chore: sync with Block upstream (277 commits, 2026-10-11)

.env.example

@@ -27,6 +27,16 @@ PGUSER=buzz
 PGPASSWORD=buzz_dev
 PGDATABASE=buzz
 
+# Fleet usage telemetry is replica-only and independent of serving-read
+# routing. This freshness budget defaults to 30000ms; 0 disables the database
+# telemetry families. When the reader is absent, stale, or unavailable, the
+# relay skips the collection and reports its availability as 0 instead of
+# falling back to the writer.
+# BUZZ_USAGE_METRICS_REPLICA_MAX_AGE_MS=30000
+# Per-community metric series are disabled by default to bound relay memory and
+# monitoring cardinality. `all` is the temporary rollback mode.
+# BUZZ_USAGE_METRICS_PER_COMMUNITY=off
+
 # -----------------------------------------------------------------------------
 # Redis 7
 # -----------------------------------------------------------------------------
@@ -37,6 +47,15 @@ REDIS_URL=redis://localhost:6379
 # Max connections in each of the relay's Postgres pools — writer and, when
 # READ_DATABASE_URL is set, reader (default 50).
 # BUZZ_DB_POOL_SIZE=50
+# Read-only partition catalog audit interval, clamped to 60s..24h (default 900s).
+# BUZZ_PARTITION_AUDIT_INTERVAL_SECS=900
+# Emergency kill switch for all automatic partition DDL, including catch-all
+# advancement; audits remain enabled.
+# BUZZ_PARTITION_MANAGER_CREATE_ENABLED=true
+# Opt in to replacing an empty partition catch-all with six months of dedicated
+# monthlies, at startup and on every audit interval (default false). Has no
+# effect while the kill switch above is off.
+# BUZZ_PARTITION_MANAGER_ADVANCE_ENABLED=false
 
 # Writer-session Postgres timeouts for buzz-db-backed pools and the relay audit
 # pool, all in milliseconds; 0 disables. The separately deployed push gateway
@@ -75,10 +94,11 @@ RELAY_URL=ws://localhost:3000
 # BUZZ_WEB_DIR=./web/dist
 
 # NIP-PL mobile push is an explicit deployment opt-in. A gateway URL alone
-# never enables it. When enabled and the URL is absent, the canonical
-# https://push.buzz.xyz/v1/deliveries/apns endpoint is used.
+# never enables it. When enabled, the exact HTTP(S) delivery URL is required.
+# Rollback requires replacing every enabled writer/worker process. Inspect and
+# explicitly decide retained queue disposition before re-enabling (see docs/push-gateway-deployment.md).
 BUZZ_PUSH_ENABLED=false
-# BUZZ_PUSH_GATEWAY_DELIVERY_URL=https://push.buzz.xyz/v1/deliveries/apns
+BUZZ_PUSH_GATEWAY_DELIVERY_URL=https://push.buzz.xyz/v1/deliveries/apns
 
 # -----------------------------------------------------------------------------
 # Admin Dashboard (private moderation surface)
@@ -106,9 +126,16 @@ BUZZ_PUSH_ENABLED=false
 # the console without manual URL entry.
 # RELAY_OPERATOR_PUBKEYS=<64-char hex pubkey>[,<64-char hex pubkey>...]
 #
-# Option B — BUZZ_ADMIN_AUTH=disabled (network-layer auth only):
-# Set only when the admin API is already protected at the network layer
-# (VPN, private ingress). The relay logs a WARN on every startup.
+# Option B — BUZZ_ADMIN_AUTH=disabled (read-only, no authentication):
+# Anyone who can reach the relay can read, in every community: reports (with
+# reporter notes and reported message content, deleted included), feedback and
+# attachments, bans and timeouts with reasons, the community directory, member
+# search and profiles (not staff status), and any stored message by ID.
+# Writes and staffing are refused.
+# Only people allowed to see all of that should be able to reach it. The admin
+# API is on the relay's main listener and its hostname check uses the caller's
+# Host header, so the whole relay port must be private, not just the admin
+# hostname. The relay logs a WARN on every startup.
 # `just admin` defaults to this mode for local review.
 #
 # Directory holding the built dashboard assets (`pnpm -C admin-web build`).
@@ -121,6 +148,12 @@ BUZZ_PUSH_ENABLED=false
 # and provisioning requests fail closed until it is set.
 # RELAY_OPERATOR_API_ORIGIN=http://127.0.0.1:3000
 
+# Deployment-global operator-listener routes. Each configured Nostr identity
+# may register target pubkeys and receives mention notifications at its URL.
+# Format: pubkey:deliveryUrl;pubkey:deliveryUrl
+# BUZZ_OPERATOR_LISTENER_TIMEOUT_MS=5000
+# BUZZ_OPERATOR_LISTENERS=<64-char hex pubkey>:https://listener.example/mentions
+
 # Optional relay-owned KLIPY key. When set, NIP-11 advertises GIF search and
 # authenticated desktop clients use this relay as the metadata/search proxy.
 # Keep the real value in your deployment's secret manager; never commit it.

.github/CODEOWNERS

@@ -1 +1,2 @@
 * @block/buzz-oss-team
+/VISION_MOBILE.md @brow

.github/ci/minio/README.md

@@ -1,8 +1,9 @@
 # Buzz CI MinIO
 
 `ghcr.io/block/buzz-minio:latest` contains MinIO and `mc` for the disposable
-Linux AMD64 CI runners. `docker-compose.ci.yml` selects it for both services;
-development and deployment defaults stay in `docker-compose.yml`.
+Linux AMD64 runners. Only the publisher smoke test selects it through
+`docker-compose.ci.yml`. Ordinary CI inherits the Silo pins from
+`docker-compose.yml`; the Helm install test inherits the chart defaults.
 
 The **MinIO image** workflow builds only when its inputs change, or on a manual
 dispatch. Pull requests build and smoke-test without publishing. On `main`, a
@@ -13,9 +14,10 @@ Once consumers adopt the override, ordinary CI only pulls it; there is no build
 fallback or dependency on the publisher. `latest` deliberately floats, and
 Compose always pulls it. Docker's pull output records the resolved digest.
 
-The Dockerfile uses the same upstream releases as the development services,
-with checksummed official GitHub release binaries and a digest-pinned Alpine
-base. MinIO and `mc` are AGPL-3.0; their corresponding source is available at
+The Dockerfile pins upstream MinIO releases independently of the Silo images
+used by the development and deployment examples. It uses checksummed official
+GitHub release binaries and a digest-pinned Alpine base. MinIO and `mc` are
+AGPL-3.0; their corresponding source is available at
 the [MinIO release](https://github.com/minio/minio/tree/RELEASE.2025-09-07T16-13-09Z)
 and [mc release](https://github.com/minio/mc/tree/RELEASE.2025-08-13T08-35-41Z).
 

.github/scripts/codex-security-review.js

@@ -28,8 +28,30 @@ const completedMarker = (baseSha, headSha) =>
 
 const reviewCommand = (headSha) => `${REVIEW_COMMAND} ${headSha}`;
 
-const isOrganizationMember = (association) =>
-  association === "MEMBER" || association === "OWNER";
+// Org membership is invisible to the workflow token when a member keeps it
+// private, so trust is repo write access. `maintain` reports as `write`.
+async function hasWriteAccess({ github, context, core, username }) {
+  if (!username) {
+    return false;
+  }
+  try {
+    const { data } = await withGithubRetry(
+      () =>
+        github.rest.repos.getCollaboratorPermissionLevel({
+          owner: context.repo.owner,
+          repo: context.repo.repo,
+          username,
+        }),
+      { core },
+    );
+    return data.permission === "admin" || data.permission === "write";
+  } catch (error) {
+    if (error?.status === 404) {
+      return false;
+    }
+    throw error;
+  }
+}
 
 const hasCurrentReviewLabel = (pullRequest) =>
   pullRequest.labels?.some(
@@ -330,6 +352,15 @@ async function prepare({ github, context, core }) {
     requestedHeadSha = context.payload.pull_request?.head?.sha || "";
   } else if (context.eventName === "issue_comment") {
     prNumber = Number(context.payload.issue?.number);
+    const commenter = context.payload.comment?.user?.login;
+    if (
+      !(await hasWriteAccess({ github, context, core, username: commenter }))
+    ) {
+      core.info(
+        `Review commands require write access to ${context.repo.owner}/${context.repo.repo}.`,
+      );
+      return;
+    }
     const command = context.payload.comment?.body || "";
     const match = /^@buzz-security-review ([0-9a-f]{40})$/.exec(command);
     if (!match) {
@@ -364,10 +395,15 @@ async function prepare({ github, context, core }) {
   }
   if (
     context.eventName === "pull_request_target" &&
-    !isOrganizationMember(pullRequest.author_association)
+    !(await hasWriteAccess({
+      github,
+      context,
+      core,
+      username: pullRequest.user?.login,
+    }))
   ) {
     core.info(
-      `Pull request #${prNumber} requires authorization from a Block organization member.`,
+      `Pull request #${prNumber} requires authorization from a user with write access.`,
     );
     return;
   }
@@ -479,17 +515,35 @@ async function invalidatePullRequestUpdate({ github, context, core }) {
     github,
     context,
     core,
-    existingOnlyForOrganizationMembers: true,
+    existingOnlyForTrustedAuthors: true,
   });
 }
 
+// A failed lookup must not skip stale-marking, so errors count as untrusted
+// and the conservative stale notice is posted.
+async function isTrustedForInvalidation({ github, context, core, pullRequest }) {
+  try {
+    return await hasWriteAccess({
+      github,
+      context,
+      core,
+      username: pullRequest.user?.login,
+    });
+  } catch (error) {
+    core.warning(
+      `Could not read PR author permission (status ${githubErrorStatus(error)}); treating the author as untrusted.`,
+    );
+    return false;
+  }
+}
+
 async function invalidate({
   github,
   context,
   core,
   prNumber: requestedPrNumber,
   existingOnly = false,
-  existingOnlyForOrganizationMembers = false,
+  existingOnlyForTrustedAuthors = false,
 }) {
   const prNumber = Number(
     requestedPrNumber ?? context.payload.pull_request?.number,
@@ -506,11 +560,12 @@ async function invalidate({
   }
 
   const existing = await findReviewComment({ github, context, prNumber });
-  const shouldOnlyUpdateExisting =
-    existingOnly ||
-    (existingOnlyForOrganizationMembers &&
-      isOrganizationMember(pullRequest.author_association));
-  if (!existing && shouldOnlyUpdateExisting) {
+  if (
+    !existing &&
+    (existingOnly ||
+      (existingOnlyForTrustedAuthors &&
+        (await isTrustedForInvalidation({ github, context, core, pullRequest }))))
+  ) {
     if (existingOnly || hasCurrentReviewLabel(pullRequest)) {
       await clearCurrentReview({ github, context, prNumber });
     }
@@ -535,7 +590,7 @@ ${STALE_MARKER}
 >
 > The current range is \`${liveMainSha}...${pullRequest.head.sha}\`.
 > A new review must complete for this exact range. When manual authorization
-> is required, a Block organization member must comment exactly
+> is required, a user with write access must comment exactly
 > \`${reviewCommand(pullRequest.head.sha)}\` to authorize a new review.
 > Any previous review applies only to its recorded range.
 `;