Merge upstream block/buzz 6861e18a8 (141 commits) for Bishop Phase U

.config/nextest.toml

@@ -32,6 +32,10 @@ max-threads = 1
 [[profile.postgres-ci.overrides]]
 filter = "test(/cluster_global_/)"
 test-group = "postgres-cluster-global"
+# The group only serializes these tests with each other. They read unfiltered,
+# cluster-wide `pg_stat_activity`, so any overlapping test's session can mask
+# activity; claim every worker so they run alone.
+threads-required = "num-test-threads"
 
 [[profile.postgres-ci.scripts]]
 # Script filters are separate from default-filter: they attach the setup and

.env.example

@@ -52,25 +52,30 @@ REDIS_URL=redis://localhost:6379
 # Emergency kill switch for all automatic partition DDL, including catch-all
 # advancement; audits remain enabled.
 # BUZZ_PARTITION_MANAGER_CREATE_ENABLED=true
-# Opt in to replacing an empty partition catch-all with six months of dedicated
-# monthlies, at startup and on every audit interval (default false). Has no
-# effect while the kill switch above is off.
-# BUZZ_PARTITION_MANAGER_ADVANCE_ENABLED=false
+# Replace an empty partition catch-all with six months of dedicated monthlies,
+# at startup and on every audit interval (default true). Has no effect while the
+# kill switch above is off.
+# BUZZ_PARTITION_MANAGER_ADVANCE_ENABLED=true
 
 # Writer-session Postgres timeouts for buzz-db-backed pools and the relay audit
-# pool, all in milliseconds; 0 disables. The separately deployed push gateway
-# owns its own database and session policy and does not consume these knobs.
+# pool, all in milliseconds; 0 disables the lock and idle timeouts. The
+# separately deployed push gateway owns its own database and session policy
+# and does not consume these knobs.
 # lock_timeout: fail a statement that waits this long on any lock instead of
 # parking behind a wedged holder (default 5000).
 # BUZZ_DB_LOCK_TIMEOUT_MS=5000
 # idle_in_transaction_session_timeout: reap sessions idle inside an open
 # transaction — bounds how long a wedged client can hold locks (default 60000).
 # BUZZ_DB_IDLE_TXN_TIMEOUT_MS=60000
-# statement_timeout: cap any single statement's runtime. Off by default —
-# startup migrations/backfills legitimately run long statements. Warning: a
-# pathologically low value (e.g. 1) also times out connection setup and can
-# prevent any DB connection from establishing.
-# BUZZ_DB_STATEMENT_TIMEOUT_MS=0
+# statement_timeout: cap any single statement's runtime (default 120000). A
+# session cannot disable it: 0 or anything above 300000 installs 300000 (5
+# minutes) and logs a warning at startup. Migrations, schema destruction, and
+# community-deletion inventory and purge transactions lift it for themselves.
+# Generic event reads (REQ history, /query, /count) and read-replica sessions
+# are further capped at 20s. Warning: a pathologically low value (e.g. 1) also
+# times out connection setup and can prevent any DB connection from
+# establishing.
+# BUZZ_DB_STATEMENT_TIMEOUT_MS=120000
 
 # -----------------------------------------------------------------------------
 # Typesense (search)
@@ -151,7 +156,8 @@ BUZZ_PUSH_GATEWAY_DELIVERY_URL=https://push.buzz.xyz/v1/deliveries/apns
 # Deployment-global operator-listener routes. Each configured Nostr identity
 # may register target pubkeys and receives mention notifications at its URL.
 # URLs may use HTTP or HTTPS. Use HTTP only for operator-controlled internal
-# connections: NIP-98 signs requests.
+# connections: NIP-98 signs requests but does not encrypt them, and
+# notifications carry full message content.
 # Format: pubkey:deliveryUrl;pubkey:deliveryUrl
 # BUZZ_OPERATOR_LISTENER_TIMEOUT_MS=5000
 # BUZZ_OPERATOR_LISTENERS=<64-char hex pubkey>:https://listener.example/mentions
@@ -371,3 +377,18 @@ RUST_LOG=buzz_relay=debug,buzz_datastore=info,buzz_db=debug,buzz_auth=debug,buzz
 # BUZZ_TERMS_OF_SERVICE_MARKDOWN="# Terms of Service\n\nFull terms here."
 # BUZZ_PRIVACY_POLICY_MARKDOWN="# Privacy Policy\n\nFull policy here."
 # BUZZ_AGE_ATTESTATION_REQUIRED=true
+
+# ── NIP-FI database community source ─────────────────────────────────────────
+# Where NIP-FI communities come from: "env" (BUZZ_NIP_FI_COMMUNITIES, default)
+# or "database" (bindings created by provisioning; needs
+# BUZZ_NIP_FI_PROVISION_BINDING and must not be combined with
+# BUZZ_NIP_FI_COMMUNITIES). See docs/operator-nip-fi-bindings.md.
+# BUZZ_NIP_FI_COMMUNITY_SOURCE=env
+# Most community-issuer rows one snapshot may hold (1..=10000000).
+# BUZZ_NIP_FI_SNAPSHOT_MAX_ROWS=1000000
+# Snapshot load timeout in ms; must be under the 30s refresh interval.
+# BUZZ_NIP_FI_SNAPSHOT_REFRESH_TIMEOUT_MS=10000
+# Hosts whose "not found" is cached for 5s (1..=1000000).
+# BUZZ_NIP_FI_RESOLVER_NEGATIVE_CACHE_MAX=100000
+# Concurrent live lookups; clamped below the database pool size.
+# BUZZ_NIP_FI_RESOLVER_MAX_INFLIGHT=8

.github/workflows/_ci-clients.yml

@@ -57,12 +57,32 @@ jobs:
           path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
           key: pnpm-${{ runner.os }}-${{ hashFiles('**/pnpm-lock.yaml') }}
 
+  # Mobile lanes run in parallel; the required check reads the combined
+  # matrix result. Test shards split files, so each compiles only its own.
   mobile:
-    name: Mobile
+    name: Mobile (${{ matrix.name }})
     runs-on: ubuntu-latest
     timeout-minutes: 30
-    # The Dreamforge fork does not build or ship the phone app (owners use Block's store build).
+    # Dreamforge will publish its own phone app (plan Q8), but the fork does not build it
+    # yet. Drop this block/buzz guard (here and on ci.yml's mobile jobs) with slice A2.
     if: inputs.lane == 'required' && github.repository == 'block/buzz' && (github.event_name == 'push' || inputs.mobile)
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: Checks
+            lane: checks
+          - name: Tests 1/3
+            lane: test
+            shard: 0
+          - name: Tests 2/3
+            lane: test
+            shard: 1
+          - name: Tests 3/3
+            lane: test
+            shard: 2
+          - name: Android
+            lane: android
     permissions:
       contents: read
     steps:
@@ -108,47 +128,127 @@ jobs:
           path: ~/.pub-cache
           key: pub-${{ runner.os }}-${{ hashFiles('mobile/pubspec.lock') }}
       - name: Format check
+        if: matrix.lane == 'checks'
         run: cd mobile && dart format --output=none --set-exit-if-changed .
       - name: Analyze
+        if: matrix.lane == 'checks'
         run: cd mobile && flutter analyze
       - name: Test
-        run: cd mobile && flutter test --dart-define=BUZZ_PUSH_GATEWAY_URL=https://push.example
+        if: matrix.lane == 'test'
+        run: /bin/bash scripts/mobile-test-shard.sh ${{ matrix.shard }} 3 --dart-define=BUZZ_PUSH_GATEWAY_URL=https://push.example
+      - name: Test configured authentication domains
+        if: matrix.lane == 'checks'
+        run: >-
+          cd mobile && flutter test
+          --dart-define=BUZZ_PUSH_GATEWAY_URL=https://push.example
+          --dart-define=BUZZ_AUTH_DOMAINS=buzz.xyz,builderlab.xyz,builderlabstaging.xyz
+          test/shared/auth/community_entry_requirements_test.dart
+          test/features/invites/invite_join_provider_test.dart
+          test/features/onboarding/onboarding_entry_routes_test.dart
+          test/shared/hosted/hosted_environment_test.dart
+          test/shared/hosted/self_hosted_entry_test.dart
+          test/features/onboarding/hosted_app_gate_environment_test.dart
+          test/features/onboarding/hosted_journeys_test.dart
+          test/features/onboarding/hosted_communities_test.dart
+          test/features/pairing/pairing_hosted_handoff_test.dart
       - name: Test mobile without push configuration
+        if: matrix.lane == 'checks'
         run: cd mobile && flutter test test/shared/push/push_unconfigured_build_test.dart
       - name: Test mobile recipe argument forwarding
+        if: matrix.lane == 'checks'
         run: /bin/bash scripts/test-mobile-gateway-recipes.sh
+      - name: Restore Gradle cache
+        if: matrix.lane == 'android'
+        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ hashFiles('mobile/android/**/*.gradle*', 'mobile/android/gradle/wrapper/gradle-wrapper.properties', 'mobile/pubspec.lock') }}
+          restore-keys: gradle-${{ runner.os }}-
+      # SDK component and plugin downloads intermittently fail on hosted
+      # runners; retry once only for those, so real build failures still fail.
       - name: Build Android debug APK
-        run: just mobile-build-android
+        if: matrix.lane == 'android'
+        run: |
+          set -o pipefail
+          log="$RUNNER_TEMP/android-build.log"
+          if ! just mobile-build-android 2>&1 | tee "$log"; then
+            grep -qE 'InstallFailedException|Could not (resolve|GET|download)' "$log"
+            just mobile-build-android
+          fi
+      - name: Test Android JVM units
+        if: matrix.lane == 'android'
+        run: cd mobile/android && ./gradlew :app:testDebugUnitTest --console=plain
+      - name: Save Gradle cache
+        if: matrix.lane == 'android' && github.event_name == 'push'
+        uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5
+        continue-on-error: true
+        with:
+          path: |
+            ~/.gradle/caches
+            ~/.gradle/wrapper
+          key: gradle-${{ runner.os }}-${{ hashFiles('mobile/android/**/*.gradle*', 'mobile/android/gradle/wrapper/gradle-wrapper.properties', 'mobile/pubspec.lock') }}
 
+  # The unsigned release build needs nothing from the native lane, so it runs
+  # beside it instead of after the simulator tests.
   mobile-swift:
-    name: Mobile Swift
+    name: Mobile Swift (${{ matrix.name }})
     runs-on: macos-latest
-    timeout-minutes: 30
+    timeout-minutes: 45
     if: inputs.lane == 'mobile-swift' && inputs.mobile
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: Native
+            lane: native
+          - name: Release
+            lane: release
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
       - name: Install Flutter dependencies
         run: cd mobile && flutter pub get
-      - name: Build
-        run: swift build --package-path mobile/ios/BuzzPushKit
-      - name: Build release
-        run: swift build -c release --package-path mobile/ios/BuzzPushKit
+      # `swift test` builds BuzzPushKit; the Release lane covers its release build.
       - name: Test
+        if: matrix.lane == 'native'
         run: swift test --package-path mobile/ios/BuzzPushKit
       - name: Test native pagination geometry
+        if: matrix.lane == 'native'
         run: /bin/bash scripts/test-mobile-pagination.sh
-      - name: Build complete iOS simulator app
-        run: cd mobile && flutter build ios --simulator --debug --no-pub
-      - name: Test native pagination accessibility
+      - name: Generate iOS build configuration
+        if: matrix.lane == 'native'
+        run: cd mobile && flutter build ios --simulator --debug --no-pub --config-only
+      # Build the complete simulator app and RunnerTests once, in the
+      # background, while the simulator boots and runs the native-control
+      # scripts. The build also guards Apple Silicon simulator linking (#7646).
+      - name: Test native controls and Runner unit tests
+        if: matrix.lane == 'native'
         run: |
-          device=$(xcrun simctl create "Pagination accessibility" "iPhone 16")
+          device=$(xcrun simctl create "Native tests" "iPhone 16")
           trap 'xcrun simctl shutdown "$device"; xcrun simctl delete "$device"' EXIT
+          xcode=(xcodebuild -workspace mobile/ios/Runner.xcworkspace -scheme Runner
+            -configuration Debug -destination "platform=iOS Simulator,id=$device"
+            CODE_SIGNING_ALLOWED=NO)
+          build_log="$RUNNER_TEMP/runner-build.log"
+          "${xcode[@]}" build-for-testing > "$build_log" 2>&1 &
+          build=$!
           xcrun simctl boot "$device"
           xcrun simctl bootstatus "$device" -b
           /bin/bash scripts/test-mobile-pagination-accessibility.sh "$device"
+          /bin/bash scripts/test-mobile-carousel.sh "$device"
           /bin/bash scripts/test-mobile-member-picker.sh "$device"
+          /bin/bash scripts/test-mobile-me-agent-accessibility.sh "$device"
+          if ! wait "$build"; then
+            cat "$build_log"
+            exit 1
+          fi
+          tail -n 5 "$build_log"
+          "${xcode[@]}" -parallel-testing-enabled NO -only-testing:RunnerTests \
+            test-without-building
       - name: Build complete unsigned iOS release
+        if: matrix.lane == 'release'
         run: |
           /bin/bash scripts/test-mobile-gateway-recipes.sh
           cd mobile && flutter build ios --release --no-codesign --no-pub

.github/workflows/_ci-relay.yml

@@ -111,6 +111,7 @@ jobs:
             --lib \
             --test e2e_event_reminder \
             --test e2e_author_only_deletion \
+            --test e2e_existence_oracle \
             --archive-file target/ci/backend-integration-tests.tar.zst
       - name: Build PostgreSQL test archive
         if: steps.relay-artifacts-cache.outputs.cache-hit != 'true' && matrix.artifact == 'postgres-tests'
@@ -581,7 +582,7 @@ jobs:
         run: |
           cargo nextest run \
             --archive-file target/ci/backend-integration-tests.tar.zst \
-            -E 'binary(e2e_event_reminder) | binary(e2e_author_only_deletion)' \
+            -E 'binary(e2e_event_reminder) | binary(e2e_author_only_deletion) | binary(e2e_existence_oracle)' \
             --run-ignored ignored-only
         env:
           RELAY_URL: ws://localhost:3000
@@ -626,6 +627,13 @@ jobs:
           cargo test -p buzz-test-client --test e2e_relay invite -- --ignored --nocapture
           cargo test -p buzz-test-client --test e2e_relay nip43_membership_snapshots_are_rejected -- --ignored --nocapture
           cargo test -p buzz-test-client --test e2e_relay nip29_departure_wire -- --ignored --nocapture
+          cargo test -p buzz-test-client --test e2e_relay nip29_batch_put_user_wire -- --ignored --nocapture
+          cargo test -p buzz-test-client --test e2e_relay nip29_announce_channel_wire -- --ignored --nocapture
+          cargo test -p buzz-test-client --test e2e_relay nip29_unlisted_channel_wire -- --ignored --nocapture
+          cargo test -p buzz-test-client --test e2e_relay nip29_solo_share_and_convert_wire -- --ignored --nocapture
+          cargo test -p buzz-test-client --test e2e_relay nip29_member_raises_guest_agent -- --ignored --nocapture
+          cargo test -p buzz-test-client --test e2e_relay nip29_guest_is_read_only_in_normal_channel -- --ignored --nocapture
+          cargo test -p buzz-test-client --test e2e_relay nip29_relay_rejects_role_change_by_unprivileged_actor -- --ignored --nocapture
         env:
           RELAY_URL: ws://localhost:3000
           GIT_CREDENTIAL_NOSTR_BIN: ${{ github.workspace }}/target/ci/git-credential-nostr

.github/workflows/_ci-rust.yml

@@ -120,7 +120,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       # MSVC needs windows.h (aws-lc-sys et al.), so this runs on a real Windows
       # runner — hermit, used by the Linux jobs, does not provide MSVC. The
-      # toolchain (1.95.0 + clippy via profile = default) comes from the
+      # toolchain (1.98.1 + clippy via profile = default) comes from the
       # repo-root rust-toolchain.toml, which the runner's preinstalled rustup
       # honors on demand; the host triple already is x86_64-pc-windows-msvc.
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32

.github/workflows/ci.yml

@@ -17,7 +17,9 @@ jobs:
   changes:
     name: Detect Changed Paths
     runs-on: ubuntu-latest
-    timeout-minutes: 2
+    # The steps take about 75 seconds, but GitHub can finish the job minutes
+    # after the last step. A 2-minute limit cancelled finished runs.
+    timeout-minutes: 10
     permissions:
       contents: read
       pull-requests: read
@@ -51,6 +53,8 @@ jobs:
               - '.config/nextest.toml'
               - 'scripts/postgres-test-*.sh'
               - 'scripts/reconcile-schema-after-pgschema.sql'
+              - 'scripts/repair-events-pkey.sql'
+              - 'scripts/start-relay-for-tests.sh'
               - 'bin/pgschema'
               - 'bin/.pgschema-*.pkg'
               - 'scripts/check-postgres-test-discovery.py'
@@ -86,7 +90,10 @@ jobs:
               - 'pnpm-lock.yaml'
             mobile:
               - 'mobile/**'
+              - 'Justfile'
+              - 'scripts/test-mobile-gateway-recipes.sh'
               - 'scripts/mobile-release.sh'
+              - 'scripts/mobile-release-source.sh'
               - 'scripts/mobile-worktree-overrides.sh'
               - 'scripts/mobile-worktree-clean.sh'
               - 'scripts/publish-mobile-release-candidate.sh'

.github/workflows/docker.yml

@@ -34,6 +34,10 @@ name: Docker image
 #   intact) and the bare version flows straight to the semver parser. On a
 #   real push event value= is empty and the match strips relay-v from the ref.
 #
+# ghcr.io/block/buzz-push-gateway carries the same :main, :sha-<7> and
+# :main-<commit UTC>-<7> tags on main pushes, and publishes only after the
+# relay's `qualify` job accepts the same source SHA.
+#
 # :main-<YYYYMMDDHHmmss>-<7> names the same main build as :sha-<7>, prefixed
 # with its UTC commit time so the tag sorts by build order. Kargo's Lexical
 # strategy picks the newest from the tag list alone; :sha-<7> cannot be
@@ -622,7 +626,9 @@ jobs:
     name: Publish public push gateway image
     if: github.event_name != 'pull_request'
     runs-on: ubuntu-24.04
-    needs: push-gateway-build
+    # Staging promotes every published main gateway image automatically, so the
+    # gateway publishes only from a source the relay's same-SHA CI qualified.
+    needs: [push-gateway-build, qualify]
     timeout-minutes: 15
     permissions:
       contents: read
@@ -654,6 +660,7 @@ jobs:
             type=sha,prefix=sha-,format=short,enable=${{ github.event_name != 'workflow_dispatch' || inputs.version == '' }}
             type=semver,pattern={{version}},match=^relay-v(.*)$,value=${{ inputs.version }}
             type=semver,pattern={{major}}.{{minor}},match=^relay-v(.*)$,value=${{ inputs.version }}
+            type=raw,value=main-{{commit_date 'YYYYMMDDHHmmss'}}-{{sha}},enable=${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
       - name: Merge and publish manifest
         id: manifest
         working-directory: /tmp/gateway-digests

.github/workflows/dreamforge-desktop-release.yml

@@ -157,7 +157,7 @@ jobs:
           persist-credentials: false
           ref: ${{ needs.gate.outputs.sha }}
 
-      - uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0
+      - uses: dtolnay/rust-toolchain@18f0487477426dce244608110aa2660c2893deb7 # 1.98.1
         with:
           targets: ${{ matrix.target }}
 
@@ -263,7 +263,7 @@ jobs:
           persist-credentials: false
           ref: ${{ needs.gate.outputs.sha }}
 
-      - uses: dtolnay/rust-toolchain@e081816240890017053eacbb1bdf337761dc5582 # 1.95.0
+      - uses: dtolnay/rust-toolchain@18f0487477426dce244608110aa2660c2893deb7 # 1.98.1
         with:
           targets: x86_64-pc-windows-msvc