COS-710: upgrade MAC Workspace to Buzz v0.5.0

.env.example

@@ -34,6 +34,10 @@ REDIS_URL=redis://localhost:6379
 # Max connections in the relay's shared Redis pool (default 16).
 # BUZZ_REDIS_POOL_SIZE=16
 
+# Max connections in each of the relay's Postgres pools — writer and, when
+# READ_DATABASE_URL is set, reader (default 50).
+# BUZZ_DB_POOL_SIZE=50
+
 # -----------------------------------------------------------------------------
 # Typesense (search)
 # -----------------------------------------------------------------------------
@@ -110,7 +114,10 @@ RELAY_URL=ws://localhost:3000
 # -----------------------------------------------------------------------------
 # Logging / Tracing
 # -----------------------------------------------------------------------------
-RUST_LOG=buzz_relay=debug,buzz_db=debug,buzz_auth=debug,buzz_pubsub=debug,tower_http=debug
+RUST_LOG=buzz_relay=debug,buzz_datastore=info,buzz_db=debug,buzz_auth=debug,buzz_pubsub=debug,tower_http=debug
+# Optional OpenTelemetry-only target filter. This is deliberately independent
+# from RUST_LOG so log verbosity changes cannot break trace parentage.
+# BUZZ_OTEL_FILTER=buzz_relay=info,buzz_datastore=info
 
 # OTLP tracing endpoint (optional — leave unset to disable)
 # OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317

.github/workflows/ci.yml

@@ -45,7 +45,9 @@ jobs:
               - 'rust-toolchain.toml'
               - 'deny.toml'
               - '.github/workflows/ci.yml'
+              - '.github/workflows/docker.yml'
               - 'scripts/run-tests.sh'
+              - 'scripts/test-docker-tag-matrix.sh'
               - 'justfile'
             desktop:
               - 'desktop/**'
@@ -76,6 +78,8 @@ jobs:
           scripts/test-mobile-release-candidate-publisher.sh
       - name: Mobile worktree identity contract
         run: scripts/test-mobile-worktree-overrides.sh
+      - name: Docker tag matrix contract
+        run: scripts/test-docker-tag-matrix.sh
 
   rust-lint:
     name: Rust Lint
@@ -340,6 +344,7 @@ jobs:
           cargo build --profile ci -p buzz-relay -p git-credential-nostr
           cargo nextest archive \
             --cargo-profile ci \
+            -p buzz-db \
             -p buzz-relay \
             -p buzz-test-client \
             --lib \
@@ -671,11 +676,11 @@ jobs:
           done
           cat /tmp/buzz-relay.log
           exit 1
-      - name: Invite claim security tests
+      - name: Invite security tests
         run: |
           cargo nextest run \
             --archive-file target/ci/backend-integration-tests.tar.zst \
-            -E 'package(buzz-relay) and test(claim_)' \
+            -E '(package(buzz-db) and test(/relay_invite::tests/)) or (package(buzz-relay) and test(/api::invites::tests/))' \
             --run-ignored ignored-only
         env:
           DATABASE_URL: postgres://buzz:${{ env.BUZZ_TEST_POSTGRES_PASSWORD }}@localhost:5432/buzz

.github/workflows/docker.yml

@@ -1,6 +1,8 @@
 name: Docker image
 
 # Builds and publishes the MAC Workspace relay image as ghcr.io/marccopson/buzz.
+# Normal tags contain stripped binaries; matching debug-* tags contain the same
+# optimized binaries with line-table debug information for native profilers.
 #
 # Strategy: each architecture builds on its native runner (ubuntu-24.04 for
 # amd64, ubuntu-24.04-arm for arm64), pushes to GHCR by digest, then a final
@@ -14,9 +16,11 @@ name: Docker image
 # the relay image version tracks crates/buzz-relay/Cargo.toml, never desktop.
 #
 # Triggers:
-#   - push to main or mac    → :<branch> + :sha-<40>
+#   - push to main or mac     → :<branch> + :sha-<40>
+#                               + :debug-<branch> + :debug-sha-<40>
 #   - push tags relay-v*.*.* → :{version} + :{major}.{minor} + :{major}
-#                              (+ :latest for stable, NOT for prereleases)
+#                              + matching :debug-* tags
+#                              (+ :latest/:debug-latest for stable releases)
 #   - pull_request           → build only (no push), cache stays warm
 #   - workflow_dispatch      → manual relay-tag rescue at the tag itself
 #
@@ -95,10 +99,6 @@ jobs:
             runner: ubuntu-24.04-arm
             arch: arm64
 
-    outputs:
-      # Used downstream by `merge` to stitch the manifest.
-      version: ${{ steps.meta.outputs.version }}
-
     steps:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
@@ -163,12 +163,13 @@ jobs:
             org.opencontainers.image.description=WebSocket relay server for the Buzz communications platform
             org.opencontainers.image.licenses=Apache-2.0
 
-      - name: Build and push by digest
-        id: build
+      - name: Build and push release image by digest
+        id: build-release
         uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7.2.0
         with:
           context: .
           file: ./Dockerfile
+          target: runtime
           platforms: ${{ matrix.platform }}
           labels: ${{ steps.meta.outputs.labels }}
           # Push by digest, not by tag — the merge job assembles the tags
@@ -180,25 +181,49 @@ jobs:
           cache-to: |
             ${{ github.event_name != 'pull_request' && format('type=registry,ref={0}-buildcache:{1},mode=max,compression=zstd', env.IMAGE_NAME, matrix.arch) || '' }}
 
-      - name: Export digest
+      - name: Build and push debug image by digest
+        id: build-debug
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf  # v7.2.0
+        with:
+          context: .
+          file: ./Dockerfile
+          target: runtime-debug
+          platforms: ${{ matrix.platform }}
+          labels: ${{ steps.meta.outputs.labels }}
+          outputs: type=image,name=${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=${{ github.event_name != 'pull_request' }}
+          cache-from: |
+            type=registry,ref=${{ env.IMAGE_NAME }}-buildcache:${{ matrix.arch }}
+
+      - name: Export release and debug digests
         if: github.event_name != 'pull_request'
         env:
-          DIGEST: ${{ steps.build.outputs.digest }}
+          RELEASE_DIGEST: ${{ steps.build-release.outputs.digest }}
+          DEBUG_DIGEST: ${{ steps.build-debug.outputs.digest }}
         run: |
-          mkdir -p /tmp/digests
-          touch "/tmp/digests/${DIGEST#sha256:}"
+          mkdir -p /tmp/digests-release /tmp/digests-debug
+          touch "/tmp/digests-release/${RELEASE_DIGEST#sha256:}"
+          touch "/tmp/digests-debug/${DEBUG_DIGEST#sha256:}"
 
-      - name: Upload digest
+      - name: Upload release digest
         if: github.event_name != 'pull_request'
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
-          name: digests-${{ matrix.arch }}
-          path: /tmp/digests/*
+          name: digests-release-${{ matrix.arch }}
+          path: /tmp/digests-release/*
+          if-no-files-found: error
+          retention-days: 1
+
+      - name: Upload debug digest
+        if: github.event_name != 'pull_request'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: digests-debug-${{ matrix.arch }}
+          path: /tmp/digests-debug/*
           if-no-files-found: error
           retention-days: 1
 
   merge:
-    name: Merge multi-arch manifest
+    name: Merge ${{ matrix.variant }} multi-arch manifest
     if: github.event_name != 'pull_request'
     runs-on: ubuntu-24.04
     needs: build
@@ -208,13 +233,21 @@ jobs:
       packages: write    # push the merged manifest
       id-token: write    # OIDC for provenance attestation on the manifest
       attestations: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - variant: release
+            tag_prefix: ""
+          - variant: debug
+            tag_prefix: debug-
 
     steps:
       - name: Download all per-arch digests
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           path: /tmp/digests
-          pattern: digests-*
+          pattern: digests-${{ matrix.variant }}-*
           merge-multiple: true
 
       - name: Set up Docker Buildx
@@ -237,13 +270,32 @@ jobs:
           # the build job's `meta` step for why match=^relay-v(.*)$, why
           # value=${{ inputs.version }} carries the rescue-dispatch version,
           # and why :latest is left to flavor.latest=auto.
+          flavor: |
+            latest=auto
+            prefix=${{ matrix.tag_prefix }},onlatest=true
           tags: |
             type=ref,event=branch,enable=${{ github.event_name != 'workflow_dispatch' || inputs.version == '' }}
             type=raw,value=sha-${{ github.sha }},enable=${{ github.event_name != 'workflow_dispatch' || inputs.version == '' }}
             type=semver,pattern={{version}},match=^relay-v(.*)$,value=${{ inputs.version }}
             type=semver,pattern={{major}}.{{minor}},match=^relay-v(.*)$,value=${{ inputs.version }}
             type=semver,pattern={{major}},match=^relay-v(.*)$,value=${{ inputs.version }}
 
+      - name: Verify debug branch tag matrix
+        if: matrix.variant == 'debug' && github.ref_type == 'branch'
+        env:
+          IMAGE_NAME: ${{ env.IMAGE_NAME }}
+          META_TAGS: ${{ steps.meta.outputs.tags }}
+        run: |
+          set -euo pipefail
+          expected_branch="${IMAGE_NAME}:debug-${GITHUB_REF_NAME}"
+          expected_sha="${IMAGE_NAME}:debug-sha-${GITHUB_SHA}"
+          grep -Fxq "$expected_branch" <<< "$META_TAGS"
+          grep -Fxq "$expected_sha" <<< "$META_TAGS"
+          if grep -Fq "${IMAGE_NAME}:debug-debug-" <<< "$META_TAGS"; then
+            echo "debug tag prefix was applied twice" >&2
+            exit 1
+          fi
+
       - name: Create and push manifest list
         id: manifest
         working-directory: /tmp/digests
@@ -284,11 +336,12 @@ jobs:
       - name: Summary
         env:
           IMAGE_NAME: ${{ env.IMAGE_NAME }}
+          VARIANT: ${{ matrix.variant }}
           MERGED_DIGEST: ${{ steps.manifest.outputs.digest }}
           META_TAGS: ${{ steps.meta.outputs.tags }}
         run: |
           {
-            echo "### Published \`${IMAGE_NAME}\`"
+            echo "### Published \`${IMAGE_NAME}\` (${VARIANT})"
             echo
             echo "**Digest:** \`${MERGED_DIGEST}\`"
             echo

AGENTS.md

@@ -343,9 +343,19 @@ Add specs to `desktop/tests/e2e/` and register them in `playwright.config.ts`
 (`smoke` project `testMatch`). Every test calls `installMockBridge(page)` for
 mock Tauri IPC. Mock pubkey, channel names, and UUIDs live in `e2eBridge.ts`.
 
+**Always build with `pnpm build:e2e`, never `pnpm run build`.** The mock Tauri
+bridge is compiled in only for `--mode e2e` (see `installE2eBridgeIfConfigured`
+in `desktop/src/main.tsx`). A plain `pnpm run build` strips it, so
+`window.__TAURI_INTERNALS__` is never defined and **every** mock-mode spec fails
+with `Cannot read properties of undefined (reading 'invoke')` — the app renders
+"Community connection failed" instead of the UI under test. That looks exactly
+like a product bug rather than a build mistake, so it burns real time.
+`pnpm test:e2e:smoke` and `pnpm test:e2e:integration` run the right build for
+you; prefer them over a manual build plus `playwright test`.
+
 **Stale server:** `reuseExistingServer: true` means a previous build's server
-serves old code. Kill port 4173 and `pnpm run build` before re-running tests
-after code changes.
+serves old code. Kill port 4173 and re-run `pnpm build:e2e` before re-running
+tests after code changes.
 
 **`addInitScript` before bridge:** `page.addInitScript` (localStorage seeding)
 must run BEFORE `installMockBridge(page)` — React reads state on mount, the