[mcdickenson]

Add a real-router regression for membership-only relays with NIP-FI off. It creates two communities through signed operator requests, adds the same service bot through each owner's signed member command, and proves that ordinary members, dual members and the shared bot retain separate community access.

The test covers:

• A configured deployment-owner key cannot publish a bot profile before tenant membership. A registration permits A publication only; B needs its own registration. Both responses must say accepted with the exact event ID, and signed queries read back the exact profile in each community.
• An A-only key cannot upload to B or read A as a B-only member. Denials occur before object-store I/O.
• PNG upload and signed GET/HEAD/Range/thumbnail reads return exact content, lengths or JPEG data for admitted callers. B cannot read A's metadata, even for a legitimate dual member or shared bot.
• Independently publishing the same bytes in B establishes B's own metadata. A host-bound media proof still cannot be reused against B, in either direction.

Only the S3 wire service is an in-memory loopback fixture. The test uses the production router, authentication, tenant lookup, owner/member commands, Postgres, Redis replay guard, media processing and serving. It requires explicit disposable loopback database/Redis URLs, rejects the default Desktop database name, and generates every identity key fresh. No production behavior changes.

Validation: the ignored integration test passed against disposable local Postgres17/Redis7. Behavioral negative controls fail when upload membership, read membership, or the community component of the sidecar key is removed; all source mutations were restored. Final head e219f5cc9f697cd081328c55a7255880a48ff64b passed the normal scanner, formatter, sign-off, branch/org checks, file-size check, Rust unit suite (287s) and Tauri checks (64s). The acceptance test source is byte-identical to the passing local run; a final file rename follows the repository _tests.rs convention. PostgreSQL test discovery and its affected static regression pass.

Run with BUZZ_TEST_DATABASE_URL=<disposable loopback DB> REDIS_URL=<disposable loopback Redis> cargo test -p buzz-relay --lib membership_only_two_community_media_and_service_bot_roundtrip -- --ignored. Initialize that disposable DB with the repository schema first. This is in-process router acceptance, not deployed ingress, session issuance or human UI acceptance; keep the PR draft pending maintainer/human verification.

Review requested from @holmes and @block/buzz-oss-team. Maintainer assignment is needed because the fork contributor cannot assign upstream reviewers.

Upstream CI run 40131331698 and the image/RC workflows currently report ACTION_REQUIRED for fork approval. DCO passes. Maintainer workflow approval is pending; this is not a failed code check.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 9e8c9fc04daf20259cd259dcaec89109587cc7f5...e219f5cc9f697cd081328c55a7255880a48ff64b.
A new review must complete for this exact range. When manual authorization
is required, a user with write access must comment exactly
@buzz-security-review e219f5cc9f697cd081328c55a7255880a48ff64b to authorize a new review.
Any previous review applies only to its recorded range.