ci: prove the relay-driven mesh lifecycle — discover, join, infer, deny — with real nodes by michaelneale · Pull Request #3862 · block/buzz

michaelneale · 2026-07-31T06:06:47Z

Summary

CI now proves the full Buzz shared-compute join story end to end: a member can discover another member's served model through the Buzz relay alone and run inference over the mesh, while a non-member gets nothing — the relay rejects its auth, and the mesh refuses to route for it even holding a leaked endpoint address.

This is deliberately different from mesh-llm's own CI smokes (which bootstrap two nodes with a hand-carried invite token / mdns): here the relay is the control plane, exactly like the desktop app:

Membership — identities A and B are added via buzz-admin (kind:13534 NIP-43 roster); C is not.
Advertise — each member publishes a client-signed kind:30003 discovery note carrying its MeshLLM owner binding and (for the serve node) serveTargets[].endpointAddr, covered by an endpoint-binding signature — the exact payload shape the desktop coordinator publishes.
Trust — the serve node derives its admission allowlist from the relay (statuses ∩ roster) and requires the exact expected {A, B} owner-id set before starting with TrustPolicy::Allowlist.
Join — the client verifies owner + endpoint bindings and membership, then dials the relay-discovered endpoint (the desktop join-watcher's dial_endpoint_addr step). No out-of-band token.
Infer — a chat completion against the client's local OpenAI endpoint routes over QUIC to the serve node's model (CPU, SmolLM2-135M, ~105MB).
Deny (differential) — the stranger's NIP-42 auth must fail with the relay's own membership rejection (restricted: not a relay member — successful auth or any unrelated connect error fails the run), and dialing the leaked endpoint must not produce a routed inference — while the trusted client re-proves inference immediately afterwards, so a dead serve node can't masquerade as an admission denial.

What's in the PR

crates/buzz-relay/examples/mesh_relay_lifecycle_smoke.rs — the harness. One process per node (mesh-llm keeps process-global state under ~/.mesh-llm), orchestrator + serve/client/stranger roles, byte-identical binding payloads to desktop/src-tauri/src/mesh_llm/identity.rs (called out with keep-in-sync comments). Child stdout is pumped through a reader thread so every wait has a hard deadline; timed-out children are killed; exit statuses are checked.
scripts/ci-mesh-lifecycle-smoke.sh — provisions a membership-gated relay (throwaway owner + signing identities via buzz-admin generate-key), runs the harness, cleans up. Fails fast if :3000 is already occupied (a stale open relay would mask gating).
scripts/start-relay-for-tests.sh — gains opt-in NIP-43 membership env passthrough (BUZZ_REQUIRE_RELAY_MEMBERSHIP + RELAY_OWNER_PUBKEY + BUZZ_RELAY_PRIVATE_KEY). Default behavior unchanged.
.github/workflows/mesh-lifecycle.yml — separate, path-filtered, non-required workflow (mesh paths, the harness's dependency crates, Cargo.lock, dispatch), pinned to ubuntu-24.04. Caches the mesh native runtime + HF model keyed on the lockfile hash, so a mesh pin bump rolls the runtime cache. Uploads relay + harness logs on failure.

Scope

This is an independent protocol harness: it speaks the same wire protocol and payload shapes as the desktop but re-implements the binding/verification logic (the desktop crate is outside the workspace). Regressions inside the desktop's own discovery filtering are the desktop unit tests' job; what this smoke proves is that the relay + mesh-llm SDK + admission stack support the lifecycle end to end.

Relationship to mesh-llm's CI

Follows the shape mesh-llm's own CI proved stable (tiny CPU model, one runner, multiple real mesh-llm processes over real QUIC — cf. their ci-two-node-client-serving-smoke.sh), but swaps the token bootstrap for the relay-driven lifecycle, which is the part only Buzz can test.

Validation

Green on GitHub Actions (ubuntu-24.04) across three runs, including after rebases onto the mesh v0.74 upgrade (#3467) and latest main:

PASS 1/6: relay-derived allowlist is exactly {A, B}
PASS 2/6: serve member ready + advertised model: jc-builds/SmolLM2-135M-Instruct-Q4_K_M-GGUF:Q4_K_M
PASS 3/6: client member discovered + joined via relay
PASS 4/6: inference routed over the mesh: "PONG"
PASS 5/6: relay rejected the stranger's NIP-42 auth (membership gate)
PASS 6/6: stranger denied (gossip visible, inference rejected: 503 all tunnels failed) while trusted inference still routes
PASS: full relay-driven mesh lifecycle verified

Also validated locally on macOS. cargo fmt --all --check and cargo clippy -p buzz-relay --all-targets -- -D warnings pass.

Notes

The harness follows the repo's mesh [dev-dependencies] pin automatically, so it doubles as a canary for future mesh upgrades (it already caught the v0.73.1 → v0.74.0 bump during development).
The stranger "deny" accepts either shape mesh-llm exhibits: no model visibility at all, or gossip visibility with inference refused — mesh-llm applies the receiving node's owner policy after the gossip handshake, so admission gates routing, not gossip. The differential trusted-inference re-check (PASS 6/6) is what makes that a real denial rather than a dead server.
Model-visibility windows are tunable via MESH_CLIENT_WINDOW_SECS / MESH_STRANGER_WINDOW_SECS if shared runners prove slow — pin a longer window in the workflow env rather than re-running the job.

Chessing234 · 2026-07-31T08:09:15Z

cool ci. if the smoke is flaky on shared runners, maybe pin a longer join timeout in the workflow rather than retrying the whole job

micspiral · 2026-08-03T06:47:44Z

This is the right shape and it covers something nothing else does — relay-as-control-plane, with no out-of-band token. The membership/binding/admission half (phases 1–3, 6) is genuinely unique to Buzz and worth landing on its own merit. Also worth noting the stated draft gate is already met: Mesh Lifecycle has three green runs on Actions now.

I've spent the last few days chasing two shared-compute bugs to root cause (#3909, and Mesh-LLM/mesh-llm#1126 / #1129), so I wanted to write down where this harness would and wouldn't have caught them — and a concrete, cheap way to extend it. Take or leave any of it.

What it would not have caught today

I grepped the diff rather than going on impressions:

failure class	coverage in this PR
restart loop — supervisor reads busy as dead	`watchdog\|request_restart\|should_evict\|wait_for_mesh_inference` → 0 refs
reply never reaches a channel	`buzz-acp\|buzz-agent\|dev-mcp\|messages send\|tool_call` → 0 refs
preset env (`thinking_effort` etc.)	doesn't call `apply_relay_mesh_env`; the `desktop/` mentions are keep-in-sync comments citing `identity.rs`

That isn't a criticism of scope — it's that both bugs live in the timing and agent layers, and this harness deliberately sits below them. The inference phase is SmolLM2-135M (~105MB) answering "Reply with exactly one word: PONG". That combination loads and prefills fast enough that the node is essentially never unresponsive, so no timing bug can surface.

Suggestion 1 — a stalled-node phase (this is the cheap, high-value one)

The bug behind #3909 was that a node which is bound but HTTP-silent — loading weights, pulling layers, or mid-prefill — was read as dead and force-restarted the whole app. Measured on a live 26B node: tcp_connect stayed at 0.2ms while every HTTP endpoint (including a lock-free /health I'd added to a patched mesh build) timed out for ~21s.

The valuable insight for CI is that this is a timing bug, not a size bug. You don't need a big model or a GPU to reproduce it — you only need the node to stop answering HTTP while its port stays bound.

The harness already spawns and holds each node as a Child, so this is close to free:

// phase N: a busy/loading node must not be classified as dead
kill(serve_pid, SIGSTOP);
assert!(tcp_connect(api_addr).is_ok());          // port still bound -> alive
assert!(http_get(api_addr, "/v1/models").is_timeout());  // ... but silent
kill(serve_pid, SIGCONT);
assert!(http_get(api_addr, "/v1/models").is_ok());       // recovers

SIGSTOP gives exactly the supervisor-visible signature — listener open, backlog accepting, zero HTTP responses — deterministically, in seconds, on any runner, with no new dependencies.

One honest caveat: SIGSTOP freezes the QUIC/gossip stack too, whereas a genuinely busy node keeps those running. So it faithfully reproduces what the supervisor sees (which is what the watchdog keys on) but it is not a full simulation of a busy node. For this purpose I think that's the right trade.

If it's worth asserting the Buzz-side classification directly rather than just the wire behaviour, probe_mesh_ingress_at in desktop/src-tauri/src/mesh_llm/recovery.rs returns exactly Live / Unhealthy / PortClosed — though it's pub(crate) today, so that would need visibility widening or a duplicated probe. Wire-level asserts alone would still have caught the regression.

Suggestion 2 — a prose-only agent phase

The second failure was subtler: a small model answers in prose and never calls the send tool, so the turn ends outcome="ok" with nothing in the channel — a silent drop. #3763's reply guard now nags twice and rerolls, which helps, but by design it cannot compel a model that simply won't tool-call.

A deterministic stub is enough to pin the contract, and needs no model at all:

a stub ACP agent that only ever streams prose and never emits a tool call;
assert on relay state — read the event back with a different identity and correlate by e-tag.

Reading relay state is the part I'd push hardest. During my own testing the agent's self-report and the harness logs both told me a reply had landed when it hadn't; only an independent authenticated read was trustworthy.

On soak

Deliberately not suggesting soak in CI. The restart loop needs hours to surface naturally, which is hopeless for a PR gate — and it's already covered in real life: I've had the desktop app sharing a 26B model for 2 days 4 hours continuous with zero restarts on the post-#3909 build (previously it bounced within minutes of a cold 26B share). That's the right place for soak. CI's job is the deterministic version of the same failure, which is what Suggestion 1 buys.

Suggestion 3 — multi-node MoA, as a separate thing

Different question, worth separating: does routing to the virtual mesh model (VIRTUAL_MODEL_NAME in crates/mesh-mixture-of-agents, fan-out + reducer with early-exit) actually produce a measurably better answer than the best single node? That's a quality/lift question, not a correctness one.

My honest view is it doesn't belong in this workflow, or possibly in Buzz CI at all:

it needs ≥2 nodes hosting genuinely different models to mean anything (fan-out over one model measures nothing);
lift needs a scored task set and repeat runs — a pass/fail smoke can't express it;
it's inherently noisy, so as a required gate it would flake.

Better as either a mesh-llm-side benchmark (skippy-bench already has the chat-corpus scaffolding) or a periodic lab job on real multi-host hardware, reporting a trend rather than gating. What could live here cheaply is the far weaker but still useful assertion that model: "mesh" routes and returns across two nodes — correctness of the MoA path, not its intelligence.

Multi-host

Everything here is single-runner over loopback, which is right for CI. Real cross-host QUIC, real RTT and contention need actual separate machines and belong in a pre-release lab tier rather than a PR gate. Two things I'd carry over from doing that by hand: pin the model per node (an --auto node swapped models mid-run and voided a test for me), and verify what's actually running by content, not version string (I had three binaries all self-reporting the same version; only grepping the built artifacts distinguished them).

michaelneale · 2026-08-03T07:03:03Z

🤖 (from micn's agent) Good call — addressed in 4281774: the model-visibility windows are now tunable via MESH_CLIENT_WINDOW_SECS / MESH_STRANGER_WINDOW_SECS env vars, so a slow shared runner can pin longer windows in the workflow instead of retrying the whole job. The zizmor pin-comment mismatch is fixed in the same commit (checkout comment now names the exact tag v6.0.3). Mesh Lifecycle is green on that head: all 6 lifecycle assertions pass.

michaelneale · 2026-08-03T22:41:52Z

🤖 (from micn's agent) Thanks for the root-cause writeup — this is exactly the analysis we wanted. I ran your comment plus the harness internals past an independent expert review; summary of where we landed:

On "would it have caught #3909 / the prose-reply drop": agreed, no. Both live in layers this harness deliberately sits below (desktop supervisor timing; ACP agent behavior). No pushback there.

On Suggestion 1 (SIGSTOP stalled-node phase): we're not adding it to this PR, for a sharper reason than cost. The expert's key observation: before #3909, probe_mesh_ingress_at already returned Unhealthy for the bound-but-HTTP-silent signature — the broken part was the decision layer (Unhealthy streak ≥ 2 → evict → restart). So all three wire-level SIGSTOP assertions (TCP ok, HTTP timeout, recovers after SIGCONT) pass against both the broken and fixed implementations — they'd reproduce the signature without pinning the regression. The thing that pins it is should_evict_after_probe / supervisor behavior, and the post-#3909 unit tests in desktop/src-tauri/src/mesh_llm/recovery.rs already do that (including the streak logic and a black-box stalled listener). A SIGSTOP phase here would be green paint over coverage that already exists in the right layer. If we later want a "brief suspension + recovery" lifecycle phase for its own sake, the right slot is after the stranger exits and before the existing VERIFY_AGAIN recheck (never during a QUIC handshake), with waitpid(WUNTRACED) sync, a fresh HTTP connection, a SIGCONT-on-drop guard (a stopped child can't process the cleanup SIGTERM), and a 1–3s freeze to stay under peer-eviction timers. Happy to do that as a follow-up if you think the recovery unit tests leave a gap.

On Suggestion 2 (prose-only agent + independent relay read): agreed it's valuable, and it's a follow-up — partly because it first needs a product decision the test would encode: when an agent never tool-calls, is the contract auto-publish, an explicit failed outcome, or "reminder then send"? #3763's guard nags but can't compel; a stub test has to assert something specific. Your "read the event back with a different authenticated identity, correlate by e-tag" principle is the part we'll definitely keep — the expert independently flagged self-reports as untrustworthy for exactly the reason you hit.

On Suggestion 3 (MoA) and soak: agreed on both — MoA lift belongs in mesh-llm benchmarks or a periodic lab job; a cheap model: "mesh" routes-and-returns smoke could be a separate non-required workflow later; soak stays out of CI (your 2d4h live run is the right venue).

One more gap the expert added that's worth recording for follow-ups: the harness reimplements the binding/verification logic, so publisher and verifier could drift together and stay self-consistent while the desktop breaks — the keep-in-sync comments are the only guard. Extracting the pure binding/discovery logic into a shared crate both sides link would close that properly, and is probably the highest-value follow-up of all of these.

Scope of this PR stays as-is: the relay-as-control-plane lifecycle (phases 1–6). Follow-ups, roughly in value order: shared binding crate → prose-agent contract test → optional suspension/recovery phase → model: "mesh" routing smoke.

…inference, denial Run the full Buzz shared-compute join story in CI with three real mesh-llm node processes on one runner, using the Buzz relay as the control plane (no hand-carried invite tokens): 1. membership — A and B added via buzz-admin (kind:13534 roster); C is not 2. advertise — members publish client-signed kind:30003 discovery notes with owner + endpoint binding signatures (the exact payload the desktop coordinator publishes) 3. trust — the serve node derives its admission allowlist from the relay (statuses ∩ roster) and starts TrustPolicy::Allowlist 4. join — the client verifies bindings + membership and dials the relay-discovered endpoint 5. infer — chat completion routes client → QUIC → serve node (CPU, SmolLM2-135M) 6. deny — the stranger gets zero statuses from the membership-gated relay AND is refused mesh admission with the leaked endpoint Mirrors the shape mesh-llm's own CI uses for its two-node smokes (tiny CPU model, one runner, real QUIC mesh), swapping mdns/token bootstrap for the relay-driven lifecycle. start-relay-for-tests.sh gains opt-in NIP-43 membership gating env passthrough. Signed-off-by: Michael Neale <michael.neale@gmail.com>

- Stranger relay denial now requires the relay's own NIP-42 membership rejection ('not a relay member'); successful auth or any other connect failure fails the run instead of passing as denial. - Differential admission proof: after the stranger's attempt, the trusted client must still route inference (VERIFY_AGAIN over stdin), so a dead serve node can no longer masquerade as an admission denial. Stranger child exit status is also checked. - Allowlist gate now requires the exact expected {A, B} owner-id set (MESH_EXPECTED_OWNERS carries ids, not a count). - Hard deadlines everywhere: child stdout is pumped through a reader thread (recv_timeout), wait_child kills on timeout; outer dial retries reduced to 3 (mesh-llm already retries internally per attempt). - Workflow: pin ubuntu-24.04, trigger paths + cache key include Cargo.lock (mesh pin bumps roll the runtime cache), add buzz-admin/ test-client/ws-client paths, upload the harness log artifact too. - Scope note in the module docs: this is an independent protocol harness mirroring the desktop payloads byte-for-byte, not a link against desktop discovery code. Signed-off-by: Michael Neale <michael.neale@gmail.com>

…dows - zizmor ref-version-mismatch: actions/checkout comment now names the exact tag (v6.0.3) matching the pinned SHA. - Per review suggestion: model-visibility windows are tunable via MESH_CLIENT_WINDOW_SECS / MESH_STRANGER_WINDOW_SECS so slow shared runners can pin longer windows instead of re-running the whole job. Signed-off-by: Michael Neale <michael.neale@gmail.com>

* origin/main: (26 commits) fix(desktop): skip native notifications outside app bundles (#5004) ci: prove the relay-driven mesh lifecycle — discover, join, infer, deny — with real nodes (#3862) fix(desktop): virtualize channel member lists (#4991) fix(desktop): enforce owner-only access in internal builds (#4053) test(desktop): match attachment button label (#4993) fix(acp): pace observer telemetry at 1/s with per-channel batch envelopes (#4917) fix(desktop): enable the content security policy (#4614) fix(mobile): merge relay recounts with locally seen thread replies (#4633) fix(desktop): enable message editing in Inbox (#2198) relay: fuzz WebSocket 1012 restart-close timing on graceful drain (BUZZ_DRAIN_JITTER_MS) (#4542) fix(desktop): outline the selected community (#4969) fix(desktop): clamp thread panel to channel surface (#4965) style(messages): increase username contrast (#4948) fix(desktop): rename generic attachment action from 'Attach image' to 'Attach file' (#2381) (#4304) fix(reactions): support max-length custom emoji (#3833) feat(desktop): allow leaving your final community (#3621) fix(buzz-agent): recover from context-window 400s instead of sticking (#4946) docs(persona-pack): fix stale desktop import instructions (#4500) fix(desktop): route macos notification clicks (#4799) feat(mobile): sync themes per community (#3767) ... Co-authored-by: Eva <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz> Signed-off-by: Eva <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz>

…-agents-nav * origin/main: Refine agent runtime controls (#5026) test(desktop): await thread scroll anchor (#3174) Improve desktop mobile pairing flow (#5024) feat(desktop): show selected community in rail (#5000) fix(desktop): stop rate-limited reconnect backfill from tearing down the authenticated socket (#4990) fix(desktop): skip native notifications outside app bundles (#5004) ci: prove the relay-driven mesh lifecycle — discover, join, infer, deny — with real nodes (#3862) fix(desktop): virtualize channel member lists (#4991) fix(desktop): enforce owner-only access in internal builds (#4053) test(desktop): match attachment button label (#4993) fix(acp): pace observer telemetry at 1/s with per-channel batch envelopes (#4917) fix(desktop): enable the content security policy (#4614) Signed-off-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>

…n-surface * origin/main: (44 commits) fix(buzz-agent): classify read timeouts distinctly in LLM error messages (#4959) Refine agent runtime controls (#5026) test(desktop): await thread scroll anchor (#3174) Improve desktop mobile pairing flow (#5024) feat(desktop): show selected community in rail (#5000) fix(desktop): stop rate-limited reconnect backfill from tearing down the authenticated socket (#4990) fix(desktop): skip native notifications outside app bundles (#5004) ci: prove the relay-driven mesh lifecycle — discover, join, infer, deny — with real nodes (#3862) fix(desktop): virtualize channel member lists (#4991) fix(desktop): enforce owner-only access in internal builds (#4053) test(desktop): match attachment button label (#4993) fix(acp): pace observer telemetry at 1/s with per-channel batch envelopes (#4917) fix(desktop): enable the content security policy (#4614) fix(mobile): merge relay recounts with locally seen thread replies (#4633) fix(desktop): enable message editing in Inbox (#2198) relay: fuzz WebSocket 1012 restart-close timing on graceful drain (BUZZ_DRAIN_JITTER_MS) (#4542) fix(desktop): outline the selected community (#4969) fix(desktop): clamp thread panel to channel surface (#4965) style(messages): increase username contrast (#4948) fix(desktop): rename generic attachment action from 'Attach image' to 'Attach file' (#2381) (#4304) ... # Conflicts: # desktop/src-tauri/src/commands/mod.rs

Absorbs the relay half that shipped separately in #5133 (squash commit ad92335): the kind:30179 ingest acceptance hunk in crates/buzz-relay/src/handlers/ingest.rs was byte-identical on both sides, so this merge removes all relay-side changes from this PR's diff. #4999 now carries only the desktop + buzz-core codec half. No rebase, no force-push — history preserved per operator instruction. Co-authored-by: Tyler Longwell <tlongwell@block.xyz> Signed-off-by: Tyler Longwell <tlongwell@block.xyz> * origin/main: fix(bench): mention the orchestrator by pubkey when posting the task (#5136) feat(relay): accept kind:30179 private managed-agent events at ingest (#5133) fix(media): require authenticated reads (#4610) fix(desktop): preserve authoritative agent avatars (#4984) fix(desktop): next/back navigation during key creation onboarding (#4978) Alert community owners and admins when a new key joins (#4900) fix(desktop): prevent sidebar prefs from reverting on stale-localStorage boot (#5086) chore(hooks): run desktop typecheck in pre-push (#5110) feat(identity): recover desktop identity from a signed-in phone (#4845) fix(buzz-agent): classify read timeouts distinctly in LLM error messages (#4959) Refine agent runtime controls (#5026) test(desktop): await thread scroll anchor (#3174) Improve desktop mobile pairing flow (#5024) feat(desktop): show selected community in rail (#5000) fix(desktop): stop rate-limited reconnect backfill from tearing down the authenticated socket (#4990) fix(desktop): skip native notifications outside app bundles (#5004) ci: prove the relay-driven mesh lifecycle — discover, join, infer, deny — with real nodes (#3862) fix(desktop): virtualize channel member lists (#4991) Signed-off-by: Eva <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz>

…igration * origin/main: fix(bench): mention the orchestrator by pubkey when posting the task (#5136) feat(relay): accept kind:30179 private managed-agent events at ingest (#5133) fix(media): require authenticated reads (#4610) fix(desktop): preserve authoritative agent avatars (#4984) fix(desktop): next/back navigation during key creation onboarding (#4978) Alert community owners and admins when a new key joins (#4900) fix(desktop): prevent sidebar prefs from reverting on stale-localStorage boot (#5086) chore(hooks): run desktop typecheck in pre-push (#5110) feat(identity): recover desktop identity from a signed-in phone (#4845) fix(buzz-agent): classify read timeouts distinctly in LLM error messages (#4959) Refine agent runtime controls (#5026) test(desktop): await thread scroll anchor (#3174) Improve desktop mobile pairing flow (#5024) feat(desktop): show selected community in rail (#5000) fix(desktop): stop rate-limited reconnect backfill from tearing down the authenticated socket (#4990) fix(desktop): skip native notifications outside app bundles (#5004) ci: prove the relay-driven mesh lifecycle — discover, join, infer, deny — with real nodes (#3862) Signed-off-by: Brad Seiler <seiler@squareup.com> # Conflicts: # deploy/charts/buzz/templates/deployment.yaml # deploy/charts/buzz/tests/render_test.yaml # deploy/charts/buzz/values.schema.json # deploy/charts/buzz/values.yaml

## Buzz Relay release v0.2.1 ### Changes since relay-v0.2.0: - fix(sdk): preserve self-mention p tags in message and forum event builders ([#4975](#4975)) ([`78c87ae20e`](78c87ae)) - feat(desktop): adding rich link previews to messages ([#3818](#3818)) ([`1922d49cb2`](1922d49)) - feat(relay): accept kind:30179 private managed-agent events at ingest ([#5133](#5133)) ([`ad923353a2`](ad92335)) - fix(media): require authenticated reads ([#4610](#4610)) ([`769ac70b74`](769ac70)) - feat(identity): recover desktop identity from a signed-in phone ([#4845](#4845)) ([`6eb65919f1`](6eb6591)) - ci: prove the relay-driven mesh lifecycle — discover, join, infer, deny — with real nodes ([#3862](#3862)) ([`38bf642fcf`](38bf642)) - relay: fuzz WebSocket 1012 restart-close timing on graceful drain (BUZZ_DRAIN_JITTER_MS) ([#4542](#4542)) ([`e14fff74d0`](e14fff7)) - fix(reactions): support max-length custom emoji ([#3833](#3833)) ([`2ea9385015`](2ea9385)) - fix(channels): restrict private-channel invitations ([#4612](#4612)) ([`efe1893dd3`](efe1893)) - fix(workflow): bind trigger author to the signed event ([#4607](#4607)) ([`885bed35ee`](885bed3)) - fix(git): revoke access for banned relay members ([#4608](#4608)) ([`997b8caaa4`](997b8ca)) - Define private managed agent wire protocol ([#4593](#4593)) ([`067c085f37`](067c085)) - perf(relay): index channel-id lookups and skip trace-only reads ([#4647](#4647)) ([`bc9e6528a7`](bc9e652)) - Polish mobile inbox and media flows ([#4512](#4512)) ([`feccf4eabc`](feccf4e)) - fix(git): allow deleting the default branch ([#4297](#4297)) ([`fc598f5f8d`](fc598f5)) - feat(projects): add buzz projects CLI commands (NIP-MP kind:30621) ([#4020](#4020)) ([`b7bb15122e`](b7bb151)) - perf(relay): serve relay-membership checks from the read replica ([#4124](#4124)) ([`ac4fa13b8e`](ac4fa13)) - fix(relay): allow open relays to set their NIP-11 workspace icon (kind:9033) ([#3998](#3998)) ([`5765fc74b7`](5765fc7)) - feat(relay): accept kind:30621 multi-repo projects at ingest ([#3171](#3171)) ([`cb9701cd30`](cb9701c)) - feat(relay): raise hosted community limit to five ([#3829](#3829)) ([`10d5a26414`](10d5a26)) - fix(relay): align NIP-11 max_limit with REQ ceiling ([#3635](#3635)) ([`23f0c26b1c`](23f0c26)) - feat(relay): gate kind 30178 team-catalog reads behind the shared tag ([#3358](#3358)) ([`114d40d9d3`](114d40d)) - fix(db): isolate usage metrics advisory-lock test on scratch DB ([#3670](#3670)) ([`dba97eecd9`](dba97ee)) - perf(presence): reduce heartbeat frequency ([#3783](#3783)) ([`bf139e8d0b`](bf139e8)) - feat(mesh): upgrade embedded mesh to v0.74 and harden shared compute (split 1/2 of #3467) ([#3741](#3741)) ([`4933672eb4`](4933672)) - feat(replica): portable heartbeat-token fence with snapshot-local reader routing ([#3268](#3268)) ([`63496cc1d4`](63496cc)) - fix(git): channel binding tooling + author remediation for unbound repos ([#3626](#3626)) ([`788b3c002b`](788b3c0)) - feat: configure S3 URL addressing style ([#3400](#3400)) ([`7012d86d52`](7012d86)) - feat(tracing): correlate trace IDs in relay logs ([#3608](#3608)) ([`005b5b819a`](005b5b8)) - fix(relay): avoid subscription lock inversion ([#3413](#3413)) ([`22be8bb351`](22be8bb)) - feat(cli): add users set-status command for NIP-38 profile status ([#3253](#3253)) ([`60158fce3e`](60158fc)) - feat(relay): make Postgres pool size configurable, default 50 ([#3191](#3191)) ([`2ce2d71cc3`](2ce2d71)) - feat(tracing): add datastore tracing plumbing ([#2760](#2760)) ([`e94b9aeda0`](e94b9ae)) - feat(invites): add use-limited invite links ([#3141](#3141)) ([`d500c2d5cf`](d500c2d)) - feat(admin): show reported message content in report detail ([#3149](#3149)) ([`f069a85503`](f069a85)) - resolve findings ([#3150](#3150)) ([`9b0f744804`](9b0f744)) - Revert "fix(cli,relay): resolve agents by verified owner" ([#3168](#3168)) ([`a041e2d21e`](a041e2d)) - fix(cli,relay): resolve agents by verified owner ([#2615](#2615)) ([`c3084b36d9`](c3084b3)) - fix(security): enforce durable community ban on NIP-43 relay-admin kinds 9030-9033 ([#3128](#3128)) ([`e2e0079101`](e2e0079)) - fix(security): authorize kind:9000 role changes in both directions ([#3017](#3017)) ([`00ecf2cac7`](00ecf2c)) - feat(desktop): handle project work from Inbox ([#3117](#3117)) ([`c5c4f390b6`](c5c4f39)) - feat(relay): make per-owner community limit configurable via BUZZ_MAX_COMMUNITIES_PER_OWNER ([#2599](#2599)) ([`2a051a404d`](2a051a4)) - feat(relay): add author-only-unless-shared read gate for kind 30175 ([#2768](#2768)) ([`ab3af82871`](ab3af82)) - fix(core): block IPv6 transition SSRF targets ([#2801](#2801)) ([`c26bf5945d`](c26bf59)) - fix(workflow): bypass system proxies for webhooks ([#2800](#2800)) ([`60a171b19e`](60a171b)) - fix(audit): hash created_at at the precision Postgres stores ([#2638](#2638)) ([`264a56a226`](264a56a)) - feat(desktop): make pull request reviews actionable ([#2510](#2510)) ([`9081ab0ec9`](9081ab0)) - fix(relay): decompress gzip-encoded git smart-HTTP request bodies ([#2670](#2670)) ([`5ca36e7b91`](5ca36e7)) - fix(sharing): preserve agent/team snapshot tEXt chunks through media sanitization ([#2438](#2438)) ([`b096b0a15a`](b096b0a)) - fix(relay): send 1012 restart close to all clients on graceful drain ([#2575](#2575)) ([`1911c69aa2`](1911c69)) - fix(media): sanitize animated image uploads ([#2524](#2524)) ([`8f8f5fa5a4`](8f8f5fa)) - fix(channels): strip leading hash prefixes from names ([#2250](#2250)) ([`d0ab3fdb05`](d0ab3fd)) - feat(relay): make Redis pool size configurable, default 16 ([#2521](#2521)) ([`bcc3e13069`](bcc3e13)) - feat(desktop+acp): spawn a harness per (agent, community) pair at GUI startup — warm sockets, lazy LLM pool ([#2122](#2122)) ([`61cc738ee8`](61cc738)) - feat(media): add S3-truth per-community storage sweep ([#2044](#2044)) ([`bd37a4d584`](bd37a4d)) - feat(relay): log NIP-98 pubkey attribution on HTTP bridge requests ([#2206](#2206)) ([`7e34bee62c`](7e34bee)) - Revert "feat(relay): inventory unreachable Git objects" ([#2275](#2275)) ([`0fb820f9bf`](0fb820f)) - feat(relay): inventory unreachable Git objects ([#2264](#2264)) ([`3afc9dae15`](3afc9da)) - relay: add author_type label to buzz_events_stored_total ([#2243](#2243)) ([`b9f54c43fe`](b9f54c4)) - fix(git): make project branch workflows reliable ([#2213](#2213)) ([`166f27be4b`](166f27b)) - feat(cli): manage repository protection rules ([#2193](#2193)) ([`f94324598d`](f943245)) - feat(cli): add agents archive/unarchive/archived subcommands ([#2173](#2173)) ([`7d7992067b`](7d79920)) - fix(mobile): sanitize Android image uploads ([#2188](#2188)) ([`ee21da90bd`](ee21da9)) - fix(cli): paginate channel directory queries ([#2181](#2181)) ([`03fe19d603`](03fe19d)) - fix(mobile): image upload fails due to unstripped metadata ([#2185](#2185)) ([`37f15b2001`](37f15b2)) - perf(relay): compact Git packs before manifest limits ([#2172](#2172)) ([`80e0ab16b0`](80e0ab1)) - perf(relay): cache Git pack hydration ([#2169](#2169)) ([`a4d82ec722`](a4d82ec)) - fix(relay): bound and observe Git read operations ([#2167](#2167)) ([`5f7c93d9c1`](5f7c93d)) - relay: gate push enqueue on live leases; batch matcher pipeline (T1b/T1a-repair/T2b) ([#2145](#2145)) ([`e43b2d5aac`](e43b2d5)) - relay: add audit logging disable switch ([#2134](#2134)) ([`bf5acabdde`](bf5acab)) - relay: skip TTL deadline bump for known-permanent channels (T1a write-amp) ([#2125](#2125)) ([`2e936d439c`](2e936d4)) - fix(git): carry NIP-OA delegation in auth event ([#2120](#2120)) ([`c12257d57a`](c12257d)) - Route lag-tolerant reads to an optional Postgres read replica ([#2084](#2084)) ([`29c48883d3`](29c4888)) - fix: recover community access visibility ([#2074](#2074)) ([`ca384d082d`](ca384d0)) - feat: proxy feedback-scoped admin attachments ([#2059](#2059)) ([`d7f918e3cb`](d7f918e)) - feat: add read-only deployment moderation dashboard ([#1999](#1999)) ([`68e670e001`](68e670e)) - Bug-bash round 2: table scroll, Goose instructions, workflow mention wake ([#2034](#2034)) ([`64b8fea6dc`](64b8fea)) - Strip media metadata on clients and reject it at the relay ([#2006](#2006)) ([`5cfd69cb0c`](5cfd69c)) - [codex] Hold Git concurrency permits through streaming (BUZZ-SEC-018) ([#1916](#1916)) ([`7baea42abb`](7baea42)) - [codex] Enforce shared relay admission limits (BUZZ-SEC-019) ([#1917](#1917)) ([`73fc0ec6cf`](73fc0ec)) - [codex] Block banned actors from moderation commands (BUZZ-SEC-007) ([#1915](#1915)) ([`caa195ca58`](caa195c)) - [codex] Fix relay WebSocket admission limits ([#1682](#1682)) ([`d3ce971fc7`](d3ce971)) - feat: add invite QR and mobile direct join ([#1957](#1957)) ([`648cbf3610`](648cbf3)) - fix(join-policy): require legal consent on hosted invites ([#1987](#1987)) ([`2e1577f76f`](2e1577f)) - [codex] Prevent actor-tag UI impersonation ([#1931](#1931)) ([`c540ec9678`](c540ec9)) - Scope relay runtime state by community ([#1658](#1658)) ([`d52dedb06f`](d52dedb)) - Apply optional relay join policy across join flows ([#1894](#1894)) ([`6c2d667575`](6c2d667)) - feat(media): require auth for relay media reads ([#1926](#1926)) ([`f308762852`](f308762)) - feat(relay): add community unarchive endpoint ([#1908](#1908)) ([`6b9641db2b`](6b9641d)) - feat(relay): gate Git web GUI separately ([#1901](#1901)) ([`34dc7dec75`](34dc7de)) - mesh: upgrade runtime, enforce membership, add shared compute provider ([#1656](#1656)) ([`54638ff4bb`](54638ff)) - Route Git scratch through configured volume ([#1884](#1884)) ([`2318b3096c`](2318b30)) - feat(relay): gate usage metrics behind stable leader ([#1814](#1814)) ([`59e9821503`](59e9821)) - Relay mesh: cross-pod tunnel + huddle transport (buzz-relay-mesh) ([#1670](#1670)) ([`ccb021d713`](ccb021d)) - feat(push): deliver accepted relay events as wakes ([#1866](#1866)) ([`bffbc5f22c`](bffbc5f)) - fix(db): resolve duplicate migration version ([#1863](#1863)) ([`08ad38a07f`](08ad38a)) - Add private product feedback sidecar ([#1857](#1857)) ([`af190c93e1`](af190c9)) - feat(relay): add durable community archival ([#1834](#1834)) ([`2b15a72675`](2b15a72)) - feat(push): add public APNs gateway ([#1770](#1770)) ([`1c006822e4`](1c00682)) - feat(relay): add atomic community ownership transfer ([#1845](#1845)) ([`52e42ccb9f`](52e42cc)) - Bound NIP-RS retention and search indexing ([#1771](#1771)) ([`1b4703021d`](1b47030)) - Add optional standalone pairing relay to Helm chart ([#1799](#1799)) ([`9b47c8548f`](9b47c85)) - fix(relay): publish membership snapshot on provisioning ([#1761](#1761)) ([`0950d392b7`](0950d39)) - feat(relay): per-community usage metrics ([#1723](#1723)) ([`620822899a`](6208228)) - refactor(desktop): remove vestigial MCP toolsets config ([#1776](#1776)) ([`dfec75b3c0`](dfec75b)) **To release:** merge this PR. The tag and build will happen automatically. Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

## Buzz Relay release v0.2.1 ### Changes since relay-v0.2.0: - fix(sdk): preserve self-mention p tags in message and forum event builders ([block#4975](block#4975)) ([`78c87ae20e`](block@78c87ae)) - feat(desktop): adding rich link previews to messages ([block#3818](block#3818)) ([`1922d49cb2`](block@1922d49)) - feat(relay): accept kind:30179 private managed-agent events at ingest ([block#5133](block#5133)) ([`ad923353a2`](block@ad92335)) - fix(media): require authenticated reads ([block#4610](block#4610)) ([`769ac70b74`](block@769ac70)) - feat(identity): recover desktop identity from a signed-in phone ([block#4845](block#4845)) ([`6eb65919f1`](block@6eb6591)) - ci: prove the relay-driven mesh lifecycle — discover, join, infer, deny — with real nodes ([block#3862](block#3862)) ([`38bf642fcf`](block@38bf642)) - relay: fuzz WebSocket 1012 restart-close timing on graceful drain (BUZZ_DRAIN_JITTER_MS) ([block#4542](block#4542)) ([`e14fff74d0`](block@e14fff7)) - fix(reactions): support max-length custom emoji ([block#3833](block#3833)) ([`2ea9385015`](block@2ea9385)) - fix(channels): restrict private-channel invitations ([block#4612](block#4612)) ([`efe1893dd3`](block@efe1893)) - fix(workflow): bind trigger author to the signed event ([block#4607](block#4607)) ([`885bed35ee`](block@885bed3)) - fix(git): revoke access for banned relay members ([block#4608](block#4608)) ([`997b8caaa4`](block@997b8ca)) - Define private managed agent wire protocol ([block#4593](block#4593)) ([`067c085f37`](block@067c085)) - perf(relay): index channel-id lookups and skip trace-only reads ([block#4647](block#4647)) ([`bc9e6528a7`](block@bc9e652)) - Polish mobile inbox and media flows ([block#4512](block#4512)) ([`feccf4eabc`](block@feccf4e)) - fix(git): allow deleting the default branch ([block#4297](block#4297)) ([`fc598f5f8d`](block@fc598f5)) - feat(projects): add buzz projects CLI commands (NIP-MP kind:30621) ([block#4020](block#4020)) ([`b7bb15122e`](block@b7bb151)) - perf(relay): serve relay-membership checks from the read replica ([block#4124](block#4124)) ([`ac4fa13b8e`](block@ac4fa13)) - fix(relay): allow open relays to set their NIP-11 workspace icon (kind:9033) ([block#3998](block#3998)) ([`5765fc74b7`](block@5765fc7)) - feat(relay): accept kind:30621 multi-repo projects at ingest ([block#3171](block#3171)) ([`cb9701cd30`](block@cb9701c)) - feat(relay): raise hosted community limit to five ([block#3829](block#3829)) ([`10d5a26414`](block@10d5a26)) - fix(relay): align NIP-11 max_limit with REQ ceiling ([block#3635](block#3635)) ([`23f0c26b1c`](block@23f0c26)) - feat(relay): gate kind 30178 team-catalog reads behind the shared tag ([block#3358](block#3358)) ([`114d40d9d3`](block@114d40d)) - fix(db): isolate usage metrics advisory-lock test on scratch DB ([block#3670](block#3670)) ([`dba97eecd9`](block@dba97ee)) - perf(presence): reduce heartbeat frequency ([block#3783](block#3783)) ([`bf139e8d0b`](block@bf139e8)) - feat(mesh): upgrade embedded mesh to v0.74 and harden shared compute (split 1/2 of block#3467) ([block#3741](block#3741)) ([`4933672eb4`](block@4933672)) - feat(replica): portable heartbeat-token fence with snapshot-local reader routing ([block#3268](block#3268)) ([`63496cc1d4`](block@63496cc)) - fix(git): channel binding tooling + author remediation for unbound repos ([block#3626](block#3626)) ([`788b3c002b`](block@788b3c0)) - feat: configure S3 URL addressing style ([block#3400](block#3400)) ([`7012d86d52`](block@7012d86)) - feat(tracing): correlate trace IDs in relay logs ([block#3608](block#3608)) ([`005b5b819a`](block@005b5b8)) - fix(relay): avoid subscription lock inversion ([block#3413](block#3413)) ([`22be8bb351`](block@22be8bb)) - feat(cli): add users set-status command for NIP-38 profile status ([block#3253](block#3253)) ([`60158fce3e`](block@60158fc)) - feat(relay): make Postgres pool size configurable, default 50 ([block#3191](block#3191)) ([`2ce2d71cc3`](block@2ce2d71)) - feat(tracing): add datastore tracing plumbing ([block#2760](block#2760)) ([`e94b9aeda0`](block@e94b9ae)) - feat(invites): add use-limited invite links ([block#3141](block#3141)) ([`d500c2d5cf`](block@d500c2d)) - feat(admin): show reported message content in report detail ([block#3149](block#3149)) ([`f069a85503`](block@f069a85)) - resolve findings ([block#3150](block#3150)) ([`9b0f744804`](block@9b0f744)) - Revert "fix(cli,relay): resolve agents by verified owner" ([block#3168](block#3168)) ([`a041e2d21e`](block@a041e2d)) - fix(cli,relay): resolve agents by verified owner ([block#2615](block#2615)) ([`c3084b36d9`](block@c3084b3)) - fix(security): enforce durable community ban on NIP-43 relay-admin kinds 9030-9033 ([block#3128](block#3128)) ([`e2e0079101`](block@e2e0079)) - fix(security): authorize kind:9000 role changes in both directions ([block#3017](block#3017)) ([`00ecf2cac7`](block@00ecf2c)) - feat(desktop): handle project work from Inbox ([block#3117](block#3117)) ([`c5c4f390b6`](block@c5c4f39)) - feat(relay): make per-owner community limit configurable via BUZZ_MAX_COMMUNITIES_PER_OWNER ([block#2599](block#2599)) ([`2a051a404d`](block@2a051a4)) - feat(relay): add author-only-unless-shared read gate for kind 30175 ([block#2768](block#2768)) ([`ab3af82871`](block@ab3af82)) - fix(core): block IPv6 transition SSRF targets ([block#2801](block#2801)) ([`c26bf5945d`](block@c26bf59)) - fix(workflow): bypass system proxies for webhooks ([block#2800](block#2800)) ([`60a171b19e`](block@60a171b)) - fix(audit): hash created_at at the precision Postgres stores ([block#2638](block#2638)) ([`264a56a226`](block@264a56a)) - feat(desktop): make pull request reviews actionable ([block#2510](block#2510)) ([`9081ab0ec9`](block@9081ab0)) - fix(relay): decompress gzip-encoded git smart-HTTP request bodies ([block#2670](block#2670)) ([`5ca36e7b91`](block@5ca36e7)) - fix(sharing): preserve agent/team snapshot tEXt chunks through media sanitization ([block#2438](block#2438)) ([`b096b0a15a`](block@b096b0a)) - fix(relay): send 1012 restart close to all clients on graceful drain ([block#2575](block#2575)) ([`1911c69aa2`](block@1911c69)) - fix(media): sanitize animated image uploads ([block#2524](block#2524)) ([`8f8f5fa5a4`](block@8f8f5fa)) - fix(channels): strip leading hash prefixes from names ([block#2250](block#2250)) ([`d0ab3fdb05`](block@d0ab3fd)) - feat(relay): make Redis pool size configurable, default 16 ([block#2521](block#2521)) ([`bcc3e13069`](block@bcc3e13)) - feat(desktop+acp): spawn a harness per (agent, community) pair at GUI startup — warm sockets, lazy LLM pool ([block#2122](block#2122)) ([`61cc738ee8`](block@61cc738)) - feat(media): add S3-truth per-community storage sweep ([block#2044](block#2044)) ([`bd37a4d584`](block@bd37a4d)) - feat(relay): log NIP-98 pubkey attribution on HTTP bridge requests ([block#2206](block#2206)) ([`7e34bee62c`](block@7e34bee)) - Revert "feat(relay): inventory unreachable Git objects" ([block#2275](block#2275)) ([`0fb820f9bf`](block@0fb820f)) - feat(relay): inventory unreachable Git objects ([block#2264](block#2264)) ([`3afc9dae15`](block@3afc9da)) - relay: add author_type label to buzz_events_stored_total ([block#2243](block#2243)) ([`b9f54c43fe`](block@b9f54c4)) - fix(git): make project branch workflows reliable ([block#2213](block#2213)) ([`166f27be4b`](block@166f27b)) - feat(cli): manage repository protection rules ([block#2193](block#2193)) ([`f94324598d`](block@f943245)) - feat(cli): add agents archive/unarchive/archived subcommands ([block#2173](block#2173)) ([`7d7992067b`](block@7d79920)) - fix(mobile): sanitize Android image uploads ([block#2188](block#2188)) ([`ee21da90bd`](block@ee21da9)) - fix(cli): paginate channel directory queries ([block#2181](block#2181)) ([`03fe19d603`](block@03fe19d)) - fix(mobile): image upload fails due to unstripped metadata ([block#2185](block#2185)) ([`37f15b2001`](block@37f15b2)) - perf(relay): compact Git packs before manifest limits ([block#2172](block#2172)) ([`80e0ab16b0`](block@80e0ab1)) - perf(relay): cache Git pack hydration ([block#2169](block#2169)) ([`a4d82ec722`](block@a4d82ec)) - fix(relay): bound and observe Git read operations ([block#2167](block#2167)) ([`5f7c93d9c1`](block@5f7c93d)) - relay: gate push enqueue on live leases; batch matcher pipeline (T1b/T1a-repair/T2b) ([block#2145](block#2145)) ([`e43b2d5aac`](block@e43b2d5)) - relay: add audit logging disable switch ([block#2134](block#2134)) ([`bf5acabdde`](block@bf5acab)) - relay: skip TTL deadline bump for known-permanent channels (T1a write-amp) ([block#2125](block#2125)) ([`2e936d439c`](block@2e936d4)) - fix(git): carry NIP-OA delegation in auth event ([block#2120](block#2120)) ([`c12257d57a`](block@c12257d)) - Route lag-tolerant reads to an optional Postgres read replica ([block#2084](block#2084)) ([`29c48883d3`](block@29c4888)) - fix: recover community access visibility ([block#2074](block#2074)) ([`ca384d082d`](block@ca384d0)) - feat: proxy feedback-scoped admin attachments ([block#2059](block#2059)) ([`d7f918e3cb`](block@d7f918e)) - feat: add read-only deployment moderation dashboard ([block#1999](block#1999)) ([`68e670e001`](block@68e670e)) - Bug-bash round 2: table scroll, Goose instructions, workflow mention wake ([block#2034](block#2034)) ([`64b8fea6dc`](block@64b8fea)) - Strip media metadata on clients and reject it at the relay ([block#2006](block#2006)) ([`5cfd69cb0c`](block@5cfd69c)) - [codex] Hold Git concurrency permits through streaming (BUZZ-SEC-018) ([block#1916](block#1916)) ([`7baea42abb`](block@7baea42)) - [codex] Enforce shared relay admission limits (BUZZ-SEC-019) ([block#1917](block#1917)) ([`73fc0ec6cf`](block@73fc0ec)) - [codex] Block banned actors from moderation commands (BUZZ-SEC-007) ([block#1915](block#1915)) ([`caa195ca58`](block@caa195c)) - [codex] Fix relay WebSocket admission limits ([block#1682](block#1682)) ([`d3ce971fc7`](block@d3ce971)) - feat: add invite QR and mobile direct join ([block#1957](block#1957)) ([`648cbf3610`](block@648cbf3)) - fix(join-policy): require legal consent on hosted invites ([block#1987](block#1987)) ([`2e1577f76f`](block@2e1577f)) - [codex] Prevent actor-tag UI impersonation ([block#1931](block#1931)) ([`c540ec9678`](block@c540ec9)) - Scope relay runtime state by community ([block#1658](block#1658)) ([`d52dedb06f`](block@d52dedb)) - Apply optional relay join policy across join flows ([block#1894](block#1894)) ([`6c2d667575`](block@6c2d667)) - feat(media): require auth for relay media reads ([block#1926](block#1926)) ([`f308762852`](block@f308762)) - feat(relay): add community unarchive endpoint ([block#1908](block#1908)) ([`6b9641db2b`](block@6b9641d)) - feat(relay): gate Git web GUI separately ([block#1901](block#1901)) ([`34dc7dec75`](block@34dc7de)) - mesh: upgrade runtime, enforce membership, add shared compute provider ([block#1656](block#1656)) ([`54638ff4bb`](block@54638ff)) - Route Git scratch through configured volume ([block#1884](block#1884)) ([`2318b3096c`](block@2318b30)) - feat(relay): gate usage metrics behind stable leader ([block#1814](block#1814)) ([`59e9821503`](block@59e9821)) - Relay mesh: cross-pod tunnel + huddle transport (buzz-relay-mesh) ([block#1670](block#1670)) ([`ccb021d713`](block@ccb021d)) - feat(push): deliver accepted relay events as wakes ([block#1866](block#1866)) ([`bffbc5f22c`](block@bffbc5f)) - fix(db): resolve duplicate migration version ([block#1863](block#1863)) ([`08ad38a07f`](block@08ad38a)) - Add private product feedback sidecar ([block#1857](block#1857)) ([`af190c93e1`](block@af190c9)) - feat(relay): add durable community archival ([block#1834](block#1834)) ([`2b15a72675`](block@2b15a72)) - feat(push): add public APNs gateway ([block#1770](block#1770)) ([`1c006822e4`](block@1c00682)) - feat(relay): add atomic community ownership transfer ([block#1845](block#1845)) ([`52e42ccb9f`](block@52e42cc)) - Bound NIP-RS retention and search indexing ([block#1771](block#1771)) ([`1b4703021d`](block@1b47030)) - Add optional standalone pairing relay to Helm chart ([block#1799](block#1799)) ([`9b47c8548f`](block@9b47c85)) - fix(relay): publish membership snapshot on provisioning ([block#1761](block#1761)) ([`0950d392b7`](block@0950d39)) - feat(relay): per-community usage metrics ([block#1723](block#1723)) ([`620822899a`](block@6208228)) - refactor(desktop): remove vestigial MCP toolsets config ([block#1776](block#1776)) ([`dfec75b3c0`](block@dfec75b)) **To release:** merge this PR. The tag and build will happen automatically. Signed-off-by: Will Pfleger <pfleger.will@gmail.com>

github-advanced-security AI found potential problems Jul 31, 2026

View reviewed changes

Comment thread .github/workflows/mesh-lifecycle.yml Fixed

michaelneale force-pushed the micn/mesh-relay-lifecycle-ci branch from 152f526 to c8239e7 Compare July 31, 2026 06:21

michaelneale force-pushed the micn/mesh-relay-lifecycle-ci branch from c8239e7 to 8c56830 Compare August 1, 2026 02:14

michaelneale marked this pull request as ready for review August 1, 2026 04:16

michaelneale requested a review from a team as a code owner August 1, 2026 04:16

michaelneale force-pushed the micn/mesh-relay-lifecycle-ci branch from 59bef12 to 4281774 Compare August 3, 2026 06:36

tlongwell-block previously approved these changes Aug 4, 2026

View reviewed changes

michaelneale added 3 commits August 6, 2026 07:20

michaelneale dismissed tlongwell-block’s stale review via 5ad9ac5 August 5, 2026 21:21

michaelneale force-pushed the micn/mesh-relay-lifecycle-ci branch from 8c1b7b4 to 5ad9ac5 Compare August 5, 2026 21:21

michaelneale enabled auto-merge (squash) August 5, 2026 23:58

tlongwell-block approved these changes Aug 6, 2026

View reviewed changes

michaelneale merged commit 38bf642 into main Aug 6, 2026
34 checks passed

michaelneale deleted the micn/mesh-relay-lifecycle-ci branch August 6, 2026 03:13

adrienlacombe mentioned this pull request Aug 7, 2026

[upstream-sync] Merge block/buzz 16cc3de6d..769ac70b7 (16 commits) adrienlacombe/buzz#22

Merged

wpfleger96 mentioned this pull request Aug 8, 2026

chore(release): release Buzz Relay version 0.2.1 #2856

Merged

Navigation Menu

Uh oh!

ci: prove the relay-driven mesh lifecycle — discover, join, infer, deny — with real nodes - #3862

ci: prove the relay-driven mesh lifecycle — discover, join, infer, deny — with real nodes#3862
michaelneale merged 3 commits into
mainfrom
micn/mesh-relay-lifecycle-ci

michaelneale commented Jul 31, 2026 •

edited

Loading

Uh oh!

Uh oh!

Chessing234 commented Jul 31, 2026

Uh oh!

micspiral commented Aug 3, 2026

Uh oh!

michaelneale commented Aug 3, 2026

Uh oh!

michaelneale commented Aug 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

michaelneale commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

What's in the PR

Scope

Relationship to mesh-llm's CI

Validation

Notes

Uh oh!

Uh oh!

Chessing234 commented Jul 31, 2026

Uh oh!

micspiral commented Aug 3, 2026

What it would not have caught today

Suggestion 1 — a stalled-node phase (this is the cheap, high-value one)

Suggestion 2 — a prose-only agent phase

On soak

Suggestion 3 — multi-node MoA, as a separate thing

Multi-host

Uh oh!

michaelneale commented Aug 3, 2026

Uh oh!

michaelneale commented Aug 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

michaelneale commented Jul 31, 2026 •

edited

Loading