Upgrade: disposition and adopt block/buzz v0.5.1 without widening Hive

[100yenadmin]

Parent: #1
Depends on: #11
Release blockers that must land on the adopted candidate: #78, #43
Dashboard dependency for #78: https://github.com/electricsheephq/electric-sheep-website-dashboard-6158a244/issues/751

Pinned Hive upstream base: dd222a509b156ba52ed3219e895d7bf1cf322c92
Current Hive main before adoption: ce2850ca75a4d528baa4280953331b13188664a2
Candidate: block/buzz v0.5.1 at a13085e9ac9a7c8dbd9426a6b88fc75abf62220e
Comparison: 104 upstream commits from the pinned base; 37 commits from v0.5.0 (4a977c588a540be38bd8ddb268cd24437bac8165) to v0.5.1.

Outcome

Adopt native Buzz v0.5.1 before the David/customer candidate while keeping Hive a thin Electric adapter. Do not replace native collaboration, create managed brokers, duplicate the agent catalog, provision Hermes, or blindly rebase.

Required disposition work

• Give all 104 upstream commits one candidate-scoped keep, backport, redesign, drop/omit, or prove-inapplicable disposition.
• Preserve the exact 37-commit v0.5.0-to-v0.5.1 disposition table recorded in this issue before source replay.
• Map conflicts across OAuth/identity, relay admission/policy, native collaboration, Agents/ACP runtimes, settings, updater/branding, packaging, and tests.
• Treat v0.5.1 relay lock-inversion fix 22be8bb35177e27efc2dca2534df9a8dd871eae0 as customer-release backport-or-prove-present work.
• Treat Hermes configured-MCP isolation 6300a6b1d03e32c473c7b6568df663c8927565cf as required backport-or-prove-present work for the supported Hive Hermes path.
• Reconcile agent catalog sharing a35771fc441cdc3c6f517f419037206783b502d2 and shared-agent fidelity f7a3988ba13b590d9a55a7e8413fc3fb5ffbef18 with the thin Company VM adapter and Company VM agents: use native signed profile avatars #43. Reuse native projections; do not create a second catalog or identity.
• Keep custom local harness creation only where the local runtime is truthfully supported; never expose it as Hive-side VM Hermes provisioning.
• Keep Electric website ownership of invites/seats; do not re-enable native hosted-invite authority in managed Hive merely because v0.5.1 refines it.
• Preserve Electric-only OAuth, entitlement, durable identity/session, host-derived tenant admission, branding/updater, Company VM catalog, and capability-gated responder seams only where upstream does not now provide the behavior.
• Implement Release blocker: managed OAuth must restore the canonical Hive identity without pairing #78 and Company VM agents: use native signed profile avatars #43 against the frozen v0.5.1-based candidate so the release blockers are not built on the stale agent/auth surface.

Acceptance

• Fresh integration branch from exact v0.5.1 with an exact commit-disposition artifact; no blind merge/rebase.
• Native Buzz collaboration and supported settings remain unchanged except for explicit managed product dispositions.
• Release blocker: managed OAuth must restore the canonical Hive identity without pairing #78 managed OAuth-only canonical identity recovery and Company VM agents: use native signed profile avatars #43 Company VM avatar presentation pass on the adopted candidate.
• Focused desktop/relay/identity/agent/updater tests, canonical exact-head CI, one independent semantic review, and a terminal disposition for every finding.
• One cumulative signed internal artifact and installed Andrew/Benjamin/ATRIS/shared-agent/channel/DM/huddle/OAuth/avatar/memory canary.
• David/customer distribution begins only after that exact cumulative artifact is accepted internally.

Non-goals

Blind cherry-picking, OpenClaw changes, Hive-side Hermes provisioning, hosted communities, Compute, customer relay creation, signing/publication from source proof alone, or claiming v0.5.1 adoption because this issue/milestone changed.

Stop conditions

Stop on native collaboration replacement, managed channel/DM brokers, client-selected tenant/relay authority, duplicate identities, private-key exposure, fabricated local personas for VM identities, unsupported runtime claims, cross-tenant access, or an OOM recurrence.

Exact next action

Freeze a13085e9ac9a7c8dbd9426a6b88fc75abf62220e, produce/verify the complete 104-commit disposition artifact, then replay the thin Electric patch stack onto a fresh v0.5.1 integration branch. Run the narrowest conflict-focused checks before opening the draft adoption PR.

Proof boundary

Issue and disposition state prove planning only. Source/CI, merge, signed artifact, installed canary, internal acceptance, and David/customer rollout remain separate claims.

[100yenadmin]

Buzz v0.5.1 delta disposition

Verified upstream tag: v0.5.1 at a13085e9ac9a7c8dbd9426a6b88fc75abf62220e.
Verified v0.5.0 tag: 4a977c588a540be38bd8ddb268cd24437bac8165.
Pinned Hive upstream base: dd222a509b156ba52ed3219e895d7bf1cf322c92.
Current Hive main before adoption: ce2850ca75a4d528baa4280953331b13188664a2.

There are 37 upstream commits from v0.5.0 to v0.5.1 and 104 total commits from the pinned Hive base to v0.5.1. This is a candidate-scoped disposition, not a blind-rebase or adoption claim.

Commit	Upstream change	Candidate disposition
7dfea2634	Mobile message image galleries (block#3312)	Keep unchanged in the upstream base; managed Mobile remains disabled until its separate proof.
6da45ac5c	Mobile message/search layout polish (block#3121)	Keep unchanged; no managed desktop override.
a3b097745	Mobile attachment picking (block#3313)	Keep unchanged; not a pre-David desktop gate.
af4d86151	Relay chart pod extension points (block#3322)	Keep in source but prove unused by the current per-company relay deployment before claiming runtime impact.
5457c947a	Multiline composer block formatting (block#3246)	Keep unchanged as native collaboration behavior.
60158fce3	CLI NIP-38 status command (block#3253)	Keep unchanged; no Electric adapter conflict.
4e3998f36	Minimum supported codex-acp version (block#3254)	Keep; capability-gate local Codex honestly and do not apply the check to VM Hermes identities.
00ede2e7a	Restore Inbox icon (block#3341)	Keep unchanged.
a77212875	Mobile loading spinners (block#3314)	Keep unchanged; no managed desktop override.
35305bfc8	DCO contributor documentation (block#3337)	Keep unchanged.
3afa129ee	Keep drafts out of Inbox All (block#3217)	Keep unchanged as native product behavior.
a35771fc4	Agent catalog sharing redesign (block#2439)	Redesign/reconcile before replay: preserve the native catalog and avatar pipeline, then layer only the company-VM provider adapter; do not create a second catalog or expose unsupported VM edit/share controls.
1e307e178	Remove stale Typesense Compose env vars (block#3332)	Keep unchanged.
b0503d80c	Add custom harness inline (block#3252)	Keep for supported user-created local agents; capability-gate it away from registered VM-agent identities and never provision Hermes from Hive.
1d4f97b95	Disable Goose cron scheduler in managed children (block#3144)	Keep; verify no regression in long-lived local agent sessions.
1d3b810ad	Community rail full-height paint (block#3382)	Keep unchanged.
4fcd55a99	Linux CI dependency docs (block#3396)	Keep unchanged.
913d564ce	Stabilize DM expansion E2E ordering (block#2004)	Keep as test-only stabilization; do not count it as product DM proof.
3ece4461d	Linux WebKit workarounds (block#3271)	Keep unchanged; not a macOS release gate.
f25e6dd6a	ACP session steering for Claude/Codex (block#3007)	Keep for supported local runtimes; verify Hermes session continuity separately and do not claim VM support from this commit.
12d63c67b	Relay chart 0.1.7 release (block#3393)	Keep metadata with the chart change; no deployment claim.
826bed482	Desktop smoke E2E timeout (block#3409)	Keep CI-only change; no product proof.
9227bdf58	File-size ratchet against base tree (block#3352)	Keep CI behavior and reconcile Electric file-size exceptions narrowly.
55a3ed7b9	Clear stale thread new-message pill (block#3411)	Keep unchanged.
90e058ebf	Claude Opus 5 model entry (block#2831)	Keep native model metadata; Hermes remains model/provider authority for VM agents.
22be8bb35	Relay subscription lock inversion fix (block#3413)	Backport-or-prove-present before customer relay qualification; this fixes a reachable relay deadlock.
6300a6b1d	Per-runtime env defaults; isolate Hermes MCP startup (block#3420)	Required backport-or-prove-present for the Hive Hermes path; adopt the generic seam and preserve operator override precedence.
485d03a35	Mobile attachment/gallery polish (block#3370)	Keep unchanged; not a pre-David desktop gate.
c405ad1d4	Anthropic caching plus MCP proxy/TLS passthrough (block#3463)	Keep upstream behavior; verify it does not override Hermes-owned provider configuration. Backport proxy/TLS passthrough only if the current VM path reproduces the egress failure.
ce01e930e	Mobile typing indicator polish (block#3528)	Keep unchanged; not a pre-David desktop gate.
24d90d128	Community invite limits (block#3529)	Omit the managed surface because Electric website owns invites/seats; retain native upstream code for unmanaged Buzz.
6438dedf8	Native gateway wire routing for Claude/GPT families (block#3538)	Keep native agent behavior; VM Hermes remains provider/model authority.
4555899ab	Mobile navigation/menu polish (block#3486)	Keep unchanged; not a pre-David desktop gate.
f7a3988ba	Preserve shared-agent fidelity (block#3553)	Keep and reuse its effective-avatar/fallback pipeline where compatible; it does not by itself implement tenant-scoped Company VM avatar overrides.
294c8c821	Move observer archive/decrypt off the main thread (block#3415)	Keep; include in the cumulative memory/responsiveness canary because it removes a known main-thread blocking path.
51bb97d2b	Run Tauri clippy pre-push (block#3555)	Keep CI/developer gate.
a13085e9a	v0.5.1 release metadata (block#3566)	Redesign for Hive version/branding/updater metadata; do not publish the upstream version string as a Hive release claim.

Gate

Adopt no source by blind rebase. Freeze the exact v0.5.1 tag, replay only the thin Electric OAuth/entitlement/identity, branding/updater, tenant-admission, and Company VM provider adapters, and then run focused tests, exact-head CI, one independent semantic review, and one cumulative installed Andrew/Benjamin/agent/huddle/memory canary. David/customer distribution remains a separate proof tier.

[evaos-code-review-bot]

evaOS issue enrichment

Issue: #69 - Upgrade: disposition and adopt block/buzz v0.5.1 without widening Hive
State: open; milestone: Hive v0.5.1 — Upstream Adoption

Related issues/PRs: #1, #11, #78, #43.
Existing labels: release, canary.
Suggested labels: security, tests, support.
Suggested owners: none.

Related context

• Epic: Hive thin adapter — Electric OAuth and VM-hosted agents #1 - mentioned in issue metadata; inspect for dependency, duplicate, or prior-decision risk.
• Fork: compare upstream and report the thin adapter patch stack #11 - mentioned in issue metadata; inspect for dependency, duplicate, or prior-decision risk.
• Release blocker: managed OAuth must restore the canonical Hive identity without pairing #78 - mentioned in issue metadata; inspect for dependency, duplicate, or prior-decision risk.
• Company VM agents: use native signed profile avatars #43 - mentioned in issue metadata; inspect for dependency, duplicate, or prior-decision risk.

Agent-start packet

Problem shape: Upgrade: disposition and adopt block/buzz v0.5.1 without widening Hive - Parent: #1 Depends on: #11 Release blockers that must land on the adopted candidate: #78, #43 Dashboard dependency for #78: https://github.com/electricsheephq/electric-sheep-website-dashboard-6158a244/issues/751 Pinned
Product fit: Product/market issue; check vision fit, customer value, and whether external precedent can reduce time-to-market.
Implementation wedge: Start with a bounded adapter/contract or dry-run packet before changing live runtime behavior.

Build / borrow / buy scan:

• Build: identify the smallest implementation wedge that proves the issue without broad rollout.
• Borrow: inspect same-repo prior art, repo memory, GitNexus context, and allowlisted cross-repo examples first.
• Buy/use: run capped external OSS/library/API/current-market research with citations, observed dates, and why each source matters.
• Library choice: compare maintenance, API fit, license, bundle/runtime cost, and integration proof.

Candidate sources:

• VISION.md / repo policy / repo-memory.md / GitNexus packet.
• Same-repo issues and PRs referenced by issue metadata.
• Allowlisted cross-repo GitHub examples with direct issue/PR/repo URLs.
• External OSS repositories or library/API docs with freshness dates.
• Current market/product examples, capped and cited, only when they change implementation direction.

Acceptance criteria:

• Preserve and execute the issue's stated acceptance criteria.
• Include source citations for any external OSS/library/current-market claims.
• Keep issue-enrichment comments sticky and idempotent.
• Keep labels, owners, reviewers, and roadmap fields suggestion-only.

Proof plan:

• Focused unit/fixture test for the changed planner behavior.
• Dry-run issue-enrichment evidence packet before live comment posting.
• Redaction check for issue body, citations, and generated markdown.
• Contract or degraded-mode proof before runtime promotion.
• Dependency/license/API-fit note before adding or relying on a package.

Known traps:

• Do not treat related links as proof by themselves; each source needs a reason why it matters.
• Do not scan old issue backlogs or exceed repo-level enrichment throttles.
• External research must stay capped, cited, fresh-dated, and redacted.
• Technical severity alone can miss product/UX regressions; include product-manager review framing.

Non-goals:

• Do not auto-apply labels, owners, reviewers, roadmap fields, or milestones.
• Do not bulk-enrich old backlog issues from this planner output.
• Do not claim external market or OSS research was performed unless cited sources are present.

Context-source taxonomy:

• [enabled] vision_repo_policy_memory_gitnexus: Use repo vision, policy, memory, and GitNexus first before external research.
• [enabled] same_repo_issues_prs: Issue metadata contains same-repo references.
• [enabled] allowlisted_cross_repo_github: Triggered by issue class; keep to configured allowlist and source caps.
• [enabled] external_oss_examples: Use for build/borrow/buy precedent with citations and observed dates.
• [enabled] library_api_docs: Use when implementation may depend on a module, SDK, API, or framework choice.
• [enabled] current_market_examples: Use for product/UX/market positioning issues with freshness dates.
• [enabled] internal_mcp_docs: Use internal docs/MCP context when available; missing context is degraded, not blocking.

Validation suggestions

• Confirm owner, acceptance criteria, and validation evidence before implementation.

Triage gaps

• Owner or reviewer signal not detected in issue body.

No labels, owners, reviewers, or roadmap fields were changed by this bot.

[100yenadmin]

Draft PR #80 is open on exact pushed head 83dd0490544e091e4c194f08e8ff610144b01578: #80

Focused source proof on that head:

• disposition manifest: 104/104 exact commits
• frontend adapter/product/community/huddle tests: 56 passed
• managed Rust adapter tests: 14 passed
• relay subscription/security tests: 27 passed
• Hermes env/MCP isolation tests: 4 passed
• metadata/profile tests: 4 passed
• huddle reducer tests: 8 passed
• typecheck, Rust format, file-size ratchet, and diff check passed

Both required v0.5.1 security items are exact ancestors and exercised: relay replacement-lock/scope safety 22be8bb35177e27efc2dca2534df9a8dd871eae0; Hermes configured-MCP isolation 6300a6b1d03e32c473c7b6568df663c8927565cf.

Upstream now has v0.5.2/main, but this candidate intentionally remains frozen on owner-approved v0.5.1; no blind rebase occurred. Canonical CI and independent semantic review remain open. This proves source behavior only, not merge, artifact, installed runtime, internal acceptance, David/customer readiness, or release. Missing/mismatched physical-device identity restoration remains #78; VM avatar presentation remains #43.

[100yenadmin]

Exact-head gate complete for b75e26d298d014996d329044129618d21f580ab3 (tree 87c8678b888a96621983517cde0d3570caa3805e).

• Canonical CI: run 30502631253 — success.
• Docker/fork GHCR workflow: run 30502631251 — success on both architectures, including the formerly failing push-gateway cache export.
• CodeQL language analyses, Socket, Helm, and Harbor: completed without a remaining blocker.
• Independent exact-head product review and targeted push-gateway workflow review: PASS, no findings.
• Review threads: zero unresolved.

The pre-existing test-only CodeQL alert in the benchmark harness was dispositioned as used in tests: it already existed on main at ce2850ca75a4d528baa4280953331b13188664a2, GitHub classified the file as test code, and the exact code writes only an ephemeral mode-0600 local benchmark config.

This proves the source/CI/review gate only. It does not prove merge, artifact, installed runtime, internal acceptance, David/customer readiness, or release.