feat(agent): add keyless broker runtime

[jrobotham-square]

Stack Info: Stacked on #6922

Why

Allow agents to run without a signing key or direct relay access by delegating authorized operations to a broker host.

What

• Add a shared HTTP broker transport with explicit local and broker modes.
• Route messages, reactions, profiles, storage, presence, typing, telemetry, and liveness through broker actions.
• Run buzz-acp through broker-polled reads with bounded replay deduplication and safe child provisioning.
• Redact all MCP environment values from observer telemetry and ACP wire logs in both local and broker modes; child provisioning remains unchanged.
• Require TLS outside loopback, provision explicit relay identity, and apply action-aware response bounds.

Risk Assessment

Low — broker mode is opt-in and local mode remains covered by existing tests. Basic end-to-end validation has exercised the keyless path through a signing broker against a real Buzz relay.

References

• Broker action contract: broker: add storage read/write and live-signal actions to the contract #6922
• Agent broker specification: docs: agent broker specification (#6467 interface half) #6790

---

Update Aug 29, 10:11: Hardened broker boundaries following review.

• Centralize redacted outbound ACP diagnostics, including session/new.
• Force plaintext loopback broker traffic to bypass proxies.
• Size channel.read response buffering from the validated page limit.
• Account for outer JSON escaping when trimming broker observer frames.

Generated with Codex

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is b49675894b39f87215e4dfc8c1ad4a3c28c6097e...10875861bad201dd8f043fd126ba9a18d6dabaec.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 10875861bad201dd8f043fd126ba9a18d6dabaec to authorize a new review.
Any previous review applies only to its recorded range.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Two credential-handling defects make the keyless boundary unsafe, and one request-bound bug makes a compromised broker unnecessarily expensive to survive:

1. High: session/new writes the broker bearer credential to ACP debug logs. Broker mode places BUZZ_BROKER_CREDENTIAL in the MCP server env (crates/buzz-acp/src/lib.rs:5231-5248), which session_new_full embeds under params.mcpServers (crates/buzz-acp/src/acp.rs:699-724). Generic send_request then logs the original message at acp::wire=debug (acp.rs:1145-1166). The new redactor only protects observer telemetry in write_ndjson and the separate prompt path, so it does not protect this log. Apply the redactor to every outbound wire diagnostic, especially send_request, and pin session/new with a log-capture regression test.

2. High: loopback HTTP can send the bearer through a system proxy in plaintext. HttpBrokerClient permits http://localhost and loopback literals, but its default reqwest client is created without .no_proxy() (crates/buzz-broker-client/src/lib.rs:52-95). Reqwest enables system/environment proxy discovery by default, so a machine with HTTP_PROXY/ALL_PROXY and no matching NO_PROXY routes the request, including the Authorization: Bearer header at lines 134-143, through that proxy. For plaintext loopback, structurally force a proxy-free client (and prevent with_client from weakening that invariant), or require HTTPS universally. Add a capture-proxy regression proving a loopback credential never reaches the proxy.

3. Medium: channel.read buffers for the protocol-wide maximum instead of the requested page size. max_response_bytes grants every read 64 MiB solely from its action (crates/buzz-broker-client/src/lib.rs:14-25,128-169), while request-specific enforcement happens only after the entire body is parsed (crates/buzz-sdk/src/broker/mod.rs:731-765). The ACP poll always asks for 100 events (crates/buzz-acp/src/runtime_transport.rs:297-307), so a hostile or faulty broker can force repeated 64 MiB allocations for pages that will ultimately be rejected. Derive the transport cap from the validated request limit and test the limit-100 case.

The explicit-channel ACP polling path itself looks sound: signed-event verification, h-tag isolation, rotating dedup, terminal unauthenticated handling, and fail-closed unknown channel metadata are wired consistently. CI is green, and focused source/contract review was against exact head 937e446cf8fce5d1b7db5de4a78b87e6b6524370 and stacked base fcf2e9bc753e9ce047b21710c4262e106c2f706b. git diff --check passed. I did not run the external broker harness; the submitted head does not include one.

[jrobotham-square]

🤖 Updated by Codex in f42a4a3c1 — all three findings are addressed:

1. Outbound ACP wire logging is now centralized through the MCP environment redactor, with a session/new log-capture regression covering the broker credential.
2. Plaintext loopback broker clients now structurally disable proxies, and a capture-proxy regression verifies the bearer reaches only the broker.
3. channel.read response buffering now derives its cap from the validated request limit, with coverage for the ACP limit of 100.

The rebase also accounts for the updated observer payload contract by including outer JSON escaping in the broker-frame budget. Local pre-push checks and CI are green on the new head. Ready for re-review.