diff --git a/.beads/interactions.jsonl b/.beads/interactions.jsonl index 57193fabf3b..fe0daeb4615 100644 --- a/.beads/interactions.jsonl +++ b/.beads/interactions.jsonl @@ -34,3 +34,6 @@ {"id":"int-e4c1bfdb34ec5b768b2fe150c50071fc","kind":"field_change","created_at":"2026-07-31T04:30:55.252637052Z","actor":"jeremylongshore","issue_id":"buzz-w92.7","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Daily ai-wire digest live — --digest composes cross-lab roundup (70b→8b→NVIDIA), posts to 1-ai-wire, cron 06:30 CT"}} {"id":"int-873d15b79debfd144c2a44cbd6113969","kind":"field_change","created_at":"2026-07-31T14:04:52.409666792Z","actor":"jeremylongshore","issue_id":"buzz-w92.4","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Anthropic bridged via HTML-scrape source type (news/research/engineering -> anthropic-blogs/research), mirroring the estate monitors; Mistral added. buzz-w92.6 partially done (tooling/mcp/newsletters/ships/status live)."}} {"id":"int-b6dc6f4abc00f98eb2fa156977ef6406","kind":"field_change","created_at":"2026-07-31T15:35:29.315597343Z","actor":"jeremylongshore","issue_id":"buzz-w92.5","extra":{"field":"status","new_value":"closed","old_value":"open","reason":"Filled groq/meta/mistral/cohere/perplexity/xai + cleaner anthropic via Olshansk RSS mirrors (from perception repo) — no RSSHub needed. Remaining empty (deepseek/qwen/moonshot/minimax/benchmarks/funding/openrouter) have no mirror."}} +{"id":"int-9071650b4885f3841b78178fbb323e5c","kind":"field_change","created_at":"2026-08-07T22:52:18.89127817Z","actor":"jeremylongshore","issue_id":"buzz-v2p","extra":{"field":"status","new_value":"in_progress","old_value":"open"}} +{"id":"int-a5479c82c5d9c3c7da53d4baf4bb8f08","kind":"field_change","created_at":"2026-08-11T19:49:36.533530195Z","actor":"jeremylongshore","issue_id":"buzz-2i6","extra":{"field":"status","new_value":"in_progress","old_value":"open"}} +{"id":"int-9c727b473c1d75965374aa86d3810db0","kind":"field_change","created_at":"2026-08-11T20:37:16.384829305Z","actor":"jeremylongshore","issue_id":"buzz-2i6","extra":{"field":"status","new_value":"open","old_value":"in_progress"}} diff --git a/.beads/issues.jsonl b/.beads/issues.jsonl index 6d9e25ee84d..d8011cb3f5e 100644 --- a/.beads/issues.jsonl +++ b/.beads/issues.jsonl @@ -1,3 +1,4 @@ +{"_type":"issue","id":"buzz-2i6.1","title":"Document that the updater's store-restore step pages by design, because the log line reads like a defect","description":"CORRECTED after checking the source rather than trusting the log line. The drill on 2026-08-11 emitted 'STORE-RESTORE FAILED after revert - MANUAL recovery required' and I first read that as a broken rollback. It is not. restore.sh refuses a live restore without --in-place because a destructive database rollback is deliberately human-gated per decision-log/038; the updater calls it without that flag, so it ALWAYS declines and pages. That is the intended design: an unattended weekly job must not silently roll a production database back.\n\nWhat the drill actually proved, end to end: a persistent smoke failure on the newly promoted digest (defeating the 3-attempt retry) reverts the image to the known-good digest, re-runs the REAL functional probe against the reverted relay, passes it, latches HOLD so nothing promotes again until a human looks, and pages for the store side. That is a complete and correct safety story.\n\nThe remaining work is wording, not mechanism: 'STORE-RESTORE FAILED' reads as a malfunction to whoever gets paged at 05:30 on a Sunday, and it will send them hunting for a bug that does not exist. Reword to something like 'store restore is human-gated (decision-log/038) - image reverted and verified; DB rollback needs a human with --in-place if the promotion migrated schema.' Also worth stating in RUNBOOK-wrapped-updater.md so the pager has the context.","status":"open","priority":1,"issue_type":"bug","owner":"jeremylongshore@users.noreply.github.com","created_at":"2026-08-11T21:37:22Z","created_by":"jeremylongshore","updated_at":"2026-08-11T21:37:52Z","labels":["go-live","probe","updater"],"dependencies":[{"issue_id":"buzz-2i6.1","depends_on_id":"buzz-2i6","type":"parent-child","created_at":"2026-08-11T15:37:21Z","created_by":"jeremylongshore","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0} {"_type":"issue","id":"buzz-20l.6","title":"Add the Claude impl-agent identity as a second buzz-acp process that authors PRs from goose-filed issues only","description":"Second buzz-acp process: Claude (claude-agent-acp), PermissionMode acceptEdits, PR-scoped PAT, a /work cwd that clones REPOS/\u003crepo\u003e on demand; reads ONLY goose-authored issues (never the raw channel firehose — invariant 2). Handoff is a human @mention of the impl agent on goose's issue (invariant 1). Acceptance: human @mention on issue #N =\u003e impl agent opens a PR against that repo; CI gates the merge; the agent cannot merge. DEPENDS on the ACP-headless spike.","status":"open","priority":1,"issue_type":"task","owner":"jeremylongshore@users.noreply.github.com","created_at":"2026-07-31T19:58:11Z","created_by":"jeremylongshore","updated_at":"2026-07-31T19:58:11Z","labels":["agentic-ops","estate","github-bridge","impl-agent"],"dependencies":[{"issue_id":"buzz-20l.6","depends_on_id":"buzz-20l","type":"parent-child","created_at":"2026-07-31T13:58:10Z","created_by":"jeremylongshore","metadata":"{}"},{"issue_id":"buzz-20l.6","depends_on_id":"buzz-20l.1","type":"blocks","created_at":"2026-07-31T13:58:36Z","created_by":"jeremylongshore","metadata":"{}"},{"issue_id":"buzz-20l.6","depends_on_id":"buzz-20l.5","type":"blocks","created_at":"2026-07-31T13:58:37Z","created_by":"jeremylongshore","metadata":"{}"}],"dependency_count":2,"dependent_count":0,"comment_count":0} {"_type":"issue","id":"buzz-20l.5","title":"Configure the goose-triage profile — owner-gated, issue-filing only, reading the repo-channel firehose","description":"goose (MiniMax) runs owner-only, PermissionMode plan/dontAsk, no-merge PAT, subscribed to the repo-home channels; reads the raw bridge feed and files ONE GitHub issue per finding via the finding-id upsert. It NEVER authors code and NEVER hands off via chat @mention. Acceptance: a posted CI-failure card results in exactly one filed issue; goose has no write path to code.","notes":"2026-08-03 live audit: Goose is online and MiniMax-M3 is configured, but the deployed container has no BUZZ_AUTH_TAG; users.agent_owner_pubkey is NULL and completed turns log NIP-AM HTTP 403. BUZZ_ACP_AGENT_OWNER is only the local response gate. Before acceptance, mint the Jeremy-owned NIP-OA tag in Buzz Desktop, deploy it via SOPS, restart, and verify the owner mapping plus a tagged turn with no NIP-AM 403.","status":"open","priority":1,"issue_type":"task","owner":"jeremylongshore@users.noreply.github.com","created_at":"2026-07-31T19:58:09Z","created_by":"jeremylongshore","updated_at":"2026-08-03T02:50:36Z","labels":["agentic-ops","estate","github-bridge","triage-agent"],"dependencies":[{"issue_id":"buzz-20l.5","depends_on_id":"buzz-20l.3","type":"blocks","created_at":"2026-07-31T13:58:34Z","created_by":"jeremylongshore","metadata":"{}"},{"issue_id":"buzz-20l.5","depends_on_id":"buzz-20l.4","type":"blocks","created_at":"2026-07-31T13:58:34Z","created_by":"jeremylongshore","metadata":"{}"},{"issue_id":"buzz-20l.5","depends_on_id":"buzz-20l","type":"parent-child","created_at":"2026-07-31T13:58:09Z","created_by":"jeremylongshore","metadata":"{}"}],"dependency_count":2,"dependent_count":3,"comment_count":0} {"_type":"issue","id":"buzz-20l.4","title":"Build the finding-id and level-triggered reconciler so every failure maps to exactly one auto-closing issue","description":"finding-id = hash(repo, workflow, normalized-failure) for idempotent issue upsert (create-only-if-absent); a periodic level-triggered reconciler computes currently-failing finding-ids and closes every finding-issue no longer in that set (do NOT rely on edge-triggered 'green run-\u003eclose' — Buzz drops replies #2459/#3587, agents go deaf in threads #2270). BUILD BEFORE the first repo channel goes live. Acceptance: three retries of one flaky failure =\u003e one issue; recovery =\u003e the issue auto-closes within one reconcile cycle.","status":"open","priority":1,"issue_type":"task","owner":"jeremylongshore@users.noreply.github.com","created_at":"2026-07-31T19:58:08Z","created_by":"jeremylongshore","updated_at":"2026-07-31T19:58:08Z","labels":["agentic-ops","estate","github-bridge","reliability"],"dependencies":[{"issue_id":"buzz-20l.4","depends_on_id":"buzz-20l.3","type":"blocks","created_at":"2026-07-31T13:58:33Z","created_by":"jeremylongshore","metadata":"{}"},{"issue_id":"buzz-20l.4","depends_on_id":"buzz-20l","type":"parent-child","created_at":"2026-07-31T13:58:08Z","created_by":"jeremylongshore","metadata":"{}"}],"dependency_count":1,"dependent_count":2,"comment_count":0} @@ -15,12 +16,13 @@ {"_type":"issue","id":"buzz-yfe.1","title":"Produce the Buzz source-code reference (file:line)","description":"Map the block/buzz source: relay, CLI, admin, event kinds, auth/NIP-OA, ACP agent, personas/templates, media. IN FLIGHT via an 8-agent ultracode workflow -\u003e BUZZ-SYSTEM-REFERENCE.md. AC: ops/buzz/reference/BUZZ-SYSTEM-REFERENCE.md written, file:line cited.","status":"closed","priority":1,"issue_type":"task","owner":"jeremylongshore@users.noreply.github.com","created_at":"2026-07-31T03:27:12Z","created_by":"jeremylongshore","updated_at":"2026-07-31T03:30:31Z","closed_at":"2026-07-31T03:30:31Z","close_reason":"source-code reference written to ops/buzz/reference/BUZZ-SYSTEM-REFERENCE.md (45KB, file:line cited, from 8-agent sourcing workflow)","dependencies":[{"issue_id":"buzz-yfe.1","depends_on_id":"buzz-yfe","type":"parent-child","created_at":"2026-07-30T21:27:12Z","created_by":"jeremylongshore","metadata":"{}"}],"dependency_count":0,"dependent_count":2,"comment_count":0} {"_type":"issue","id":"buzz-yfe","title":"Encode durable Buzz operational expertise — reference, skill, operator agents","description":"Stop operating Buzz by trial-and-error. Produce source-grounded reference docs, a buzz-ops skill that bundles them, and validated operator agents that actually know how Buzz is wired. Built via /skill-creator and /agent-creator (IS 8-field spec), grounded in the references. Home: ops/buzz/reference/ (docs), intent-os .claude/ (skill+agents).","status":"closed","priority":1,"issue_type":"epic","owner":"jeremylongshore@users.noreply.github.com","created_at":"2026-07-31T03:27:11Z","created_by":"jeremylongshore","updated_at":"2026-07-31T03:37:21Z","closed_at":"2026-07-31T03:37:21Z","close_reason":"All 7 children closed: 2 references + skill + 3 agents + validation; all PASS the IS validators","dependency_count":0,"dependent_count":0,"comment_count":0} {"_type":"issue","id":"buzz-ehv","title":"Community channel layout and identity roster — build clean, keep clean","description":"The buzz-prod community's channel architecture and member/agent identity hygiene. Ground truth + procedures: ops/buzz/RUNBOOK-channels.md (source-cited). SHIPPED this session (2026-07-31): the clean provider-first open layout (0-general pinned, ask, ai-wire, anthropic-* group, \u003cprovider\u003e-wire firehoses, topic *-wire, private sys-*); persona agents (Bumble/Fizz/Honey/CCA-F) purged; canonical names set (Buzz Admin, goose minimax3, AI Wire, humans); RUNBOOK-channels.md written. Open children below.","status":"open","priority":1,"issue_type":"epic","owner":"jeremylongshore@users.noreply.github.com","created_at":"2026-07-31T03:27:09Z","created_by":"jeremylongshore","updated_at":"2026-07-31T03:27:09Z","dependency_count":0,"dependent_count":0,"comment_count":0} -{"_type":"issue","id":"buzz-2i6","title":"Install nak on the Buzz hosts and run the real functional-probe rehearsal, then enable the prod updater timer","description":"The updater lane is deployed to staging (dormant) but the real functional-probe rehearsal is blocked: nak (the NIP-42 auth+publish+readback CLI the probe uses) is absent on the Buzz hosts. buzz-admin IS in the relay image. Steps: install nak on staging (+ prod), run functional-probe.sh against the live staging relay (throwaway member auth+publish+readback, un-invited refused, cleans up), then a controlled no-op-digest updater rehearsal on staging, THEN install-updater-lane.sh intent-ops-buzz --enable-timer for prod. Parent: buzz-ocv.4.","notes":"REHEARSAL PARTIAL on live staging 2026-07-29 (nak copied to /usr/local/bin/nak on the staging host; jq present). VERIFIED LIVE: closed relay up+healthy+CORS-applied; buzz-admin add-member/remove-member/list-members work — EXACT syntax is 'buzz-admin add-member --pubkey \u003chex-or-npub\u003e' (NOT positional; positional errors with usage). nak emits 64-char hex from 'nak key public'; relay accepts hex. add+remove round-trip proven; test member cleaned up (relay left clean: owner + 1 pre-existing member). REMAINING: the nak publish/readback NIP-42 flow hung with reactive '--auth' — the closed relay likely needs '--force-pre-auth' (authenticate BEFORE the EVENT/REQ), and readback (nak req -i \u003cid\u003e) on a closed relay also needs auth so the member NSEC must be threaded into functional-probe.sh's readback() (currently it only gets the event id). NEXT: (1) prove 'NOSTR_SECRET_KEY=\u003cnsec\u003e nak event -k1 -c X --auth --force-pre-auth \u003cws\u003e' returns an id against staging; (2) prove readback with the member key; (3) bake the verified commands + --pubkey into functional-probe.sh add_member/del_member/publish/readback; (4) then no-op-digest updater rehearsal on staging; (5) install-updater-lane.sh intent-ops-buzz --enable-timer.\nREHEARSAL DONE on staging (intent-os PR #288): nak installed on the staging host; functional-probe.sh fixed to the real NIP-42 flow (--sec, public wss through Caddy, --force-pre-auth readback, --pubkey, keygen newline, global cleanup trap) and PROVEN GREEN E2E against the live staging relay — member publish+readback, un-invited refused; smoke-suite PASS; unauth-matrix 6/6. Self-cleaning; staging membership left clean. REMAINING: install nak on the PROD host + run the same 3 gates against buzz-prod off-network; then enable the prod updater timer.\nAdvanced 2026-07-30 (ultracode Track-A workflow), timer NOT armed by design: (1) nak installed on prod host intent-ops-buzz (/usr/local/bin/nak, keygen verified); (2) wrapped-updater lane installed DORMANT via install-updater-lane.sh (no --enable-timer) — 6/6 lane scripts + both systemd units present, daemon-reload+syntax OK; (3) smoke-suite.sh + unauth-matrix.sh pushed (the installer omits them); (4) functional-probe rehearsal PASSED green against live prod (see buzz-nry.3 gate-suite run — member auth/publish/readback, un-invited refused, self-cleaned). VERIFIED dormant: timer disabled+inactive, updater.service never ran, serving digest unchanged (a0f672). REMAINING = arm the timer (systemctl enable --now) — HELD pending owner call: arming = unattended weekly pre-1.0 prod deploys with advisory-only scan, before apex cutover. Recommend arming AFTER apex cutover; lane is one command from armed.","status":"open","priority":1,"issue_type":"task","owner":"jeremylongshore@users.noreply.github.com","created_at":"2026-07-29T21:47:43Z","created_by":"jeremylongshore","updated_at":"2026-07-30T05:40:19Z","labels":["go-live","probe","updater"],"dependency_count":0,"dependent_count":0,"comment_count":0} +{"_type":"issue","id":"buzz-2i6","title":"Enable the Buzz prod updater timer — blocked only on drilling the clean revert case, everything else is done and proven","description":"The updater lane is deployed to staging (dormant) but the real functional-probe rehearsal is blocked: nak (the NIP-42 auth+publish+readback CLI the probe uses) is absent on the Buzz hosts. buzz-admin IS in the relay image. Steps: install nak on staging (+ prod), run functional-probe.sh against the live staging relay (throwaway member auth+publish+readback, un-invited refused, cleans up), then a controlled no-op-digest updater rehearsal on staging, THEN install-updater-lane.sh intent-ops-buzz --enable-timer for prod. Parent: buzz-ocv.4.","notes":"REHEARSAL PARTIAL on live staging 2026-07-29 (nak copied to /usr/local/bin/nak on the staging host; jq present). VERIFIED LIVE: closed relay up+healthy+CORS-applied; buzz-admin add-member/remove-member/list-members work — EXACT syntax is 'buzz-admin add-member --pubkey \u003chex-or-npub\u003e' (NOT positional; positional errors with usage). nak emits 64-char hex from 'nak key public'; relay accepts hex. add+remove round-trip proven; test member cleaned up (relay left clean: owner + 1 pre-existing member). REMAINING: the nak publish/readback NIP-42 flow hung with reactive '--auth' — the closed relay likely needs '--force-pre-auth' (authenticate BEFORE the EVENT/REQ), and readback (nak req -i \u003cid\u003e) on a closed relay also needs auth so the member NSEC must be threaded into functional-probe.sh's readback() (currently it only gets the event id). NEXT: (1) prove 'NOSTR_SECRET_KEY=\u003cnsec\u003e nak event -k1 -c X --auth --force-pre-auth \u003cws\u003e' returns an id against staging; (2) prove readback with the member key; (3) bake the verified commands + --pubkey into functional-probe.sh add_member/del_member/publish/readback; (4) then no-op-digest updater rehearsal on staging; (5) install-updater-lane.sh intent-ops-buzz --enable-timer.\nREHEARSAL DONE on staging (intent-os PR #288): nak installed on the staging host; functional-probe.sh fixed to the real NIP-42 flow (--sec, public wss through Caddy, --force-pre-auth readback, --pubkey, keygen newline, global cleanup trap) and PROVEN GREEN E2E against the live staging relay — member publish+readback, un-invited refused; smoke-suite PASS; unauth-matrix 6/6. Self-cleaning; staging membership left clean. REMAINING: install nak on the PROD host + run the same 3 gates against buzz-prod off-network; then enable the prod updater timer.\nAdvanced 2026-07-30 (ultracode Track-A workflow), timer NOT armed by design: (1) nak installed on prod host intent-ops-buzz (/usr/local/bin/nak, keygen verified); (2) wrapped-updater lane installed DORMANT via install-updater-lane.sh (no --enable-timer) — 6/6 lane scripts + both systemd units present, daemon-reload+syntax OK; (3) smoke-suite.sh + unauth-matrix.sh pushed (the installer omits them); (4) functional-probe rehearsal PASSED green against live prod (see buzz-nry.3 gate-suite run — member auth/publish/readback, un-invited refused, self-cleaned). VERIFIED dormant: timer disabled+inactive, updater.service never ran, serving digest unchanged (a0f672). REMAINING = arm the timer (systemctl enable --now) — HELD pending owner call: arming = unattended weekly pre-1.0 prod deploys with advisory-only scan, before apex cutover. Recommend arming AFTER apex cutover; lane is one command from armed.\nUNBLOCKED AND MOSTLY DONE, but the timer is deliberately NOT enabled. The bead's stated blocker was wrong: nak was already installed on BOTH hosts. The real blocker was that the functional probe defaults to ws://127.0.0.1:3004 and the relay is vhost-scoped, so loopback returns 404 on the WS upgrade - a healthy relay looked broken. Rehearsal then found the lane had never been runnable at all: (1) BUZZ_IMAGE_CHANNEL=ghcr.io/block/buzz:relay is a 404 tag on both hosts; (2) DW_SMOKE_CMD was UNSET on both hosts and deploy-wrapper treats unset as SUCCESS, so every promotion would self-certify and auto-revert could never fire; (3) backup.sh/restore.sh were never shipped by install-updater-lane.sh so staging aborted at 'bound snapshot failed'. All four fixed in intent-os PR #455 with a new smoke-probe.sh that self-resolves RELAY_URL per host. PROVEN LIVE: smoke gate passes healthy and fails closed on both hosts; staging AND production promoted a0f67203 (built 2026-07-10, 32 days stale) -\u003e 4e31b7c7 (2026-08-08) with the functional probe green; prod verified after - NIP-11 200, 13 members and 483 channel/roster event pairs intact. This closes the RUSTSEC-2026-0225..0232 nostr bump and the relay subscription lock-inversion fix. TIMER STAYS DORMANT because the clean revert case is still unproven: a /bin/false drill did revert the image but could not confirm health so it paged and latched HOLD (correct fail-closed), and a once-fail drill was defeated by the wrapper's bounded smoke retry. Remaining before enabling: drill the clean revert, drill restore_stores (never exercised), and replace the always-pass advisory-scan with a real SBOM gate.","status":"open","priority":1,"issue_type":"task","owner":"jeremylongshore@users.noreply.github.com","created_at":"2026-07-29T21:47:43Z","created_by":"jeremylongshore","updated_at":"2026-08-11T20:37:16Z","started_at":"2026-08-11T19:49:36Z","labels":["go-live","probe","updater"],"dependency_count":0,"dependent_count":0,"comment_count":0} {"_type":"issue","id":"buzz-aet","title":"Author the authoritative Buzz naming and boundaries record and reconcile the blueprint ledger to prod-up","description":"Track B of the Buzz adoption plan (owner amendment 2026-07-29, do FIRST). Author the canonical naming+boundaries record in the fork 000-docs from the AUTHORITATIVE NAMING \u0026 REPOSITORY MODEL table: 6 assets (upstream block/buzz, code fork intent-solutions-io/buzz, contributor lab intent-solutions-io/intent-ops-buzz repo, production host intent-ops-buzz VPS, live ops lane intent-os ops/buzz, deferred plugin intent-solutions-io/intent-ops-buzz-plugin), the disambiguation rule (never bare 'intent-ops-buzz'), and the four-plane flow with two separate gates (contribution vs deployment). Reconcile the blueprint 001 completion ledger to reality (prod host built/deployed/verified pre-cutover, backups+restore proven), name the plugin repo deferred, and add the contributor-lab plane. Unblocks the parked contributor-lab architecture DRAFT (Track C). The amendment forbids durable architecture docs until this lands. Done-means: naming doc exists + internally consistent; ledger prod-up; no bare-intent-ops-buzz ambiguity; pnpm check green on the intent-os reconcile edit.","status":"closed","priority":1,"issue_type":"task","owner":"jeremylongshore@users.noreply.github.com","created_at":"2026-07-29T19:19:37Z","created_by":"jeremylongshore","updated_at":"2026-07-29T19:36:54Z","started_at":"2026-07-29T19:19:43Z","closed_at":"2026-07-29T19:36:54Z","close_reason":"Track B shipped: authored fork 000-docs/006-DR-STND-authoritative-naming-and-boundaries.md (canonical six-asset table + host-vs-repo disambiguation rule + four-plane flow + two-gate model); reconciled the 001 blueprint ledger to prod-up (E2/E2d/E3 states, ELab row, E9 plugin named intent-ops-buzz-plugin + DEFERRED, new Phase 6 pointer); added the intent-os ops/buzz/README 'Naming \u0026 planes' section. Merged: fork PR #11 + intent-os PR #281 (estate-CI 3 green contexts: gates 128s, drills 212s, gitleaks). pnpm check EXIT=0; no bare-intent-ops-buzz ambiguity remains.","labels":["architecture","ledger","naming"],"dependency_count":0,"dependent_count":0,"comment_count":0} {"_type":"issue","id":"buzz-nry.3","title":"Run the full go-live gate suite against production on the dedicated box","description":"The full E3 go-live gate suite to RUN against PROD before any invite (all BLOCKING, none assumed passed): unauth probe matrix off-network; functional membership probe (NIP-42 publish+readback, un-invited refused); backup restore drill (restore staging from prod's artifacts); updater planted-fault drill on staging; key runbooks rehearsed; resource caps verified. Status is tracked per-gate in the notes and in intent-os ops/buzz — the off-site backup leg and several gates remain OPEN; this description is scope, not a completion claim.","notes":"Go-live gates PARTIAL against prod: (1) functional membership probe GREEN — owner NIP-42 auth -\u003e publish -\u003e readback OK; un-invited key REFUSED (closed relay enforcing, member_count:1 on boot). (2) unauth HTTP probe matrix PASS — media PUT 405, git 404/405, hooks 400, admin 404; public readiness/NIP-11/web-client 200. (3) resource caps + loopback-only publish + isolated bridge net verified. REMAINING/BLOCKING before any invite: backup-restore drill, updater planted-fault drill, key runbooks — all depend on backup+updater wiring (buzz-ocv.4, not built).\nRESTORE DRILL PROVEN (buzz-nry.3 gate item): restored the first prod archive into an ISOLATED dev-box scratch project (prod/staging untouched, prod 4/4 healthy throughout). 40 tables restored; the exact prod-published event 9717ccaa physically present; relay_members=1 + member_count:1 on boot; media restored; relay identity stable (same key-\u003e35cd57ab); relay boots healthy; un-invited refused; restart persistence holds. RTO ~3min, RPO = backup point (18:36:41Z). Caveat: headless nak auth-on-REQ readback didn't complete in-harness (passed on prod). Evidence: ops/buzz/RUNBOOK-backup-restore.md. STILL BLOCKING before invite: updater planted-fault drill, key runbooks, off-site copy.\nGATE SUITE PASSED against prod 2026-07-30 (ultracode Track-A workflow, non-destructive): smoke 200/NIP-11/functional PASS; unauth-matrix 6/6 REJECT; functional-probe (member NIP-42 auth+publish+readback, un-invited refused) with cleanup CONFIRMED (back to baseline count 3). The suite deliverable is DONE; this bead stays OPEN only because its dependency buzz-nry.2 (apex DNS cutover) is owner-gated and not yet done — close together when apex cuts over.","status":"closed","priority":1,"issue_type":"task","owner":"jeremylongshore@users.noreply.github.com","created_at":"2026-07-29T16:31:30Z","created_by":"jeremylongshore","updated_at":"2026-07-30T07:17:47Z","closed_at":"2026-07-30T07:17:47Z","close_reason":"DONE 2026-07-30. Full go-live gate suite PASSED against prod (buzz-prod.intentsolutions.io): smoke 200/NIP-11/functional PASS; unauth-matrix 6/6 REJECT; functional-probe (member NIP-42 auth+publish+readback, un-invited refused) with cleanup CONFIRMED (baseline count 3). Was dependency-blocked by buzz-nry.2 (apex cutover) — that dependency is resolved by the owner decision to keep buzz-prod permanent, so this now closes with its already-captured green evidence.","labels":["hosting"],"dependencies":[{"issue_id":"buzz-nry.3","depends_on_id":"buzz-nry.2","type":"blocks","created_at":"2026-07-29T10:31:31Z","created_by":"jeremylongshore","metadata":"{}"},{"issue_id":"buzz-nry.3","depends_on_id":"buzz-nry","type":"parent-child","created_at":"2026-07-29T10:31:29Z","created_by":"jeremylongshore","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0} {"_type":"issue","id":"buzz-nry.2","title":"Deploy production from the proven staging artifacts with fresh secrets and cut DNS over","description":"Deploy prod from the proven staging artifacts (same digest-pinned compose) with FRESH secrets minted on the new box (new relay identity, new bootstrap owner key until the owner's desktop key swaps in, new db/redis/minio; staging keys never promote). DNS cuts over to the prod host at go-live; the shared stack renames to the staging domain. Deploy specifics + addressing in intent-os ops/buzz. Depends on the bootstrap child.","notes":"Prod deploy DONE (apex cutover pending): staging-proven digest-pinned compose deployed with FRESH prod secrets; 4 containers healthy; own Caddy ingress TLS + security headers. REMAINING (gated on the owner's client-generated desktop key): DNS cutover to the prod host, rename staging to the staging domain, swap BUZZ_DOMAIN/RELAY_URL/CORS to the apex, swap RELAY_OWNER_PUBKEY to the owner's desktop pubkey. Addressing + specifics in intent-os ops/buzz.","status":"closed","priority":1,"issue_type":"task","owner":"jeremylongshore@users.noreply.github.com","created_at":"2026-07-29T16:31:22Z","created_by":"jeremylongshore","updated_at":"2026-07-30T07:17:44Z","closed_at":"2026-07-30T07:17:44Z","close_reason":"DONE 2026-07-30. Production deployed from proven staging artifacts with FRESH secrets on the dedicated host intent-ops-buzz, serving buzz-prod.intentsolutions.io (169.58.95.32). The 'cut DNS over' (apex → buzz.) requirement is DROPPED by owner decision 2026-07-30: buzz-prod.intentsolutions.io is the PERMANENT production URL (no apex cutover). Prod DNS is therefore already on its permanent, correct name — nothing further to cut over.","labels":["hosting"],"dependencies":[{"issue_id":"buzz-nry.2","depends_on_id":"buzz-nry","type":"parent-child","created_at":"2026-07-29T10:31:22Z","created_by":"jeremylongshore","metadata":"{}"},{"issue_id":"buzz-nry.2","depends_on_id":"buzz-nry.1","type":"blocks","created_at":"2026-07-29T10:31:31Z","created_by":"jeremylongshore","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0} {"_type":"issue","id":"buzz-nry.1","title":"Bootstrap the new production host to estate conventions","description":"Bootstrap the dedicated prod host to estate ops/host conventions: Ubuntu 24.04, tailnet-only SSH, ufw, fail2ban, unattended-upgrades, docker, its own Caddy (separate ingress = separate failure domain), age host key + sops, borg client, Netdata (tailnet-bound). Host addressing, key paths, and access detail live ONLY in intent-os ops/buzz. Gated on the owner installing the dev-box SSH key.","status":"closed","priority":1,"issue_type":"task","owner":"jeremylongshore@users.noreply.github.com","created_at":"2026-07-29T16:31:15Z","created_by":"jeremylongshore","updated_at":"2026-07-29T18:06:58Z","started_at":"2026-07-29T17:57:57Z","closed_at":"2026-07-29T18:06:58Z","close_reason":"intent-ops-buzz bootstrapped to estate baseline + verified: Ubuntu 24.04.4 LTS, hostname intent-ops-buzz, joined tailnet [tailnet addr — intent-os ops/buzz] (untagged/user-owned, matching estate); ufw default-deny (tailnet-trusted iface + public 80/443 only, public 22 CLOSED/times-out); sshd key-only + PermitRootLogin no + PasswordAuthentication no; a non-root sudo admin account (NOPASSWD, docker group); fail2ban + unattended-upgrades active; 2G swap swappiness=10; docker 29.6 (log-rotation + live-restore) + compose v5.3; caddy 2.11 (own ingress); age host key at [host key path — intent-os ops/host] (recipient [host age recipient — intent-os ops/host/secrets]); borg client; sops 3.9.4; Netdata bound loopback+tailnet only (127.0.0.1:19999 + [tailnet addr — intent-os ops/buzz]:19999, not public). 7/7 services active.","labels":["hosting"],"dependencies":[{"issue_id":"buzz-nry.1","depends_on_id":"buzz-nry","type":"parent-child","created_at":"2026-07-29T10:31:15Z","created_by":"jeremylongshore","metadata":"{}"}],"dependency_count":0,"dependent_count":1,"comment_count":0} {"_type":"issue","id":"buzz-nry","title":"Stand up the dedicated Buzz production VPS and cut the prod domain over to it","description":"Track D: Buzz production runs on its OWN dedicated VPS (owner topology decision 2026-07-29, fork 000-docs/005) so a fast-moving pre-1.0 stack does not share a failure domain with revenue workloads. The shared-VPS stack becomes permanent STAGING (epic buzz-ocv). Prod = the proven staging artifacts (same digest-pinned compose) with FRESH secrets; staging keys never promote. All go-live gates run against prod before any invite. Concrete host detail (addressing, keys, DNS, deploy specifics) lives ONLY in the private intent-os ops/buzz lane.","notes":"GitHub: intent-solutions-io/buzz#9 — https://github.com/intent-solutions-io/buzz/issues/9. MIRROR RULE: bd-sync handles fan-out — `bd-sync note buzz-nry` and `bd-sync close buzz-nry` mirror to GH and Plane automatically.\n\nPlane: BUZZ-3 — (Plane, internal)\nProd pairing milestone 2026-07-30: mobile device pairing now LIVE on the production host (buzz-prod.intentsolutions.io) — sidecar + Caddy /pair deployed, owner confirmed a real device paired (intent-os PR #291). Prod relay + sidecar both healthy. Remaining under this prod epic: .2 apex DNS cutover off buzz-prod-\u003e buzz., .3 full go-live gate suite against prod.","status":"closed","priority":1,"issue_type":"epic","owner":"jeremylongshore@users.noreply.github.com","created_at":"2026-07-29T16:31:08Z","created_by":"jeremylongshore","updated_at":"2026-07-30T07:18:01Z","started_at":"2026-07-29T17:57:57Z","closed_at":"2026-07-30T07:18:01Z","close_reason":"EPIC DONE 2026-07-30. Dedicated Buzz production VPS (intent-ops-buzz, 169.58.95.32) stood up to estate conventions (.1), deployed with fresh secrets serving buzz-prod.intentsolutions.io (.2), and the full go-live gate suite passed against it (.3). Owner decision 2026-07-30: buzz-prod.intentsolutions.io is the PERMANENT production URL — the 'cut the prod domain over' (apex) part of this epic is intentionally NOT done and is retired, not deferred. All three children closed.","labels":["hosting"],"dependency_count":0,"dependent_count":0,"comment_count":0} +{"_type":"issue","id":"buzz-v2p","title":"Retire the two phantom Buzz repositories and delete the naming-disambiguation rule they forced","description":"The naming record 006 reserved two GitHub repositories that were never created: intent-solutions-io/intent-ops-buzz (Track-C contributor lab) and intent-solutions-io/intent-ops-buzz-plugin (deferred operator plugin). The lab repo was given the same string as the real production VPS, and 006 papered over that collision with a 'never write the bare phrase intent-ops-buzz' rule enforced on every mention.\n\nRetire both phantom repos. With the lab gone there is no collision, so the disambiguation rule is DELETED rather than enforced. Track C is closed as deferred-indefinitely: the contribution practice produced one upstream PR (block/buzz#4722) that needed no lab, and the flagship candidate the lab was designed to verify was dropped (Block fixed the relay half in #4196; the desktop half was a fork-local defect). The parked architecture draft moves into version control at intent-os ops/buzz/PLAN-contrib-lab-architecture.md as DEFERRED.\n\nThe production host name intent-ops-buzz is UNCHANGED — it is a real VPS with DNS, systemd units, compose files, and backup scripts, and ~80 of the 86 references across the estate are to it and are correct.\n\nAlso fixes a currently-red gate: scripts/audit-harness verify exits 2 on committed content (000-INDEX drifted from its pin, 007-AA-AUDR was never pinned) — both landed via PRs #17/#20 without a follow-up re-pin, so pre-push is red for everyone in this repo.","acceptance_criteria":"006 lists four assets that all exist; the disambiguation section is deleted; the flow is three planes; 001 ledger has no ELab row and no phantom repo names; scripts/audit-harness verify exits 0; both fork gates green; the parked draft is in version control under intent-os ops/buzz/; decision-log/048 supersedes D138; stale branch origin/fix/community-member-onboarding deleted.","notes":"GitHub: intent-solutions-io/buzz#23 — https://github.com/intent-solutions-io/buzz/issues/23. MIRROR RULE: bd-sync handles fan-out — `bd-sync note buzz-v2p` and `bd-sync close buzz-v2p` mirror to GH and Plane automatically.\nDeleting stale remote branch `fix/community-member-onboarding` (the reverted PR #16 branch). Tip SHA recorded for recovery: `a991d7c77643a59a76a9239bdc5cea98f24d7388`. Its 6 commits are not ancestors of `main` (PR #16 was squash-merged, then reverted by #18), and each is resolved: the push-gateway CI fix is upstream as `block/buzz#4722` (open) and also lives on `contrib/push-gateway-image-override`, which is KEPT until #4722 closes; the nine RUSTSEC bumps were dropped because upstream carries them; the onboarding change was dropped because the relay half belongs upstream (Block's own `#4196`, open) and the desktop half was a fork-local defect that violated the additive-only contract. Recover with `git fetch origin a991d7c77643a59a76a9239bdc5cea98f24d7388` if ever needed.\nScope addition (owner request mid-flight): added a fork-specific `REVIEW.md` — this repo had NO reviewer guidance, so the PR bot reviewed it as an ordinary repo with no notion that touching an upstream-owned path is the defect that matters most here (exactly how PR #16's breach got through). Registered across all three surfaces that a new root file must appear in, in lockstep: the ALLOW array in check-additive-only.sh, MUST_SURVIVE in check-must-survive.sh (12→13 paths), and FORK.md's table; also hash-pinned (13→14 files) so reviewer instructions cannot be silently weakened. Verified `REVIEW.md` is NOT upstream-owned (`git ls-tree upstream/main` → no match), so it is a true addition, not a third declared divergence. Proved the registration is load-bearing by running the gate with the allowlist entry stripped: 'NON-ADDITIVE CHANGE vs upstream/main: REVIEW.md', exit 1.\n\nAlso addressed the CodeRabbit review on #23: fixed the §3 three-plane ambiguity I introduced (every diagram box now tagged with its plane or SOURCE) and the §5 'internal tooling never enters the fork' contradiction (fork-governance carve-out). Deferred the stale 001 E2d/E3 ledger rows as bead buzz-51i — pre-existing drift in unmodified lines, and reconciling it means asserting prod cutover state that needs verification, not a passing docs edit.\nCI verdict: all checks green on #23 except the Kilo bot (not a required check; it is failing on 'selected model is no longer available', a bot-settings issue, not a finding).\n\n`Desktop Smoke E2E (4)` failed once on `thread-focus-mode.spec.ts` — investigated rather than waved off, and it is a FLAKE. Evidence: (1) the PR's complete diff is 12 files — 000-docs/, CLAUDE.md, FORK.md, REVIEW.md, both gate scripts, .harness-hash*, .beads/ — with nothing under desktop/, crates/, web/, mobile/, or src/, so there is no mechanism by which it breaks a desktop E2E test; (2) the same shard already reported `relay-reconnect.spec.ts` as flaky-passed-on-retry in that very run; (3) `gh run rerun --failed` on the identical commit returned RUN=success with zero code changes.\n\nCorrection worth recording: I nearly reported this as pre-existing drift, but the four earlier pushes on this branch all CANCELLED their CI runs, so this was the first Desktop suite to complete on the branch and there was no prior green to compare against. The re-run is the evidence, not the assumption.\n\nRequired-check status: buzz#23 `fork-contract` PASS; intent-os#392 Gates + Drills + gitleaks all PASS. Both awaiting merge approval.","status":"in_progress","priority":2,"issue_type":"task","owner":"jeremylongshore@users.noreply.github.com","created_at":"2026-08-07T22:52:15Z","created_by":"jeremylongshore","updated_at":"2026-08-07T23:37:30Z","started_at":"2026-08-07T22:52:19Z","dependency_count":0,"dependent_count":0,"comment_count":0} {"_type":"issue","id":"buzz-ehv.3","title":"Expose community roster and join dates in mobile admin UI","description":"Mobile consumes relay membership for messaging but lacks the desktop admin roster surface. Add a discoverable Members \u0026 invites screen for owner/admin identities, backed by the authoritative NIP-43 roster, with member names, roles, join timestamps, search, invite entry point, and explicit loading/error/missing-snapshot states. Do not duplicate relay membership state locally.","acceptance_criteria":"Owner/admin can open Members \u0026 invites on mobile and see the same roster, roles, and join timestamps as desktop; ordinary members cannot mutate membership; invite entry and error states are tested; desktop and mobile agree against one relay snapshot.","status":"open","priority":2,"issue_type":"feature","owner":"jeremylongshore@users.noreply.github.com","created_at":"2026-08-03T16:28:29Z","created_by":"jeremylongshore","updated_at":"2026-08-03T16:28:29Z","dependencies":[{"issue_id":"buzz-ehv.3","depends_on_id":"buzz-ehv","type":"parent-child","created_at":"2026-08-03T10:28:28Z","created_by":"jeremylongshore","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0} {"_type":"issue","id":"buzz-s8q","title":"Evaluate + owner-gated execute the Buzz relay upgrade off v0.2.0 via the wrapped updater (staging-rehearsed, pinned-sha — we'd be running AHEAD of Block's stable :latest)","description":"Finding 2026-07-31: Block's GHCR :latest relay tag == our current prod digest (a0f672, 'v0.2.0'); there is NO version-pinned relay release — v0.5.3-era relay code exists only in rolling :main / sha-\u003ccommit\u003e builds. So a relay upgrade = running UNRELEASED bleeding-edge code + a ~3-version schema migration on the live 49-person event store (exactly the D139 risk). Value is low relay-side (community-limit-\u003e5, NIP-11 max_limit, reconnect backoff); the agent reply-guard #3763 + Claude/Codex harnesses are AGENT-binary changes (rebuild our buzz-agent image, tracked under buzz-20l), NOT relay. Desktop clients already auto-updated to v0.5.3 and work against our relay (Nostr protocol-stable). Recommendation: stay on stable :latest until a real relay release exists OR buzz-20l needs a specific relay feature; if executed, pin a sha-\u003ccommit\u003e (not rolling :main), rehearse the migration on buzz-testing via ops/buzz/scripts/updater.sh, then prod with bound-snapshot + functional-probe + auto-revert. Owner-gated: this is an eyes-open 'run ahead of upstream stable' decision.","status":"open","priority":2,"issue_type":"task","owner":"jeremylongshore@users.noreply.github.com","created_at":"2026-08-01T02:40:44Z","created_by":"jeremylongshore","updated_at":"2026-08-01T02:40:44Z","labels":["agentic-ops","relay","updater"],"dependency_count":0,"dependent_count":0,"comment_count":0} {"_type":"issue","id":"buzz-20l.8","title":"Cherry-pick the upstream Codex auto-reviewer (block/buzz #3715) onto the fork as a config injection","description":"buzz-acp-local approvals_reviewer=auto_review (#3715, OPEN upstream) — the closest drop-in for the dead Greptile PR-review. Cherry-pick as a fork config injection; does NOT touch the owner-gated remote-agents spec #3748. Acceptance: a PR triggers an automated Codex review comment on a test repo.","status":"open","priority":2,"issue_type":"task","owner":"jeremylongshore@users.noreply.github.com","created_at":"2026-07-31T19:58:13Z","created_by":"jeremylongshore","updated_at":"2026-07-31T19:58:13Z","labels":["agentic-ops","codex-review","estate","github-bridge"],"dependencies":[{"issue_id":"buzz-20l.8","depends_on_id":"buzz-20l.1","type":"blocks","created_at":"2026-07-31T13:58:38Z","created_by":"jeremylongshore","metadata":"{}"},{"issue_id":"buzz-20l.8","depends_on_id":"buzz-20l","type":"parent-child","created_at":"2026-07-31T13:58:12Z","created_by":"jeremylongshore","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0} @@ -55,6 +57,7 @@ {"_type":"issue","id":"buzz-4ei.1","title":"Author the master blueprint, decision record, deploy posture, and FORK.md as additive-only artifacts","description":"000-docs/{000-INDEX,001-PP-PLAN,002-DR-DECR,003-OD-DEPL} + FORK.md; zero upstream-path edits.","status":"closed","priority":2,"issue_type":"task","owner":"jeremylongshore@users.noreply.github.com","created_at":"2026-07-29T04:24:18Z","created_by":"jeremylongshore","updated_at":"2026-07-29T04:26:00Z","closed_at":"2026-07-29T04:26:00Z","close_reason":"Authored additive-only: 000-docs/{000-INDEX,001-PP-PLAN blueprint,002-DR-DECR decision record,003-OD-DEPL deploy posture} + FORK.md; git diff upstream/main --stat shows only fork-added paths","labels":["fork-infra"],"dependencies":[{"issue_id":"buzz-4ei.1","depends_on_id":"buzz-4ei","type":"parent-child","created_at":"2026-07-28T22:24:18Z","created_by":"jeremylongshore","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0} {"_type":"issue","id":"buzz-4ei","title":"Stand up the Intent Solutions fork infrastructure for the Buzz adoption","description":"Phase 1 / E1 of 000-docs/001-PP-PLAN-buzz-adoption-master-blueprint.md: fork + clone + beads/Dolt activation, master blueprint + decision record + deploy posture + FORK.md, testing-SOP baseline (TEST_AUDIT.md), three-way mirror (GitHub cluster issue + Plane BUZZ) and memory seeding. Additive-only: zero upstream-path edits.","notes":"GitHub: intent-solutions-io/buzz#1 — https://github.com/intent-solutions-io/buzz/issues/1. MIRROR RULE: bd-sync handles fan-out — `bd-sync note buzz-4ei` and `bd-sync close buzz-4ei` mirror to GH and Plane automatically.\n\nPlane: BUZZ-1 — (Plane, internal)\nE1 milestone: blueprint set + FORK.md + TEST_AUDIT.md authored (buzz-4ei.1, .2 closed); beads write-path root-caused (bd contributor-role fork routing) and fixed via --role maintainer; PR opening next. Note: epic was re-minted from buzz-ekg to buzz-4ei during the store rebuild.\nE1 shipped: PR intent-solutions-io/buzz#2 squash-merged to fork main (6cf4df96f) after CodeRabbit review (4 findings fixed in e49ed40a6, 2 declined with reasons). Children .1/.2/.4 closed with evidence; .3 (fork-lane test layers) remains open — epic stays in_progress until it lands. Deferred: epic-boundary Dolt tag until dolt-mcp-vcs is available (system dolt CLI is version-skewed vs bd's embedded engine).","status":"closed","priority":2,"issue_type":"epic","owner":"jeremylongshore@users.noreply.github.com","created_at":"2026-07-29T04:24:17Z","created_by":"jeremylongshore","updated_at":"2026-07-29T06:21:39Z","started_at":"2026-07-29T04:25:59Z","closed_at":"2026-07-29T06:21:39Z","close_reason":"E1 complete: all 4 children closed with evidence (PRs #2/#3/#5/#6 merged; blueprint ledger E1=COMPLETE; GH cluster #1 auto-closed by PR #6). Fork contract now machine-enforced. Phase 2 hosting opens per blueprint after the MX cutover.","dependency_count":0,"dependent_count":0,"comment_count":0} {"_type":"issue","id":"buzz-bkt","title":"acceptance probe","status":"closed","priority":2,"issue_type":"task","owner":"jeremylongshore@users.noreply.github.com","created_at":"2026-07-29T04:23:48Z","created_by":"jeremylongshore","updated_at":"2026-07-29T04:23:49Z","started_at":"2026-07-29T04:23:49Z","closed_at":"2026-07-29T04:23:49Z","close_reason":"probe","dependency_count":0,"dependent_count":0,"comment_count":0} +{"_type":"issue","id":"buzz-51i","title":"Reconcile the 001 blueprint completion ledger with live bead + prod state","description":"CodeRabbit flagged on PR #23 that the 001 master-blueprint completion ledger has drifted from reality. The E2d and E3 rows still describe pre-cutover production and open blocking gates, while .beads/issues.jsonl and .beads/interactions.jsonl record the permanent production URL (buzz-prod.intentsolutions.io), a passed production gate suite, and the production epic closed 2026-07-30.\n\nRisk if left: 001 is the STANDING EXECUTION AUTHORITY — execution prompts are extracted from it, never re-derived. Stale rows can make a future session reopen retired DNS/cutover work or block on gates that already passed.\n\nDeferred out of PR #23 deliberately: that PR retires two phantom repositories and is scoped to naming. The E2d/E3 rows are pre-existing drift in lines it does not modify, and reconciling them means asserting current production cutover state, which needs verification against the host and the ops lane rather than a docs edit.","acceptance_criteria":"E2d and E3 ledger rows either reflect verified current state or are explicitly marked historical; the reconciliation is evidenced against .beads state and ops/buzz records, not asserted.","status":"open","priority":3,"issue_type":"task","owner":"jeremylongshore@users.noreply.github.com","created_at":"2026-08-07T23:00:37Z","created_by":"jeremylongshore","updated_at":"2026-08-07T23:00:37Z","dependency_count":0,"dependent_count":0,"comment_count":0} {"_type":"issue","id":"buzz-20l.10","title":"Schema the goose-filed issue (finding, repro, executable acceptance, stop-conditions, blast-radius) and lint it in pnpm check (deferred)","description":"The filed issue is the program the impl agent executes — refuse to hand it an unschematized one. Adopt upstream #3928 'agent work contracts' schema when it lands. Deferred until goose triage precision is proven.","status":"open","priority":3,"issue_type":"task","owner":"jeremylongshore@users.noreply.github.com","created_at":"2026-07-31T19:58:15Z","created_by":"jeremylongshore","updated_at":"2026-07-31T19:58:15Z","labels":["agentic-ops","estate","github-bridge","schema"],"dependencies":[{"issue_id":"buzz-20l.10","depends_on_id":"buzz-20l","type":"parent-child","created_at":"2026-07-31T13:58:14Z","created_by":"jeremylongshore","metadata":"{}"},{"issue_id":"buzz-20l.10","depends_on_id":"buzz-20l.5","type":"blocks","created_at":"2026-07-31T13:58:39Z","created_by":"jeremylongshore","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0} {"_type":"issue","id":"buzz-20l.9","title":"Replay the dead reviewers' historical output as a golden eval set and MiniMax model-drift detector (deferred)","description":"Greptile/Gemini/CodeRabbit historical output on merged PRs = a free labeled dataset. Run goose/MiniMax over the same diffs to measure findings-recall + false-positive rate; use as a model-drift detector when MiniMax-M3 changes under us. Deferred until the triage lane is live.","status":"open","priority":3,"issue_type":"task","owner":"jeremylongshore@users.noreply.github.com","created_at":"2026-07-31T19:58:14Z","created_by":"jeremylongshore","updated_at":"2026-07-31T19:58:14Z","labels":["agentic-ops","estate","eval","github-bridge"],"dependencies":[{"issue_id":"buzz-20l.9","depends_on_id":"buzz-20l","type":"parent-child","created_at":"2026-07-31T13:58:13Z","created_by":"jeremylongshore","metadata":"{}"},{"issue_id":"buzz-20l.9","depends_on_id":"buzz-20l.5","type":"blocks","created_at":"2026-07-31T13:58:39Z","created_by":"jeremylongshore","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0} {"_type":"issue","id":"buzz-b6z.4","title":"Verify and surface the buzz-audit hash-chain (tamper-evident audit log)","description":"The buzz-audit crate keeps a per-community SHA-256 hash-chain. Add a periodic chain-verify (like the estate ico audit verify) + surface a break to sys-incidents. AC: chain-verify runs green; a planted break alerts.","status":"open","priority":3,"issue_type":"task","owner":"jeremylongshore@users.noreply.github.com","created_at":"2026-07-31T03:40:58Z","created_by":"jeremylongshore","updated_at":"2026-07-31T03:40:58Z","dependencies":[{"issue_id":"buzz-b6z.4","depends_on_id":"buzz-b6z","type":"parent-child","created_at":"2026-07-30T21:40:58Z","created_by":"jeremylongshore","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0} diff --git a/.harness-hash b/.harness-hash index 12b44469910..0c7816fe7bb 100644 --- a/.harness-hash +++ b/.harness-hash @@ -1,12 +1,14 @@ -7c51b2422a2578ab34c9415f1bcb9456bf2ca0c6f6dbe6d828c35d2dbd7dc8b4 000-docs/000-INDEX.md -a95f7d4b328f506d53ccc028486f80e79cd7854b7985e838ec6913af21a47f33 000-docs/001-PP-PLAN-buzz-adoption-master-blueprint.md +5db9ab53608e79f71b30390a0eeb3c9135240ab75537427aa1584cc98b8b74c9 000-docs/000-INDEX.md +33475ba35f35b2c45decc6f87e1fa65d1f94fd196523b31e4cc7ab99eb708137 000-docs/001-PP-PLAN-buzz-adoption-master-blueprint.md def765bd4f637f1b2cfe5abdb508837e3247b771c8530d0ef394a587c6adc250 000-docs/002-DR-DECR-buzz-adoption-decision-record.md 5030aaf8545985489095cc6f48badee6981f4f2db7b2ba9879877f4bb6bfb755 000-docs/003-OD-DEPL-deploy-posture-public.md 9bcad2b30288a04687745e989a9779823ed16891c1e3c5fa8ae544fa3d814ca7 000-docs/004-DR-DECR-fork-gate-wiring.md 75b5b1253248fd4f04aebfae36efeb2ce48323a567d4ca63d59e0d67667789f6 000-docs/005-DR-DECR-dedicated-vps-topology.md -27bf0d046df299a1662b8c86b4b8a9da1e0c8e14e98c0919d2873014c1080b47 000-docs/006-DR-STND-authoritative-naming-and-boundaries.md -d1c85ad5bafc4b6eb1f78ec888746f66f45e87cb9fd9d84122cfdd59994821c4 FORK.md +01a1f93c8708df44fbb0363cb0e8b380f74c92dc8b8d74166875c0af71aa406e 000-docs/006-DR-STND-authoritative-naming-and-boundaries.md +d47f82f7f176ad3fbd87d6e6d6acd8248a2347439de6df6ed3d16f643669088f 000-docs/007-AA-AUDR-fork-contract-breach-2026-08-03.md +256ccaec753442a09b8be409abe946c9c522b0a9c757cfa97fa050fafe2a9b31 FORK.md +72406a348005a6890a0d26b82e86e55f973b89458a63117b0e5b1be34546675b REVIEW.md 43f3750a570e82cfa0c0cdef6ff51d962f7dbd98f892b590c0a30955043c0ab4 TEST_AUDIT.md da2d266381d9209da59fcc6b06ca351e8eaf0b56470b5353557cc5eb48354761 lefthook-local.yml -fa65f444d630a5eb6db9aa2e306bb389aefd08837a6c696793dc29579369b03c scripts/fork-gates/check-additive-only.sh -5fce5778878475c456ad90fdd1a0d559b5b9bc44cfa583dddd7a783f09397930 scripts/fork-gates/check-must-survive.sh +f39e11b7b4ac8901fe3b8c381abaa97b6567d1d5dd34454aad274e0e94714f65 scripts/fork-gates/check-additive-only.sh +210b917e47095b784fd5e5e68e63ce59163268f759f9c5819e2cad30143b2562 scripts/fork-gates/check-must-survive.sh diff --git a/.harness-hash-extra-patterns b/.harness-hash-extra-patterns index 5ed7f2381dc..c0b9561c0f6 100644 --- a/.harness-hash-extra-patterns +++ b/.harness-hash-extra-patterns @@ -2,6 +2,7 @@ # surface. Any byte change to these must be a reviewed edit followed by # `scripts/audit-harness init`, never silent drift or rebase loss. FORK.md +REVIEW.md TEST_AUDIT.md 000-docs/*.md scripts/fork-gates/*.sh diff --git a/000-docs/000-INDEX.md b/000-docs/000-INDEX.md index 3edd76688d3..3acb07c0f97 100644 --- a/000-docs/000-INDEX.md +++ b/000-docs/000-INDEX.md @@ -11,5 +11,5 @@ This directory is an Intent Solutions **addition** to the fork — upstream | 003 | [OD-DEPL — Deploy posture (public-safe)](003-OD-DEPL-deploy-posture-public.md) | Hosting shape, wrapped update lane, edge controls, go-live gates. Operator detail lives in the private ops lane. | | 004 | [DR-DECR — Fork-gate wiring](004-DR-DECR-fork-gate-wiring.md) | TEST_AUDIT G6 decision: tracked `lefthook-local.yml` + fork gates + hash pinning; F1 resolution; escape-scan baseline. | | 005 | [DR-DECR — Dedicated production VPS topology](005-DR-DECR-dedicated-vps-topology.md) | Owner decision (2026-07-29): production on a dedicated VPS; the shared-host stack becomes permanent staging. Supersedes the one-server answer in `001`/`003`. | -| 006 | [DR-STND — Authoritative naming & boundaries](006-DR-STND-authoritative-naming-and-boundaries.md) | **CANONICAL** (owner amendment 2026-07-29, FINAL): the six Buzz assets, the host-vs-repo disambiguation rule, the four-plane flow, and the two gates (contribution vs deployment). Any doc naming a Buzz asset defers to this. | +| 006 | [DR-STND — Authoritative naming & boundaries](006-DR-STND-authoritative-naming-and-boundaries.md) | **CANONICAL** (owner amendment 2026-07-29; narrowed by Revision 2026-08-07): the four Buzz assets — all of which exist — the three-plane flow, and the two gates (contribution vs deployment). Any doc naming a Buzz asset defers to this. | | 007 | [AA-AUDR — Fork-contract breach audit 2026-08-03](007-AA-AUDR-fork-contract-breach-2026-08-03.md) | PR #16 merged 14 upstream-owned paths onto fork `main` (process breach only; prod untouched). Divergence inventory, causal chain (gates never in CI), remediation: revert → repair-branch sync → upstream via the contribution lane → gates as a required CI check. | diff --git a/000-docs/001-PP-PLAN-buzz-adoption-master-blueprint.md b/000-docs/001-PP-PLAN-buzz-adoption-master-blueprint.md index 8f632f707f9..672ff159a10 100644 --- a/000-docs/001-PP-PLAN-buzz-adoption-master-blueprint.md +++ b/000-docs/001-PP-PLAN-buzz-adoption-master-blueprint.md @@ -82,21 +82,19 @@ three-way (bead ↔ GitHub issue ↔ Plane project `BUZZ`). | E5 — Team onboarding (all-in) | 3 | not started | — | | E6 — Agent bridge (isolated coding agent `goose minimax3`) | 4 | **LIVE on prod** (2026-07-30, decision-log/039, PR #301): `buzz-acp`+goose/MiniMax-M3 running as a member on the prod host, owner-gated + PR-gated, egress-isolated. Open: wire the prod PR loop (repo + scoped token + branch protection — owner inputs) | GH #? · PR #301 | | E7 — Governed-brain agent (`@bob`, BYOH) | 4 | staged (follow-up) | — | -| ELab — Contributor laboratory (`intent-solutions-io/intent-ops-buzz` **repository**, Track C) | 6 | not started (repo not yet created — correct; depends on the naming record `006`) | — | | E8 — Upstream contribution lane (Track D) | 5 | qualified candidates filed | — | -| E9 — Operator plugin (`intent-solutions-io/intent-ops-buzz-plugin`) | 7 | **DEFERRED** — scope gauged from the real install cycle (owner call 2026-07-29); repo not yet created | — | +| E9 — Operator plugin | 7 | **DEFERRED** — scope gauged from the real install cycle (owner call 2026-07-29). No repo exists or is reserved; if it is ever built, it is named then (`006` Revision 2026-08-07) | — | | E10 — Community channel layout & identity roster (`buzz-ehv`) | 3 | **build DONE (2026-07-31)** — clean provider-first open layout live (`0-general` pinned, `ask`, `ai-wire`, `anthropic-*` group, `-wire` + topic `*-wire`, private `sys-*`); persona agents purged; canonical names set; `ops/buzz/RUNBOOK-channels.md` (source-cited). Open: CCA-channel decision (owner-gated), member join/onboarding model | fork beads `buzz-ehv` | | E11 — Buzz operational expertise: reference + skill + agents (`buzz-yfe`) | 3 | **COMPLETE (2026-07-31)** — 2 source-cited references (`ops/buzz/reference/`, 100% citation-consistent with the fork); `buzz-ops` skill (PASS `/validate-skillmd`); 3 operator agents `buzz-ops`/`buzz-feed-curator`/`buzz-relay-admin` (PASS `/validate-agent`) | fork beads `buzz-yfe` | | E12 — AI-Wire feed engine (`buzz-w92`) | 4 | **posting primitive DONE**; ingestion pipeline next — `AI Wire` bot live, first cards posted to `ai-wire`+`0-general`. Children: pipeline (RSSHub+feed→LLM→card), easy/medium/hard feeds, Anthropic monitor-fleet wire, curation+digest, cron | fork beads `buzz-w92` | | E13 — Estate system notifications into `sys-*` (`buzz-0ts`) | 4 | **not started** (Track B) — `buzz-notify.sh`/`af_buzz_transport` → private `sys-*` channels, retiring Slack/notify/Moshi (keep off-estate floor + Ezekiel email) | fork beads `buzz-0ts` | Asset names are governed by `006-DR-STND-authoritative-naming-and-boundaries.md` -(canonical). Never write the bare phrase `intent-ops-buzz` — it is either the -**production host** or the **repository**; always disambiguate. +(canonical). `intent-ops-buzz` is the **production host** — a VPS, not a repo. +There are exactly two Buzz repositories: upstream `block/buzz` and this fork. (The LMS↔estate integration audit — an adjacent adoption-program workstream — -lives entirely in the private operations repo; it has no phase or epic here. -Phase 6 in this tree is the contributor laboratory, below.) +lives entirely in the private operations repo; it has no phase or epic here.) --- @@ -245,20 +243,24 @@ operator repros → scoped fixes. Qualified first touches: upstream #3419 this in Phase 4), #3399 (ACP runtime registry docs). Comment-first, DCO, human approval on every claim/PR. -### Phase 6 — Contributor laboratory (ELab, Track C) - -Depends on: the naming record `006` (done). A **separate** repository — -`intent-solutions-io/intent-ops-buzz` **repository** (NOT a fork, NOT the prod -host of the same name) — that resolves any exact Buzz candidate, mirrors -upstream CI, adds self-hosting/fault/deployment tests, compares against an exact -upstream baseline, produces reusable PR evidence, and hands normalized -`gate-result/v1` evidence to the Intent Eval Platform for the contribution and -deployment gates (`006` §4–§5). The lab **executes**; IEP **decides**; the ops -lane **records**; the host **runs**. Its full architecture (contrib.lock schema, -pinned runner, `buzz-contrib` CLI, test profiles, CI workflows, IEP adapter, -J-Rig dataset, evidence bundle, baseline run, contamination check) graduates -from the parked draft to filed artifacts **in Track C** — not before, per the -owner amendment's "no durable architecture docs until the naming record lands." +### Phase 6 — Contributor laboratory (ELab, Track C) — CLOSED, deferred indefinitely (2026-08-07) + +**Not built, and no repository was ever created for it.** Track C proposed a +separate contribution-laboratory repo that would resolve any exact Buzz +candidate, mirror upstream CI, add self-hosting/fault/deployment tests, and hand +normalized `gate-result/v1` evidence to the Intent Eval Platform for the two +gates (`006` §4). Demand never materialized: the contribution practice has +produced one upstream PR (`block/buzz#4722`) that needed no lab, and the +flagship candidate the lab was designed to verify was dropped — Block has its own +upstream fix for the relay half in flight (`#4196`, open at time of writing), and +the desktop half turned out to be a fork-local defect. + +The architecture draft is parked, not lost: `intent-os` +`ops/buzz/PLAN-contrib-lab-architecture.md`, marked DEFERRED, with the +un-parking conditions stated in its header. Its 0–6 test-layer taxonomy and +fault-injection matrix apply to the relay we run **today** and are useful +independent of any lab repo. Retirement record: `006` Revision 2026-08-07 and +`intent-os` `decision-log/048`. ### Phase 7 — Operator plugin (E9) @@ -286,11 +288,11 @@ skill, not a tutorial). - **Branding:** Intent, model-agnostic (matches Buzz's ACP neutrality); never a vendor/model name, per the estate's own-vocabulary rule. -- **Home:** its **own standalone repo** `intent-solutions-io/intent-ops-buzz-plugin` - (per the naming record `006`; not `jeremylongshore`), listed in the CCPI - marketplace by reference, never vendored into the monorepo — its release - cadence tracks Buzz, not the marketplace. The repo is not yet created (correct - — the scope is deferred). +- **Home:** its **own standalone repo** under `intent-solutions-io` (not + `jeremylongshore`), listed in the CCPI marketplace by reference, never + vendored into the monorepo — its release cadence tracks Buzz, not the + marketplace. No repo exists or is name-reserved; the name is chosen if and + when the scope is un-deferred (`006` Revision 2026-08-07). - **Prior-art check (done 2026-07-29):** Buzz ships native agent-harness support *for running an agent inside Buzz* (the `buzz-acp` ACP bridge), but no plugin exists for *building/operating/self-hosting* a Buzz relay — genuine gap, not a diff --git a/000-docs/006-DR-STND-authoritative-naming-and-boundaries.md b/000-docs/006-DR-STND-authoritative-naming-and-boundaries.md index 7c906ebbbf0..51bea6f2ef8 100644 --- a/000-docs/006-DR-STND-authoritative-naming-and-boundaries.md +++ b/000-docs/006-DR-STND-authoritative-naming-and-boundaries.md @@ -1,11 +1,11 @@ # Authoritative Buzz naming & boundaries record > **Status: CANONICAL.** This is the single source of truth for every Buzz asset -> name and the boundary between them. Owner amendment 2026-07-29 (FINAL). It -> supersedes every earlier statement that combined the fork, the contributor -> lab, the production host, or the ops lane. Any doc that names a Buzz asset -> defers to this record; where another doc conflicts, this one wins and the -> other is corrected. +> name and the boundary between them. Owner amendment 2026-07-29; narrowed by +> **Revision 2026-08-07** (below). It supersedes every earlier statement that +> combined the fork, the production host, or the ops lane. Any doc that names a +> Buzz asset defers to this record; where another doc conflicts, this one wins +> and the other is corrected. > > Filed per Document Filing Standard v4.4. Public-safe: this record names > assets and describes the pipeline shape only — no hostnames-as-addresses, no @@ -13,56 +13,74 @@ > private ops lane (`intent-os` `ops/buzz/`), which this record points to but > never reproduces. +## Revision 2026-08-07 — two phantom repositories retired + +The original record listed **six** assets. Two of them were repositories that +had never been created and now never will be: + +- `intent-solutions-io/intent-ops-buzz` — the Track-C **contributor lab**. + Track C is closed as deferred-indefinitely: the contribution practice has + produced one upstream PR (`block/buzz#4722`) that needed no lab, and the + flagship candidate the lab was designed to verify was dropped — Block has its + own upstream fix for the relay half in flight (`#4196`, open at time of + writing), and the desktop half was a fork-local defect that had no business + on fork `main`. Its parked architecture draft now lives at `intent-os` + `ops/buzz/PLAN-contrib-lab-architecture.md`, marked DEFERRED — the test-layer + taxonomy and fault matrix in it apply to the relay we run **today**, + independent of any lab repo. +- `intent-solutions-io/intent-ops-buzz-plugin` — the deferred operator plugin. + Still deferred; if it is ever built its name is chosen then, not reserved now. + +Retiring the lab repository also retires the reason the old §3 existed. That +section defined a "never write the bare phrase `intent-ops-buzz`" rule because a +phantom repository had been given the same string as the production host. With +the phantom gone there is no collision, so **the rule is deleted rather than +enforced** — a name that needs a footnote on every mention is the defect. + +**The production host name is unchanged.** `intent-ops-buzz` is a real VPS with +DNS, systemd units, compose files, and backup scripts; the overwhelming majority +of references to that string across the estate are to the host and are correct. + ## 1. Why this record exists -Two of the assets below deliberately share the string `intent-ops-buzz` — one -is a **VPS host**, the other is a **GitHub repository**. Early planning also -blurred the code fork, the contribution/verification lab, and the live ops -lane into one "Buzz repo." They are distinct planes with distinct trust levels, +Early planning blurred the code fork, the live ops lane, and the production host +into one "Buzz repo." They are distinct planes with distinct trust levels, distinct secrets postures, and distinct answers to "does this submit upstream?" Conflating them is how prod credentials leak into a PR runner or how an untrusted fork branch gets deployed. This record fixes the names and the boundaries so no session has to re-derive them. -## 2. The six assets (exact identifiers) +## 2. The four assets (exact identifiers) | Asset | Exact identifier | Type | Purpose | Holds secrets? | Submits upstream? | |---|---|---|---|---|---| | **Upstream** | `block/buzz` | repo | official source of truth for Buzz | — | n/a | | **Code fork** | `intent-solutions-io/buzz` | repo (fork of `block/buzz`) | clean `contrib/*` branches → PRs to `block/buzz` **only**; additive-only IS overlay (`000-docs/`, `FORK.md`, beads) | **NO** | **YES** | -| **Contributor lab** | `intent-solutions-io/intent-ops-buzz` | repo (**NOT a fork**) | reproducible test runner: self-host / fault / deployment conformance, PR evidence, IEP adapter, CI orchestration | **NO** | **NO** | | **Production host** | `intent-ops-buzz` | **VPS host** (NOT a repo) | the deployed prod relay | runtime secrets only | n/a | | **Live ops lane** | `intent-solutions-io/intent-os` path `ops/buzz/` | repo path | authoritative prod state: digest, deploy/backup/restore/monitor/promotion records, runbooks | **YES** (sops-encrypted) | n/a | -| **Deferred plugin** | `intent-solutions-io/intent-ops-buzz-plugin` | repo | operator plugin for the CCPI marketplace — **DEFERRED, out of scope now** | — | **NO** | - -The contributor lab and the deferred plugin repos **do not exist yet** — that is -correct. They are created only when their track opens (lab = Track C; plugin = -gauged from the real install cycle, owner call 2026-07-29). The personal fork -`jeremylongshore/buzz` is **retired** — all Buzz work lives under the org. - -## 3. The disambiguation rule (non-negotiable) -The production **host** and the contributor-lab **repository** share the string -`intent-ops-buzz`. **NEVER use the bare phrase.** Always write: +Every asset above **exists**. There are exactly two Buzz repositories — upstream +and the fork. The personal fork `jeremylongshore/buzz` is **retired**; all Buzz +work lives under the org. Two further repositories that earlier revisions of +this record reserved were never created and have been retired outright — see +*Revision 2026-08-07*. -- "`intent-ops-buzz` **production host**" (or "the prod host", "the Buzz VPS"), **or** -- "`intent-ops-buzz` **repository**" (or "the contributor lab"). +## 3. The three-plane flow -A bare `intent-ops-buzz` in any doc, commit, bead, or prompt is a defect — fix -it on sight. +Three planes sit between a candidate change and a running relay, and each does +exactly one job: the **Intent Eval Platform DECIDES** what the evidence means, +**Intent OS RECORDS** what is approved and running, and the **production host +RUNS** it. -## 4. The four-plane flow - -Each plane does exactly one job. The lab **executes** tests; the Intent Eval -Platform **decides** what the evidence means; Intent OS **records** what is -approved and running; the host **runs** it. +Upstream and the code fork are **not** planes — they are the SOURCE of +candidates, sitting upstream of the pipeline. The fork's job is the contribution +lane (`contrib/*` → PRs to `block/buzz`); it never decides, records, or runs. +Every box in the diagram is tagged with its plane, or with SOURCE where it has +none, so the mapping is not left to inference. ```text - block/buzz ◄──PR── intent-solutions-io/buzz (contribute: clean contrib/* branches) - │ candidate SHA - ▼ - intent-ops-buzz REPOSITORY (the lab) (EXECUTE: run tests, normalize evidence) - │ normalized gate-result/v1 evidence bundle + block/buzz ◄──PR── intent-solutions-io/buzz (SOURCE: clean contrib/* branches) + │ candidate SHA + gate evidence ▼ Intent Eval Platform (IEP) (DECIDE: evaluate / sign / gate) │ decision + evidence digest @@ -75,10 +93,12 @@ approved and running; the host **runs** it. └──────────────► back to intent-os ops/buzz (RECORD: deploy evidence) ``` -## 5. Two separate gates +## 4. Two separate gates A change that is safe to **submit upstream** is **not** automatically safe to -**deploy**. The lab produces evidence for both; IEP renders each verdict. +**deploy**. Evidence comes from upstream CI (`just ci`, the required checks on +`block/buzz`) plus this fork's own gates — additive-only, must-survive, +escape-scan, and the vendored audit harness. IEP renders each verdict. | Gate | Question | Verdicts | |---|---|---| @@ -89,27 +109,30 @@ The deployment gate adds everything the contribution gate does not check: Compose conformance, migrations, backup, restore, upgrade, rollback, persistence, monitoring, CORS, pairing, image scan. -## 6. Boundaries — what may and may not cross plane lines +## 5. Boundaries — what may and may not cross plane lines - **Secrets** live only in the ops lane (`ops/buzz/`, sops-encrypted) and as - runtime state on the production host. The code fork and the contributor lab - **never** hold secrets. Untrusted candidate / fork-PR code runs on - disposable, isolated runners with **no** prod credentials, **no** SSH, and - **no** Docker socket. The prod host is **not** a general-purpose PR runner. + runtime state on the production host. The code fork **never** holds secrets. + Untrusted candidate / fork-PR code runs on disposable, isolated runners with + **no** prod credentials, **no** SSH, and **no** Docker socket. The prod host + is **not** a general-purpose PR runner. - **The code fork stays rebase-clean:** IS additions are additive-only; internal - tooling never enters the fork unless it is deliberately proposed upstream. - A `contrib/*` branch must not add intent-only paths (`intent-os/`, `iep/`, - `evidence/private/`, `.env*`, `*.age`, `*.key`, `private/`, `internal/`). -- **The ops lane is the only ops authority.** Adding the contributor-lab - repository does **not** create a second ops repo — it is a distinct - *contribution + verification* plane. Prod state stays in `intent-os` - `ops/buzz/`. -- **IEP is reused, not rebuilt.** The lab depends only on the published - `@intentsolutions/core` schemas/validators and emits `gate-result/v1` - rows through the existing signing path; it does not re-implement evaluation - or signing. - -## 7. Relationship to the other fork docs + **product and ops** tooling never enters the fork unless it is deliberately + proposed upstream. **Fork-governance** tooling is the explicit exception — + `scripts/fork-gates/`, the vendored audit harness, and `lefthook-local.yml` + are *required* on governance `main` and are listed in `FORK.md`'s must-survive + table. A `contrib/*` branch must not add intent-only paths (`intent-os/`, + `iep/`, `evidence/private/`, `.env*`, `*.age`, `*.key`, `private/`, + `internal/`) — governance files included: the two lanes never mix. +- **The ops lane is the only ops authority.** Prod state — digests, deploy and + restore records, runbooks — lives in `intent-os` `ops/buzz/` and nowhere else. + No second ops repo is created for any reason. +- **IEP is reused, not rebuilt.** Anything that emits gate evidence depends only + on the published `@intentsolutions/core` schemas/validators and emits + `gate-result/v1` rows through the existing signing path; it does not + re-implement evaluation or signing. + +## 6. Relationship to the other fork docs - `001` (master blueprint) — the completion ledger and phase tree; reconciled to prod-up alongside this record. Where `001` named an asset loosely, this @@ -117,5 +140,6 @@ persistence, monitoring, CORS, pairing, image scan. - `005` (dedicated-VPS topology) — established the prod host as a dedicated VPS and the shared-host stack as permanent staging; this record names those assets precisely. -- The contributor-lab architecture (parked draft) graduates to a filed artifact - only in Track C, now that this naming record exists. +- The contributor-lab architecture draft is parked, not filed here — it lives in + the private ops lane at `intent-os` `ops/buzz/PLAN-contrib-lab-architecture.md` + as a DEFERRED plan. See *Revision 2026-08-07* for why. diff --git a/CLAUDE.md b/CLAUDE.md index 9ec9563a017..e06a6acacfa 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -1,17 +1,28 @@ # CLAUDE.md — intent-solutions-io/buzz (FORK — read this before anything) -> **Declared divergence.** Upstream `block/buzz` ships `CLAUDE.md` as a symlink to -> `AGENTS.md`. This fork replaces it with this file — one of exactly two declared -> divergences from upstream-owned paths (the other is -> `.github/workflows/fork-gates.yml`). Both are listed in `FORK.md`'s must-survive -> table and the fork-gate allowlist. +This file provides guidance to Claude Code (claude.ai/code) when working with +code in this repository. It covers **only** what is specific to this fork — +build, test, architecture, and all upstream conventions live in `AGENTS.md`, +which is upstream-owned and authoritative. Do not restate it here; it changes +under us. + +> **Declared divergence.** Upstream `block/buzz` ships `CLAUDE.md` as a symlink +> to `AGENTS.md`. This fork replaces it with this file — one of exactly two +> declared divergences from upstream-owned paths (the other is +> `.github/workflows/fork-gates.yml`). Both are listed in `FORK.md`'s +> must-survive table and the fork-gate allowlist. ## Read order (mandatory) -1. **`AGENTS.md`** — upstream's agent contributor guide. All upstream rules - (hermit activation, `just ci`, DCO `-s`, Nostr-first design law) apply - unchanged to all upstream code. -2. **`FORK.md`** — the fork contract. It governs everything this file summarizes. +1. **`AGENTS.md`** — upstream's agent contributor guide: repo structure, the + crate map, `just` recipes, event-kind/`h`-tag design law, desktop/mobile + rules, screenshot protocol, gotchas. All of it applies unchanged to all + upstream code. +2. **`FORK.md`** — the fork contract. It governs everything this file + summarizes. +3. **`000-docs/000-INDEX.md`** — the fork's own planning artifacts. + `006-DR-STND` is **canonical** for asset naming and plane boundaries; any + other doc naming a Buzz asset defers to it. ## The fork contract (binding — violations are defects) @@ -28,11 +39,44 @@ - **A deliberate carry requires a `CARRIED_PATCHES` entry** in `scripts/fork-gates/check-additive-only.sh` — it is **empty by design**, and the entry is removed the moment upstream merges the patch. -- **Run both fork gates before any PR:** - `scripts/fork-gates/check-additive-only.sh` and - `scripts/fork-gates/check-must-survive.sh`. The same checks run in CI - (`.github/workflows/fork-gates.yml`) as a **required check** on `main` — a PR - that modifies upstream-owned paths cannot merge. + +## Two branch lanes — never mix them + +| Lane | Branch | Contents | +|---|---|---| +| Fork governance | `main` (via PR) | Additive IS files only: `000-docs/`, `.beads/`, `FORK.md`, `TEST_AUDIT.md`, `scripts/fork-gates/`, vendored harness, the two declared divergences | +| Upstream contribution | `contrib/*` off this org fork | Real Buzz changes destined for `block/buzz`. DCO-signed, comment-first per upstream CONTRIBUTING. **Never** mixed with governance files | + +## Commands (fork-lane — these exist nowhere in AGENTS.md) + +```bash +# Fork gates — run BOTH before any PR. Same checks are a required CI check on +# main (.github/workflows/fork-gates.yml); the 2026-08-03 breach merged because +# they were local-only. +git fetch upstream main # gates diff against upstream/main +scripts/fork-gates/check-additive-only.sh # no upstream-owned path may differ +scripts/fork-gates/check-must-survive.sh # governance set intact — run after EVERY rebase + +# Vendored Intent Solutions audit harness (v1.3.1) — wired via lefthook-local.yml +scripts/audit-harness escape-scan --staged # pre-commit: secret / REFUSE-pattern scan +scripts/audit-harness verify # pre-push: .harness-hash pin check (exit 2 = TAMPERED) +scripts/audit-harness init # re-pin AFTER a reviewed edit to a pinned file +scripts/audit-harness list # what is currently pinned +``` + +`.harness-hash` pins the fork policy surface (`000-docs/*`, `FORK.md`, +`TEST_AUDIT.md`, `lefthook-local.yml`, both gate scripts). Editing any of them +without re-running `init` fails pre-push — that is the point, not a bug. + +`lefthook-local.yml` is merged with upstream's `lefthook.yml` by lefthook; +upstream's hooks are untouched. `just setup` / `just hooks` installs both. +Decision record for this wiring: `000-docs/004-DR-DECR-fork-gate-wiring.md`. + +**Upstream gate, unchanged** — activate hermit first (`. ./bin/activate-hermit`; +never rewrite hook commands to work around an unconfigured `PATH`), then +`just ci` before any PR, and commit with `git commit -s` (DCO is a required +check). Everything else — `just test`, `just relay`, `just desktop-screenshot`, +crate layout — is in `AGENTS.md`. ## What lives where @@ -40,6 +84,9 @@ `.beads/` prefix `buzz`, `FORK.md`, fork gates, vendored audit harness). - **NOT here, ever:** compose env, relay/owner/agent keys, member data, ingress config, runbooks, backups — those live in the private ops lane - (intent-os `ops/buzz/`). + (intent-os `ops/buzz/`). This repo is public by GitHub's fork rules. +- **Task state:** beads, prefix `buzz` (`bd ready`, `bd show `); `.beads/` + is on the must-survive list and its JSONL mirror is tracked. Mirror changes + with `bd-sync`, not raw `bd`. - Execution authority for the adoption program: `000-docs/001-PP-PLAN-buzz-adoption-master-blueprint.md`. diff --git a/FORK.md b/FORK.md index c80ec79508c..ea3d652b428 100644 --- a/FORK.md +++ b/FORK.md @@ -34,6 +34,7 @@ apply unchanged to all upstream code. | Path | Purpose | |---|---| | `FORK.md` | this contract | +| `REVIEW.md` | fork-specific guidance for the automated PR reviewer (contract, lanes, disclosure, severity) | | `000-docs/` | Intent Solutions planning artifacts (master blueprint, decision record, deploy posture) | | `.beads/` (tracked subset) | task tracking for the adoption program (prefix `buzz`) | | `TEST_AUDIT.md` | testing-SOP baseline audit | diff --git a/REVIEW.md b/REVIEW.md new file mode 100644 index 00000000000..26aaed4cee5 --- /dev/null +++ b/REVIEW.md @@ -0,0 +1,157 @@ +# REVIEW.md + +Repository-specific guidance for Kilo's automated pull-request reviewer. + +Catch defects, unsafe claims, and governance drift that CI cannot judge. Report only findings +introduced by the pull request and verify each against surrounding source. + +## Review objective + +This repository is **`intent-solutions-io/buzz`, a fork of `block/buzz`** — not a product of ours. +Buzz is Block's Rust relay for team chat; we run upstream published images, digest-pinned, and add +governance files on top. Read `CLAUDE.md` first, then `FORK.md`, then `AGENTS.md` (upstream-owned and +authoritative for all build, test, and architecture questions). + +The single highest-value thing you can catch here is a **fork-contract breach**. It has happened +once: PR #16 merged 14 upstream-owned paths onto fork `main` and had to be reverted. The audit is +`000-docs/007-AA-AUDR-fork-contract-breach-2026-08-03.md`. Read it before reviewing anything that +touches an upstream path. + +## The fork contract (the rule that outranks everything else) + +**This fork is ADDITIVE-ONLY.** `main` tracks upstream `main`. A PR that modifies an upstream-owned +path — code, workflows, lockfiles, docs, `.gitignore`, anything — is a **defect**, regardless of how +good the change is. Good changes go upstream; they do not land here. + +The machine form of the contract is the `ALLOW` array in +`scripts/fork-gates/check-additive-only.sh`; its human form is `FORK.md`'s must-survive table. The +two must stay in lockstep — **flag any PR that edits one without the other**. + +- Exactly **two** declared divergences from upstream-owned paths exist: `CLAUDE.md` (replaces + upstream's `AGENTS.md` symlink) and `.github/workflows/fork-gates.yml`. A PR proposing a third is + a **Critical** finding unless it also amends `FORK.md`, the gate allowlist, and states the + justification. +- `CARRIED_PATCHES` in the gate script is **empty by design**. An entry is a deliberate, temporary + carry of a fix upstream has not merged, and must name the upstream PR/issue and be removed on + merge. A populated `CARRIED_PATCHES` with no upstream reference is a **Critical** finding. +- Adding any **new** root-level or new-prefix file requires adding it to the gate allowlist *and* + `FORK.md`. A new file that is not on the allowlist fails the gate — if a PR adds one and the gate + is green, suspect the allowlist was widened silently. + +## Two branch lanes — never mix them + +| Lane | Branch | Contents | +|---|---|---| +| Fork governance | `main` (via PR) | Additive IS files only: `000-docs/`, `.beads/`, `FORK.md`, `REVIEW.md`, `TEST_AUDIT.md`, `scripts/fork-gates/`, the vendored harness, the two declared divergences | +| Upstream contribution | `contrib/*` | Real Buzz changes destined for `block/buzz`. DCO-signed, comment-first per upstream CONTRIBUTING | + +Mixing them is a finding in **both** directions: governance files on a `contrib/*` branch will be +rejected by upstream and leak internal planning into a public PR; upstream code changes on `main` +breach the contract. A `contrib/*` branch must never add intent-only paths (`intent-os/`, `iep/`, +`evidence/private/`, `.env*`, `*.age`, `*.key`, `private/`, `internal/`) or governance files. + +## Public-repo disclosure safety + +**This repository is public** — GitHub forks of public repos cannot be made private. Treat every +added line as published. + +Nothing estate-private belongs here, ever: compose environment files, relay/owner/agent keys, member +data, ingress configuration, hostnames-as-addresses, IP addresses, runbooks, backup configuration. +Those live in the private ops lane (`intent-os` `ops/buzz/`), which this repo points to and never +reproduces. Public-safe planning describes *shape* — asset names and pipeline structure — not +addresses or credentials. + +Never reproduce a suspected secret in a review comment; identify only its location and the required +remediation. The vendored harness runs an escape-scan pre-commit, but it is a pattern matcher, not a +judgment: a hostname or member name that no regex flags is still a disclosure finding. + +## Naming and authority + +`000-docs/006-DR-STND-authoritative-naming-and-boundaries.md` is **canonical** for asset naming and +plane boundaries. Any doc naming a Buzz asset defers to it; where another doc conflicts, `006` wins +and the other is corrected — flag the conflict rather than accepting the newer text. + +- `intent-ops-buzz` is a **VPS host**, not a repository. +- Exactly **two** Buzz repositories exist: upstream `block/buzz` and this fork. A PR that references + any other Buzz repository is asserting something untrue — flag it. Two repositories that earlier + revisions reserved were retired 2026-08-07 (`006` § *Revision 2026-08-07*). +- `000-docs/001-PP-PLAN-buzz-adoption-master-blueprint.md` is the standing execution authority; its + completion ledger is updated on every epic close. Flag ledger rows that contradict `.beads/` state. + +## Status and evidence integrity + +- Green CI proves only the checks that ran — not architecture, operational readiness, live + integration, owner approval, or production conformance. +- Documentation, closed work, or structural tests are not deployment. +- Flag unsupported terms such as "verified", "proven", or "production-ready" where no command, + drill, artifact, or receipt is named. Evidence names the command, the result, and the rollback. +- Historical records describe what was known then. Require a dated correction or successor entry + instead of rewriting them to fit today's narrative — `000-docs/` filing law and the append-only + discipline of audit records both depend on this. +- An upstream PR referenced as justification must have its **actual state** checked. "Upstream fixed + it" for an *open* PR is a false claim, and a cheap one to catch. + +## Gates that must stay green + +Both fork gates run in CI as the required check `fork-contract` +(`.github/workflows/fork-gates.yml`): + +``` +scripts/fork-gates/check-additive-only.sh # no upstream-owned path may differ +scripts/fork-gates/check-must-survive.sh # the governance set is intact +``` + +The vendored Intent Solutions audit harness pins the fork policy surface (`000-docs/*`, `FORK.md`, +`TEST_AUDIT.md`, `lefthook-local.yml`, both gate scripts) in `.harness-hash`: + +- `scripts/audit-harness escape-scan --staged` — pre-commit secret / REFUSE-pattern scan +- `scripts/audit-harness verify` — pre-push pin check; **exit 2 = TAMPERED** +- `scripts/audit-harness init` — re-pin, only *after* a reviewed edit to a pinned file + +A PR that edits a pinned file **must** re-pin in the same PR. A PR that re-pins without a +corresponding reviewed content change is the inverse smell — flag it and ask what drifted. + +Upstream's own gate is unchanged and applies to any `contrib/*` work: activate hermit +(`. ./bin/activate-hermit`), run `just ci`, and commit with `git commit -s` (DCO is a required +check). Never rewrite a hook command to work around an unconfigured `PATH`. + +## Beads + +Task state lives in beads (prefix `buzz`); `.beads/issues.jsonl` is the tracked portable mirror, and +the authoritative history is the local Dolt database. Change beads through `bd`/`bd-sync`, never by +hand-editing the JSONL. Flag manual JSONL edits, bulk regeneration, or a bead closed in the mirror +with no evidence in its reason. + +## Severity calibration + +- **Critical:** an upstream-owned path modified on `main`; a third declared divergence added without + amending `FORK.md` and the gate allowlist; any credential, key, member datum, hostname-as-address, + or estate-private configuration committed to this public repo; a `CARRIED_PATCHES` entry with no + upstream reference; a false claim about production or upstream state that could authorize unsafe + action. +- **Warning:** governance and contribution lanes mixed; gate allowlist and `FORK.md` drifted apart; a + pinned file edited without a re-pin; a canonical-record conflict left unresolved; an unsupported + "verified"/"production-ready" claim; a ledger row contradicting `.beads/` state; a doc naming a + repository that does not exist. +- **Info:** a concrete maintainability or documentation improvement with real future cost. Use + sparingly, never for personal preference. + +Do not flag formatting-only differences or failures already enforced and reported by tooling. +Severity follows credible impact, not file importance. **Docs-only does not mean low risk here** — +`000-docs/` holds the canonical naming record and the standing execution authority, and a wrong +statement in either propagates to every session that reads it. + +## Scope discipline + +Most PRs on this fork are governance and documentation, and are small. Review what the PR changed. +Pre-existing drift in unmodified lines is worth *one* note with a suggested deferral, not a demand +that the PR grow — a naming-cleanup PR is not the place to reconcile production status. + +## Comments and summary + +Comment on an exact changed line only when actionable. Inspect enough context to prove the issue; do +not post speculative or duplicate findings. Explain the impact and the smallest safe correction. + +Summarize which lane the PR is in (governance `main` vs `contrib/*`), whether the fork contract +holds, what the gates actually proved, and any disclosure risk. If no actionable finding remains, +respond with `lgtm` and nothing else. diff --git a/scripts/fork-gates/check-additive-only.sh b/scripts/fork-gates/check-additive-only.sh index 8f4f22fe7c8..aac2233b9e6 100755 --- a/scripts/fork-gates/check-additive-only.sh +++ b/scripts/fork-gates/check-additive-only.sh @@ -22,6 +22,7 @@ fi # human contract; this array is its machine form). ALLOW=( "FORK.md" + "REVIEW.md" "TEST_AUDIT.md" "000-docs/" ".beads/" diff --git a/scripts/fork-gates/check-must-survive.sh b/scripts/fork-gates/check-must-survive.sh index 62d6e522a08..630b689f303 100755 --- a/scripts/fork-gates/check-must-survive.sh +++ b/scripts/fork-gates/check-must-survive.sh @@ -10,6 +10,7 @@ cd "$(git rev-parse --show-toplevel)" MUST_SURVIVE=( "FORK.md" + "REVIEW.md" "TEST_AUDIT.md" "000-docs/000-INDEX.md" "000-docs/001-PP-PLAN-buzz-adoption-master-blueprint.md"