revert: back out PR #16 — upstream-owned paths off fork main (FORK.md) by jeremylongshore · Pull Request #18 · intent-solutions-io/buzz

jeremylongshore · 2026-08-04T05:50:36Z

What

Reverts the #16 squash (71ad4571c) — restores all 14 upstream-owned paths (relay crates, desktop, all four upstream workflows, both lockfiles) to their pre-#16 upstream state. Plain git revert; no force-push, no history rewrite.

Why + decision rationale

FORK.md: this fork is additive-only — "a dressing commit that touches an upstream path is a defect." #16 merged a good fix into the wrong lane. Chose revert-then-recontribute over carrying the patch (CARRIED_PATCHES) because the owner's direction is to not customize Buzz while Block is actively developing it; the fix goes upstream via the contribution system instead.

Layer touched

Fork main tracking surface only. The fix's content is preserved on fix/community-member-onboarding (source material for the upstream contribution).

How it works / verified — evidence

Gate run on this branch:

check-additive-only.sh: violations drop 16 → 2; the remaining 2 (.harness-hash*) are a pre-existing allowlist/contract mismatch, fixed by the follow-up sync PR.
check-must-survive.sh: PASS 10/10.
git diff origin/main --name-only = exactly the 14 breach paths, nothing else.

Risk assessment

Low. Nothing in production runs fork-built relay code (relay is on the upstream digest-pinned image); the reverted feature was never deployed. Onboarding interim remains the manual backfill runbook (proven on two members).

Rollback

git revert of this commit restores #16's content (not that we want it).

Follow-up

Sync PR: land fix/fork-upstream-sync-20260803 (upstream sync + gate-allowlist fix). 2. Upstream contribution via the /contribute lane. 3. Fork gates → required CI check.

Governance links

Audit record: 000-docs/007-AA-AUDR-fork-contract-breach-2026-08-03.md (PR #17). Refs #16.

…al (#16)" This reverts commit 71ad457. Signed-off-by: jeremylongshore <jeremylongshore@users.noreply.github.com>

coderabbitai · 2026-08-04T05:50:46Z

Warning

Review limit reached

@jeremylongshore, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 59 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: eb181971-cdc8-4c26-9703-94e699adf11f

📥 Commits

Reviewing files that changed from the base of the PR and between 71ad457 and 9d73d27.

⛔ Files ignored due to path filters (2)

Cargo.lock is excluded by !**/*.lock
desktop/src-tauri/Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (12)

.github/workflows/ci.yml
.github/workflows/docker.yml
.github/workflows/release.yml
.github/workflows/signed-macos-canary.yml
crates/buzz-relay/src/api/invites.rs
crates/buzz-relay/src/handlers/side_effects.rs
desktop/src-tauri/src/commands/channels.rs
desktop/src-tauri/src/commands/channels_tests.rs
desktop/src/features/onboarding/welcome.test.mjs
desktop/src/features/onboarding/welcome.ts
desktop/src/features/settings/ui/SettingsPanels.tsx
desktop/tests/e2e/invites-settings-screenshots.spec.ts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

kilo-code-bot · 2026-08-04T05:51:27Z

Code Review Summary

The review did not run because the selected model is no longer available.

Choose another model in Kilo Code review settings: https://app.kilo.ai/code-reviews

…gest truncation, split executed vs planned What: three fixes to the breach audit from PR #17 review. (1) The divergence reproduction command now uses pinned object IDs (631b05c...71ad457) instead of mutable branch refs, so later runs reproduce the recorded 73-path result. (2) The truncated relay-image digest is now explicitly declared deliberate (public fork; full deployment evidence lives in the private ops lane). (3) Section 6 is retitled a remediation PLAN with per-step PR references (#18 revert, #19 sync), separating filed-before-completion planning from completion evidence. Why: an audit record must be reproducible and honest about what was done vs planned at filing time; CodeRabbit's Major finding was exactly that executed/planned conflation. How verified: re-read against the three review threads; each finding has a matching hunk; no content outside section 2 intro, section 4 bullet 1, and section 6 changed. Signed-off-by: jeremylongshore <jeremylongshore@users.noreply.github.com>

jeremylongshore · 2026-08-04T06:07:09Z

Pre-merge check triage (no required checks on this repo yet — that is what the follow-up enforcement PR fixes)

Security → Dependency policy FAIL: expected and transient. The revert restores the pre-fix(onboarding): auto-join invited members to General #16 lockfiles byte-identical, which predate upstream's RUSTSEC-2026-0225..0232 fixes (upstream 318fbf896 / fix(security): bump nostr crates for RUSTSEC-2026-0225..0232 + default sprig image to published digest block/buzz#4392). The very next PR (chore(fork): sync upstream main (117 commits) + fix gate allowlist for pinned harness files #19) merges those upstream fixes in; this failure is a property of the pre-breach baseline, not of the revert.
Build public push gateway (amd64/arm64) FAIL: structural for any org fork. cache-to is hardcoded to ghcr.io/block/buzz-push-gateway-buildcache, which a fork's GITHUB_TOKEN cannot write (permission_denied: The requested installation does not exist). The revert restored upstream's workflow per the additive-only contract; the fix is routed upstream via the contribution lane, not carried here. We deploy upstream published images — fork-built images are unused by design.
Kilo Code Review FAIL: bot misconfiguration ("selected model is no longer available") on every PR in this repo — needs a model re-selection in Kilo settings; not a code signal.
CodeRabbit was rate-limited for this PR; the diff is mechanical git revert output of 71ad4571c with zero authored content.

Merging on this basis per the remediation plan in 000-docs/007-AA-AUDR-fork-contract-breach-2026-08-03.md §6.

Jeremy Longshore
intentsolutions.io

* docs(audit): file the 2026-08-03 fork-contract breach audit record What: adds 000-docs/007-AA-AUDR-fork-contract-breach-2026-08-03.md and its index row. The record inventories all 73 divergent paths of fork main (71ad457) vs upstream/main (631b05c), classifying 57 as allowlisted additive surface, 14 as PR #16 contract violations (relay crates, desktop, all four upstream workflows, both lockfiles), and 2 (.harness-hash*) as a pre-existing allowlist/contract mismatch. Why: FORK.md declares this fork additive-only; PR #16 breached that. The causal chain (fork gates wired only in local lefthook, never a required CI check) and the no-damage findings (prod relay on the upstream digest-pinned image, nothing pushed upstream) need a durable record before the revert and enforcement work lands. Chose a standalone dated audit doc over folding the narrative into the revert PR body because 000-docs is the fork's declared record lane and PR bodies don't index. How verified: divergence list reproduced from git diff upstream/main... origin/main --name-status; the 14-path violation set confirmed equal to the PR #16 squash diff; gate run on a detached worktree at 71ad457 reproduced FAIL/16 + must-survive PASS as recorded. Signed-off-by: jeremylongshore <jeremylongshore@users.noreply.github.com> * docs(audit): address CodeRabbit findings — pin repro refs, justify digest truncation, split executed vs planned What: three fixes to the breach audit from PR #17 review. (1) The divergence reproduction command now uses pinned object IDs (631b05c...71ad457) instead of mutable branch refs, so later runs reproduce the recorded 73-path result. (2) The truncated relay-image digest is now explicitly declared deliberate (public fork; full deployment evidence lives in the private ops lane). (3) Section 6 is retitled a remediation PLAN with per-step PR references (#18 revert, #19 sync), separating filed-before-completion planning from completion evidence. Why: an audit record must be reproducible and honest about what was done vs planned at filing time; CodeRabbit's Major finding was exactly that executed/planned conflation. How verified: re-read against the three review threads; each finding has a matching hunk; no content outside section 2 intro, section 4 bullet 1, and section 6 changed. Signed-off-by: jeremylongshore <jeremylongshore@users.noreply.github.com> --------- Signed-off-by: jeremylongshore <jeremylongshore@users.noreply.github.com> Co-authored-by: jeremylongshore <jeremylongshore@users.noreply.github.com>

Revert "fix(onboarding): auto-join invited members to canonical Gener…

9d73d27

…al (#16)" This reverts commit 71ad457. Signed-off-by: jeremylongshore <jeremylongshore@users.noreply.github.com>

jeremylongshore mentioned this pull request Aug 4, 2026

chore(fork): sync upstream main (117 commits) + fix gate allowlist for pinned harness files #19

Merged

jeremylongshore merged commit b6152e0 into main Aug 4, 2026
27 of 31 checks passed

jeremylongshore deleted the revert/pr-16-fork-contract branch August 4, 2026 06:20

Navigation Menu

Uh oh!

revert: back out PR #16 — upstream-owned paths off fork main (FORK.md) - #18

revert: back out PR #16 — upstream-owned paths off fork main (FORK.md)#18
jeremylongshore merged 1 commit into
mainfrom
revert/pr-16-fork-contract

jeremylongshore commented Aug 4, 2026

Uh oh!

coderabbitai Bot commented Aug 4, 2026

Review limit reached

Uh oh!

kilo-code-bot Bot commented Aug 4, 2026

Uh oh!

jeremylongshore commented Aug 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

jeremylongshore commented Aug 4, 2026

What

Why + decision rationale

Layer touched

How it works / verified — evidence

Risk assessment

Rollback

Follow-up

Governance links

Uh oh!

coderabbitai Bot commented Aug 4, 2026

Review limit reached

Uh oh!

kilo-code-bot Bot commented Aug 4, 2026

Code Review Summary

Uh oh!

jeremylongshore commented Aug 4, 2026

Pre-merge check triage (no required checks on this repo yet — that is what the follow-up enforcement PR fixes)

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant