Clean up Buzz envelopes and auto-register memberships

[olegbrok]

Outcome

Cleans up Buzz inbound envelopes and makes newly granted Buzz memberships usable without manual database edits. Known contacts render from an explicit per-agent trust registry; unknown contacts remain fully attributable and visibly untrusted.

What changed

• Adds the platform-general verified_contacts table and agent-scoped registry methods plus GET / PUT / DELETE /agents/{name}/verified-contacts owner API surfaces.
• Ships a one-shot seed for Barsik's verified Brad owner principal (buzz:posspecialists:90425c…) with name=Brad and role=owner; fresh installs retry the seed when Barsik is first registered.
• Renders known Buzz senders as from:Brad (owner) principal:90425c785cf2…; registry names always override sender-supplied names.
• Keeps unknown senders on the full-principal display_name(untrusted) path. Unknown principals claiming a registered name are flagged as untrusted+collides:<registered-name>.
• Removes the duplicated Buzz channel ID while preserving full msg_id and one full chat_id for outreach calls. Telegram group and DM header bytes are unchanged.
• Auto-registers configured Buzz channels in group_chats at subscription time and again on first authorized inbound, preserving operator aliases.
• Opens one community-global membership REQ with the exact filter {"kinds":[44100,44101],"#p":["<agent-pubkey>"]}.
• Reconciles stored membership history before opening any channel REQ, then handles live adds by admitting/registering the channel and opening one channel-local REQ without restart. Removes revoke the inbound gate, deactivate the channel, discard pending rows, and close the live REQ.
• Rejects pre-membership channel history on dynamically opened REQs and prevents older membership history from reopening a newer removal.

Trust and routing impact

The contact registry is explicit and keyed by (agent_name, platform, principal); no contact is learned from traffic. Missing rows, an empty table, or lookup failures keep the current full-principal unknown rendering and never blank or crash the sender slot.

Membership changes require a BIP340-valid event received on the authenticated relay connection with exactly one canonical self p tag and one canonical channel h tag. Runtime identity, subscriptions, contacts, and group-chat registration remain per-agent; the Brad row is only the caller-specified deployment seed.

Deliberate 1059 split

Kind 1059 is not included in this PR's filter. The tree has no NIP-17 gift-wrap/NIP-44 unwrap path, and subscribing now would make PinkyBot appear DM-capable while silently swallowing messages it cannot decrypt.

Follow-up work must first decide the NIP-44 dependency strategy (maintained library vs. reviewed vendored implementation), then add authenticated unwrap/decrypt, authorization, routing, and adversarial tests end to end. Only after that should kind 1059 join the #p-gated REQ.

Validation

• env -u PINKY_DREAM_TRANSPORT PYTHONPATH=src ... pytest -q tests/test_agent_registry.py tests/test_broker.py tests/test_buzz_inbound.py tests/test_buzz_inbound_poller.py tests/test_verified_contacts.py — 224 passed
• ruff check . — passed
• source py_compile — passed
• git diff --check — passed
• broader local run reached 695 passed / 1 skipped before the host's production PINKY_DREAM_TRANSPORT=tmux override escaped an SDK-mocked dream test; that exact test passes independently with the override removed. GitHub CI remains the clean full-suite gate.

Barsik's pre-merge production-relay probe remains required for the exact 44100/44101 #p filter. No relay credentials or live fan-out probe were used in this build lane.

Boundaries

No production database, identity, relay subscription, release, daemon, or deployment state was changed. This draft does not authorize merge or deploy.

---

🤖 Opened by Kuzya