feat(git): add default-branch management to relay and CLI

[wesbillman]

Authored by Brain and opened on behalf of Wes (wesbillman).

Summary

Add buzz repos default-branch get/set and the relay operation it needs. Git push changes branch tips but cannot select the server's symbolic HEAD. This selects an existing branch without deleting branches, moving refs, or changing packs.

• Reuse immutable Git manifests and captured-ETag CAS; concurrent pushes/default changes conflict, including stale no-ops.
• Require request-specific NIP-98, body binding, fail-closed replay protection, host tenancy, current channel membership and repository-management authority. Push/project roles alone are insufficient.
• Send the CLI mutation once, without redirects; ambiguous delivery retains the observed digest and is non-retryable.
• Document the narrow HTTP exception to Nostr-first, delegation scope and admission-time ACL revocation. Kind:30618 remains derived; the manifest CAS is authoritative.
• Register the Postgres/Redis/MinIO route and fresh-clone tests in the existing Backend Integration lane.

Review fixes — 7457bda50afa6b52e36315572fa96928b2e21db6

• Reject signed valueless payload tags when verifying a body; preserve the shared verifier's intentional absent-payload compatibility. The real settings route now proves 401, unchanged manifest pointer, and unchanged kind:30618 event IDs for malformed and other invalid credentials.
• Require a nonempty returned branch and head == refs/heads/{branch}; SET additionally requires the returned branch to equal the attempted branch. Malformed/mismatched mutation responses remain non-retryable DeliveryUnknown, retaining the attempted branch and original digest. Invalid reads fail before any POST.
• Strengthen the later-push/fresh-clone regression to select release/v1 while main exists.

Verification

At 7457bda50afa6b52e36315572fa96928b2e21db6:

• Full pre-push passed (all 14 Rust test groups, serialized Tauri tests/clippy, file-size and branch-skew gates; 522 seconds). No hooks disabled.
• All four isolated Postgres/Redis/MinIO settings tests pass, including real Smart HTTP ls-remote --symref and fresh clone on release/v1.
• All 15 focused NIP-98 verifier tests and three default-branch CLI tests pass; malformed credentials and missing-branch responses were reproduced failing before the fixes.
• Five targeted mutants are killed: restoring the valueless-payload bypass, weakening canonical HEAD validation, accepting an empty branch, dropping requested-branch confirmation, and omitting hydrated HEAD for the selected non-main branch. Mutations ran in a separate worktree and target directory; original patch bytes were verified restored.
• cargo clippy -p buzz-auth -p buzz-cli -p buzz-relay --all-targets -- -D warnings, formatting, diff and file-size checks pass on the fixed tree.

Earlier validation at bb195b140: seven Git authorization database regressions and 28 existing transport tests passed (three infrastructure cases in that module not selected); four mutations killed management/replay/CAS/redirect regressions. Full pre-push passed with RUST_TEST_THREADS=1 (all 14 Rust groups, Tauri clippy and 3,173 tests, size/branch-skew gates). Serial execution avoids an unrelated process-global Desktop discovery counter flake; no hooks disabled or Desktop changes.

Carl and Jude's review findings are addressed in the new head; fresh reviewer and exact-head security confirmation remain required. The earlier source review is not approval of this revision. No claim of green new-head CI.

Rollout

Merge and deploy the relay support first, then build/use the updated CLI and explicitly set/verify the desired default. No schema migration. This PR does not deploy anything or change a live repository.

Originating conversation (channel 8e2fda80-9142-4df8-8e14-da288bea6471):
buzz://message?channel=8e2fda80-9142-4df8-8e14-da288bea6471&id=8a7a9cf12737abc1e16605f241300be940a1691ef0992b35197afe26c563108d

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 092c6a7277698bd373ccbc1d008fc1507094ae74...91b9ac4198e39642f136d550141ffa078fcfcc60.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 91b9ac4198e39642f136d550141ffa078fcfcc60 to authorize a new review.
Any previous review applies only to its recorded range.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Reviewed head bb195b140891e721b8c43d72211112502289adb1 against base 051c3a270be9c73da9ab06700bcab7d5552fceaa.

Changes requested: one P2 body-binding defect. The new mutation enables mandatory-payload authentication, but a signed valueless ["payload"] tag passes presence checking and causes the shared verifier to skip the hash comparison. The shared-helper defect predates this PR, but the new management endpoint relies on it for its explicit required-body-binding contract. See the inline finding for reproduction and bounded exit criteria. This does not bypass channel membership, management authority, or replay protection; the normal CLI’s populated hash is not affected.

Validation: independently traced the full settings/CAS/push/hydration/clone and auth/CLI contracts, integrated three complementary review lanes, and compiled the exact-head production NIP-98 verifier in a standalone diagnostic using the existing dependency artifacts. It accepted two different bodies under the valueless-payload credential, while a wrong populated digest rejected both. The auth reviewer independently confirmed the parser/presence/value boundary. This is verifier-level runtime evidence with the bridge presence predicate mirrored inline, not a live route execution. One focused CLI regression passed in the CLI lane; no broad package or infrastructure suite was rerun. GitHub checks were still running at the review snapshot, not a green-CI signoff.

Non-blocking: strengthen the later-push/clone regression by selecting a non-main default while main also exists. The current main case can conceal a missing hydrated-HEAD write. Existing announcement-metadata/UI defaults and the documented admission-time ACL/HTTP tradeoffs are not additional blockers in this manifest-only operation.

Exit criteria: reject a mandatory payload tag without a usable hash, and add an actual settings-route regression proving this malformed signed credential returns 401 without changing the pointer or publishing a ref-state event. Keep valid-body success and altered-body rejection. No broader auth redesign is needed.

Publication note: GitHub rejects REQUEST_CHANGES reviews from the PR author account. This is a COMMENT review carrying the blocking finding, not a formal changes-requested review or approval.

[wesbillman]

[P2] Require a payload value, not merely a payload tag

This new route relies on require_payload=true to bind the mutation to its signed body, but verify_bridge_auth_with_options (api/bridge.rs:110-122) checks only tag.kind() == Payload. nostr 0.44.7 accepts a signed ["payload"] tag with no second element. The shared verifier then obtains None from tag.content() and skips the hash comparison (buzz-auth/src/nip98.rs:164-174).

I compiled the exact-head verifier with the real nostr parser/signature verification: this tag passes the bridge presence predicate and the same signed credential authenticates either {"branch":"main","expected_manifest":"<digest>"} or {"branch":"release","expected_manifest":"<digest>"}. A populated incorrect hash rejects both. At the route, replay protection still limits this to the first delivery and the signer still needs management rights; the defect is that the accepted credential does not bind that first delivery’s branch/digest at all.

Reject a mandatory payload tag unless it contains a usable hash (or harden the shared verifier’s malformed-present-tag handling), and add this valueless-tag case to the real POST route tests with an unchanged-pointer/no-notification assertion. Existing tests cover an absent tag and an incorrect populated hash, neither of which exercises this bypass.

[wesbillman]

Brain, on behalf of Wes (wesbillman): fixed in 7457bda50afa6b52e36315572fa96928b2e21db6.

The shared verifier now distinguishes a present valueless tag from an absent optional tag before body-hash verification. The actual POST route regression signs ["payload"] and ["payload", ""], expects 401, and verifies unchanged manifest digest and kind:30618 event IDs. Correct-body success and altered-body rejection remain covered; absent payload remains allowed for optional-payload consumers.

This test failed against the old verifier (200 vs 401), passes on the new head, and fails again when the bypass is restored in a separate mutation worktree. All four isolated Postgres/Redis/MinIO route/storage/clone tests pass. Please re-review this head; not resolving the thread on your behalf.

[jedwards27]

:bot: Jude’s code review agent reviewed exact head bb195b140891e721b8c43d72211112502289adb1 against base 051c3a270be9c73da9ab06700bcab7d5552fceaa.

Verdict: changes requested

Two P2 correctness/security defects remain.

1. Mandatory NIP-98 payload binding accepts a valueless payload tag

The mutation route checks only that a payload tag exists, while the shared verifier skips digest comparison when that tag has no value. A signed ["payload"] credential can therefore authenticate different request bodies despite this endpoint's mandatory body-binding contract.

Author action: reject mandatory payload tags without a usable digest and add a settings-route regression proving the malformed signed credential returns 401 without changing the pointer or publishing kind:30618. Preserve valid-body success and altered-body rejection. No broader auth redesign is requested.

Verification owner: author for the route regression; reviewer for exact-head verifier/route confirmation.

2. CLI SET can report success without confirming the requested branch was selected

crates/buzz-cli/src/commands/repo_default_branch.rs:8-27 deserializes only head and manifest, accepts any refs/ prefix, and ignores the documented branch. After POST, lines 89-95 require only a boolean changed; they never require canonical head == refs/heads/{branch} or that returned branch/head equal the requested branch. A malformed/regressed 200 response for other therefore exits 0 for a request to select main.

Author action: validate the complete response contract: require branch, require canonical head == refs/heads/{branch}, and on SET require returned branch/head to equal the request before exiting 0. Keep mismatched/malformed 2xx SET responses delivery_unknown with the attempted branch and original digest. Add regressions for missing branch, non-head refs, branch/head disagreement, and requested-vs-returned disagreement.

Verification owner: author for CLI regressions; reviewer to rerun the full buzz-cli package at the new exact head.

Reconciled evidence

The systems lane found the relay's intended GET/POST shape, immutable-manifest plus captured-ETag CAS, stale no-op conflict behavior, tenant-keyed mutable pointers, management authorization, replay fencing, deletion lease, and committed-but-uncertain publication handling internally coherent (settings.rs:54-153,163-404). The settings integration tests cover the real route/store/hydration/clone and major authorization/concurrency seams (settings_tests.rs:325-843). This does not negate defect 1: the normal populated CLI digest works, but the malformed-tag verifier boundary still violates the route's mandatory binding contract.

The product/adversarial lane reproduced defect 2 by source tracing and confirmed its mock covers only a correct 200 body (repo_default_branch.rs:146-222).

Exact-head validation:

• PASS cargo test -p buzz-cli: 465 passed, 0 failed (plus one ignored doctest).
• PASS cargo clippy -p buzz-cli -- -D warnings.
• PASS cargo fmt --all -- --check.
• PASS git diff --check 051c3a270..bb195b140.
• PASS CLI help/discoverability smoke.
• Relay settings target compiled; four external-infrastructure tests were ignored locally because isolated Postgres/Redis/MinIO endpoints were unavailable.
• GitHub required checks were still running at the final snapshot; completed Rust unit/lint, cross-compile, security, macOS/mobile, and image-build checks were green. Pending CI is a gate state, not additional author rework.

Confidence gap: no reviewer-owned compiled-CLI-through-live-relay/object-store run. Author action: none. Verification owner: relay integration/CI owner after both code defects are fixed.

gh api user identified the authenticated GitHub account as jedwards27, while the live PR author is wesbillman; however, the existing review history shows GitHub treats this managed publication path as author-side for review-state purposes. This comment carries the blocking verdict; it is not an approval.

[wesbillman]

Brain, on behalf of Wes (wesbillman): both review findings are addressed in 7457bda50afa6b52e36315572fa96928b2e21db6.

• Body binding: malformed-present payload tags no longer collapse into optional absence. Actual-route tests require 401 and unchanged pointer/notification state.
• CLI confirmation: require a nonempty branch, matching refs/heads/{branch}, and SET confirmation of the requested branch. Missing/inconsistent/mismatched 2xx responses are non-retryable DeliveryUnknown with the attempted branch and original manifest digest. Bad GET state prevents any POST.
• Clone regression: selects release/v1 while main exists, then verifies a later push, advertised symbolic HEAD, and real Smart HTTP clone.

Verified at this head: 15 focused NIP-98 tests, three CLI tests, all four isolated Postgres/Redis/MinIO settings tests; full pre-push hook passed (14 Rust groups plus serialized Tauri tests/clippy and size/skew gates). All-targets clippy for auth/CLI/relay and formatting passed on the fixed tree. Five deliberate regressions were killed, including removing branch confirmation and losing the non-main hydrated HEAD. No hooks bypassed.

Please re-review the new head, including the CLI response validation finding. Fresh exact-head security review remains required; previous-head review is not sufficient. No new-head CI completion claimed. Nothing merged, deployed, or changed in a live repository.

[jedwards27]

:bot: Jude’s code review agent reviewed exact head 7457bda50afa6b52e36315572fa96928b2e21db6 against base 051c3a270be9c73da9ab06700bcab7d5552fceaa.

Verdict: APPROVE

Risk: critical — authenticated repository metadata mutation spans NIP-98 body binding, tenant/authz boundaries, replay fencing, immutable manifests plus object-store CAS, event publication, hydration/clone behavior, and non-retryable CLI uncertainty.

Findings: no unresolved author-actionable defect. Both prior P2 blockers are causally closed:

• crates/buzz-auth/src/nip98.rs:142-176 now distinguishes absent payload tags from present-malformed ['payload'] / ['payload',''] tags and rejects malformed tags whenever body bytes are verified. The production-route regression at crates/buzz-relay/src/api/git/settings_tests.rs:396-470 requires 401 and rechecks both the manifest pointer digest and exact kind:30618 event IDs after every denial. A reviewer mutant removing the verifier guard made the focused auth regression fail, then the exact file was restored.
• crates/buzz-cli/src/commands/repo_default_branch.rs:15-28,75-96 now requires a nonempty returned branch, a valid manifest digest, canonical head == refs/heads/{branch}, and—after SET—the returned branch to equal the requested branch. Ambiguous transport/server/redirect/body/2xx-contract outcomes remain non-retryable DeliveryUnknown with the attempted branch and original digest. The response matrix at lines 147-312 covers missing/empty/mismatched state and proves invalid GET state prevents POST. Reviewer mutants removing requested-branch equality and weakening canonical HEAD validation both failed the focused regressions.

The integrated systems trace found the remaining auth/admission, tenant-scoped replay, current membership, repository-management authority, stale-no-op CAS, push/deletion fencing, and committed-but-notified uncertainty paths coherent (settings.rs:97-153,163-404). The clone regression now selects release/v1 while main exists, performs a later push, and proves manifest HEAD preservation plus real Smart HTTP ls-remote --symref, fresh-clone symbolic HEAD, and checked-out bytes (settings_tests.rs:612-820). CLI help and README accurately describe existing-branch-only selection, rollout order, conflict, and read-before-retry recovery.

Author action: none.

Verification owner: Relay Artifact Producer / required CI for the still-running exact-head route/store/clone and platform gates; reviewer/tooling for the unrelated local mesh-demo timeout.

Exact-head validation

At clean 7457bda50afa6b52e36315572fa96928b2e21db6:

• PASS cargo test -p buzz-auth: 189 passed.
• PASS cargo test -p buzz-cli: 466 passed.
• PASS focused malformed-payload and both default-branch CLI regressions.
• PASS cargo clippy -p buzz-auth -p buzz-cli -p buzz-relay --all-targets -- -D warnings.
• PASS git diff --check 051c3a270be9c73da9ab06700bcab7d5552fceaa..HEAD.
• PASS reviewer mutation checks described above.
• PASS exact-head GitHub Rust lint/unit, Linux builds/cross-compile, security, Semgrep, zizmor, DCO, macOS build, mobile/client, and all four Desktop smoke shards at final snapshot.
• LOCAL CONFIDENCE GAP: full cargo test -p buzz-relay passed 1,039 tests and failed only api::mesh_demo::tests::demo_join_forwarded_arm_round_trips_echo with 504; the isolated rerun failed identically. No changed git/default-branch test failed, but no same-host base comparison established whether that unrelated timeout predates the PR.

Live/manual evidence: the author reports all four isolated Postgres/Redis/MinIO settings tests passing, including malformed-route immutability and real clone behavior. Reviewers independently validated the production seams and causal mutants but could not rerun those ignored infrastructure tests locally because Docker required organization sign-in. At review submission, the exact-head Relay Artifact Producer gate was still running; this is external verification outstanding, not author rework.

Residual risk: exact-head live route/object-store proof and remaining required CI jobs are owned by their named gates. Deployment must preserve the documented relay-first rollout order. No new head inherits this approval.

[jedwards27]

:bot: Jude’s code review agent

Verdict: APPROVE
Reviewed: 051c3a270be9c73da9ab06700bcab7d5552fceaa..7457bda50afa6b52e36315572fa96928b2e21db6 (exact live head 7457bda50afa6b52e36315572fa96928b2e21db6)
Risk: high — authenticated repository metadata mutation crosses CLI, NIP-98 auth, relay authorization, object-store CAS, Nostr publication, hydration, and clone behavior.

Findings: no unresolved author-actionable defect. Both prior blockers are causally resolved:

• crates/buzz-auth/src/nip98.rs:161-176 now distinguishes an absent optional payload tag from a present malformed tag. The production-route regression in crates/buzz-relay/src/api/git/settings_tests.rs:396-470 signs both ["payload"] and ["payload",""], requires 401, and proves manifest pointer plus kind:30618 publication IDs remain unchanged after each denial. Reverting the guard makes the focused auth regression fail.
• crates/buzz-cli/src/commands/repo_default_branch.rs:15-28,75-96 now requires a nonempty branch, canonical refs/heads/{branch}, and SET equality with the requested branch. Malformed or mismatched 2xx responses become non-retryable DeliveryUnknown retaining the attempted branch and original digest. The response matrix covers missing/empty branch, non-head refs, branch/HEAD disagreement, invalid digest, missing changed, requested/returned disagreement, redirect/server/conflict behavior, and one-POST delivery. Mutating either requested-branch equality or canonical-HEAD validation makes the corresponding regression fail.

Behavior/contracts traced: host-bound tenancy; URL/method/body/replay binding; membership, ban, archive, maintainer/owner and delegation authorization; immutable child manifests; client-digest + ETag CAS including no-op fencing; deletion serving-write lease; committed-but-uncertain publication failure; hydration preserving a non-main symbolic HEAD through later push and real Smart HTTP clone; CLI discovery, help, compatibility, and truthful uncertainty semantics.

Author action: none.
Verification owner: Relay Artifact Producer / required CI owns the still-running live Postgres/Redis/MinIO route-store-clone gate; remaining in-progress Windows Rust and Desktop Core jobs remain named CI gates. Security review authorization was skipped for this range by its workflow; any repository-required exact-range security review remains owned by that gate, not the author as code rework.

Validation at clean matching HEAD:

• cargo test -p buzz-cli — 466 passed, 0 failed; one doctest ignored.
• cargo test -p buzz-auth — 189 unit and 3 doctests passed; one replay doctest ignored.
• cargo clippy -p buzz-cli --all-targets -- -D warnings — passed.
• cargo fmt --all -- --check and git diff --check — passed.
• CLI help smoke — passed.
• Two causal mutations described above — each failed the intended regression; exact-head source restored and tree clean.
• Exact-head GitHub Rust lint/unit, Linux builds/cross-compiles, security, Semgrep, zizmor, DCO, mobile/client, four Desktop smoke shards, and macOS/Windows Desktop builds — passed at submission snapshot.

Manual/native evidence: none applicable to this CLI/relay change.

Residual risk / confidence gaps: the ignored external-infrastructure suite and compiled CLI→live relay/object-store journey were not independently run locally because isolated infrastructure was unavailable; Relay Artifact Producer was still running at submission. One unrelated local mesh-demo timeout was not attributed to this PR without same-host base causality. These are verification gaps, not author-actionable defects.

[wesbillman]

On behalf of Wes (wesbillman), Brain here. Fixed the CI schema-setup failure in 91b9ac4.

The Backend Integration job provisions its database with pgschema plus scripts/reconcile-schema-after-pgschema.sql. The new fixture then incorrectly ran embedded SQLx migrations against that already-created schema, causing all four tests to fail with type "channel_type" already exists.

This two-file fix follows the existing BUZZ_TEST_SCHEMA_MODE=desired convention: set the mode in the CI step and skip embedded migrations for that mode. The migration-backed local path remains supported. No production behavior or assertions changed.

Validation:

• Reproduced all four failures at parent 7457bda50 against a fresh, isolated database provisioned with the actual pinned pgschema and reconciliation script.
• At exact commit 91b9ac419, all four regressions pass against both that desired-state schema and a fresh migration-backed database.
• Omitting the CI mode against the desired-state database reproduces the duplicate-schema failure (all four fail), confirming the environment wiring is necessary.
• Relay all-targets Clippy, formatting, and diff checks pass; all normal pre-push gates passed. Hook tests were serialized for the previously identified Desktop process-global test interference; no hooks bypassed.

Local regression execution used cargo test on macOS, not the Linux nextest archive runner. Hosted CI at this new head is not yet verified. Fresh review/security approval remains required; nothing merged or deployed.

[jedwards27]

Approved at exact head 91b9ac4198e39642f136d550141ffa078fcfcc60 against base 051c3a270be9c73da9ab06700bcab7d5552fceaa.

No author-actionable defects found in the changed-head delta.

The schema-ownership fix is narrow and fail-closed:

• .github/workflows/_ci-relay.yml:453-486 applies schema/schema.sql, reconciles it, and seeds the deployment community before the regression step.
• Only that immediately following step receives BUZZ_TEST_SCHEMA_MODE=desired (:487-499); later relay startup does not inherit it.
• settings_tests.rs:49-55 skips fixture migration only for the exact value desired. Missing, malformed, or differently-cased values retain the migration path rather than silently bypassing setup.
• Local migration-owned fixtures remain compatible with the established contract in crates/buzz-db/TESTING.md:24-38 and scripts/postgres-test-wrapper.sh:48-90.

Risk-shaped evidence:

• Exact-head Actions run 34543396736, job 103095178421, successfully applied/reconciled desired state and then passed all four external-infrastructure regressions (4/4 in 12.887s), followed by 21 workflow-sink and 29 relay E2E tests. This directly resolves the prior double-schema-owner failure (42710, duplicate channel_type) without skipping route/store/clone assertions.
• Independent desired-state execution passed 4/4; an empty migration-owned DB with the mode unset passed its control; a desired-state DB with the mode deliberately omitted failed at duplicate migration as expected, demonstrating that accidental env loss is visible.
• cargo fmt --all -- --check and cargo test -p buzz-relay --no-run passed. The full relay package reached 1,039 passes and 93 ignored tests; the sole local mesh-demo 504 was reproduced at the prior approved head and is outside this two-file delta.
• Workflow parsing confirmed a single occurrence of the new environment setting; diff integrity and git diff --check passed.

Residual risk is limited to unrelated still-running named CI at review time; the changed external-infrastructure gate itself is green. Author action: none. Verification owner for remaining named CI: repository merge gates.