Conversation
Extract global navigation shortcuts into a focused hook and remove the unused threadActivityItems context field. Co-authored-by: Amp <amp@ampcode.com> Amp-Thread-ID: https://ampcode.com/threads/T-019f8626-f5ed-731e-94dc-37ce0fd51b93
noahjalex
marked this pull request as ready for review
July 21, 2026 20:40
tucktuck101
pushed a commit
to tucktuck101/buzz
that referenced
this pull request
Sep 17, 2026
…hecks-tier2 feat(ci): run the corpus validator and package-drift guard on push
tucktuck101
pushed a commit
to tucktuck101/buzz
that referenced
this pull request
Sep 17, 2026
`cargo-deny check` fails on the Security CI job:
error[vulnerability]: TLS 1.3 handshake messages incorrectly accepted
across encryption level boundaries
Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0285
advisories FAILED, bans ok, licenses ok, sources ok
Lockfile only -- no Cargo.toml change, no source change. `cargo update -p rustls
--precise 0.23.45` also carries rustls-webpki 0.103.13 -> 0.103.15 and
aws-lc-sys 0.41.0 -> 0.45.0, both required by that rustls version.
A SYNC, NOT A DECISION. Upstream block/buzz is already on rustls 0.23.45; this
fork was on 0.23.42. The version is pinned to match upstream rather than taking
what `cargo update` offered on its own (0.23.43), so the lockfiles converge
instead of drifting further apart. Same shape as block#2277.
WHY IT WENT UNNOTICED
The Security job sits behind the `rust` paths filter and is `skipping` on almost
every PR -- verified on block#2283, block#2276, block#2269 and block#2264. It fired on block#2270 only
incidentally: that PR regenerates
launchpad/crates/knowledge/generated/corpus.json, and `launchpad/crates/**` is
in the filter. A Rust security audit therefore runs when, and only when,
somebody edits documentation in the right place.
Second repo-wide failure in two days found by accident on a documentation PR
rather than by the safety net; the first was the MinIO outage (block#2266).
VERIFICATION
cargo-deny check exit 0; advisories ok, bans ok,
licenses ok, sources ok
(was: advisories FAILED)
cargo check --workspace --all-targets exit 0, no errors, 3m05s
cargo test --workspace --lib 993 passed, 2 failed
cargo test -p buzz-core --lib 262 passed, 0 failed
TWO TESTS FAIL, AND BOTH FAIL IDENTICALLY WITHOUT THIS CHANGE. Each was re-run
in the same worktree against origin/launchpad's lockfile (rustls 0.23.42,
aws-lc-sys 0.41.0) and failed the same way, so neither is caused by the bump:
buzz-relay api::mesh_demo::tests::demo_join_forwarded_arm_round_trips_echo
HTTP 504 != 200
git-sign-nostr tests::test_parse_envelope_rejects_invalid_oa_pubkey
assertion failed: result.is_err()
The second was checked with particular care: aws-lc-sys is a cryptographic
library and that test asserts a pubkey is REJECTED, so a bump quietly making it
accepted is exactly the regression worth catching. It fails on the baseline too.
A third, buzz-acp `claude_named_adapter_wire_lifecycle_records_prompt_and_cost`,
failed once and passed on re-run: flaky, not deterministic.
None of the three has an issue yet. They are pre-existing and out of scope here,
but they mean the workspace suite is NOT green as it stands -- stated plainly
rather than buried, because this change is not why.
A further six buzz-relay media tests failed until the database had migrations
applied (`relation "communities" does not exist`); all 35 pass once migrated.
Environmental, not a code fault.
NOT VERIFIED: no TLS handshake was exercised end to end and no integration suite
was run. This changes no code, but "compiles and unit-tests pass" is not "the
relay still negotiates TLS correctly" -- the full Rust matrix in CI is what
establishes that.
Closes block#2284
Signed-off-by: test <test@example.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Keep
AppShellfocused on application composition and reduce its size below the desktop file-size guard.What
AppShellContextwhile retaining the derived activity feedRisk Assessment
Low — shortcut behavior and context consumers are unchanged.
References
Generated with Amp