Relay-primary private managed-agent config

crates/buzz-relay/src/handlers/ingest.rs

@@ -28,12 +28,13 @@ use buzz_core::kind::{
     KIND_NIP29_EDIT_METADATA, KIND_NIP29_JOIN_REQUEST, KIND_NIP29_LEAVE_REQUEST,
     KIND_NIP29_PUT_USER, KIND_NIP29_REMOVE_USER, KIND_NIP43_LEAVE_REQUEST,
     KIND_NIP65_RELAY_LIST_METADATA, KIND_PERSONA, KIND_PIN_LIST, KIND_PRESENCE_UPDATE,
-    KIND_PRODUCT_FEEDBACK, KIND_PROFILE, KIND_PROJECT, KIND_REACTION, KIND_READ_STATE, KIND_REPORT,
-    KIND_STREAM_MESSAGE, KIND_STREAM_MESSAGE_BOOKMARKED, KIND_STREAM_MESSAGE_DIFF,
-    KIND_STREAM_MESSAGE_EDIT, KIND_STREAM_MESSAGE_PINNED, KIND_STREAM_MESSAGE_SCHEDULED,
-    KIND_STREAM_MESSAGE_V2, KIND_STREAM_REMINDER, KIND_TEAM, KIND_TEAM_CATALOG, KIND_TEXT_NOTE,
-    KIND_USER_STATUS, KIND_WORKFLOW_DEF, KIND_WORKFLOW_TRIGGER, RELAY_ADMIN_ADD_MEMBER,
-    RELAY_ADMIN_CHANGE_ROLE, RELAY_ADMIN_REMOVE_MEMBER, RELAY_ADMIN_SET_WORKSPACE_PROFILE,
+    KIND_PRIVATE_MANAGED_AGENT, KIND_PRODUCT_FEEDBACK, KIND_PROFILE, KIND_PROJECT, KIND_REACTION,
+    KIND_READ_STATE, KIND_REPORT, KIND_STREAM_MESSAGE, KIND_STREAM_MESSAGE_BOOKMARKED,
+    KIND_STREAM_MESSAGE_DIFF, KIND_STREAM_MESSAGE_EDIT, KIND_STREAM_MESSAGE_PINNED,
+    KIND_STREAM_MESSAGE_SCHEDULED, KIND_STREAM_MESSAGE_V2, KIND_STREAM_REMINDER, KIND_TEAM,
+    KIND_TEAM_CATALOG, KIND_TEXT_NOTE, KIND_USER_STATUS, KIND_WORKFLOW_DEF, KIND_WORKFLOW_TRIGGER,
+    RELAY_ADMIN_ADD_MEMBER, RELAY_ADMIN_CHANGE_ROLE, RELAY_ADMIN_REMOVE_MEMBER,
+    RELAY_ADMIN_SET_WORKSPACE_PROFILE,
 };
 use buzz_core::tenant::TenantContext;
 use buzz_core::verification::verify_event;
@@ -263,7 +264,7 @@ fn required_scope_for_kind(kind: u32, event: &Event) -> Result<Scope, &'static s
         KIND_TEXT_NOTE | KIND_LONG_FORM => Ok(Scope::MessagesWrite),
         KIND_CONTACT_LIST | KIND_READ_STATE | KIND_USER_STATUS | KIND_AGENT_ENGRAM
         | KIND_EVENT_REMINDER | KIND_PERSONA | KIND_TEAM | KIND_MANAGED_AGENT
-        | KIND_TEAM_CATALOG | super::push_lease::KIND_PUSH_LEASE => {
+        | KIND_PRIVATE_MANAGED_AGENT | KIND_TEAM_CATALOG | super::push_lease::KIND_PUSH_LEASE => {
             Ok(Scope::UsersWrite)
         }
         // NIP-AM: agent turn metrics are agent-authored global events (encrypted to owner).
@@ -476,6 +477,7 @@ pub(crate) fn is_global_only_kind(kind: u32) -> bool {
             // (pubkey, kind, d_tag). A stray `h` tag must not channel-scope them.
             | KIND_TEAM
             | KIND_MANAGED_AGENT
+            | KIND_PRIVATE_MANAGED_AGENT
             | KIND_TEAM_CATALOG
             // NIP-34: git events use `a` tags (repo reference), not `h` tags (channel scope).
             // Parameterized replaceable kinds are keyed by (pubkey, kind, d_tag).
@@ -3338,15 +3340,14 @@ mod tests {
     }
 
     #[test]
-    fn private_managed_agent_kind_remains_rejected_until_atomic_ingest_exists() {
-        assert!(
-            required_scope_for_kind(
-                buzz_core::kind::KIND_PRIVATE_MANAGED_AGENT,
-                &make_dummy_event(),
-            )
-            .is_err(),
-            "kind 30179 must not enter generic EVENT ingest before privacy and aggregate CAS deploy"
+    fn private_managed_agent_kind_is_owner_scoped_global_user_data() {
+        let event = make_dummy_event();
+        assert_eq!(
+            required_scope_for_kind(KIND_PRIVATE_MANAGED_AGENT, &event),
+            Ok(Scope::UsersWrite)
         );
+        assert!(is_global_only_kind(KIND_PRIVATE_MANAGED_AGENT));
+        assert!(!requires_h_channel_scope(KIND_PRIVATE_MANAGED_AGENT));
     }
 
     #[test]

desktop/src-tauri/src/app_state.rs

@@ -35,28 +35,27 @@ pub struct AppState {
     /// Workspace-provided relay URL override. Set by `apply_workspace` on app
     /// init and takes priority over env vars and compile-time defaults.
     pub relay_url_override: Mutex<Option<String>>,
-    /// Set during backend setup when managed agents are eligible for launch
-    /// restore. `apply_workspace` consumes it after installing the workspace
-    /// relay and identity, so agents never start against the fallback relay.
+    /// Set during backend setup when managed agents are eligible for launch restore.
+    /// `apply_workspace` consumes it after installing the workspace relay and
+    /// identity, so agents never start against the fallback relay.
     pub managed_agent_restore_pending: AtomicBool,
-    /// Whether desktop may repair managed-agent kind:0 profiles from its local
-    /// records. Disabled by the agent-managed profiles experiment so an agent's
-    /// own profile updates are not overwritten on start or restore.
+    /// Whether desktop may repair managed-agent kind:0 profiles from local records.
+    /// Disabled by the experiment so agent profile updates survive start/restore.
     pub managed_agent_profile_reconcile_enabled: AtomicBool,
-    /// Shared shutdown signal checked by launch-time agent restoration.
+    /// Shared shutdown signal for launch-time agent restoration.
     pub shutdown_started: AtomicBool,
     /// Serializes every managed-runtime transition that changes the protected
     /// PID set: spawn/register, adoption, stop, shutdown, and sweep snapshots.
     /// Never perform network I/O while holding this lock.
     pub managed_agent_runtime_transition: Mutex<()>,
     pub managed_agents_store_lock: Mutex<()>,
+    pub(crate) private_managed_agent_overlay:
+        Mutex<crate::managed_agents::private_config_overlay::PrivateConfigOverlay>,
     pub channel_templates_store_lock: Mutex<()>,
     pub managed_agent_processes: Mutex<HashMap<ManagedAgentRuntimeKey, ManagedAgentPairRuntime>>,
     pub huddle_state: Mutex<HuddleState>,
     pub huddle_audio: crate::huddle::tts_settings::HuddleAudioSettingsState,
-    /// Tauri app handle — stored after setup so huddle commands can emit
-    /// `huddle-state-changed` events without needing the handle threaded
-    /// through every call site.
+    /// Tauri handle for emitting huddle events.
     ///
     /// Set once during `setup()` in `lib.rs`; never cleared.
     pub app_handle: Mutex<Option<AppHandle>>,
@@ -213,6 +212,7 @@ pub fn build_app_state() -> AppState {
         managed_agent_runtime_transition: Mutex::new(()),
         identity_mutation: Mutex::new(()),
         managed_agents_store_lock: Mutex::new(()),
+        private_managed_agent_overlay: Mutex::new(Default::default()),
         channel_templates_store_lock: Mutex::new(()),
         managed_agent_processes: Mutex::new(HashMap::new()),
         session_config_cache: Mutex::new(HashMap::new()),

desktop/src-tauri/src/commands/agents.rs

@@ -70,49 +70,12 @@ pub(super) fn retain_managed_agent_pending(
 /// `pending_sync = 1`. The `d_tag` is the agent's pubkey. Best-effort: a
 /// failure is logged and swallowed so a retention hiccup never blocks the
 /// disk-authoritative delete.
-pub(super) fn tombstone_managed_agent_pending(
+pub(crate) fn tombstone_managed_agent_pending(
     app: &AppHandle,
     state: &AppState,
     agent_pubkey: &str,
 ) {
-    use crate::managed_agents::{
-        agent_events::build_agent_delete,
-        retention::{
-            delete_retained_event, open_retention_db, retain_event, tombstone_retention_d_tag,
-            RetainedEvent,
-        },
-    };
-    use buzz_core_pkg::kind::KIND_MANAGED_AGENT;
-    use nostr::JsonUtil;
-
-    const KIND_DELETE: u32 = 5;
-
-    let result = (|| -> Result<(), String> {
-        let scope = crate::managed_agents::retention::active_retention_scope(app, state)?;
-        let owner_pubkey = scope.owner_keys.public_key().to_hex();
-        let event = build_agent_delete(agent_pubkey, &owner_pubkey)?
-            .sign_with_keys(&scope.owner_keys)
-            .map_err(|e| format!("failed to sign managed-agent tombstone: {e}"))?;
-        let conn = open_retention_db(&scope.db_path)?;
-        delete_retained_event(&conn, KIND_MANAGED_AGENT, &owner_pubkey, agent_pubkey)?;
-        retain_event(
-            &conn,
-            &RetainedEvent {
-                kind: KIND_DELETE,
-                pubkey: owner_pubkey,
-                // Key by the target coordinate so cross-kind d-tag tombstones
-                // occupy distinct rows (F2c).
-                d_tag: tombstone_retention_d_tag(KIND_MANAGED_AGENT, agent_pubkey),
-                content: event.content.to_string(),
-                created_at: event.created_at.as_secs() as i64,
-                raw_event: event.as_json(),
-                pending_sync: true,
-            },
-        )
-    })();
-    if let Err(e) = result {
-        eprintln!("buzz-desktop: agent-tombstone: {e}");
-    }
+    crate::managed_agents::agent_events::tombstone_managed_agent_pending(app, state, agent_pubkey);
 }
 
 /// Build and sign the NIP-IA `kind:9035` archive request enqueued when an
@@ -543,6 +506,11 @@ pub async fn list_managed_agents(app: AppHandle) -> Result<Vec<ManagedAgentSumma
         for pubkey in &exited_pubkeys {
             state.clear_agent_session_caches(pubkey);
         }
+        let records = state
+            .private_managed_agent_overlay
+            .lock()
+            .map_err(|error| error.to_string())?
+            .resolved_records(&records);
 
         let personas = load_personas(&app).unwrap_or_default();
         // One disk read for the whole list — build_managed_agent_summary takes
@@ -1071,6 +1039,27 @@ pub async fn start_managed_agent(
     // Snapshot the workspace owner pubkey for the legacy auth_tag fallback.
     // Read outside the records lock to keep lock ordering simple.
     let owner_hex = workspace_owner_hex(&state)?;
+    let local_records = {
+        let _store_guard = state
+            .managed_agents_store_lock
+            .lock()
+            .map_err(|error| error.to_string())?;
+        load_managed_agents(&app)?
+    };
+    if state
+        .private_managed_agent_overlay
+        .lock()
+        .map_err(|error| error.to_string())?
+        .contains(&pubkey)
+    {
+        return crate::managed_agents::private_config_overlay::start_relay_only_agent(
+            &app,
+            &state,
+            &pubkey,
+            &owner_hex,
+            &local_records,
+        );
+    }
     enum StartTarget {
         Local,
         Provider {

desktop/src-tauri/src/commands/identity.rs

@@ -415,6 +415,14 @@ fn commit_imported_identity(
 
     let storage = persist(&keys)?;
 
+    // Serialize the identity scope transition with inbound private-config
+    // handling, which holds this lock from owner resolution through overlay
+    // insertion. Otherwise an old-owner patch could land after this clear.
+    let _managed_agents_store_guard = state
+        .managed_agents_store_lock
+        .lock()
+        .map_err(|e| e.to_string())?;
+
     // Update in-memory keys BEFORE clearing recovery flags. The Release
     // stores below pair with Acquire loads in get_identity: a reader
     // observing false is guaranteed to see the updated keys.
@@ -424,6 +432,11 @@ fn commit_imported_identity(
         *active_keys = keys;
         state.set_identity_storage(storage);
     }
+    state
+        .private_managed_agent_overlay
+        .lock()
+        .map_err(|e| e.to_string())?
+        .clear();
 
     // Clear both recovery flags — an import is valid in either lost or
     // keyring-locked state and resolves both. In the locked case the

desktop/src-tauri/src/commands/personas/inbound.rs

@@ -77,7 +77,9 @@ fn reconcile_inbound_persona_event_blocking(
         save_managed_agents, save_teams,
         team_events::team_content_from_event,
     };
-    use buzz_core_pkg::kind::{KIND_DELETION, KIND_MANAGED_AGENT, KIND_PERSONA, KIND_TEAM};
+    use buzz_core_pkg::kind::{
+        KIND_DELETION, KIND_MANAGED_AGENT, KIND_PERSONA, KIND_PRIVATE_MANAGED_AGENT, KIND_TEAM,
+    };
     use nostr::JsonUtil;
 
     let state = app.state::<AppState>();
@@ -96,10 +98,17 @@ fn reconcile_inbound_persona_event_blocking(
         return reconcile_inbound_tombstone(&event, &arrival_relay_url, &app, &state);
     }
 
-    if !matches!(kind, KIND_PERSONA | KIND_TEAM | KIND_MANAGED_AGENT) {
+    if !matches!(
+        kind,
+        KIND_PERSONA | KIND_TEAM | KIND_MANAGED_AGENT | KIND_PRIVATE_MANAGED_AGENT
+    ) {
         return Ok(());
     }
 
+    if kind == KIND_PRIVATE_MANAGED_AGENT {
+        return reconcile_inbound_private_managed_agent(&event, &arrival_relay_url, &app, &state);
+    }
+
     // The d-tag identifies the record within its kind. Persona derives it from
     // the parsed record (`persona_d_tag`); team/agent carry it as the event's
     // d-tag directly. The persona is parsed once here and reused in the apply
@@ -182,6 +191,80 @@ fn reconcile_inbound_persona_event_blocking(
     Ok(())
 }
 
+fn apply_inbound_private_managed_agent_event(
+    event: &nostr::Event,
+    owner_keys: &nostr::Keys,
+    conn: &rusqlite::Connection,
+    overlay: &mut crate::managed_agents::private_config_overlay::PrivateConfigOverlay,
+) -> Result<crate::managed_agents::retention::InboundOutcome, String> {
+    use crate::managed_agents::{
+        private_config_overlay::PrivateConfigPatch,
+        retention::{retain_inbound_event, InboundOutcome, RetainedEvent},
+    };
+    use buzz_core_pkg::{kind::KIND_PRIVATE_MANAGED_AGENT, private_managed_agent};
+    use nostr::JsonUtil;
+
+    // The codec verifies signature/owner, decrypts, validates the nsec binding,
+    // and rejects malformed portable config before any local state changes.
+    let (_, payload) = private_managed_agent::validate_and_decrypt(event, owner_keys)
+        .map_err(|error| format!("invalid private managed-agent event: {error}"))?;
+    let d_tag = payload.agent_pubkey.clone();
+    // Constructing the Desktop patch validates backend-specific fields without
+    // mutating the live overlay or retained head.
+    let patch = PrivateConfigPatch::from_payload(payload)?;
+    let outcome = retain_inbound_event(
+        conn,
+        &RetainedEvent {
+            kind: KIND_PRIVATE_MANAGED_AGENT,
+            pubkey: event.pubkey.to_hex(),
+            d_tag,
+            content: event.content.clone(),
+            created_at: event.created_at.as_secs() as i64,
+            raw_event: event.as_json(),
+            pending_sync: false,
+        },
+    )?;
+    if outcome == InboundOutcome::Applied {
+        overlay.insert_patch(patch);
+    }
+    Ok(outcome)
+}
+
+fn reconcile_inbound_private_managed_agent(
+    event: &nostr::Event,
+    arrival_relay_url: &str,
+    app: &AppHandle,
+    state: &AppState,
+) -> Result<(), String> {
+    use crate::managed_agents::retention::{open_retention_db, InboundOutcome};
+
+    let _store_guard = state
+        .managed_agents_store_lock
+        .lock()
+        .map_err(|error| error.to_string())?;
+    let Some(scope) =
+        crate::managed_agents::retention::arrival_retention_scope(app, state, arrival_relay_url)?
+    else {
+        return Ok(());
+    };
+
+    let mut overlay = state
+        .private_managed_agent_overlay
+        .lock()
+        .map_err(|error| error.to_string())?;
+    let conn = open_retention_db(&scope.db_path)?;
+    let outcome =
+        apply_inbound_private_managed_agent_event(event, &scope.owner_keys, &conn, &mut overlay)?;
+    if outcome == InboundOutcome::Skipped {
+        return Ok(());
+    }
+
+    drop(overlay);
+    try_regenerate_nest(app);
+    let _ = app.emit("agents-data-changed", ());
+    Ok(())
+}
+
 /// Parse an inbound wire event and enforce the signature gate. Everything
 /// downstream trusts `event.pubkey` (ownership routing, tombstone scoping,
 /// behavioral-quad application), so a forged pubkey must die here — the
@@ -244,13 +327,18 @@ fn reconcile_inbound_tombstone(
         },
         save_managed_agents, save_teams,
     };
-    use buzz_core_pkg::kind::{KIND_DELETION, KIND_MANAGED_AGENT, KIND_PERSONA, KIND_TEAM};
+    use buzz_core_pkg::kind::{
+        KIND_DELETION, KIND_MANAGED_AGENT, KIND_PERSONA, KIND_PRIVATE_MANAGED_AGENT, KIND_TEAM,
+    };
     use nostr::JsonUtil;
 
     let Some((target_kind, target_d_tag)) = parse_deletion_coordinate(event) else {
         return Ok(()); // no routable coordinate — nothing to delete
     };
-    if !matches!(target_kind, KIND_PERSONA | KIND_TEAM | KIND_MANAGED_AGENT) {
+    if !matches!(
+        target_kind,
+        KIND_PERSONA | KIND_TEAM | KIND_MANAGED_AGENT | KIND_PRIVATE_MANAGED_AGENT
+    ) {
         return Ok(()); // deletion for a kind we don't track locally
     }
 
@@ -299,7 +387,12 @@ fn reconcile_inbound_tombstone(
             teams.retain(|record| record.id != target_d_tag);
             save_teams(app, &teams)?;
         }
-        KIND_MANAGED_AGENT => {
+        KIND_MANAGED_AGENT | KIND_PRIVATE_MANAGED_AGENT => {
+            state
+                .private_managed_agent_overlay
+                .lock()
+                .map_err(|error| error.to_string())?
+                .remove(&target_d_tag);
             let mut agents = load_managed_agents(app)?;
             agents.retain(|record| record.pubkey != target_d_tag);
             save_managed_agents(app, &agents)?;