feat(cloud): security notices for every owner's phone, naming the client only while the copy carries events

[frahlg]

What

Security notices reach every owner's phone through FTW Cloud, with the readable copy on or off. This is the box and protocol half; the service half is srcfl/ftw-cloud#23, and the phone half is srcfl/ftw-app#77.

#1646 already made the box send notice {kind} whenever the link is up. This PR checks that and closes three gaps:

• The client's name, only when the grant allows it. notice may carry client on agent.added, and only while the readable copy is on and its grant has ftw.events.read, as an event's arguments would. With the copy off the notice holds the kind alone. The name must pass cloudwire.NoticeClientOK: at most 65 characters (the consent page keeps 64 and adds "…"), no control or format character. FTW Cloud knows the name from the roster's agent row whatever the copy; the copy decides only whether it also reaches Apple. ADR 0008 and the docs now say so.
• One alert, owners only. The five notice kinds no longer go to FTW Cloud as event (QueueEvent refuses them). With the copy on, an owner got the event and the notice; a viewer with events got the event.
• A notice cannot carry readings. cloudwire.ReadNotice decodes a notice strictly: any field beyond the header, kind and client refuses it, as do a boot that is not 16 bytes, a kind outside NoticeKinds, or a name on another kind or that NoticeClientOK refuses. FTW Cloud uses it before it sends anything to Apple.
• A notice lasts a day. It states a lasting fact, so ReadAlert accepts one up to NoticeMaxAgeMs (24 h) old, and FTW Cloud gives Apple the same expiry. An event of a notice's kind reads as the generic line.
• The box counts what it drops. A notice its full queue (16) pushes out is logged and counted in noticesDropped (GET /api/cloud).

ReadAlert, the reference for the phone's notification extension, now reads a signed notice in an alert as an event of its kind, with client as its one argument. The alert's aps stays the same for every kind.

Docs: docs/protocol-cloud.md (notice table, Push, byte budget, what Apple sees) and docs/agents.md (Push kinds).

Pairs

• feat: security notices reach every owner's phone, copy or not, and the car class is held ftw-cloud#23 pins go/protocol to this branch (c41e6e9, master with QUIC merged in). It moves to the merge commit once this lands.
• iPhone: security notices from FTW Cloud, and the car class in CloudView ftw-app#77 replays the new push vectors.
• The car half of the same task is feat(cloud): the car class in FTW Cloud's copy, and a charger's level and goal read from its car #1662.

Catalogue

agent.added now reads "An assistant or Sourceful was given access to your box. See who has access in the app." (review S6), edited in srcfl/ftw-webapp#94 first and copied here with push_gen.go regenerated. The box renders it with no name of its own; the phone names the client from the notice.

Contract-pair: srcfl/ftw-webapp@8d80b8e

Deploy order

Cloud first (srcfl/ftw-cloud#23), then boxes (this), then phones (srcfl/ftw-app#77). A box that sends notices to a service that drops them loses nothing but those pushes; a service ready first drops the old event copies at once.

Tests

• cloudwire: ten new push vectors (notice: agent added, with the client's name, owner added, a kind that is no notice, a name on another kind, a notice that carries a reading, a notice kind sent as an event, a notice twenty hours old, one over a day old, one with a short boot). The earlier cases keep their bytes.
• cloudwire.TestReadNoticeTakesOnlyANotice.
• cloudlink: TestANoticeGoesWithTheCopyOff now also checks that no name goes with the copy off; TestANoticeNamesTheClientOnlyWhenTheGrantCarriesEvents (with a cut name and a format character); TestANoticeKindIsNoEvent; TestAFullNoticeQueueCountsWhatItDrops; TestANoticeGoesPastTheBudget.
• cmd/ftw: TestAnAgentAddedAtTheBoxPageNamesItsClient (add and widen).
• GOFLAGS=-p=2 make verify: clean (vet, tests, build).

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-16T08:00:14.391573Z	ec5db08	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ec5db08b31

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Avoid recording delivered cloud notices as failures

When FTW Cloud is the only effective notification transport—for example, no ntfy provider and no web-push subscriptions—agentPorts.push successfully queues the separate notice and then calls NotifyAgents; the registered CloudPublisher reaches this branch, returns ErrNothingToSend, and notifications.Service.deliver consequently increments Failed and writes a failed history entry because every publisher appeared absent. Thus successfully delivered security notices are reported as failures; exclude these kinds before dispatching to the cloud event publisher or account for the notice delivery as a successful transport.

AGENTS.md reference: AGENTS.md:L22-L23

Useful? React with 👍 / 👎.