Refine shared compute setup experience - #7014
Open
sandro-sq wants to merge 27 commits into
Open
Conversation
Bump every mesh-llm git dependency in buzz-relay and buzz-desktop from v0.75.1 to v0.76.0-rc3, and make Qwen3.8 27B Q4_K_M the curated pick for 64GB-class machines. The rc carries the two changes that make Qwen3.8 safe to recommend: Mesh-LLM/mesh-llm#1283 routes Qwen3.8 identities to the qwen35 recurrent family (without it the identity compacts to a string matching neither qwen35 nor qwen36, so a hybrid recurrent model is classified as dense attention-KV), and #1342 restores recurrent shared prefixes. #1343 adds Qwen3.8-27B-Q4_K_M to the compiled MODEL_CATALOG. Because the large pick now exists in MODEL_CATALOG, the synthesized catalog entry Buzz carried for the gemma-4-26B pick is removed along with its size/file/description constants; the entry is canonicalized from the upstream catalog instead. The retired gemma-4-26B alias is kept in canonical_curated_model_id so machines that already selected it keep resolving to a model id Mesh's OpenAI ingress accepts. Dependency resolution notes: iroh moves 1.0.2 -> 1.0.3 to match the rc's requirement, and libsqlite3-sys moves 0.30.1 -> 0.35.0 because the rc's mesh-llm-log-store requires rusqlite 0.37 (only one package may link sqlite3). Verification: cargo check passes for buzz-relay and for buzz-desktop with --features mesh-llm; 2611 buzz-desktop tests pass; cargo fmt --check is clean. Two failures predate this change and reproduce on unmodified origin/main: the global_config inherited_shared_compute_translates_to_supported_agent_transport assertion (expects "auto", gets "mesh") and an items-after-test-module clippy lint in managed_agents/restore.rs. Not runtime-verified against a live Qwen3.8 mesh node from this branch. Co-authored-by: Michael Neale <michael.neale@gmail.com> Signed-off-by: Michael Neale <michael.neale@gmail.com>
buzz-agent's `BUZZ_AGENT_LLM_TIMEOUT_SECS` defaults to 240s. MeshLLM's OpenAI frontend gives a backend call 600s (`OpenAiFrontendConfig::DEFAULT_BACKEND_TIMEOUT`), so on shared compute the client aborts work the server is still legitimately doing. Requests to a local mesh are `stream: false`, so a cold multi-ten-thousand token prefill is one silent request. Measured on an M5 Max serving Qwen3.8-27B Q4_K_M: an 88,318-token cold prompt returns HTTP 200 after 503s at 176 tok/s prefill. At the 240s default the client gives up at four minutes, then retries with an escalated budget (240 -> 480 -> 960), piling load onto a box that is already prefilling the first attempt. Seat the mesh client budget at 660s, just above the frontend's 600s, so the mesh's own error surfaces rather than a client abort racing it. Remote providers are untouched and keep buzz-agent's 240s default. Like the other mesh seeds this is a default, not policy: an explicit user value survives via `insert_default_if_unset` plus the copy-forward list in `relay_mesh_process_env`. Co-authored-by: Michael Neale <michael.neale@gmail.com> Signed-off-by: Michael Neale <michael.neale@gmail.com>
Bump every mesh-llm git dependency in buzz-relay and buzz-desktop from the v0.76.0-rc3 tag to v0.76.0-rc4. rc4 is a low-risk move from rc3: git diff v0.76.0-rc3..v0.76.0-rc4 in Mesh-LLM/mesh-llm touches only generated console web assets and the release version bump, so the runtime behaviour Buzz depends on is the same code we already validated. It is the first release tag carrying the Qwen3.8 fixes as a downloadable artifact for every platform, which means nodes no longer need a source build to serve the curated large pick. The Qwen3.8 27B curated recommendation from the rc3 commit is unchanged. Verification: cargo check passes for buzz-relay and for buzz-desktop with --features mesh-llm. The one warning emitted (unreachable statement in commands/workspace.rs) predates this change. Co-authored-by: Michael Neale <michael.neale@gmail.com> Signed-off-by: Michael Neale <michael.neale@gmail.com>
desktop-standalone was the only launch recipe that ignored the `mesh` variable. dev, staging and production all build FEATURES=(--features mesh-llm) when it is set; desktop-standalone invoked `tauri dev` with no features, so `just mesh=1 desktop-standalone` silently produced a non-mesh build and the app reported "mesh-llm feature not enabled" from desktop/src-tauri/src/mesh_llm_stubs.rs. Wire it up the same way as the other three recipes. Co-authored-by: Michael Neale <michael.neale@gmail.com> Signed-off-by: Michael Neale <michael.neale@gmail.com>
Bump every mesh-llm git dependency in buzz-relay and buzz-desktop from the v0.76.0-rc4 tag to v0.76.0-rc6, and regenerate both lockfiles at tag commit a8ddb455. Verification: cargo check -p buzz-relay --all-targets and cargo check --manifest-path desktop/src-tauri/Cargo.toml --features mesh-llm --all-targets pass. The desktop check retains the pre-existing unreachable-code warning in commands/workspace.rs. The buzz-relay package suite compiled rc6 and ran 892 passing tests, but its existing mesh demo forwarded-arm test timed out with HTTP 504 twice. Co-authored-by: Michael Neale <michael.neale@gmail.com> Signed-off-by: Michael Neale <michael.neale@gmail.com>
…ership Mesh admission is seeded from the relay's NIP-43 membership snapshot (kind:13534), which is built purely from the `relay_members` table. On a relay running with `BUZZ_REQUIRE_RELAY_MEMBERSHIP=false`, signing in never writes a `relay_members` row, so that snapshot lists at most whoever was added out of band. Ordinary participants are absent from it. Desktop treated that as an authoritative roster, so every node resolved an empty intersection, fell back to `trust_owners([self])`, and sat at "1 NODE" with an empty peer list forever. Two machines sharing compute on the same open relay could never see each other, through any number of restarts. Admission was only part of it: `availability_from_events` also required a snapshot and filtered status notes to `members.contains(reporter)`, so serve-target discovery was membership-gated too. Relaxing admission alone would still have left peers undiscoverable. Resolve the relay's membership mode from its NIP-11 document instead. The relay advertises NIP-43 only when membership is actually enforced, so the advertisement is a faithful signal. When it is absent, skip the snapshot requirement for routing and pass `trusted_owner_ids: None`, which the existing SDK path already maps to `TrustPolicy::Off` — stock MeshLLM behaviour, scoped by the relay-derived mesh topic. Membership emptiness deliberately does NOT drive this. On an enforcing relay a missing snapshot is a transient replication gap, and the existing code treats it as an error precisely so a blip cannot flap a live node down to self-only. Keying open-mesh off "no snapshot" would have turned that blip into a silent loss of admission enforcement. A failed NIP-11 probe therefore falls back to the enforcing behaviour: an unreachable relay can never relax admission. Closed-relay behaviour is unchanged, including the fail-closed error and the shrink hysteresis. `roster_reconcile_action` maps `Ok(None)` to `Keep`: a node already enforcing an allowlist keeps it, so a mid-flight NIP-11 change cannot de-restrict a running mesh. Freshness and owner-signed endpoint binding still gate routing on an open relay; only the membership intersection is lifted. Co-authored-by: Michael Neale <michael.neale@gmail.com> Signed-off-by: Michael Neale <michael.neale@gmail.com>
…-rc3 * origin/main: (86 commits) Centralize replaceable event persistence (#6660) feat(workflows): discover trigger filter values (#6712) feat(desktop): simplify the message action rail (#6529) fix(desktop): restore icon-only remote marker (#6491) fix(ci): prevent poisoned Rust caches (#6618) docs(security): route reports through private advisories (#6728) fix(composer): wrap Buzz chip labels without orphaning icons (#6581) fix(desktop): bound thread /query and surface load errors, not false-empty (#6447) fix(messages): route edits to the owning composer (#6575) fix(mobile): join starter channels after accepting invite (#5915) Add mobile profile editing (#6583) fix(desktop): align jump-to-latest pill with composer height (#6606) fix(desktop): emit singular `mention` feed category so alerts route correctly (#6665) fix(mobile): recover stale and shuffled messages (#6691) feat(mobile): browse and join open channels (#6243) show mention counts in channel notifications (#6696) fix(desktop): hide selection formatting tray on composer right-click (#6683) fix(desktop): stabilize members dialog scrolling (#6670) fix(desktop): keep member runtime status off the UI thread (#6445) perf(desktop): persist channel heads, collapse thread reads and reply sends (#6572) ...
…e, and probing Follow-up to the open-mesh change (d99cba5), closing three gaps found in review: 1. A stray membership snapshot on an open relay no longer gates routing. Admission runs TrustPolicy::Off there, but discovery still intersected status notes with any kind:13534 roster that happened to exist (added out of band), and the query layer applied the same authors filter — a hybrid where admission admits everyone while discovery hides non-roster peers. Both branches now check the relay mode: open relays ignore membership entirely and rely on freshness plus owner-signed endpoint binding. 2. Reconcile recovers a node isolated by the startup probe fallback. A transient NIP-11 probe failure at start falls back to the enforcing path and a self-only allowlist; treating Ok(None) as an unconditional Keep then pinned that node at "1 NODE" until an app restart — the original bug, reintroduced by one HTTP blip. A self-only roster admits nobody else, so restarting into open mesh relaxes nothing that protected anyone. An allowlist admitting other owners is still never relaxed mid-flight. 3. Successful NIP-11 probes are memoized per relay URL. The deployment mode does not flap at runtime, and discovery re-probed on every reconcile poll. Failures are not cached, so the fallback in (2) re-probes and recovers. Co-authored-by: Michael Neale <michael.neale@gmail.com> Signed-off-by: Michael Neale <michael.neale@gmail.com>
Bump every MeshLLM git dependency in buzz-relay and buzz-desktop from v0.76.0-rc6 to the released v0.76.0-rc7 tag at 5d07a20b, and regenerate both lockfiles. The transitive lockfile delta follows rc7's dependency graph; json5 is removed and the Windows/proc-macro families move to the versions rc7 selects. Review also closes two open-relay gaps: malformed NIP-11 mode evidence now keeps the fail-closed fallback, and persisted-agent bootstrap target resolution uses the relay mode instead of reapplying closed-membership filtering on open relays. Verification: both package suites compile against rc7. Desktop mesh-focused tests pass (88 passed, 1 ignored). The full desktop suite retains the pre-existing inherited shared-compute assertion failure (mesh vs auto); the relay suite retains the pre-existing mesh demo forwarded-arm HTTP 504 (908 passed, 1 failed, 48 ignored). Co-authored-by: Jimmy <1fe240cd1a8cf775f6f3060f115e5a303181f3abf28ad4cb0c2515f4a02b36a8@meshllm.communities.buzz.xyz> Signed-off-by: Jimmy <1fe240cd1a8cf775f6f3060f115e5a303181f3abf28ad4cb0c2515f4a02b36a8@meshllm.communities.buzz.xyz>
Signed-off-by: Jimmy <1fe240cd1a8cf775f6f3060f115e5a303181f3abf28ad4cb0c2515f4a02b36a8@meshllm.communities.buzz.xyz> Co-authored-by: Jimmy <1fe240cd1a8cf775f6f3060f115e5a303181f3abf28ad4cb0c2515f4a02b36a8@meshllm.communities.buzz.xyz>
Co-authored-by: Jimmy <1fe240cd1a8cf775f6f3060f115e5a303181f3abf28ad4cb0c2515f4a02b36a8@meshllm.communities.buzz.xyz> Signed-off-by: Jimmy <1fe240cd1a8cf775f6f3060f115e5a303181f3abf28ad4cb0c2515f4a02b36a8@meshllm.communities.buzz.xyz>
…-6189-fresh Co-authored-by: Michael Neale <michael.neale@gmail.com> Signed-off-by: Michael Neale <michael.neale@gmail.com>
Route agent-form shared-compute discovery through the same NIP-11 mode resolution used by mesh startup and routing. Open relays no longer trigger the closed-relay member-roster warning. Co-authored-by: Mic Neale <305999590+micspiral@users.noreply.github.com> Signed-off-by: Jimmy <1fe240cd1a8cf775f6f3060f115e5a303181f3abf28ad4cb0c2515f4a02b36a8@meshllm.communities.buzz.xyz>
Signed-off-by: Jimmy <1fe240cd1a8cf775f6f3060f115e5a303181f3abf28ad4cb0c2515f4a02b36a8@meshllm.communities.buzz.xyz>
Reject partially malformed supported_nips arrays instead of treating an ambiguous NIP-11 document as evidence that membership is disabled. Remove the permanent relay-mode cache so open runtimes can detect a relay that later enables membership enforcement. Keep established closed runtimes on their existing roster-only reconcile path. Only open and startup-fallback self-only runtimes re-probe mode; failed probes preserve the current policy, while a valid closed result restarts into the fetched allowlist. Co-authored-by: Jimmy <1fe240cd1a8cf775f6f3060f115e5a303181f3abf28ad4cb0c2515f4a02b36a8@meshllm.communities.buzz.xyz> Signed-off-by: Jimmy <1fe240cd1a8cf775f6f3060f115e5a303181f3abf28ad4cb0c2515f4a02b36a8@meshllm.communities.buzz.xyz>
Signed-off-by: Jimmy <1fe240cd1a8cf775f6f3060f115e5a303181f3abf28ad4cb0c2515f4a02b36a8@meshllm.communities.buzz.xyz>
The mode-aware resolver replaced the legacy closed-only helper in production. Keep the compatibility wrapper available to its existing closed-mode tests without leaving an unused production export. Co-authored-by: Jimmy <1fe240cd1a8cf775f6f3060f115e5a303181f3abf28ad4cb0c2515f4a02b36a8@meshllm.communities.buzz.xyz> Signed-off-by: Jimmy <1fe240cd1a8cf775f6f3060f115e5a303181f3abf28ad4cb0c2515f4a02b36a8@meshllm.communities.buzz.xyz>
Exercise the real NIP-11 HTTP probe three times at one URL as its response changes from open to closed to malformed. This guards against restoring the permanent mode cache and proves malformed evidence cannot be interpreted as open. Co-authored-by: Jimmy <1fe240cd1a8cf775f6f3060f115e5a303181f3abf28ad4cb0c2515f4a02b36a8@meshllm.communities.buzz.xyz> Signed-off-by: Jimmy <1fe240cd1a8cf775f6f3060f115e5a303181f3abf28ad4cb0c2515f4a02b36a8@meshllm.communities.buzz.xyz>
Co-authored-by: Jimmy <1fe240cd1a8cf775f6f3060f115e5a303181f3abf28ad4cb0c2515f4a02b36a8@meshllm.communities.buzz.xyz> Signed-off-by: Jimmy <1fe240cd1a8cf775f6f3060f115e5a303181f3abf28ad4cb0c2515f4a02b36a8@meshllm.communities.buzz.xyz>
Keep relay-mode evidence distinct from roster availability so an open runtime restarts once NIP-11 proves membership enforcement, even when the first roster snapshot is unavailable. Run the feature-enabled desktop mesh tests in CI and correct the newly exercised wire-model expectation. Co-authored-by: Jimmy <1fe240cd1a8cf775f6f3060f115e5a303181f3abf28ad4cb0c2515f4a02b36a8@meshllm.communities.buzz.xyz> Signed-off-by: Jimmy <1fe240cd1a8cf775f6f3060f115e5a303181f3abf28ad4cb0c2515f4a02b36a8@meshllm.communities.buzz.xyz>
Require a successful HTTP status before accepting supported_nips as relay-mode evidence. Cover a valid-shaped open body returned with 503 so an HTTP failure cannot disable admission. Co-authored-by: Jimmy <1fe240cd1a8cf775f6f3060f115e5a303181f3abf28ad4cb0c2515f4a02b36a8@meshllm.communities.buzz.xyz> Signed-off-by: Jimmy <1fe240cd1a8cf775f6f3060f115e5a303181f3abf28ad4cb0c2515f4a02b36a8@meshllm.communities.buzz.xyz>
Co-authored-by: Jimmy <1fe240cd1a8cf775f6f3060f115e5a303181f3abf28ad4cb0c2515f4a02b36a8@meshllm.communities.buzz.xyz> Signed-off-by: Jimmy <1fe240cd1a8cf775f6f3060f115e5a303181f3abf28ad4cb0c2515f4a02b36a8@meshllm.communities.buzz.xyz>
Require two consecutive observations before whole-app restarts, fail closed after repeated unknown mode reads, and throttle self-only-to-open recovery restarts across process launches. Add feature-enabled mesh clippy to CI and resolve the warnings it exposes. Clarify transport trust and catalog contracts. Co-authored-by: Jimmy <1fe240cd1a8cf775f6f3060f115e5a303181f3abf28ad4cb0c2515f4a02b36a8@meshllm.communities.buzz.xyz> Signed-off-by: Jimmy <1fe240cd1a8cf775f6f3060f115e5a303181f3abf28ad4cb0c2515f4a02b36a8@meshllm.communities.buzz.xyz>
Apply one persisted cooldown and in-memory latch to both admission-mode restart paths, retain throttling across clock rollback, and cover the composed self-only hysteresis wiring. Make the shared Tauri clippy recipe feature-enable mesh support so local checks and CI stay aligned. Co-authored-by: Jimmy <1fe240cd1a8cf775f6f3060f115e5a303181f3abf28ad4cb0c2515f4a02b36a8@meshllm.communities.buzz.xyz> Signed-off-by: Jimmy <1fe240cd1a8cf775f6f3060f115e5a303181f3abf28ad4cb0c2515f4a02b36a8@meshllm.communities.buzz.xyz>
Remove the open-relay/open-mesh admission mode from PR #6189 at Mic's direction: running the mesh unenforced when the Buzz relay does not enforce NIP-43 membership is not a product mode we want, and it was the source of all the fail-open complexity (NIP-11 mode probing, the two-observation mode state machine, restart markers/throttles/latches). Reverted to main's behavior: admission is always roster/allowlist driven. On a relay with no membership snapshot the mesh simply runs self-only — safe and boring, no mode probes, no whole-app restarts. Removed: MeshRelayMode, relay_mesh_mode_from_nip11, the NIP-11 mode probe, coordinator_admission.rs, mode-scoped discovery/availability, and all their tests. Kept from this branch (independent of the mode work): - mesh-llm 0.76.0-rc7 upgrade and the restored hardware model ladder - BUZZ_AGENT_LLM_TIMEOUT_SECS=660 mesh client timeout default - desktop-standalone mesh=1 feature flag wiring - cfg-only warning fixes in workspace.rs and restore.rs desktop-tauri-clippy now lints BOTH cfg graphs (default and --features mesh-llm): features are additive, so a single invocation covers only one graph, and both ship (release-windows builds without mesh-llm). CI keeps calling the recipe, and keeps the feature-enabled --lib test step. Verified on this commit: clippy -D warnings clean on both graphs; feature-enabled lib suite 3110 passed / 0 failed / 19 ignored; default-feature lib suite 3005 passed / 0 failed; fmt and diff checks clean. Signed-off-by: Michael Neale <michael.neale@gmail.com>
Signed-off-by: Alessandro Joabar <sandro@squareup.com>
🔐 Codex Security Review
|
Signed-off-by: Alessandro Joabar <sandro@squareup.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Testing
just ciNotes
Built on top of #6189 so the UX changes can be reviewed independently without modifying Mic's branch.