feat(acp): add BUZZ_GIT_IDENTITY switch for agent commit identity

[wpfleger96]

🤖 This adds an operator switch for whose identity an agent's commits carry, and removes the reason agents were clearing their git identity env vars. Replaces #6177.

Since #7819, every agent authors and signs commits as its nostr identity through GIT_CONFIG_* env vars, which beat repo and global config in every shell the agent runs. Operators had no way to opt out of that.

BUZZ_GIT_IDENTITY=agent|user. It's read once in GitEnvironment::install. Unset or agent keeps today's behavior. user keeps only relay git auth (the credential helper and keyfile) and installs no identity, no git-sign-nostr and no signing config, so git uses the operator's own config. It also drops inherited GIT_CONFIG_* entries for the agent identity and signing keys, author.*/committer.*, and include.path/includeIf.*.path, so a nested agent in user mode can't pick up its parent agent's identity. Any other value fails startup with an error naming the variable and both allowed values. The resolved mode is forwarded in the managed env to MCP servers, which buzz-agent starts with a cleared env, so a nested buzz-acp launched from an MCP shell keeps the operator's choice instead of falling back to agent.

Known limitation: in user mode, an operator whose own git config signs with git-sign-nostr has commits refused with a key-mismatch error, because the agent shell's BUZZ_PRIVATE_KEY (needed by the buzz CLI) loads ahead of nostr.keyfile and NIP-GS requires the signer to exit when the loaded key doesn't match -u. Nothing is signed with the wrong key. SSH and GPG signing are unaffected.

Desktop reserves GIT_CONFIG*. User env overrides are layered onto the spawn command after the relay credential helper, so a single GIT_CONFIG_COUNT=0 used to silently drop it. GIT_CONFIG and every GIT_CONFIG_* name are now reserved keys.

session_new_forwards_complete_git_block_without_duplicate_names no longer reads the runner's env. Run inside an agent session, it picked up the session's own inherited GIT_CONFIG_* and failed. Agents worked around that by unsetting GIT_CONFIG_COUNT, and any commit made in that shell fell back to the human's git identity and signing key. The test now hides the runner's GIT_CONFIG* and BUZZ_GIT_IDENTITY under ENV_LOCK and restores them afterwards.

Agent instructions. base_prompt.md and the nest AGENTS.md now say the runtime sets the agent's commit identity and signing, and that agents shouldn't override them with user.* config, -c user.*, --author or another signing key. Trailers are added only when the repository or the person the agent works for requires them. If a repository requires a different author, the agent tells the operator, who can switch to BUZZ_GIT_IDENTITY=user, instead of overriding the identity. The nest AGENTS.md scopes this to agents Buzz runs through its stock buzz-acp harness, and notes that custom harnesses get only relay git auth and control their own attribution. NEST_AGENTS_VERSION goes from 5 to 6.

[github-actions]

🔐 Codex Security Review

Note: This is an automated, security-focused review generated by Codex.
Use it as a supplement to human review; false positives are possible.

Scope

• Exact PR diff: 04b040ef6ce1a748fb2418340735cfc04e0fd8f4...d81fb788d3e91ecfaa1b90db3418172f99e4e5cc
• Model: gpt-5.6-sol

💡 Click "edited" above to see earlier reviews for this PR.

---

Review Summary

Overall Risk: NONE

No concrete security, correctness, or reliability defects were identified in the authorized PR range.

Findings

No concrete security, correctness, or reliability findings were identified.

Notes

• Review used read-only source and history inspection; tests and repository scripts were not executed as instructed.

---

_{Generated by Codex Security Review |
Requested by: @wpfleger96 |
Workflow run}

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Two reproducible P2 blockers in the new opt-out behavior; details and required fixes are inline. Also noted one optional documentation qualification. Please address both runtime findings with process-boundary regressions before merge.

Reviewed base d56ed75424d803cf29b2f1f4f430ee81dc145f92 → head c2968c73ca12f266778d6f61bff0b34a0075eda2. Built the ACP, agent, and MCP binaries at the clean head; exercised real Git commits through native adapter and full task-harness/agent/MCP chains using disposable repositories and a deterministic local model. No live relay or Desktop app was involved. Independent Desktop/config and Git/signing review lanes completed.

Existing Rust unit/lint/Windows CI passes; broad suites were not duplicated locally. Latest snapshot still has Desktop Core running and smoke shard 2 failing on empty-edit-delete.spec.ts:51 (missing alertdialog). That UI failure is separate from these findings; its cause was not investigated.

addressed

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Re-review: the MCP propagation blocker is fixed, and the optional custom-harness documentation correction is addressed. No new defects found in the revision.

One prior P2 remains: operator Nostr signing in user mode. I reproduced the same failure at the new head. The author explicitly deferred it and documented the limitation; that is a proposed scope exception, not a verified fix. I retain this recommendation pending a fix or Wes’s explicit acceptance of that exception. No additional code objections if the exception is accepted.

Reviewed base d56ed75424d803cf29b2f1f4f430ee81dc145f92 → head d81fb788d3e91ecfaa1b90db3418172f99e4e5cc, concentrating on the delta since c2968c73. Rebuilt the three runtime binaries at the clean head. The actual task-harness → agent → MCP → shell → nested harness chain now preserves user; both commits use the operator identity, unsigned. Unset/explicit agent modes still produce verified agent signatures. Native-adapter and inherited-config controls also passed. Independent source/test review of the fix found no new blockers.

Existing Rust CI and all four Desktop smoke shards pass; Desktop Core is still running. Broad suites were not duplicated locally. No live relay or Desktop app was exercised.

Carl, automated reviewer via Wes’s account: withdrawing my blocking recommendation. The documented, intentionally deferred Nostr-signing limitation is narrow and fail-safe; recommend treating it as non-blocking. Finding remains valid, not fixed.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Revised recommendation: non-blocking; suitable for human approval at d81fb788d3e91ecfaa1b90db3418172f99e4e5cc. My remaining finding is technically correct, but I overweighted it as a merge blocker. The intentionally deferred, documented Nostr-signing limitation affects a narrow opt-in configuration and fails closed by rejecting the commit; it does not silently sign as the wrong identity. I recommend accepting that limitation for this PR, rather than requiring signer/auth redesign here.

The MCP propagation fix remains verified, the custom-harness wording is corrected, and no other code objections remain. This supersedes my blocking recommendation; the limitation is not fixed, and I am not claiming Wes has separately accepted it. No approval is submitted on Wes’s behalf.

Head is unchanged from the process-level re-review. Current CI snapshot has no failures; Desktop Core is still running, so merge remains subject to required checks.