feat(identity): add release-selected remote managed identity

[baxen]

Stack and scope

Draft; not rollout/staging-ready. Depends on async EventSigner extraction #7600. Target is baxen/async-event-signer-extraction, not main. Closest existing PR: #7600 (the neutral extraction); no existing remote-managed-identity PR was found before creating this draft.

Adds release-selected organization-held identity to desktop and mobile, with captured RemoteEventSigner capabilities separate from login/token ownership. OSS retains local custody and optional local media auth. Managed mode cannot fall back to generating/importing/exporting a local human key. Nostr event construction and publication remain outside the signer; exact returned event fields, author, ID and signature are verified. Relay/session generation and ACK-ID checks fence asynchronous operations.

Local-secret-dependent pairing, key backup/export, encrypted personal sync/reminders, local managed-agent custody and analogous operations are explicitly unavailable rather than silently replaced by plaintext publication. See desktop/MANAGED_IDENTITY.md and mobile/MANAGED_IDENTITY.md for product differences, lifecycle and exclusions.

Media review fixes

• Corporate desktop read-proof errors now propagate before upstream transport in streaming proxy, custom-protocol proxy and bounded download consumers; avatar-card caller also propagates the Result. OSS recovery alone may omit auth.
• Mobile managed read proofs use 120-second lifetime / 10-second refresh margin, within the backend's 300-second ceiling; OSS remains 600/60. Proof timestamp/expiration and cache origin use captured construction time. Exact HTTPS origin/effective port/userinfo checks, generation checks and no-redirect transport remain intact.
• Red-first native recording-server regression reproduced nine unsigned successful requests (three consumers × missing identity/logout/proof denial), then passed with zero requests. OSS regression proves its three unsigned requests still succeed. Mobile production media→actual remote signer request test initially receives policy-shaped 403 for 600 seconds, then verifies backend bounds, 120-second proof, cache reuse/refresh at 109/110 seconds and zero further transport after logout. The service mock enforces policy rather than always signing.

Cross-repository contract

• Only POST <signerUrl>v1/buzz/identity/ensure and POST <signerUrl>v1/buzz/identity/sign; default deployment prefix /cash-app/goose/, no legacy aliases. Sign returns a signature, never ordinary publication. Ensure's initial provisioning is separate.
• Exactly seven nonsecret compiled fields: signerUrl, issuer, clientId, audience, organization, connection, redirectUri. Release environment is not an eighth client field. signerUrl includes deployment prefix, not a full endpoint; no client secrets/tokens in build configuration.
• Desktop callback is configured exact http://127.0.0.1:<fixed-port>/enterprise-callback (busy bind fails); mobile buzz://enterprise-login.
• Aligned with backend draft squareup/cash-server#124571 at 703f02195041fd53deadbdd95ee885f6f75a4919, release draft squareup/buzz-releases#94 at ed54ec3ba7ceb2c1835bf68450771c0a77432731. Auth0 Terraform draft Add agent conversation domain model #1385 remains unbound/deny-only pending corporate-authority choice and active-infrastructure authorization. These are source contracts, not deployed-service evidence.

Validation and provenance

Fresh full affected suites on frozen source (HEAD was 59ad3ee6… with prepared changes), subsequently verified byte-identical to committed tree b3d50467f5bd3a9ff752a8490bc1a57e690d675c:

• cargo test --locked --manifest-path desktop/src-tauri/Cargo.toml: 3203 unit + 10 integration passed; 21 ignored.
• Synthetic compiled corporate cargo test … compiled_corporate -- --ignored: 2 passed, including real AppState no-key/import guard and new zero-transport regression. Native source matches final tree; no live credentials.
• Tauri cargo clippy --locked … --all-targets -- -D warnings: passed.
• flutter test --no-pub --reporter expanded: 2171 passed; flutter analyze --no-pub: clean; Dart format 563 files, zero changes; Rust fmt/diff whitespace checks passed.
• File-size policy tests 10 passed and desktop/web/mobile differential gates passed. Focused mobile auth/media tests 29 passed. Genuine red logs retained; one subsequent test-only list-matcher defect was corrected without weakening the policy assertions.

Reused, not rerun, from matching unchanged source manifests: WS 25 tests/clippy; frontend 6504 JS tests, 2 synthetic Chromium login tests, TypeScript/Biome/text checks and protected internal/OSS build matrix; actual compiled config parser tests, intended missing-system-keyring guard; mobile synthetic define parser (1), actual release source check and three actual Swift emoji sources compiled for iOS 16 arm64 simulator. Native/Flutter suites were rerun because their packages changed. Existing frontend warnings remain as documented in prior evidence.

Full frozen patch SHA256 including all new files: 1596261030009319ddaa0c21f6607cd78d93a2e488ecfb6ac19bfd126c1ab902. Feature-only patch against d7a54a876…: 3242be95c6e29fcc372681453882420e28a384a1e949341d0d498de665913e4b. Local durable evidence: /Users/baxen/Development/buzz-remote-managed-identity-artifacts/final-38c81a13/ (logs, before/after manifests, full patches, self-review); inherited evidence attribution is explicit, not a claim all suites ran at the merge SHA. Package/static checks were run directly; wrapper hooks were skipped to avoid installing through shared dependency symlinks or packaging empty sidecar placeholders. A fresh repository-wide just ci/packaged-app build was not run.

The extraction's newer mobile content had already been integrated manually. A normal local merge records d7a54a876… ancestry, resolving six overlapping files to the reviewed/tested content; merge tree equals feature content tree exactly. No published history rewritten. Size measured honestly: 145 files +5790/−409 feature-only; combined stack from original baseline 164 files +7262/−567, versus original enterprise implementation 104 files +3721/−318. This is not a file-count reduction claim.

Remaining limitations / blocked runtime gates

• Directory/profile editing remains exposed although the backend excludes ordinary profile mutation; it fails instead of changing directory-owned names.
• Mobile refresh still calls ensure and checks the pinned identity; mobile direct parser/generic proof preflight is weaker than Rust. Backend policy is still required.
• No full operator offboarding/live relay eviction or crash-durable signed-event outbox; ambiguous retries may construct new events.
• No live corporate SSO/enrollment/token rotation, actual keychain, deployed signing/media workflow, full native app link/launch, URLSession runtime redirect test, signed installer/AOT configuration embedding or release/deployment was exercised. Synthetic Chromium is not native GUI; compiled Swift sources/source markers/artifact bytes are not runtime proof. Sidecars are empty placeholders.
• No Auth0 mutation, schema apply, enrollment or deployment. Infrastructure authority and active-repo ownership decisions still block staging readiness.