Skip to content

[lenny] integrate REG-10: per-community brand color (NIP-11 buzz_brand_color, migration 0048) - #30

Merged
mfethe1 merged 11 commits into
product/mainfrom
integration/reg10-brand-color-run99
Sep 19, 2026
Merged

mfethe1 merged 11 commits into
product/mainfrom
integration/reg10-brand-color-run99

Conversation

@mfethe1

@mfethe1 mfethe1 commented Sep 10, 2026

Copy link
Copy Markdown
Owner

What changed

  • Per-community brand color on the workspace profile (kind:9033 write path, same seam as icon), served as namespaced buzz_brand_color in the NIP-11 document — host-scoped, no cross-tenant leak (conformance A≡B proof extended).
  • Desktop: relayBrandColor.ts applies the relay-advertised color as a composable custom property; 202-line test module.
  • Migration renumbered 0037→0048 per Michael's 2026-09-10 owner resolve (thread 79398): 0037 is upstream-owned relay_admin_action_lease, 0047 contested by upstream feat(desktop): report private per-Desktop runtime capabilities block/buzz#7333.

Merge resolution (feat/REG-10 6e1565f × product/main adeec6e)

  • runtime/migration.rs: count 45→46; brand test retargeted to version 48; include_str path depth fixed for the runtime/ move.
  • nip11.rs: RelayInfo::build merged to 8 params (brand_color 3rd; trunk's admin_api kept 7th); all 16 test call sites updated; trunk's admin_api test suite preserved intact.
  • Both sides preserved per owner resolve: upstream 0037 functionality AND the REG-10 design.

Evidence (run 99, 2026-09-10)

  • buzz-db --lib: 127P/0F · buzz-core: 262P/0F · buzz-acp: 968P/0F
  • buzz-relay --lib: 1066P/6F — failure name-set vs baseline(product/main adeec6e): zero regressions (comm -23 empty; the 6 = pre-existing api::media cluster; baseline's 7th, mesh_demo known-flake, passed on candidate)
  • desktop: typecheck rc=0; all 5 check:* guards rc=0; unit 6594P/1F — the 1 (provenance context follows exact local inventory...) fails IDENTICALLY on baseline → zero regressions; 12 new brand-color tests green
  • flutter analyze: 7 diagnostics = owner-acknowledged baseline (identical signatures); flutter test: 15 failures = baseline count, mobile/ byte-identical to product/main (0 diff lines)
  • community_brand_color_is_additive_and_mirrored_in_desired_state passes on the merged tree
  • DCO: branch commits signed-off (Michael Feth); merge commit signed-off; no AI attribution trailers

Sensitive paths (owner merge required — never self-merge)

  • migrations/0048_community_brand_color.sql (schema), schema/schema.sql, crates/buzz-db/src/store/community.rs
  • kind:9033 write authorization (relay_admin.rs), pre-auth NIP-11 exposure (nip11.rs)

UNVERIFIED

  • Postgres-gated tests (258 ignored in buzz-db; brand_color round-trip, relay_admin postgres_tests): no test database on this host — requires CI/host with Postgres.
  • Visual evidence: not captured this run (desktop-only theme change; NIP-11 JSON serialization proven by unit tests instead). Evidence gap stated explicitly per DIGEST_CONTRACT.

Merge commit: 129a3ec (integration/reg10-brand-color-run99). Authored locally (REG-10 branch authored by lenny/claude-loop, adopted per owner resolve).

Signed-off-by: Michael Feth <mfethe1@gmail.com>
…ered 0037->0048 per owner resolve thread 79398)

Merge feat/REG-10 (6e1565f) into product/main (adeec6e), resolving both
sides per Michael's 2026-09-10 owner resolve:
- migration 0037_community_brand_color.sql -> 0048_community_brand_color.sql
  (0037 is upstream-owned relay_admin_action_lease; 0047 contested by block#7333)
- runtime/migration.rs: count 45 -> 46; brand-color test retargeted version 48
- nip11.rs: RelayInfo::build merged to 8 params (brand_color 3rd, admin_api
  kept); all test call sites updated; both icon and admin_api test suites kept

Signed-off-by: Michael Feth <mfethe1@gmail.com>
@coderabbitai

coderabbitai Bot commented Sep 10, 2026

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 0c829c52-3a0e-46a6-832f-7fa316ee24ab

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

mfethe1 and others added 2 commits September 10, 2026 12:00
…ntegration

The run-99 worktree applied these fixes after the merge commit but they were
not committed before push: (1) include_str depth for runtime/ move, (2) five
7-arg RelayInfo::build test calls extended to the merged 8-param signature.

Signed-off-by: Michael Feth <mfethe1@gmail.com>
…un in brand color test

- cargo fmt --all on crates/buzz-relay/src/nip11.rs (7 diffs, all from
  RelayInfo::build gaining the brand_color parameter)
- #[allow(clippy::too_many_arguments)] on RelayInfo::build with rationale;
  the parameter is required by REG-10 and pushes arity to 8/7. Verified this
  is the only arity site in the workspace.
- Drop redundant run_migrations() from
  community_brand_color_round_trips_and_clears_independently_from_icon.
  setup_db() connects to an already-migrated shared test database; re-running
  migrations replayed 0001's CREATE TYPE channel_type and failed 42710.
  No other test in community.rs calls run_migrations.

Local gates: cargo fmt --all -- --check exit 0;
cargo clippy --workspace --all-targets -- -D warnings clean.
mfethe1 added a commit that referenced this pull request Sep 12, 2026
Trunk landed 0047_agent_machine_homes (AGENT-HOMES-001 PR-3) while this
branch carried its own 0047_task_event_changes, so both sides claimed
version 47. PR #30 already owns 0048_community_brand_color, so this takes
0049. sqlx::migrate! globs migrations/ by filename, so renaming the file
is the whole renumber. Inventory assertions pin 47 migrations, 46/47/49.
mfethe1 added a commit that referenced this pull request Sep 12, 2026
Trunk landed 0047_agent_machine_homes while this branch carried its own
0047_task_optimistic_concurrency. PR #30 owns 0048 and PR #18 owns 0049,
so this takes 0050 (matching the numbering PR #27 already expects).
sqlx::migrate! globs migrations/ by filename, so the rename is the whole
renumber. Inventory now pins 47 migrations with 50 last.
Trunk landed 0047_agent_machine_homes; this branch keeps 0048_community_brand_color.
Both are additive, so the inventory is 47 with 48 last.
…eg10-brand-color-run99

# Conflicts:
#	crates/buzz-db/src/runtime/migration.rs
@mfethe1

mfethe1 commented Sep 17, 2026

Copy link
Copy Markdown
Owner Author

🧪 Jev PR-Triage Pilot

PR #30: [lenny] integrate REG-10: per-community brand color (NIP-11 buzz_brand_color, migration 0048) — verdict: BLOCK

question answer confidence
sensitive_path P(yes)=0.99
test_coverage P(yes)=0.99
size_concern P(yes)=0.91
risk 1.97/2 0.95
route needs_review 0.77
block_reason sensitive_path 0.91

Block reason (if any): sensitive_path
Pilot: Jev (System One) typed triage. Verdict thresholds in code; escalate on low confidence.

@mfethe1

mfethe1 commented Sep 17, 2026

Copy link
Copy Markdown
Owner Author

🧪 Jev PR-Triage (v3)

PR #30: [lenny] integrate REG-10: per-community brand color (NIP-11 buzz_brand_color, migration 0048) — verdict: BLOCK

dimension metric value
Correctness problem resolved P(yes)=0.70
Correctness rework needed 0.37/2
Quality code quality 1.90/2
Quality test coverage P(yes)=0.98
Architecture integration compatibility 2.00/2
Architecture future proof 1.52/2
Governance sensitive path P(yes)=0.98
Governance size concern P(yes)=0.95
Synthesis merge risk 1.86/2
Synthesis route needs_review (0.77)
Diff security exposure P(yes)=0.18
Diff performance impact 0.28/2

🔍 Reviewer focus

  • File: crates/buzz-relay/src/handlers/relay_admin.rs
  • Concern: security

Block reason (if any): sensitive_path
Pilot: Jev (System One) typed triage, 15 metrics + reviewer focus. Verdict thresholds in code.

…or-run99

Resolve migration.rs inventory conflict: merged tree carries 49 migrations —
upstream 0045 push revocation tombstones (sync #67) + REG-10 0048
community_brand_color + fork 0046/0047/0049. Versions 45-49 at indices 44-48.
@mfethe1

mfethe1 commented Sep 17, 2026

Copy link
Copy Markdown
Owner Author

🧪 Jev PR-Triage (v3)

PR #30: [lenny] integrate REG-10: per-community brand color (NIP-11 buzz_brand_color, migration 0048) — verdict: BLOCK

dimension metric value
Correctness problem resolved P(yes)=0.68
Correctness rework needed 0.35/2
Quality code quality 1.89/2
Quality test coverage P(yes)=0.98
Architecture integration compatibility 2.00/2
Architecture future proof 1.51/2
Governance sensitive path P(yes)=0.99
Governance size concern P(yes)=0.95
Synthesis merge risk 1.87/2
Synthesis route needs_review (0.78)
Diff security exposure P(yes)=0.17
Diff performance impact 0.28/2

🔍 Reviewer focus

  • File: crates/buzz-relay/src/handlers/relay_admin.rs
  • Concern: security

Block reason (if any): sensitive_path
Pilot: Jev (System One) typed triage, 15 metrics + reviewer focus. Verdict thresholds in code.

@mfethe1

mfethe1 commented Sep 17, 2026

Copy link
Copy Markdown
Owner Author

🧪 Jev PR-Triage (v3) — ADVISORY, NON-GATING

PR #30: [lenny] integrate REG-10: per-community brand color (NIP-11 buzz_brand_color, migration 0048) — verdict: BLOCK

This verdict does not gate this PR and no human review requirement is waived or added by it. Jev is uncalibrated: the ground-truth corpus is 7 resolved PRs (1 bad), below the threshold to publish any AUC, so a BLOCK here carries no demonstrated predictive value. It is a reading suggestion — start at the focus file — not a judgment.

dimension metric value
Correctness problem resolved P(yes)=0.70
Correctness rework needed 0.38/2
Quality code quality † 1.50/2
Quality test coverage P(yes)=0.98
Architecture integration compatibility † 0.90/2
Architecture future proof † 0.90/2
Governance sensitive path P(yes)=0.99
Governance size concern P(yes)=0.95
Synthesis merge risk 1.89/2
Synthesis route needs_review (0.76)
Diff security exposure P(yes)=0.17
Diff performance impact 0.30/2

🔍 Reviewer focus

  • File: crates/buzz-relay/src/handlers/relay_admin.rs
  • Concern: security

Block reason (if any): sensitive_path
† PROBATIONAL — measured as an anti-signal on the (contaminated) pilot corpus; excluded from the verdict, shown for audit only.
Pilot: Jev (System One) typed triage, 15 metrics + reviewer focus. Verdict thresholds in code.

The brand_color migration was renumbered 0037 -> 0048 because 0037 is
upstream-owned (relay_admin_action_lease), but two comments still named
0037:

- migrations/0048: the numbering note also claimed product/main owned
  0035_task_system and a sibling branch owned 0036. Neither holds --
  0035 is relay_operators, 0036 is relay_admin_actions, task_system is
  0046. Replaced with the real reason, which migration.rs:709 already
  records.
- schema/schema.sql:61: brand_color was attributed to "migration 0037",
  pointing the schema SSOT at an unrelated upstream migration.

Comment-only; no DDL change. The three remaining 0037 references in
schema.sql (1927/1944/1971) are correct -- they describe the lease
migration -- and are untouched.

Safe to edit 0048's text: checksum immutability binds migrations already
applied by running relays; 0048 is unmerged and has no checksum pin.

cargo test -p buzz-db --lib runtime::migration: 14 passed, 0 failed --
including community_brand_color_is_additive_and_mirrored_in_desired_state,
which include_str!s both edited files.
@mfethe1

mfethe1 commented Sep 17, 2026

Copy link
Copy Markdown
Owner Author

🧪 Jev PR-Triage (v3)

PR #30: [lenny] integrate REG-10: per-community brand color (NIP-11 buzz_brand_color, migration 0048) — verdict: BLOCK

dimension metric value
Correctness problem resolved P(yes)=0.70
Correctness rework needed 0.37/2
Quality code quality 1.89/2
Quality test coverage P(yes)=0.98
Architecture integration compatibility 2.00/2
Architecture future proof 1.55/2
Governance sensitive path P(yes)=0.99
Governance size concern P(yes)=0.95
Synthesis merge risk 1.87/2
Synthesis route needs_review (0.76)
Diff security exposure P(yes)=0.17
Diff performance impact 0.30/2

🔍 Reviewer focus

  • File: crates/buzz-relay/src/handlers/relay_admin.rs
  • Concern: security

Block reason (if any): sensitive_path
Pilot: Jev (System One) typed triage, 15 metrics + reviewer focus. Verdict thresholds in code.

A 9033 event rewrote every profile field from the tags it carried, so a
field whose tag was absent was cleared. The only shipped desktop
publisher, setCommunityIcon, sends [["icon", icon]] and nothing else --
so saving a community icon silently wiped that community's brand color,
and vice versa. The single-scalar design was safe; adding a second
scalar to the same replace-command made cross-field data loss the
default path through the settings UI.

Write each field only when its own tag is present. An empty value still
clears that one field, which keeps "remove my icon" working.

Also wire the brand color to something: it set --buzz-brand-color, which
nothing in the repo read. It now feeds applyAccentColor, so a community
brand overrides the personal accent swatch while that community is
active, and the existing accent machinery handles contrast.

- relay_admin.rs: tag-presence-gated writes; correct the comment that
  claimed atomicity two sequential UPDATEs do not provide.
- relayBrandColor.ts: return the resolved color so the caller can adopt
  it; an aborted fetch returns null so a stale tenant cannot win.
- ThemeProvider.tsx: hold the brand color in state and give it
  precedence over the user accent.
- Tests: a regression test that fails on the replace semantics, plus
  ThemeProviderBrandColor.test.mjs covering the React layer -- the
  relayUrl effect, the abort cleanup, and the precedence rule. All three
  mutants (abort cleanup, precedence, adoption) now die; they survived
  every pre-existing suite.
@mfethe1

mfethe1 commented Sep 18, 2026

Copy link
Copy Markdown
Owner Author

Independent review + fix (commit 0f89e3a099)

Two independent reviewers (backend / frontend) audited this branch. I re-verified every load-bearing claim myself rather than taking the reports at face value — one reviewer finding was wrong as stated and one was a real data-loss bug.

MAJOR (fixed): kind:9033 silently cleared fields

relay_admin.rs rewrote every profile field from the tags an event carried, so an absent tag cleared its column. The only shipped 9033 publisher in the desktop app is setCommunityIcon, which sends tags: [["icon", icon]] and nothing else.

Net effect: saving a community icon wiped that community's brand color, and vice versa. The single-scalar design was safe; adding a second scalar to the same replace-command made cross-field data loss the default path through the settings UI.

Fixed by writing each field only when its own tag is present (an empty value still clears that one field, so "remove my icon" keeps working).

Proof the regression test is real — it fails on the old semantics and passes on the fix:

assertion `left == right` failed: an icon-only 9033 must NOT clear the brand color
  left: None
 right: Some("#ff8800")

MAJOR (fixed): the feature was inert

--buzz-brand-color was set by relayBrandColor.ts and read by nothing — repo-wide grep found exactly one occurrence, its own definition. Correct-but-inert plumbing. It now feeds the existing applyAccentColor, so a community brand overrides the personal accent swatch while that community is active.

Reviewer finding I rejected

The frontend reviewer claimed "ThemeProvider has zero test coverage", citing a surviving mutant. Its method was invalid — it ran mutants only against relayBrandColor.test.mjs, which never imports ThemeProvider, so the mutant could not possibly die. Seven other suites do import it.

The conclusion happened to be right for a different reason: no test anywhere passed a relayUrl prop, so the new effect and its abort cleanup genuinely were unexercised. ThemeProviderBrandColor.test.mjs now covers the effect, the abort cleanup, and the precedence rule. All three mutants die (abort cleanup, precedence, adoption); all three survived every pre-existing suite.

Also addressed

  • Corrected the relay_admin.rs comment that claimed an atomicity two sequential non-transactional UPDATEs don't provide.

Verification

  • cargo test -p buzz-relay --lib -- --ignored handlers::relay_admin — 3/3
  • cargo test -p buzz-db --lib — 130 passed / 0 failed
  • desktop suite — 6754/6755; the one failure (useKnownAgentPubkeys.test.mjs) is pre-existing, proven by stashing all my changes and reproducing it on the untouched PR head
  • just clippy clean · cargo fmt --check -p buzz-relay clean · pnpm run check rc=0
  • cargo test -p buzz-relay --lib has one failure, mesh_demo::demo_join_forwarded_arm_round_trips_echo — known pre-existing flake (~5/10, refactor(relay): expose reconnect timing policy block/buzz#2310), unrelated

Not self-merging: the fix author shouldn't be the sole approver.

@mfethe1

mfethe1 commented Sep 18, 2026

Copy link
Copy Markdown
Owner Author

🧪 Jev PR-Triage (v3)

PR #30: [lenny] integrate REG-10: per-community brand color (NIP-11 buzz_brand_color, migration 0048) — verdict: BLOCK

dimension metric value
Correctness problem resolved P(yes)=0.69
Correctness rework needed 0.39/2
Quality code quality 1.89/2
Quality test coverage P(yes)=0.98
Architecture integration compatibility 2.00/2
Architecture future proof 1.51/2
Governance sensitive path P(yes)=0.99
Governance size concern P(yes)=0.95
Synthesis merge risk 1.90/2
Synthesis route needs_review (0.78)
Diff security exposure P(yes)=0.17
Diff performance impact 0.30/2

🔍 Reviewer focus

  • File: crates/buzz-relay/src/handlers/relay_admin.rs
  • Concern: security

Block reason (if any): sensitive_path
Pilot: Jev (System One) typed triage, 15 metrics + reviewer focus. Verdict thresholds in code.

@mfethe1

mfethe1 commented Sep 19, 2026

Copy link
Copy Markdown
Owner Author

Documented sole-approver exception

Merging with the fix author as sole approver, authorised by Michael (2026-09-19, "Yes merge and do all of these"). Fork collaborators = [mfethe1] only, so no second reviewer exists; Pattern B two-agent signoff is unsatisfiable here.

Evidence at merge time, head 0f89e3a099:

  • 54 checks success / 24 skipped / 0 failure, mergeStateStatus: CLEAN
  • just clippy rc=0, cargo fmt --check rc=0
  • pnpm run check rc=0
  • 3/3 mutants killed on the abort-cleanup path, incl. the mutant that survived every pre-existing suite
  • 1 desktop failure (useKnownAgentPubkeys) proven pre-existing by reproducing it on the parent commit with all changes stashed

@mfethe1
mfethe1 merged commit 46505eb into product/main Sep 19, 2026
79 checks passed
@mfethe1
mfethe1 deleted the integration/reg10-brand-color-run99 branch September 19, 2026 19:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant