Draft: Release-selected corporate login and native enterprise signing

[baxen]

Outcome

Implement the reduced native integration milestone: release-selected corporate identity, browser login/refresh, and remote signing at the native client seams. No signer settings UI and no new durable client outbox. This remains a draft pending review, deployment configuration and live acceptance.

Companion: https://github.com/squareup/cash-server/pull/124571

Changes

• BUZZ_BUILD_ENTERPRISE selects corporate mode at release build time (Tauri build env / Flutter dart-define). No employee-entered signer URL or local/enterprise picker. OSS defaults remain local-key.
• Desktop and mobile public-client authorization-code/PKCE S256 login, callback-state checks, server-selected identity discovery, secure token storage and single-flight refresh. Refresh pins account/community; ambiguous rotating-token failures require login rather than replaying an old durable token.
• One corporate bearer token, not two app/login credentials. Kgoose resolves the stable account from verified Auth0 organization+subject.
• Desktop SigningIdentity snapshots route generic event IPC, chat/channel/DM writes, query auth, native relay sessions, media, and human huddle auth/STT. Enterprise mode rejects private-key access/import and prevents local-agent startup/restore.
• Mobile signing seam routes submissions, NIP-42, HTTP query auth, uploads, typing/status and human huddle auth. Media consumers await cached host-scoped read proofs; file bytes go directly to Buzz.
• Login UI bypasses key onboarding and stays at a retryable gate on denial. Desktop logout is provided. Mobile retains its existing sign-out flow with corporate credential cleanup.
• Local read markers work without a private key; encrypted cross-device read-state sync is disabled for this first corporate build.
• Updated protocol/release documentation and agent contributor contract.

Deliberate first-build exclusions

Private-key export/backup/import/pairing, local managed-agent creation/start, profile editing, secret-dependent observer/mesh/git-helper operations, encrypted preference synchronization and mobile private-key-based push/NSE support are not remotely reimplemented. They remain unavailable rather than using a different local identity. Independently operated authorized relay agents remain usable in conversations.

No durable client outbox was added: ordinary sign/publish/ACK flows remain, with possible delivery uncertainty across an app crash or lost acknowledgement.

Deployment and security gates

• Configure real Auth0 public clients/audience/claims/refresh, Okta federation, Kgoose/schema/encryption/community-admin settings and internal release build values. Desktop loopback ephemeral-port redirect registration must be supported; mobile callback is buzz://enterprise-login.
• Validate real native login, refresh, second device, messaging, media and huddles against deployed services. Mock UI tests are not that evidence.
• Offboarding membership reconciliation and pending-provisioning fencing remain separate security work; active-WebSocket termination stays on its existing branch.
• Custody lifecycle/audit, profile refresh/migration, ingress body limits, header redaction, fleet quotas and security review still gate production rollout.

Verification

• Shared Rust signer/PKCE: 8 tests passed; native clippy passed.
• Enterprise-compiled desktop test passed: local key access/import rejected before persistence.
• Native relay regressions: 22 passed, 1 live-relay test ignored.
• Desktop JS: 6,503 passed. Read-state local-only regression: 31 tests passed.
• Desktop corporate-login E2E: 2 passed (success and denial/no local fallback); screenshots captured through mock bridge.
• Mobile full suite: 2,126 passed on rerun. Earlier run had a temporary-directory cleanup race in a voice-note test; focused rerun also passed.
• Mobile analyzer, desktop TypeScript, browser tests/typecheck and scoped formatting checks passed.
• Full repository just ci stopped in unit tests: unchanged ACP wall-clock tests idle_resets_on_stdout_activity and keepalive_resets_idle_past_deadline failed. A later ACP suite invocation passed; both tests passed in focused serial reruns (0.84s and 1.45s). The full gate is not green and later stages did not complete.
• Initial push hooks caught an egress-inventory regression introduced here. Fixed by consolidating local/corporate huddle signing into one guarded seam; all 16 egress tests passed. Corrected push succeeded at e0387f5bc; all normal hooks passed, including Rust, desktop Tauri, desktop JS/typecheck and mobile checks.

No production configuration, schema, identity or relay membership was changed. No live Auth0/Okta login or real-device acceptance was performed.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 78618804ec86a014524ad7d1fb55928e8f5c3edf...e0387f5bcb1d368449ad6fc949acb2be5911ee62.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review e0387f5bcb1d368449ad6fc949acb2be5911ee62 to authorize a new review.
Any previous review applies only to its recorded range.

[baxen]

🤖 Updated enterprise login UI, exercised through the desktop E2E bridge (not a live Auth0 login).

Release-selected corporate login

Enterprise builds offer corporate sign-in, not a signer URL or local-key setup.

Denied login

A failed corporate login stays at the gate with a retry; it never falls back to local keys.