[tee8z]

Problem and behavior

Developers need one terminal setup command while keeping Buzz apps interchangeable. buzz onboard creates or imports an identity, enrolls credentials, registers agents through the same events and encrypted manager requests as GPUI, and pairs the developer's Paseo daemon.

This replaces #152 without rewriting its published history. It targets tee8z/agent-gateway-key and depends on #154; the real SDK now signs grants rather than printing an unavailable-command fallback. Manager pairing and capability discovery require #150.

Step	Result
Identity	Private key files, invite admission, and profile; WSS only.
Credentials	GitHub, model, and 1Password credentials through encrypted enrollment.
Agents	Presets, channel membership, and one saved first-start thread per agent.
Enrollment	Every manager refusal is actionable; unchanged credentials still reconcile enabled or rotated daemon Secrets.
Gateway	Owner confirmation, default/max 90-day expiry, current strong relay head, durable revocation handling, and strictly newer replacement timestamps.
Pairing	Offer link, QR code, password display, and desktop/web/mobile instructions.

Saved signed kickoff events survive lost manager replies and partial failures, so retries reuse the same Sandbox thread. Provisioning queries read the writer. The local grant summary is cleared before reconciliation and cannot override a revoked relay head. Agent keys cannot become gateways; community and channel admission remain explicit.

Credentials are neither persisted in onboarding state nor echoed. Private owner/agent identity files use restrictive permissions. Existing app agents are reused, and app enrollment stays available.

Validation

• All 519 CLI tests pass, including 14 production wizard journeys with only terminal, external relay, manager, and local tools faked.
• All-target CLI Clippy with -D warnings, Rust formatting, and diff checks pass.
• Regressions cover committed-but-lost first-start replies, manager storage failures, unchanged-profile Secret reconciliation, writer/replica routing, QR display, refusal codes, redaction, real SDK grant renewal, remote revocation, declined confirmation, and same-second replacement.
• Removing kickoff reuse, writer consistency, enabled-daemon reconciliation, or monotonic grant replacement fails its regression. Restored onboarding journeys pass.
• Repository-wide just ci remains incomplete: the shared environment cannot locate native glib-2.0.pc; previous broad Rust checks passed. No staging developer was enrolled or deployed by these checks.

The PR exceeds the default size guideline because it preserves the already-published eight-step wizard and its end-to-end resume tests. Steps are separated into modules; splitting the imported history into partial commands would obscure the retry contract. The gateway foundation remains separately reviewed below this PR.

Acceptance and rollout

Merge #154 and #150 before the final onboarding build. Use the manager-provided gateway public key; an administrator must admit it to the community, and the channel owner must add it to the workspace. A delegation itself grants no membership.

For human acceptance, run buzz onboard against the intended community, enroll and first-start the agents, complete gateway membership, pair Paseo from the offer, and rerun. Confirm no duplicate thread or Sandbox, the same agents remain available in a Buzz app, and revoking the grant prevents gateway access. Agents added later require a daemon restart to refresh providers.

Final SDK review is complete; the concurrent-revocation publication blocker is fixed in ddc596f and independently rechecked through the actual HTTP/default wizard regression. A post-publication writer read requires the exact submitted live head before saving or printing success. Removing that guard fails the regression.

Draft pending human workflow confirmation. No review completion marker attestation, cluster changes, or deployment.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

[tee8z]

Independent review of the real SDK integration at d1b064c, against the onboarding goal and the prior #152 review. The earlier retry/provisioning blockers are tracked separately in the imported fixes; this pass focuses on the new gateway reconciliation boundary.

Blocking: a dominated grant receipt can still be reported as live. steps_gateway.rs:131 trusts Relay::publish before saving the local grant and printing success. The production HttpRelay::publish uses accepted(), which treats accepted:true plus message:"duplicate:" as success. The relay returns that receipt for a dominated NIP-33 write as well as an exact duplicate (ingest.rs returns it whenever was_inserted is false).

A realistic failure: the wizard reads/builds a grant, the user pauses at confirmation, the owner revokes through an app, and the user then confirms the older wizard grant. The relay correctly retains revocation, but onboarding saves and reports the gateway as granted. Monotonic timestamps relative to the earlier read do not close this race.

Before saving/reporting success, strongly re-read the coordinate and require the current verified live head to match the submitted grant. Preserve exact-ID retry success when that event remains current. Add a regression through the default wizard and real HttpRelay with a concurrent revoke and a successful duplicate: receipt; it must fail without restoring the local granted summary.

Optional: gateway.rs still describes renewal in terms of a “saved grant”; update that comment to the current relay head.

The remaining new seams look sound: current relay state overrides the local cache, failed reconciliation clears the summary, same-second replacement advances the timestamp, all production onboarding queries force the writer, and wizard tests now use the actual SDK builder by default. No new privileged membership or owner impersonation path is introduced.

Scores: minimalism 9/10, elegance 9/10, correctness 8/10 until the receipt/current-head race is fixed. I inspected the production relay receipt path and the client grant path; I have not run a live onboarding enrollment. Keep this draft pending the fix, validation and human acceptance.

[tee8z]

Rechecked ddc596f: the blocker is resolved. Before saving or reporting a new grant, the wizard strongly re-reads the coordinate and requires the submitted event ID plus valid live SDK authority. A concurrent revoke returns Conflict and leaves the local summary empty; an exact-ID duplicate retry can still succeed when that event remains current. The renewal comment is also corrected.

I independently ran the built production-seam regression commands::onboard::tests::gateway_confirmation_requires_the_submitted_live_head_after_duplicate_receipt --exact: 1 passed. It uses the default wizard and actual HttpRelay, asserts strong query filters, returns an accepted duplicate receipt while retaining a newer revocation, and verifies no granted summary or success output. I also inspected the post-publication guard in the final diff.

No remaining blocker from this SDK integration review. Scores: minimalism 9/10, elegance 9/10, correctness 9/10. Human workflow confirmation and the remaining full gates still govern readiness; this comment does not attest buzz-review-completed.