feat(agent): show completed work without reopening the full thread

[BradGroux]

Note: This is a replacement for PR #2941, which was accidentally closed when branches were force-pushed after a commit identity rewrite. The changes are identical, rebased onto the latest main.

Closes #2932.

Observed problem

Buzz already has signed agent job events, but kind:43004 results are opaque strings. A requester has to reconstruct the requested outcome, final state, artifacts, verification, and blockers from the full thread, and Home can expose structured content as raw JSON.

What changes

• Add a versioned JobResultPayload contract with dispositions, typed artifact references, verification results, explicit blockers, byte and item limits, unsafe-reference rejection, and cross-field invariants.
• Add a typed SDK builder and buzz jobs handoff --channel <uuid> --job <event-id> --manifest <path|->.
• Admit the existing 43001 through 43006 job lifecycle at the relay under channel-scoped messages:write authorization.
• Add a Desktop handoff card and human-readable Home projection.
• Keep legacy, malformed, unsupported, oversized, or tag-mismatched 43004 content on the existing Markdown fallback.
• Document the protocol and privacy boundary in docs/nips/NIP-AJ.md.

Trust and compatibility

The signed content is authoritative, while schema and disposition tags are query hints. Desktop only trusts structured content when the payload event ID matches the single signed reply tag.

Artifact references fail closed. URL-shaped references are parsed before kind-specific validation, including artifact kinds that also accept raw branch, canvas, workflow-output, or free-form references. Credential-bearing URLs, POSIX absolute paths, Windows rooted paths, drive-letter paths, and UNC paths are rejected in both Rust and Desktop instead of becoming clickable or relay-visible handoff data.

Version 1 ignores additive unknown object fields. Older clients continue to see JSON content as ordinary text, and newer clients continue to render legacy plaintext results as Markdown.

Verification

Verified on exact head 372308646b32fff1fe2324c7977c8207e0992d04, rebased onto current main at b1b283cd4c7f926e12eeee8ae1f38c7471922b16:

• Full Rust suites for buzz-core, buzz-sdk, and buzz-cli passed.
• The three relay admission, channel-scope, and migrated-kind regressions passed.
• Full Desktop JavaScript suite: 3,901 tests passed, 0 failures.
• Desktop lint, file-size ratchet, typecheck, and production build passed.
• Rust and Desktop regressions cover relay authorization, channel scoping, unsafe URLs, absolute local paths across operating systems, malformed payload fallback, and reader-facing disposition copy.

The SDK signing test round-trips the canonical payload through the signed event shape. A complete relay library run reached 825 passed and 35 ignored, but nine unchanged admin/media tests could not acquire their local Postgres fixture (Sqlx(PoolTimedOut)); an isolated rerun reproduced the same missing-fixture failure. A live remote relay integration run was not performed.

Non-goals

• No scheduler, worker loop, approval system, project-management surface, or local workspace scanner.
• No change to job acceptance or agent mention delivery.
• No new HTTP endpoint or production dependency.

[BradGroux]

This is a replacement for #2941, which was accidentally closed when branches were force-pushed after a commit identity rewrite. Prior review comments and feedback are preserved on the old PR:

#2941

[BradGroux]

Rebased onto the latest main (was 36 commits behind). All 3 commits applied cleanly. The job result handoff feature (structured kind:43004 payloads, buzz jobs handoff CLI, Desktop handoff card) is not present on current main, so this PR is still needed.

No review comments on this PR. CI will verify the build and test gate.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 213092074c269bee90c87163672f9c2b8d714cfe...b6db2b23098ec263f6b35f47a1a1c2c8063f28e3.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review b6db2b23098ec263f6b35f47a1a1c2c8063f28e3 to authorize a new review.
Any previous review applies only to its recorded range.

[BradGroux]

Rebased onto the latest main (was 62 commits behind at f249710, now at 00e61ea). The branch applies cleanly with all tests passing.

Still-needed assessment: No upstream commits in the 62-commit window address the same issue. This PR remains needed.

Review requests: buzz-oss-team review request is active from the previous pass.

[BradGroux]

Rebased onto current block:main (2af9773d6) — 38 new commits since the last rebase pass (Aug 29, 00e61eafa).

Conflict resolved: desktop/src/features/messages/ui/MessageRow.tsx — Upstream added a WaveMessageAttachment import and other imports above the lazy-loaded DiffMessage/DiffMessageExpanded lines. This PR's JobResultCard lazy import was interleaved in the same region. The resolution keeps both the upstream imports and the PR's JobResultCard lazy import, placed after DiffMessageExpanded.

Still needed: No upstream commit addresses inspectable job result handoffs. The PR remains relevant.

Verification:

• Branch is 0 commits behind block:main, mergeable on GitHub
• All commits authored as Brad Groux (3053586+BradGroux noreply)
• DCO signoff preserved on all commits

[BradGroux]

Rebase and review — 2026-09-03

Base commit: 752cbfc03 (latest main)
Mergeable: Yes
Conflict resolution: MessageRow.tsx — trivial import conflict, merged the JobResultCard lazy import.

Accuracy review: Completed job results still reopen the full thread instead of showing a result handoff.
Continued relevance: Still needed.

[BradGroux]

Rebase and review update — Sep 3, 2026

Rebased onto latest main (88687876f). No conflicts.

Accuracy review: Main does not have job result handoff support — job lifecycle kinds 43001–43006 are not admitted to required_scope_for_kind / requires_h_channel_scope, and there is no inspectable result handoff surface for completed agent work. The PR (including ScaleLeanChris's cherry-picked relay E2E test commit and the local-path rejection fix for job artifacts) is still needed.

Mergeable status: Confirmed MERGEABLE on GitHub after force-push.

[BradGroux]

Rebase pass — Sep 5, 2025

Rebased onto current upstream main (f038cbbb0). Main moved 62 commits since the Sep 2 rebase pass (2af9773d6).

Rebase result

Rebased cleanly onto current main. No conflicts.

Still-needed assessment

Checked all 62 new main commits for overlap with this PR's topic. None obsoleted:

• Verify ACP relay events before prompt routing #7010 (verify ACP relay events before prompt routing) adds signature verification to relay event handling — does not address SubscribeMode filtering (fix(acp): stop SubscribeMode::All from subscribing to every event kind #6646) or mention latency tracing (feat(acp): show where reply time goes after an agent @mention #6637)
• fix(buzz-acp): bound busy-owner hold to prevent cross-channel starvation #7337 (bound busy-owner hold to prevent cross-channel starvation) changes ACP dispatch scheduling — does not add latency observers (feat(acp): show where reply time goes after an agent @mention #6637)
• fix(acp): rename system tag to agent-instructions #7332 (rename system tag to agent-instructions) renames prompt boundary tags — does not affect MCP server wiring (feat(acp): accept extra MCP servers via BUZZ_ACP_EXTRA_MCP_COMMANDS #6651, fix(acp): add BUZZ_ACP_AGENT_ARGS_JSON for lossless structured argument transport #6654, fix(desktop): wire MCP server for Claude Code agents #6658) or agent args transport (fix(acp): add BUZZ_ACP_AGENT_ARGS_JSON for lossless structured argument transport #6654)
• perf(desktop): publish mention sends before waking agents #7154 (publish mention sends before waking agents) is a desktop send-path optimization — does not address ACP latency observability (feat(acp): show where reply time goes after an agent @mention #6637)
• feat(agents): harness-agnostic effort write path and spawn bridge #4625 (harness-agnostic effort write path) extracts runtime catalog to catalog.rs and adds effort normalization — does not fix Claude MCP wiring (fix(desktop): wire MCP server for Claude Code agents #6658, still has mcp_command: None upstream), Goose provider URL translation (fix(desktop): let Goose agents use OpenAI-compatible provider URLs #6641), or capability readiness manifests (feat(agent): show readiness and capabilities before delegation #6643)
• feat(cli): add buzz gifs command group and NIP-30 emoji tags on messages #7259 (buzz gifs command group and NIP-30 emoji tags) adds emoji tag support to build_message and new CLI commands — does not address NUL byte validation (fix(cli): reject NUL bytes in message content instead of silently truncating #6653), thread root filter (fix(cli): apply --channel to the root filter in messages thread #6655), or include_aux (fix(cli): plumb include_aux so messages thread/get can see reactions #6656)
• refactor(relay): extract NIP-29 membership authorization #7285 (extract NIP-29 membership authorization) refactors relay authz — does not affect multi-channel HTTP query (fix(relay): stop multi-channel HTTP query from narrowing to one UUID #6648)
• fix(desktop): authorize remote mentions at publication #7124, fix(desktop): bind duplicate mention selections to exact recipients #7133, fix(desktop): restore mention chip identity icons #7338 (mention chip identity, duplicate selections, authorize remote mentions) are desktop mention UI changes — do not affect SDK self-targeted p tags (fix(sdk): preserve self-targeted p tags in add-member, remove-member, and DM builders #6657)

Verification

• PR confirmed MERGEABLE on GitHub
• All commits authored as Brad Groux (3053586+BradGroux noreply)
• DCO signoff preserved on all commits
• Review requests to buzz-oss-team still active from the Aug 24 recovery pass

[BradGroux]

Restoration note — Sep 16, 2026: The original text of this comment was accidentally overwritten when the Sep 16 rebase pass posted its follow-up with an edit flag instead of as a new comment. What follows is a faithful reconstruction from the session record; the byte-exact original remains in this comment's GitHub edit history (hover the edited marker on this comment).

Rebase pass — Sep 9, 2026

Rebased onto current upstream main (c045321a7). Main moved 8 commits since the Sep 5 rebase pass (f038cbbb0).

Rebase result

Rebased cleanly onto current main. No conflicts.

Still-needed assessment

Checked all 8 new main commits for overlap with this PR's topic. None obsoleted. None of the 8 new main commits add job-result handoff UI.

Verification

• PR confirmed MERGEABLE on GitHub
• All commits authored as Brad Groux (3053586+BradGroux noreply)
• DCO signoff preserved on all commits
• Review requests to buzz-oss-team still active from the Aug 24 recovery pass

[BradGroux]

Rebase pass — Sep 16, 2026

Rebased onto current upstream main (213092074). Main moved 37 commits since the Sep 9 rebase pass (c045321a7).

Rebase result

Rebased cleanly onto current main. No conflicts.

Still-needed assessment

None of the 37 new main commits add job-result handoff UI.

Verification

• PR confirmed MERGEABLE on GitHub
• All commits authored as Brad Groux (3053586+BradGroux noreply)
• DCO signoff preserved on all commits
• buzz-oss-team review request still active

What was not done

No local test suites were run. The rebase only repositions commits; conflict resolutions carry the same logical changes forward (CI will verify builds).