[bradseiler]

Replaces #869, whose pull-request head stopped tracking the published branch after the rebase.

Summary

• Adds host-owned NIP-FA sessions with native secure-storage ownership and community-scoped NIP-FI assertions.
• Routes native relay sends, uploads, media, Huddle audio, and project Git through shared discovery and authorization.
• Preserves Builderlab legacy sign-in and hosted-community management when FI is unconfigured; restores native search ordering, audience authority, Settings grouping, and sign-out backup erasure.
• Keeps the PR in draft while configured-build contracts and platform acceptance remain open.

Candidate and validation

• Assigned base: 4ad00a8aeabea1b8ab95e7392574223980c95319.
• Candidate: 84a107c3bb4020ae56f6a1fa8e125ad266921d2d.
• bin/pnpm check: passed at the parent candidate c00d7106; this follow-up is Rust-only.
• Full Vitest: 10,558 passed, 9 skipped at c00d7106.
• Settings browser suite: 34 passed across Chromium and WebKit at c00d7106.
• Full Rust library suite at c00d7106, serial: 546 passed, 3 ignored. McKeon independently ran the full parallel suite at that head: 546 passed, 3 ignored.
• At 84a107c3, the four new relay-send, upload, media, and Git transport tests passed individually. The full parallel Rust suite had 547 passed, 3 failed, and 3 ignored; failures were in unchanged Nsec backup-choice and terminal tests. The two backup failures and one hang passed in isolation. Clean-main runs also reproduced parallel backup/terminal lock flakes.
• Repository push hooks passed, including formatting, design-system/type and unit-test checks, and Clippy. cargo fmt --all --check and workspace Clippy passed.
• Hosted CI was manually dispatched at the published branch head 84a107c3; its Windows native validation job is running: https://github.com/block/buzz-app/actions/runs/39475707470. The workflow's manual-dispatch path runs Windows validation only.
• The delta review at 84a107c3 found no blocking implementation defect. It flagged Huddle expiry as a remaining product/acceptance question: the socket closes at assertion expiry, but cached assertions can have as little as about 15 seconds remaining when a Huddle joins. There is no automatic Huddle reconnect; a user rejoin obtains fresh authorization and repeats NIP-42.

Open gates

• Do not ship FI-configured builds until hosted-community management has the agreed same-origin NIP-FA API extension and automatic Nsec backup has a native NsecBackupHost contract. No host-owned credential is forwarded to Builderlab APIs.
• Keep BUZZ_BUILD_FEDERATED_IDENTITY_CONFIG unset by default. Unconfigured builds retain the existing hosted-community and Builderlab sign-in paths.
• Test builds stub secure-store compare-and-swap and deletion. Real macOS Keychain, Windows Credential Manager, and Linux secret-store behavior remains unverified on each supported OS.
• Nsec backup/terminal parallel flakes are present on assigned main and remain outside this change.
• Chromium fake-microphone capture remains an environment/native acceptance gap; the same pending getUserMedia behavior reproduced in a minimal page with the configured fake-device flags.
• Automatic checks on this replacement PR, native macOS/Linux acceptance, an FI-enforcing relay test, and human sign-off remain outstanding.

Staged acceptance

1. macOS, Windows, and Linux: use disposable identities. Verify sign-in, restart restore, sign-out, wipe, key-store replacement/deletion, and recovery from a locked or unavailable store. Record OS/version, build configuration, pass/fail for each workflow, and sanitized logs without secrets.
2. FI-enforcing relay: only after all three OS checks pass, test an enrolled key against a relay whose NIP-11 requires FI. Confirm relay send, upload, media read, Huddle audio upgrade, and project Git read succeed with exactly one scoped assertion header; public relay requests omit it; no upstream session token reaches the relay. Verify denial is terminal and exposes the sign-in recovery action.
3. Huddle expiry: confirm expected user experience when authorization expires during a call, including joins close to the assertion expiry. Confirm socket closure, explicit rejoin, fresh authorization, and NIP-42. This behavior needs product acceptance before configured rollout.
4. Evidence: record platform/build identifiers, relay fixture/endpoint, sanitized request-header assertions, restart/sign-out outcomes, and owner sign-off. Test-only secure-store stubs do not satisfy the real-OS storage gate.

Rollback

Do not enable relay enforcement as part of this app change. If a configured build fails acceptance, withdraw that build or revert this change. Protected relays must continue to fail closed; rollback must never use unsigned or legacy credentials for a configured FI request.

Generated with Codex

[bradseiler]

🤖 Superseded by #1424, the rebuild on newer main with agent credentials and shared-session plugin integration. Both replace #869; these are alternative implementations, not a stack.

The reconciliation checklist in #1424 preserves the unique work and unresolved contracts from this PR: Huddle audio upgrade/expiry, transport regression tests, legacy compatibility, admitted-operation semantics, bounded assertion failures, management/backup contracts, and native acceptance. Code integration remains outstanding there; this closure does not mean those differences are resolved.

This branch and the review history remain available. Validation reported here applies to its recorded heads only. Continue integration and readiness tracking in #1424.