fix: restore Codex delivery and scoped native app access

[Greg-Moskalenko]

Summary

• keep Codex workspace-write turns network-enabled only when the adapter proves it honors Buzz's explicit network and writable-root policy
• add a harness-owned broker that transports the exact already-signed Buzz event when the sandboxed CLI has a degraded or ambiguous relay outcome
• verify relay acceptance and exact event readback for both direct and brokered delivery
• preserve message content, channel/thread tags, mentions, attachments, signer, and event id without reconstructing or re-signing the payload
• restore native Computer Use session approval for one identity-bound agent and an exact app allowlist, while leaving form elicitation disabled by default

Why

Kamaljinder's Luna turns continued to run and compose replies, but normal buzz messages send calls ran inside a Codex workspace-write sandbox whose per-turn policy disabled network access. Earlier sends only worked when the model happened to request an elevated retry. After a fresh session stopped choosing that escape, direct replies and heartbeat publications silently failed.

This change makes the intended workspace-write network policy explicit and adds a signed-event delivery contract outside the model sandbox so publishing no longer depends on model-selected escalation.

Safety properties

• direct relay delivery remains the primary path
• broker accepts only a bounded message-kind allowlist and validates signer, signature, event id, membership, channel tags, timestamps, size, capability, and request correlation
• broker publishes the exact signed event, performs exact readback, and never rebuilds or re-signs assistant prose
• bounded queue, scan, response, timeout, lease, symlink/reparse, and stale-file handling
• stock adapters fail closed at startup; the required adapter capability is versioned

Validation

• env -u BUZZ_ACP_LAZY_POOL ./bin/just ci
• full repository CI passed at 23565511392457b177ed47a25f8ed9bb6be8d652
• release binaries built and SHA-256 pinned for live Luna acceptance
• independent security/correctness review completed with no remaining actionable findings

Optional outbound mention guard

• add the generic BUZZ_OUTBOUND_TOP_LEVEL_MENTION_PUBKEYS policy for new stream and forum messages; no agent or recipient identity is hard-coded
• resolve one canonical policy value and propagate it consistently to the agent child, MCP subprocess, direct CLI, and harness broker
• require top-level messages to carry exactly the configured p-tag set; reject missing, additional, malformed, or duplicate tags before relay submission
• allow unmentioned replies only after verifying the signed parent exists in the same channel; mentioned replies must still match the configured set
• leave edit and diff payloads unaffected

Path-level tests cover direct and broker rejection, matching top-level delivery,
signed same-channel replies, forged or cross-channel reply rejection, policy
precedence and propagation, and edit/diff compatibility.

Routing-policy live acceptance

• Kamaljinder's Desktop-managed signing context ran the validated 708054d8
  candidate with BUZZ_OUTBOUND_TOP_LEVEL_MENTION_PUBKEYS set to Boofus only.
• A top-level wrong-recipient attempt naming Ultra Beefus failed locally with the
  mention-policy error and produced no matching KJ event on the relay.
• The matching Boofus-only probe was accepted exactly once and read back exactly
  once as KJ-signed event
  ee871edddfba2ffdb2d8249f5a86be446749d5ab6878ccd5b4d5d7c6ae3ce3dd.
• The signed event is kind 9, has the Inbox triage h tag, no e tag, and
  exactly one p tag: Boofus
  (7ab52828888397487758803330ded03256c25a98025642fe35382f030b930711).
• KJ was then restored to the normal 3,600-second cadence; startup readback shows
  32 workers configured, 31 channel subscriptions, relay connection, online
  presence, and the Boofus-only guard in the live process environment.

Scoped native Computer Use permission bridge

• keep ACP form elicitation disabled by default for every agent
• enable it only when an explicit configured agent pubkey exactly matches the
  harness signing identity and at least one exact macOS bundle identifier is
  configured
• accept only the installed Computer Use adapter's session-persistence bootstrap
  request for get_app_state, the active ACP session, and an allowlisted bundle;
  decline generic forms, cross-session requests, wrong apps, malformed schemas,
  and write-action bootstrap requests
• return session persistence only; never write the machine-wide Computer Use
  approvals file
• propagate the immutable policy through initial pool startup and every respawn
  or recovery path

The intended live configuration is Kamaljinder's exact signing identity with
com.apple.Photos and com.granola.app. Once bootstrapped, the resulting ACP
session approval is app-wide for that channel session, so later UI actions in
those two apps do not re-prompt; this is not a read-only or turn-only grant.

Native Computer Use live acceptance

• A fresh Desktop-managed Kamaljinder process started the exact
  23565511392457b177ed47a25f8ed9bb6be8d652 candidate with the identity-bound
  policy enabled for exactly two configured bundles.
• One signed, read-only channel probe requested accessibility trees from
  Photos, Messages, and Granola. Kamaljinder signed event
  7d9ad8365c72f862f6e5e20500025e21463c6cbbb96304b0c8c2fc4559b41301
  reporting that all three trees loaded, and signed appendix
  36b40a45475c63f8e4ddc9a31e0a8b6964bce3ef08240fd31ed3891a6f24a9bb
  recorded mutations=none and database_access=none.
• Relay thread readback returned the exact probe, result, and appendix from the
  intended signing identities and thread.
• Before and after the fresh-session probe, the machine-wide Computer Use
  approvals file remained byte-identical at SHA-256
  986985bca72e536a7632551a29220e6e7853d2c574d9c6b99bdc9e548594c630.
  It still contains Messages plus the pre-existing system/browser apps; Photos
  and Granola were not added globally.

Dependency and merge gate

Paired adapter change: agentclientprotocol/codex-acp#368.

Do not merge this PR until the compatible adapter is available to the Buzz package/runtime. Live acceptance must also pass on Luna with a fresh session: one channel mention, one DM, and one forced material heartbeat, each accepted once and read back from the intended destination without require_escalated or EAI_NONAME.

The native Computer Use bridge live acceptance above has passed. The pull
request remains draft and must follow the normal Apps manual review and merge
gate.