[bradseiler]

Summary

Editing attachment messages through buzz messages edit can remove their files from the effective message. Preserve the latest live imeta set across successive edits and add --clear-attachments for explicit removal. Add an SDK builder for complete replacement attachment sets while preserving the existing API.

The relay provides a versioned effective-edit lookup on /query for kinds 9/40002/40008/45001/45003; media reads fold the same set. It uses the existing normalized-target index, fresh channel authorization, and a primary snapshot. Generic #e matching is unchanged. Mixed-case historical edits cannot restore removed files, including when another reference would allow republication.

Related issue

Fixes #3022. Follows #9077. Related open attempts: #3062 and #3065.

Testing

Published head: c630c4ebf0b20a9618f4844629eec1e666699cbe, through all mandatory push hooks. The governed-five snapshot passed all four PostgreSQL/HTTP acceptance tests with RUST_MIN_STACK unset and 3,333 affected-package tests. The committed test-only array correction passed clippy and the preflight rerun.

Independent mutations detected dropped read/lookup kinds, the CLI two-kind split, and preflight ordering, channel and live-edit errors. The published follow-up adds forum preview retention/suppression and a deleted-original preflight fixture; both surviving mutations now fail as intended. Independent review verified the fixes. All four acceptance tests pass; the full DB/relay run had two NIP-FI failures that passed in isolation. The actual standalone MCP workflow passed against this relay and clean local app 5b583b8c69596353bc37e9f3938eca1aabcd081e: 15 MCP edits, 10 direct publications and 60 member GET/HEAD checks across five isolated blob pairs. Publication of that tested app head, hosted checks and human upload → edit → clear → edit → GET/HEAD confirmation remain pending. No human acceptance is claimed.

Rollout

The lookup, CLI preservation/clear and media reads use kinds 9/40002/40008/45001/45003. Deploy the relay before releasing the CLI and paired MCP producer. New clients abort without publishing against an unsupported relay. Old CLI edits emit empty imeta and now revoke diff/forum attachments that previously remained readable. Other channel-tagged kinds retain the historical plain-edit path. No additional schema change is needed beyond migration 0086.

Readiness remains blocked by mobile edits that omit imeta, the app UI fold that can restore older files, unaudited SDK/direct callers and unmeasured historical exposure. Run docs/sql/private-media-edit-preflight.sql for each community; producer updates do not repair signed historical edits. No enforce activation is authorized. off skips policy checks, shadow changes policy metrics while allowing policy failures, and enforce denies inaccessible references.

Observe buzz_media_publication_access_total{mode="shadow",reason="denied"}. Prefer rolling back the client release while retaining the additive lookup. A relay rollback makes new CLI/MCP edits fail closed; already-published imeta remains valid under the older reference rules. Concurrent edits still use (created_at,id) without compare-and-swap.

Generated with Codex

[github-actions]

🔐 Codex Security Review

Note: This is an automated, security-focused review generated by Codex.
Use it as a supplement to human review; false positives are possible.

Scope

• Exact PR diff: f3b127e3af5c14d2314faa2b63556c3f51ec6743...c630c4ebf0b20a9618f4844629eec1e666699cbe
• Model: gpt-6.1-sol

💡 Click "edited" above to see earlier reviews for this PR.

---

Review Summary

Overall Risk: NONE

No concrete security, correctness, or reliability findings identified in the authorized PR range.

Findings

No concrete security, correctness, or reliability findings were identified.

Notes

• Review used read-only source and history inspection. Builds and tests were not executed, as instructed.

---

_{Generated by Codex Security Review |
Requested by: @bradseiler |
Workflow run}

[wpfleger96]

🤖 Approving. I checked the parts that carry the risk:

• Read authorization on the new effective_edit lookup. It runs after relay-member admission and the existing /query gates. Its SQL rule (channel not deleted, and visibility='open' or an active channel_members row) matches what get_readable_named_only_channels grants a filter that names the channel. It then applies event_visible_to_reader to both the original and the edit, so a reader gets nothing here that the normal explicit-channel read wouldn't give them. Missing and inaccessible both return the same 404.
• Edit selection. The latest-edit SQL doesn't filter by pubkey. That's fine because validate_edit_ownership only accepts 40003s from the effective author or the owning human, so every stored live edit already comes from an authorized editor. Carried files are still publication-checked per signer.
• CLI. It refuses to publish unless it gets the exact v1 envelope back, so a new CLI against an old relay fails closed. It re-checks the returned original's id, kind and channel. Stamping max(now, head+1) with a 60s ceiling stays well inside the relay's 900s future bound.
• SDK. Rejecting non-imeta tags in build_edit_with_media closes off injecting a target, channel or auth tag.

Nonblocking:

• The PostgreSQL and E2E lanes were still running when I looked, and the description mentions two Postgres fixture fixes that haven't been pushed yet. Once they land, the Testing paragraph's in-progress status can come out.
• buzz-relay now has a dev-dependency on buzz-cli just for the CLI end-to-end test. That's reasonable, but it does grow the relay's test build graph.