feat(sdk): define owner-approved relay terminal protocol

crates/buzz-core/src/kind.rs

@@ -204,6 +204,7 @@ pub const RESULT_GATED_KINDS: &[u32] = &[
 /// included for filter-layer enforcement but are never stored, so the
 /// storage-layer search defense does not apply to them.
 pub const P_GATED_KINDS: &[u32] = &[
+    KIND_SANDBOX_TERMINAL_FRAME,
     KIND_AGENT_OBSERVER_FRAME,
     KIND_MEMBER_ADDED_NOTIFICATION,
     KIND_MEMBER_REMOVED_NOTIFICATION,
@@ -713,8 +714,15 @@ pub const KIND_GIT_STATUS_DRAFT: u32 = 1633;
 /// announcement, never a project. See `docs/nips/NIP-MP.md`.
 pub const KIND_PROJECT: u32 = 30621;
 
+/// Owner/gateway terminal grants and metadata-only acceptance/end records.
+pub const KIND_SANDBOX_ATTACH: u32 = 30624;
+/// NIP-44 encrypted, ephemeral terminal frames; never persisted.
+pub const KIND_SANDBOX_TERMINAL_FRAME: u32 = 24203;
+
 /// All registered kind constants — used for duplicate detection and iteration.
 pub const ALL_KINDS: &[u32] = &[
+    KIND_SANDBOX_ATTACH,
+    KIND_SANDBOX_TERMINAL_FRAME,
     KIND_PROFILE,
     KIND_TEXT_NOTE,
     KIND_CONTACT_LIST,

crates/buzz-relay/src/handlers/ingest.rs

@@ -551,7 +551,7 @@ fn map_push_accept_error(error: super::push_lease::AcceptError) -> IngestError {
 /// Returns `Err` for unknown kinds — the relay rejects them.
 fn required_scope_for_kind(kind: u32, event: &Event) -> Result<Scope, &'static str> {
     match kind {
-        buzz_core::kind::KIND_AGENT_CHANNEL_GRANT => Ok(Scope::MessagesWrite),
+        buzz_core::kind::KIND_AGENT_CHANNEL_GRANT | buzz_core::kind::KIND_SANDBOX_ATTACH => Ok(Scope::MessagesWrite),
         // Owner-managed global authority, like a profile or managed-agent record.
         buzz_core::kind::KIND_AGENT_GATEWAY_DELEGATION => Ok(Scope::UsersWrite),
         KIND_PROFILE => Ok(Scope::UsersWrite),
@@ -4503,6 +4503,7 @@ mod postgres_tests {
     fn per_kind_scope_allowlist_covers_all_migrated_kinds() {
         let dummy = make_dummy_event();
         let migrated = [
+            buzz_core::kind::KIND_SANDBOX_ATTACH,
             KIND_PROFILE,
             KIND_DELETION,
             KIND_REACTION,

crates/buzz-sdk/Cargo.toml

@@ -14,3 +14,5 @@ uuid = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 thiserror = { workspace = true }
+
+base64 = { workspace = true }

crates/buzz-sdk/src/lib.rs

@@ -17,6 +17,7 @@ pub mod builders;
 pub mod gateway;
 pub mod mentions;
 pub mod nip_oa;
+pub mod sandbox_attach;
 pub mod sharing;
 pub mod workflow;