feat: add reputation provider foundation

.github/workflows/ci.yml

@@ -745,6 +745,17 @@ jobs:
             --run-ignored ignored-only
         env:
           DATABASE_URL: postgres://buzz:${{ env.BUZZ_TEST_POSTGRES_PASSWORD }}@localhost:5432/buzz
+      - name: Web-of-Trust event lifecycle contract
+        # Verifies the persistence/query semantics of kinds 1985, 10040 and
+        # 30382 against real Postgres: accumulation, replacement, equal-time
+        # ties, author/coordinate isolation, deletion, and stale-replay fences.
+        run: |
+          cargo nextest run \
+            --archive-file target/ci/backend-integration-tests.tar.zst \
+            -E 'package(buzz-db) and test(web_of_trust_event_lifecycles_persist_and_query_exactly)' \
+            --run-ignored ignored-only
+        env:
+          DATABASE_URL: postgres://buzz:${{ env.BUZZ_TEST_POSTGRES_PASSWORD }}@localhost:5432/buzz
       - name: Upload relay log
         if: failure()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7

.github/workflows/docker.yml

@@ -178,8 +178,10 @@ jobs:
           outputs: type=image,name=${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=${{ github.event_name != 'pull_request' }}
           cache-from: |
             type=registry,ref=${{ env.IMAGE_NAME }}-buildcache:${{ matrix.arch }}
+          # Only block/buzz owns the default cache namespace. Fork repositories
+          # may still consume its public cache, but must not try to update it.
           cache-to: |
-            ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && format('type=registry,ref={0}-buildcache:{1},mode=max,compression=zstd', env.IMAGE_NAME, matrix.arch) || '' }}
+            ${{ github.repository == 'block/buzz' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && format('type=registry,ref={0}-buildcache:{1},mode=max,compression=zstd', env.IMAGE_NAME, matrix.arch) || '' }}
 
       - name: Build and push debug image by digest
         id: build-debug
@@ -402,7 +404,7 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
           outputs: type=image,name=ghcr.io/block/buzz-push-gateway,push-by-digest=true,name-canonical=true,push=${{ github.event_name != 'pull_request' }}
           cache-from: type=registry,ref=ghcr.io/block/buzz-push-gateway-buildcache:${{ matrix.arch }}
-          cache-to: ${{ (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && format('type=registry,ref=ghcr.io/block/buzz-push-gateway-buildcache:{0},mode=max,compression=zstd', matrix.arch) || '' }}
+          cache-to: ${{ github.repository == 'block/buzz' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && format('type=registry,ref=ghcr.io/block/buzz-push-gateway-buildcache:{0},mode=max,compression=zstd', matrix.arch) || '' }}
       - name: Export digest
         if: github.event_name != 'pull_request'
         env:

crates/buzz-acp/src/lib.rs

@@ -229,17 +229,23 @@ async fn fetch_relay_dkg_capabilities(relay_url: &str) -> Result<DkgCapabilities
 }
 
 async fn relay_dkg_capabilities(relay_url: &str) -> DkgCapabilities {
-    for attempt in 0..DKG_CAPABILITY_ATTEMPTS {
+    let attempts = DKG_CAPABILITY_RETRY_DELAYS
+        .iter()
+        .copied()
+        .map(Some)
+        .chain(std::iter::once(None));
+    for (attempt, retry_delay) in attempts.enumerate() {
         match fetch_relay_dkg_capabilities(relay_url).await {
             Ok(capabilities) => return capabilities,
-            Err(error) if attempt + 1 < DKG_CAPABILITY_ATTEMPTS => {
-                let delay = DKG_CAPABILITY_RETRY_DELAYS[attempt];
-                tracing::warn!(attempt = attempt + 1, %error, ?delay, "relay capability discovery failed; retrying");
-                tokio::time::sleep(delay).await;
-            }
-            Err(error) => {
-                tracing::warn!(attempt = attempt + 1, %error, "relay capability discovery failed; DKG memory disabled for this agent session");
-            }
+            Err(error) => match retry_delay {
+                Some(delay) => {
+                    tracing::warn!(attempt = attempt + 1, %error, ?delay, "relay capability discovery failed; retrying");
+                    tokio::time::sleep(delay).await;
+                }
+                None => {
+                    tracing::warn!(attempt = attempt + 1, %error, "relay capability discovery failed; DKG memory disabled for this agent session");
+                }
+            },
         }
     }
     DkgCapabilities::default()