Relay: enforce control-plane collaboration authority

[100yenadmin]

Summary

• add a per-community native / control_plane collaboration policy, defaulting existing and newly provisioned communities to native
• resolve the control identity from the current sole relay owner for the exact host-bound community
• gate channel creation/lifecycle/visibility and channel/DM membership mutations before storage or side effects
• preserve ordinary messages, threads, reactions, own-message edits/deletes, and personal DM hide behavior
• rotate authority through the existing atomic relay-owner transfer path
• serialize controlled mutations with owner and policy changes while keeping the writer pool available

Security properties

• policy and control identity come only from durable server state; client tags cannot select either
• a control-plane community with no sole current owner fails closed
• open-channel self-join and signed NIP-29/DM command bypasses are covered
• the current owner can reconcile membership after rotation without depending on a stale channel role
• native-only audio huddle automation is disabled under control_plane
• provisioning applies host, owner, and supplied policy atomically
• a dedicated bounded authority pool prevents guarded requests from exhausting the mutation pool
• cross-community authority is scoped by the server-resolved community UUID

Validation

• cargo test -p buzz-relay collaboration_policy --lib
• cargo test -p buzz-relay automatic_huddle_membership_and_archive_are_native_only --lib
• cargo test -p buzz-relay community_provisioning --lib
• cargo test -p buzz-db --lib (82 passed, 122 Postgres tests ignored by the repository)
• cargo test -p buzz-db embedded_migrator_contains_consolidated_initial_schema --lib
• cargo check -p buzz-db -p buzz-relay --lib
• cargo clippy -p buzz-db -p buzz-relay --lib -- -D warnings
• cargo fmt --all -- --check
• canonical GitHub CI on the exact pushed head, including the Postgres integration test

Review

• independent semantic review covered the collaboration-policy security lane
• initial findings: two P1 and two realistic P2, all fixed now
• delta finding: one realistic P2 authority-pool exhaustion risk, fixed now
• final targeted delta at 758e8691dc9da4545ffbc2ee75a24757786c953d: clean

Closes #15

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 95b1050c-17d6-417a-bf11-73ee4993d64c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/15-control-plane-channel-policy

---

_{Comment @coderabbitai help to get the list of available commands.}

[100yenadmin]

This pre-reset staging PR is closed as superseded by merged upstream-first reset PR #37 and the current thin-adapter tracker #1/#36.

No code is being deleted. The branch and review history remain available. Retained behavior was replayed narrowly in #37; dropped managed brokers, blanket guards, duplicate UI, and control-signed routine collaboration must not be revived from this PR.