MIKE-49 checkpoint 1: Desktop fixture-only audit command

[michaelerobertsjr]

Scope

Checkpoint 1 of the Desktop UI entry point for MIKE-49 (owner interface Proposal A — see buzz-auditor docs/superhero/plans/mike-49-owner-interface-decision-brief.md). This PR is fixture-only and simulated-data-only:

• A new Rust module desktop/src-tauri/src/commands/mike49_audit/ (fixture.rs, sanitize.rs, command.rs) builds a small, deterministic, disposable-key (nostr::Keys::generate()) fixture in-process, reusing the reviewed nip-am-verify crate's verify_and_decrypt, SessionCoverageTracker, and cursor/pagination API unmodified.
• A new mike49_run_fixture_audit Tauri command (registered in lib.rs's invoke_handler) takes no AppState parameter and returns an explicit #[derive(Serialize)] report struct with "simulated": true / "dataSource": "in_memory_fixture" always present.
• A new Settings > Experiments panel (Mike49AuditFixturePanel.tsx, mounted in the existing ExperimentalFeaturesCard.tsx — no new navigation/routing pattern invented) with an explicit run button (no auto-run on mount), loading/success/failure states, a visibly distinct capped/incomplete-vs-complete pagination indicator, an empty-fixture-source probe, and a duplicate-run guard.

Dependency decision (record before further code)

Tried a source-control dependency first:

nip-am-verify = { git = "ssh://git@github.com/cccareers/buzz-auditor.git", rev = "83db37a" }

cargo tree failed — Cargo's built-in (libgit2) transport could not authenticate to the private repo, even though the system CLI in the same environment authenticates fine (verified separately with ssh -T git@github.com):

error: failed to get `nip-am-verify` as a dependency of package `buzz-desktop`
Caused by: failed to load source for dependency `nip-am-verify`
Caused by: unable to update ssh://git@github.com/cccareers/buzz-auditor.git?rev=83db37a
Caused by: failed to authenticate when downloading repository
  * attempted ssh-agent authentication, but no usernames succeeded: `git`
  if the git CLI succeeds then `net.git-fetch-with-cli` may help here
Caused by: no authentication methods succeeded

net.git-fetch-with-cli = true would likely fix this but is a repo-wide Cargo config change out of scope for this checkpoint.

Fell back to a path dependency, per the plan:

nip-am-verify = { path = "../../../buzz-auditor/tools/nip-am-verify" }

Caveat, explicit and not hidden: this assumes buzz-auditor is checked out as a sibling directory of buzz (REPOS/buzz and REPOS/buzz-auditor under the same parent). It is not CI-portable and not merge-ready as-is — a checkpoint-1-only provisional choice pending vendoring, a fixed transport config, or a real registry dependency. Full reasoning is inline in desktop/src-tauri/Cargo.toml's comment above the dependency line.

Sanitizer

sanitize.rs ports buzz-auditor's Python sanitizer discipline (nip_am_pipeline_bridge.py/nip_am_verify_bridge.py/report_safety.py) to Rust: field allowlist, credential-shaped-value detection (including values nested inside a sub-object), kind type-checked before allowlist lookup, numeric validators, per-kind blocked counts, fixed content-free error messages. Since this runs natively in one Rust process (no subprocess boundary like the Python bridge has), the real safety property is structural: only the explicit #[derive(Serialize)] report struct ever crosses into the Tauri command's return value. The sanitizer is wired live into the command path (not just unit-tested decoration) as a second, redundant gate.

Explicitly NOT touched / NOT done

• No real keys, no real relay, no archive, no native_relay_client — verified by grepping desktop/src-tauri/src/commands/mike49_audit/ for those names (only appears in doc comments explaining what is absent).
• No merge to main, no live validation run — held for a later, separately-approved step per the MIKE-49 plan.

Verification (real output, not estimates)

• cargo check --manifest-path desktop/src-tauri/Cargo.toml -p buzz-desktop --lib — clean, 0 warnings.
• cargo clippy --manifest-path desktop/src-tauri/Cargo.toml --workspace --all-targets -- -D warnings (both default and --features mesh-llm graphs, matching just desktop-tauri-clippy) — clean.
• cargo fmt --manifest-path desktop/src-tauri/Cargo.toml --all -- --check — clean.
• cd desktop/src-tauri && cargo test --workspace — 3198 passed, 0 failed, 19 ignored in the main buzz_lib binary (includes 25 new tests in commands::mike49_audit::{fixture,sanitize,command}::tests), plus all buzz-terminal sub-crate suites green.
• pnpm typecheck (desktop) — clean, exit 0.
• pnpm check (biome) — no new errors; 4 warnings / 5 infos are pre-existing, in unrelated files.
• pnpm check:px-text, pnpm check:pubkey-truncation — clean.
• pnpm test (desktop) — 6494 passed, 0 failed, including 6 new component tests in Mike49AuditFixturePanel.test.mjs proving idle/loading/success (records + capped/incomplete pagination + empty-source probe)/empty-records/failure/duplicate-run-guard states against a stubbed Tauri IPC layer.
• node desktop/scripts/check-file-sizes.mjs — clean (largest new file: command.rs, 679/1500 lines).

Not done: launching the actual Tauri app for a visual/manual check — not practical in this environment. The component test file is the closest available substitute; a human should still click through Settings > Experiments once to visually confirm layout/styling.

Linked to https://linear.app/cccareersorg/issue/MIKE-49

---

Follow-up: reproducibility + evidence (commit 3baa50f)

Hannibal's review of aea3f8e found three gaps in the checkpoint-1 evidence. Fixed at 3baa50f:

1. Reproducible dependency pin, not a mutable sibling checkout. scripts/mike49-pin-nip-am-verify.sh reads the exact commit from desktop/src-tauri/NIP_AM_VERIFY_PINNED_REV (83db37a6f8fec5663227ceeb439b21c30d5d19ac) and materializes it as a detached-HEAD git worktree of cccareers/buzz-auditor at <this-checkout-toplevel>/.mike49-nip-am-verify-pinned — byte-exact regardless of what branch the sibling REPOS/buzz-auditor checkout happens to be on. Cargo.toml's path dependency now points at that fixed location, which also fixes the previously-documented nested-worktree relative-path break (../../../ resolved to the wrong place from inside .claude/worktrees/<id>/) without a manual edit and without vendoring buzz-auditor source into block/buzz. Verified: git -C .mike49-nip-am-verify-pinned rev-parse HEAD == the pinned rev; cargo tree -p buzz-desktop -i nip-am-verify resolves to that exact worktree path.

2. Sanitizer parity against the pinned Python reference, with compared outputs. New test record_sanitizer_matches_the_pinned_python_reference_on_shared_examples in command.rs. testdata/sanitizer_parity_examples.json (10 scenarios: valid, invalid enum/nested-type values, credential-shaped values both top-level and nested inside cost.note, an unrecognized field, a malformed hex id) is fed to both this crate's RECORD_ALLOWED and a frozen, captured-verbatim run of the real collector.nip_am_pipeline_bridge.sanitize_pipeline_line from a git worktree of buzz-auditor pinned to the same 83db37a — not hand-written expectations. One scenario (related_event_id_present) is asserted as a documented, safe divergence: Python's allowlist validates a field this command's own fixture producer never emits, so RECORD_ALLOWED correctly omits it (narrower, never over-trusting).

3. Actual command-to-renderer flow, not just component tests. New desktop/tests/e2e/mike49-audit-fixture.spec.ts, wired into src/testing/e2eBridge.ts's real mock-IPC layer (mockIPC from @tauri-apps/api/mocks), run via pnpm test:e2e:smoke. Three specs exercise the real click → invoke("mike49_run_fixture_audit") → render path (not a mocked React prop): explicit-run idle→loading→success with the two real fixture scenarios rendered, a rejected-invoke failure state showing the fixed error copy, and the duplicate-run guard (a second dispatched click during loading does not trigger a second invoke call, verified by intercept-counting window.__TAURI_INTERNALS__.invoke). This is still not the compiled native Tauri app — a human click-through is still the only way to visually confirm layout/styling — but it is a real IPC round trip through a rendered page, not JSDOM-rendering the component in isolation.

Full verification at 3baa50f, Hermit-activated (rustc/cargo 1.95.0), pinned dependency, from this exact worktree:

• cargo test (workspace) — 3199/3199 passed, 0 failed, 19 ignored (was 3198; +1 for the new parity test).
• cargo clippy --all-targets -- -D warnings — 0 warnings.
• cargo fmt --check — clean.
• pnpm typecheck — clean.
• pnpm test (component) — 6494/6494 passed.
• pnpm check (biome + px-text + pubkey-truncation) — no new errors (4 warnings / 5 infos are pre-existing, unrelated files).
• just file-size-check — clean.
• pnpm build:e2e && npx playwright test --project=smoke mike49-audit-fixture — 3/3 passed.

Still fixture-only, still no real keys/events/relay/archive access, no merge.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 051c3a270be9c73da9ab06700bcab7d5552fceaa...2895cc8197a7519ed11de4a0330d24df6ee9a0c1.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 2895cc8197a7519ed11de4a0330d24df6ee9a0c1 to authorize a new review.
Any previous review applies only to its recorded range.