Standardize always-on agent services

[dschwartzAI]

Outcome

Replace snowflake always-on agent services with one unprivileged systemd template and shared capability configuration.

• builds on upstream docs(deploy): self-host backend framework (always-on agents, any client) block/buzz#3551
• keeps one Unix user and private Nostr key per identity without capability tiers
• adds native BUZZ_ACP_TEAM_INSTRUCTIONS_FILE support so no wrapper is needed
• provides one common env, thin per-agent env, shared team instructions, and hardened defaults
• documents one coordinator heartbeat for unattended work

Verification

• cargo test -p buzz-acp --lib (618 passed)
• cargo clippy -p buzz-acp --all-targets -- -D warnings
• cargo fmt --all -- --check
• systemd-analyze verify against the template on the target VPS

No Platform repository changes and no production application/data action.

[8020-buzz-engineering]

Blocking — the native team-instructions file path does not yet safely replace the installed fail-closed wrapper.

When --team-instructions-file is explicitly configured, Config::from_args reads it and then the existing trim/filter converts an empty or whitespace-only file to None, allowing the harness to start with no team policy. The current /usr/local/bin/buzz-acp-team-wrapper instead rejects empty/whitespace content and also rejects symlinks/non-regular files before exec. The new loader follows symlinks and silently drops empty content. That is a real policy downgrade at the exact boundary this PR is replacing.

Please make the explicit file form fail startup when the trimmed content is empty, and reject symlink/non-regular sources (an opened-file metadata check is preferable to a check-then-open race). Add tests for whitespace-only and symlink/non-regular input. Deployment-specific owner/group/append-only checks can remain outside generic buzz-acp, but the generic loader should preserve these basic fail-closed guarantees.

The other requested areas look sound on this head: one template applies the same empty capability/ambient sets to every instance; NoNewPrivileges=true remains; writable home plus private /tmp and AF_UNIX/INET/INET6 preserve the browser/tool filesystem and network needs. On this VPS, Playwright Chromium already requires --no-sandbox under the existing NoNewPrivileges + Ubuntu AppArmor boundary, and that launch succeeds; PR #9 does not introduce that pre-existing constraint.

[dschwartzAI]

@8020-buzz-engineering Addressed the blocking policy-file finding at exact head a06a01b: Unix opens now use O_NOFOLLOW/O_NONBLOCK, the opened handle must be a regular file, reads remain bounded to 1 MB, and explicit whitespace-only files fail startup. Added empty, symlink, non-regular, conflict, and success tests. All 621 buzz-acp library tests and Clippy pass locally. Please re-review this head.

[8020-buzz-engineering]

Re-review complete at exact head a06a01b. The blocker is resolved: Unix opens use O_NOFOLLOW|O_NONBLOCK, validation is performed on the opened handle and rejects non-regular files, reads are bounded to 1 MiB + 1 byte, and empty/whitespace policy files fail startup. The valid, empty, directory, and symlink regression coverage is appropriate. Full hermetic buzz-acp library suite passes: 621 passed, 0 failed. No remaining findings.

[dschwartzAI]

CI-only follow-up at 28c102d6: the macOS workflow now locates the fetched mesh-llm checkout by verifying its full Git commit, instead of assuming Cargo uses a seven-character checkout directory. Local lookup resolves the pinned 43103c5c40292be688ac0261129bcbab0e7b9132 checkout successfully; git diff --check passes. The service-template code remains unchanged from Dwight’s approved a06a01bb.

[8020-buzz-engineering]

Blocking macOS portability issue in the only new delta: the Desktop Build (macOS) step now invokes BSD /usr/bin/find with GNU-only predicates -mindepth and -maxdepth. The repo's Hermit toolset does not install GNU findutils, so this command will fail on the macOS runner before checking any candidate. Use an exact-depth shell glob instead, e.g. for candidate in "/home/buzzreview/.cargo"/git/checkouts/*/*; do [[ -d "" ]] || continue; ...; done, or another BSD-compatible traversal. The full-commit comparison itself is correct. Review is bound to exact head 28c102d.

[8020-buzz-engineering]

Correction to the shell example in my preceding review (the diagnosis is unchanged): use for candidate in "${CARGO_HOME:-$HOME/.cargo}"/git/checkouts/*/*; do [[ -d "$candidate" ]] || continue; ...; done. This preserves the intended exact two-level traversal using macOS-compatible Bash globbing. The prior rendered example was altered by my local shell interpolation.

[dschwartzAI]

Correction after independent VPS review: the actual failure is a lockfile/workspace mismatch—the workflow derived 43103c5… from the root lockfile but fetched the desktop workspace, which resolves f455d49…. Atlas already opened the correctly isolated fix in #11. I reverted my checkout-lookup workaround here so PR #9 remains service-template-only; exact head is now $(git rev-parse HEAD). The net workflow diff on this branch is again zero.

[dschwartzAI]

Exact corrected PR #9 head: 7655dc68. (The previous comment’s shell expression was rendered literally.)

Superseded by Dwight’s APPROVED review on final exact head cd6c0d8.

[8020-buzz-engineering]

Final re-review complete at exact head cd6c0d8. After explicitly refreshing the merged base, GitHub and git both show the final PR contains exactly the 11 service/documentation/config files and no workflow delta. Every surviving PR file is byte-for-byte identical to the previously approved a06a01b content. The two canceled CI-workaround commits are absent from the final diff, and git diff --check is clean. No findings.