Skip to content

Add generic information-flow control core - #7293

Merged
jmecom merged 2 commits into
mainfrom
jm/ifc-core
Sep 4, 2026
Merged

Add generic information-flow control core#7293
jmecom merged 2 commits into
mainfrom
jm/ifc-core

Conversation

@jmecom

@jmecom jmecom commented Sep 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Adds a dependency-free ifc-core crate implementing reader-set confidentiality labels and monotonic per-computation flow state.

  • Defines flow ordering, join, and meet over caller-supplied principal universes.
  • Fails closed for unknown or cross-universe input and checks reader widening at egress.
  • Includes property tests for lattice laws and monotonic taint, plus the design paper that motivates the broker integration.

The crate deliberately contains no Buzz, Nostr, channel, membership, or grant policy; those remain in the Buzz adapter.

@github-actions

github-actions Bot commented Sep 3, 2026 •
edited
Loading

Copy link
Copy Markdown

🔐 Codex Security Review

Status: review required for the current range.

The current range is 4afef8649ab11d60b423893e9e4f8cd36868d35a...e2c15758edebbf27c90080c614144056aad4ae76.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review e2c15758edebbf27c90080c614144056aad4ae76 to authorize a new review.
Any previous review applies only to its recorded range.

@jmecom
Add generic information-flow control core
91ea86e 
Signed-off-by: Jordan Mecom <jm@squareup.com>
@jmecom
jmecom marked this pull request as ready for review September 3, 2026 19:11
@jmecom
jmecom requested a review from a team as a code owner September 3, 2026 19:11
wpfleger96
wpfleger96 reviewed Sep 4, 2026
View reviewed changes

@wpfleger96 wpfleger96 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The IFC core is compact and matches the design paper: reverse reader-set inclusion governs flow, join intersects readers, meet unions them, and unknown or cross-universe observations permanently fail closed. The production crate has no dependencies, its public API is documented, and the paper keeps the security claim correctly scoped to broker-mediated paths.

CI is green at 91ea86e94e799a4204d317717df6e8cd9fb4d1b0. Independent external-consumer verification also passed exhaustive finite-domain oracles for flow ordering, join/meet, two-input accumulation, public/restricted combinations, unknown and cross-universe poisoning, and empty restricted-label rejection.

One non-blocking diagnostic issue: FlowState::check_egress() reports a destination from another universe as EgressError::DestinationWidensReaders. The operation denies correctly, but the message says the audience widened when the actual cause is a universe mismatch. Consider adding a distinct cross-universe egress variant so the future adapter can diagnose policy/configuration errors accurately.

@jmecom
Report cross-universe egress distinctly
e2c1575 
Signed-off-by: Jordan Mecom <jm@squareup.com>
@jmecom
jmecom requested a review from wpfleger96 September 4, 2026 20:41
@jmecom jmecom mentioned this pull request Sep 4, 2026
Open
@jmecom
jmecom enabled auto-merge (squash) September 4, 2026 20:46
@jmecom
jmecom disabled auto-merge September 4, 2026 22:00
@jmecom
jmecom enabled auto-merge (squash) September 4, 2026 22:21
@jmecom
jmecom merged commit 4d447b9 into main Sep 4, 2026
152 of 155 checks passed
@jmecom
jmecom deleted the jm/ifc-core branch September 4, 2026 22:26
mfethe1 added a commit to mfethe1/buzz that referenced this pull request Sep 4, 2026
@mfethe1
[lenny] merge: integrate upstream block/main f038cbb into product/mai…
d3c86da 
…n (5 commits: block#7134 sidebar unread, block#7293 IFC core, block#7335 Pi launcher, block#7338 mention chips, block#7336 video speed)

Conflict: crates/buzz-acp/src/lib.rs — fork session_store init and upstream
pi_launcher/base_prompt block were both added at the same point in main();
resolved by keeping both (fork block first, upstream block second).

Signed-off-by: Michael Feth <mfethe1@gmail.com>
baxen pushed a commit that referenced this pull request Sep 5, 2026
Fizz
Merge remote-tracking branch 'origin/main' into fizz/room-model-contract
2b1ccba 
* origin/main:
  fix(desktop): keep packaged frontendDist relative so Windows embeds assets (#7177)
  fix(sidebar): simplify unread indicators and emphasize priority activity (#7134)
  Add generic information-flow control core (#7293)
  feat(buzz-acp): update base prompt; add buzz context and skills to Pi agents (#7335)
  fix(desktop): restore mention chip identity icons (#7338)
  Persist video playback speed preference (#7336)
  Verify ACP relay events before prompt routing (#7010)
  fix(buzz-acp): bound busy-owner hold to prevent cross-channel starvation (#7337)
  feat(desktop): invite owned agents from standalone forums (#7125)
  fix(desktop): authorize remote mentions at publication (#7124)
  fix(acp): rename system tag to agent-instructions (#7332)
  fix(desktop): bind duplicate mention selections to exact recipients (#7133)
  refactor(relay): extract NIP-29 membership authorization (#7285)
  chore(release): release Buzz Desktop version 0.5.22 (#7308)
  feat(desktop): preserve mentions across copy and paste (#7228)
  test(desktop): await Bestie drag and profile hover endpoints (#7294)

Signed-off-by: Fizz <400e8babadcee6a7f420103f10a2849d84c4a9c71d5bd04f3948c814216648a3@buzz.block.builderlab.xyz>
@yjc801 yjc801 mentioned this pull request Sep 6, 2026
Merged
This was referenced Sep 6, 2026
Open
Open
wpfleger96 pushed a commit that referenced this pull request Sep 8, 2026
Duncan
Merge remote-tracking branch 'origin/main' into duncan/nip-fi-deny-api
7a47714 
* origin/main:
  chore(release): release Buzz Desktop version 0.5.23 (#7381)
  fix(desktop): keep packaged frontendDist relative so Windows embeds assets (#7177)
  fix(sidebar): simplify unread indicators and emphasize priority activity (#7134)
  Add generic information-flow control core (#7293)
  feat(buzz-acp): update base prompt; add buzz context and skills to Pi agents (#7335)
  fix(desktop): restore mention chip identity icons (#7338)
  Persist video playback speed preference (#7336)
  Verify ACP relay events before prompt routing (#7010)
  fix(buzz-acp): bound busy-owner hold to prevent cross-channel starvation (#7337)
  feat(desktop): invite owned agents from standalone forums (#7125)
  fix(desktop): authorize remote mentions at publication (#7124)
  fix(acp): rename system tag to agent-instructions (#7332)
  fix(desktop): bind duplicate mention selections to exact recipients (#7133)
  refactor(relay): extract NIP-29 membership authorization (#7285)
  chore(release): release Buzz Desktop version 0.5.22 (#7308)
  feat(desktop): preserve mentions across copy and paste (#7228)
  test(desktop): await Bestie drag and profile hover endpoints (#7294)

Signed-off-by: Duncan <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@buzz.block.builderlab.xyz>
wpfleger96 pushed a commit that referenced this pull request Sep 8, 2026
Hayt
Merge remote-tracking branch 'origin/main' into hayt/nip-fi-stateless…
488c73f 
…-enforcement

* origin/main:
  Add generic information-flow control core (#7293)
  feat(buzz-acp): update base prompt; add buzz context and skills to Pi agents (#7335)
  fix(desktop): restore mention chip identity icons (#7338)
  Persist video playback speed preference (#7336)
  Verify ACP relay events before prompt routing (#7010)
  fix(buzz-acp): bound busy-owner hold to prevent cross-channel starvation (#7337)
  feat(desktop): invite owned agents from standalone forums (#7125)
  fix(desktop): authorize remote mentions at publication (#7124)
  fix(acp): rename system tag to agent-instructions (#7332)
  fix(desktop): bind duplicate mention selections to exact recipients (#7133)
  refactor(relay): extract NIP-29 membership authorization (#7285)
  chore(release): release Buzz Desktop version 0.5.22 (#7308)
  feat(desktop): preserve mentions across copy and paste (#7228)
  test(desktop): await Bestie drag and profile hover endpoints (#7294)
  Collapse contiguous join messages (#7262)
  chore(release): release Buzz Desktop version 0.5.21 (#7301)
  fix(scripts): copy global-agent-config.json in buzz-adopt-prod-agents (#7303)

Signed-off-by: Hayt <9e1c23a3fd83f61da34420e4e88ff1b16e45cafcc0cd9019eb07d4ecfa8ca9b0@buzz.block.builderlab.xyz>
wpfleger96 added a commit that referenced this pull request Sep 8, 2026
@wpfleger96
Merge remote-tracking branch 'origin/main' into wpfleger/desktop-admi…
efa68d2 
…n-surface

* origin/main: (23 commits)
  chore(release): release Buzz Desktop version 0.5.23 (#7381)
  fix(desktop): keep packaged frontendDist relative so Windows embeds assets (#7177)
  fix(sidebar): simplify unread indicators and emphasize priority activity (#7134)
  Add generic information-flow control core (#7293)
  feat(buzz-acp): update base prompt; add buzz context and skills to Pi agents (#7335)
  fix(desktop): restore mention chip identity icons (#7338)
  Persist video playback speed preference (#7336)
  Verify ACP relay events before prompt routing (#7010)
  fix(buzz-acp): bound busy-owner hold to prevent cross-channel starvation (#7337)
  feat(desktop): invite owned agents from standalone forums (#7125)
  fix(desktop): authorize remote mentions at publication (#7124)
  fix(acp): rename system tag to agent-instructions (#7332)
  fix(desktop): bind duplicate mention selections to exact recipients (#7133)
  refactor(relay): extract NIP-29 membership authorization (#7285)
  chore(release): release Buzz Desktop version 0.5.22 (#7308)
  feat(desktop): preserve mentions across copy and paste (#7228)
  test(desktop): await Bestie drag and profile hover endpoints (#7294)
  Collapse contiguous join messages (#7262)
  chore(release): release Buzz Desktop version 0.5.21 (#7301)
  fix(scripts): copy global-agent-config.json in buzz-adopt-prod-agents (#7303)
  ...

Signed-off-by: Will Pfleger <pfleger.will@gmail.com>
brow added a commit that referenced this pull request Sep 8, 2026
@brow
Merge main to satisfy the pre-push branch-skew gate
581fd52 
* origin/main: (29 commits)
  fix(acp): pace targeted overflow recovery on consumer capacity (#7325)
  fix(link-preview): keep composer fetches user-paced (#7211)
  feat(mesh): upgrade to mesh-llm 0.76.0-rc8 and recommend Qwen3.8 27B (#6189)
  fix(agent): route GPT-5+ model-service FQNs to Responses (#7358)
  fix(buzz-acp): wake held ACP threads and fence forked sessions (#7340)
  fix(mobile): style inline code with the app mono face (#6631)
  chore(release): release Buzz Desktop version 0.5.23 (#7381)
  fix(desktop): keep packaged frontendDist relative so Windows embeds assets (#7177)
  fix(sidebar): simplify unread indicators and emphasize priority activity (#7134)
  Add generic information-flow control core (#7293)
  feat(buzz-acp): update base prompt; add buzz context and skills to Pi agents (#7335)
  fix(desktop): restore mention chip identity icons (#7338)
  Persist video playback speed preference (#7336)
  Verify ACP relay events before prompt routing (#7010)
  fix(buzz-acp): bound busy-owner hold to prevent cross-channel starvation (#7337)
  feat(desktop): invite owned agents from standalone forums (#7125)
  fix(desktop): authorize remote mentions at publication (#7124)
  fix(acp): rename system tag to agent-instructions (#7332)
  fix(desktop): bind duplicate mention selections to exact recipients (#7133)
  refactor(relay): extract NIP-29 membership authorization (#7285)
  ...

Signed-off-by: Tom Brow <tomb@block.xyz>
rileycrane pushed a commit that referenced this pull request Sep 8, 2026
Sol
Merge remote-tracking branch 'origin/main' into fizz/md-viewer
8120875 
* origin/main: (77 commits)
  fix(acp): pace targeted overflow recovery on consumer capacity (#7325)
  fix(link-preview): keep composer fetches user-paced (#7211)
  feat(mesh): upgrade to mesh-llm 0.76.0-rc8 and recommend Qwen3.8 27B (#6189)
  fix(agent): route GPT-5+ model-service FQNs to Responses (#7358)
  fix(buzz-acp): wake held ACP threads and fence forked sessions (#7340)
  fix(mobile): style inline code with the app mono face (#6631)
  chore(release): release Buzz Desktop version 0.5.23 (#7381)
  fix(desktop): keep packaged frontendDist relative so Windows embeds assets (#7177)
  fix(sidebar): simplify unread indicators and emphasize priority activity (#7134)
  Add generic information-flow control core (#7293)
  feat(buzz-acp): update base prompt; add buzz context and skills to Pi agents (#7335)
  fix(desktop): restore mention chip identity icons (#7338)
  Persist video playback speed preference (#7336)
  Verify ACP relay events before prompt routing (#7010)
  fix(buzz-acp): bound busy-owner hold to prevent cross-channel starvation (#7337)
  feat(desktop): invite owned agents from standalone forums (#7125)
  fix(desktop): authorize remote mentions at publication (#7124)
  fix(acp): rename system tag to agent-instructions (#7332)
  fix(desktop): bind duplicate mention selections to exact recipients (#7133)
  refactor(relay): extract NIP-29 membership authorization (#7285)
  ...

Signed-off-by: Sol <478bb5a31222ea2b28a3d1afb8b1d598940628f19c2a87efc3c4b822299eeec6@buzz.block.builderlab.xyz>

# Conflicts:
#	desktop/src-tauri/src/commands/media_download.rs
#	desktop/src-tauri/src/lib.rs
@jmecom jmecom mentioned this pull request Sep 11, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@wpfleger96 wpfleger96 wpfleger96 approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jmecom @wpfleger96