feat(mesh): upgrade to mesh-llm 0.76.0-rc8 and recommend Qwen3.8 27B

[micspiral]

Upgrades Buzz's mesh-llm dependencies through the released v0.76.0-rc8 tag (2040765d), including the Qwen3.8 curated recommendation and rc8's scheduler/runtime improvements.

Scope note: the earlier open-relay/unenforced-admission mode has been removed from this PR at Mic's direction — it is not a product mode we want. Mesh admission remains roster/allowlist driven, exactly as on main: on a relay with no NIP-43 membership snapshot the mesh runs self-only. No NIP-11 mode probing, no mode-transition restarts. A future perimeter/admission strategy for open relays will be designed separately.

This PR also:

• seeds BUZZ_AGENT_LLM_TIMEOUT_SECS=660 for mesh agents, above MeshLLM's 600-second backend timeout;
• makes desktop-tauri-clippy lint both default and mesh-llm cfg graphs;
• runs the feature-enabled desktop test suite in CI;
• recommends Qwen3.8 27B Q4_K_M for larger machines, then ladders down through Gemma 4 E4B and Qwen 9B for smaller machines;
• keeps stored shared-compute auto translated to MeshLLM's supported wire model mesh.

RC8 verification:

• just ci passed locally at 92ecc7ec933bdd4df804cc9f28a2b51efa5313c5.
• Pre-push differential gates passed, including both desktop Tauri cfg graphs and package tests.
• A prior isolated runtime smoke used the RC8 binary's OpenAI endpoint for a Buzz-shaped system/user/tool/tool-result/final-response loop; all assertions passed and the isolated process was shut down.

Perf previously measured on M5 Metal, Qwen3.8-27B-Q4_K_M: TTFT 0.22–0.32 s, ~25 tok/s streaming; agent-shaped turns ~1 s to first token after the first (prefix cache).

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Requesting changes at cbba75536e9226c760e49cb75281a3e79d20783c for two admission-contract gaps: a running open mesh never tightens after the relay begins enforcing membership, and malformed supported_nips elements can fail open. All reported CI checks are green at this head, but they do not cover these authority transitions and malformed-input boundaries.

[michaelneale]

thanks @wesbillman, addressed

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Re-reviewed head 34e31f7e against base cada3028. One admission blocker remains.

The malformed supported_nips path is fixed and now fails closed, but the open-to-closed transition can still retain a live open admission policy when the first closed membership snapshot is unavailable. Once NIP-11 has proven that the relay is closed, that state must survive roster-read failure so the existing TrustPolicy::Off runtime is replaced by a fail-closed/self-only runtime rather than kept open. Please add a regression test for open → closed → unavailable roster.

Non-blocking test-adequacy note: the desktop mesh unit tests are feature-gated out of normal CI, and just mesh-e2e filters on mesh_llm, so the new managed_agents::relay_mesh::tests timeout cases are not selected there either. Please give the feature-enabled tests an automated execution path; otherwise these admission and timeout regressions have little durable protection.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 00e61eafa917d296104006576b7a2ddbfd58bb5a...92ecc7ec933bdd4df804cc9f28a2b51efa5313c5.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 92ecc7ec933bdd4df804cc9f28a2b51efa5313c5 to authorize a new review.
Any previous review applies only to its recorded range.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Re-reviewed head 0f1798e207bf9d16107cb35d4ab648dd683ccc6e against base 80177e4c8e97e7bf1f1a3760c4e3503aace22860.

The prior admission blocker is resolved. Once NIP-11 proves an open runtime's relay has tightened to membership enforcement, roster unavailability is now preserved as ClosedWithoutRoster and requests a process restart. Relaunch resolves the missing closed roster to Some([]), and normalized_roster applies a self-only TrustPolicy::Allowlist; a later roster recovery causes another restart into the recovered allowlist. Probe failure or malformed NIP-11 preserves the current policy, and an established nonempty closed allowlist never relaxes from a later open-mode report.

The feature-enabled test gap is also fixed: CI now runs cargo test --manifest-path desktop/src-tauri/Cargo.toml --features mesh-llm --lib. At this exact head the Desktop Core log executed 3,114 tests (3,095 passed, 19 ignored, 0 failed), including the NIP-11 re-probe, malformed-input, open→closed/roster-unavailable restart, routing, timeout, and catalog tests.

No actionable blockers found. Non-blocking test-adequacy note: the new regression coverage proves the critical transition through focused decision seams rather than one composed open → closed/unavailable → self-only relaunch → roster-recovery scenario. The implementation path is coherent and the relevant seams are CI-executed, so I am not keeping the PR blocked on that additional composition test.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Re-reviewed head 0f1798e207bf9d16107cb35d4ab648dd683ccc6e against base 80177e4c8e97e7bf1f1a3760c4e3503aace22860.

P1 — treat non-success NIP-11 responses as unknown, not as authority to disable admission. In desktop/src-tauri/src/commands/mesh_llm.rs:194-203, the probe calls send()?.json()? without error_for_status(). A 4xx/5xx response whose JSON has a valid supported_nips array without NIP-43 therefore resolves to OpenNoMembership. Initial startup then maps it to trusted_owner_ids = None / TrustPolicy::Off at lines 404-420; a self-only fallback runtime can likewise restart into unenforced mode through mesh_llm/coordinator.rs:267-272,399-407. This contradicts the function's own contract that HTTP errors preserve the current or fail-closed policy.

I reproduced this at the exact head by changing the existing NIP-11 mock's status line from 200 OK to 503 Service Unavailable while leaving its open/closed/malformed bodies intact. cargo test --manifest-path desktop/src-tauri/Cargo.toml --features mesh-llm --lib relay_mode_probe_rechecks_the_same_url_without_caching still passed: all three 503 bodies were parsed as mode evidence. Please reject non-2xx before parsing and add a regression asserting that a valid-shaped 4xx/5xx body remains an error.

All reported CI checks are green, including the 3,114-test feature-enabled Desktop Mesh run and relay-driven lifecycle smoke. No other blockers found in the dependency, catalog, hardware ladder, timeout, discovery, or open→closed roster-transition paths.