Electric: add managed evaOS Teams identity broker login

[100yenadmin]

Parent: #1
Closes #4

Summary

• add an Electric-only evaos-teams-managed build boundary for Electric Desktop device login, server-scoped Nostr key binding, entitlement refresh, relaunch, account switching, and atomic managed logout
• keep the opaque Desktop session and Nostr private key in Rust under the distinct evaos-teams-desktop OS Keychain service; expose only a safe status projection to the renderer
• fail closed on missing/locked Keychain, expired or wrong-key entitlement, callback/relay/deep-link injection, concurrent auth operations, and native identity import/export paths
• preserve the existing native Buzz path when the managed feature is absent

Dashboard prerequisite: electricsheephq/dashboard#707 at 5bf9baed7416338840f20fd2631041e5c391cf3d.

Review remediation

• stage every claimed Desktop session as a durable revoke-pending record, then durably checkpoint logout_confirmed before any fallible local restore or wipe; confirmed recovery never depends on a second remote logout
• prove Keychain write ACLs with an actual same-value blob rewrite, not the normal no-op-skipping replacement path
• enforce the broker expiry deadline in backend signing authorization; an entitlement-owned, generation-bound timer serializes refresh/expiry and cancels huddle resources independently of audio WebSocket reconnects
• reject both reconnecting and initial audio handshakes that complete after entitlement expiry, refresh, huddle reset, leave, or channel replacement
• reject NIP-AB pairing in managed builds before any nsec can be encoded or exported
• route both loopback and exact evaos-teams://auth/callback fallback through one strict callback primitive; register the custom scheme only in managed builds, propagate that overlay to generate_context!(), and redact malformed URL logs
• gate every identified human-key signing, decryption, and owner-auth path on a current managed entitlement

Validation

Exact head: 357e4c43393278f5744dba97dd80cc000358798f

• focused managed protocol/auth/logout/expiry/huddle tests: 16 passed
• focused managed huddle suite: 94 passed
• focused managed pairing export guard: 1 passed
• full managed Rust suite before the final huddle-only remediation (single-threaded): 1581 passed, 13 ignored OS-keychain/real-relay integration tests, 0 failed
• managed cargo clippy --no-default-features --features evaos-teams-managed --lib --tests -- -D warnings: passed
• managed build output contains the exact TAURI_CONFIG rustc overlay with buzz and evaos-teams; native build output contains no overlay
• native cargo check --lib: passed
• native just desktop-tauri-clippy: passed
• desktop file-size policy: passed
• prior unchanged frontend proof: desktop checks/typecheck and 3403-test JavaScript suite passed before this Rust-only remediation
• canonical GitHub CI: run 30075499853 passed on this exact head, including Rust lint, native Desktop Core, Windows, macOS, all four smoke shards, and both relay-backed integration shards

Review status

The bounded final review at ed6127ebb48ef83eab69a2b6c7b621e4580ecbf1 verified the four earlier blockers and found passive huddle expiry plus Tauri rustc propagation residuals. The owner-authorized surgical review at 961652f181093d4e73d067f947b1cf775c64fdaf verified the Tauri fix and found that the first audio-bound expiry watcher could die on reconnect and race refresh. The surgical review at c8b4ded43811e56c72718c79cd7760d55e27e9a3 passed the entitlement generation/transition lifecycle, pipeline-drop ordering, and native correction, but found a supported initial-audio-handshake expiry race. The permitted final targeted delta review passed this exact head: the race is fixed, entitlement→huddle lock ordering is consistent and deadlock-free, and native behavior is unchanged.

All verified findings have a terminal disposition in the #4 tracker update.

Proof boundary

This draft stages source only. It does not merge, deploy the dashboard/relay/VM, sign or publish an app, mutate customer/runtime state, or prove a canary. Provider authentication and setup remain Hermes authority and are checked only when Hermes launches.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 40b1d671-11ec-4bd7-9a8d-3c6fbf5d10ad

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/4-managed-electric-login

---

_{Comment @coderabbitai help to get the list of available commands.}

[100yenadmin]

This pre-reset staging PR is closed as superseded by merged upstream-first reset PR #37 and the current thin-adapter tracker #1/#36.

No code is being deleted. The branch and review history remain available. Retained behavior was replayed narrowly in #37; dropped managed brokers, blanket guards, duplicate UI, and control-signed routine collaboration must not be revived from this PR.