Fix #1422 inbound BUZZ result collector

[BryanHarrisScripts]

Summary

Repairs the PlotPickle side of the inbound Tamsin collector without weakening the signed-provenance boundary.

• Match Story Bridge responses by the parsed requestId instead of requiring minified JSON with no whitespace.
• Continue requiring the exact result marker at the start, one JSON object, the expected request/run/work/Agent correlation, and the approved Agent signer.
• Surface a precise missing-public-signature compatibility reason instead of silently polling until a generic timeout.
• Add regressions for pretty-printed result JSON, mismatched/malformed/prefixed responses, and signature-stripped BUZZ CLI events.

Root cause

Two independent problems were present:

1. Tamsin may return valid pretty-printed JSON. The collector searched for an exact compact substring such as "requestId":"...", so whitespace caused the matching result to be ignored.
2. BUZZ Desktop/CLI 0.5.19 and 0.5.20 omit the public Nostr sig field from full messages get JSON. PlotPickle cannot truthfully complete BIP-340 verification without it and therefore continues to fail closed.

The second item requires a small BUZZ CLI output-contract correction before the Windows live exit proof can pass. No private key is needed or exposed.

Validation

• Focused Story Bridge suite: 30/30 passed.
• Focused UAT contracts: 463/463 passed, 0 blockers, 0 warnings.
• Production build: passed.
• git diff --check: passed.
• Repository-wide lint did not start because the current ESLint 10 / pinned React lint plugin combination throws contextOrFilename.getFilename is not a function in an unrelated Developer Workbench file.

Exit gate

Keep this PR draft and #1422 open until BUZZ preserves the public event signature and the real Afterglow → Tamsin test records:

• accepted signed contribution;
• retry idempotency;
• stale-revision rejection;
• unchanged PPF/canon.

Configuration-sync work remains paused until this gate passes.

[BryanHarrisScripts]

Upstream dependency tracked at block/buzz#6874.

This draft should remain unmerged until a BUZZ build returns the public sig field and the real PlotPickle → BUZZ → Tamsin → PlotPickle signed round trip passes on Windows.

[BryanHarrisScripts]

Developer Workbench guidance

Reviewed: 2026-08-26T12:39:06.0934771+00:00
Exact reviewed head: bed0ecd737f7406fdf5f5d24550670ee4933c51d

{
  "diff": {
    "core/story-workflow/buzz-story-bridge-core.mjs": [
      {
        "from": "export function storyBridgeResultMatchesRequest(content, requestId) {",
        "to": "export function storyBridgeResultMatchesRequest(content, requestId) {"
      },
      {
        "from": "  const expectedRequestId = cleanText(requestId, 180);",
        "to": "  const expectedRequestId = cleanText(requestId, 180);"
      },
      {
        "from": "  if (!expectedRequestId) return false;",
        "to": "  if (!expectedRequestId) return false;"
      },
      {
        "from": "  try {",
        "to": "  const envelope = decodeStoryBridgeResultEnvelope(content);"
      },
      {
        "from": "    const envelope = decodeStoryBridgeResultEnvelope(content);",
        "to": "  return cleanText(envelope?.requestId, 180) === expectedRequestId;"
      },
      {
        "from": "    return cleanText(envelope?.requestId, 180) === expectedRequestId;",
        "to": "  } catch {"
      },
      {
        "from": "  } catch {",
        "to": "    return false;"
      }
    ],
    "tests/issue-1422-buzz-story-bridge.test.mjs": [
      {
        "from": "assert.equal(storyBridgeResultMatchesRequest(`${STORY_BRIDGE_RESULT_MARKER}\\n{broken`, bridge.requestId), false);",
        "to": "  assert.throws(\n    () => storyBridgeResultMatchesRequest(`${STORY_BRIDGE_RESULT_MARKER}\\n{broken`, bridge.requestId),\n    /JSON/,"
      },
      {
        "from": "  assert.match(contribution.reason, /public signature/i);",
        "to": "    );"
      }
    ]
  }
}

[BryanHarrisScripts]

Live Windows exit proof completed on 2026-08-26 against exact PR head 98b72603c44ad476eb87763e456f1faa982fd63c using BUZZ main 22cdda441d19da1b15dd7db4d932d2f067cd87b3, which contains upstream signature-preservation merge 583af02299e20cbd8603044c7844bc128e4e06cd (#6884). PlotPickle reported BUZZ Story Test: PASS: Tamsin signed the bounded result, retry remained idempotent, a stale response was rejected, and PPF/canon stayed unchanged. Exact-head Story Bridge, BEN Code Quality, Hardware-Aware Local AI, and LEARN Validation are all green. No unresolved review threads remain.