[matt2e]

Onboarding stack (merge in order, top to bottom):

1. fix(navigation): run the visit deadline only while a presenter is attached #1814 navigation: visit deadline only while a presenter is attached (merged)
2. refactor(communities): extract the join owner and add the pre-join relay lookup #1815 communities: join owner and pre-join relay lookup (merged)
3. feat(identity): observable nsec backup status with pass tickets, explicit lock release, and refused-recovery copy #1816 identity: native nsec backup status (merged)
4. feat(identity): first-run Builderlab account client and dev seed — bundled-grant sign-in, account reads, key link/unlink, backup, saved communities #1818 identity: first-run Builderlab account client and dev seed (merged)
5. feat(identity): first-run setup store, step table and pages (composition follows in the next PR) #1819 identity: first-run setup store, step table and pages (merged)
6. feat(identity): the first-run Welcome flow replaces the key-setup gate (FOUNDATION: App.tsx) #1820 identity: Welcome flow replaces the key-setup gate ← this PR
7. feat(settings): read-only Key backup row in Settings → Identity #1821 settings: read-only Key backup row
8. [DO NOT MERGE] chore(identity): DO NOT MERGE — isolated debug Keychain slot (full stack for native testing) #1822 DO NOT MERGE: isolated debug Keychain slot (full stack for native testing)

#1817 (the Builderlab tenant table) was closed on 2026-10-29 and is not in the stack. #1821 and #1822 are still based on this PR's pre-rebase head 86634692, which is the same change as 480bf96b. They do not have becb0bd7 yet and need rebasing onto this head.

Builds on (all merged): #1814–#1816, #1818 and #1819. Welcome.tsx imports #1815's FindCommunity/find-community/join/join-journal/destination, #1816's service, #1818's builderlab-account/first-run-seed/oauth/first-run, and all of #1819. first-run-navigation.test.tsx needs #1814.

Diff (18 files, +7568/−207): production +1064/−16; tests +5993/−160; docs +511/−31. No Rust, build configuration or FOUNDATION file other than App.tsx changes.

CI status: the latest run fails only Rust and tool integration, and so CI required. The cause is a new zip advisory that main has already fixed in #2137. This branch needs main merged in before CI can pass. Details are under Checks below.

What this layer is

The composition and the product flow. Welcome.tsx (936 lines) covers:

• the landing (Sign in with email and Community URL) and discovery via FindCommunity;
• for a community hosted by this build's Builderlab, sign-in at once. A build has one Builderlab, and the only listed deployment is the public one. builderlab-hosted.ts (48 lines) matches hosts under communities.buzz.xyz on the default port, or a relay publishing that deployment's NIP-11 self key. hostedByThisBuilderlab holds only when that deployment's portal, https://app.builderlab.xyz, is the origin of this build's BUZZ_BUILDERLAB_URL. An empty, invalid or other-origin build URL (an unconfigured or federated-identity build) never signs in at once. The table keeps room for a second row, but none is added;
• for any other community, including one run by another Builderlab deployment, the connect choice: sign in at BUZZ_BUILDERLAB_URL, or bring a key;
• the setup lanes (Create my key / I already have a key / Welcome back / Restore / Start over);
• Join Community through admitCommunity/completeJoin, the profile step, the known-communities restore and the invite-intent handoff;
• the failure page (Try again / Continue without backup / a blocking link failure);
• the backToLanding/enterApp invariants and the heading focus handoff.

LegacyIdentityOffer.tsx (64 lines) offers old Buzz's identity as a dialog over the landing (see the review follow-ups below).

The one FOUNDATION edit: App.tsx imports Welcome instead of IdentitySetup and passes identity, communities and invites (+7/−3). IdentitySetup.tsx gets a one-line comment. JoinCommunity.tsx (from #1819, which nothing on main mounts) loses its disabled Scan a QR code and Create a community buttons. Docs describe the whole flow.

Not supported: federated-identity builds. Welcome's Sign in with email uses the bundled Builderlab plugin's own network grant. Builds with BUZZ_BUILD_FEDERATED_IDENTITY_CONFIG do not have that grant (#1461), so sign-in fails after the browser step. FI builds need their own first-run path before they adopt this flow. This is documented in docs/identity.md (first-run section) and docs/configuration.md (federated identity build input).

Review follow-ups

SHAs here are the current ones. Threads and comments from before the 2026-11-02 rebase use the old SHAs; the mapping is in the next section.

• e65782e9: a canceled sign-in that settles after a later one is ignored. signIn continues only if no cancel happened since it started.
• ad85304f: docs/identity.md states the backup and recovery capability contract instead of which deployments enable them.
• a80d2f1c: Try again on the invite page uses the shared Button's loading state, so focus stays on it through a repeated denial.
• d647876f + f8a1f9db: the old-Buzz key bring-over is back, as an alert dialog over the landing. Title Continue with your Buzz identity?, actions Not now and Continue.
  • identity.legacyAvailable() runs once per entry into missing, and identity.importLegacy() runs only on Continue.
  • The dialog waits while a sign-in is pending or another first-run page shows.
  • A failed import shows its error in the dialog, and Continue retries.
  • Success enters the app with no sign-in, link or backup, and LegacyCommunityImport takes over as on main.
  • Not now and Escape dismiss it until the next launch with no key. It returns after Sign out.
• e1841cf4: removes the tenant table that re-entered this PR (below). Its message, and an earlier version of this description, said hosted sign-in was "always at BUZZ_BUILDERLAB_URL" as intended. That was wrong for a community another Builderlab hosts: a public release (app.builderlab.xyz) given a block.builderlab.xyz community URL signed in at the public Builderlab and linked the new or imported key to that account. main never did this, because its key-setup gate never calls Builderlab.
• 7bec8638: the first fix. It gave each listed deployment (public, Block, staging) its portal, and another deployment's community got a connect page offering only a key. Superseded by 480bf96b.
• 480bf96b: one Builderlab per build for now, the public deployment (owner decision).
  • Removed: the block.builderlab.xyz and test.blockstaging.build rows, the key-only connect page (elsewhere) and the join save guard.
  • builderlabHosting → { portal, here } becomes hostedByThisBuilderlab → boolean. It is true only for a communities.buzz.xyz relay (or its self key) in a build whose BUZZ_BUILDERLAB_URL origin is https://app.builderlab.xyz.
  • Every other community gets the ordinary connect choice, including another deployment's. An admitted join after a landing sign-in is saved to the account again.
  • Docs add the federated-identity note above.
• becb0bd7: the disabled "Coming soon" placeholders are removed (owner request; they come back once the features exist).
  • The landing loses "Scan a QR code — Coming soon".
  • Join a community loses "Scan a QR code" and "Create a community". Its action column is now empty, as on other onboarding screens.
  • Welcome back's "Recover from another device — Coming soon" stays.
  • The two tests that asserted the buttons and the docs/identity.md mentions are updated.

Rebase onto main (2026-11-02)

At 10:37 UTC this branch was rebased from af6e8993d onto main at 67e404917. The PR's diff is the same before and after apart from hunk offsets (17 files, +7580/−199 at the time; becb0bd7 came after). Every commit SHA changed:

Before	Now	Commit
5b78e9de	aea3fe70	tenant table (stale, see below)
0dc22c0d	e65782e9	canceled sign-in
3854b5a1	ad85304f	capability-contract docs
86a4b4c3	a80d2f1c	Try again focus
b3ccd00e / f2a94e07	d647876f / f8a1f9db	old-Buzz offer
50bad0cd	e1841cf4	tenant table removed
d2e2b7ee	7bec8638	per-deployment portals
86634692	480bf96b	one Builderlab per build

The tenant table re-entered and is removed again

The 2026-11-02 01:04 UTC force-push rebuilt this branch from the pre-closure 10-28 commits. That brought back #1817's tenant table (aea3fe70) and the 05/06 variants built on it (171c8051, 5cf1b65d):

• builderlab-tenants.ts;
• the BUZZ_BUILDERLAB_TENANTS input in vite.config.ts and build.rs;
• the grant union in host_request.rs and the binding-signer origin rule in identity.rs;
• the per-origin sign-in signatures and Welcome's per-tenant routing.

e1841cf4 puts back main's (af6e8993d) version of those 20 files. It restores the tenant-free pieces from 75127a4d4: builderlab-hosted.ts and its test, and Welcome's connect(signal) and account(credential, identity). Every review fix above stays. 7bec8638 later gave each builderlab-hosted.ts row its portal, with no tenant table and no build input, and 480bf96b keeps only the public row. The three stale commits still appear in this PR's commit list. After e1841cf4 their net diff against main is zero, and the repository squash-merges.

Review focus

• FOUNDATION: src/app/App.tsx. The import swap and the <Welcome identity communities invites> wrapper are the only three approved lines. After the rebase onto main, the LegacyCommunityImport that main placed inside IdentitySetup stays inside <Welcome>, so it still renders only once setup is complete (resolution approved by the author). No other FOUNDATION file (services.ts, main.tsx, communities/service.ts, plugins/api.ts) is in the stack.
• The gate: children render only when identity is ready and setup is idle. enterApp() is the only way setup becomes idle with a key. backToLanding is the only path back to the landing: it clears discovery, reads and the first-run session, and keeps the typed address.
• Nothing is signed to a relay before the user chooses to join. A failed link or unlink blocks with Try again only; a failed backup may be skipped.
• The old-Buzz dialog renders only in the landing JSX, while its hook runs with Welcome's other hooks, so the folder check and a dismissal outlive visits to other pages.
• identity.test.tsx journeys are grouped by lane in file order: landing/discovery and the old-Buzz offer, Connect, Join/profile/invite, key import, Welcome back/restore, Start over/owned, then failures and seed. They assert exact invoke/relay_http sequences. first-run-join-handoff.test.tsx runs the real App + createServices(). first-run-navigation.test.tsx proves fix(navigation): run the visit deadline only while a presenter is attached #1814's rule through the real gate.
• Browser journeys: none added or removed. tests/fixtures/window-chrome.tsx gains one line that answers identity_legacy_available with false.

Checks run on this branch's tree

• Hosted CI at becb0bd7 (this head): run 41430912324 has 37 checks passing, 2 skipped and 2 failing.
  • Passed:
    • JavaScript 1–4/4. Each shard runs pnpm check (Biome, typecheck, design:check), the frontend build and a quarter of the Vitest suite.
    • Browser journeys in Chromium (9 shards) and WebKit (14 shards).
    • The Vitest flake check (2 shards) and its selection.
    • Browser measurements, Native browser fixture, Protected agents (macOS), WebKit recording (macOS), DCO, zizmor and Semgrep OSS.
  • Skipped: the browser flake-check matrix and Windows native validation, as on every earlier run of this PR.
  • Failed: Rust and tool integration, at its Dependency policy step (cargo-deny --locked check), and so CI required.
    • The one error is RUSTSEC-2026-0429 against zip 4.6.1, which the app reaches only through tauri-plugin-updater 2.13.3.
    • The advisory is new: this job passed on this PR at 08:40 UTC, and other branches started failing the same step at 10:39 UTC.
    • This PR changes neither Cargo.lock nor deny.toml.
    • deps: tauri-plugin-updater 2.14.1 moves zip to 9, clearing RUSTSEC-2026-0429 #2137, merged to main at 11:33 UTC, moves the updater to 2.14.1 and zip to 9. This branch's base (67e404917) predates it, so a re-run fails again. It needs main merged in, or a rebase.
• Locally at becb0bd7:
  • Passed: tsc --noEmit, Biome on the changed source files, git diff --check, and three Vitest files with 141 tests (identity.test.tsx, first-run-join-handoff.test.tsx and first-run-navigation.test.tsx).
  • Deferred: a rendered check of the landing and Join a community without the buttons (both themes, 480 and 1100 px, 150 % text).
• Locally at 480bf96b:
  • Passed: tsc --noEmit, plus four Vitest files with 158 tests, run with BUZZ_TEST_WORKERS=2: builderlab-hosted.test.ts, identity.test.tsx, first-run-join-handoff.test.tsx and first-run-navigation.test.tsx. Biome passed on the five changed source and test files.
  • Fail-before confirmed:
    • The new 2-case journey fails with 7bec8638's Welcome.tsx, ConnectChoice.tsx and builderlab-hosted.ts in place (2 failed). A bb-block URL in a public build, and a bb-public URL with no build URL, each got the key-only page.
    • With the row !== undefined guard removed from hostedByThisBuilderlab, its self-fallback test fails: an unknown relay matched when there was no build URL.
  • Not run: the hooks (the commit and pushes used --no-verify, as the owner asked), any native build and a rendered check. ConnectChoice is back to its e1841cf4 layout.
• At 7bec8638 and e1841cf4:
  • Local tsc --noEmit and the first-run Vitest files passed: 171 tests in four files at 7bec8638. At e1841cf4, 132 tests in identity.test.tsx, the other first-run files and vite-config.test.mjs (23 tests).
  • Fail-before was confirmed for each commit's new journeys. 480bf96b later removed 7bec8638's key-only journeys along with that behaviour. The canceled-sign-in journey, rewritten with two build-portal sign-ins, still failed without the cancel-count check.
  • Hosted CI passed on the pre-rebase commits (runs 41400983722 and 41396764126).
• Earlier, on the tenant tree (before e1841cf4):
  • At d647876f: lint, typecheck and design:check passed; the full Vitest suite passed (854 files, 14,737 tests); window-chrome.spec.mjs passed in Chromium.
  • The old-Buzz dialog was rendered in a scratch fixture in Chromium and WebKit, light and dark, at 1100 and 480 px and with 150 % text. After f8a1f9db shortened the primary label, Not now and Continue share one row at both widths.
  • Hosted CI run 41386883487 on pre-rebase f2a94e07 passed.
  • No later commit changes LegacyIdentityOffer.tsx or where Welcome renders it.

Native evidence

None on this tree, and the native-validation gap is still open. Native first-run runs use the full tree in the DO-NOT-MERGE #1822, which adds the isolated debug Keychain slot. #1822 is still on the pre-rebase head, and no native run has been made since the 10-30 rebase, so the old-Buzz dialog's real keychain prompt has not been seen either. Treat every PR before #1822 as unit/integration-tested only.

Why this branch is green where 572d69398 was red. This PR's Welcome.tsx is the 19df106d5 version: a failed link blocks first run with Try again only, instead of offering Continue without linking. Six identity.test.tsx journeys depend on it and fail against the earlier Welcome:

• "a link that fails after the key is created blocks setup with only Try again…"
• "a link that keeps failing after a key is imported…"
• "a transient unlink failure after Start over…"
• "an unlink refused after Start over offers only Try again…"
• "a transient link failure after a successful unlink…"
• "a development seed's unlink status fails Start over's unlink…"

#1791's quiet read retries. After the rebase onto main with #1791, the identity.test.tsx relay fixture's unreachable saved community answers a web page instead of a 503. inspectProfile would retry a 503 for seconds, and those retries leaked into later tests. With the web page, the restore test keeps asserting exactly one discovery read without waiting out a retry schedule.

🤖 Generated with Claude Code

[wesbillman]

🤖 Star Lord’s automated source review via Wes’s account.

Three changes requested inline: fence canceled sign-in continuations, preserve the legacy-key migration entry point, and remove deployment rollout details from public documentation. One optional retry-focus improvement is also inline.

Rocket, Mantis and Groot supplied independent review lanes. Reviewed head e2f928f8b8d89f9506ba1b1e703d22fd0eba9da2, base 5c9a65404d7d0dd929650f6f7098e7aa5936841d. Source-only: tests, app/native flows, rendered accessibility and CI were not executed or verified; the author’s deferred validation remains open.

[wesbillman]

🤖 Star Lord’s automated source follow-up via Wes’s account.

No new findings in the tenant-removal/rebase changes. Three earlier items still need changes:

• Sign-in continuation: the previous P1 cross-origin consequence is resolved by removing tenant routing. A P2 remains at Welcome.tsx:247–260: a canceled sign-in can settle after a newer sign-in reaches key import, restart account checks, replace that page and discard its typed draft. Fence the continuation to its attempt before reading the shared session; cover cancellation followed by a newer sign-in and a late old completion.
• Legacy-key migration (P2) remains absent from Welcome. Keeping LegacyCommunityImport inside the gate preserves community import, but does not restore the explicit old-key import action promised by docs/identity.md:427. Restore that action or explicitly resolve the product contract and update its documentation/tests.
• Public rollout details (P2) remain in docs/identity.md:66–67,151; replace environment-specific rollout statements with the portable capability contract.

The retry-focus suggestion remains optional. Existing comments are linked rather than duplicated.

Rocket, Mantis and Groot completed independent lanes. Reviewed head 64a5f0bad98c51935229f39458a4489247ce0ce7, base 32731cd75ccc4cacfea3249f9016fc894435747f. Source-only follow-up: no tests, app/native flows, rendered accessibility, performance or CI verification. The PR’s stated native-validation gap remains open.

[wesbillman]

🤖 Star Lord’s automated source follow-up via Wes’s account.

No new findings in the hosted-community recognition and automatic-sign-in changes. The following earlier P2 items still need changes:

• Canceled sign-in continuation: Welcome.tsx:248–260 still lets a canceled attempt resume after a newer sign-in reaches key import, replacing that page and losing its draft. Fence the continuation to its attempt on new sign-in, cancellation and unmount. The earlier cross-origin consequence remains resolved.
• Legacy-key migration: the active Welcome gate still omits the opt-in legacy-key import promised by docs/identity.md:432–438. Restore the action or explicitly resolve the product contract and update its documentation/tests.
• Public rollout details: deployment rollout statements remain at docs/identity.md:72–73,157. Replace them with the portable capability contract. The new public-host/key classifier is not an additional disclosure finding.

The retry-focus suggestion remains optional. Existing comments are linked rather than duplicated.

Rocket, Mantis and Groot completed independent lanes. Reviewed head 75127a4d427c6831fa4723ffe0e92677d2344719, base 235e33ead40427dcf9d905783e33105c9894a2b5. Source-only follow-up: no tests, app/native flows, rendered accessibility, performance or CI verification. The PR’s stated native-validation gap remains open.

[wesbillman]

🤖 Star Lord’s automated source follow-up via Wes’s account.

One new P2 configuration-parity finding is inline. The earlier findings still need changes:

• Canceled sign-in continuation is P1 again: tenant routing restores its cross-origin consequence. At Welcome.tsx:267–274, canceled attempt A can finish after B has signed in and paused at key setup. The session owner discards A’s result but resolves A’s caller, which combines B’s shared credential with A’s captured origin. The account-check requests then send B’s credential to A’s configured portal. Fence this continuation on new attempts, cancellation and unmount before reading the credential or replacing account state; cover A settling after B succeeds. The abort checks inside the OAuth client do not fence Welcome’s continuation.
• Legacy-key migration (P2) remains missing from the active Welcome gate. Restore the opt-in migration action through the existing identity service, or explicitly resolve the product contract and update the retained documentation/tests.
• Public rollout details (P2) remain in docs/identity.md:76–77,160–162. Replace deployment-specific availability statements with the portable capability contract.

The existing retry-focus suggestion remains optional. Earlier comments are linked rather than duplicated.

Rocket, Mantis and Groot completed independent lanes; Star Lord integrated the source evidence. Reviewed head a8185e95a3f62739ba7dcf90dfcc84bd000be124, base af6e8993d4f090b4fd4e7526a0dec1e42e51090f. Public PR description inspected; no description attachments. Source-only: no tests, builds, app/native sign-in, rendered accessibility or performance checks were run. One hosted-CI snapshot showed 21 successful, 17 running and 2 skipped checks; it does not establish acceptance. The PR’s stated native-validation gap remains open.