feat: add MAC bridge owner authorisation flow

.env.example

@@ -34,6 +34,10 @@ REDIS_URL=redis://localhost:6379
 # Max connections in the relay's shared Redis pool (default 16).
 # BUZZ_REDIS_POOL_SIZE=16
 
+# Max connections in each of the relay's Postgres pools — writer and, when
+# READ_DATABASE_URL is set, reader (default 50).
+# BUZZ_DB_POOL_SIZE=50
+
 # -----------------------------------------------------------------------------
 # Typesense (search)
 # -----------------------------------------------------------------------------
@@ -50,6 +54,11 @@ RELAY_URL=ws://localhost:3000
 # Stable relay signing key. Set this in dev if you want REST-created forum posts
 # to keep resolving to the original author across relay restarts.
 # BUZZ_RELAY_PRIVATE_KEY=<32-byte hex private key>
+# COS follow-up authority. When set, this must be the exact 64-character
+# lowercase-hex public key derived from the Estate bridge's protected
+# BUZZ_PRIVATE_KEY. Unset disables the feature; blank/malformed values abort
+# relay startup. The relay advertises the accepted key in NIP-11 `cos_follow_up`.
+# BUZZ_COS_FOLLOW_UP_BRIDGE_PUBKEY=<64-lowercase-hex-public-key>
 # Optional: path to the web UI dist directory. When set, the relay serves
 # the web frontend at / for browser requests. Leave unset for local dev
 # (use `just web` for Vite HMR instead).
@@ -105,7 +114,10 @@ RELAY_URL=ws://localhost:3000
 # -----------------------------------------------------------------------------
 # Logging / Tracing
 # -----------------------------------------------------------------------------
-RUST_LOG=buzz_relay=debug,buzz_db=debug,buzz_auth=debug,buzz_pubsub=debug,tower_http=debug
+RUST_LOG=buzz_relay=debug,buzz_datastore=info,buzz_db=debug,buzz_auth=debug,buzz_pubsub=debug,tower_http=debug
+# Optional OpenTelemetry-only target filter. This is deliberately independent
+# from RUST_LOG so log verbosity changes cannot break trace parentage.
+# BUZZ_OTEL_FILTER=buzz_relay=info,buzz_datastore=info
 
 # OTLP tracing endpoint (optional — leave unset to disable)
 # OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317

.gitattributes

@@ -0,0 +1,8 @@
+# Git for Windows defaults to core.autocrlf=true, so without this every text
+# file lands in the working copy with CRLF. Biome formats with LF
+# (biome.json sets no lineEnding override), which fails `biome check` on
+# effectively every file, and
+# desktop/src/features/messages/ui/virtuaWheelModePatch.test.mjs asserts on
+# patches/*.patch with `\n`-joined patterns. Normalize to LF in the working
+# copy on every platform; the stored blobs are already LF.
+* text=auto eol=lf

.github/PULL_REQUEST_TEMPLATE.md

@@ -5,4 +5,4 @@
 <!-- Fixes #1234, or N/A. Before opening: search existing issues/PRs for duplicates — link the closest one, or say "none found". -->
 
 ### Testing
-<!-- How was this verified? -->
+<!-- How was this verified? UI change? Include before/after screenshots (or a short recording). -->

.github/workflows/ci.yml

@@ -45,7 +45,9 @@ jobs:
               - 'rust-toolchain.toml'
               - 'deny.toml'
               - '.github/workflows/ci.yml'
+              - '.github/workflows/docker.yml'
               - 'scripts/run-tests.sh'
+              - 'scripts/test-docker-tag-matrix.sh'
               - 'justfile'
             desktop:
               - 'desktop/**'
@@ -59,10 +61,13 @@ jobs:
             mobile:
               - 'mobile/**'
               - 'scripts/mobile-release.sh'
+              - 'scripts/mobile-worktree-overrides.sh'
+              - 'scripts/mobile-worktree-clean.sh'
               - 'scripts/publish-mobile-release-candidate.sh'
               - 'scripts/release-rulesets.sh'
               - 'scripts/test-mobile-release-contract.sh'
               - 'scripts/test-mobile-release-candidate-publisher.sh'
+              - 'scripts/test-mobile-worktree-overrides.sh'
               - '.github/workflows/mobile-release-candidate.yml'
               - '.github/workflows/ci.yml'
       - name: Release workflow source contract
@@ -71,6 +76,10 @@ jobs:
         run: |
           scripts/test-mobile-release-contract.sh
           scripts/test-mobile-release-candidate-publisher.sh
+      - name: Mobile worktree identity contract
+        run: scripts/test-mobile-worktree-overrides.sh
+      - name: Docker tag matrix contract
+        run: scripts/test-docker-tag-matrix.sh
 
   rust-lint:
     name: Rust Lint
@@ -335,6 +344,7 @@ jobs:
           cargo build --profile ci -p buzz-relay -p git-credential-nostr
           cargo nextest archive \
             --cargo-profile ci \
+            -p buzz-db \
             -p buzz-relay \
             -p buzz-test-client \
             --lib \
@@ -666,11 +676,11 @@ jobs:
           done
           cat /tmp/buzz-relay.log
           exit 1
-      - name: Invite claim security tests
+      - name: Invite security tests
         run: |
           cargo nextest run \
             --archive-file target/ci/backend-integration-tests.tar.zst \
-            -E 'package(buzz-relay) and test(claim_)' \
+            -E '(package(buzz-db) and test(/relay_invite::tests/)) or (package(buzz-relay) and test(/api::invites::tests/))' \
             --run-ignored ignored-only
         env:
           DATABASE_URL: postgres://buzz:${{ env.BUZZ_TEST_POSTGRES_PASSWORD }}@localhost:5432/buzz
@@ -1010,16 +1020,20 @@ jobs:
           touch "desktop/src-tauri/binaries/buzz-dev-mcp-$TARGET"
           touch "desktop/src-tauri/binaries/git-credential-nostr-$TARGET"
           touch "desktop/src-tauri/binaries/buzz-$TARGET"
-      # Mesh rev is derived from Cargo.lock so a dependency bump needs no
-      # lockstep edit here; the cache key tracks it automatically.
+      # Resolve the exact desktop Mesh dependency so the native cache and build
+      # always use the same checkout, even when the root lockfile contains
+      # another mesh-llm-sdk version.
       - name: Resolve mesh-llm rev
         id: mesh_rev
         run: |
           set -euo pipefail
-          REV=$(python3 -c 'import tomllib; d=tomllib.load(open("Cargo.lock", "rb")); p=next(p for p in d["package"] if p["name"] == "mesh-llm-sdk"); print(p["source"].rsplit("#", 1)[1])')
-          [[ -n "$REV" ]] || { echo "::error::could not resolve mesh-llm rev from Cargo.lock"; exit 1; }
+          metadata=$(cargo metadata --manifest-path desktop/src-tauri/Cargo.toml --features mesh-llm --format-version 1)
+          REV=$(python3 -c 'import json,sys; data=json.load(sys.stdin); p=next(p for p in data["packages"] if p["name"]=="mesh-llm-sdk"); print(p["source"].rsplit("#", 1)[1])' <<<"$metadata")
+          SDK_MANIFEST=$(python3 -c 'import json,sys; data=json.load(sys.stdin); print(next(p["manifest_path"] for p in data["packages"] if p["name"]=="mesh-llm-sdk"))' <<<"$metadata")
+          MESH_ROOT=$(cd "$(dirname "$SDK_MANIFEST")/../.." && pwd)
+          [[ -n "$REV" ]] || { echo "::error::could not resolve desktop mesh-llm rev from Cargo metadata"; exit 1; }
           echo "rev=$REV" >> "$GITHUB_OUTPUT"
-          echo "short=${REV:0:7}" >> "$GITHUB_OUTPUT"
+          echo "root=$MESH_ROOT" >> "$GITHUB_OUTPUT"
       - name: Restore mesh llama build cache
         id: llama_cache
         uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
@@ -1029,16 +1043,13 @@ jobs:
       - name: Build mesh llama native libraries
         if: steps.llama_cache.outputs.cache-hit != 'true'
         env:
-          MESH_REV_SHORT: ${{ steps.mesh_rev.outputs.short }}
+          MESH_ROOT: ${{ steps.mesh_rev.outputs.root }}
         run: |
           set -euo pipefail
-          cargo fetch --manifest-path desktop/src-tauri/Cargo.toml
-          SHORT="$MESH_REV_SHORT"
-          MESH_ROOT=$(find "${CARGO_HOME:-$HOME/.cargo}/git/checkouts" -path "*/$SHORT" -type d -name "$SHORT" | head -1)
-          if [[ -z "$MESH_ROOT" ]]; then
-            echo "::error::mesh-llm checkout for $SHORT not found after cargo fetch"
+          [[ -x "$MESH_ROOT/scripts/prepare-llama.sh" && -x "$MESH_ROOT/scripts/build-llama.sh" ]] || {
+            echo "::error::mesh-llm build scripts not found under resolved checkout $MESH_ROOT"
             exit 1
-          fi
+          }
           export LLAMA_STAGE_BACKEND=metal
           export LLAMA_STAGE_BUILD_DIR="$GITHUB_WORKSPACE/.cache/mesh-llama/build-stage-abi-metal"
           export CMAKE_OSX_DEPLOYMENT_TARGET=10.15