Buzz Updates & Release Notes

Publish push gateway chart 0.4.0 through the repository's protected release lane. The chart implementation and version already landed in #8206; this PR adds release notes without changing runtime behavior.

Merging push-chart-release/0.4.0 invokes the release bot to create push-chart-v0.4.0 and publish the immutable chart to GHCR. Publication unblocks the wrapper chart and subsequent disabled-production preparation. This does not activate any gateway.

Validation

Release notes match the merged single-application configuration and migration guards. Diff checks pass. The source PR's required checks and PostgreSQL suite passed; chart validation will run again on this release PR.

Signed-off-by: Tom Brow [email protected]

Desktop and shared changes

• test(desktop): move CSP guards from Rust to the desktop JS suite (#8172) (5142cf6b2a0f44686eeda1ed07905ee3560fd78e)
• fix(desktop): repair the Windows notification shim's false denial on read (#5600) (99924a5a69200d34f5cc67e9b76748d7ece72705)
• feat: raise hosted community limit to fifty (#8186) (8f66f7051c68560feb27dbc74b069c851bc018bd)
• feat(desktop): browse and moderate every community in the Admin Console (#8027) (836e7d0d06789765b4d98a93c2b509a2a0fbd1bf)
• Use Silo for bundled object storage (#8023) (d742fc5f304a430e94e89b0d4a427d17adc1a47f)
• fix(desktop): address workflow deletions at the workflow's actual owner (#2669) (5ff83d82f852edb50a96cab4cb67a13baa8bf830)
• fix(desktop): show OpenAI-compatible endpoint settings in the baked-env UI (#8117) (403c19f6734259cc22ef8ac0c90162ffceeec796)
• feat(buzz-agent): send User-Agent on LLM requests (#8116) (1e2281fd45f0a18da95924fa445cd34080d349ea)

Other repository changes

• fix(mobile): normalize relay URL before disabling push (#8201) (394d4a434b70f6c14587174bc9942b3ba1d0eb59)
• feat(buzz-db): run push enqueue and channel TTL refresh in app code (#8135) (16eb0b6685a9ea5cd06275aed172903dac69f225)
• fix(mobile): keep thread content visible while positioning replies (#8134) (b6d97a69f0aeed53d58689c57a9939f8fab52093)
• fix(mobile): simplify notification settings (#8199) (e9269cbdf66b0e2fdb588aa20aad65bcba3ca622)
• fix(push): stop backfilling messages on lease activation (#8178) (4db7bb0e7f904b2f0ea232aacae6cd7f6b8a3b39)
• docs(nip-ap): add teams and kind:44300 instructions versions (#8191) (acf1ede20288f5c31e1aae351c1559764b614c1f)
• feat(db): advance an empty partition catch-all under bounded locks (#7993) (a8fe2b612c1c83de8f0983fa7a5cc1cb81ac7be8)
• fix(chart): own the Datadog version label on every workload Pod (#7876) (5a93e862ee28b8804f681ae15997a00bdc45d1bf)
• fix(mobile): polish channel management and iOS Settings (#8171) (7e8aac44034a19a8ea845dbc5484e53eed7d02ef)
• fix(mobile): preserve Markdown attachment destinations (#8168) (1ac0a1271bfabe5a5af5578e2860c15fc8b0991e)
• docs(nips): add NIP-FA federated identity adapter spec (#8148) (a918e605cae84789d7ec47df152219b4c341a1c7)
• feat(relay): record when a read-state account starts (#8157) (7afdc2aac930cd02001825d0b528f6f48595cd4a)
• ci: shorten the PR critical path (desktop lanes, smoke shards, parallel relay artifacts) (#8156) (d34c9c2c9b2e8e81675e8635c6b101481d561a97)
• Preview Tabler icons in the mobile app (#8109) (bbcbd7ce139ccd24b39eb13df85bd294346a609c)
• fix(deletion): give the scheduled drain the cold-start DB connector (#8146) (c6340a45a072c1793280cdcaec793d4a5dd82d97)
• refactor(schema): fan desired-state schema out to one file per table (#8131) (745501962e68041b3aee5c83fd3ea3bf5a496dbc)
• refactor(db): type-level admitted event-write transactions (AdmittedTx) (#8130) (f8bf2c529cdf2c193ad0be6cf333def124d182f2)
• fix(mobile): tolerate unrelated NIP-11 relay metadata (#8160) (70d2ca7760f5f6d5217e73d4921555bb3ce0c0e8)
• feat(admin): add community archive commands (#7107) (1972b7d256a5d0bb90eea6ef78e93d6b55bb1a12)
• feat(relay): add community reads to the admin API (#8011) (032198ce43680947c288bfd219d6a9b81d882348)
• fix(ios): use the shared glass capsule for thread titles (#8150) (f260ad7f957ab0d4e491cc75bffefce321ee9430)
• perf(relay): bound fleet usage metrics collection (#7176) (6d07a291376477942b70ba44489a47c9f6bfe006)
• fix(ios): let channel titles use available navigation space (#8137) (c96d707f6efd359e6cfdc34bd93c8b5fb36f1d5d)
• buzz-db: purge retention-free deletions in the app and index mentions in the event transaction (#8128) (da651ad6726154ff1fe314fc64462031970f1106)
• feat(relay): time post-metrics-bind startup steps (#8132) (e097c42996c9a634209fd46df86998ee4a71ea48)
• release: push gateway chart 0.3.5 (#8141) (bd1ff00e487d473bb60691f023a360d4d89e3079)
• feat(push): support Deployment metadata annotations (#8136) (9f5a25a41ed292576e27be59f902270e63636eaf)
• fix(buzz-pair): install rustls ring CryptoProvider before WSS (#7998) (b9e851d7be0af4f7f13294a8cb41de257f0dcf12)
• fix(buzz-acp): bound sibling-gate lookup failures instead of caching them (#7216) (003770cb7961adb8dd4905823dfe76dfcf5e07c7)
• feat(relay): private read-state accessory API (#7906) (1a2ddf9eaa87031a0d49ca1d882a46b5b89beb8d)
• fix(acp): keep agent-to-agent thread replies in the thread (#8124) (46dcc01873aae7ef926c2c9be7c5d360f296ac94)
• release: push gateway chart 0.3.4 (#8126) (c6dd587e2ae3ee7c0abb15a93437edf1ecb52860)
• feat(push): support platform-managed gateway runtime pods (#8113) (73a2a05c973bb97593f2d456c23a2ccdfe1a7bec)

Compare desktop-v0.5.27...desktop-v0.5.28

Summary

Every chart-managed Pod now carries a chart-owned tags.datadoghq.com/version label derived from the deployed image, instead of a value each wrapper restates once per workload.

Covered Pod templates:

• relay Deployment (templates/deployment.yaml)
• pairing relay (templates/pairing-relay.yaml)
• storage-accounting CronJob (templates/storage-accounting-cronjob.yaml)
• operator jobs, including the deletion drain (templates/_operator-jobs.tpl)

Source order: image.tag, then image.digest, then Chart.AppVersion (buzz.imageVersionSource). Tag-first is deliberate: The rendered value matches the sha-<commit> pins wrappers already carry, so upgrading to this chart does not roll any Pods.

An image promotion only has to write image.tag + image.digest. No per-workload label edit is needed.

Exact runtime identity stays exact in two places. The image reference is repository@digest when a digest is pinned. BUZZ_STORAGE_SNAPSHOT_CODE_SHA (persisted as code_sha) is still digest-first.

Label safety: buzz.imageVersionLabel maps any OCI tag or digest to a valid label value.

Valid values already in Datadog's normal form (lowercase, no __) pass through byte for byte, so sha-<hex> and 1.2.3-rc.4 are unchanged. Datadog lowercases tag values and collapses __, so any other value is hashed rather than allowed to report the same version as a different revision.

A digest keeps 63 hex characters. Anything else is replaced by the first 63 hex characters of its SHA-256.

Exactly 63 lowercase hex characters is reserved for the hashed and digest forms, so a rendered label cannot be fed back as a tag to make two revisions collide.

When both tag and digest are set, the label names the tag even if they disagree; the digest still pins what runs.

Precedence: a tags.datadoghq.com/version supplied through any workload's podLabels is ignored. Every other label, including tags.datadoghq.com/env and /service, passes through unchanged.

Overriding instead of failing means a wrapper with a stale pin is corrected by the upgrade itself. The chart bump and the wrapper cleanup don't have to land together.

What got simpler: one image identity instead of N. Wrappers delete their per-workload version pins. Image promotion tooling no longer needs a "mirror the tag into a label path" feature. One shared helper (buzz.podLabelsWithVersion) replaces four podLabels passthroughs.

Chart 0.1.10 → 0.1.11, with an artifacthub.io/changes entry.

Documented in the chart README ("Datadog version label") and docs/deployment-identity.md.

Note: a vendor-namespaced label now renders unconditionally in an OSS chart. This is in tension with VISION_SOVEREIGN.md. The label is inert without the operator-supplied tags.datadoghq.com/service/env, and the chart already ships vendor-specific defaults (e.g. sidecar.istio.io/inject).

Testing

Run on a Blox (Linux) workstation at tree 41634b7ca (helm v3.16.4, helm-unittest 0.8.2, the CI versions):

• helm lint deploy/charts/buzz: 0 failed
• helm unittest deploy/charts/buzz: 12 suites, 85/85 passed

New tests/version_label_test.yaml checks the relay, pairing relay, and deletion drain: tag wins over a stale podLabels pin, the label is stamped with no podLabels, and digest-only images get a label-safe value. tests/storage_accounting_test.yaml covers the same cases for the CronJob, plus the Chart.AppVersion fallback.

Mutation checks:

• Reverting any one template to the plain podLabels passthrough fails tests.
• Switching the source order to digest-first fails tests.
• Restoring the case-insensitive passthrough fails the three Datadog-normalization tests (uppercase, __, uppercased 63-hex).

No Rust, desktop, web, or mobile sources changed.

Linear tracking

Related work: BUZZ-215.

Signed-off-by: tornquist [email protected]
Signed-off-by: Elrond 28d6302a099e5225b02c4155ac4236e4912603df2ab08dbfc2f4fef08ce598c8@buzz.block.builderlab.xyz
Co-authored-by: Claude Opus 5 [email protected]
Co-authored-by: Elrond 28d6302a099e5225b02c4155ac4236e4912603df2ab08dbfc2f4fef08ce598c8@buzz.block.builderlab.xyz

Publish gateway chart 0.3.5 through the normal immutable release workflow. This release includes Deployment metadata annotations from #8136, while preserving chart-owned policy markers and existing default manifests. Only the chart version and release notes change. The gateway binary appVersion remains 0.1.0.

Validation

Full gateway chart render suite and release-contract validation passed. The feature's full repository validation and exact-head owner review passed before merge. Publication will be verified from the OCI registry before advancing the wrapper dependency.

buzz-review-completed: Agent validation passed; automated DCO finding was reconciled against the signed exact-head commit and green DCO check. Tom confirmed the human-testing rule is inapplicable to this chart-only release; personal testing is not claimed.

Signed-off-by: Tom Brow [email protected]

Publish push gateway chart 0.3.4 through the normal chart release
workflow. The chart version and implementation were merged in
#8113; this release PR
records the release notes and triggers the immutable chart tag and OCI
publisher.
Publication is authorized. The pending security review of #8113 is a
blocker for pinning the chart in the later infrastructure PR, not for
this publication. No gateways or relays are activated.

Validation

The merged implementation passed the complete chart render suite, chart
CI, and all 14 local wrapper tests. This release changes only the
changelog; chart contents are unchanged from the validated
implementation. Published OCI contents and digest will be verified after
publication.

Signed-off-by: Tom Brow [email protected]

Desktop and shared changes

feat(desktop): offer Claude effort levels in agent edit and create (#8059) (9c6fa14aa03358b4188f2ce0a92a9e435a3cb41b)
fix(desktop): use object-scale-down for inline markdown images (#4686) (fcf5f044b3af56f3855a417e61e4389fa925c1bd)
fix(desktop): detect Kimi Code in its default install path (#3700) (964b556a429c77c43df8429e97e3648f42d47d52)
feat(pairing): enter desktop codes on mobile (#8085) (5173fad6602ae82c06f338d19ef0f18eff57159b)
fix(desktop): show readable Claude Code model names and descriptions (#8053) (5a4b2d3dcc422954b4bd5829310a40f12b3cb03d)
feat(agents): request summarized Claude thinking and label empty rows (#8051) (cc528dbe0538cff0357b7644a9466ad689a1874f)
fix(mcp): support Goose discovery handshake (#8037) (4f51b9e1010e086a16c099cd8d8218ca974a5e18)
test(agent): synchronize handoff steering with tool approval (#8042) (2c270cf9d7849b6fc596a17608d78d91e2c10507)
fix(acp): wake agents for mentions added by edits (#6131) (47654215ebe44829941e6d7edc635ef401e8d8e8)
fix(relay): close community ban gaps across audio, agents and HTTP (#8005) (a38707d35c5d7028a83dcb4b85482a26f8b67605)
feat(acp): add BUZZ_GIT_IDENTITY switch for agent commit identity (#8024) (d1b7da45a232316118d33793c15cbc45e4a86976)
test(desktop): pin mention undo and status expiry smoke behavior (#7592) (04b040ef6ce1a748fb2418340735cfc04e0fd8f4)
feat(desktop): remove communities locally and stop their agent pairs (#7997) (83aab8cb5c4fb1f7b73d8782ae44edc8f6df4dce)
Allow following channel messages before their first reply (#7692) (036215636f530a93ef5e0cddf985e579ed52e393)
Fix rounded macOS icon on older Macs (#8018) (0ee2ad7fbf49dff593c34ab50dd32f891845611b)
fix(desktop): read channel metadata and member lists from writer after writes (#7999) (bd0896f5c0dfcc6d0c27b23ba644dff63e50617a)
feat(desktop): add Admin Console Actions tab for direct staff actions (#7904) (f001ebbb6ea5ad2cf262fcd0f05e1cd2ae83bb7f)
fix(agents): stop built-in prompts from teaching sleep polling (#7992) (965e1997b5de462a3b87a3c455d0db00261a06b3)
feat(relay): add direct staff ban/timeout/delete with staff guard (#7883) (020193f8e36bede04a57e0c06ba60e26ed67612b)
feat(acp): wrap workers at the subprocess launch boundary (#7985) (95b018c8713be9beebbd2517ace48529e3c0e6ed)
Add Kimi Code's default install path to managed-agent binary discovery (#5997) (2664d14316790a57ea44b3f97c57440b70e43436)
test(desktop): fix flaky forum empty-draft replacement e2e (#7981) (12dbb114aad72b89d17d6d1c668d8d4c3fdad2ae)

Other repository changes

docs(changelog): remove hand-written Unreleased section (#8123) (af5bb0af488784c3707e99c87e0675a729711a6e)
BUZZ-175: Route serving event writes through the tenant lock (#7828) (d0fd96fca6704548cebe2f69d8dff0e3c80e77e2)
feat(mobile): follow the portable mention rules, including DMs (#8102) (932228936464a0bdd44eae0f5e95ca5bbcd819b9)
feat(mobile): read web app catch-up marks for unread state (#8103) (166d383ca7aa9ffd5796ad7e4d3be1884d81da73)
docs(identity): tighten enterprise adapter contract (#8069) (1e67395fd19a8b4de0cecca97cd1b36842fe8b77)
chore(push): release gateway chart 0.3.3 (#8107) (c9143ed8f709a06db9f4e6994f3ffa39aa5f3950)
fix(acp): steer mid-turn DM follow-ups natively again (#8058) (0a070dfd3f3c233ea71bf390813abee4032068cb)
feat(push): support migration pod annotations (#8105) (fd885b553004520ce5ed5dffdb085957d01a80cd)
fix(db): enumerate only active communities for maintenance (#8061) (7f6ffd5ee5ae1b66d660245acf465b88e17639bc)
Polish iOS header glass and scroll-edge blur (#8097) (8746bfebfffd31e418b439d262cbb70de54aafa4)
fix(mobile): fill and stabilize content-aware loading placeholders (#8083) (46e60206a47ed1f696d625df57a1e5dd2d019a42)
fix(mobile): polish photo carousels and video viewer controls (#8079) (f0eb5575ffc9d5f57af4ed3f574529d997c83a0d)
fix(mobile): align Android conversation headers and reactions (#8082) (5f2d801b8f1d7be0c06839bded3f0391cbb46f92)
fix(mobile): unify sheet sections and bottom spacing (#8081) (75a4efd0cabed81c1583cb3868b232b4bde50c81)
feat(mobile): add iOS Liquid Glass tabs and quick actions (#8080) (03f24a69bf34adf25bc7f85aa00ab74c9e80c759)
feat(mobile): add animated community switcher (#8076) (d2da104d947e07dd0c203dabd92f245eeca6b672)
fix(mobile): manage channel members from profile sheets (#8078) (05d1714912589737636735baac8e5edce2c26ee1)
fix(mobile): refine iOS navigation and conversation details (#8075) (a14107ab2edee286d3a458a1a4c1ec26e7be8a17)
docs: restore enterprise identity adapter contract with relay assertion (#8064) (e982f70fba29cdaa9a8378f118a0e498537bd8db)
Use native iOS navigation bars with large titles and avatars (#8052) (6cf45820025721367c9f174aae164c8cf9a52a19)
feat(mobile): organize community and profile settings (#8056) (33f54de2dd27a8f6bce0d359183f5ebe5f2fa9ba)
refactor(relay): bind HTTP tenants through one shadow-aware helper (#8062) (8af2d91f37270365d5cd9170ac48349baa08475e)
feat(relay): add NIP-FI shadow mode for HTTP, WebSocket and admin (#8034) (df3f28a2c44f0bd258cff046717cde3fa026662e)
BUZZ-175: Add application-owned writer lock foundations (#7706) (fe9e2409a02fbac415d5c66181135be3eec28a86)
feat(mobile): native iOS message menus and reaction sheets (#8055) (ea143ea64beb79abacf423920cd70bbf23698b64)
fix(acp): steer running turns with edited mentions (#6132) (133fb9869228dab4c00cb2b9e259bf834a55dbf7)
test(relay): configure a community in the Git ban-lookup fixture (#8039) (448407a972ca9da0c1e13d49ee2c2170821be8a2)
fix(acp): wake quiet hosts for respawns and queued retries (#7459) (e4681e44a72fa3c4c873d0315024187351f4068d)
fix(relay): restore buzz-relay build after #8005 and #8028 (#8036) (639593bba97b4ed1386d5128bceecfab2072df31)
fix(mobile): preserve exact mention recipients in saved drafts (#7387) (2782b9cd5ea11d31954fae0e080d1446533f4e8f)
feat(nip-fi): bind assertions to the request Host's community (#8028) (2ebfde9147140a4036b11bfc2c6b0da68688a05c)
refactor(buzz-relay): share NIP-FI assertion evaluation across adapters (#7990) (9b083957f6802fd8e0efc7414269714619139cf2)
Include thread roots in agent activity events (#8029) (2e8b8d9a92b080024356004955625615c33ee543)
fix(relay): gate owner-only kinds in shared fan-out access filter (#8006) (24c1e702a68c7b1623f4a33dd2745a39b0597098)
fix(relay): deny channel writes when the channel lookup fails (#8007) (15772c54f36d1ed68c9c77ffb63235acb5ee8a64)
feat(nip-fi): admin disconnect/deny API with in-memory deny-until-TTL map (S4) (#7977) (16839a07738cf6189ee2f21c02d923b0f9dbe80d)
fix(mobile): hide notification settings without relay push capability (#8025) (fad4ff637a56a80e4871b5591a7aca58964ca903)
test(mobile): cover presence ordering against delayed live events (#7526) (2cca0ec15789370d494f06192f71400afdb60c98)
fix(acp): add edit field to native-steer fallback test event (#8022) (d56ed75424d803cf29b2f1f4f430ee81dc145f92)
fix(acp): interrupted frame writes close the sole writer; fixed native-steer refusal reasons (#7568) (514a9a86d3664fdd5d40457b7db09dccc5b27b3c)
feat(mobile): refresh onboarding and smooth QR scanner motion (#8019) (6b5bb6f5a3fbad1ca42d8f9b14a1418d333b6461)
fix(acp): preserve routing for edited messages (#4741) (5fdb2e53659ee29002545f1022c138fe0b8282f9)
fix(mobile): distinguish unknown presence on identity surfaces (#7383) (cf5e83829a9e9ace6332bf1d0793aa31030b7eeb)
fix(mobile): hydrate and refresh relay presence snapshots (#7382) (965fe1dffa12e2fa5419bf61cbcfed1b3691b0d1)
fix(deletion): require sole owner at admission (#7966) (53a12100b34577286c89102f1875ca2b6eea61e5)
fix(ci): gate security review on repo write access (#7986) (0ee609379004a894e99b449885c37a044f41919e)
feat(buzz-relay): idempotent owner community deletion with quota reservation (#7969) (d7a35afa9859a0c666de93ab1cd4f8a433a1cfe8)
feat(mobile): show contextual names in lists, Search and Pulse (#7896) (7a1910e700c08358292ec82fdc93464be8f00274)
Compare desktop-v0.5.26...desktop-v0.5.27

Prepares publication of the Buzz push gateway chart 0.3.3, including the optional migration Pod annotations already merged in #8105. This PR adds release notes only; chart templates, values, and schema are unchanged from the reviewed implementation.

Merging the push-chart-release/0.3.3 branch triggers the normal release workflow: create push-chart-v0.3.3, validate the chart, then publish oci://ghcr.io/block/buzz/charts/buzz-push-gateway:0.3.3. Keep this PR in draft until publication is explicitly authorized. It does not deploy a gateway.

Validation

Focused migration annotation renders, release contract checks, and local chart packaging pass. The merged implementation passed chart CI and Jude's automated review in #8105. The earlier repository-wide local just ci run failed in unchanged ACP tests; it was not rerun for release notes. The registry manifest digest can only be verified after publication.

Signed-off-by: Tom Brow [email protected]

Desktop and shared changes

• fix(desktop): correct Grok Build setup guide URL (#4846) (7ebf1beb44139264e9c5c7fee6970429ff66f934)
• feat(relay): implement NIP-AR channel artifacts (#7919) (12670bd0f037c66a682272bb81c46c3f254fad74)
• fix(desktop): resolve unlisted project channel requests (#7619) (c96553eb13a073ca9f4ee1547b50ba3d28dfd4db)
• Schedule the deletion drain safely (#7827) (6918dd3a83fd7aacf6d8e4634d3864eb10ead61d)
• test(desktop): wait for channel head refresh before paging thread summary test (#7955) (f1e50be4103addabd497563495e0ffe5bda07ef7)
• 🤖 perf: bound long-thread aux reads and make query deadlines terminal (#7854) (9b1c4f98e2981d6d89fbfa3154b8ef0b3b6ad334)
• Add native HPKE encryption for nsec backups (#7849) (cc36d25bec2d34340ab7aace50110f51162edd7a)
• test(desktop): scope video menu e2e probes to emitted messages (#7953) (548718e042decbc059fd7ebfb9b9ad2459ac258d)
• fix(sidebar): converge stale-at-open state across devices (sections/sort/stars/mutes) (#7805) (52c4c08c9ef349f2bb994ca40e98faa0f44209ea)
• feat(nip-fi): harden Blossom kind-24242 verifier to NIP-FI spec (#7288) (f7ff4294fa95191d1fc7b29a765e6f0b48db6bd8)
• fix(ci): select runtime suites from PR changes only (#7843) (02c6309f534050e54c8d36f5ce90e48e4dd152b1)
• test(desktop): synchronize upload edit smoke test (#7903) (a1fb6645d994e72b5f39fae8bd482d400e4005b6)
• feat(desktop): relay admin console for the /api/admin/v1 operator surface (#4768) (8f8c4dfadecb2298a9140af5d323487aaad844ab)

Other repository changes

• fix(db): audit partition catalog before creation (#6515) (14a752fb2445790bf4620348e485e8576371f906)
• feat(mobile): show contextual names in channel conversations (#7895) (4ef23609b7025bc356a9ea078834d57b69ec33cf)
• feat(buzz-relay): NIP-FI stateless enforcement (S3) — upgrade gate, NIP-42 pairing, session lifetime, JWKS warm (#7224) (8519db1532efd6cda8f72bb6454c00fc3f87cfba)
• feat(web): add Browse releases link next to invite download (#2255) (b9d22a273f2225917f13b13a9fde305629126502)
• docs(nips): fix stray angle brackets in created_at clauses (#4486) (12423f2868b810240a6b949d21c8a09e9e8a1994)
• docs: specify desktop-driven mobile push suppression (#7809) (45c288c1793bbbbbbb1be88f8a53c6aecfff8d2f)
• feat(mobile): add the contextual identity-name resolver (#7894) (efe04288ea907adfe91a38ae916c0d364c315cca)
• Automate owner deletion preparation (#7830) (bba75a71eb5a719b597479ec848053cde364befd)
• fix(mobile): stale community selection during mobile invite setup (#7951) (662014d544f835a075f0020e7d161fe7985d7959)
• Add owner deletion admission control plane (#7818) (15d44dcceee0679979991b3100f21f01fc799693)
• Make relay readiness process-local (#7341) (b37e477211313a94344a31aea4b180ed4effe0b8)
• 🤖 docs(nip-fi): remove implementation references from the spec (#7912) (447951a19c00edfa6432636f50782445929ab678)
• fix(relay): fail startup on invalid operator listener config (#7933) (ebe99a46e8802b9ff20fdf6a1028ce93bdefaa43)
• fix(db): limit event transactions to listener mention kinds (#7932) (1846094b3111a059f856bb4f3466c102fad17ef7)
• feat(relay): deliver pubkey mentions to relay companions (#7793) (c4c86006f2d67b2ea9055780129ee7ce95c54e0a)
• docs(protocol): propose simplified channel artifacts (#7791) (b0d6fb8ad27f6f255a5044e49ed0a59e11542914)
• feat(push): support configurable HTTP(S) delivery URLs (#7877) (781d39510cf23cfe224e8f521ae06a23377e06de)
• feat(relay): enforce NIP-FI assertion+NIP-98 pairing on HTTP ingress (#7264) (6410e685a80d42db0645fadc9bbe710559ef911e)
• fix(ci): run the admin disabled-mode DB test in the PostgreSQL lane (#7900) (b65cff31a4c5f4a0af63952b60a21fd73195321a)
• 🤖 docs: add pre-PR checklist and review guidance to AGENTS.md (#7897) (9c7687cc914cd8eddee7ba25cb980ad1a6bc0fdc)
• docs: specify durable data backfills (#7326) (9263cda8455b8fd27f4491e5e4fc0ebc2ce2e8bc)
• docs(vision): add /buzz/v1 read endpoints to the protocol contract (#7879) (930b8bb800d8149ce29a881ba4c5d9f424580434)
• 🤖 fix(justfile): point just staging at the current staging relay (#7881) (20131488528e35e6c50f4ccdb0490a9135c28edf)
• fix(relay-admin): make thread deletions atomic and fence expired action leases under row lock (#7853) (676e8c43825fa478850a3a320b1367d3288cce1a)
• fix(mobile): keep retired sections manager out of successor cache (#7873) (28a8b90805278a91d723731bf7b824cea473bcfa)
• Select one feature flag provider at compile time (#7677) (8f6b66f9ff6b2e42cd713506805763269375b473)

Compare desktop-v0.5.25...desktop-v0.5.26

Why

The deletion engine already exposes a one-shot buzz-admin deletions drain command, but operators have no safe way to schedule it. A generic workload wrapper could expose arbitrary commands or inherit relay credentials, which would add a second control plane and widen the blast radius.

What

This PR adds an opt-in Kubernetes CronJob for the typed deletion drain command. It is stacked on #7818, which adds owner-request admission.

How

The chart keeps the job disabled by default. The CronJob uses Forbid, zero Kubernetes retries, bounded runtime and history, and only the database, Redis, and object-store settings required by the executor. PostgreSQL leases, checkpoints, and retry timing remain the sole durable retry authority.

The closed _operator-jobs.tpl helper centralizes safe CronJob mechanics without creating an arbitrary command or environment registry. This leaves the touched system simpler than a general job framework would.

Risk

The deployment blast radius is low because the job is disabled by default. When enabled, it can run destructive deletion work that the database has already approved, so the chart limits concurrency, retries, credentials, and execution time.

Testing

Rendered every deploy/charts/buzz/ci/*.yaml fixture with helm template; all passed at e68cb753bb6673aa1baa60046969bdb2d4738b62.

Ran the full independent Desktop, Tauri, and web lanes; all passed at e68cb753bb6673aa1baa60046969bdb2d4738b62. Flutter package resolution made no progress within three minutes, so the mobile lane is not claimed green.

Bigger picture

A later stack layer must inventory and approve admitted owner requests. Until then, this scheduler cannot make a new owner request destructive.

Generated with Codex

Signed-off-by: tornquist [email protected]

Signed-off-by: Codex [email protected]

Signed-off-by: Elrond 28d6302a099e5225b02c4155ac4236e4912603df2ab08dbfc2f4fef08ce598c8@buzz.block.builderlab.xyz

Co-authored-by: Codex [email protected]

Co-authored-by: Claude Opus 5 [email protected]

Co-authored-by: Elrond 28d6302a099e5225b02c4155ac4236e4912603df2ab08dbfc2f4fef08ce598c8@buzz.block.builderlab.xyz