feat(buzz-agent): add DatabricksAuthCoordinator single-flight OAuth

.github/workflows/ci.yml

@@ -1214,6 +1214,20 @@ jobs:
         # Serial: windows_resolver_tests mutate process-global env
         # (BUZZ_SHELL/GIT_BASH/SystemRoot) that SharedState::new reads.
         run: cargo test -p buzz-dev-mcp --target $env:TARGET -- --test-threads=1
+      - name: Test (buzz-agent auth coordinator)
+        # The auth coordinator single-flights on an OS advisory lock, which is
+        # LockFileEx on Windows; this integration suite drives real second
+        # processes on the same lock file, so it only exercises the Windows
+        # lock runtime if it runs ON Windows. Every other job compiles it but
+        # never executes it. Tests exercised on Windows: lock serialization
+        # (two coordinators race for the same key), cooldown sidecar sharing
+        # across processes, attempt-sidecar adoption (UserInitiated waiter
+        # adopts a predecessor's denial), and the in-process single-flight for
+        # same-key coalescing. Tests that are UNIX-ONLY and NOT executed here:
+        # crash-release (flock drop on SIGKILL, guarded by #[cfg(unix)]) and
+        # cross-process cache success/race (on-disk token handoff, also
+        # #[cfg(unix)]).
+        run: cargo test -p buzz-agent --target $env:TARGET --test databricks_auth_coordinator
       # Smoke-test the new host-prereq contract: Git for Windows (which provides
       # bash) is available on the runner, a shell command round-trips, and bash
       # does NOT resolve from System32 (so WSL's launcher is never picked up).

Justfile

@@ -391,14 +391,21 @@ test-unit:
         # because nothing in CI runs `cargo test --workspace` — workspace
         # membership alone buys clippy/check, not a single executed test.
         cargo nextest run -p buzz-backend-kubernetes
-        # buzz-agent model-capabilities corpus: the Rust half of the
-        # cross-language drift guard. `model_capabilities.rs` embeds
-        # scripts/model-capabilities.json + scripts/normative-corpus.json via
-        # include_str! and replays the full locked corpus as pure in-process tests (no
-        # infra). Enumerated explicitly because nothing in CI runs
-        # `cargo test --workspace`; without this step a manifest edit that
-        # diverges Rust from the corpus ships green.
-        cargo nextest run -p buzz-agent --lib
+        # buzz-agent: two infra-free concerns run together by executing the
+        # whole crate (lib + integration tests), because nothing in CI runs
+        # `cargo test --workspace`, so without this stanza neither the crate's
+        # library tests nor its integration tests execute remotely.
+        #   * model-capabilities corpus (lib): the Rust half of the
+        #     cross-language drift guard. `model_capabilities.rs` embeds
+        #     scripts/model-capabilities.json + scripts/normative-corpus.json via
+        #     include_str! and replays the full locked corpus as pure in-process
+        #     tests; without it a manifest edit that diverges Rust from the
+        #     corpus ships green.
+        #   * OAuth auth coordinator (lib concurrency matrix + databricks
+        #     integration tests): lock single-flight, cooldown, cross-process
+        #     crash recovery — infra-free via a stub OIDC provider and an
+        #     injected browser opener, no network or Postgres.
+        cargo nextest run -p buzz-agent
         # Admin API auth-boundary tests (api::admin in buzz-relay): the NIP-98
         # duplicate-tag rejections, the Host/Origin replay-ordering causal pair,
         # the admin.localhost origin/advertisement/canonical-URL pins, and the

crates/buzz-agent/Cargo.toml

@@ -24,6 +24,24 @@ path = "src/main.rs"
 name = "fake-mcp"
 path = "tests/bin/fake_mcp.rs"
 
+# Test-only lock holder: a real second process that takes the coordinator's
+# cross-process advisory lock, so the auth tests can prove genuine
+# inter-process single-flight and crash-release rather than same-process
+# handles. Tiny; only used by the databricks auth integration tests.
+[[bin]]
+name = "lock-holder"
+path = "tests/bin/lock_holder.rs"
+
+# Test-only auth worker: a real second process that runs the PUBLIC auth
+# coordinator API (`acquire_with_intent`) with a scripted browser opener and a
+# shared temp cache, so the auth tests can prove the cross-process single-flight
+# contract end-to-end — durable cooldown sharing and one-grant/one-cache races
+# across a genuine process boundary, not two in-process handles. Only used by
+# the databricks auth integration tests.
+[[bin]]
+name = "auth-worker"
+path = "tests/bin/auth_worker.rs"
+
 [dependencies]
 tokio = { workspace = true, features = ["rt-multi-thread", "macros", "io-std", "io-util", "sync", "process", "time", "net"] }
 serde = { workspace = true }
@@ -45,6 +63,11 @@ url = { workspace = true }
 urlencoding = "2"
 webbrowser = "1"
 dirs = "6"
+# Cross-process advisory file lock (flock on Unix, LockFileEx on Windows) for
+# the auth coordinator's single-flight. Kept off std's `File::try_lock` so the
+# crate stays buildable on the repo's declared 1.88 MSRV (those std APIs are
+# 1.89+).
+fs2 = "0.4"
 
 [target.'cfg(unix)'.dependencies]
 nix = { version = "0.31", default-features = false, features = ["signal", "process"] }