HOLD — no live activation

This PR is a disabled source checkpoint for six AEON Aspect buzz-acp workers. It does not install, load, start, restart, switch, or mutate any live Gateway, session, token, worker, Fleet policy, or Concilium path. It makes no Voxis, A2A, or live-canary claim.

What it hardens

• Canonical private ephemeral-room admission: positive ttl, valid future ttl_deadline, deterministic latest kind-39000 selection, strict singleton-tag parsing, exact h tag, and fail-closed revocation on expiry/archive/membership removal/query failure. Stale malformed metadata can recover through a newer valid canonical event; malformed canonical or unorderable evidence remains closed.
• Runtime receipt correlation from triggering request through ACP evidence to one cryptographically verified reply using exactly one canonical prompt anchor; delayed duplicates fail closed. Thread-root follow-ups reuse their effective root anchor while an exact pre-turn event-ID baseline excludes replies from earlier turns.
• Opt-in trusted inbound-event transport: one signature-verified event is carried outside prompt text at _meta.buzz.inboundEvent; invalid, ambiguous, multi-event, cancelled/merged, and heartbeat turns fail closed with no envelope.
• Stable fixed Gateway sessions with --require-existing, --no-memory, and --no-base-prompt; Gateway remains the identity, tools, skills, memory, and compaction owner.
• Existing Buzz ACP behavior is pinned explicitly: one process, queue/queue handling, presence/typing/observer on, bounded context, heartbeat/count rotation off, timeouts fixed, and Architect-approved bypassPermissions posture. No Buzz MCP/model/system/team/initial prompt is injected.
• Private-office and invited-huddle rules accept the native kind-9 and kind-40002 stream-message surfaces while retaining exact room, exact h, Architect author, and huddle mention gates.
• One-handle O_NOFOLLOW Aspect key reads with current-user/0600/expected-pubkey checks.
• Six deterministic, secret-free LaunchAgent previews with RunAtLoad=false, KeepAlive=false, Fleet placeholders, and one-worker rollback labels.
• Real six-TOML load_rules() and Clap parsing tests plus package validators. Receipt mode now requires verified owner authority before startup, and no-argument LaunchAgent rendering uses the checked-in OSS fixture.

Proof

• node --test deploy/local/aeon-aspects/worker.test.mjs — 10/10
• node deploy/local/aeon-aspects/validate.mjs — OK
• cargo test -p buzz-acp — 602/602, including canonical metadata ambiguity/recovery, stable-thread-root receipt isolation, two-turn thread-root, top-level-DM, and trusted-envelope contracts
• cargo clippy -p buzz-acp --all-targets -- -D warnings — green
• just ci — format, workspace clippy, Desktop/web/mobile checks, Rust/JS tests, Desktop/Tauri builds, and mobile tests green on final head
• pre-push rust-tests, desktop-tauri-test, and branch-skew — green
• git diff --check — clean
• detect-secrets + manual changed/generated-file scan — no secrets; reported examples/test hex only
• All currently submitted automated review threads are addressed and resolved on the current head.

Does not prove / resume blockers

• The AEON-v6 ACP run-ID/trusted per-run tool-context and Nexus reply-tool counterparts are accepted source commits awaiting Fleet's joined main checkpoint; they are not proven in a live immutable generation.
• The fixed Nexus session's caller-bound outbound Buzz publisher/signing path is source-reviewed but not yet proven live.
• Exact live relay membership is not proven by the identity-map declaration.
• Cross-process exactly-once is not durable; unattended restart therefore remains disabled.
• Kind-48106 huddle guideline delivery, broad avatar metadata, and spoken-huddle proof remain open.
• Workflow approval/multi-room behavior, media mutations, Concilium speech, broad A2A speech, and the other five live workers remain outside the Nexus text canary.

Nexus-only resume checklist

After Fleet releases the runtime lock, all of these are required before requesting a separate Architect Nexus-only canary GO:

1. Supply the immutable Gateway generation identity and immutable OpenClaw binary path.
2. Prove pre-existing agent:main:buzz-private and current openclaw acp --require-existing flag behavior.
3. Supply the owned token-file path and read back: absolute, regular, non-symlink, current-user owner, mode 0600.
4. Supply an ACP wire fixture with fixed sessionKey and a fresh per-prompt runId.
5. Prove a caller-bound Nexus-session outbound Buzz publisher that cannot select an arbitrary Aspect and emits a Nexus-signed exact reply anchor.
6. Verify the live Nexus private room contains exactly Architect and Nexus.
7. Confirm the legacy aeon-buzz reply path is disabled and no Gateway switch/restart/validation is in progress.
8. Render replacements for Nexus only, start one worker only, perform one request/reply, retain both event IDs + session key + run ID, and materialize the receipt.
9. Roll back only org.aeon.buzz-acp.nexus if any proof fails.

The other five workers remain disabled and require separate later authorization.