[tee8z]

Shared channel mentions currently reach the relay but a running remote harness rejects every non-owner. This layer admits an explicit mention only after a fresh encrypted manager authorization. It retains the actual requester's identity, rechecks queued tasks before context or model access, and retains signed failure replies across interrupted delivery.

Depends on #112. This is the running-agent consumer; sleeping-agent wakeup follows separately. The manager's shared_tasks setting defaults to false and supplies the authoritative manager key only to channel-thread launches. A matching agent image is required before enabling it. Owner DMs retain their existing behavior. The sharing flag rejects a bound DM explicitly; private DM memory remains available. This revision integrates the merged channel/DM binding API on current main. Shared-capable channel sessions disable personal core memory before session creation, including when a grant is enabled later.

Agents can issue a bounded, provenance-preserving handoff with buzz agents handoff <agent> --from <incoming-event-id> --message '<task>'. The owner-facing share help explicitly states that channel members invoke the agent's configured tools.

This cohesive layer exceeds the 1,000-line default because admission transport, both listener and queued-turn enforcement, durable refusal delivery, and their production-path tests must land together. Publishing the transport alone would leave no safe, usable consumer.

Validation:

• Harness unit suite: 1,100 passed, 3 ignored.
• Fresh request IDs and request-scoped reply filters; revocation between admissions; actual requester preserved through the production listener gate.
• Production queued-turn test refuses unavailable authorization before memory or ACP session creation and retains the original task.
• Durable refusal replay, bounded outbox, payload limits, and configured rollout gate tests.
• CLI: 495 passed. Full-stack manager: 141 passed, 2 ignored. Clippy passed for ACP, CLI, and manager across all targets.
• Full local CI remains limited by the host missing the unchanged Tauri GLib development package; the earlier workspace Rust lint completed successfully.

Human acceptance testing remains pending. No review-completion attestation is claimed. After the full stack and matching images are deployed: opt an agent into a shared channel, mention it from a second member, hand work to another opted-in agent in the same thread, revoke the grant, and confirm the next request is visibly refused while owner DMs still work.

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 14 billable files and costs up to $3.50.}

• Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 3 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available. Your 50 included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: voltagecloud/buzz
• Branch: feat/shared-agent-harness
• File: .coderabbit.yaml
• Commit: bca433e
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Essentials
• Run ID: b62996aa-0c0a-4220-b45f-431d1ee88ec3

Commits

Reviewing files that changed from the base of the PR and between 34d2984 and bca433e.

Files ignored due to path filters: 1

• Cargo.lock is excluded by !**/*.lock

Files selected for processing: 14

• crates/buzz-acp/Cargo.toml
• crates/buzz-acp/src/acp.rs
• crates/buzz-acp/src/config.rs
• crates/buzz-acp/src/lib.rs
• crates/buzz-acp/src/pool.rs
• crates/buzz-acp/src/runtime.rs
• crates/buzz-acp/src/sharing.rs
• crates/buzz-acp/src/sharing/notices.rs
• crates/buzz-acp/src/sharing/tests.rs
• crates/buzz-cli/src/commands/agents.rs
• crates/buzz-cli/src/commands/agents_sharing_tests.rs
• crates/buzz-cli/src/lib.rs
• crates/buzz-sandbox-reaper/src/manager.rs
• crates/buzz-sandbox-reaper/src/manager_tests/shared.rs

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

[tee8z]

Agent review: both listener admission and queued model dispatch use fresh request IDs and current manager permission. Shared work preserves the signed requester, never substitutes the owner, and cannot enter setup or lifecycle paths. Shared-capable channel sessions disable personal core memory before any grant can expose an existing session. The opt-in manager flag defaults off and is supplied only to thread launches.

Production-path tests exercised listener allow/refuse, revocation between requests, encrypted reply scoping, queued authorization failure before memory/session creation, durable signed refusal retries, and the actual handoff CLI dispatch. Harness: 1,097 passed, 3 ignored; CLI: 495 passed; manager: 139 passed, 1 ignored. Clippy passed across all targets for all three packages.

No remaining concrete blocker found in this running-agent layer. Minimalism, elegance, and correctness: 9/10 each. Sleeping-agent wakeup and the complete two-owner workflow are being validated in the next layer. Human acceptance remains pending; no completion attestation is claimed.