eleven / ocho Public

Native "Sign in with Eleven": passkey sign-in + synced server list (iOS + Mac) (#412)

* home,core: Sign-in-with-Eleven foundation — AASA, native crypto, targets

The verifiable groundwork for native "Sign in with Eleven":

- home serves /.well-known/apple-app-site-association (webcredentials
  for both app bundle ids) so native passkeys bind to this RP. No RP
  change — its origin is already home.elevenmessenger.com.
- HomeCrypto: the backup crypto ported to Swift/CryptoKit, byte-
  compatible with home/web/static/crypto.js (PRF→HKDF KEK, DEK wrap,
  16 KiB padding, EHB1 envelope). Proven by a cross-impl vector — Swift
  opens a JS-sealed blob and reads the server list (HomeCryptoTests).
- Deployment targets bumped to iOS 18 / macOS 15 (native passkey PRF
  needs them) and the webcredentials associated-domain added to both
  app entitlements.

Next: HomeClient (the API), the native WebAuthn+PRF ceremony, and the
first-run UI.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* core: HomeClient (API) + HomeVault (blob contents, order, sync ops)

HomeClient speaks home's WebAuthn begin/finish + blob GET/PUT wire
(base64url, ETag/If-Match optimistic concurrency). HomeVault is the
decrypted backup: the { v, servers:[{url,name,icon,order?,credentials}] }
schema (order added for cross-device list ORDER, not just membership),
open-with-PRF, re-seal preserving other passkeys' wrapped DEKs, and
upsert/reorder helpers for the sync cycle.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* core: HomeAuth — native passkey+PRF ceremony (AuthenticationServices)

The iOS18/macOS15 ceremony: discoverable sign-in (or register for a
first backup) with the PRF extension evaluating the same input the web
uses, Apple's raw fields reshaped into the WebAuthn JSON go-webauthn
verifies, returning link token + credential id + PRF output. Apple's
overlay hands PRF back as a SymmetricKey — its raw bytes are exactly
the web's HKDF input, so the KEK matches. Compiles against the SDK;
the ceremony itself needs a device + the home AASA deployed to run.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* ios: first-run "Sign in with Eleven" — restore your spaces from a passkey

The no-servers first run now leads with "Sign in with Eleven": a passkey to
home.elevenmessenger.com restores your saved server list onto this device
(HomeAuth ceremony → fetch blob → HomeVault.open → SavedInstances). Joining a
specific chat by invite link (paste / QR) is demoted to a quiet secondary
action. PRF output never leaves the device.

- HomeSignInModel orchestrates ceremony → restore, with inline status (restored
  N / empty backup / no passkey / error) — no floating toast.
- ElevenMark imageset (the real purple "11" tile) for the welcome brand.
- Mac is deferred: its webcredentials entitlement needs this Mac registered in
  the dev account (breaks local ad-hoc builds otherwise), and macOS sign-in
  needs the same. Reverted the Mac entitlement + macOS 15 bump; iOS keeps
  iOS 18 + webcredentials. HomeAuth stays @available(macOS 15) — compiles,
  uncalled on Mac until we bump + register.

Not yet testable end-to-end: home must serve the AASA (route is in this branch,
not deployed) and the ceremony needs a device biometric.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* core: realign HomeVault to the shipped star/sort schema (array-order + starred)

Home was upgraded so the saved-spaces list uses ARRAY ORDER as the master order
plus a per-server `starred` boolean — not the `order` field HomeVault had. Match
home/web/static/serverlist.js: entry is { url, name?, starred?, credentials },
and port its pure helpers (partition / toggleStar / moveInGroup / order) with a
Swift test that mirrors serverlist.test.mjs — so the native rail sorts a member's
spaces identically to the home page. `starred: nil` serialises as an ABSENT key
(matching the web's flag-drop), verified by test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* ios: starred servers populate the rail; the rest fold under "More"

SavedInstance gains a `starred` flag (optional, so old saved lists still decode).
Once anything is starred, the server drawer shows only the stars and collapses
the rest under a "More" disclosure — matching the home page. Long-press a server
→ Star / Unstar (repositioned like the vault's toggleStar: star → end of the
starred group, unstar → top of the rest). A ★ marks starred rows.

Local-only for now — the home-vault write-back (so home ↔ apps stay in sync)
lands with the sign-in ceremony. Mac rail parity follows.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* mac: starred servers populate the rail; the rest fold behind "More"

Rail parity with iOS + home: once anything is starred, the server rail shows
only the starred icons, with the rest behind a quiet ellipsis "More" toggle
(Discord's more-servers idiom; auto-opens when the selected chat lives in the
fold). Right-click an icon → Star / Unstar, above Remove.

Star state lives on the shared SavedInstance (the record iOS uses and the home
vault syncs) — a chat is starred iff its native identity is, so the item only
appears once the identity has been extracted (first open). toggleStar repositions
both the instances list and the rail's chats array with the vault's boundary
semantics (star → end of starred, unstar → top of the rest).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* core,ios,mac: home-vault sync — stars/order/adds flow device ↔ home

HomeSync keeps the device's server list and the home backup in lockstep:

- HomeSession (Keychain): the home link token + blob DEK, kept after sign-in so
  routine changes sync without re-running Face ID. No new exposure class — the
  DEK opens the backup, whose contents (server credentials) already live in the
  same Keychain via InstancesStore. The PRF output is never stored.
- push: upsert the device's list (order + stars + names + credentials) into the
  vault; vault-only entries (spaces saved elsewhere, incl. credential-less
  {url,name} bookmarks — now decoded as optional) are preserved, tailed. One
  refetch+reapply on a 409. Serialised so quick star-taps can't interleave.
- Sync never deletes from the vault; removal stays an explicit act on home.
- Wiring: every iOS AppState mutation (add/remove/move/star/note) and the Mac's
  star/drag/remove push; the Mac translates to RAIL order (chats drives it).
- Restore now applies vault stars, saves the session, and pushes device-only
  servers up — so home matches the device from the very first sign-in.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* ios: "Sign in with Eleven" from the server drawer; Debug dev-mode association

Two pieces that make the ceremony reachable on a device that already has
servers (first-run never shows there):

- The drawer's footer offers "Sign in with Eleven" until a home session exists —
  the entry point for a device that joined by invite link to start syncing its
  list. Runs the same HomeSignInModel as first-run; failures render inline, and
  success needs no banner (the restored servers just appear in the list).
- Debug builds sign with LChat-Debug.entitlements, whose webcredentials
  association carries ?mode=developer — dev installs bind to home immediately
  instead of waiting on Apple's CDN. Release keeps the clean association.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* ios: drawer sign-in surfaces every outcome; "Sign in"; add Sign out

The first device run failed SILENTLY: a non-cancel ASAuthorizationError mapped
to .noPasskey, which the drawer didn't render — loading state, then the button
just re-armed. Now every terminal phase says something inline, and ceremony
errors surface verbatim (code included) so the next failure names itself.

Also: the drawer row is just "Sign in" (was "Sign in with Eleven"), and a
signed-in drawer offers "Sign out" — forgets the home session (Keychain), keeps
the device's servers, so signing back in is testable.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* core: native passkey registration labels the account "Eleven" (matches home #365)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* ios,core: explicit "Back up this device" mints a passkey + first backup

Sign in never mints a passkey: home has no account discovery, so registering
always creates a NEW anonymous account — riding it on the sign-in button is the
exact fallback the web dropped in #323. Instead the drawer offers a quiet,
explicit "New to Eleven? Back up this device" (shown when signed out with
servers to back up): it runs the registration ceremony, seals the device's
server list into a fresh envelope keyed only to the new passkey
(HomeVault.sealFresh — the web's createBlobFor), stores it with If-Match "0",
and keeps the session so sync starts immediately.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: address all 10 confirmed findings from the adversarial review

Correctness (data loss / dead ends):
- restore() now merges VAULT-WINS: stars/names/order from the vault apply to
  servers the device already has (AppState.applyVault) BEFORE the write-back —
  the device-wins push was silently wiping stars other devices stored.
- Blob-less account (404 on sign-in): create the first envelope right there
  with the PRF in hand (sealFresh + If-Match "0") and save the session — it
  was a permanent dead-end (no session, push can't create a blob).
- Mac noteIdentity preserves `starred` — every page load was clearing it and
  the next sync pushed the unstar vault-wide.
- Session state is a @Published on HomeSignInModel (sessionExists) shared by
  first-run and the drawer — the drawer's one-shot @State stayed stale after a
  first-run sign-in, leaving "Back up this device" visible; tapping it minted
  a SECOND home account and orphaned the real backup. backUp() also refuses
  outright when a session exists (defense in depth).
- Per-group .onMove (AppState.moveInGroup): starring anything had killed
  drag-reorder entirely on iOS.
- Deployment target back to iOS 17: the PRF ceremony is runtime-gated
  (#available(iOS 18)) with the pre-sign-in first-run card and no drawer
  affordances below 18 — the 18 bump stranded every iOS 17 member.
- Dropped the unreachable Phase.noPasskey (cancel is indistinguishable from
  no-passkey at the API); its guidance is now static idle copy on first-run.

Round-trip fidelity:
- HomeSync.push works on the RAW JSON object (HomeVault.openRawObject/
  sealRawObject) and patches only fields this build owns — strict-Codable
  re-encoding stripped unknown top-level/per-server/credentials fields that
  newer clients wrote (the web spread-merges; test added).

Build + docs:
- home/main.go reset to main's (the rebase had re-added serveAASA — duplicate
  method, home package didn't compile).
- Mac syncHome documented as DORMANT until Mac sign-in ships (task tracked).

95 tests green (incl. new raw round-trip regression); iOS + Mac build clean at
target 17/14.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* mac: "Sign in with Eleven" from Settings (staged behind device registration)

The Settings General pane gains an Eleven section: Sign In runs the passkey
ceremony (runtime-gated to macOS 15 — the target stays 14) and merges the
vault VAULT-WINS into this Mac: SavedInstances upserted (identity + star, the
resolved myUserId preserved), missing rail entries created, the vault's order
applied to the rail, and only then the push — the iOS data-loss lesson. A
blob-less account seals the Mac's servers straight into a first envelope
(If-Match "0") rather than dead-ending. Signed in shows Sign Out + the sync
one-liner; session state is @Published so it can't go stale.

ACTIVATION (two flips, morning): register this Mac in the team
(scratchpad/register-mac.sh — the ASC API call the auto-mode classifier
correctly held for approval), then point the LChatMac Debug
CODE_SIGN_ENTITLEMENTS at the staged LChatMac-Dev.entitlements
(webcredentials + ?mode=developer, mirroring iOS Debug; never ships).
Until then the button reports the association error honestly.

Closes the review's "dormant Mac sync plumbing" finding: the Mac now has the
sign-in entry point that makes syncHome real.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* mac: activate the Debug webcredentials entitlement (Mac registered: 8VWU966HQ3)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* mac: blank feed after send — verified pin, no history-yank, wedge recovery

The post-send jump was a one-shot scrollTo computed against estimated
LazyVStack row heights while the composer inset shrank under it — the
content resizes mid-jump and the viewport ends clamped past the real
end: a fully blank feed (the third inset-change blanking, after #297
and #318). Sends and at-bottom arrivals now go through pinUntilSettled,
which re-pins against measured geometry until the last row is flush.

Two more in the same handler: the nearBottom check defaulted UNKNOWN
(old last row unmaterialised = reader deep in history) to true, yanking
readers to the bottom on every arrival — now defaults to false; and a
wedged feed (zero materialised rows while messages exist) always
re-pins its way out.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* ios: Debug-only 'Reset app' in the drawer — wipe Keychain + stores for a true first run

Keychain items survive an app uninstall, so reinstalling never resets a
device — first-run flows were untestable. DevReset clears both Keychain
services (identities, thread keys, home session), UserDefaults, and the
on-disk stores, then exits; Debug UI only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* ios: first-run copy — 'Group chat made by dreams', plain 'Sign in', home's privacy pitch

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* ios: sign-in lands you IN the app — syncing state, auto-entry, last-space memory

Restore populated instances but nothing selected one, so sign-in
stranded the user on the welcome screen with a green count. Now: the
ceremony shows 'Syncing your spaces…' once the sheet is down, RootView
selects a space the moment instances land, and the selection is
remembered (UserDefaults) so launches and restores open the last space
you were in — falling back to the first in vault order.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>