feat: harden Context Engine agent delivery

.github/workflows/ci.yml

@@ -381,6 +381,7 @@ jobs:
             -p buzz-test-client \
             --lib \
             --test e2e_event_reminder \
+            --test membership_revision_precondition \
             --archive-file target/ci/backend-integration-tests.tar.zst
       - name: Save relay artifacts cache
         # PR-scoped exact-source entries cannot warm main or other PRs and churn
@@ -757,6 +758,20 @@ jobs:
             --run-ignored ignored-only
         env:
           DATABASE_URL: postgres://buzz:${{ env.BUZZ_TEST_POSTGRES_PASSWORD }}@localhost:5432/buzz
+      - name: Prepared-event membership-race test (H1)
+        # The prepared-publish vs membership-change race probe drives the
+        # relay's real ingest entry point against real Postgres and an
+        # advisory lock held by the test. #[ignore]d in the default suite
+        # behind an explicit BUZZ_TEST_DATABASE_URL, selected explicitly here
+        # — see crates/buzz-relay/tests/membership_revision_precondition.rs.
+        run: |
+          cargo nextest run \
+            --archive-file target/ci/backend-integration-tests.tar.zst \
+            -E 'package(buzz-relay) and binary(membership_revision_precondition) and test(rejects_dm_publish_after_membership_changes)' \
+            --run-ignored ignored-only
+        env:
+          DATABASE_URL: postgres://buzz:${{ env.BUZZ_TEST_POSTGRES_PASSWORD }}@localhost:5432/buzz
+          BUZZ_TEST_DATABASE_URL: postgres://buzz:${{ env.BUZZ_TEST_POSTGRES_PASSWORD }}@localhost:5432/buzz
       - name: NIP-ER reminder e2e
         # Feature e2e for NIP-ER (Event Reminders, kind:30300): write-path
         # validation, author-only read filtering, and scheduler delivery against

Justfile

@@ -92,6 +92,30 @@ build:
 build-release:
     cargo build --workspace --release
 
+# Build the security-pinned ACP harness from one fixed, isolated checkout path.
+trusted-buzz-acp-release:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    source_root="$(cd "{{justfile_directory()}}" && pwd -P)"
+    source_commit="$(git -C "$source_root" rev-parse HEAD)"
+    build_parent="/Users/gabriel/.buzz/REPOS/.trusted-build"
+    build_root="$build_parent/buzz-acp"
+    mkdir -p "$build_parent"
+    if [[ ! -e "$build_root" && ! -L "$build_root" ]]; then
+        git -C "$source_root" worktree add --detach "$build_root" "$source_commit"
+    else
+        [[ -d "$build_root" && ! -L "$build_root" && "$(cd "$build_root" && pwd -P)" == "$build_root" ]]
+        [[ "$(git -C "$build_root" rev-parse --path-format=absolute --git-common-dir)" == "$(git -C "$source_root" rev-parse --path-format=absolute --git-common-dir)" ]]
+        git -C "$build_root" diff --quiet --no-ext-diff --
+        git -C "$build_root" diff --cached --quiet --no-ext-diff --
+        git -C "$build_root" switch --detach "$source_commit"
+    fi
+    [[ "$(git -C "$build_root" rev-parse HEAD)" == "$source_commit" ]]
+    export CARGO_INCREMENTAL=0
+    export RUSTFLAGS="--remap-path-prefix=${build_root}=/buzz-source"
+    cargo build --manifest-path "$build_root/Cargo.toml" --release -p buzz-acp
+    shasum -a 256 "$build_root/target/release/buzz-acp"
+
 # Run repo lint, formatting, and repository policy checks
 check: fmt-check clippy desktop-check desktop-tauri-fmt-check desktop-tauri-clippy web-check mobile-check security-review-check file-size-check
 

crates/buzz-acp/Cargo.toml

@@ -20,6 +20,7 @@ path = "src/main.rs"
 buzz-core = { workspace = true }
 buzz-sdk = { workspace = true }
 buzz-persona = { path = "../buzz-persona" }
+buzz-cli = { path = "../buzz-cli" }
 
 # Nostr
 nostr = { workspace = true }
@@ -51,6 +52,8 @@ url = { workspace = true }
 
 # NIP-98 HTTP auth signing
 sha2 = { workspace = true }
+hmac = { workspace = true }
+rand = { workspace = true }
 base64 = "0.22"
 hex = { workspace = true }