BrianInAz · BrianInAz · Aug 2, 2026 · Aug 2, 2026 · Aug 2, 2026 · Aug 2, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -1034,16 +1034,15 @@ jobs:
           touch "desktop/src-tauri/binaries/buzz-dev-mcp-$TARGET"
           touch "desktop/src-tauri/binaries/git-credential-nostr-$TARGET"
           touch "desktop/src-tauri/binaries/buzz-$TARGET"
-      # Mesh rev is derived from Cargo.lock so a dependency bump needs no
-      # lockstep edit here; the cache key tracks it automatically.
+      # Mesh rev is derived from the desktop lockfile so a dependency bump
+      # needs no lockstep edit here; the cache key tracks it automatically.
       - name: Resolve mesh-llm rev
         id: mesh_rev
         run: |
           set -euo pipefail
-          REV=$(python3 -c 'import tomllib; d=tomllib.load(open("Cargo.lock", "rb")); p=next(p for p in d["package"] if p["name"] == "mesh-llm-sdk"); print(p["source"].rsplit("#", 1)[1])')
-          [[ -n "$REV" ]] || { echo "::error::could not resolve mesh-llm rev from Cargo.lock"; exit 1; }
+          REV=$(python3 -c 'import tomllib; d=tomllib.load(open("desktop/src-tauri/Cargo.lock", "rb")); p=next(p for p in d["package"] if p["name"] == "mesh-llm-sdk"); print(p["source"].rsplit("#", 1)[1])')
+          [[ -n "$REV" ]] || { echo "::error::could not resolve mesh-llm rev from desktop/src-tauri/Cargo.lock"; exit 1; }
           echo "rev=$REV" >> "$GITHUB_OUTPUT"
-          echo "short=${REV:0:7}" >> "$GITHUB_OUTPUT"
       - name: Restore mesh llama build cache
         id: llama_cache
         uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
@@ -1052,15 +1051,18 @@ jobs:
           key: mesh-llama-${{ runner.os }}-metal-${{ steps.mesh_rev.outputs.rev }}
       - name: Build mesh llama native libraries
         if: steps.llama_cache.outputs.cache-hit != 'true'
-        env:
-          MESH_REV_SHORT: ${{ steps.mesh_rev.outputs.short }}
         run: |
           set -euo pipefail
-          cargo fetch --manifest-path desktop/src-tauri/Cargo.toml
-          SHORT="$MESH_REV_SHORT"
-          MESH_ROOT=$(find "${CARGO_HOME:-$HOME/.cargo}/git/checkouts" -path "*/$SHORT" -type d -name "$SHORT" | head -1)
-          if [[ -z "$MESH_ROOT" ]]; then
-            echo "::error::mesh-llm checkout for $SHORT not found after cargo fetch"
+          MESH_MANIFEST=$(
+            cargo metadata --locked --manifest-path desktop/src-tauri/Cargo.toml --features mesh-llm --format-version 1 |
+              python3 -c 'import json, sys; data = json.load(sys.stdin); print(next(package["manifest_path"] for package in data["packages"] if package["name"] == "mesh-llm-sdk"))'
+          )
+          MESH_ROOT=$(dirname "$MESH_MANIFEST")
+          while [[ "$MESH_ROOT" != "/" && ! -x "$MESH_ROOT/scripts/prepare-llama.sh" ]]; do
+            MESH_ROOT=$(dirname "$MESH_ROOT")
+          done
+          if [[ ! -x "$MESH_ROOT/scripts/prepare-llama.sh" || ! -x "$MESH_ROOT/scripts/build-llama.sh" ]]; then
+            echo "::error::mesh-llm native build scripts not found from cargo metadata"
             exit 1
           fi
           export LLAMA_STAGE_BACKEND=metal

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
@@ -81,6 +81,8 @@ env:
 jobs:
   build:
     name: Build (${{ matrix.platform }})
+    # Fork pull requests still compile, but only canonical upstream publishes.
+    if: github.event_name == 'pull_request' || github.repository == 'block/buzz'
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     permissions:
@@ -125,8 +127,8 @@ jobs:
               max-parallelism = 2
 
       - name: Log in to GHCR
-        # Skip on pull_request from forks — no GHCR creds, build-only.
-        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+        # Pull requests are build-only and never authenticate or write caches.
+        if: github.event_name != 'pull_request'
         uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee  # v4.2.0
         with:
           registry: ghcr.io
@@ -179,7 +181,7 @@ jobs:
           cache-from: |
             type=registry,ref=${{ env.IMAGE_NAME }}-buildcache:${{ matrix.arch }}
           cache-to: |
-            ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && format('type=registry,ref={0}-buildcache:{1},mode=max,compression=zstd', env.IMAGE_NAME, matrix.arch) || '' }}
+            ${{ github.event_name != 'pull_request' && format('type=registry,ref={0}-buildcache:{1},mode=max,compression=zstd', env.IMAGE_NAME, matrix.arch) || '' }}
 
       - name: Build and push debug image by digest
         id: build-debug
@@ -224,7 +226,7 @@ jobs:
 
   merge:
     name: Merge ${{ matrix.variant }} multi-arch manifest
-    if: github.event_name != 'pull_request'
+    if: github.event_name != 'pull_request' && github.repository == 'block/buzz'
     runs-on: ubuntu-24.04
     needs: build
     timeout-minutes: 15
@@ -342,6 +344,8 @@ jobs:
 
   push-gateway-build:
     name: Build public push gateway (${{ matrix.platform }})
+    # Fork pull requests still compile, but only canonical upstream publishes.
+    if: github.event_name == 'pull_request' || github.repository == 'block/buzz'
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     permissions:
@@ -377,7 +381,7 @@ jobs:
             [worker.oci]
               max-parallelism = 2
       - name: Log in to GHCR
-        if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+        if: github.event_name != 'pull_request'
         uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee  # v4.2.0
         with:
           registry: ghcr.io
@@ -402,7 +406,7 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           outputs: type=image,name=ghcr.io/block/buzz-push-gateway,push-by-digest=true,name-canonical=true,push=${{ github.event_name != 'pull_request' }}
           cache-from: type=registry,ref=ghcr.io/block/buzz-push-gateway-buildcache:${{ matrix.arch }}
-          cache-to: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && format('type=registry,ref=ghcr.io/block/buzz-push-gateway-buildcache:{0},mode=max,compression=zstd', matrix.arch) || '' }}
+          cache-to: ${{ github.event_name != 'pull_request' && format('type=registry,ref=ghcr.io/block/buzz-push-gateway-buildcache:{0},mode=max,compression=zstd', matrix.arch) || '' }}
       - name: Export digest
         if: github.event_name != 'pull_request'
         env:
@@ -419,7 +423,7 @@ jobs:
 
   push-gateway-merge:
     name: Publish public push gateway image
-    if: github.event_name != 'pull_request'
+    if: github.event_name != 'pull_request' && github.repository == 'block/buzz'
     runs-on: ubuntu-24.04
     needs: push-gateway-build
     timeout-minutes: 15

diff --git a/.github/workflows/private-ca-release.yml b/.github/workflows/private-ca-release.yml
@@ -19,7 +19,8 @@ concurrency:
 
 env:
   UPSTREAM_REPOSITORY: block/buzz
-  PATCH_COMMIT: 6d03a38da5e3402bf97df1b3c46152887eb3778e
+  PRIVATE_CA_PATCH_COMMIT: 6d03a38da5e3402bf97df1b3c46152887eb3778e
+  SECURITY_PATCH_COMMIT: 7dbfcd785be0a9c002863a793c4fbab89a6258c3
 
 jobs:
   monitor:
@@ -44,25 +45,26 @@ jobs:
           work="$(mktemp -d)"; trap 'rm -rf "${work}"' EXIT
           git clone --depth 1 --branch "${tag}" "https://github.com/${UPSTREAM_REPOSITORY}.git" "${work}/source"
           source_sha="$(git -C "${work}/source" rev-parse HEAD)"
-          git -C "${work}/source" fetch --depth 2 "https://github.com/${GITHUB_REPOSITORY}.git" "${PATCH_COMMIT}"
-          if git -C "${work}/source" cherry-pick --no-commit "${PATCH_COMMIT}"; then
+          if for patch_commit in "${PRIVATE_CA_PATCH_COMMIT}" "${SECURITY_PATCH_COMMIT}"; do
+            git -C "${work}/source" fetch --depth 2 "https://github.com/${GITHUB_REPOSITORY}.git" "${patch_commit}"
+            git -C "${work}/source" cherry-pick --no-commit "${patch_commit}"
+          done; then
             patch_status=clean
-            git -C "${work}/source" cherry-pick --abort || git -C "${work}/source" reset --hard
           else
             patch_status=conflict
-            git -C "${work}/source" cherry-pick --abort || git -C "${work}/source" reset --hard
           fi
+          git -C "${work}/source" reset --hard "${source_sha}"
           for label in buzz-update build-approved skip remediation-required built accepted; do
             gh label create "${label}" --force --color 0E8A16 --description "Buzz private-CA release lifecycle" >/dev/null
           done
           cat >"${work}/issue.md" <<EOF
-          <!-- buzz-private-ca-release tag=${tag} source_sha=${source_sha} patch_sha=${PATCH_COMMIT} patch_status=${patch_status} -->
+          <!-- buzz-private-ca-release tag=${tag} source_sha=${source_sha} private_ca_patch_sha=${PRIVATE_CA_PATCH_COMMIT} security_patch_sha=${SECURITY_PATCH_COMMIT} patch_status=${patch_status} -->
           ## Buzz ${tag} is available
 
           Upstream release: $(jq -r '.html_url' <<<"${release}")
           Published: $(jq -r '.published_at' <<<"${release}")
           Immutable source SHA: \`${source_sha}\`
-          Patch applicability: **${patch_status}**
+          Certified patch-series applicability: **${patch_status}**
 
           ### Changelog
 
@@ -97,25 +99,6 @@ jobs:
           gh issue comment "${{ github.event.issue.number }}" --repo "${GITHUB_REPOSITORY}" --body "Skipped by @BrianInAz; no private-CA package was built."
           gh issue close "${{ github.event.issue.number }}" --repo "${GITHUB_REPOSITORY}"
 
-  built:
-    if: >-
-      github.event_name == 'issues' && github.event.action == 'labeled' &&
-      github.event.label.name == 'built' && github.actor == 'BrianInAz'
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      issues: write
-    steps:
-      - name: Record the local package handoff
-        env:
-          GH_TOKEN: ${{ github.token }}
-          ISSUE_NUMBER: ${{ github.event.issue.number }}
-        run: |
-          set -euo pipefail
-          body="$(gh issue view "${ISSUE_NUMBER}" --repo "${GITHUB_REPOSITORY}" --json body --jq .body)"
-          grep -Eq '^<!-- buzz-private-ca-release tag=(desktop-)?v[0-9]+\.[0-9]+\.[0-9]+ source_sha=[0-9a-f]{40} patch_sha=[0-9a-f]{40} patch_status=clean -->$' <<<"${body}" || { echo "not a clean monitor-created ticket" >&2; exit 1; }
-          gh issue comment "${ISSUE_NUMBER}" --repo "${GITHUB_REPOSITORY}" --body "Built by @BrianInAz on the approved Apple Silicon Mac. Record the immutable artifact, checksum, private WSS gate, and local acceptance evidence before adding \`accepted\`."
-
   accepted:
     if: >-
       github.event_name == 'issues' && github.event.action == 'labeled' &&
@@ -132,7 +115,7 @@ jobs:
         run: |
           set -euo pipefail
           body="$(gh issue view "${ISSUE_NUMBER}" --repo "${GITHUB_REPOSITORY}" --json body --jq .body)"
-          grep -Eq '^<!-- buzz-private-ca-release tag=(desktop-)?v[0-9]+\.[0-9]+\.[0-9]+ source_sha=[0-9a-f]{40} patch_sha=[0-9a-f]{40} patch_status=clean -->$' <<<"${body}" || { echo "not a clean monitor-created ticket" >&2; exit 1; }
+          grep -Eq '^<!-- buzz-private-ca-release tag=(desktop-)?v[0-9]+\.[0-9]+\.[0-9]+ source_sha=[0-9a-f]{40} private_ca_patch_sha=[0-9a-f]{40} security_patch_sha=[0-9a-f]{40} patch_status=clean -->$' <<<"${body}" || { echo "not a clean monitor-created ticket" >&2; exit 1; }
           labels="$(gh issue view "${ISSUE_NUMBER}" --repo "${GITHUB_REPOSITORY}" --json labels --jq '.labels[].name')"
           grep -Fxq built <<<"${labels}" || { echo "accepted requires the built lifecycle state" >&2; exit 1; }
           gh issue comment "${ISSUE_NUMBER}" --repo "${GITHUB_REPOSITORY}" --body "Accepted by @BrianInAz after private WSS, state-preserving install, restart, reconnect, and history-restoration evidence was recorded."
@@ -159,12 +142,14 @@ jobs:
         run: |
           set -euo pipefail
           body="$(gh issue view "${ISSUE_NUMBER}" --repo "${GITHUB_REPOSITORY}" --json body --jq .body)"
-          marker="$(grep -E '^<!-- buzz-private-ca-release tag=(desktop-)?v[0-9]+\.[0-9]+\.[0-9]+ source_sha=[0-9a-f]{40} patch_sha=[0-9a-f]{40} patch_status=clean -->$' <<<"${body}")"
+          marker="$(grep -E '^<!-- buzz-private-ca-release tag=(desktop-)?v[0-9]+\.[0-9]+\.[0-9]+ source_sha=[0-9a-f]{40} private_ca_patch_sha=[0-9a-f]{40} security_patch_sha=[0-9a-f]{40} patch_status=clean -->$' <<<"${body}")"
           [[ -n "${marker}" ]] || { echo "not a clean monitor-created ticket" >&2; exit 1; }
           tag="$(sed -E 's/.*tag=([^ ]+).*/\1/' <<<"${marker}")"
           source_sha="$(sed -E 's/.*source_sha=([^ ]+).*/\1/' <<<"${marker}")"
-          patch_sha="$(sed -E 's/.*patch_sha=([^ ]+).*/\1/' <<<"${marker}")"
-          [[ "${patch_sha}" == "${PATCH_COMMIT}" ]] || { echo "wrong patch" >&2; exit 1; }
+          private_ca_patch_sha="$(sed -E 's/.*private_ca_patch_sha=([^ ]+).*/\1/' <<<"${marker}")"
+          security_patch_sha="$(sed -E 's/.*security_patch_sha=([^ ]+).*/\1/' <<<"${marker}")"
+          [[ "${private_ca_patch_sha}" == "${PRIVATE_CA_PATCH_COMMIT}" ]] || { echo "wrong private-CA patch" >&2; exit 1; }
+          [[ "${security_patch_sha}" == "${SECURITY_PATCH_COMMIT}" ]] || { echo "wrong security patch" >&2; exit 1; }
           remote_sha="$(git ls-remote "https://github.com/${UPSTREAM_REPOSITORY}.git" "refs/tags/${tag}^{}" | awk '{print $1}')"
           [[ -n "${remote_sha}" ]] || remote_sha="$(git ls-remote "https://github.com/${UPSTREAM_REPOSITORY}.git" "refs/tags/${tag}" | awk '{print $1}')"
           [[ "${remote_sha}" == "${source_sha}" ]] || { echo "tag SHA changed" >&2; exit 1; }
@@ -182,14 +167,26 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
-      - name: Fetch immutable source and apply patch
+      - name: Fetch immutable source and apply certified patch series
         run: |
           set -euo pipefail
           git clone --depth 1 --branch "${{ needs.approval.outputs.tag }}" "https://github.com/${UPSTREAM_REPOSITORY}.git" "$RUNNER_TEMP/source"
           [[ "$(git -C "$RUNNER_TEMP/source" rev-parse HEAD)" == "${{ needs.approval.outputs.source_sha }}" ]]
-          git -C "$RUNNER_TEMP/source" fetch --depth 2 "https://github.com/${GITHUB_REPOSITORY}.git" "${PATCH_COMMIT}"
-          git -C "$RUNNER_TEMP/source" cherry-pick --no-commit "${PATCH_COMMIT}"
+          for patch_commit in "${PRIVATE_CA_PATCH_COMMIT}" "${SECURITY_PATCH_COMMIT}"; do
+            git -C "$RUNNER_TEMP/source" fetch --depth 2 "https://github.com/${GITHUB_REPOSITORY}.git" "${patch_commit}"
+            git -C "$RUNNER_TEMP/source" cherry-pick --no-commit "${patch_commit}"
+          done
           git -C "$RUNNER_TEMP/source" diff --check
+      - name: Reject vulnerable root and Apple Silicon desktop graphs
+        working-directory: ${{ runner.temp }}/source
+        run: |
+          set -euo pipefail
+          cargo-deny --locked check --config deny.toml advisories
+          cargo-deny --locked \
+            --manifest-path desktop/src-tauri/Cargo.toml \
+            --target aarch64-apple-darwin \
+            --exclude-dev \
+            check --config deny.toml advisories
       - name: Run full upstream CI
         working-directory: ${{ runner.temp }}/source
         run: just ci
@@ -206,16 +203,61 @@ jobs:
         working-directory: ${{ runner.temp }}/source
         run: cargo test --manifest-path desktop/src-tauri/Cargo.toml native_websocket::tests::native_websocket_platform_tls_connector_is_available
 
-  local-macos-handoff:
+  package:
+    name: Build private-CA package on standard hosted Apple Silicon
     needs: [approval, validate]
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
+    runs-on: macos-15
+    timeout-minutes: 90
     permissions:
+      contents: read
       issues: write
     steps:
-      - name: Local macOS package handoff
+      - name: Require free standard public ARM64 runner
+        env:
+          REPOSITORY_IS_PRIVATE: ${{ github.event.repository.private }}
+        run: |
+          set -euo pipefail
+          [[ "${REPOSITORY_IS_PRIVATE}" == "false" ]] || {
+            echo "This package lane is approved only for free standard runners in a public repository." >&2
+            exit 1
+          }
+          [[ "$(uname -m)" == "arm64" ]] || {
+            echo "macos-15 must resolve to a standard Apple Silicon runner." >&2
+            exit 1
+          }
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
+      - uses: cashapp/activate-hermit@cea9af7913204a965fd488637a8d1811bba2e616 # v1
+      - name: Build and verify ad-hoc-signed package
+        env:
+          SOURCE_SHA: ${{ needs.approval.outputs.source_sha }}
+          TAG: ${{ needs.approval.outputs.tag }}
+        run: |
+          set -euo pipefail
+          output_directory="${RUNNER_TEMP}/private-ca/${TAG}"
+          scripts/build-private-ca-macos.sh "${TAG}" "${SOURCE_SHA}" "${output_directory}"
+          (
+            cd "${output_directory}"
+            shasum -a 256 -c SHA256SUMS
+          )
+      - name: Upload short-lived private-CA candidate
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: buzz-private-ca-${{ needs.approval.outputs.tag }}-${{ needs.approval.outputs.source_sha }}
+          path: ${{ runner.temp }}/private-ca/${{ needs.approval.outputs.tag }}/
+          if-no-files-found: error
+          compression-level: 0
+          retention-days: 7
+      - name: Record hosted package evidence
         env:
           GH_TOKEN: ${{ github.token }}
+          ARTIFACT_NAME: buzz-private-ca-${{ needs.approval.outputs.tag }}-${{ needs.approval.outputs.source_sha }}
+          ISSUE_NUMBER: ${{ needs.approval.outputs.issue_number }}
+          SOURCE_SHA: ${{ needs.approval.outputs.source_sha }}
+          TAG: ${{ needs.approval.outputs.tag }}
         run: |
           set -euo pipefail
-          gh issue comment "${{ needs.approval.outputs.issue_number }}" --repo "${GITHUB_REPOSITORY}" --body "Remote validation passed. Package on the approved local Mac with scripts/build-private-ca-macos.sh ${{ needs.approval.outputs.tag }} ${{ needs.approval.outputs.source_sha }}. GitHub-hosted macOS runners are intentionally not used."
+          run_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
+          gh issue comment "${ISSUE_NUMBER}" --repo "${GITHUB_REPOSITORY}" --body "GitHub-hosted macOS package built on the free standard macos-15 Apple Silicon runner. Source: \`${SOURCE_SHA}\`. Certified patches: \`${PRIVATE_CA_PATCH_COMMIT}\`, \`${SECURITY_PATCH_COMMIT}\`. Artifact: \`${ARTIFACT_NAME}\` (retained 7 days). Run: ${run_url}. The app is ad-hoc signed; no Apple signing identity or secret was used. Next: run the private WSS gate, then download and perform state-preserving installation and acceptance on Brian's MacBook before adding \`accepted\`."
+          gh issue edit "${ISSUE_NUMBER}" --repo "${GITHUB_REPOSITORY}" --add-label built
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/deny.toml b/deny.toml
@@ -1,4 +1,8 @@
 [advisories]
+# Vulnerabilities remain fatal. Limit no-fix unmaintained notices to direct
+# workspace dependencies so target-specific transitive notices stay visible
+# without masking actionable vulnerability results.
+unmaintained = "workspace"
 ignore = [
     # instant 0.1.13 — unmaintained crate. Transitive dep: nostr → instant.
     # Will be resolved when nostr crate updates its dependencies.