[bradseiler]

Why

Communities that require account authentication need actionable sign-in and recovery guidance. First-run account replacement must preserve the shared session on cancellation and fence setup to the account the user selected.

What

Read the host's requires_nip_fi requirement separately from FI capability. Preserve required policy independently of compatibility. Offer supported-build guidance when sign-in is unavailable, and keep the device key during recovery.

Reuse main’s scoped FI transport for Welcome’s existing account-check, import/create, link and backup choices. A conflicting binding stops before requesting a challenge.

How

Reuse the existing native session, bundled Builderlab grants and first-run setup owner. Tokens stay native; requests carry the public session revision. Main already grants and tests the backup-status read; no runtime grant change remains. Native recovery preserves the shared session until replacement succeeds. Cancellation joins the pending operation before restoring setup; requests use current credentials for the same account. Legacy discovery and native socket renewal retain their existing behavior.

The configured FI origin already reaches the binding signer through plugin-manager's build configuration; this PR preserves that trust policy. It adds no relay-selected sign-in origin, billing requirement, or audio renewal owner.

The production delta is 502 added and 90 removed lines against main 73255c5d7, above the 250–400-line checkpoint. Most of the overrun handles account replacement and cancellation in Welcome. The smallest alternative considered was to omit in-Welcome account replacement and require leaving setup to change accounts; that would leave the requested first-run recovery incomplete. The current flow keeps the existing setup owner and adds the guards needed to prevent old-account setup after a replacement. Tests and documentation are separate from this count.

Risk

FOUNDATION boundary: this rebase preserves main’s existing services.firstRunFederatedIdentity composition. App.tsx has no delta. The earlier raw IPC helper is superseded by that scoped owner. Any further FOUNDATION wiring change still needs explicit human guidance under AGENTS.md. Component tests do not establish packaged support. Keep this PR draft.

Authentication, binding, cancellation and backup are sensitive paths. Exact packaged builds and enforcing-relay acceptance remain required before readiness.

Builderlab’s supported login contract has no account-selection hint. Users may need to change their provider account in the browser before signing in again. This PR does not force a chooser or silently sign out all communities. Packaged chooser/cancel validation remains open.

Testing

Test-only review follow-up at da8fa6ca29ee2ccd8c4997f82891636db62af889: the corrected acquisition fixture supplies a successful account reply. Removing the expected-revision guard now fails that regression. Dropping Welcome’s replacement-revision argument fails the new mounted regression; explicit retry then proves the concurrent account can load without another sign-in. Both mutations produce one intended failure each; the restored complete test files pass 189 tests. Independent review found no blockers. The full frontend suite at this head passes 16,487 tests, with 21 skipped. The first default-concurrency test hook had 23 failures across nine unchanged files, mostly five-second timeouts. All nine complete files passed separately with 343 tests using the repo’s documented BUZZ_TEST_WORKERS=2 setting. Normal hooks passed with that documented setting, including related tests/types, design checks and workspace Clippy; timeouts, assertions and test selection are unchanged. The first failure’s cause remains unconfirmed. New-head hosted CI remains separate.

The prior reconciliation at bbd353435 passed 16,486 frontend tests (21 skipped), plus 101 plugin-manager tests in each default and exact-host FI configuration. Those results remain attributed to that head. This follow-up changes tests only; native and UI code are unchanged.

Exercised the public-state recovery fixture at bbd353435 in disposable Chromium: light mode at wide width, dark mode at 390px with 125% text, keyboard access, sign-in-again and cancellation states. This exercises UI only, with no live credentials or OS store.

Prior requirement-plumbing and backup-credential mutations failed the intended tests and were restored. Reconciled mounted tests retain cancellation/commit orderings and same-account retry checks. New regressions cover main’s installed-key boundary and a concurrent replacement before consuming a sign-in result. The removed helper’s request and registration coverage now belongs to the existing account, first-run and FI service tests.

Deferred: packaged chooser/cancel with an existing shared session, fresh signup, existing-account linking and key preservation, native explicit-link/Builderlab agent attestation against staging, two assertion lifetimes, reconnect/rediscovery and account/key/agent revocation. Mobile and CLI acceptance require their own supported artifacts and configuration. See the support matrix and acceptance procedure.

Bigger picture

BUZZ-518 builds on merged #1424, #1461 and #2142. Candidate packaging and staging activation belong to BUZZ-514–516; audio renewal stays in BUZZ-457. Open #2152, #2183, #2225 and #2240 remain separate. No cash-server companion is needed. No merge or deployment is requested.

Readiness also depends on BUZZ-511, published as draft block/buzz#8988 at 82c64ce008171855606511c1340cddaa949196fe. Parser and mounted onboarding fixtures now share that producer's required-host field projection. The normative Discovery contract and executable host/mode matrix are pinned. Capability remains separate from requirement and does not grant issuer trust.

The current draft producer is 7075b9ee40d254aebad28d92b28e4a67152d2c34. Its NIP-FI specification is identical to the fixture’s pinned 82c64ce008, and its NIP-11 requirement and FI descriptor fields are unchanged. The tenant/icon refactor does not change the consumer projection, so the fixture pin remains valid. This source comparison does not establish deployed interoperability. Producer review, hosted CI, human acceptance, production baseline verification and activation/live-fleet gates remain separate. Required-host discovery returns 503/no-store when the verifier, deny map or finite lifetime is missing; Buzz keeps that as a recoverable discovery failure, never optional/free access. Revalidate the fixture after producer revisions.

Rollout requires the BUZZ-511 producer/spec before exact-host client acceptance and enforcement. Field absence keeps legacy behavior; non-FI clients need a supported build. Observe admission with the same npub and renewal across two actual lifetimes. A client revert preserves the key, binding, backup consent, native session and durable relay policy; it does not turn required access off. See the linked acceptance document for the sequence and rollback limits.

Generated with Codex