Merge remote-tracking branch 'origin/main' into wpfleger/desktop-admin-surface

* origin/main:
  fix(desktop): back split thread headers (#7137)
  add public descriptions to agent personas (#7126)
  feat(desktop): add protected-build Bestie experiment (#6902)
  fix(relay): reject a frame on its own acknowledgement channel (#6961)
  fix(acp): wake agents from workflow messages (#6953)
  feat: render agent avatars as squircles (#7106)
  fix(ci): salvage Codex review output on PTY-shutdown hang (#7042)
  fix: retrieving cold memories; add regression task (#6950)
  Enforce NIP-OA authorization time bounds (#7004)
  feat(db): configurable writer session timeouts (lock, idle-txn, statement) (#6229)
  feat(desktop): use segmented controls for channel creation (#6845)
  feat(buzz-agent): surface stop reason and silent-turn WARN in telemetry (#7038)
  fix(desktop): surface channel history load failures (#7013)
  fix(composer): polish automatic mentions (#6956)
  fix(desktop): resolve bundled sidecar on cheap path and bound login-shell spawns (#6904)
  perf(mobile): reduce cold startup and channel rendering delays (#6996)
  feat(mobile): push notifications MVP (#6269)

Signed-off-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>

Author: Duncan

.env.example

@@ -38,6 +38,21 @@ REDIS_URL=redis://localhost:6379
 # READ_DATABASE_URL is set, reader (default 50).
 # BUZZ_DB_POOL_SIZE=50
 
+# Writer-session Postgres timeouts for buzz-db-backed pools and the relay audit
+# pool, all in milliseconds; 0 disables. The separately deployed push gateway
+# owns its own database and session policy and does not consume these knobs.
+# lock_timeout: fail a statement that waits this long on any lock instead of
+# parking behind a wedged holder (default 5000).
+# BUZZ_DB_LOCK_TIMEOUT_MS=5000
+# idle_in_transaction_session_timeout: reap sessions idle inside an open
+# transaction — bounds how long a wedged client can hold locks (default 60000).
+# BUZZ_DB_IDLE_TXN_TIMEOUT_MS=60000
+# statement_timeout: cap any single statement's runtime. Off by default —
+# startup migrations/backfills legitimately run long statements. Warning: a
+# pathologically low value (e.g. 1) also times out connection setup and can
+# prevent any DB connection from establishing.
+# BUZZ_DB_STATEMENT_TIMEOUT_MS=0
+
 # -----------------------------------------------------------------------------
 # Typesense (search)
 # -----------------------------------------------------------------------------
@@ -59,6 +74,12 @@ RELAY_URL=ws://localhost:3000
 # (use `just web` for Vite HMR instead).
 # BUZZ_WEB_DIR=./web/dist
 
+# NIP-PL mobile push is an explicit deployment opt-in. A gateway URL alone
+# never enables it. When enabled and the URL is absent, the canonical
+# https://push.buzz.xyz/v1/deliveries/apns endpoint is used.
+BUZZ_PUSH_ENABLED=false
+# BUZZ_PUSH_GATEWAY_DELIVERY_URL=https://push.buzz.xyz/v1/deliveries/apns
+
 # -----------------------------------------------------------------------------
 # Admin Dashboard (private moderation surface)
 # -----------------------------------------------------------------------------
@@ -253,6 +274,10 @@ RUST_LOG=buzz_relay=debug,buzz_datastore=info,buzz_db=debug,buzz_auth=debug,buzz
 # app launch while keeping the current identity and relay data.
 # VITE_BUZZ_FORCE_FRESH_ONBOARDING=true
 
+# Protected internal builds only: selects the module graph that contains the
+# default-off Bestie experiment. Official OSS builds must leave this unset.
+# VITE_BUZZ_BESTIE=1
+
 # ── Subscription & filtering ─────────────────────────────────────────────────
 # Subscribe mode: "mentions" (default), "all", or "config" (rule-based).
 # BUZZ_ACP_SUBSCRIBE=mentions

.github/workflows/ci.yml

@@ -304,7 +304,7 @@ jobs:
     name: Desktop
     runs-on: ubuntu-latest
     timeout-minutes: 5
-    needs: [changes, desktop-core, desktop-smoke-e2e]
+    needs: [changes, desktop-core, desktop-smoke-e2e, desktop-windows-build]
     if: always() && (github.event_name == 'push' || needs.changes.outputs.desktop == 'true' || needs.changes.outputs.desktop-rust == 'true' || needs.changes.outputs.rust == 'true')
     permissions:
       contents: read
@@ -319,6 +319,10 @@ jobs:
             echo "Desktop Smoke E2E shards finished with: ${{ needs.desktop-smoke-e2e.result }}"
             exit 1
           fi
+          if [ "${{ needs.desktop-windows-build.result }}" != "success" ]; then
+            echo "Desktop Windows Build finished with: ${{ needs.desktop-windows-build.result }}"
+            exit 1
+          fi
           echo "Desktop jobs passed"
 
   desktop-e2e-relay:
@@ -380,6 +384,7 @@ jobs:
             -p buzz-relay \
             -p buzz-test-client \
             --lib \
+            --bin buzz-relay \
             --test e2e_event_reminder \
             --archive-file target/ci/backend-integration-tests.tar.zst
       - name: Save relay artifacts cache
@@ -684,6 +689,18 @@ jobs:
           VALUES ('00000000-0000-4000-8000-00000000c0de', 'localhost:3000')
           ON CONFLICT (lower(host)) DO NOTHING
           ;"
+      - name: Workflow message provenance tests
+        # The relay's workflow_sink suite is not selected by the infra-free
+        # unit job. Run both its pure tests and ignored PostgreSQL tests here so
+        # authored-template provenance cannot regress behind a green CI build.
+        run: |
+          cargo nextest run \
+            --archive-file target/ci/backend-integration-tests.tar.zst \
+            -E 'package(buzz-relay) and test(/workflow_sink/)' \
+            --run-ignored all
+        env:
+          DATABASE_URL: postgres://buzz:${{ env.BUZZ_TEST_POSTGRES_PASSWORD }}@localhost:5432/buzz
+          TEST_DATABASE_URL: postgres://buzz:${{ env.BUZZ_TEST_POSTGRES_PASSWORD }}@localhost:5432/buzz
       - name: Replaceable persistence PostgreSQL tests
         # Transaction, concurrency, and mention-index coverage for the
         # replaceable-event store seam. These tests require real Postgres and
@@ -709,6 +726,31 @@ jobs:
         env:
           DATABASE_URL: postgres://buzz:${{ env.BUZZ_TEST_POSTGRES_PASSWORD }}@localhost:5432/buzz
           TEST_DATABASE_URL: postgres://buzz:${{ env.BUZZ_TEST_POSTGRES_PASSWORD }}@localhost:5432/buzz
+      - name: Writer session timeout guardrails
+        run: |
+          cargo nextest run \
+            --archive-file target/ci/backend-integration-tests.tar.zst \
+            -E 'package(buzz-db) and test(session_timeouts_install_through_db_new_and_bound_lock_waits)' \
+            --run-ignored ignored-only
+        env:
+          DATABASE_URL: postgres://buzz:${{ env.BUZZ_TEST_POSTGRES_PASSWORD }}@localhost:5432/buzz
+          TEST_DATABASE_URL: postgres://buzz:${{ env.BUZZ_TEST_POSTGRES_PASSWORD }}@localhost:5432/buzz
+      - name: Audit writer session timeout guardrails
+        run: |
+          cargo nextest run \
+            --archive-file target/ci/backend-integration-tests.tar.zst \
+            -E 'package(buzz-relay) and test(audit_writer_pool_installs_timeouts_and_bounds_advisory_lock_waits)' \
+            --run-ignored ignored-only
+        env:
+          DATABASE_URL: postgres://buzz:${{ env.BUZZ_TEST_POSTGRES_PASSWORD }}@localhost:5432/buzz
+      - name: Audit worker lock-timeout recovery
+        run: |
+          cargo nextest run \
+            --archive-file target/ci/backend-integration-tests.tar.zst \
+            -E 'package(buzz-relay) and test(audit_worker_retries_lock_timeout_until_original_entry_is_appended_once)' \
+            --run-ignored ignored-only
+        env:
+          DATABASE_URL: postgres://buzz:${{ env.BUZZ_TEST_POSTGRES_PASSWORD }}@localhost:5432/buzz
       - name: Start relay
         run: |
           chmod +x ./target/ci/buzz-relay
@@ -1007,6 +1049,20 @@ jobs:
       - name: Build Android debug APK
         run: just mobile-build-android
 
+  mobile-swift:
+    name: Mobile Swift
+    runs-on: macos-latest
+    timeout-minutes: 10
+    needs: [changes]
+    if: needs.changes.outputs.mobile == 'true'
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - name: Build
+        run: swift build --package-path mobile/ios/BuzzPushKit
+      - name: Build release
+        run: swift build -c release --package-path mobile/ios/BuzzPushKit
+      - name: Test
+        run: swift test --package-path mobile/ios/BuzzPushKit
   security:
     name: Security
     runs-on: ubuntu-latest
@@ -1081,6 +1137,36 @@ jobs:
             -p git-credential-nostr \
             -p git-sign-nostr
 
+  desktop-windows-build:
+    name: Desktop Windows Build
+    runs-on: windows-latest
+    timeout-minutes: 20
+    needs: [changes]
+    if: github.event_name == 'push' || needs.changes.outputs.desktop == 'true' || needs.changes.outputs.desktop-rust == 'true' || needs.changes.outputs.rust == 'true'
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 24.14.1
+          package-manager-cache: false
+      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
+        with:
+          version: 11.4.0
+      - name: Install desktop dependencies
+        shell: bash
+        run: pnpm install --frozen-lockfile
+      - name: Build both protected-feature selections
+        shell: pwsh
+        run: |
+          Remove-Item Env:VITE_BUZZ_BESTIE -ErrorAction SilentlyContinue
+          pnpm -C desktop build
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          $env:VITE_BUZZ_BESTIE = "1"
+          pnpm -C desktop build
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
   windows-rust:
     name: Windows Rust (x86_64-pc-windows-msvc)
     runs-on: windows-latest

.github/workflows/codex-security-review.yml

@@ -214,7 +214,7 @@ jobs:
     if: needs.prepare-review.outputs.authorized == 'true'
     runs-on: ubuntu-latest
     environment: codex-review
-    timeout-minutes: 30
+    timeout-minutes: 40
     concurrency:
       group: codex-security-review-${{ needs.prepare-review.outputs.pr_number }}
       cancel-in-progress: true
@@ -228,7 +228,7 @@ jobs:
       REVIEW_REPOSITORY: review-target
       REVIEW_DIFF_FILE: .git/codex-review.diff
     outputs:
-      review_json: ${{ steps.run_codex.outputs.final-message }}
+      review_json: ${{ steps.salvage.outputs.review_json }}
     steps:
       - name: Checkout exact pull request head
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -287,6 +287,12 @@ jobs:
       # action's local proxy rather than entering the Codex subprocess.
       - name: Review pull request
         id: run_codex
+        # Codex CLI ≥0.149.x can leave a PTY descendant holding inherited stdio
+        # after the turn completes, stalling the action indefinitely. The output
+        # file is written before the hang, so a timeout here wastes at most 30
+        # minutes instead of the full 40, and the salvage step recovers the result.
+        timeout-minutes: 30
+        continue-on-error: true
         uses: openai/codex-action@86365089eb2b84e0a8fb0717b304f8bdcb13b20e # v1.12
         env:
           # Checkout and fetch are complete. Remove runner credentials from the
@@ -306,6 +312,8 @@ jobs:
           safety-strategy: drop-sudo
           permission-profile: ':read-only'
           working-directory: ${{ github.workspace }}/${{ env.REVIEW_CONTEXT }}
+          # Written before the hang; salvaged below if the step times out.
+          output-file: ${{ runner.temp }}/codex-review.json
           output-schema: |
             {
               "type": "object",
@@ -442,6 +450,51 @@ jobs:
             assumptions. Review only the authorized PR range and ground every finding
             in a changed hunk and a plausible failure or abuse path.
 
+      # Salvage the finished review whether the Codex step completed cleanly or
+      # timed out due to the PTY-shutdown hang. Prefer the action's final-message
+      # output (set on a clean exit); fall back to the output file written by the
+      # CLI before the hang. Fail the job only when neither source is available or
+      # the recovered JSON is not a valid review shape.
+      - name: Salvage review output
+        id: salvage
+        if: always()
+        env:
+          FINAL_MESSAGE: ${{ steps.run_codex.outputs.final-message }}
+          CODEX_OUTPUT_FILE: ${{ runner.temp }}/codex-review.json
+        run: |
+          json=""
+
+          # Prefer the action output set on a clean exit.
+          if [ -n "$FINAL_MESSAGE" ]; then
+            json="$FINAL_MESSAGE"
+            echo "source=action-output" >> "$GITHUB_STEP_SUMMARY"
+          elif [ -s "$CODEX_OUTPUT_FILE" ]; then
+            json="$(cat "$CODEX_OUTPUT_FILE")"
+            echo "source=output-file" >> "$GITHUB_STEP_SUMMARY"
+          else
+            echo "No review output from action or output file." >&2
+            exit 1
+          fi
+
+          # Minimal shape validation: non-empty JSON object with overall_risk.
+          if ! echo "$json" | python3 -c "
+          import sys, json
+          d = json.load(sys.stdin)
+          assert isinstance(d, dict), 'not an object'
+          assert 'overall_risk' in d, 'missing overall_risk'
+          "; then
+            echo "Review JSON failed shape validation." >&2
+            exit 1
+          fi
+
+          # Write as a multiline output (GitHub-safe delimiter).
+          EOF=$(dd if=/dev/urandom bs=15 count=1 2>/dev/null | base64)
+          {
+            echo "review_json<<${EOF}"
+            echo "$json"
+            echo "${EOF}"
+          } >> "$GITHUB_OUTPUT"
+
   post-review:
     name: Post Codex Security Review
     needs: [prepare-review, security-review]

.intersect/sadscan.yaml

@@ -2,3 +2,14 @@
 exclude_rules_for_files:
   sq.pii.cc.visa:
     - Cargo.lock
+  # Self-signed test fixture generated solely to exercise reqwest identity parsing.
+  kingfisher.privkey.2:
+    - "*apns-test-identity.pem"
+    - "*apns-test-key-only.pem"
+    - "*apns-test-encrypted-identity.pem"
+    - "*apns-test-mismatched-identity.pem"
+  np.pem.1:
+    - "*apns-test-identity.pem"
+    - "*apns-test-key-only.pem"
+    - "*apns-test-encrypted-identity.pem"
+    - "*apns-test-mismatched-identity.pem"