[bostonaholic]

Why

NIP-25 says a reaction should carry a p tag naming the author of the reacted-to event. Without that tag an author cannot query reactions to their own messages with a #p filter. The buzz-app Activity reactions tab (block/buzz-app#2638, merged) is built on that query. buzz-app's own publishers already add the tag.

What

• buzz reactions add now looks up the target event and adds ["p", <target author>] to the reaction. This covers both plain emoji and custom emoji (--emoji-url).
• The target lookup reads from the writer (consistency: strong), so a message published moments ago isn't missed during replica lag.
• If the lookup returns nothing, the reaction is sent without p and the relay decides. A reader-scoped lookup leaves out system channels and, for non-members, unlisted open channels, even though the sender can react there. If the target really doesn't exist, the relay's rejection (invalid: reaction target event not found) reaches the user unchanged. A failed lookup (auth, network, relay error) still stops the command before anything is sent.
• The mobile app gets the same tag in feat(mobile): tag the reacted-to message author on reactions #9141.
• No change to the SDK builders, buzz-acp status reactions (👀 and similar), or the desktop app. Agent status reactions therefore keep no p tag and stay out of the Inbox.

Testing

• New unit tests run against a fake relay. Each behavior test fails without its change:
  • a plain reaction carries the p tag
  • a custom emoji reaction carries the p tag
  • the target lookup sends consistency: strong
  • a target the lookup can't see is still reacted to, without p
  • the relay's rejection reaches the user as written
  • a failed lookup sends nothing (guards existing behavior)
• buzz-cli suite: 687/687 passed on the branch merged with current main. cargo clippy -p buzz-cli --all-targets -D warnings and cargo fmt --check are clean.
• I ran the built binary against a stub HTTP relay (no local relay with these channel types was set up on this machine). Capture below.
• Not yet done: a run against a real local relay, and the human test from the AGENTS.md checklist.

Demo

Built target/debug/buzz (0a1bbb9) run against a stub relay. In the stub, aaaa… is readable, cccc… exists but an unscoped read can't see it (like a system channel), and bbbb… doesn't exist:

$ buzz reactions add --event aaaa…aaaa --emoji "👍"   # readable target
{"accepted":true,"event_id":"aadc4727…","message":""}
exit 0
$ buzz reactions add --event cccc…cccc --emoji "👍"   # exists, hidden from an unscoped read
{"accepted":true,"event_id":"c963d6b9…","message":""}
exit 0
$ buzz reactions add --event bbbb…bbbb --emoji "👍"   # does not exist
{"error":"relay_error","message":"relay error 400: invalid: reaction target event not found","retryable":false}
exit 2

relay query [{"consistency": "strong", "ids": ["aaaa…"], "limit": 1}]
relay received kind:7 tags=[["e","aaaa…"],["p","35c18ae2…"]]
relay received kind:7 tags=[["e","cccc…"]]
relay received kind:7 tags=[["e","bbbb…"]]

How a human can test

1. Against a local relay, send a message as user A: buzz messages send --channel <id> --content hi.
2. As user B, run buzz reactions add --event <that id> --emoji "👍".
3. Sign in as user A in a current buzz-app build and open Activity → Reactions. It works if a "B reacted 👍" row appears for that message. Without this change, no row appears.
4. Run buzz reactions add --event <64 hex chars that don't exist> --emoji "👍". It works if this prints the relay's reaction target event not found and exits 2.
5. React to a message in a system channel you belong to. It works if the reaction is accepted.

🤖 Generated with Claude Code

[bostonaholic]

@codex review

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-09T17:50:46.469631Z	0a1bbb9	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: 5fec7f94e7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

🔐 Codex Security Review

Note: This is an automated, security-focused review generated by Codex.
Use it as a supplement to human review; false positives are possible.

Scope

• Exact PR diff: ab399231c29ab31d982769b6f235ea06bee312c1...30e216ec09cb59fc29a8d86cecf71274524a09d3
• Model: gpt-6.1-sol

💡 Click "edited" above to see earlier reviews for this PR.

---

Review Summary

Overall Risk: MEDIUM

The new target-author lookup introduces two reliability regressions that can reject valid reactions.

Findings

[MEDIUM] Preserve channel scope when resolving the reaction target

• Category: Reliability
• Location: crates/buzz-cli/src/commands/reactions.rs:38 (source)
• Description: The new mandatory lookup supplies only the event ID. The bridge excludes system channels from implicit query scope even for members, and excludes unlisted open channels for nonmembers unless the filter names the channel. Consequently, an authorized caller reacting to a message in either case receives NotFound before submission. Previously, reaction ingestion resolved the channel directly from the target and applied the normal write authorization checks.
• Impact: CLI reactions stop working for messages in system channels and for authorized nonmembers of unlisted open channels.
• Recommendation: Allow callers to supply the target channel and include its #h constraint in the author lookup, preserving the relay's channel access checks.

[MEDIUM] Use strong consistency for the mandatory target lookup

• Category: Reliability
• Location: crates/buzz-cli/src/commands/reactions.rs:38 (source)
• Description: Without consistency set to strong, the bridge dispatches this lookup through query_events_routed. When replica routing is enabled, a recently accepted message can still be absent from the replica. The successful empty response becomes NotFound and aborts the reaction. Previously, reaction ingestion looked up the target through get_event_by_id_for_event_write on the writer.
• Impact: Reacting to a just-published or live-delivered message can fail intermittently during replication lag, despite the target existing and being writable.
• Recommendation: Add consistency set to strong to this filter so the write prerequisite reads from the writer.

Notes

• No additional limitations were reported.

---

_{Generated by Codex Security Review |
Requested by: @bostonaholic |
Workflow run}

[bostonaholic]

🤖 Both findings in the security review (#9121 (comment)) are fixed.

• Strong consistency: fixed in 20dd96a. The target lookup now sends consistency: strong, as other write-gating reads in the CLI do (channels.rs). Covered by add_reaction_reads_target_from_the_writer, which failed without the fix.
• Channel scope: fixed in 0a1bbb9. When the lookup returns nothing, the CLI sends the reaction without p and the relay decides, which is what it did before this PR. A failed lookup still stops the command before anything is sent. If the target doesn't exist, the relay's invalid: reaction target event not found reaches the user unchanged. Covered by add_reaction_to_unreadable_target_submits_without_p_tag and add_reaction_shows_the_relay_rejection_verbatim, which both failed before the change, and by add_reaction_fails_without_submitting_when_target_lookup_errors. With feat(relay): index reactions under their target author for #p reads #9285 deployed, the relay derives the recipient for reactions sent without p.

[bostonaholic]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: 0a1bbb9da3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".