fix(desktop): keep explicit agent profiles bound to their exact key

[loganj]

🤖

Summary

In Buzz Desktop, clicking a message from stopped agent A could open running agent B—and B's controls—because both shared a persona (an agent definition). This now opens the author you clicked and only that agent's own controls, so you can inspect an old message without being redirected to a different running agent.

An explicit public key—the identifier for one agent—now stays exact across message authors, members, DMs, deep links and Instances rows, including stopped, archived and relay-only agents. Local controls come only from a matching local record for that key. A relay-only A cannot borrow B's Start/Stop/Edit controls or configuration.

Deliberately opening a persona is different: it can still select a representative that respects archived instances or offer Start when none remains. The change removes competing historical-persona redirects rather than adding another identity exception.

Related issue

Independent base: main; no stack parent or child among the replacements. Extracted from #7114, retained as historical source (98fe33ec).

Behavior contract. Originating Buzz discussion · channel f7a9536a-1738-4bad-a888-b3ea25010ef1.

Testing

Synthetic Playwright mock-bridge state. After screenshots exercise this independent profile extraction (df6612b1); no availability or cloud-marker implementation is included.

Before: historical A redirects to running B

Unchanged main product code (bc006f67) with the same updated historical-message fixture fails: clicking Earlier Parity Agent opens Current Parity Agent and its Stop control.

After: historical A opens A

The clicked author remains Earlier Parity Agent, with A's public key and its own Start control. The current sibling is not substituted.

Exact relay-only A while local sibling B exists

A's public key and owner-scoped profile are visible; no local Start/Stop/Edit/Add control or sibling definition is borrowed.

Explicit persona navigation may select local B

Deliberately opening the persona selects its local representative, with B's key and legitimate Stop/Restart/Edit controls.

Explicit persona without an instance may offer Start

This is a deliberately opened persona, not a relay-only key turned into a persona surface.

Original screenshot publication; all five immutable image URLs and captions retained here. The final documentation-only commit does not change this UI. These are synthetic browser fixtures, not live runtime health evidence.

To check manually, open an old message from stopped A while same-persona B is running; compare the displayed key and controls. Then open the persona itself and verify that representative selection still works.

Evidence and limitations

5,793 desktop tests, 56 profile/archive browser cases, type/static/size checks and repository-wide just ci passed. The historical-message regression fails on unchanged main by opening B instead of A. Published-head CI passed.

The advisory security check timed out without a result; it is not a passing check. No availability, cloud-marker, discovery or mention-routing change is included. These screenshots do not establish remote delivery, agent execution or termination.

Security authorization history (audit, not clearance)

The security gate remains visible and unresolved. Existing authorization-request comments were posted by loganj: old-head request for df6612b1db5a6f8d128cef955fd66a80b6828cb8 at 2026-08-31 17:55:11 UTC, then current-head request for 9c4b6523ceaef0f3d92906fcdb5d9a3b9ede7e17 at 17:55:57 UTC. The existing issue-comment workflow run ended cancelled after the previously reported timeout; it did not produce a completed security review. Latest exact-head Run/Post Codex jobs are skipped, not security approval. Historical comments remain available at their original links; consolidating their audit here does not withdraw authorization or clear the gate. An authorized security workflow owner must arrange the missing exact-range result.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is bc006f67087b049e2f9c4d8a2f26faceff628225...9c4b6523ceaef0f3d92906fcdb5d9a3b9ede7e17.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 9c4b6523ceaef0f3d92906fcdb5d9a3b9ede7e17 to authorize a new review.
Any previous review applies only to its recorded range.

[jedwards27]

:bot: Jude’s code review agent

Verdict: APPROVE
Reviewed: bc006f67087b049e2f9c4d8a2f26faceff628225..9c4b6523ceaef0f3d92906fcdb5d9a3b9ede7e17 (exact head 9c4b6523ceaef0f3d92906fcdb5d9a3b9ede7e17)
Risk: high — this is renderer-side identity and management-authority selection, where a same-persona substitution could expose controls for the wrong agent.

Behavior/contracts traced: explicit-pubkey and persona-only navigation; normalized exact-key lookup; local managed-record/persona derivation; retained profile state; lifecycle/edit/instance control gating; owner-scoped relay reads; archived/stopped siblings; async relay removal; renderer/Tauri/relay/persistence/release boundaries; keyboard semantics and visible profile states.

Findings: no blocking or non-blocking defect found.

The changed resolver makes an explicit pubkey a hard fence: only the exact normalized local managed record may supply persona context or sibling buckets (desktop/src/features/profile/lib/useCanonicalManagedAgentProfile.ts:14-22,49-66). UserProfilePanel preserves the requested key and gates retained persona/configuration and management controls on that exact local record while leaving persona-only navigation separate (desktop/src/features/profile/ui/UserProfilePanel.tsx:198-226,265-336,705-719,782-829; desktop/src/features/agents/ui/AgentsScreen.tsx:49-64,81-89). Instance disclosures remain semantic buttons with focus styling and aria-expanded (desktop/src/features/profile/ui/ProfileInstancesSection.tsx:21-38,71-87). The documented identity contract agrees with the implementation (docs/agent-profile-identity.md:3-24). No Tauri command, persistence schema, relay protocol, tenant keying, spawn path, or packaging contract changed in the reviewed range.

Author action: none.
Verification owner: CI/release retains normal required gates; reviewer/tooling owns any additional native-shell observation.

Validation at matching clean head:

• PASS — exact remote head/base, mergeability, unresolved-thread, diff, and check freshness revalidated immediately before review; authenticated reviewer jedwards27 differs from PR author loganj.
• PASS — git diff --check, Desktop typecheck, and Desktop static checks.
• PASS — focused identity/profile suites (independent runs of 17 and 20 tests).
• PASS — E2E-mode production build and exact-key-profile.spec.ts (4/4): relay-only explicit A with and without local B, archived A with live siblings, and all-archived siblings.
• PASS — causal mutations at both resolver and production call site made the guarded unit/E2E cases fail, then passed after restoration; final trees clean.
• PASS — exact-head CI: Desktop Core, Desktop, macOS build, four smoke shards, relay E2E, and both integration shards; current check rollup contains no failed required check.
• PASS — generated-state inspection showed relay-only A retaining A’s key without borrowed controls/configuration, while persona navigation retained its intended local controls.

Manual/native evidence: browser E2E and generated pixels were inspected. A real Tauri/native keyboard/AX journey was not run; no control or layout contract changed, and the changed selection seam is exercised through the E2E production call site.

Residual risk: both independent full local Desktop suite attempts were interrupted during concurrent/long execution without a failing assertion. Exact-head Desktop Core CI completed the repository Desktop test gate, focused tests and causal mutations passed, and no author-actionable defect was established. Native-shell observation remains a reviewer/tooling confidence gap, not an author rework item.