chore(fork): sync upstream main (117 commits) + fix gate allowlist for pinned harness files

.beads/interactions.jsonl

@@ -13,3 +13,24 @@
 {"id":"int-a2361c4964a752d958cfc5fbb69bd077","kind":"field_change","created_at":"2026-07-29T21:16:21.533526502Z","actor":"jeremylongshore","issue_id":"buzz-ocv.5","extra":{"field":"status","new_value":"in_progress","old_value":"open"}}
 {"id":"int-4ee4835e436c4b7b6a00d0501b8b071c","kind":"field_change","created_at":"2026-07-30T04:47:01.972398591Z","actor":"jeremylongshore","issue_id":"buzz-ocv.6","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"DONE 2026-07-30. Mobile pairing sidecar deployed to prod + a REAL device paired (owner-confirmed handshake). Root cause: pinned relay-v0.2.0 image lacks buzz-pair-relay; fix pins the sidecar SEPARATELY via BUZZ_PAIR_RELAY_IMAGE (:main @9de8aff1) + absolute entrypoint, deployed sidecar-first (relay untouched), Caddy /pair route added. Verified wss://buzz-prod.intentsolutions.io/pair -> 101 Switching Protocols (Caddy->sidecar); sidecar logs show the live paired connection. intent-os PR #291 (overlay + test image-guard + runbook; 4/4 CI green). pairing-overlay-test now guards the image bug (5/5)."}}
 {"id":"int-ecdd102b39c09f97150839220f0b0d34","kind":"field_change","created_at":"2026-07-30T04:47:05.19034745Z","actor":"jeremylongshore","issue_id":"buzz-ocv.5","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"DONE 2026-07-30. Tauri desktop CORS origins (tauri://localhost + http://tauri.localhost) composed into version-controlled compose (intent-os PR #283), applied live to both hosts (PR #284), cors-config-test 2/2 in ci:drills. Final owner-gated gate met: Jeremy joined from the PACKAGED Linux desktop client to buzz-prod.intentsolutions.io (connected, admin, channels visible) — the packaged-client CORS verification the acceptance required."}}
+{"id":"int-9d63f6e48fc6157929c47a230eede39a","kind":"field_change","created_at":"2026-07-30T05:45:53.661302817Z","actor":"jeremylongshore","issue_id":"buzz-ocv.2","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"DONE 2026-07-30 (ultracode Track-A workflow). Compensating edge controls shipped + applied. CODE: ops/buzz/scripts/apply-edge-controls.sh (plan-only default, --apply to install) + hermetic test, merged intent-os PR #292 (4/4 estate-CI green, adversarially verified sound). APPLIED LIVE on the dedicated prod host intent-ops-buzz: fail2ban 'caddy-buzz' jail (bans public 4xx-flooders from /var/log/caddy/buzz-access.log) + nftables 'inet buzz_edge' connlimit (128 concurrent NEW/IP on tcp 80+443 only) + buzz-edge-nft.service enabled (reboot-safe). VERIFIED no self-lock: SSH intact, relay _readiness 200 off-box, tailnet/port-22 never touched (WS/established never dropped). SCOPING: applied to the Buzz-DEDICATED prod host only; deliberately NOT applied host-wide on the shared VPS staging (its connlimit would rate-limit co-tenant estate stacks Plane/ERP/CRM) — request_body caps + security headers already exist in Caddy on both. Closes the last non-owner-gated piece of go-live edge hardening."}}
+{"id":"int-d1b3bcb9725ff332970aacd020a3a368","kind":"field_change","created_at":"2026-07-30T05:54:52.463260258Z","actor":"jeremylongshore","issue_id":"buzz-bsy","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"DONE 2026-07-30 (ultracode Track-A workflow). Built ops/buzz/scripts/restore.sh — the real destructive three-store restore (Postgres pg_restore --clean --if-exists → media mc mirror --overwrite → git volume), gated behind --in-place with verify-before-destroy (sha256 every artifact + PGDMP header + manifest.env==--env cross-check; exit 2 writes nothing). Chose --in-place-required over auto-restore so decision-log/038's human-gate holds with ZERO updater.sh changes: the updater's flagless call exits 64 → rc5 page unchanged (updater-drill 6/6 still green). Hermetic restore-test.sh 6/6 with mutation-proven teeth; restore-drill-test 4/4 no regression; wired into ci:drills. Merged intent-os PR #293 (4/4 estate-CI green). Remaining real-tool proof = a host-side scratch-stack drill before first prod use (noted in runbook)."}}
+{"id":"int-be2173d658fc095081a9083e49d64528","kind":"field_change","created_at":"2026-07-30T07:17:44.135065314Z","actor":"jeremylongshore","issue_id":"buzz-nry.2","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"DONE 2026-07-30. Production deployed from proven staging artifacts with FRESH secrets on the dedicated host intent-ops-buzz, serving buzz-prod.intentsolutions.io (169.58.95.32). The 'cut DNS over' (apex → buzz.) requirement is DROPPED by owner decision 2026-07-30: buzz-prod.intentsolutions.io is the PERMANENT production URL (no apex cutover). Prod DNS is therefore already on its permanent, correct name — nothing further to cut over."}}
+{"id":"int-f42f74288896136765cfddee4c2de26e","kind":"field_change","created_at":"2026-07-30T07:17:46.752322494Z","actor":"jeremylongshore","issue_id":"buzz-nry.3","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"DONE 2026-07-30. Full go-live gate suite PASSED against prod (buzz-prod.intentsolutions.io): smoke 200/NIP-11/functional PASS; unauth-matrix 6/6 REJECT; functional-probe (member NIP-42 auth+publish+readback, un-invited refused) with cleanup CONFIRMED (baseline count 3). Was dependency-blocked by buzz-nry.2 (apex cutover) — that dependency is resolved by the owner decision to keep buzz-prod permanent, so this now closes with its already-captured green evidence."}}
+{"id":"int-67f8b7a8627b3a18e0b7b5d935a2d3c1","kind":"field_change","created_at":"2026-07-30T07:18:01.27822535Z","actor":"jeremylongshore","issue_id":"buzz-nry","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"EPIC DONE 2026-07-30. Dedicated Buzz production VPS (intent-ops-buzz, 169.58.95.32) stood up to estate conventions (.1), deployed with fresh secrets serving buzz-prod.intentsolutions.io (.2), and the full go-live gate suite passed against it (.3). Owner decision 2026-07-30: buzz-prod.intentsolutions.io is the PERMANENT production URL — the 'cut the prod domain over' (apex) part of this epic is intentionally NOT done and is retired, not deferred. All three children closed."}}
+{"id":"int-7879443495ecbf89b4dc0db155eeab9d","kind":"field_change","created_at":"2026-07-31T03:30:31.615907433Z","actor":"jeremylongshore","issue_id":"buzz-yfe.1","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"source-code reference written to ops/buzz/reference/BUZZ-SYSTEM-REFERENCE.md (45KB, file:line cited, from 8-agent sourcing workflow)"}}
+{"id":"int-5068eed2df8e022fc89b5a792782fd39","kind":"field_change","created_at":"2026-07-31T03:30:33.412199224Z","actor":"jeremylongshore","issue_id":"buzz-yfe.2","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"estate-deployment reference written to ops/buzz/reference/BUZZ-ESTATE-DEPLOYMENT-REFERENCE.md (source-cited)"}}
+{"id":"int-a7c6e307556516f672455c69f544d886","kind":"field_change","created_at":"2026-07-31T03:30:34.984414889Z","actor":"jeremylongshore","issue_id":"buzz-w92.1","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"AI Wire feed bot minted (8189ba10), relay member, joined ai-wire+0-general, first cards posted accepted:true 2026-07-31"}}
+{"id":"int-ddb9fd8ab1b2e550f95a215b3bfc16e0","kind":"field_change","created_at":"2026-07-31T03:36:16.562161598Z","actor":"jeremylongshore","issue_id":"buzz-yfe.3","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"buzz-ops skill built (.claude/skills/buzz-ops/ with 3 bundled references); PASS /validate-skillmd standard tier"}}
+{"id":"int-f5404dea1362f4e691fb6edda3e17b7d","kind":"field_change","created_at":"2026-07-31T03:36:18.134646786Z","actor":"jeremylongshore","issue_id":"buzz-yfe.4","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"buzz-ops agent built + PASS /validate-agent (14-field standalone spec)"}}
+{"id":"int-85fdaa9e88769d07584be2fb1e04cf42","kind":"field_change","created_at":"2026-07-31T03:36:19.601340573Z","actor":"jeremylongshore","issue_id":"buzz-yfe.5","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"buzz-feed-curator agent built + PASS /validate-agent"}}
+{"id":"int-8850efaef9cdedb9badb537fc62935ba","kind":"field_change","created_at":"2026-07-31T03:36:21.08100149Z","actor":"jeremylongshore","issue_id":"buzz-yfe.6","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"buzz-relay-admin agent built + PASS /validate-agent"}}
+{"id":"int-4260303d729ddb42abd839cb31f38f27","kind":"field_change","created_at":"2026-07-31T03:36:22.349391594Z","actor":"jeremylongshore","issue_id":"buzz-yfe.7","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"all 3 agents PASS /validate-agent; skill PASS /validate-skillmd; reference-vs-code consistency 106 citations 100% resolve to real fork source (no fabrications)"}}
+{"id":"int-f0b734dccd26f403f2e9576181b68a3f","kind":"field_change","created_at":"2026-07-31T03:37:20.957039522Z","actor":"jeremylongshore","issue_id":"buzz-yfe","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"All 7 children closed: 2 references + skill + 3 agents + validation; all PASS the IS validators"}}
+{"id":"int-630ab91f0cf7e0e25edae67f26073244","kind":"field_change","created_at":"2026-07-31T04:06:15.368820216Z","actor":"jeremylongshore","issue_id":"buzz-w92.2","extra":{"field":"status","new_value":"in_progress","old_value":"open"}}
+{"id":"int-cca6517e1c6ee0187914938b7edd0144","kind":"field_change","created_at":"2026-07-31T04:18:38.265063552Z","actor":"jeremylongshore","issue_id":"buzz-w92.2","extra":{"field":"status","new_value":"closed","old_value":"in_progress","reason":"pipeline built + hardened (fetch→dedupe(newest-25)→Groq/NVIDIA summary→card), rate-limit fallback chain, ops/buzz/wire/buzz-wire.py"}}
+{"id":"int-78e02ffa7530bcd16898d0cbbffeec34","kind":"field_change","created_at":"2026-07-31T04:18:40.136787487Z","actor":"jeremylongshore","issue_id":"buzz-w92.3","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"easy-tier feeds live — OpenAI, HuggingFace, arXiv cs.AI, Google DeepMind; 4 seed cards posted with summaries"}}
+{"id":"int-ca89c97ced65361b3070b31df6bec542","kind":"field_change","created_at":"2026-07-31T04:18:41.731887559Z","actor":"jeremylongshore","issue_id":"buzz-w92.8","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"3h cron deployed (~/bin/buzz-wire-cron.sh) + notify-lib liveness + registered in automations.md"}}
+{"id":"int-e4c1bfdb34ec5b768b2fe150c50071fc","kind":"field_change","created_at":"2026-07-31T04:30:55.252637052Z","actor":"jeremylongshore","issue_id":"buzz-w92.7","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Daily ai-wire digest live — --digest composes cross-lab roundup (70b→8b→NVIDIA), posts to 1-ai-wire, cron 06:30 CT"}}
+{"id":"int-873d15b79debfd144c2a44cbd6113969","kind":"field_change","created_at":"2026-07-31T14:04:52.409666792Z","actor":"jeremylongshore","issue_id":"buzz-w92.4","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Anthropic bridged via HTML-scrape source type (news/research/engineering -> anthropic-blogs/research), mirroring the estate monitors; Mistral added. buzz-w92.6 partially done (tooling/mcp/newsletters/ships/status live)."}}
+{"id":"int-b6dc6f4abc00f98eb2fa156977ef6406","kind":"field_change","created_at":"2026-07-31T15:35:29.315597343Z","actor":"jeremylongshore","issue_id":"buzz-w92.5","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Filled groq/meta/mistral/cohere/perplexity/xai + cleaner anthropic via Olshansk RSS mirrors (from perception repo) — no RSSHub needed. Remaining empty (deepseek/qwen/moonshot/minimax/benchmarks/funding/openrouter) have no mirror."}}