fix(activity): stream Prime activity to mobile and members

[ChinaDairy]

Summary

Fix Prime-agent activity streaming end to end on mobile and desktop, while exposing only a separate, strictly sanitized live activity summary to other current members of the same stream/forum.

• preserves the encrypted, full-fidelity, owner-only kind 24200 observer feed
• adds ephemeral member-visible kind 24201 with a closed, content-free schema
• authorizes only managed agent publishers that are current channel/community members
• rechecks current membership for publication, subscription, and delivery
• excludes DMs, archived channels, ambiguous tags, HTTP ingest, replay/history/search, and unsafe fields
• fixes mobile handling of batched owner observer frames
• keeps owner and ordinary-member parsers/renderers separate
• adds bounded ACP queueing, ACK/retry/reconnect handling, shutdown fencing, and fail-visible drops
• accepts the deployed legacy ACP mode value steer-thread as an alias for steer

Privacy / authorization contract

Shared frames are producer-built from a closed DTO. They contain only schema version, opaque activity ID, timestamp, closed activity/status enums, optional bounded duration, optional canonical tool class, and optional bounded aggregate usage.

They contain no prompts, model output, thoughts, plans, raw messages, tool titles/arguments/results, paths, URLs, raw errors, session IDs, triggering event IDs, credentials, or arbitrary adapter/diagnostic data.

Kind 24201 requires a valid signer matching the declared managed agent, exactly one canonical channel tag, a non-DM stream/forum, current agent membership, current viewer membership, freshness, and strict schema validation. Database uncertainty fails closed. Membership is rechecked at fan-out so revocation affects open subscriptions.

Frozen candidate

• Exact candidate: e0758e20e26fab31a4f49e1cbefd21c2c4dc438a
• Base: 7634fe74563ea7f3c86fb6017a0ad647a9934477
• Commits above base: 11
• DCO: all 11 commits signed off
• Tree: clean

Exact-SHA verification

All commands below were run against the frozen candidate above.

• Rust format and Clippy (-D warnings): passed
• buzz-core: 249 unit tests plus integration tests passed
• buzz-sdk: 257 unit tests plus activity-builder tests passed
• buzz-acp: 816 library tests plus lifecycle tests passed
• buzz-backend-kubernetes: 154 unit tests plus provider-wire tests passed
• buzz-relay: 899 library tests passed; 44 explicitly infra-gated tests remained ignored
• Real-Postgres activity lifecycle fence: passed
• Real-Postgres live-only DB surfaces (event/thread/usage/admin): passed
• Real-Postgres legacy search exclusion: passed
• Relay/DB/search Clippy (-D warnings): passed
• Mobile format/analyze/file-size gate: passed
• Mobile full suite: 1,312 tests passed
• Desktop lint/static checks: passed (one pre-existing style warning, no errors)
• Desktop frontend suite: 4,769 tests passed
• Desktop production web build: passed
• Tauri format/check/Clippy: passed
• Tauri full serialized workspace suite: 2,407 main-crate tests plus all subsidiary-crate tests passed; expected OS-keychain/performance tests remained ignored

Production state

This successor SHA is not deployed.

Production still runs the previously authorized pre-merge canaries:

• relay revision 16968a4f1c3b59ab89ee5302f27418c0c02d546d
• four Prime ACP units on the prior corrected b7edff0d96dae7f1c2fc520b7c0cc782da01f8ee binary
• Control and Jarvis remain on their baseline ACP binary

The relay remains healthy and externally ready with zero restarts in the latest check. Live kind-24201 delivery has not yet been proven; the earlier member probe timed out. No mobile release containing this change has been distributed or installed.

Release requirements

Do not merge or deploy a successor commit under this attestation. Required checks, code-owner approval, and last-push approval must bind to the exact SHA above. Any source edit or base rebase requires fresh gates and review.

[ChinaDairy]

Exact candidate 16968a4 is locally green across Rust, mobile (1,278 tests), and desktop (4,730 tests plus production build). @block/buzz-oss-team please approve the fork workflow runs and provide the required non-author/code-owner review for this exact SHA. Production remains unchanged pending protected merge.

[ChinaDairy]

Production canary found one compatibility issue after the relay passed: existing Prime units use BUZZ_ACP_MULTIPLE_EVENT_HANDLING=steer-thread, while the candidate CLI accepted only steer. The canary failed closed on Luna; Luna was restored online on the predecessor binary and the other Prime units were untouched. Added a backward-compatible steer-thread alias plus regression test. All 752 ACP library tests, Clippy with -D warnings, and rustfmt pass. New exact head: b7edff0d96dae7f1c2fc520b7c0cc782da01f8ee. Please review/approve this exact SHA; prior approvals are stale.

[ChinaDairy]

Closing at the requester’s direction. We will wait for upstream native Activity support instead of maintaining this custom implementation.