feat(core): project Multiverse placement in signed event order

[loganj]

Summary

First foundational slice of the updated Multiverse design, replacing—not extending—the obsolete exact-run preview in #7145. 450 added lines, four files, based directly on current main b1f6b7ef770dddbb7f33c9f5861c379a47bca1d6. No old PR is rewritten or closed; #7140 and #7151 are separate baseline repairs, not dependencies.

buzz_core::placement projects desired placement and per-host intent from the relevant valid events for one scoped agent:

• Newer signed created_at wins; lower event ID wins timestamp ties. Arrival time never decides.
• Stop X preserves desired Y and Y's unchanged Start token, including reordered backfill.
• Stop of the latest desired host clears placement without resurrecting an earlier host.
• A stale launch continuation loses its token; duplicate intent does not change projection.

This proves the uncertain projection semantics without enabling incomplete remote effects. It is not a command executor, auth adapter, durable dedup journal, or implementation of Restart/Move. There are no runtime consumers yet. Inputs must be authenticated, decoded and scope-checked by the subsequent transport adapter; the helper does not confer authority. No relay sequencing, clock-skew gate, lease, special replay or stronger Stop proof is introduced.

Design and dependencies

Approved design sections 5.2 and 7.1; locally verified SHA-256 46724375f9913a7da96caabaf2020433e2b06fa8bb2f5f4879e30410f8188f9a.
Owner implementation authorization / source channel.

Base: main; head: work/multiverse-01-order-b4f2fd6c. Next PR stacks on this branch and binds a versioned authenticated intent codec to the projection. In particular, old destination-only ciphertext cannot let X learn Start Y: authorized multi-host visibility must be solved without receiver-specific order or widening private disclosure. Then private transport/history, automatic profiles/inventory, durable admission/retention, ordinary local controls and current-host Restart, remote intake/results, typed keyless integration, Move, UI/observations and acceptance follow in bounded slices. Detailed API boundary is in docs/multiverse-placement.md.

Broker #6742 is merged; #6922 and #6967 remain proposed, and #6967 has changes requested. This PR depends on neither unmerged broker branch and does not claim keyless runtime integration. The owner-approved Desktop-host design accepts partition overlap and forbids key export, unlike the older remote-provider vision's single-instance/key-handoff language.

Validation — exact head 46323b421888a45dcec687e784545d295f89145e

Clean tracked/untracked worktree before and after final checks:

• Full buzz-core: 264 unit tests + 2 doc tests pass, none ignored.
• Nine placement regressions include 1,440 full permutations, every partial prefix and duplicate full sets, checked against an independent signed-order transition model. Also targeted Stop isolation/no fallback, stale continuations, same-second ties and future-clock cases.
• Three negative controls fail as expected: reverse ID tie order, let Stop cross host boundaries, ignore the newer Stop fence. Source restored and full suite rerun afterward.
• cargo clippy -p buzz-core --all-targets --all-features -- -D warnings: pass.
• Workspace cargo fmt --all -- --check, repository differential file-size gate (including ten policy tests), and git diff --check: pass.

All Cargo runs used the committed lockfile and existing Hermit cache offline, compiling this worktree's actual source. Full just ci is blocked, not passed: workspace Clippy requires uncached aes 0.8.4; offline mode prevents download. The run stopped there, before broader packages/frontend/mobile. No dependency installation or service/configuration changes were authorized or performed. Required remote CI remains a gate; package checks do not replace it.

Review / limitations

Draft; do not merge or mark ready automatically. Independent review should focus on equivalence of the two-scan reducer to signed chronological transitions, Stop isolation/no fallback, unchanged-target tokens, tie direction and non-authorizing API boundaries. No native app, remote lifecycle, bounded-retention, privacy transport or end-to-end acceptance is claimed. Presence is not stopped proof; same-second races, clock skew and potentially unbounded partition overlap remain accepted limits.

[github-actions]

🔐 Codex Security Review

Note: This is an automated, security-focused review generated by Codex.
Use it as a supplement to human review; false positives are possible.

Scope

• Exact PR diff: b1f6b7ef770dddbb7f33c9f5861c379a47bca1d6...46323b421888a45dcec687e784545d295f89145e
• Model: gpt-5.6-sol

💡 Click "edited" above to see earlier reviews for this PR.

---

Review Summary

Overall Risk: NONE

No concrete security, correctness, or reliability findings. The new projection is unused by runtime paths and its ordering and stop/start semantics are internally consistent.

Findings

No concrete security, correctness, or reliability findings were identified.

Notes

• Static read-only review only; tests and builds were not executed as required.

---

_{Generated by Codex Security Review |
Requested by: @loganj |
Workflow run}

[loganj]

@buzz-security-review 46323b4

[loganj]

Independent delegated technical review of b1f6b7ef770dddbb7f33c9f5861c379a47bca1d6...46323b421888a45dcec687e784545d295f89145e (all four changed files, 450 additions). No blocking finding in the zero-I/O ordering foundation. This is a scoped technical review comment, not an approving GitHub review or runtime acceptance.

• placement.rs:37–42,98–115,122–144: max signed sender timestamp, then lower event ID, selects the latest Start. Only a later Stop for the queried host supersedes its target state. Consequently Stop X preserves desired Y and the exact Y Start token, while Stop Y clears desired placement without falling back to X. Newer selections and target Stops reject old placement continuation tokens; duplicates and lower-ranked backfill do not renew them.
• The two-scan projection matches chronological semantics: the latest Start overwrites all earlier selections; afterward only each target’s own Stop can alter that target. Empty/Stop-only histories remain non-launching. Same-second ties and future-clock dominance are intentional accepted policy, not receiver-order guarantees.
• Tests exercise the production projection using signed/verified fixtures, distinct-time and tied permutations, partial histories, duplicates, no resurrection, unchanged-target tokens, and same-host reselection. Reused exact-head author records for 264 unit + 2 doc tests, package Clippy, formatting and three falsifying mutations; no redundant full suite. Independently rechecked clean source, remote head/base and diff whitespace.
• Boundary remains explicit: from_event extracts fields without authentication; public intents must bind order/host/action to the same verified, authorized, scope-matched event. No production callsites exist yet. History completeness, durable one-shot admission, restart/move guards and effect-boundary authorization remain consumer obligations, not capabilities supplied by retains_start. No downstream implementation is required in this foundation diff.

Gate caveats: local full just ci is NOT passed (offline uncached aes 0.8.4); remote CI 33864580930 and Docker 33864580724 are still active. The exact-range security workflow was explicitly authorized by the documented command and run 33864856544 is reviewing; dispatch is not a result. PR remains draft, with required maintainer/code-owner approval outstanding. This delegated reviewer uses the existing loganj account (also the author), so this comment must not be counted as independent-account approval.