fix(acp): safely route verified direct replies

[bgx4k3p]

Summary

• deliver bounded unmentioned reply candidates in both mentions and config subscription modes
• accept a direct reply only after verifying the child signature and its signed immediate parent, agent authorship, and same-channel binding
• preserve ordered config rules while waiving only the mention predicate for a verified reply
• retain owner/sibling DM authorization and drop unrelated unmentioned shared-channel traffic

Safety and liveness

• re-authorize the effective listener/workflow author after bounded background classification
• distinguish Matched, NoMatch, and FailedClosed so filter failures cannot widen into later rules
• fail closed on malformed events and parent lookup failure/timeout; non-agent parents receive at most one ordinary fallback classification
• cap the recent-parent cache at 4,096, parent lookups and signature verifications at 8 each, and deadlines at two seconds
• service validated replies after at most 32 relay events and reject stale subscription generations

Tests

• cargo test -p buzz-acp: 932 unit + 9 lifecycle tests passed
• cargo clippy -p buzz-acp --all-targets -- -D warnings
• cargo fmt --all -- --check
• git diff --check

The production backport remains separately pinned to the deployed relay source; this PR targets current upstream main.

[ScaleLeanChris]

Tested commit 1999b2f10 on macOS arm64 with the repository Hermit toolchain:

• cargo test -p buzz-acp: 671 unit tests and 9 lifecycle integration tests passed
• cargo fmt --all -- --check: passed
• cargo clippy -p buzz-acp --all-targets -- -D warnings: passed

I also reviewed the application gate after the relay-side mention filter is widened. Top-level unmentioned chatter avoids the REST lookup, while parent lookup fails closed on lookup errors, missing or malformed parents, ID or signature mismatch, a different author, and a cross-channel parent. The behavior looks sound.

Non-blocking coverage suggestion: add explicit invalid-signature and cross-channel-agent-parent tests. Those are important stated invariants and easy to regress during a future refactor.

[Chessing234]

is_direct_reply_to_agent runs inline on the harness event loop for every unmatched mentions-mode event with a parent tag, and each miss can sit up to 2s on REST. that stalls next_event and can drop real @mentions under channel traffic that used to never reach the harness.

short-circuit with a local recent-agent-event-id set (or move the parent check off the select loop) before paying REST on replies to everyone else?

[bgx4k3p]

Good catch. You're right that awaiting the parent REST lookup inline introduces head-of-line blocking in the harness event loop. I'll revise this so recently observed parent events are resolved from a bounded verified cache, while cache misses use bounded background verification rather than blocking next_event. I'll also add coverage showing a slow or failed lookup cannot delay a following explicit mention, plus explicit invalid-signature and cross-channel-parent tests.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is b1f6b7ef770dddbb7f33c9f5861c379a47bca1d6...fb438025a5ee2aa53ce81eacb7ed25c2e40b8434.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review fb438025a5ee2aa53ce81eacb7ed25c2e40b8434 to authorize a new review.
Any previous review applies only to its recorded range.