Bypass manual routing for Buzz sign-in, derive and validate identity in the controller, and initialize only public owner routing using the current Host relay after the stale/cancel fence. Retained owners still must match; custody remains session-only.
Regression drives the real Node/Bun UI once with no controller owner configured and an explicit synthetic credential fixture. Focused 12-test checks, typecheck, and first-use PTY walkthrough pass. Earlier broad-suite 400-second failure remains unresolved; no production Keychain access or native rebuild.
Signed-off-by: Logan Johnson <loganj@squareup.com>
Selecting Sign in with Buzz key now dispatches the read of the saved Buzz
owner key immediately. The extra Beehive confirmation before it is removed:
selection itself is the explicit user gesture. While the read is in flight
the status line keeps the custody disclosure (Keychain read only, session
only, no local copy) and states that an OS keychain permission dialog is
separate and never bypassed or promised away.
Saved-key and matching-key import sign-in keep their confirmation and
input paths; helper source, owner matching, session-only custody,
cancellation and all backend behavior are unchanged. The test-only fixture
gains an inert env-gated pacing knob so a PTY driver can observe the
pending state and exercise Esc cancellation deterministically.
Verified with the synthetic source-UI PTY driver in a fresh
beehive-pairing-cli- HOME with explicit BEEHIVE_TEST_CREDENTIAL_FILE,
installed loader and service fences; production Keychain never read: one
selection reaches signed-in controls with no further Beehive input, and
Esc still cancels the in-flight read. Focused 12/12 backend and 8/8
renderer suites and package typecheck re-passed.
Signed-off-by: Logan Johnson <loganj@squareup.com>
