feat(manifest): Röbel declares its agentic workspace — buzz.roebel.app, pinned sha-3e48f1b, Max as owner, Mecky as member

Owner = MaxBrych's public kind-0 author key (already on the world-readable
record); agent member = Mecky's declared relay pubkey. Baseline tests learn
that the canonical manifest now carries buzz. B-track B0.3 (manifest half).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: MaxBrych

packages/cli/test/doctor.test.ts

@@ -175,8 +175,10 @@ test("a declared buzz workspace is an endpoint, counts for comms, and nags about
   };
   assert.ok(!doctor(withAgents).warnings.some((w) => w.includes("buzz declared without")));
 
-  // Undeclared -> no buzz endpoint, comms note unchanged.
-  const plain = doctor(roebel);
+  // Undeclared -> no buzz endpoint, comms note unchanged. (The canonical
+  // manifest now declares buzz, so strip it for the baseline.)
+  const { buzz: _buzz, ...servicesWithoutBuzz } = roebel.services;
+  const plain = doctor({ ...roebel, services: servicesWithoutBuzz });
   assert.ok(!plain.endpoints.some((e) => e.name === "buzz"));
   assert.doesNotMatch(plain.sovereignty.find((l) => l.layer === "comms")!.note, /workspace relay/);
 });

packages/cli/test/render.test.ts

@@ -80,7 +80,12 @@ test("secrets appear only as references, never resolved values", () => {
   // every secret the manifest names is surfaced as a ref in SECRETS.md
   assert.deepEqual(
     collectSecretRefs(roebel).sort(),
-    ["$COORDINATOR_PUBKEY", "$GNOSIS_BUNDLER_RPC", "$GNOSIS_RPC", "$MATRIX_CLIENT_SECRET", "$NEXTCLOUD_CLIENT_SECRET", "$ROEBEL_ID_JWKS", "$SUPABASE_URL", "$WEB_CLIENT_SECRET"],
+    [
+      "$BUZZ_GIT_HOOK_HMAC_SECRET", "$BUZZ_POSTGRES_PASSWORD", "$BUZZ_REDIS_PASSWORD",
+      "$BUZZ_RELAY_PRIVATE_KEY", "$BUZZ_S3_ACCESS_KEY", "$BUZZ_S3_SECRET_KEY",
+      "$COORDINATOR_PUBKEY", "$GNOSIS_BUNDLER_RPC", "$GNOSIS_RPC", "$MATRIX_CLIENT_SECRET",
+      "$NEXTCLOUD_CLIENT_SECRET", "$ROEBEL_ID_JWKS", "$SUPABASE_URL", "$WEB_CLIENT_SECRET",
+    ],
   );
   // the keystone env references the secret, it does not inline a value
   assert.match(renderBundle(selfHosted).files["roebel-id.env"], /NEXTCLOUD_CLIENT_SECRET=\$NEXTCLOUD_CLIENT_SECRET/);
@@ -95,7 +100,7 @@ test("the plan is ordered and covers every declared surface", () => {
     // Federation follows the relay: peers are mirrored into a store that only
     // exists once the node's own Nostr surface is up.
     // The indexer follows the relay: it indexes stores that must exist first.
-    "mas-oidc", "nostr-relay", "indexer", "federation", "web-env",
+    "mas-oidc", "nostr-relay", "buzz", "indexer", "federation", "web-env",
     // Operations come after the services exist but before "verify" — a node is
     // not verified until it is also survivable.
     "backup", "backup-offsite", "backup-restore-test", "harden", "firewall",
@@ -581,11 +586,15 @@ test("manifest-declared agent keys become the add-members script; humans-only sh
 });
 
 test("buzz is config-gated — an undeclared workspace changes nothing", () => {
-  const compose = renderComposeYml(roebel);
+  // The canonical Röbel manifest now declares buzz, so the baseline is a
+  // variant with it stripped — the assertion stays: no declaration, no trace.
+  const { buzz: _buzz, ...servicesWithoutBuzz } = roebel.services;
+  const noBuzz = { ...roebel, services: servicesWithoutBuzz };
+  const compose = renderComposeYml(noBuzz);
   assert.doesNotMatch(compose, /buzz/i);
-  assert.doesNotMatch(renderCaddyfile(roebel), /buzz/i);
-  assert.equal(renderBundle(roebel).files["buzz/add-members.sh"], undefined);
-  assert.ok(!plan(roebel).some((s) => s.id === "buzz"));
+  assert.doesNotMatch(renderCaddyfile(noBuzz), /buzz/i);
+  assert.equal(renderBundle(noBuzz).files["buzz/add-members.sh"], undefined);
+  assert.ok(!plan(noBuzz).some((s) => s.id === "buzz"));
 });
 
 test("a vault: secret ref fails at render time, not on the box", () => {

packages/protocol/examples/roebel.netizen.json

@@ -167,6 +167,22 @@
         "element": "https://chat.roebel.app"
       }
     },
+    "buzz": {
+      "url": "https://buzz.roebel.app",
+      "imageTag": "sha-3e48f1b",
+      "ownerPubkey": "4dbcf5811b976212623b75f778e3be404643eb2f200bbb8ac8ebf6f46fecac0a",
+      "agentPubkeys": [
+        "412e639ad250e84faeb3033bba1d20ee09b8a68a2ca8542fcd19d3c2475df16b"
+      ],
+      "secrets": {
+        "postgresPassword": "$BUZZ_POSTGRES_PASSWORD",
+        "redisPassword": "$BUZZ_REDIS_PASSWORD",
+        "s3AccessKey": "$BUZZ_S3_ACCESS_KEY",
+        "s3SecretKey": "$BUZZ_S3_SECRET_KEY",
+        "relayPrivateKey": "$BUZZ_RELAY_PRIVATE_KEY",
+        "gitHookHmac": "$BUZZ_GIT_HOOK_HMAC_SECRET"
+      }
+    },
     "secrets": {
       "nextcloudClientSecret": "$NEXTCLOUD_CLIENT_SECRET",
       "matrixClientSecret": "$MATRIX_CLIENT_SECRET",
@@ -296,7 +312,12 @@
   ],
   "record": {
     "decisions": {
-      "bodies": [{ "id": "stadtvertretung", "noticeScope": "town" }]
+      "bodies": [
+        {
+          "id": "stadtvertretung",
+          "noticeScope": "town"
+        }
+      ]
     }
   },
   "branding": {