feat(hosts): preview durable Start, certified Stop and same-agent Move

[loganj]

Summary

Combined preview candidate for owner-private host inventory and same-agent execution across opted-in desktop hosts:

• owner-authenticated, community-scoped host history/run presence and encrypted execution commands/receipts;
• durable Start intent/replay and exact-generation Stop, with a supported ACP → agent → MCP → owned-shell completion proof;
• Move = confirmed selected-source Stop followed by a fresh same-agent destination session, not workspace/file/session transfer;
• ordinary Desktop controls share the same execution journal. The final B1 delta captures Restart's community across its Stop await, preserves native owner/community binding through preflight, and permits explicit local retry after definite pre-spawn rejection without weakening remote provisioning admission or uncertain-state fences;
• retain the pending mesh echo receive across housekeeping ticks (same repair also proposed separately in fix(mesh): retain echo receive across housekeeping ticks #7140).

Source candidate: 8671f76f3815187ef53a81d3ceccbcb0a8443367, based on 93237b4a745b14cb8bfe292053bf34adef652d29. See docs/host-execution.md for the protocol, lifecycle boundaries and evidence limitations. No agent config-model rules changed.

Validation and source binding

The affected B1 delta at 51f30353 passed:

• native execution/recovery: 9 passed, 1 intentionally ignored opt-in real-process test;
• runtime commands 8, scope 11, agent command tests 31;
• desktop affected lifecycle JS: 21 passed;
• clippy (--lib --features remote-start-preview -- -D warnings), native fmt, TS, Biome, repository differential size and whitespace checks;
• rebased ACP author gate: 28 passed; workflow owner: 9 passed. These are actual nonzero test filters.

Earlier frozen integrated source 8e31847c685dc8e595f508c7c75f7b654a5fabf1 passed the full native suite (3035 passed / 19 ignored), full desktop JS suite (5940 passed), clippy/fmt/TS/Biome/size. These are reused unaffected-suite evidence, not full-suite reruns on the final descendant. Startup shutdown tests passed 3/3 after rebase. No claim that just ci has been rerun on this exact head; this draft requests useful current remote checks.

Prior live native tracing demonstrated same identity/new destination generation, correlated Stop→Start, old source presence gone, unrelated peer preserved, and ordinary Stop/Start/Restart plus stale-Stop retry rejection. That used two local native executors on one physical machine and a synthetic provider. An early ACP-initialization Restart returned RootExited and correctly blocked replacement; it is retained as a negative result. It did not exercise the final summary/profile B1 workflow.

Review and CI follow-through

Independent review of 51f30353 found both original B1 repairs sound but caught a new native caller-contract error: first-start continuation passed a WS URL into an HTTP-base assertion. f2c768c728ad80f3344926995448f492fce1a1c3 fixes the caller with the existing WS-aware binder, preserving captured owner/community values for spawn. Production-continuation tests first reproduced the failure (1 passed / 2 failed), then passed; native agents filter 63/63, relay scope 11/11, clippy/fmt/size/diff pass. These are ephemeral-state unit tests, not app launches.

Combined CI at 51f30353 also found stale provenance-copy assertions in mentions.spec.ts (Smoke 2; all retries expected “From another Buzz setup” instead of the intentional “Not managed on this device”). af24a6e3a0e04c3354686a47b3d65b62e3f9d12d updates the three affected expectations and adds a no-live-host provenance regression: affected JS 11/11 and Biome pass. This changes tests only, not product copy or lifecycle behavior. Original failed job. Actual current-head CI run 33440731664 completed FAILURE: integration shard 1 agents.spec.ts:2625 Start never produces agent-runtime-active (119 pass / 1 fail / 1 skip); shard 2 profile.spec.ts:1109 Start remains Start instead of Stop (99 pass / 1 fail / 1 skip), both on every retry. Diagnosis/fix is active; these are engineering failures, not external review blockers. All four smoke shards (including corrected Smoke 2), Desktop Core, unit, Rust lint, platform builds, backend/relay E2E, Docker and security/DCO checks passed. No final green claim.

The two af24 Start failures were reproduced unchanged locally (2/2 failed). 8671f76f3815187ef53a81d3ceccbcb0a8443367 corrects the shared mock summary: native summaries already supply selected workspace scope for valid unstarted agents independently of a live run; the mock omitted it. The existing failing tests now pass 2/2 without weakening assertions. New mounted scope tests pass 2/2 and wire→shared actions→real IPC tests pass 4/4 (12/12 with existing action tests), including missing scope, stale pin and changed-community rejection.

The bounded scope audit also found a real fresh create-start gap: local preflight bound its owner/community only after awaiting mesh preflight when no caller scope was supplied. The new private preflight boundary binds before polling and revalidates afterwards, preserving the existing typed values through recovery/spawn. Negative control restoring the old order: 4 passed / 3 failed; corrected agent-command tests 67/67, scope 11, runtime 60, pair commands 8, execution 9 + 1 ignored, clippy/fmt/TS/Biome/size pass. Ordinary config and strict remote admission are unchanged. Independent narrow review of frozen 8671f76f is closed with no blockers: it verified early owner/community binding, recovery/nonjournal/spawn carry-through, unchanged admission/uncertainty fences, and native→mock→consumed UI contract. This closes this correction only, not whole-feature or human approval.

Current-head CI 33444394321 completed FAILURE. Both integration shards now pass, including the repaired Start flows. Smoke 3 has one all-retry failure in messaging.spec.ts:2437 (“sends a thread message to its parent channel with a root-thread link”); 320 passed, 3 flaky, 1 skipped. The Desktop aggregate therefore fails. Other smoke shards, Desktop Core, platform builds, Rust lint, unit, relay/backend integration and Security passed. Trace-backed diagnosis: line 2629 is the shared-row visibility/catch-up predicate, before the author/avatar assertions. The accepted row remains in both message caches but timeline tail buffering withholds it while the physical-bottom state hides the catch-up pill. This is independently reproduced on current base 2f3dd850 (5 failures/1 pass in a bounded six-geometry, 4× CPU diagnostic), with the messaging test and buffer/scroll owners byte-identical to the CI merge source. A separate one-condition fix keeps the existing catch-up pill visible when buffered rows exist; the same baseline matrix then passes 6/6, retaining all original assertions. That proposed baseline repair is not yet committed or incorporated here; required CI remains red, no rerun/green claim. Disposition is pending before any new-head CI/package work. af24 Start failures above remain historical.

Verified 8671f76 package (native runtime validation on hold)

• Source HEAD 8671f76f3815187ef53a81d3ceccbcb0a8443367; tree 0604dc1329da95f4c9ce2c349412fdf7f2e39b83; parent af24a6e3a0e04c3354686a47b3d65b62e3f9d12d.
• Apple Silicon DMG: Buzz-8671f76f-aarch64.dmg (110,398,277 bytes), SHA-256 4525a95a45403fad864cf64946f94f173242d08f5be9da070489b8c7641fa378.
• Exact committed-source archive: source-8671f76f3815187ef53a81d3ceccbcb0a8443367.tar.gz (41,945,048 bytes), SHA-256 4a2962168e66a9198e202dc718362521a644f10b0a1674ae79e547b54bbf610d.
• Copied actual release Cargo fingerprint confirms features exactly default, mesh-llm, remote-start-preview, system-keyring; remote-start-tracer is declared but not enabled. Six actual release sidecars (buzz, buzz-acp, buzz-agent, buzz-dev-mcp, buzz-backend-kubernetes, git-credential-nostr) were byte-compared inside the app before signing. No source-test externalBin=[] override.
• Package and sidecars exit 0; build-time hdiutil verify VALID and codesign --verify --deep --strict passed. Ad-hoc only: no Team ID, Developer ID or notarization. Noninteractive Tauri --no-sign, explicit ad-hoc signing and plain hdiutil; no Finder, credential lookup or app launch. Three existing release warnings remain, not a warning-free build claim.
• Local WORK_LOGS/MULTIVERSE_FIX_346540E3/package/ contains artifacts, MANIFEST.json, concise provenance, copied fingerprint, toolchain records, pre-/post-sign hashes and logs. Independent final verification rehashed both artifacts and all embedded executables, compared decompressed source archive byte-for-byte with git archive HEAD, and checked all six delta source hashes. Tracked source remains clean; completed package PID archived. This is a local path, not a download URL; earlier Buzz DMG/JSON uploads were unsupported.
• Older Buzz-af24a6e3-aarch64.dmg and Buzz-51f30353-aarch64.dmg are superseded historical evidence, preserved with their original names/hashes, not relabeled. The intermediate f2 package attempt produced no completed artifact.
• Native UI/screenshots, packaged Start/Move, Mesh 0.75.1 first-use runtime/Metal loading and real inference remain unverified. Active credential/keychain hold requires explicit private human resolution and supported credential/config isolation before any launch. Renaming the bundle does not isolate the keyring.

Explicit open delivery gates / limits

• Independent review findings above were addressed narrowly; do not interpret review of 51f30353 as blanket approval of its descendants. Narrow 8671f76f review is closed with no blockers. GitHub/codeowner review and required CI remain open. The security bot reports review required for current range b47b5a50127c080a74ed4de19a43534cd9a7b563...8671f76f3815187ef53a81d3ceccbcb0a8443367; if manual authorization is required, a Block organization member must comment exactly @buzz-security-review 8671f76f3815187ef53a81d3ceccbcb0a8443367. Passing Security/Semgrep/zizmor checks do not supply that review.
• Native UI/screenshots, packaged Start/Move, real-model inference and two-physical-host behavior remain unverified. Interactive credential/keychain/app-launch work is on hold; nothing here authorizes production config or credentials.
• The Stop guarantee is cooperative supported owned-work teardown, not hostile process containment or arbitrary detached/external jobs. Root exit alone, missing proof, timeout and unknown intent remain replacement-blocking.
• Mesh SDK dynamic native runtime installation/loading happens at first use; compiling its SDK is not proof of Metal runtime loading or inference.
• Local package is ad-hoc signed only, not Developer ID signed/notarized, and is not a production release.

Related work found: #7140 (mesh repair), #4597 (relay-native execution nodes), #5412 (read-only shared fleet), #6259 (computer naming). This preview does not replace those separate product/review scopes. No duplicate PR found for branch move-af80728f.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is b47b5a50127c080a74ed4de19a43534cd9a7b563...8671f76f3815187ef53a81d3ceccbcb0a8443367.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 8671f76f3815187ef53a81d3ceccbcb0a8443367 to authorize a new review.
Any previous review applies only to its recorded range.