feat(agents): resume deferred work through private reminders

[a-arad]

Agents can keep notes about work that becomes useful later, but the CLI and ACP harness could not return a private NIP-ER reminder to an agent's attention. Add the encrypted reminder lifecycle to the SDK and CLI, and recover due reminders through the existing ACP private session and agent pool.

buzz reminders supports create, list/get, snooze, complete, and cancel, with relative or timezone-qualified due times and optional original-message links. ACP queries current author-owned heads without a creation-time lower bound, rechecks a version before dispatch, backs off failed turns, and retains private delivery receipts across restart. A normal turn records delivery; the agent retains ownership of completion, cancellation, or revised timing. Reminders do not emit public acknowledgments, interrupt active work, or add a task workflow.

Validation:

• Full CARGO_INCREMENTAL=0 just ci passes on current main (Rust/relay/Tauri/desktop/mobile tests and desktop/web builds). The first attempt exhausted local disk in an unrelated relay build; only this task's disposable incremental caches were cleared before the successful run.
• Affected SDK/CLI/ACP suites pass (1,710 tests including pool integration); targeted restart, replacement, malformed payload, pagination, failure recovery, private framing, and encrypted-envelope tests.
• Removing the persistent receipt check makes the restart regression fail.
• Production relay 0.2.1 accepts the full CLI lifecycle, rejects stale expected versions, and hides an owned reminder from the other CLI identity.
• Linux release binaries built from this exact commit with the lockfile; installed on two production research controllers with persistent receipts and retained rollback binaries.
• Live restart canary: scheduled a private reminder, restarted the controller before its due time, observed a native turn two seconds after the due time, and deliberately left its relay state pending. Verified its durable delivery receipt, restarted again, and observed no duplicate native turn across more than two recovery polls. Cancelled the synthetic reminder afterward; this tests delivery independently of author-owned completion.
• Production researchers independently chose useful return times and retained baselines. The model researcher selected the next actual source release rather than an artificial near-term deadline.
• The nearer operational reminder dispatched one second after its due time, after a controller restart, into a fresh native session. The researcher reconstructed the retained baseline, issued fresh queries, produced a dated comparison, completed the reminder and returned its finding to the original thread. Its peer then verified 55 artifact hashes, reproduced the result byte for byte, posted the verification and ended its turn. No second operator wake or replacement reminder was required. This demonstrates the useful-work mechanism; the later source-release follow-up and week-long reliability remain unobserved.

Delivery is at least once across a crash before its receipt is durable; agents are directed to inspect retained artifacts before repeating actions. This adds no relay or desktop protocol changes. The production relay already advertises NIP-ER and NIP-42.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 3c7f288c60d67df78577b237e27c3dfc8831aaa1...6c2d99c1372a0cf77f61e22f2da0909294646a43.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 6c2d99c1372a0cf77f61e22f2da0909294646a43 to authorize a new review.
Any previous review applies only to its recorded range.