[FIX] Port shared-agent directory projection to desktop-v0.5.14

[marklyonx-star]

Scope

House-fork-only port and audit of upstream block/buzz PR block#5832 at exact head 2ae62afd1f3e6f2e8abd792aa66ec079c61ab73b.

• Base: desktop-v0.5.14 (391495e7d347d20b67e39e3c240d17ef63c5c2c0)
• House base branch: codex/desktop-v0.5.14-base
• Port commits preserve upstream provenance with -x and DCO sign-off.
• The final refactor only splits directory code into submodules so the port satisfies the existing file-size ratchet.

Behavior audited

• Shared managed agents are discovered from owner-authenticated kind:30177 policy plus agent kind:0 NIP-OA proof.
• Relay-signed kind:39002 membership is the only source of channel IDs.
• Self-authored kind:10100 headless agents remain discoverable, but their claimed channel IDs are cleared.
• Forged policy/membership, missing or revoked owner proof, malformed pubkeys, and policy collisions fail closed.
• Relay directory pagination uses a deterministic timestamp + event-id cursor.

Verification

• Untouched desktop-v0.5.14 baseline: focused nostr_convert tests 45/45.
• Ported focused nostr_convert tests: 53/53.
• Composite relay cursor test: 1/1.
• pnpm --dir desktop check:file-sizes: pass.
• Desktop Tauri cargo fmt --check: pass.
• Desktop Tauri clippy: pass.
• Full just ci: pass, including 2,464 desktop Rust tests and 1,399 mobile tests.
• git diff --check codex/desktop-v0.5.14-base...HEAD: pass.

Two-machine autocomplete canary

This is a pre-deploy control, not patched acceptance: the candidate was not installed because this task forbids live Buzz changes.

• Mac Mini, installed Buzz, All Agents: typed only @, observed the menu, then cleared the draft without sending. Visible entries were Mark Lyon, Maria, Mini, MacMini Lyon, Aaron, Beau, Bumble, Fizz, and Honey. Remote seats Harper, Harper.X, Kimi, and Atticus were absent, reproducing the defect.
• MacBook: CANNOT_TELL. The saved Tailscale endpoint answered a one-packet ping (8.457 ms), but TCP 5900 refused the Screen Sharing connection. No remote input occurred and no setting was changed.
• Candidate two-machine acceptance therefore remains unmeasured until the port is built or installed under a separate live-state stamp and both UI sessions are reachable.

Boundaries

Draft only for Harper second-eye. No upstream submission. No live Buzz seat, profile, channel, relay, credential, installation, or restart state was changed.

Review focus

1. Trust precedence between self-authored kind:10100 and owner-verified kind:30177.
2. Fail-closed behavior when NIP-OA proof or relay authority is absent.
3. Pagination and equal-timestamp determinism.
4. Structural module split versus the upstream two-commit patch.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: fb09e690-5ba7-4001-ac71-12c064a0ed17

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}