feat(desktop): list private known Desktops

[loganj]

Current verification — September 4

Exact-head CI SUCCESS, attempt 2: https://github.com/block/buzz/actions/runs/33891105430 . PostgreSQL 380/380 selected tests passed; status smoke and workflow smoke recovered on the same-head rerun. Workflow target passed on Playwright retry #2; the workflow shard had eight recovered flaky cases. No source changes or weakened guards. Earlier local/pending evidence below is historical. Live two-Desktop acceptance remains unperformed; this remains a draft, not a merge or deployment claim.

Summary

Adds a private Known Desktops list to Agents, with generated names and stable, owner/community-scoped installation identities. Startup and reconnect reconcile the local profile independently of the bounded inventory. The UI distinguishes this Desktop, partial results, and failed refreshes without interpreting saved profiles as online or ready to run agents.

• Persist one signed, self-encrypted kind 30180 profile before publication; retries reuse the exact bytes, including after a long offline first launch.
• Authenticate and decrypt records natively before display; fence owner/community/transport changes and retain same-scope rows on refresh failure.
• Admit old Desktop profiles at the shared ingest boundary while retaining future-time, signature, author, envelope, and other-kind checks. Exclude profile ciphertext from full-text indexing.

Display-only: no hostnames, enrollment, credentials, capability reporting, execution authority, or remote controls. This draft is based directly on main; freshness and capability UI are separate follow-ups. The larger size of this initial slice has owner approval. No existing PR/issue was found for this scoped private Desktop inventory.

Validation

• Six frontend coordinator/render/mounted-cache tests pass using direct existing tools (native IPC and transport mocked). After updating the stale signed-integer source assertion to match the unsigned ingest constant, the reconnect replay suite passes 35/35; the future-tolerance value remains 900 seconds.
• Rust: core 256 passed; DB 122 passed / 252 ignored; bridge 64 passed / 8 ignored; REQ 55 passed; focused Desktop fanout and age-window tests each passed. Relay test target compiles, including the production-ingest regressions. Clippy passes for core/DB/relay, all targets, with warnings denied.
• Formatting, changed-file Biome, Desktop differential file-size, and PostgreSQL test-discovery checks pass.
• PostgreSQL regressions are included for the actual authenticated HTTP/WS owner+kind queries, private storage, and aged production ingestion. They are discoverable by the normal CI PostgreSQL/Redis lane; not run locally (no local database provisioning).
• Local TypeScript check is not clean: eight errors in unchanged status/calendar code, including missing react-day-picker in the reused dependency cache. Native validation remains blocked by unavailable sherpa-onnx download in the offline environment. No native two-Desktop acceptance or screenshot is claimed.

Before leaving draft: exercise two native Desktops with the same owner/community, offline first launch/reconnect, restart identity stability, disconnect retention, and owner/community switching. CI results do not replace that acceptance.

Validation update at 329554051b04e3d9d46e009067dc7d58bcee7711: only the stale test assertion changed from the previously tested production source. Normal exact-head CI is pending; no blanket green claim.

Migration

Migration 0045 excludes the new kind from the generated FTS expression and recreates its GIN index. Like the prior FTS migration, it rewrites events under ACCESS EXCLUSIVE; plan the deployment window accordingly. No migration or runtime deployment was performed while preparing this draft.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is cd02b693aae86444b0b5636474a3d202c6fc8f26...329554051b04e3d9d46e009067dc7d58bcee7711.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 329554051b04e3d9d46e009067dc7d58bcee7711 to authorize a new review.
Any previous review applies only to its recorded range.

[loganj]

Final-head validation disposition

Head 329554051b04e3d9d46e009067dc7d58bcee7711, unchanged base cd02b693aae86444b0b5636474a3d202c6fc8f26. The named aged-profile exact-byte retry and authenticated private profile HTTP/WS query/storage regressions actually executed and passed in PostgreSQL job 101091035511. Desktop Core and relay integrations passed. The historical full run remained red; passing target tests alone was not used to waive it.

Bounded diagnosis of the three failed jobs:

• Status smoke fixture: saved retry trace places actual dialog-opening click 95 ms after the fixture expired. It opens a new Today draft, not the intended existing expiring draft. Follow-up: controlled browser clock, assert the intended existing draft before expiry, then advance time; retain original preservation/alert/save assertions.
• Workflow smoke: geometry samples occur during inspector width/translation animation, before the existing animation wait. The final retry instead reopens incomplete YAML: trigger text contains the helper's step text, while the send-message step has no text. The helper's unscoped Message text locator can target the outgoing trigger editor during its exit transition. Follow-up: settle/measure one frame; verify the new step editor before filling and assert the serialized trigger and step separately. Retry2 has no saved action trace, so its exact sequence is not claimed as proven.
• Replica-fence PG: initial probe rejects MaskedActivity { masked: 1 } before token rewind/epoch recovery. The fail-closed guard is correct to refuse unknown cluster activity; the log does not identify the offending row or exact visibility/lifecycle cause. Follow-up: DB fixture/replica-fence diagnostics and cluster isolation, not weakening the production guard.

The affected test/product sources and runner dependencies are unchanged versus the base in the inspected paths. Indirect scheduling effects are not excluded. These are separate maintenance follow-ups, not established Multiverse functional regressions or blanket flake waivers. CODEOWNERS identifies the repository maintainer team, not an assigned individual.

Requested failed-job rerun only, unchanged head, attempt 2: https://github.com/block/buzz/actions/runs/33891105430 . Terminal outcome will be recorded separately. No source changes or merge performed.

[loganj]

Final CI outcome

https://github.com/block/buzz/actions/runs/33891105430 attempt 2 completed SUCCESS on unchanged head 329554051b04e3d9d46e009067dc7d58bcee7711 and base cd02b693aae86444b0b5636474a3d202c6fc8f26.

The actual PostgreSQL job 101117686233 executed 380 selected tests: all passed, 1,445 skipped, including the previously failed replica-fence epoch regression and both named private-profile/aged-retry regressions. Status smoke job 101117681166 and workflow smoke job 101117681105 now succeed. The status shard included recovered flaky cases; this is a successful check outcome, not a claim of universally deterministic tests.

No source changes or assertion/production guard weakening were used. The earlier maintenance diagnoses remain recorded; a passing rerun does not explain the original masked row or repair the fixture races. Existing native/Core and relay integration successes remain valid. Maintainer review and a live two-Desktop acceptance walkthrough remain distinct gates; no merge, live migration or deployment performed.

[loganj]

Qualification to the successful rerun: the workflow target itself passed on Playwright retry #2 (the first two attempts failed); the shard finished with 326 passed and 8 recovered flaky cases. Its timing/locator maintenance follow-up remains open. Green CI here is not a claim that the workflow test was repaired.