Skip to content

feat(projects): let home channel admins manage related channels - #7147

Draft
johnmatthewtennant wants to merge 25 commits into
mainfrom
jtennant/project-home-channel-permissions
Draft

feat(projects): let home channel admins manage related channels#7147
johnmatthewtennant wants to merge 25 commits into
mainfrom
jtennant/project-home-channel-permissions

Conversation

@johnmatthewtennant

@johnmatthewtennant johnmatthewtennant commented Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

Project metadata is signer-owned, so home-channel admins could not add or remove related channels without the Project owner's key.

This adds bounded, actor-signed Project revision events. The relay authorizes either the Project owner or a current owner/admin of the Project's live home channel, applies revisions with compare-and-swap semantics, and preserves the immutable signed revision history. Projects without a resolvable home channel remain owner-managed, and repository permissions are unchanged.

Desktop and CLI channel actions publish these revisions. Owner-authored Project replacements preserve folded channel membership, while writer-backed head reads prevent stale replica state from authorizing a mutation.

Reviewer verification

  1. As a Project owner, set a home channel and make a second user an admin of that channel.
  2. As the second user, open the Project and add a related channel. Confirm it appears under Channels and the resulting Project revision is signed by the admin.
  3. Remove that related channel and confirm it disappears. A channel shown only because it belongs to a linked repository should not expose Remove from Project.
  4. Repeat with a home-channel member who is not an admin and confirm the management action is unavailable.

Screenshots

Related channel on the Project home

Related channel on the Project home

@johnmatthewtennant
feat(projects): authorize home channel admins
eb18afa 
Signed-off-by: John Tennant <jtennant@squareup.com>
@johnmatthewtennant
fix(db): renumber project revision migration
256d6b9 
Signed-off-by: John Tennant <jtennant@squareup.com>
@johnmatthewtennant
fix(projects): allocate revision protocol kind
68c42ee 
Signed-off-by: John Tennant <jtennant@squareup.com>
@johnmatthewtennant
fix(projects): harden revision lifecycle
d0542cc 
Signed-off-by: John Tennant <jtennant@squareup.com>
@johnmatthewtennant
fix(projects): preserve revised channel membership
267244d 
Signed-off-by: John Tennant <jtennant@squareup.com>
@johnmatthewtennant
fix(projects): reset revisions across lifecycle changes
9f48dd5 
Signed-off-by: John Tennant <jtennant@squareup.com>
@johnmatthewtennant
fix(projects): gate channel creation on permissions
a11c8de 
Signed-off-by: John Tennant <jtennant@squareup.com>
@johnmatthewtennant
test(cli): register project channel commands
7b20873 
Signed-off-by: John Tennant <jtennant@squareup.com>
@github-actions

github-actions Bot commented Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown

🔐 Codex Security Review

Status: review required for the current range.

The current range is 571c1902d0ca55cfd4ccf6b91eeb731909cc10be...ce911024b65f09d9c214e1ef35035473fb16fca3.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review ce911024b65f09d9c214e1ef35035473fb16fca3 to authorize a new review.
Any previous review applies only to its recorded range.

@johnmatthewtennant
fix(projects): satisfy current clippy
cc209ae 
Signed-off-by: John Tennant <jtennant@squareup.com>
@johnmatthewtennant
fix(db): move project revisions after main migrations
367ec08 
Signed-off-by: John Tennant <jtennant@squareup.com>
@johnmatthewtennant
Merge remote-tracking branch 'origin/main' into jtennant/project-home…
adb6781 
…-channel-permissions

* origin/main:
  fix(model-capabilities): humanize databricks goose model names (#7135)
  feat(db): add NIP-FI identity and final-admission schema foundation (#6994)
  feat(buzz-acp): give each channel thread its own agent session (#6732)
  docs: add review-proven failure-path & async-state rules to AGENTS.md (#7061)
  fix(desktop): back split thread headers (#7137)
  add public descriptions to agent personas (#7126)
  feat(desktop): add protected-build Bestie experiment (#6902)
  fix(relay): reject a frame on its own acknowledgement channel (#6961)
  fix(acp): wake agents from workflow messages (#6953)

Signed-off-by: John Tennant <jtennant@squareup.com>

# Conflicts:
#	crates/buzz-db/src/runtime/migration.rs
#	schema/schema.sql
@johnmatthewtennant
test(db): include later write fences in parity
21087d8 
Signed-off-by: John Tennant <jtennant@squareup.com>
@johnmatthewtennant
fix(projects): preserve committed revision results
dbfa466 
Signed-off-by: John Tennant <jtennant@squareup.com>
@johnmatthewtennant
fix(projects): preserve channel management access
d88016b 
Signed-off-by: John Tennant <jtennant@squareup.com>
@johnmatthewtennant
fix(projects): scope revision reads and advance heads
ef90d63 
Signed-off-by: John Tennant <jtennant@squareup.com>
@johnmatthewtennant
fix(projects): reject archived home authority
a0919b7 
Signed-off-by: John Tennant <jtennant@squareup.com>
@johnmatthewtennant
fix(projects): serialize channel authority reads
b051e85 
Signed-off-by: John Tennant <jtennant@squareup.com>
@johnmatthewtennant
fix(projects): serialize channel state authority
ee41570 
Signed-off-by: John Tennant <jtennant@squareup.com>
@johnmatthewtennant
fix(projects): lock membership authority rows
dc42d40 
Signed-off-by: John Tennant <jtennant@squareup.com>
@johnmatthewtennant
fix(projects): bound collaborative channel revisions
8e3516e 
Signed-off-by: John Tennant <jtennant@squareup.com>
@johnmatthewtennant
Merge remote-tracking branch 'origin/main' into jtennant/project-home…
1933ebf 
…-channel-permissions

* origin/main:
  fix(desktop): scope composer autocomplete to focus (#6860)
  feat(desktop): add isolated named demo builds (#6407)

Signed-off-by: John Tennant <jtennant@squareup.com>
@johnmatthewtennant
fix(projects): reconcile collaborative revisions
4821ceb 
Signed-off-by: John Tennant <jtennant@squareup.com>
@johnmatthewtennant
test(projects): cover stale repository attachment
49fcc0a 
Signed-off-by: John Tennant <jtennant@squareup.com>
@johnmatthewtennant
fix(db): box applied project revisions
6c63968 
Signed-off-by: John Tennant <jtennant@squareup.com>
@johnmatthewtennant
fix(desktop): mock project revision heads in e2e
ce91102 
Signed-off-by: John Tennant <jtennant@squareup.com>
@johnmatthewtennant

johnmatthewtennant commented Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

@buzz-security-review ce91102

mfethe1 added a commit to mfethe1/buzz that referenced this pull request Sep 1, 2026
@mfethe1
fix(db): renumber 0043_task_system.sql to 0046, clearing duplicate-00…
97f1ccf 
…43 absorb collision

Fourth recurrence of the measured HW-016/HW-019 defect class. Upstream PR block#7158
merged 2026-09-01T19:19:49Z carrying 0043_push_gateway_dogfood_profile.sql,
colliding with the fork's landed 0043_task_system.sql (integrated run 53).

git mv migrations/0043_task_system.sql -> migrations/0046_task_system.sql
(100% similarity, 0 content lines). Three references updated:
- crates/buzz-db/src/migration.rs:1218 assert migrations[34].version 43->46
- crates/buzz-db/src/task.rs:145 doc comment prose
- crates/buzz-relay/src/api/tasks.rs:593 comment prose

Re-measured upstream tail immediately pre-commit: 0043_push_gateway_dogfood_profile.sql.
Next free vs merged tree = 0046 (0044 contested by block#6965/block#7147/block#7157/block#7209;
0045 by block#7157/block#7209; 0046 zero open claimants).

Fork-only: task system absent upstream. migrations.len() stays 35 (renumber).

Signed-off-by: Michael Feth <michael@jira-flow.com>
mfethe1 added a commit to mfethe1/buzz that referenced this pull request Sep 2, 2026
@mfethe1
fix(db): renumber 0043_task_system.sql to 0046, clearing duplicate-00…
7c6dca6 
…43 absorb collision

Fourth recurrence of the measured HW-016/HW-019 defect class. Upstream PR block#7158
merged 2026-09-01T19:19:49Z carrying 0043_push_gateway_dogfood_profile.sql,
colliding with the fork's landed 0043_task_system.sql (integrated run 53).

git mv migrations/0043_task_system.sql -> migrations/0046_task_system.sql
(100% similarity, 0 content lines). Three references updated:
- crates/buzz-db/src/migration.rs:1218 assert migrations[34].version 43->46
- crates/buzz-db/src/task.rs:145 doc comment prose
- crates/buzz-relay/src/api/tasks.rs:593 comment prose

Re-measured upstream tail immediately pre-commit: 0043_push_gateway_dogfood_profile.sql.
Next free vs merged tree = 0046 (0044 contested by block#6965/block#7147/block#7157/block#7209;
0045 by block#7157/block#7209; 0046 zero open claimants).

Fork-only: task system absent upstream. migrations.len() stays 35 (renumber).

Signed-off-by: Michael Feth <michael@jira-flow.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@johnmatthewtennant