Result handoff card

The same signed kind:43004 payload renders with distinct outcome, progress, artifact, verification, and disposition fields in both supported themes.

Light theme

Dark theme

I rebased this branch onto current main and re-audited the trust boundary around artifact references.

The structured handoff remains relevant and does not overlap the newer invite or Markdown parser changes on main. The review did find one real validation gap: artifact kinds that can accept raw references (branch, canvas, workflow_output, and other) could also accept a URL containing embedded credentials because their validators treated the value as an opaque raw reference first. Desktop could then render that value as a link.

Head f387a8e9b75c4462df9073f3b442f12276d25fbe parses URL-shaped values before kind-specific raw-reference validation and rejects embedded credentials consistently in Rust and Desktop. Regression coverage spans every affected artifact kind.

Verification was refreshed against the rebased tree: the full affected Rust package suites, all 3,737 Desktop JavaScript tests, Desktop typecheck and E2E build, strict Rust formatting/Clippy, and targeted Biome checks passed. A live relay submission was not rerun, so the proof remains the signed-event round trip plus the existing relay submission path.

Rebased this branch onto current block/buzz main at c55e421a0.

Head moved from fcb0edeea to 7d1c3bc43. The CLI test conflict was resolved by retaining both current main's user-status parser coverage and this branch's jobs handoff parser coverage. The current message-row changes from main also remain intact alongside the inspectable job-result card.

Verification:

• The full buzz-core, buzz-sdk, and buzz-cli test suites passed.
• Strict Clippy passed for those three packages with all targets and warnings denied.
• Desktop Biome, file-size, text-size, and pubkey-truncation checks passed.
• The full Desktop test suite, TypeScript typecheck, and production Vite build passed on the final rebased branch.
• git diff --check, DCO trailer checks, and the direct merge-base audit passed.

GitHub checks are rerunning on the new head.

Rebased onto current main at b1b283cd4c7f926e12eeee8ae1f38c7471922b16 and re-audited #2932 against the current open-PR landscape. #3877 explicitly leaves structured handoff cards out of scope, so this work is not superseded.

A clean-context review found three gaps that are now repaired:

• The relay now admits job lifecycle kinds 43001 through 43006 under channel-scoped messages:write authorization and requires the signed h tag.
• Rust and Desktop now reject Windows rooted and UNC file references in addition to POSIX absolute and drive-letter paths.
• Empty-artifact copy distinguishes blocked and failed results from an intentional no_artifact completion.

Exact-head verification on 372308646b32fff1fe2324c7977c8207e0992d04:

• Full Rust suites for buzz-core, buzz-sdk, and buzz-cli passed.
• The three relay admission, channel-scope, and migrated-kind regressions passed.
• Full Desktop JavaScript suite: 3,901 passed, 0 failed.
• Desktop lint, file-size ratchet, typecheck, and production build passed.

No live remote relay was used. A complete relay library run reached 825 passed and 35 ignored, but nine unchanged admin/media tests could not acquire their local Postgres fixture (Sqlx(PoolTimedOut)); an isolated rerun reproduced the same missing-fixture failure. The changed relay boundary is covered by the passing authorization and scope regressions, and the signed SDK event shape is round-tripped in tests.