feat(agent): show completed work without reopening the full thread

[BradGroux]

Closes #2932.

Observed problem

Buzz already has signed agent job events, but kind:43004 results are opaque strings. A requester has to reconstruct the requested outcome, final state, artifacts, verification, and blockers from the full thread, and Home can expose structured content as raw JSON.

What changes

• Add a versioned JobResultPayload contract with dispositions, typed artifact references, verification results, explicit blockers, byte and item limits, unsafe-reference rejection, and cross-field invariants.
• Add a typed SDK builder and buzz jobs handoff --channel <uuid> --job <event-id> --manifest <path|->.
• Add a Desktop handoff card and human-readable Home projection.
• Keep legacy, malformed, unsupported, oversized, or tag-mismatched 43004 content on the existing Markdown fallback.
• Document the protocol and privacy boundary in docs/nips/NIP-AJ.md.

Trust and compatibility

The signed content is authoritative, while schema and disposition tags are query hints. Desktop only trusts structured content when the payload event ID matches the single signed reply tag.

Artifact references fail closed. URL-shaped references are parsed before kind-specific validation, including artifact kinds that also accept raw branch, canvas, workflow-output, or free-form references. Credential-bearing URLs such as https://user:secret@example.com/... are rejected in both Rust and Desktop instead of becoming clickable links.

Version 1 ignores additive unknown object fields. Older clients continue to see JSON content as ordinary text, and newer clients continue to render legacy plaintext results as Markdown.

Verification

Verified at exact head f387a8e9b75c4462df9073f3b442f12276d25fbe, rebased onto current main:

• Full affected Rust package suites for buzz-core, buzz-sdk, and buzz-cli.
• Full Desktop JavaScript suite — 3,737 tests passed.
• Desktop typecheck and E2E build.
• Strict Rust formatting and affected-package Clippy.
• Targeted Biome checks over the changed Desktop surfaces.
• Rust and Desktop regressions reject credential-bearing URLs for every artifact kind that can otherwise accept a raw reference.

The SDK signing test round-trips the canonical payload through the signed event shape. A live relay integration run was not performed in this worktree.

Non-goals

• No scheduler, worker loop, approval system, project-management surface, or local workspace scanner.
• No change to job acceptance or agent mention delivery.
• No new HTTP endpoint or production dependency.

[BradGroux]

Result handoff card

The same signed kind:43004 payload renders with distinct outcome, progress, artifact, verification, and disposition fields in both supported themes.

Light theme

Dark theme

[BradGroux]

I rebased this branch onto current main and re-audited the trust boundary around artifact references.

The structured handoff remains relevant and does not overlap the newer invite or Markdown parser changes on main. The review did find one real validation gap: artifact kinds that can accept raw references (branch, canvas, workflow_output, and other) could also accept a URL containing embedded credentials because their validators treated the value as an opaque raw reference first. Desktop could then render that value as a link.

Head f387a8e9b75c4462df9073f3b442f12276d25fbe parses URL-shaped values before kind-specific raw-reference validation and rejects embedded credentials consistently in Rust and Desktop. Regression coverage spans every affected artifact kind.

Verification was refreshed against the rebased tree: the full affected Rust package suites, all 3,737 Desktop JavaScript tests, Desktop typecheck and E2E build, strict Rust formatting/Clippy, and targeted Biome checks passed. A live relay submission was not rerun, so the proof remains the signed-event round trip plus the existing relay submission path.

[BradGroux]

Rebased this branch onto current block/buzz main at c55e421a0.

Head moved from fcb0edeea to 7d1c3bc43. The CLI test conflict was resolved by retaining both current main's user-status parser coverage and this branch's jobs handoff parser coverage. The current message-row changes from main also remain intact alongside the inspectable job-result card.

Verification:

• The full buzz-core, buzz-sdk, and buzz-cli test suites passed.
• Strict Clippy passed for those three packages with all targets and warnings denied.
• Desktop Biome, file-size, text-size, and pubkey-truncation checks passed.
• The full Desktop test suite, TypeScript typecheck, and production Vite build passed on the final rebased branch.
• git diff --check, DCO trailer checks, and the direct merge-base audit passed.

GitHub checks are rerunning on the new head.