pkgs: bump buzz-agent-tools to 63496cc1 - clears W7

docs/upstream-watch.md

@@ -20,7 +20,6 @@ this file is that nobody has to rediscover *why* a line of config is there.
 |---|---|---|---|
 | W1 | Agent publishes `kind:0` only, so it is mentionable but unbadged | [#2987](https://github.com/block/buzz/issues/2987), [#3277](https://github.com/block/buzz/issues/3277) | `shouldHideAgentFromMentions` reaches its invocability branch |
 | W2 | Agent must create its own channel; it cannot be added to an existing one | not filed (see `reconcile-channels`) | Relay or CLI gains a membership grant for an existing pubkey |
-| W7 | Repos must be created in the desktop client; `buzz repos create` produces unusable announcements | not filed | `buzz repos create` gains a channel-binding flag |
 | W5 | Relay runs from the upstream container image, not built from source | not filed | Upstream publishes the frontend assets, or a source build produces the web surface |
 | W6 | Postgres needs `enableTCPIP` + a loopback `trust` rule | gated on W5 | The relay no longer runs in a container |
 
@@ -108,28 +107,32 @@ while Garage validated the signature scope. SeaweedFS does not, so the pin is un
 and the `region` option is gone. If the object store is ever changed again, re-check this
 first - it fails as `AuthorizationHeaderMalformed`, which does not obviously point at region.
 
-### W7 - CLI-announced repos cannot pass the git read gate
+### W7 - resolved 2026-07-30 by upstream binding support
 
 The relay gates git reads on a **buzz-channel binding** carried by the `kind:30617`
-announcement. Without it every fetch is denied:
+announcement. Without it every fetch was denied:
 
 ```
 WARN git read gate: missing/malformed buzz-channel binding (deny)  repo=constellation
 ```
 
-The client surfaces that as *"Could not fetch repository … repository not found"*, which is
-misleading - the repo name is registered and auth succeeded (the relay logs 200s, no 401s).
-The denial is the binding check, not a missing repo or a credential problem.
+The client surfaced that as *"Could not fetch repository … repository not found"*, which was
+misleading - the repo name was registered and auth succeeded (the relay logged 200s, no
+401s). The denial was the binding check, not a missing repo or a credential problem.
 
-`buzz repos create` has no flag for it: its options are `--id`, `--name`, `--description`,
-`--clone`, `--web`, `--nostr-relay`. So **any announcement made from the CLI is
-structurally unusable**, and there is no CLI path to repair or retract it either -
-`buzz messages delete` resolves message-kind events only and answers `event <id> not found`
-for a 30617.
+`buzz repos create` previously had no flag for it, so any announcement made from the CLI was
+structurally unusable and there was no CLI path to repair or retract one either.
 
-Practical consequence: **create projects in the desktop client**, which binds them to a
-channel and pushes over NIP-98. Do not announce repos from the CLI expecting them to work.
-Two related facts worth knowing:
+[block/buzz#3626](https://github.com/block/buzz/pull/3626) (merged) fixed this: `buzz repos
+create` now takes an optional `--channel <uuid>` that emits the `buzz-channel` tag at
+creation, and a new `buzz repos bind --id <repo> --channel <uuid>` rebinds an
+already-announced repo (the remediation path for anything created before this landed,
+including announcements this deployment made while the workaround was in force). Picked up
+here via the `pkgs/buzz-agent-tools.nix` rev bump to
+`63496cc1d4c6f1b7c613801bdcc694169dcf391a`.
+
+Projects can now be provisioned with `buzz repos create --id <repo> --channel <uuid>`
+instead of only from the desktop client. The two related facts below still hold:
 
 - Announcing reserves the name in `git_repo_names` but does not create the repo; a repo
   comes into being on first push. There is no create/init endpoint - the only git routes are
@@ -139,9 +142,6 @@ Two related facts worth knowing:
   request's method and URL, so a static header cannot cover a whole push. No credential
   helper ships with the CLI.
 
-**Clear when** `buzz repos create` can bind an announcement to a channel - then repos can be
-provisioned from a script rather than by hand in the client.
-
 ### W5 / W6 - the relay is an image, the agent is built
 
 Upstream publishes a container image for the **relay** only, and the relay serves bundled

pkgs/buzz-agent-tools.nix

@@ -7,13 +7,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "buzz-agent-tools";
-  version = "0-unstable-2026-07-28";
+  version = "0-unstable-2026-07-30";
 
   src = fetchFromGitHub {
     owner = "block";
     repo = "buzz";
-    rev = "4a977c588a540be38bd8ddb268cd24437bac8165";
-    hash = "sha256-rrTpV4wYRdL1o0cJXifHz5qGJ4tlr2Go1g3MdNrj26w=";
+    rev = "63496cc1d4c6f1b7c613801bdcc694169dcf391a";
+    hash = "sha256-iC+as1J/GYRIYSUnZWUEqXHF86t0Ks6C+WSyGB7ucGA=";
   };
 
   # The workspace lock file pulls ~40 git dependencies; allowBuiltinFetchGit avoids