[bradseiler]

Federated identity native integration

Summary

• Adds host-owned NIP-FA sessions with native secure-storage ownership and community-scoped NIP-FI assertions.
• Routes native relay sends, uploads, media, Huddle audio, and project Git through shared discovery and authorization.
• Preserves Builderlab legacy sign-in and hosted-community management when FI is unconfigured; restores native search ordering, audience authority, Settings grouping, and sign-out backup erasure.
• Keeps the PR in draft while configured-build contracts and platform acceptance remain open.

Candidate and validation

• Assigned base: 4ad00a8aeabea1b8ab95e7392574223980c95319.
• Candidate: 84a107c3bb4020ae56f6a1fa8e125ad266921d2d.
• bin/pnpm check: passed at the parent candidate c00d7106; this follow-up is Rust-only.
• Full Vitest: 10,558 passed, 9 skipped at c00d7106.
• Settings browser suite: 34 passed across Chromium and WebKit at c00d7106.
• Full Rust library suite at c00d7106, serial: 546 passed, 3 ignored. McKeon independently ran the full parallel suite at that head: 546 passed, 3 ignored.
• At 84a107c3, the four new relay-send, upload, media, and Git transport tests passed individually. The full parallel Rust suite had 547 passed, 3 failed, and 3 ignored; failures were in unchanged Nsec backup-choice and terminal tests. The two backup failures and one hang passed in isolation. Clean-main runs reproduce parallel backup/terminal lock flakes; see RESEARCH/PR869_REREVIEW_84a107c3.md and its logs.
• Repository push hooks passed, including formatting, design-system/type and unit-test checks, and Clippy. cargo fmt --all --check and workspace Clippy passed.
• Hosted CI was manually dispatched at the published branch head 84a107c3; its Windows native validation job is running: https://github.com/block/buzz-app/actions/runs/39475707470. The workflow's manual-dispatch path runs Windows validation only.
• The delta review at 84a107c3 found no blocking implementation defect. It flagged Huddle expiry as a remaining product/acceptance question: the socket closes at assertion expiry, but cached assertions can have as little as about 15 seconds remaining when a Huddle joins. There is no automatic Huddle reconnect; a user rejoin obtains fresh authorization and repeats NIP-42.

Open gates

• Do not ship FI-configured builds until hosted-community management has the agreed same-origin NIP-FA API extension and automatic Nsec backup has a native NsecBackupHost contract. No host-owned credential is forwarded to Builderlab APIs.
• Keep BUZZ_BUILD_FEDERATED_IDENTITY_CONFIG unset by default. Unconfigured builds retain the existing hosted-community and Builderlab sign-in paths.
• Test builds stub secure-store compare-and-swap and deletion. Real macOS Keychain, Windows Credential Manager, and Linux secret-store behavior remains unverified on each supported OS.
• Nsec backup/terminal parallel flakes are present on assigned main and remain outside this change.
• Chromium fake-microphone capture remains an environment/native acceptance gap; the same pending getUserMedia behavior reproduced in a minimal page with the configured fake-device flags.
• The PR's internal head ref and automatic pull-request checks still show 75d81820, despite the branch ref pointing at 84a107c3; no automatic PR suite is attached to the new commit yet. Native macOS/Linux acceptance, an FI-enforcing relay test, and human sign-off remain outstanding.

Staged acceptance

1. macOS, Windows, and Linux: use disposable identities. Verify sign-in, restart restore, sign-out, wipe, key-store replacement/deletion, and recovery from a locked or unavailable store. Record OS/version, build configuration, pass/fail for each workflow, and sanitized logs without secrets.
2. FI-enforcing relay: only after all three OS checks pass, test an enrolled key against a relay whose NIP-11 requires FI. Confirm relay send, upload, media read, Huddle audio upgrade, and project Git read succeed with exactly one scoped assertion header; public relay requests omit it; no upstream session token reaches the relay. Verify denial is terminal and exposes the sign-in recovery action.
3. Huddle expiry: confirm expected user experience when authorization expires during a call, including joins close to the assertion expiry. Confirm socket closure, explicit rejoin, fresh authorization, and NIP-42. This behavior needs product acceptance before configured rollout.
4. Evidence: record platform/build identifiers, relay fixture/endpoint, sanitized request-header assertions, restart/sign-out outcomes, and owner sign-off. Test-only secure-store stubs do not satisfy the real-OS storage gate.

Rollback

Do not enable relay enforcement as part of this app change. If a configured build fails acceptance, withdraw that build or revert this change. Protected relays must continue to fail closed; rollback must never use unsigned or legacy credentials for a configured FI request.