chore(sync): merge upstream block/buzz main and buzz-gpui master

.config/nextest.toml

@@ -24,10 +24,17 @@ fail-fast = false
 # wrapper retained one database per concurrently running test process.
 test-threads = 8
 
+[test-groups.postgres-cluster-global]
+# These tests inspect cluster-wide activity or create least-privilege sessions,
+# so database-per-test isolation alone cannot make them independent.
+max-threads = 1
+
 [[profile.postgres-ci.overrides]]
 filter = "test(/cluster_global_/)"
-# Activity scans also observe ordinary tests connecting to the same cluster.
-# Reserve every worker so those tests and their wrappers cannot overlap a scan.
+test-group = "postgres-cluster-global"
+# The group only serializes these tests with each other. They read unfiltered,
+# cluster-wide `pg_stat_activity`, so any overlapping test's session can mask
+# activity; claim every worker so they run alone.
 threads-required = "num-test-threads"
 
 [[profile.postgres-ci.scripts]]
@@ -36,3 +43,13 @@ threads-required = "num-test-threads"
 filter = "(test(/postgres_tests::/) or binary(/^postgres_/)) and not test(/(^|::)external_infra[^:]*::/)"
 setup = "postgres-template"
 run-wrapper = "postgres-isolation"
+
+[profile.flake]
+# The advisory pull-request flake lane (scripts/flake-check.mjs rust) repeats
+# a selection and must see every failed repetition, so no retries; the JUnit
+# report gives it per-test statuses.
+retries = 0
+fail-fast = false
+
+[profile.flake.junit]
+path = "junit.xml"

.env.example

@@ -52,25 +52,30 @@ REDIS_URL=redis://localhost:6379
 # Emergency kill switch for all automatic partition DDL, including catch-all
 # advancement; audits remain enabled.
 # BUZZ_PARTITION_MANAGER_CREATE_ENABLED=true
-# Opt in to replacing an empty partition catch-all with six months of dedicated
-# monthlies, at startup and on every audit interval (default false). Has no
-# effect while the kill switch above is off.
-# BUZZ_PARTITION_MANAGER_ADVANCE_ENABLED=false
+# Replace an empty partition catch-all with six months of dedicated monthlies,
+# at startup and on every audit interval (default true). Has no effect while the
+# kill switch above is off.
+# BUZZ_PARTITION_MANAGER_ADVANCE_ENABLED=true
 
 # Writer-session Postgres timeouts for buzz-db-backed pools and the relay audit
-# pool, all in milliseconds; 0 disables. The separately deployed push gateway
-# owns its own database and session policy and does not consume these knobs.
+# pool, all in milliseconds; 0 disables the lock and idle timeouts. The
+# separately deployed push gateway owns its own database and session policy
+# and does not consume these knobs.
 # lock_timeout: fail a statement that waits this long on any lock instead of
 # parking behind a wedged holder (default 5000).
 # BUZZ_DB_LOCK_TIMEOUT_MS=5000
 # idle_in_transaction_session_timeout: reap sessions idle inside an open
 # transaction — bounds how long a wedged client can hold locks (default 60000).
 # BUZZ_DB_IDLE_TXN_TIMEOUT_MS=60000
-# statement_timeout: cap any single statement's runtime. Off by default —
-# startup migrations/backfills legitimately run long statements. Warning: a
-# pathologically low value (e.g. 1) also times out connection setup and can
-# prevent any DB connection from establishing.
-# BUZZ_DB_STATEMENT_TIMEOUT_MS=0
+# statement_timeout: cap any single statement's runtime (default 120000). A
+# session cannot disable it: 0 or anything above 300000 installs 300000 (5
+# minutes) and logs a warning at startup. Migrations, schema destruction, and
+# community-deletion inventory and purge transactions lift it for themselves.
+# Generic event reads (REQ history, /query, /count) and read-replica sessions
+# are further capped at 20s. Warning: a pathologically low value (e.g. 1) also
+# times out connection setup and can prevent any DB connection from
+# establishing.
+# BUZZ_DB_STATEMENT_TIMEOUT_MS=120000
 
 # -----------------------------------------------------------------------------
 # Typesense (search)
@@ -95,6 +100,8 @@ RELAY_URL=ws://localhost:3000
 
 # NIP-PL mobile push is an explicit deployment opt-in. A gateway URL alone
 # never enables it. When enabled, the exact HTTP(S) delivery URL is required.
+# Rollback requires replacing every enabled writer/worker process. Inspect and
+# explicitly decide retained queue disposition before re-enabling (see docs/push-gateway-deployment.md).
 BUZZ_PUSH_ENABLED=false
 BUZZ_PUSH_GATEWAY_DELIVERY_URL=https://push.buzz.xyz/v1/deliveries/apns
 
@@ -148,10 +155,20 @@ BUZZ_PUSH_GATEWAY_DELIVERY_URL=https://push.buzz.xyz/v1/deliveries/apns
 
 # Deployment-global operator-listener routes. Each configured Nostr identity
 # may register target pubkeys and receives mention notifications at its URL.
+# URLs may use HTTP or HTTPS. Use HTTP only for operator-controlled internal
+# connections: NIP-98 signs requests but does not encrypt them, and
+# notifications carry full message content.
 # Format: pubkey:deliveryUrl;pubkey:deliveryUrl
 # BUZZ_OPERATOR_LISTENER_TIMEOUT_MS=5000
 # BUZZ_OPERATOR_LISTENERS=<64-char hex pubkey>:https://listener.example/mentions
 
+# Optional endpoint that receives each new per-community storage snapshot
+# written by `buzz-admin storage-snapshot`, in NIP-98 relay-signed POST batches
+# shaped like kgoose's storage-usage record request. One relay pod checks for a
+# new snapshot every 5 minutes. Receivers must treat a repeated community and
+# measured_at as already recorded.
+# BUZZ_STORAGE_USAGE_URL=https://kgoose.example/cash-app/goose/v1/buzz/storage-usage/record
+
 # Optional relay-owned KLIPY key. When set, NIP-11 advertises GIF search and
 # authenticated desktop clients use this relay as the metadata/search proxy.
 # Keep the real value in your deployment's secret manager; never commit it.
@@ -223,7 +240,80 @@ BUZZ_S3_ADDRESSING_STYLE=path
 RUST_LOG=buzz_relay=debug,buzz_datastore=info,buzz_db=debug,buzz_auth=debug,buzz_pubsub=debug,tower_http=debug
 # Optional OpenTelemetry-only target filter. This is deliberately independent
 # from RUST_LOG so log verbosity changes cannot break trace parentage.
-# BUZZ_OTEL_FILTER=buzz_relay=info,buzz_datastore=info
+# BUZZ_OTEL_FILTER=buzz_relay=info,buzz_relay::access=off,buzz_datastore=info
+#
+# Access log: the relay writes JSON lines for security-relevant actions under
+# the `buzz_relay::access` target, with an `event` field of `http`, `auth`,
+# `req`, `count`, `sync`, or `close`. `http` is one line per HTTP request, written
+# by one layer when the response is ready (not proof the body was delivered):
+# `route` is the matched route template (never the raw path), with the response
+# `status` and `time_to_response_ms` on every line. It carries the login
+# (`method`, `pubkey`, `pubkey_verified`) and `outcome` (`success`, `denied`,
+# `failed`, `challenged`, or `undecided` when the route recorded no decision; a
+# refusal is final). `/query` and `/count` add the filter summary and
+# `result_count`; `/events` adds `accepted`, `kind`, `event_id` and a fixed
+# `reject_reason` code; invite and admin attachment routes add their own fields
+# (`invite_id`, `expires_at`, `max_uses`, `joined`, `feedback_id`,
+# `attachment_sha256`). Invite codes, tokens and Blossom read hashes are never
+# logged. An attachment read with admin auth disabled logs
+# `method=network_trusted` and no key. A request dropped before its response
+# logs `request=aborted` with no `status`.
+# Every matched route is logged except `/` (non-upgrade), `/info`,
+# `/.well-known/nostr.json`, `/health`, `/_liveness` and `/_readiness`.
+# Requests matching no route log only at status 400 and above, as
+# `route="<unmatched>"`, except that the SPA and static files the relay
+# serves when enabled (web assets, invite landing pages, git web pages, the
+# admin bundle) log nothing at any status, including 404. Successful WebSocket
+# upgrades log no `http` line.
+# `auth` is one line per WebSocket login, written when it succeeds or is
+# refused; every root WebSocket `auth` line carries the TCP `peer_addr`.
+# `req` / `count` / `sync` is one line per WebSocket read (a NIP-AR sync
+# subscription is a `sync` read), with the same filter summary
+# (search text is never logged, only `search: true`). A `sync` line is written
+# when its initial set completes, not when live delivery ends: its summary is
+# the registered live filter (kinds and channels, never artifact predicates)
+# and `events_queued` counts the initial set. `buzz_ws_reads_total` counts
+# parsed reads by `type` (`req`, `count`, `sync`). The summary lists up to
+# 10 kinds, channel ids, authors and `p` values each; `kind_count`,
+# `channel_count`, `author_count` and `p_count` appear only when the list is
+# `*` or shows fewer values than the filters held. `close` is the
+# connection's one line: duration, totals, the login's `pubkey`, `method` and
+# `pubkey_verified`, and `reads_suppressed` / `auth_suppressed` for repeated
+# refusals past the first 16. It is written however the connection ends, with
+# `refused` (`not_admitted`, `connection_limit`) when the relay refused it
+# before serving it. Refusals that arrive after `close` has been written log
+# their own lines.
+# Successful lines and git's credential-less first request
+# (`outcome=challenged`) are INFO; refusals, error statuses and aborted
+# requests are WARN. A successful `/query` or `/count` that returned nothing
+# (`result_count=0`) is DEBUG, since polling clients make most of them. A
+# WebSocket read is WARN only when it ends in `error`;
+# refused and `aborted` reads stay INFO, since `aborted` means the read ended
+# before completing: the client closed the connection or sent CLOSE, a same-ID
+# REQ replaced it, or the session was cancelled, all of which are routine. Turn it down with
+# `buzz_relay::access=warn` (keeps refusals, errors and aborted HTTP requests,
+# and of WebSocket reads only `error` outcomes) or `buzz_relay::access=off` in
+# RUST_LOG.
+# It is off in the OTel export by default so lines are not shipped twice.
+# Removed or renamed: `NIP-42 auth successful/failed`, `WebSocket connection
+# established/closed` and the `event=connect` line (folded into `close`), `HTTP
+# bridge request` (folded into the bridge's `http` line), `Event ingested via
+# pipeline` (the WebSocket `Event ingested` line and the `/events` line carry
+# its fields), `relay invite minted`, `relay member added via invite` and `admin
+# feedback attachment read` (folded into the route's `http` line), the `addr`
+# field, now `peer_addr`, and the JSON `span` field (`spans` already ends with
+# the current span; a line logged under an explicit parent span loses that
+# parent's fields). Git subprocess stderr moved from WARN to DEBUG because hook
+# output can contain message text.
+
+# Request header holding the real client IP, logged as `client_ip` on `http`,
+# `auth`, `close` and connection-limit lines next to `peer_addr` (optional,
+# case-insensitive; unset or empty turns it off). A list value logs its
+# rightmost entry; a value that isn't an IP address is not logged. Set it only
+# when every request reaches the relay through a proxy that overwrites this
+# header (for example `cf-connecting-ip` behind Cloudflare or `x-real-ip`
+# behind nginx); otherwise clients can forge it.
+# BUZZ_CLIENT_IP_HEADER=x-real-ip
 
 # OTLP tracing endpoint (optional — leave unset to disable)
 # OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317
@@ -367,3 +457,28 @@ RUST_LOG=buzz_relay=debug,buzz_datastore=info,buzz_db=debug,buzz_auth=debug,buzz
 # BUZZ_TERMS_OF_SERVICE_MARKDOWN="# Terms of Service\n\nFull terms here."
 # BUZZ_PRIVACY_POLICY_MARKDOWN="# Privacy Policy\n\nFull policy here."
 # BUZZ_AGE_ATTESTATION_REQUIRED=true
+
+# ── NIP-FI database community source ─────────────────────────────────────────
+# Where NIP-FI communities come from: "env" (BUZZ_NIP_FI_COMMUNITIES, default)
+# or "database" (bindings created by provisioning; needs
+# BUZZ_NIP_FI_PROVISION_BINDING and must not be combined with
+# BUZZ_NIP_FI_COMMUNITIES). See docs/operator-nip-fi-bindings.md.
+# BUZZ_NIP_FI_COMMUNITY_SOURCE=env
+# Most community-issuer rows one snapshot may hold (1..=10000000).
+# BUZZ_NIP_FI_SNAPSHOT_MAX_ROWS=1000000
+# Snapshot load timeout in ms; must be under the 30s refresh interval.
+# BUZZ_NIP_FI_SNAPSHOT_REFRESH_TIMEOUT_MS=10000
+# Hosts whose "not found" is cached for 5s (1..=1000000).
+# BUZZ_NIP_FI_RESOLVER_NEGATIVE_CACHE_MAX=100000
+# Concurrent live lookups; clamped below the database pool size.
+# BUZZ_NIP_FI_RESOLVER_MAX_INFLIGHT=8
+
+# Optional absolute legacy-v1 invite cutoff, UTC RFC3339 whole seconds.
+# Unset preserves natural token expiry; never changes v2 invitations.
+# BUZZ_INVITE_V1_INVALID_AFTER=2026-12-01T00:00:00Z
+
+# Optional NIP-FI historical verified profiles (disabled by default): issuer JSON
+# entries may set public_profile=true, public_issuer_label="Example Corp", and
+# verified_at_refresh_seconds=3600 (integer 0..86400). Requires a stable relay
+# key and NIP-FI enforcement. Profiles are historical records and are never
+# retracted.

.github/scripts/codex-security-review.test.js

@@ -203,7 +203,7 @@ const NO_FINDINGS_REVIEW = {
 
 async function postReview(state, review = NO_FINDINGS_REVIEW) {
   const environment = {
-    CODEX_MODEL: "gpt-5.6-sol",
+    CODEX_MODEL: "gpt-6.1-sol",
     GITHUB_REPOSITORY: "block/buzz",
     GITHUB_RUN_ID: "1234",
     GITHUB_SERVER_URL: "https://github.com",