Skip to content

perf(relay): index channel-id lookups and skip trace-only reads - #4647

Merged
tlongwell-block merged 1 commit into
block:mainfrom
jemiahw:fix/channels-id-lookup-hot-query
Aug 4, 2026
Merged

perf(relay): index channel-id lookups and skip trace-only reads#4647
tlongwell-block merged 1 commit into
block:mainfrom
jemiahw:fix/channels-id-lookup-hot-query

Conversation

@jemiahw

@jemiahw jemiahw commented Aug 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Problem

SELECT id, community_id FROM channels WHERE id = ANY($1) AND deleted_at IS NULL is the top Load by waits (AAS) on the Buzz Postgres writer. Two independent causes compound, and both are fixed here.

1. No index can serve it

channels is PRIMARY KEY (community_id, id), and every secondary index leads with community_id:

Index Columns
(primary key) (community_id, id)
idx_channels_nip29_group (community_id, nip29_group_id)
idx_channels_dm_hash (community_id, participant_hash)
idx_channels_community_type (community_id, channel_type)
idx_channels_community_visibility (community_id, visibility)
idx_channels_created_by (community_id, created_by)
idx_channels_ttl_expiry (ttl_deadline) (partial)

The two tenant-independent lookups carry no community_id predicate — deliberately:

  • Db::communities_of_channels — WHERE id = ANY($1) AND deleted_at IS NULL
  • Db::community_of_channel — WHERE id = $1 AND deleted_at IS NULL

That independence is load-bearing, not an oversight: projecting a row's true owning community regardless of the fetch query's WHERE clause is what makes Inv_NonInterference non-vacuous. If the fetch ever dropped its tenant scoping, this lookup would still report the real label and the checker would catch the mismatch.

But a composite btree is only usable when its leading column is constrained, so neither query can use the primary key, and nothing else leads with id. Both sequentially scan channels on every call.

2. In production the result is discarded

Both call sites feed record_read_message_rows / record_read_by_id_rows, which call tracer.record(...). Production binds NoopTracer (crates/buzz-relay/src/state.rs), whose record body is empty.

The existing guard tests trace_state, which is Some for every well-formed request — it only goes None on malformed pubkey bytes. So the scan ran on the hot read path and its output was dropped. This is the classic eager-argument bug: log.debug("..." + expensiveCall()) with no isDebugEnabled() check.

3. Multiplied per filter

The non-search call site sits inside the phase-3 per-filter loop, so a REQ carrying N filters performed N sequential scans of channels before responding.

Changes

Tracer::enabled() — a capability check on the trait (the isDebugEnabled() of this seam), defaulting to true. NoopTracer overrides it to false, and both emitters in req.rs now gate on it, skipping the trace-only DB read entirely in production.

migrations/0027_channels_id_lookup_index.sql

CREATE INDEX IF NOT EXISTS idx_channels_id_live
    ON channels (id) INCLUDE (community_id)
    WHERE deleted_at IS NULL;
  • INCLUDE (community_id) — both queries select exactly (id, community_id), so this is covering and can be served index-only.
  • Partial on deleted_at IS NULL — matches both predicates exactly, excludes soft-deleted history, and lets Postgres skip the recheck.
  • Not UNIQUE. id alone is not unique in this table — command_executor.rs documents that community_of_channel(channel_id) is ambiguous because the same channel id can appear under more than one community. A unique index would encode a false constraint and fail to build on any database already holding such a pair.

Worth keeping the index even though fix #1 removes the production caller: it still runs under conformance, and community_of_channel has the same problem on its own paths.

schema/schema.sql — mirrored, since a test asserts desired-state parity.

Conformance is unchanged

This is the part worth reviewing closely. Under a real tracer enabled() returns true and every emit happens exactly as before — the gate only skips building emit inputs when nothing observes them, never an emit that would otherwise have been made. The coverage-breach guard stays non-vacuous.

CountingTracer forwards enabled() to its inner tracer rather than inheriting the true default. Both directions matter and both fail silently:

  • inheriting true over a NoopTracer would keep the overhead this PR removes;
  • hardcoding false over a live tracer would suppress the emits whose absence EmitGuard reports as ImplBug — masking real breaches behind expected ones.

Covered by a new regression test, counting_tracer_delegates_enabled_to_inner, which asserts delegation in both directions.

Verification

  • cargo check -p buzz-conformance -p buzz-relay — clean
  • cargo clippy --all-targets — clean, zero warnings
  • cargo test -p buzz-conformance — 6/6
  • cargo test -p buzz-relay --lib conformance — 11/11
  • cargo test -p buzz-db --lib migration — 7/7
  • just test-unit (pre-push) — green

Migration-count assertions in crates/buzz-db/src/migration.rs were bumped 26 → 27, with content assertions for 0027 following the existing per-migration pattern (including a guard that it never becomes UNIQUE).

Open questions for reviewers

  1. Lock strategy. Built without CONCURRENTLY, following migration 0004's precedent, because sqlx runs each migration inside a transaction and CREATE INDEX CONCURRENTLY cannot run in one. This takes a brief SHARE lock on channels (blocks writes, not reads) — small relative to events, but an operator preferring zero write-blocking can pre-build it by hand and IF NOT EXISTS makes the migration a no-op. I could not confirm whether sqlx 0.9 supports a -- no-transaction directive; if it does, that may be preferable.

  2. Diagnosis is static. This comes from reading the source, not from EXPLAIN against the live database. Worth confirming with EXPLAIN (ANALYZE, BUFFERS) on the writer before/after — that also sizes the win by revealing the real table size and row counts.

  3. Expected impact scales with average filters-per-REQ, which I did not measure. pg_stat_statements ordered by total_exec_time would confirm this query drops off the top and show whether anything else is scanning the same way.

@jemiahw
perf(relay): index channel-id lookups and skip trace-only reads
3285110 
`SELECT id, community_id FROM channels WHERE id = ANY($1) AND deleted_at
IS NULL` is the top "Load by waits (AAS)" on the writer. Two independent
causes, both fixed here.

No index can serve it. `channels` is PRIMARY KEY (community_id, id) and
every secondary index leads with community_id, but the tenant-independent
lookups (`Db::communities_of_channels`, `Db::community_of_channel`) carry
no community_id predicate — deliberately, since projecting a row's true
label independently of the fetch query's WHERE clause is what makes
Inv_NonInterference non-vacuous. A composite btree needs its leading
column constrained, so both queries sequentially scan `channels` on every
call. Migration 0027 adds a covering partial index on (id) INCLUDE
(community_id) WHERE deleted_at IS NULL, serving both index-only. Not
UNIQUE: `id` alone is not unique, as command_executor.rs documents.

The result was also discarded in production. Both callers feed
`record_read_*_rows` -> `tracer.record(...)`, and production binds
`NoopTracer`, whose `record` is empty. The existing `if let Some(...)`
guard tests `trace_state`, which is `Some` for every well-formed request,
so the scan ran and its output was dropped — once per filter for the
non-search lane, inside the phase-3 loop. `Tracer` grows an `enabled()`
capability check (the `log.isDebugEnabled()` of this seam) that
`NoopTracer` overrides to `false`, and both emitters now gate on it.

Conformance behaviour is unchanged: a real tracer reports `enabled() ==
true` and every emit happens exactly as before, so the coverage-breach
guard stays non-vacuous. `CountingTracer` forwards `enabled()` to its
inner tracer rather than inheriting the `true` default — inheriting it
would keep the overhead over a `NoopTracer`, and hardcoding `false` would
suppress emits the `EmitGuard` reports as `ImplBug`. Covered by
`counting_tracer_delegates_enabled_to_inner`.

Built without CONCURRENTLY, per 0004's precedent: sqlx runs each
migration in a transaction. Takes a brief SHARE lock on `channels`;
operators wanting zero write-blocking can pre-build the index
concurrently by hand, and IF NOT EXISTS makes the migration a no-op.

Signed-off-by: Jemiah Westerman <jemiah@squareup.com>
@tlongwell-block
tlongwell-block marked this pull request as ready for review August 4, 2026 17:19
@tlongwell-block
tlongwell-block requested a review from a team as a code owner August 4, 2026 17:19
This was referenced Aug 4, 2026
Open
Open
@tlongwell-block
tlongwell-block merged commit bc9e652 into block:main Aug 4, 2026
33 checks passed
veltri-23 added a commit to veltri-23/buzz that referenced this pull request Aug 4, 2026
@veltri-23
fix(buzz-db): renumber backfill migration to 0028
48e3c2f 
PR block#4647 merged as 0027_channels_id_lookup_index.sql, so the embedded
migrator would have two version-27 migrations. Whichever merged second
breaks the sqlx checksum (VersionMismatch(27)) at boot with
BUZZ_AUTO_MIGRATE=true. Renumber to 0028 and bump the count assertion
27 -> 28.

Signed-off-by: Hunter Veltri <veltrifinancial@gmail.com>
wpfleger96 pushed a commit that referenced this pull request Aug 4, 2026
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7
Merge remote-tracking branch 'origin/main' into will/archive-defaults…
43717e6 
…-enabled

* origin/main:
  Dock Buzz Term within channel workspace (#4724)
  perf(relay): index channel-id lookups and skip trace-only reads (#4647)
  fix(agents): canonicalize stale persona harness pins (#4631)
  Refine community invite links (#4734)

Signed-off-by: npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7 <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>
wpfleger96 added a commit that referenced this pull request Aug 4, 2026
npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7 @wpfleger96
Merge commit 'ce3cf3cd2' into duncan/nip-rs-unread-format
384ebc9 
* commit 'ce3cf3cd2': (76 commits)
  Polish Huddle voice controls (#4694)
  fix(local-archive): default both archive settings to enabled (#4750)
  fix(mobile): stop oversized read-state retry loop (#4595)
  fix(desktop): close reconnect gaps that previously required CMD+R (#4737)
  Dock Buzz Term within channel workspace (#4724)
  perf(relay): index channel-id lookups and skip trace-only reads (#4647)
  fix(agents): canonicalize stale persona harness pins (#4631)
  Refine community invite links (#4734)
  feat(desktop): persist sidebar observed-unread across webview reload (#3976)
  feat(desktop): surface config diff in restart-required badge (#3637)
  Polish sidebar unread hierarchy (#4573)
  fix(desktop): show cached display names on startup (#3317)
  docs(acp): explain per-channel session model in base prompt (#4729)
  docs(nip-am): normative amendment — cache SHOULD/MUST + pricingIdentity + consumer cost guidance (#4632)
  Remove blur from Welcome composer guidance (#4691)
  Refine desktop timeline activity presentation (#4582)
  Defer desktop media uploads until send (#4522)
  fix(desktop): stop clipping focus ring on channel intro action cards (#2392) (#4374)
  Polish mobile inbox and media flows (#4512)
  feat: ship Buzz Term (#4347)
  ...

Co-authored-by: Will Pfleger <pfleger.will@gmail.com>
Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
@azrilamil azrilamil mentioned this pull request Aug 4, 2026
Open
shellz-n-stuff added a commit to shellz-n-stuff/buzz that referenced this pull request Aug 4, 2026
@shellz-n-stuff
Merge remote-tracking branch 'origin/main' into codex/harden-shared-a…
5b4fa1d 
…gent-instructions

* origin/main: (30 commits)
  feat: Buzz entity links — rich preview cards + in-app navigation for repos, PRs, and issues (block#4695)
  fix(desktop): serialize tray channel actions for frontend (block#4762)
  chore(release): release Buzz Desktop version 0.5.5 (block#4788)
  feat(projects): support multiple repositories (block#4671)
  fix(ci): make desktop cache test version agnostic (block#4791)
  fix(desktop): widen post-Enter timeouts in empty-edit-delete spec (block#4792)
  fix(desktop): wait for terminal frame before splash (block#4781)
  fix(desktop): integer-align custom reaction emoji (block#4779)
  Polish Huddle voice controls (block#4694)
  fix(local-archive): default both archive settings to enabled (block#4750)
  fix(mobile): stop oversized read-state retry loop (block#4595)
  fix(desktop): close reconnect gaps that previously required CMD+R (block#4737)
  Dock Buzz Term within channel workspace (block#4724)
  perf(relay): index channel-id lookups and skip trace-only reads (block#4647)
  fix(agents): canonicalize stale persona harness pins (block#4631)
  Refine community invite links (block#4734)
  feat(desktop): persist sidebar observed-unread across webview reload (block#3976)
  feat(desktop): surface config diff in restart-required badge (block#3637)
  Polish sidebar unread hierarchy (block#4573)
  fix(desktop): show cached display names on startup (block#3317)
  ...

Signed-off-by: Alex Rosenzweig <arosenzweig@squareup.com>
sandro-sq added a commit that referenced this pull request Aug 4, 2026
@sandro-sq
Merge remote-tracking branch 'origin/main' into micspiral/mesh-share-ux
6c5c78f 
* origin/main: (31 commits)
  feat: paste composer text without formatting (#4801)
  Revert "chore(release): release Buzz Desktop version 0.5.5" (#4808)
  chore(release): release Buzz Desktop version 0.5.5 (#4800)
  fix: reauthenticate databricks model discovery (#4008)
  Revert "chore(release): release Buzz Desktop version 0.5.5" (#4797)
  feat: Buzz entity links — rich preview cards + in-app navigation for repos, PRs, and issues (#4695)
  fix(desktop): serialize tray channel actions for frontend (#4762)
  chore(release): release Buzz Desktop version 0.5.5 (#4788)
  feat(projects): support multiple repositories (#4671)
  fix(ci): make desktop cache test version agnostic (#4791)
  fix(desktop): widen post-Enter timeouts in empty-edit-delete spec (#4792)
  fix(desktop): wait for terminal frame before splash (#4781)
  fix(desktop): integer-align custom reaction emoji (#4779)
  Polish Huddle voice controls (#4694)
  fix(local-archive): default both archive settings to enabled (#4750)
  fix(mobile): stop oversized read-state retry loop (#4595)
  fix(desktop): close reconnect gaps that previously required CMD+R (#4737)
  Dock Buzz Term within channel workspace (#4724)
  perf(relay): index channel-id lookups and skip trace-only reads (#4647)
  fix(agents): canonicalize stale persona harness pins (#4631)
  ...

Signed-off-by: Alessandro Joabar <sandro@squareup.com>
@adrienlacombe adrienlacombe mentioned this pull request Aug 5, 2026
Merged
@github-actions github-actions Bot mentioned this pull request Aug 5, 2026
Open
@wpfleger96 wpfleger96 mentioned this pull request Aug 8, 2026
Merged
wpfleger96 added a commit that referenced this pull request Aug 8, 2026
@wpfleger96
chore(release): release Buzz Relay version 0.2.1 (#2856)
6e5c462 
## Buzz Relay release v0.2.1

### Changes since relay-v0.2.0:

- fix(sdk): preserve self-mention p tags in message and forum event
builders ([#4975](#4975))
([`78c87ae20e`](78c87ae))
- feat(desktop): adding rich link previews to messages
([#3818](#3818))
([`1922d49cb2`](1922d49))
- feat(relay): accept kind:30179 private managed-agent events at ingest
([#5133](#5133))
([`ad923353a2`](ad92335))
- fix(media): require authenticated reads
([#4610](#4610))
([`769ac70b74`](769ac70))
- feat(identity): recover desktop identity from a signed-in phone
([#4845](#4845))
([`6eb65919f1`](6eb6591))
- ci: prove the relay-driven mesh lifecycle — discover, join, infer,
deny — with real nodes
([#3862](#3862))
([`38bf642fcf`](38bf642))
- relay: fuzz WebSocket 1012 restart-close timing on graceful drain
(BUZZ_DRAIN_JITTER_MS)
([#4542](#4542))
([`e14fff74d0`](e14fff7))
- fix(reactions): support max-length custom emoji
([#3833](#3833))
([`2ea9385015`](2ea9385))
- fix(channels): restrict private-channel invitations
([#4612](#4612))
([`efe1893dd3`](efe1893))
- fix(workflow): bind trigger author to the signed event
([#4607](#4607))
([`885bed35ee`](885bed3))
- fix(git): revoke access for banned relay members
([#4608](#4608))
([`997b8caaa4`](997b8ca))
- Define private managed agent wire protocol
([#4593](#4593))
([`067c085f37`](067c085))
- perf(relay): index channel-id lookups and skip trace-only reads
([#4647](#4647))
([`bc9e6528a7`](bc9e652))
- Polish mobile inbox and media flows
([#4512](#4512))
([`feccf4eabc`](feccf4e))
- fix(git): allow deleting the default branch
([#4297](#4297))
([`fc598f5f8d`](fc598f5))
- feat(projects): add buzz projects CLI commands (NIP-MP kind:30621)
([#4020](#4020))
([`b7bb15122e`](b7bb151))
- perf(relay): serve relay-membership checks from the read replica
([#4124](#4124))
([`ac4fa13b8e`](ac4fa13))
- fix(relay): allow open relays to set their NIP-11 workspace icon
(kind:9033) ([#3998](#3998))
([`5765fc74b7`](5765fc7))
- feat(relay): accept kind:30621 multi-repo projects at ingest
([#3171](#3171))
([`cb9701cd30`](cb9701c))
- feat(relay): raise hosted community limit to five
([#3829](#3829))
([`10d5a26414`](10d5a26))
- fix(relay): align NIP-11 max_limit with REQ ceiling
([#3635](#3635))
([`23f0c26b1c`](23f0c26))
- feat(relay): gate kind 30178 team-catalog reads behind the shared tag
([#3358](#3358))
([`114d40d9d3`](114d40d))
- fix(db): isolate usage metrics advisory-lock test on scratch DB
([#3670](#3670))
([`dba97eecd9`](dba97ee))
- perf(presence): reduce heartbeat frequency
([#3783](#3783))
([`bf139e8d0b`](bf139e8))
- feat(mesh): upgrade embedded mesh to v0.74 and harden shared compute
(split 1/2 of #3467) ([#3741](#3741))
([`4933672eb4`](4933672))
- feat(replica): portable heartbeat-token fence with snapshot-local
reader routing ([#3268](#3268))
([`63496cc1d4`](63496cc))
- fix(git): channel binding tooling + author remediation for unbound
repos ([#3626](#3626))
([`788b3c002b`](788b3c0))
- feat: configure S3 URL addressing style
([#3400](#3400))
([`7012d86d52`](7012d86))
- feat(tracing): correlate trace IDs in relay logs
([#3608](#3608))
([`005b5b819a`](005b5b8))
- fix(relay): avoid subscription lock inversion
([#3413](#3413))
([`22be8bb351`](22be8bb))
- feat(cli): add users set-status command for NIP-38 profile status
([#3253](#3253))
([`60158fce3e`](60158fc))
- feat(relay): make Postgres pool size configurable, default 50
([#3191](#3191))
([`2ce2d71cc3`](2ce2d71))
- feat(tracing): add datastore tracing plumbing
([#2760](#2760))
([`e94b9aeda0`](e94b9ae))
- feat(invites): add use-limited invite links
([#3141](#3141))
([`d500c2d5cf`](d500c2d))
- feat(admin): show reported message content in report detail
([#3149](#3149))
([`f069a85503`](f069a85))
- resolve findings ([#3150](#3150))
([`9b0f744804`](9b0f744))
- Revert "fix(cli,relay): resolve agents by verified owner"
([#3168](#3168))
([`a041e2d21e`](a041e2d))
- fix(cli,relay): resolve agents by verified owner
([#2615](#2615))
([`c3084b36d9`](c3084b3))
- fix(security): enforce durable community ban on NIP-43 relay-admin
kinds 9030-9033 ([#3128](#3128))
([`e2e0079101`](e2e0079))
- fix(security): authorize kind:9000 role changes in both directions
([#3017](#3017))
([`00ecf2cac7`](00ecf2c))
- feat(desktop): handle project work from Inbox
([#3117](#3117))
([`c5c4f390b6`](c5c4f39))
- feat(relay): make per-owner community limit configurable via
BUZZ_MAX_COMMUNITIES_PER_OWNER
([#2599](#2599))
([`2a051a404d`](2a051a4))
- feat(relay): add author-only-unless-shared read gate for kind 30175
([#2768](#2768))
([`ab3af82871`](ab3af82))
- fix(core): block IPv6 transition SSRF targets
([#2801](#2801))
([`c26bf5945d`](c26bf59))
- fix(workflow): bypass system proxies for webhooks
([#2800](#2800))
([`60a171b19e`](60a171b))
- fix(audit): hash created_at at the precision Postgres stores
([#2638](#2638))
([`264a56a226`](264a56a))
- feat(desktop): make pull request reviews actionable
([#2510](#2510))
([`9081ab0ec9`](9081ab0))
- fix(relay): decompress gzip-encoded git smart-HTTP request bodies
([#2670](#2670))
([`5ca36e7b91`](5ca36e7))
- fix(sharing): preserve agent/team snapshot tEXt chunks through media
sanitization ([#2438](#2438))
([`b096b0a15a`](b096b0a))
- fix(relay): send 1012 restart close to all clients on graceful drain
([#2575](#2575))
([`1911c69aa2`](1911c69))
- fix(media): sanitize animated image uploads
([#2524](#2524))
([`8f8f5fa5a4`](8f8f5fa))
- fix(channels): strip leading hash prefixes from names
([#2250](#2250))
([`d0ab3fdb05`](d0ab3fd))
- feat(relay): make Redis pool size configurable, default 16
([#2521](#2521))
([`bcc3e13069`](bcc3e13))
- feat(desktop+acp): spawn a harness per (agent, community) pair at GUI
startup — warm sockets, lazy LLM pool
([#2122](#2122))
([`61cc738ee8`](61cc738))
- feat(media): add S3-truth per-community storage sweep
([#2044](#2044))
([`bd37a4d584`](bd37a4d))
- feat(relay): log NIP-98 pubkey attribution on HTTP bridge requests
([#2206](#2206))
([`7e34bee62c`](7e34bee))
- Revert "feat(relay): inventory unreachable Git objects"
([#2275](#2275))
([`0fb820f9bf`](0fb820f))
- feat(relay): inventory unreachable Git objects
([#2264](#2264))
([`3afc9dae15`](3afc9da))
- relay: add author_type label to buzz_events_stored_total
([#2243](#2243))
([`b9f54c43fe`](b9f54c4))
- fix(git): make project branch workflows reliable
([#2213](#2213))
([`166f27be4b`](166f27b))
- feat(cli): manage repository protection rules
([#2193](#2193))
([`f94324598d`](f943245))
- feat(cli): add agents archive/unarchive/archived subcommands
([#2173](#2173))
([`7d7992067b`](7d79920))
- fix(mobile): sanitize Android image uploads
([#2188](#2188))
([`ee21da90bd`](ee21da9))
- fix(cli): paginate channel directory queries
([#2181](#2181))
([`03fe19d603`](03fe19d))
- fix(mobile): image upload fails due to unstripped metadata
([#2185](#2185))
([`37f15b2001`](37f15b2))
- perf(relay): compact Git packs before manifest limits
([#2172](#2172))
([`80e0ab16b0`](80e0ab1))
- perf(relay): cache Git pack hydration
([#2169](#2169))
([`a4d82ec722`](a4d82ec))
- fix(relay): bound and observe Git read operations
([#2167](#2167))
([`5f7c93d9c1`](5f7c93d))
- relay: gate push enqueue on live leases; batch matcher pipeline
(T1b/T1a-repair/T2b) ([#2145](#2145))
([`e43b2d5aac`](e43b2d5))
- relay: add audit logging disable switch
([#2134](#2134))
([`bf5acabdde`](bf5acab))
- relay: skip TTL deadline bump for known-permanent channels (T1a
write-amp) ([#2125](#2125))
([`2e936d439c`](2e936d4))
- fix(git): carry NIP-OA delegation in auth event
([#2120](#2120))
([`c12257d57a`](c12257d))
- Route lag-tolerant reads to an optional Postgres read replica
([#2084](#2084))
([`29c48883d3`](29c4888))
- fix: recover community access visibility
([#2074](#2074))
([`ca384d082d`](ca384d0))
- feat: proxy feedback-scoped admin attachments
([#2059](#2059))
([`d7f918e3cb`](d7f918e))
- feat: add read-only deployment moderation dashboard
([#1999](#1999))
([`68e670e001`](68e670e))
- Bug-bash round 2: table scroll, Goose instructions, workflow mention
wake ([#2034](#2034))
([`64b8fea6dc`](64b8fea))
- Strip media metadata on clients and reject it at the relay
([#2006](#2006))
([`5cfd69cb0c`](5cfd69c))
- [codex] Hold Git concurrency permits through streaming (BUZZ-SEC-018)
([#1916](#1916))
([`7baea42abb`](7baea42))
- [codex] Enforce shared relay admission limits (BUZZ-SEC-019)
([#1917](#1917))
([`73fc0ec6cf`](73fc0ec))
- [codex] Block banned actors from moderation commands (BUZZ-SEC-007)
([#1915](#1915))
([`caa195ca58`](caa195c))
- [codex] Fix relay WebSocket admission limits
([#1682](#1682))
([`d3ce971fc7`](d3ce971))
- feat: add invite QR and mobile direct join
([#1957](#1957))
([`648cbf3610`](648cbf3))
- fix(join-policy): require legal consent on hosted invites
([#1987](#1987))
([`2e1577f76f`](2e1577f))
- [codex] Prevent actor-tag UI impersonation
([#1931](#1931))
([`c540ec9678`](c540ec9))
- Scope relay runtime state by community
([#1658](#1658))
([`d52dedb06f`](d52dedb))
- Apply optional relay join policy across join flows
([#1894](#1894))
([`6c2d667575`](6c2d667))
- feat(media): require auth for relay media reads
([#1926](#1926))
([`f308762852`](f308762))
- feat(relay): add community unarchive endpoint
([#1908](#1908))
([`6b9641db2b`](6b9641d))
- feat(relay): gate Git web GUI separately
([#1901](#1901))
([`34dc7dec75`](34dc7de))
- mesh: upgrade runtime, enforce membership, add shared compute provider
([#1656](#1656))
([`54638ff4bb`](54638ff))
- Route Git scratch through configured volume
([#1884](#1884))
([`2318b3096c`](2318b30))
- feat(relay): gate usage metrics behind stable leader
([#1814](#1814))
([`59e9821503`](59e9821))
- Relay mesh: cross-pod tunnel + huddle transport (buzz-relay-mesh)
([#1670](#1670))
([`ccb021d713`](ccb021d))
- feat(push): deliver accepted relay events as wakes
([#1866](#1866))
([`bffbc5f22c`](bffbc5f))
- fix(db): resolve duplicate migration version
([#1863](#1863))
([`08ad38a07f`](08ad38a))
- Add private product feedback sidecar
([#1857](#1857))
([`af190c93e1`](af190c9))
- feat(relay): add durable community archival
([#1834](#1834))
([`2b15a72675`](2b15a72))
- feat(push): add public APNs gateway
([#1770](#1770))
([`1c006822e4`](1c00682))
- feat(relay): add atomic community ownership transfer
([#1845](#1845))
([`52e42ccb9f`](52e42cc))
- Bound NIP-RS retention and search indexing
([#1771](#1771))
([`1b4703021d`](1b47030))
- Add optional standalone pairing relay to Helm chart
([#1799](#1799))
([`9b47c8548f`](9b47c85))
- fix(relay): publish membership snapshot on provisioning
([#1761](#1761))
([`0950d392b7`](0950d39))
- feat(relay): per-community usage metrics
([#1723](#1723))
([`620822899a`](6208228))
- refactor(desktop): remove vestigial MCP toolsets config
([#1776](#1776))
([`dfec75b3c0`](dfec75b))

**To release:** merge this PR. The tag and build will happen
automatically.

Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
41fred pushed a commit to 41fred/buzz that referenced this pull request Aug 9, 2026
@wpfleger96 @41fred
chore(release): release Buzz Relay version 0.2.1 (block#2856)
afd93b0 
## Buzz Relay release v0.2.1

### Changes since relay-v0.2.0:

- fix(sdk): preserve self-mention p tags in message and forum event
builders ([block#4975](block#4975))
([`78c87ae20e`](block@78c87ae))
- feat(desktop): adding rich link previews to messages
([block#3818](block#3818))
([`1922d49cb2`](block@1922d49))
- feat(relay): accept kind:30179 private managed-agent events at ingest
([block#5133](block#5133))
([`ad923353a2`](block@ad92335))
- fix(media): require authenticated reads
([block#4610](block#4610))
([`769ac70b74`](block@769ac70))
- feat(identity): recover desktop identity from a signed-in phone
([block#4845](block#4845))
([`6eb65919f1`](block@6eb6591))
- ci: prove the relay-driven mesh lifecycle — discover, join, infer,
deny — with real nodes
([block#3862](block#3862))
([`38bf642fcf`](block@38bf642))
- relay: fuzz WebSocket 1012 restart-close timing on graceful drain
(BUZZ_DRAIN_JITTER_MS)
([block#4542](block#4542))
([`e14fff74d0`](block@e14fff7))
- fix(reactions): support max-length custom emoji
([block#3833](block#3833))
([`2ea9385015`](block@2ea9385))
- fix(channels): restrict private-channel invitations
([block#4612](block#4612))
([`efe1893dd3`](block@efe1893))
- fix(workflow): bind trigger author to the signed event
([block#4607](block#4607))
([`885bed35ee`](block@885bed3))
- fix(git): revoke access for banned relay members
([block#4608](block#4608))
([`997b8caaa4`](block@997b8ca))
- Define private managed agent wire protocol
([block#4593](block#4593))
([`067c085f37`](block@067c085))
- perf(relay): index channel-id lookups and skip trace-only reads
([block#4647](block#4647))
([`bc9e6528a7`](block@bc9e652))
- Polish mobile inbox and media flows
([block#4512](block#4512))
([`feccf4eabc`](block@feccf4e))
- fix(git): allow deleting the default branch
([block#4297](block#4297))
([`fc598f5f8d`](block@fc598f5))
- feat(projects): add buzz projects CLI commands (NIP-MP kind:30621)
([block#4020](block#4020))
([`b7bb15122e`](block@b7bb151))
- perf(relay): serve relay-membership checks from the read replica
([block#4124](block#4124))
([`ac4fa13b8e`](block@ac4fa13))
- fix(relay): allow open relays to set their NIP-11 workspace icon
(kind:9033) ([block#3998](block#3998))
([`5765fc74b7`](block@5765fc7))
- feat(relay): accept kind:30621 multi-repo projects at ingest
([block#3171](block#3171))
([`cb9701cd30`](block@cb9701c))
- feat(relay): raise hosted community limit to five
([block#3829](block#3829))
([`10d5a26414`](block@10d5a26))
- fix(relay): align NIP-11 max_limit with REQ ceiling
([block#3635](block#3635))
([`23f0c26b1c`](block@23f0c26))
- feat(relay): gate kind 30178 team-catalog reads behind the shared tag
([block#3358](block#3358))
([`114d40d9d3`](block@114d40d))
- fix(db): isolate usage metrics advisory-lock test on scratch DB
([block#3670](block#3670))
([`dba97eecd9`](block@dba97ee))
- perf(presence): reduce heartbeat frequency
([block#3783](block#3783))
([`bf139e8d0b`](block@bf139e8))
- feat(mesh): upgrade embedded mesh to v0.74 and harden shared compute
(split 1/2 of block#3467) ([block#3741](block#3741))
([`4933672eb4`](block@4933672))
- feat(replica): portable heartbeat-token fence with snapshot-local
reader routing ([block#3268](block#3268))
([`63496cc1d4`](block@63496cc))
- fix(git): channel binding tooling + author remediation for unbound
repos ([block#3626](block#3626))
([`788b3c002b`](block@788b3c0))
- feat: configure S3 URL addressing style
([block#3400](block#3400))
([`7012d86d52`](block@7012d86))
- feat(tracing): correlate trace IDs in relay logs
([block#3608](block#3608))
([`005b5b819a`](block@005b5b8))
- fix(relay): avoid subscription lock inversion
([block#3413](block#3413))
([`22be8bb351`](block@22be8bb))
- feat(cli): add users set-status command for NIP-38 profile status
([block#3253](block#3253))
([`60158fce3e`](block@60158fc))
- feat(relay): make Postgres pool size configurable, default 50
([block#3191](block#3191))
([`2ce2d71cc3`](block@2ce2d71))
- feat(tracing): add datastore tracing plumbing
([block#2760](block#2760))
([`e94b9aeda0`](block@e94b9ae))
- feat(invites): add use-limited invite links
([block#3141](block#3141))
([`d500c2d5cf`](block@d500c2d))
- feat(admin): show reported message content in report detail
([block#3149](block#3149))
([`f069a85503`](block@f069a85))
- resolve findings ([block#3150](block#3150))
([`9b0f744804`](block@9b0f744))
- Revert "fix(cli,relay): resolve agents by verified owner"
([block#3168](block#3168))
([`a041e2d21e`](block@a041e2d))
- fix(cli,relay): resolve agents by verified owner
([block#2615](block#2615))
([`c3084b36d9`](block@c3084b3))
- fix(security): enforce durable community ban on NIP-43 relay-admin
kinds 9030-9033 ([block#3128](block#3128))
([`e2e0079101`](block@e2e0079))
- fix(security): authorize kind:9000 role changes in both directions
([block#3017](block#3017))
([`00ecf2cac7`](block@00ecf2c))
- feat(desktop): handle project work from Inbox
([block#3117](block#3117))
([`c5c4f390b6`](block@c5c4f39))
- feat(relay): make per-owner community limit configurable via
BUZZ_MAX_COMMUNITIES_PER_OWNER
([block#2599](block#2599))
([`2a051a404d`](block@2a051a4))
- feat(relay): add author-only-unless-shared read gate for kind 30175
([block#2768](block#2768))
([`ab3af82871`](block@ab3af82))
- fix(core): block IPv6 transition SSRF targets
([block#2801](block#2801))
([`c26bf5945d`](block@c26bf59))
- fix(workflow): bypass system proxies for webhooks
([block#2800](block#2800))
([`60a171b19e`](block@60a171b))
- fix(audit): hash created_at at the precision Postgres stores
([block#2638](block#2638))
([`264a56a226`](block@264a56a))
- feat(desktop): make pull request reviews actionable
([block#2510](block#2510))
([`9081ab0ec9`](block@9081ab0))
- fix(relay): decompress gzip-encoded git smart-HTTP request bodies
([block#2670](block#2670))
([`5ca36e7b91`](block@5ca36e7))
- fix(sharing): preserve agent/team snapshot tEXt chunks through media
sanitization ([block#2438](block#2438))
([`b096b0a15a`](block@b096b0a))
- fix(relay): send 1012 restart close to all clients on graceful drain
([block#2575](block#2575))
([`1911c69aa2`](block@1911c69))
- fix(media): sanitize animated image uploads
([block#2524](block#2524))
([`8f8f5fa5a4`](block@8f8f5fa))
- fix(channels): strip leading hash prefixes from names
([block#2250](block#2250))
([`d0ab3fdb05`](block@d0ab3fd))
- feat(relay): make Redis pool size configurable, default 16
([block#2521](block#2521))
([`bcc3e13069`](block@bcc3e13))
- feat(desktop+acp): spawn a harness per (agent, community) pair at GUI
startup — warm sockets, lazy LLM pool
([block#2122](block#2122))
([`61cc738ee8`](block@61cc738))
- feat(media): add S3-truth per-community storage sweep
([block#2044](block#2044))
([`bd37a4d584`](block@bd37a4d))
- feat(relay): log NIP-98 pubkey attribution on HTTP bridge requests
([block#2206](block#2206))
([`7e34bee62c`](block@7e34bee))
- Revert "feat(relay): inventory unreachable Git objects"
([block#2275](block#2275))
([`0fb820f9bf`](block@0fb820f))
- feat(relay): inventory unreachable Git objects
([block#2264](block#2264))
([`3afc9dae15`](block@3afc9da))
- relay: add author_type label to buzz_events_stored_total
([block#2243](block#2243))
([`b9f54c43fe`](block@b9f54c4))
- fix(git): make project branch workflows reliable
([block#2213](block#2213))
([`166f27be4b`](block@166f27b))
- feat(cli): manage repository protection rules
([block#2193](block#2193))
([`f94324598d`](block@f943245))
- feat(cli): add agents archive/unarchive/archived subcommands
([block#2173](block#2173))
([`7d7992067b`](block@7d79920))
- fix(mobile): sanitize Android image uploads
([block#2188](block#2188))
([`ee21da90bd`](block@ee21da9))
- fix(cli): paginate channel directory queries
([block#2181](block#2181))
([`03fe19d603`](block@03fe19d))
- fix(mobile): image upload fails due to unstripped metadata
([block#2185](block#2185))
([`37f15b2001`](block@37f15b2))
- perf(relay): compact Git packs before manifest limits
([block#2172](block#2172))
([`80e0ab16b0`](block@80e0ab1))
- perf(relay): cache Git pack hydration
([block#2169](block#2169))
([`a4d82ec722`](block@a4d82ec))
- fix(relay): bound and observe Git read operations
([block#2167](block#2167))
([`5f7c93d9c1`](block@5f7c93d))
- relay: gate push enqueue on live leases; batch matcher pipeline
(T1b/T1a-repair/T2b) ([block#2145](block#2145))
([`e43b2d5aac`](block@e43b2d5))
- relay: add audit logging disable switch
([block#2134](block#2134))
([`bf5acabdde`](block@bf5acab))
- relay: skip TTL deadline bump for known-permanent channels (T1a
write-amp) ([block#2125](block#2125))
([`2e936d439c`](block@2e936d4))
- fix(git): carry NIP-OA delegation in auth event
([block#2120](block#2120))
([`c12257d57a`](block@c12257d))
- Route lag-tolerant reads to an optional Postgres read replica
([block#2084](block#2084))
([`29c48883d3`](block@29c4888))
- fix: recover community access visibility
([block#2074](block#2074))
([`ca384d082d`](block@ca384d0))
- feat: proxy feedback-scoped admin attachments
([block#2059](block#2059))
([`d7f918e3cb`](block@d7f918e))
- feat: add read-only deployment moderation dashboard
([block#1999](block#1999))
([`68e670e001`](block@68e670e))
- Bug-bash round 2: table scroll, Goose instructions, workflow mention
wake ([block#2034](block#2034))
([`64b8fea6dc`](block@64b8fea))
- Strip media metadata on clients and reject it at the relay
([block#2006](block#2006))
([`5cfd69cb0c`](block@5cfd69c))
- [codex] Hold Git concurrency permits through streaming (BUZZ-SEC-018)
([block#1916](block#1916))
([`7baea42abb`](block@7baea42))
- [codex] Enforce shared relay admission limits (BUZZ-SEC-019)
([block#1917](block#1917))
([`73fc0ec6cf`](block@73fc0ec))
- [codex] Block banned actors from moderation commands (BUZZ-SEC-007)
([block#1915](block#1915))
([`caa195ca58`](block@caa195c))
- [codex] Fix relay WebSocket admission limits
([block#1682](block#1682))
([`d3ce971fc7`](block@d3ce971))
- feat: add invite QR and mobile direct join
([block#1957](block#1957))
([`648cbf3610`](block@648cbf3))
- fix(join-policy): require legal consent on hosted invites
([block#1987](block#1987))
([`2e1577f76f`](block@2e1577f))
- [codex] Prevent actor-tag UI impersonation
([block#1931](block#1931))
([`c540ec9678`](block@c540ec9))
- Scope relay runtime state by community
([block#1658](block#1658))
([`d52dedb06f`](block@d52dedb))
- Apply optional relay join policy across join flows
([block#1894](block#1894))
([`6c2d667575`](block@6c2d667))
- feat(media): require auth for relay media reads
([block#1926](block#1926))
([`f308762852`](block@f308762))
- feat(relay): add community unarchive endpoint
([block#1908](block#1908))
([`6b9641db2b`](block@6b9641d))
- feat(relay): gate Git web GUI separately
([block#1901](block#1901))
([`34dc7dec75`](block@34dc7de))
- mesh: upgrade runtime, enforce membership, add shared compute provider
([block#1656](block#1656))
([`54638ff4bb`](block@54638ff))
- Route Git scratch through configured volume
([block#1884](block#1884))
([`2318b3096c`](block@2318b30))
- feat(relay): gate usage metrics behind stable leader
([block#1814](block#1814))
([`59e9821503`](block@59e9821))
- Relay mesh: cross-pod tunnel + huddle transport (buzz-relay-mesh)
([block#1670](block#1670))
([`ccb021d713`](block@ccb021d))
- feat(push): deliver accepted relay events as wakes
([block#1866](block#1866))
([`bffbc5f22c`](block@bffbc5f))
- fix(db): resolve duplicate migration version
([block#1863](block#1863))
([`08ad38a07f`](block@08ad38a))
- Add private product feedback sidecar
([block#1857](block#1857))
([`af190c93e1`](block@af190c9))
- feat(relay): add durable community archival
([block#1834](block#1834))
([`2b15a72675`](block@2b15a72))
- feat(push): add public APNs gateway
([block#1770](block#1770))
([`1c006822e4`](block@1c00682))
- feat(relay): add atomic community ownership transfer
([block#1845](block#1845))
([`52e42ccb9f`](block@52e42cc))
- Bound NIP-RS retention and search indexing
([block#1771](block#1771))
([`1b4703021d`](block@1b47030))
- Add optional standalone pairing relay to Helm chart
([block#1799](block#1799))
([`9b47c8548f`](block@9b47c85))
- fix(relay): publish membership snapshot on provisioning
([block#1761](block#1761))
([`0950d392b7`](block@0950d39))
- feat(relay): per-community usage metrics
([block#1723](block#1723))
([`620822899a`](block@6208228))
- refactor(desktop): remove vestigial MCP toolsets config
([block#1776](block#1776))
([`dfec75b3c0`](block@dfec75b))

**To release:** merge this PR. The tag and build will happen
automatically.

Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bradseiler bradseiler bradseiler approved these changes
@tlongwell-block tlongwell-block tlongwell-block approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Dependency Dashboard

3 participants

@jemiahw @bradseiler @tlongwell-block