Skip to content

fix(audit): hash created_at at the precision Postgres stores - #2638

Merged
wpfleger96 merged 2 commits into
block:mainfrom
shani-singh1:fix/audit-chain-timestamp-precision
Jul 24, 2026
Merged

fix(audit): hash created_at at the precision Postgres stores#2638
wpfleger96 merged 2 commits into
block:mainfrom
shani-singh1:fix/audit-chain-timestamp-precision

Conversation

@shani-singh1

@shani-singh1 shani-singh1 commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

Fixes #2637 — full analysis and reproduction there.

Problem

Audit entries are stamped and hashed with Utc::now() (nanoseconds), then stored in a TIMESTAMPTZ column (microseconds). compute_hash covers created_at.to_rfc3339(), and chrono emits 0/3/6/9 fractional digits depending on the value — so the digest written at service.rs:103 is computed over …T12:00:00.123456789+00:00 while verify_chain recomputes over the …T12:00:00.123456+00:00 that Postgres hands back.

Every hash chain backed by a real database therefore fails verification at its first entry, on untampered data. That is not just a broken feature — it means a genuinely forged row is indistinguishable from the permanent baseline failure, so HashMismatch carries no signal.

It is invisible in CI because all six chain tests are #[ignore = "requires Postgres"], and the in-process hash.rs tests use a fixture timestamp of 2026-01-01T00:00:00Z — zero sub-seconds, the one value where the bug cannot appear.

Solution

Reduce created_at to the stored precision before hashing, so the in-memory entry and the row are byte-identical:

pub fn to_storage_precision(created_at: DateTime<Utc>) -> DateTime<Utc> {
    created_at.trunc_subsecs(6)
}

log_inner is the only place that assigns created_at — every caller goes through NewAuditEntry, which carries no timestamp — so this is a single choke point. It is wrapped in a log_timestamp() helper purely so the invariant is assertable without a database.

I chose truncation at the write path over the alternative (hashing a precision-independent encoding such as timestamp_micros().to_be_bytes()). Both fix the mismatch, but truncating keeps the existing hash preimage format and gives the stronger invariant: the AuditEntry returned from log() is now exactly what a later read returns.

Truncation matches what actually happens on the wire — sqlx encodes DateTime<Utc> as microseconds since the Postgres epoch, truncating — so the value hashed is the value stored.

Validation

Toolchain note: built on Windows with the x86_64-pc-windows-gnu toolchain (no MSVC linker locally).

Before, against Postgres 17 with migrations/* applied:

$ cargo test -p buzz-audit --lib -- --ignored --test-threads=1

test service::tests::chain_links_within_one_community ... FAILED
test service::tests::chains_are_independent_per_community ... FAILED
test service::tests::community_chain_starts_at_seq_1_with_null_prev ... ok
test service::tests::cross_community_row_does_not_verify ... ok
test service::tests::verify_detects_tampering_within_a_community ... FAILED
test service::tests::verify_empty_range_is_false ... ok

test result: FAILED. 3 passed; 3 failed

with HashMismatch { seq: 2 } / HashMismatch { seq: 1 } on untampered chains.

After, same database:

test result: ok. 6 passed; 0 failed

verify_detects_tampering_within_a_community is the one to look at: it asserts HashMismatch lands on the tampered entry's seq. It was failing because verification already blew up on an earlier untampered row — so the assertion proving tamper detection works had never actually been exercised. It passes now.

Also:

  • cargo test -p buzz-audit --lib (no Postgres) — 12 passed, 0 failed.
  • cargo clippy -p buzz-audit --all-targets -- -D warnings — clean.
  • cargo fmt -p buzz-audit -- --check — clean.

New tests

Three in hash.rs, none needing Postgres:

  • storage_precision_drops_sub_microsecond_digits — the helper's contract, and that it is idempotent so a re-read value is unchanged.
  • nanosecond_timestamps_cannot_survive_a_database_round_trip — asserts the digests differ. This is the trap itself, written down so the next person changing the hash preimage sees why the precision reduction is load-bearing.
  • storage_precision_timestamps_survive_a_database_round_trip — the invariant the write path must hold.

Plus log_timestamp_carries_no_sub_microsecond_digits in service.rs, deliberately not #[ignore]d, so a regression on the write path is caught by just test-unit instead of only by Postgres-gated tests that normally never run.

Compatibility

Rows written before this stay unverifiable — they always were — so there is no migration. An operator relying on an existing chain has to re-anchor.

Relationship to #2620

#2620 proposes a shared verify_entries walk (anchoring, seq contiguity, tail-truncation detection) plus a buzz-admin audit verify command. Its Postgres-free unit tests build entries in memory and would pass regardless, but its #[ignore] Postgres tests and the operator command itself would fail on every real chain until this lands. Worth taking this first so that work has a verifiable baseline — the two changes don't overlap in code.

@shani-singh1
shani-singh1 requested a review from a team as a code owner July 23, 2026 22:22
@shani-singh1
fix(audit): hash created_at at the precision Postgres stores
ebfcb93 
`log_inner` stamped entries with `Utc::now()` (nanoseconds) and hashed the
value via `to_rfc3339()`, whose sub-second digit count follows the value.
`audit_log.created_at` is `TIMESTAMPTZ` — microsecond resolution — so
`verify_chain` recomputed the digest over a different byte string than the
one that was written and returned `HashMismatch` on untampered data.

Every chain backed by a real database failed verification at its first
entry, which also made a genuinely forged row indistinguishable from the
baseline failure.

Reduce `created_at` to the stored precision before hashing, so the in-memory
entry and the row are byte-identical. `log_inner` is the only place that
assigns it — every caller goes through `NewAuditEntry`, which carries no
timestamp — so this is a single choke point.

Tests: three Postgres-free tests in `hash.rs` pinning the invariant, the trap
that caused it, and the round trip; plus a non-ignored `service.rs` test that
the write path's timestamp carries no sub-microsecond digits, so a regression
is caught by `just test-unit` rather than only by the `#[ignore]` chain tests.

Rows written before this stay unverifiable — they always were — so no
migration is needed, but an operator relying on an existing chain has to
re-anchor.

Fixes block#2637

Signed-off-by: Shani Singh <teamdeveloperworld@gmail.com>
@shani-singh1
shani-singh1 force-pushed the fix/audit-chain-timestamp-precision branch from 09d3868 to ebfcb93 Compare July 23, 2026 22:28
@dophsquare

dophsquare commented Jul 24, 2026

Copy link
Copy Markdown

P0 triage — merge candidate. 🐝

Reviewed the diff. The root cause is real and the fix is correct: Utc::now() yields nanosecond resolution on Linux (clock_gettime), compute_hash covers created_at.to_rfc3339() whose sub-second digit count is value-dependent (chrono emits 0/3/6/9 digits), and Postgres TIMESTAMPTZ stores microseconds. So the write-time preimage ≠ the read-time preimage and verify_chain fails at entry #1 on untampered data — tamper-evidence is effectively off in any real deployment.

to_storage_precision → trunc_subsecs(6) before hash+store is the right normalization, and it's idempotent so a re-read row is stable. Test coverage is exactly what I'd want: the negative case (nanosecond_timestamps_cannot_survive_a_database_round_trip) proves the trap, and the positive case proves the invariant holds after truncation.

One thing worth confirming before merge: that every write path routes created_at through to_storage_precision (not just the one at service.rs:103) — a single unnormalized call site reintroduces the break. If there's a linked-in enforcement point (e.g. hashing only accepts already-truncated timestamps) that'd be even more robust. LGTM otherwise.

@shani-singh1
fix(audit): normalize created_at inside compute_hash
08bcce9 
Truncating at the write path fixes the live break, but leaves the invariant
as a convention: a future write path that stamps `created_at` without
`to_storage_precision` reintroduces the write/read preimage split.

Normalize at the single point that consumes the value instead, so the
enforcement is structural. Truncation is idempotent and the write path
already truncates, so no digest changes — verified by writing a chain with
the previous commit and validating those same rows under this one.

The `assert_ne!` test that pinned the trap moved down a level: it now asserts
on the RFC-3339 preimage (`.123456789` vs `.123456`), which is the property
that actually causes the split, and a new test asserts `compute_hash` yields
the same digest either way.

Signed-off-by: Shani Singh <teamdeveloperworld@gmail.com>
@shani-singh1

shani-singh1 commented Jul 24, 2026

Copy link
Copy Markdown
Contributor Author

Both points addressed — the second one by taking your suggestion.

Every write path. Confirmed: there is exactly one. log_inner (service.rs:112) is the only place in the workspace that assigns AuditEntry.created_at. Every producer goes through NewAuditEntry, which deliberately carries no timestamp — the two external call sites (buzz-relay/src/api/media.rs:426, buzz-relay/src/handlers/event.rs:558) construct that struct, and its doc comment already states seq/prev_hash/hash/created_at are assigned by AuditService::log.

The enforcement point. You were right that convention isn't enough, so I did it: 08bcce9 moves the normalization into compute_hash itself, which is the single point that consumes the value.

hasher.update(
    to_storage_precision(entry.created_at)
        .to_rfc3339()
        .as_bytes(),
);

A future write path that forgets to truncate now can't split the preimage — write-time hashes trunc(ts), read-time hashes trunc(trunc(ts)), and truncation is idempotent. The write-path truncation stays, because it carries a second invariant worth keeping: the AuditEntry returned from log() is byte-identical to the row a later read returns.

Digest stability, verified rather than argued. Since the write path already truncates, normalizing again should be a no-op on real chains — but "should be" isn't good enough for a hash function, so I checked it against Postgres: wrote a 3-entry chain with the previous commit, then verified those same rows with this one via a throwaway integration test.

verifying 3 pre-existing rows (seq 1..=3)
test preexisting_chain_still_verifies ... ok

So this commit is digest-compatible with the one before it — no re-anchoring needed on top of what the first commit already required.

Test restructure. nanosecond_timestamps_cannot_survive_a_database_round_trip had to go, since its assert_ne! is now false by construction. It's replaced by two tests that split the concern properly:

  • rfc3339_sub_second_width_follows_the_value — pins the trap one level down, on the preimage itself (…20.123456789+00:00 vs …20.123456+00:00). That's the property that actually causes the split, and it stays true regardless of what compute_hash does with it.
  • compute_hash_normalizes_sub_microsecond_timestamps — pins the new guarantee: handed an untruncated created_at, compute_hash still produces the storage-precision digest.

Re-ran everything after the change: 13 unit tests pass without Postgres, 6/6 chain tests pass against Postgres 17, clippy -D warnings and fmt --check clean.

@SeanGearin SeanGearin mentioned this pull request Jul 24, 2026
Open
wpfleger96
wpfleger96 approved these changes Jul 24, 2026
View reviewed changes

@wpfleger96 wpfleger96 left a comment •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 Walked through this one carefully and I'm happy with it. Verified the root cause at source: service.rs stamps Utc::now() at nanosecond precision while hash.rs digests created_at.to_rfc3339(), so the write-time preimage carries 9 fractional digits vs 6 after the Postgres µs round-trip — the write/verify split is real.

What I particularly like about this fix:

  • It truncates at the write path and normalizes inside compute_hash, so a future caller that forgets to truncate can't reintroduce the divergence. And since trunc_subsecs(6) is idempotent, digests for existing rows are unchanged — I walked the legacy-row verification path and behavior is identical.
  • The Postgres-free unit test (log_timestamp_carries_no_sub_microsecond_digits) directly guards the write path, so the fix itself is pinned by a test, not just the bug.

CI is fully green. Thanks for the thorough validation against real Postgres — approving.

@wpfleger96 wpfleger96 mentioned this pull request Jul 24, 2026
Closed
3 tasks
@wpfleger96
wpfleger96 merged commit 264a56a into block:main Jul 24, 2026
32 checks passed
@wpfleger96 wpfleger96 mentioned this pull request Jul 25, 2026
Merged
This was referenced Aug 2, 2026
Open
Open
Open
Open
Open
wpfleger96 added a commit that referenced this pull request Aug 8, 2026
@wpfleger96
chore(release): release Buzz Relay version 0.2.1 (#2856)
6e5c462 
## Buzz Relay release v0.2.1

### Changes since relay-v0.2.0:

- fix(sdk): preserve self-mention p tags in message and forum event
builders ([#4975](#4975))
([`78c87ae20e`](78c87ae))
- feat(desktop): adding rich link previews to messages
([#3818](#3818))
([`1922d49cb2`](1922d49))
- feat(relay): accept kind:30179 private managed-agent events at ingest
([#5133](#5133))
([`ad923353a2`](ad92335))
- fix(media): require authenticated reads
([#4610](#4610))
([`769ac70b74`](769ac70))
- feat(identity): recover desktop identity from a signed-in phone
([#4845](#4845))
([`6eb65919f1`](6eb6591))
- ci: prove the relay-driven mesh lifecycle — discover, join, infer,
deny — with real nodes
([#3862](#3862))
([`38bf642fcf`](38bf642))
- relay: fuzz WebSocket 1012 restart-close timing on graceful drain
(BUZZ_DRAIN_JITTER_MS)
([#4542](#4542))
([`e14fff74d0`](e14fff7))
- fix(reactions): support max-length custom emoji
([#3833](#3833))
([`2ea9385015`](2ea9385))
- fix(channels): restrict private-channel invitations
([#4612](#4612))
([`efe1893dd3`](efe1893))
- fix(workflow): bind trigger author to the signed event
([#4607](#4607))
([`885bed35ee`](885bed3))
- fix(git): revoke access for banned relay members
([#4608](#4608))
([`997b8caaa4`](997b8ca))
- Define private managed agent wire protocol
([#4593](#4593))
([`067c085f37`](067c085))
- perf(relay): index channel-id lookups and skip trace-only reads
([#4647](#4647))
([`bc9e6528a7`](bc9e652))
- Polish mobile inbox and media flows
([#4512](#4512))
([`feccf4eabc`](feccf4e))
- fix(git): allow deleting the default branch
([#4297](#4297))
([`fc598f5f8d`](fc598f5))
- feat(projects): add buzz projects CLI commands (NIP-MP kind:30621)
([#4020](#4020))
([`b7bb15122e`](b7bb151))
- perf(relay): serve relay-membership checks from the read replica
([#4124](#4124))
([`ac4fa13b8e`](ac4fa13))
- fix(relay): allow open relays to set their NIP-11 workspace icon
(kind:9033) ([#3998](#3998))
([`5765fc74b7`](5765fc7))
- feat(relay): accept kind:30621 multi-repo projects at ingest
([#3171](#3171))
([`cb9701cd30`](cb9701c))
- feat(relay): raise hosted community limit to five
([#3829](#3829))
([`10d5a26414`](10d5a26))
- fix(relay): align NIP-11 max_limit with REQ ceiling
([#3635](#3635))
([`23f0c26b1c`](23f0c26))
- feat(relay): gate kind 30178 team-catalog reads behind the shared tag
([#3358](#3358))
([`114d40d9d3`](114d40d))
- fix(db): isolate usage metrics advisory-lock test on scratch DB
([#3670](#3670))
([`dba97eecd9`](dba97ee))
- perf(presence): reduce heartbeat frequency
([#3783](#3783))
([`bf139e8d0b`](bf139e8))
- feat(mesh): upgrade embedded mesh to v0.74 and harden shared compute
(split 1/2 of #3467) ([#3741](#3741))
([`4933672eb4`](4933672))
- feat(replica): portable heartbeat-token fence with snapshot-local
reader routing ([#3268](#3268))
([`63496cc1d4`](63496cc))
- fix(git): channel binding tooling + author remediation for unbound
repos ([#3626](#3626))
([`788b3c002b`](788b3c0))
- feat: configure S3 URL addressing style
([#3400](#3400))
([`7012d86d52`](7012d86))
- feat(tracing): correlate trace IDs in relay logs
([#3608](#3608))
([`005b5b819a`](005b5b8))
- fix(relay): avoid subscription lock inversion
([#3413](#3413))
([`22be8bb351`](22be8bb))
- feat(cli): add users set-status command for NIP-38 profile status
([#3253](#3253))
([`60158fce3e`](60158fc))
- feat(relay): make Postgres pool size configurable, default 50
([#3191](#3191))
([`2ce2d71cc3`](2ce2d71))
- feat(tracing): add datastore tracing plumbing
([#2760](#2760))
([`e94b9aeda0`](e94b9ae))
- feat(invites): add use-limited invite links
([#3141](#3141))
([`d500c2d5cf`](d500c2d))
- feat(admin): show reported message content in report detail
([#3149](#3149))
([`f069a85503`](f069a85))
- resolve findings ([#3150](#3150))
([`9b0f744804`](9b0f744))
- Revert "fix(cli,relay): resolve agents by verified owner"
([#3168](#3168))
([`a041e2d21e`](a041e2d))
- fix(cli,relay): resolve agents by verified owner
([#2615](#2615))
([`c3084b36d9`](c3084b3))
- fix(security): enforce durable community ban on NIP-43 relay-admin
kinds 9030-9033 ([#3128](#3128))
([`e2e0079101`](e2e0079))
- fix(security): authorize kind:9000 role changes in both directions
([#3017](#3017))
([`00ecf2cac7`](00ecf2c))
- feat(desktop): handle project work from Inbox
([#3117](#3117))
([`c5c4f390b6`](c5c4f39))
- feat(relay): make per-owner community limit configurable via
BUZZ_MAX_COMMUNITIES_PER_OWNER
([#2599](#2599))
([`2a051a404d`](2a051a4))
- feat(relay): add author-only-unless-shared read gate for kind 30175
([#2768](#2768))
([`ab3af82871`](ab3af82))
- fix(core): block IPv6 transition SSRF targets
([#2801](#2801))
([`c26bf5945d`](c26bf59))
- fix(workflow): bypass system proxies for webhooks
([#2800](#2800))
([`60a171b19e`](60a171b))
- fix(audit): hash created_at at the precision Postgres stores
([#2638](#2638))
([`264a56a226`](264a56a))
- feat(desktop): make pull request reviews actionable
([#2510](#2510))
([`9081ab0ec9`](9081ab0))
- fix(relay): decompress gzip-encoded git smart-HTTP request bodies
([#2670](#2670))
([`5ca36e7b91`](5ca36e7))
- fix(sharing): preserve agent/team snapshot tEXt chunks through media
sanitization ([#2438](#2438))
([`b096b0a15a`](b096b0a))
- fix(relay): send 1012 restart close to all clients on graceful drain
([#2575](#2575))
([`1911c69aa2`](1911c69))
- fix(media): sanitize animated image uploads
([#2524](#2524))
([`8f8f5fa5a4`](8f8f5fa))
- fix(channels): strip leading hash prefixes from names
([#2250](#2250))
([`d0ab3fdb05`](d0ab3fd))
- feat(relay): make Redis pool size configurable, default 16
([#2521](#2521))
([`bcc3e13069`](bcc3e13))
- feat(desktop+acp): spawn a harness per (agent, community) pair at GUI
startup — warm sockets, lazy LLM pool
([#2122](#2122))
([`61cc738ee8`](61cc738))
- feat(media): add S3-truth per-community storage sweep
([#2044](#2044))
([`bd37a4d584`](bd37a4d))
- feat(relay): log NIP-98 pubkey attribution on HTTP bridge requests
([#2206](#2206))
([`7e34bee62c`](7e34bee))
- Revert "feat(relay): inventory unreachable Git objects"
([#2275](#2275))
([`0fb820f9bf`](0fb820f))
- feat(relay): inventory unreachable Git objects
([#2264](#2264))
([`3afc9dae15`](3afc9da))
- relay: add author_type label to buzz_events_stored_total
([#2243](#2243))
([`b9f54c43fe`](b9f54c4))
- fix(git): make project branch workflows reliable
([#2213](#2213))
([`166f27be4b`](166f27b))
- feat(cli): manage repository protection rules
([#2193](#2193))
([`f94324598d`](f943245))
- feat(cli): add agents archive/unarchive/archived subcommands
([#2173](#2173))
([`7d7992067b`](7d79920))
- fix(mobile): sanitize Android image uploads
([#2188](#2188))
([`ee21da90bd`](ee21da9))
- fix(cli): paginate channel directory queries
([#2181](#2181))
([`03fe19d603`](03fe19d))
- fix(mobile): image upload fails due to unstripped metadata
([#2185](#2185))
([`37f15b2001`](37f15b2))
- perf(relay): compact Git packs before manifest limits
([#2172](#2172))
([`80e0ab16b0`](80e0ab1))
- perf(relay): cache Git pack hydration
([#2169](#2169))
([`a4d82ec722`](a4d82ec))
- fix(relay): bound and observe Git read operations
([#2167](#2167))
([`5f7c93d9c1`](5f7c93d))
- relay: gate push enqueue on live leases; batch matcher pipeline
(T1b/T1a-repair/T2b) ([#2145](#2145))
([`e43b2d5aac`](e43b2d5))
- relay: add audit logging disable switch
([#2134](#2134))
([`bf5acabdde`](bf5acab))
- relay: skip TTL deadline bump for known-permanent channels (T1a
write-amp) ([#2125](#2125))
([`2e936d439c`](2e936d4))
- fix(git): carry NIP-OA delegation in auth event
([#2120](#2120))
([`c12257d57a`](c12257d))
- Route lag-tolerant reads to an optional Postgres read replica
([#2084](#2084))
([`29c48883d3`](29c4888))
- fix: recover community access visibility
([#2074](#2074))
([`ca384d082d`](ca384d0))
- feat: proxy feedback-scoped admin attachments
([#2059](#2059))
([`d7f918e3cb`](d7f918e))
- feat: add read-only deployment moderation dashboard
([#1999](#1999))
([`68e670e001`](68e670e))
- Bug-bash round 2: table scroll, Goose instructions, workflow mention
wake ([#2034](#2034))
([`64b8fea6dc`](64b8fea))
- Strip media metadata on clients and reject it at the relay
([#2006](#2006))
([`5cfd69cb0c`](5cfd69c))
- [codex] Hold Git concurrency permits through streaming (BUZZ-SEC-018)
([#1916](#1916))
([`7baea42abb`](7baea42))
- [codex] Enforce shared relay admission limits (BUZZ-SEC-019)
([#1917](#1917))
([`73fc0ec6cf`](73fc0ec))
- [codex] Block banned actors from moderation commands (BUZZ-SEC-007)
([#1915](#1915))
([`caa195ca58`](caa195c))
- [codex] Fix relay WebSocket admission limits
([#1682](#1682))
([`d3ce971fc7`](d3ce971))
- feat: add invite QR and mobile direct join
([#1957](#1957))
([`648cbf3610`](648cbf3))
- fix(join-policy): require legal consent on hosted invites
([#1987](#1987))
([`2e1577f76f`](2e1577f))
- [codex] Prevent actor-tag UI impersonation
([#1931](#1931))
([`c540ec9678`](c540ec9))
- Scope relay runtime state by community
([#1658](#1658))
([`d52dedb06f`](d52dedb))
- Apply optional relay join policy across join flows
([#1894](#1894))
([`6c2d667575`](6c2d667))
- feat(media): require auth for relay media reads
([#1926](#1926))
([`f308762852`](f308762))
- feat(relay): add community unarchive endpoint
([#1908](#1908))
([`6b9641db2b`](6b9641d))
- feat(relay): gate Git web GUI separately
([#1901](#1901))
([`34dc7dec75`](34dc7de))
- mesh: upgrade runtime, enforce membership, add shared compute provider
([#1656](#1656))
([`54638ff4bb`](54638ff))
- Route Git scratch through configured volume
([#1884](#1884))
([`2318b3096c`](2318b30))
- feat(relay): gate usage metrics behind stable leader
([#1814](#1814))
([`59e9821503`](59e9821))
- Relay mesh: cross-pod tunnel + huddle transport (buzz-relay-mesh)
([#1670](#1670))
([`ccb021d713`](ccb021d))
- feat(push): deliver accepted relay events as wakes
([#1866](#1866))
([`bffbc5f22c`](bffbc5f))
- fix(db): resolve duplicate migration version
([#1863](#1863))
([`08ad38a07f`](08ad38a))
- Add private product feedback sidecar
([#1857](#1857))
([`af190c93e1`](af190c9))
- feat(relay): add durable community archival
([#1834](#1834))
([`2b15a72675`](2b15a72))
- feat(push): add public APNs gateway
([#1770](#1770))
([`1c006822e4`](1c00682))
- feat(relay): add atomic community ownership transfer
([#1845](#1845))
([`52e42ccb9f`](52e42cc))
- Bound NIP-RS retention and search indexing
([#1771](#1771))
([`1b4703021d`](1b47030))
- Add optional standalone pairing relay to Helm chart
([#1799](#1799))
([`9b47c8548f`](9b47c85))
- fix(relay): publish membership snapshot on provisioning
([#1761](#1761))
([`0950d392b7`](0950d39))
- feat(relay): per-community usage metrics
([#1723](#1723))
([`620822899a`](6208228))
- refactor(desktop): remove vestigial MCP toolsets config
([#1776](#1776))
([`dfec75b3c0`](dfec75b))

**To release:** merge this PR. The tag and build will happen
automatically.

Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@wpfleger96 wpfleger96 wpfleger96 approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

buzz-audit: every hash chain fails verification — created_at is hashed at nanosecond precision but stored at microsecond precision

3 participants

@shani-singh1 @dophsquare @wpfleger96