primary-key }}
+          EXPECTED_KEY: ${{ steps.rust_cache_key.outputs.key }}
+        run: '[[ "$CACHE_HIT" == true && "$CACHE_KEY" == "$EXPECTED_KEY" ]] || { echo "::error::Exact tag cache miss (hit=$CACHE_HIT restored=$CACHE_KEY expected=$EXPECTED_KEY)"; exit 1; }'

.github/workflows/docker.yml

@@ -1,6 +1,8 @@
 name: Docker image
 
-# Builds and publishes the public Buzz relay images as ghcr.io/block/buzz.
+# Builds and publishes the public Buzz relay images (default ghcr.io/<owner>/buzz;
+# block/buzz → ghcr.io/block/buzz). Forks write cache/images to their own GHCR
+# namespace so they are not denied on ghcr.io/block/* packages.
 # Normal tags contain stripped binaries; matching debug-* tags contain the same
 # optimized binaries with line-table debug information for native profilers.
 #
@@ -72,11 +74,8 @@ concurrency:
 
 permissions: {}
 
-env:
-  # Single source of truth for the image name. Set GHCR_IMAGE as a repo
-  # variable to override (e.g., for forks that want to push to their own
-  # namespace without forking this file).
-  IMAGE_NAME: ${{ vars.GHCR_IMAGE != '' && vars.GHCR_IMAGE || 'ghcr.io/block/buzz' }}
+# Image names are resolved per-job (GHCR requires fully lowercase refs;
+# github.repository_owner can be mixed-case on personal forks).
 
 jobs:
   build:
@@ -106,6 +105,30 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - name: Resolve GHCR image names (lowercase)
+        env:
+          GHCR_IMAGE_VAR: ${{ vars.GHCR_IMAGE }}
+          GHCR_GATEWAY_VAR: ${{ vars.GHCR_PUSH_GATEWAY_IMAGE }}
+        run: |
+          set -euo pipefail
+          owner="$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')"
+          if [ -n "${GHCR_IMAGE_VAR}" ]; then
+            image="${GHCR_IMAGE_VAR}"
+          else
+            image="ghcr.io/${owner}/buzz"
+          fi
+          if [ -n "${GHCR_GATEWAY_VAR}" ]; then
+            gateway="${GHCR_GATEWAY_VAR}"
+          else
+            gateway="ghcr.io/${owner}/buzz-push-gateway"
+          fi
+          # GHCR rejects mixed-case repository names
+          image="$(echo "$image" | tr '[:upper:]' '[:lower:]')"
+          gateway="$(echo "$gateway" | tr '[:upper:]' '[:lower:]')"
+          echo "IMAGE_NAME=${image}" >> "$GITHUB_ENV"
+          echo "GATEWAY_IMAGE=${gateway}" >> "$GITHUB_ENV"
+          echo "Resolved IMAGE_NAME=${image} GATEWAY_IMAGE=${gateway}"
+
       - name: Verify tag-bound release source
         if: github.ref_type == 'tag' || github.event_name == 'workflow_dispatch'
         env:
@@ -243,6 +266,18 @@ jobs:
             tag_prefix: debug-
 
     steps:
+      - name: Resolve GHCR image names (lowercase)
+        env:
+          GHCR_IMAGE_VAR: ${{ vars.GHCR_IMAGE }}
+          GHCR_GATEWAY_VAR: ${{ vars.GHCR_PUSH_GATEWAY_IMAGE }}
+        run: |
+          set -euo pipefail
+          owner="$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')"
+          if [ -n "${GHCR_IMAGE_VAR}" ]; then image="${GHCR_IMAGE_VAR}"; else image="ghcr.io/${owner}/buzz"; fi
+          if [ -n "${GHCR_GATEWAY_VAR}" ]; then gateway="${GHCR_GATEWAY_VAR}"; else gateway="ghcr.io/${owner}/buzz-push-gateway"; fi
+          echo "IMAGE_NAME=$(echo "$image" | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_ENV"
+          echo "GATEWAY_IMAGE=$(echo "$gateway" | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_ENV"
+
       - name: Download all per-arch digests
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
@@ -363,6 +398,17 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
+      - name: Resolve GHCR image names (lowercase)
+        env:
+          GHCR_IMAGE_VAR: ${{ vars.GHCR_IMAGE }}
+          GHCR_GATEWAY_VAR: ${{ vars.GHCR_PUSH_GATEWAY_IMAGE }}
+        run: |
+          set -euo pipefail
+          owner="$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')"
+          if [ -n "${GHCR_IMAGE_VAR}" ]; then image="${GHCR_IMAGE_VAR}"; else image="ghcr.io/${owner}/buzz"; fi
+          if [ -n "${GHCR_GATEWAY_VAR}" ]; then gateway="${GHCR_GATEWAY_VAR}"; else gateway="ghcr.io/${owner}/buzz-push-gateway"; fi
+          echo "IMAGE_NAME=$(echo "$image" | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_ENV"
+          echo "GATEWAY_IMAGE=$(echo "$gateway" | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_ENV"
       - name: Verify tag-bound release source
         if: github.ref_type == 'tag' || github.event_name == 'workflow_dispatch'
         env:
@@ -387,7 +433,7 @@ jobs:
         id: meta
         uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9  # v6.1.0
         with:
-          images: ghcr.io/block/buzz-push-gateway
+          images: ${{ env.GATEWAY_IMAGE }}
           labels: |
             org.opencontainers.image.title=Buzz Push Gateway
             org.opencontainers.image.description=Capability-gated APNs last hop for Buzz
@@ -400,9 +446,9 @@ jobs:
           file: ./Dockerfile.push-gateway
           platforms: ${{ matrix.platform }}
           labels: ${{ steps.meta.outputs.labels }}
-          outputs: type=image,name=ghcr.io/block/buzz-push-gateway,push-by-digest=true,name-canonical=true,push=${{ github.event_name != 'pull_request' }}
-          cache-from: type=registry,ref=ghcr.io/block/buzz-push-gateway-buildcache:${{ matrix.arch }}
-          cache-to: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && format('type=registry,ref=ghcr.io/block/buzz-push-gateway-buildcache:{0},mode=max,compression=zstd', matrix.arch) || '' }}
+          outputs: type=image,name=${{ env.GATEWAY_IMAGE }},push-by-digest=true,name-canonical=true,push=${{ github.event_name != 'pull_request' }}
+          cache-from: type=registry,ref=${{ env.GATEWAY_IMAGE }}-buildcache:${{ matrix.arch }}
+          cache-to: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && format('type=registry,ref={0}-buildcache:{1},mode=max,compression=zstd', env.GATEWAY_IMAGE, matrix.arch) || '' }}
       - name: Export digest
         if: github.event_name != 'pull_request'
         env:
@@ -429,6 +475,17 @@ jobs:
       id-token: write
       attestations: write
     steps:
+      - name: Resolve GHCR image names (lowercase)
+        env:
+          GHCR_IMAGE_VAR: ${{ vars.GHCR_IMAGE }}
+          GHCR_GATEWAY_VAR: ${{ vars.GHCR_PUSH_GATEWAY_IMAGE }}
+        run: |
+          set -euo pipefail
+          owner="$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')"
+          if [ -n "${GHCR_IMAGE_VAR}" ]; then image="${GHCR_IMAGE_VAR}"; else image="ghcr.io/${owner}/buzz"; fi
+          if [ -n "${GHCR_GATEWAY_VAR}" ]; then gateway="${GHCR_GATEWAY_VAR}"; else gateway="ghcr.io/${owner}/buzz-push-gateway"; fi
+          echo "IMAGE_NAME=$(echo "$image" | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_ENV"
+          echo "GATEWAY_IMAGE=$(echo "$gateway" | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_ENV"
       - name: Download per-arch digests
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
@@ -447,7 +504,7 @@ jobs:
         id: meta
         uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9  # v6.1.0
         with:
-          images: ghcr.io/block/buzz-push-gateway
+          images: ${{ env.GATEWAY_IMAGE }}
           tags: |
             type=ref,event=branch,enable=${{ github.event_name != 'workflow_dispatch' || inputs.version == '' }}
             type=sha,prefix=sha-,format=short,enable=${{ github.event_name != 'workflow_dispatch' || inputs.version == '' }}
@@ -458,28 +515,30 @@ jobs:
         working-directory: /tmp/gateway-digests
         env:
           META_TAGS: ${{ steps.meta.outputs.tags }}
+          GATEWAY_IMAGE: ${{ env.GATEWAY_IMAGE }}
         run: |
           set -euo pipefail
           tags=(); while IFS= read -r tag; do [ -n "$tag" ] && tags+=("-t" "$tag"); done <<< "$META_TAGS"
-          digests=(); for digest in *; do digests+=("ghcr.io/block/buzz-push-gateway@sha256:${digest}"); done
+          digests=(); for digest in *; do digests+=("${GATEWAY_IMAGE}@sha256:${digest}"); done
           docker buildx imagetools create "${tags[@]}" "${digests[@]}"
           first_tag=$(echo "$META_TAGS" | head -n1)
           digest=$(docker buildx imagetools inspect "$first_tag" --format '{{json .Manifest}}' | jq -r '.digest')
           echo "digest=${digest}" >> "$GITHUB_OUTPUT"
       - name: Attest gateway image provenance
         uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
         with:
-          subject-name: ghcr.io/block/buzz-push-gateway
+          subject-name: ${{ env.GATEWAY_IMAGE }}
           subject-digest: ${{ steps.manifest.outputs.digest }}
           push-to-registry: true
       - name: Gateway publication summary
         env:
           GATEWAY_DIGEST: ${{ steps.manifest.outputs.digest }}
           GATEWAY_TAGS: ${{ steps.meta.outputs.tags }}
+          GATEWAY_IMAGE: ${{ env.GATEWAY_IMAGE }}
         run: |
           set -euo pipefail
           {
-            echo "### Published \`ghcr.io/block/buzz-push-gateway\`"
+            echo "### Published \`${GATEWAY_IMAGE}\`"
             echo
             printf "**Digest:** \`%s\`\n" "$GATEWAY_DIGEST"
             echo
@@ -490,6 +549,6 @@ jobs:
             echo
             echo 'Verify provenance before deployment:'
             echo "\`\`\`"
-            printf 'gh attestation verify oci://ghcr.io/block/buzz-push-gateway@%s --owner block\n' "$GATEWAY_DIGEST"
+            printf 'gh attestation verify oci://%s@%s --owner %s\n' "$GATEWAY_IMAGE" "$GATEWAY_DIGEST" "${{ github.repository_owner }}"
             echo "\`\`\`"
           } >> "$GITHUB_STEP_SUMMARY"