feat: reuse Pubky Ring identities by Jasonvdb · Pull Request #643 · synonymdev/bitkit-ios

Jasonvdb · 2026-07-24T13:46:32Z

Part of #571. Builds on merged #636.

Description

Discover Ring-owned Pubky profiles and explicitly connect the selected identity from Profile setup.
Keep only a source reference and session. Borrowed keys are verified just in time and are never persisted or backed up.
Share Bitkit-owned identities with Ring through the non-synchronizing pubky.shared Keychain group.
Revalidate borrowed access on launch, foreground, and Paykit writes. Definitive source loss disconnects; temporary Keychain failures remain retryable.
Clear borrowed Paykit state and published endpoints before removing local session access.
Preserve the existing callback, signup/auth approval, watch-only, and deletion flows.

Mirrors are verified before pruning or private deletion. Missing entitlements defer mirroring without deleting private data.

Release gate

Merge/release after Ring #342. Apple must provision pubky.shared for both App IDs, regenerate profiles, and pass signed two-app physical-device interoperability.

Design

Bitkit handoff: Profile choice and contact import overview.

Validation

Current head f0266f12 contains master f4d4dbe25; every PR commit is signed.

Shared-source gate/cache follow-up: 137 focused tests passed.
Source-loss endpoint/private-state cleanup: 134 focused tests passed.
Channel-usable refresh replay: 4 focused simulator tests passed.
Earlier branch validation: 319 focused simulator tests, 49 profile-manager tests, signed simulator build/entitlement checks.
SwiftFormat, translation validation, and git diff --check passed.
Current hosted CI is running.

Manual Tests

Tests used a disposable zero-balance simulator wallet and staging identities. Simulator results do not replace the signed physical-device release gate.

Automated coverage

PubkyAuthURLSchemeTests, PubkyProfileManagerTests, SharedPubkyIdentityTests, PaykitSdkClientConfigTests, PubkyAuthApprovalSheetTests, PubkyAuthRequestTests, and WalletViewModelReceiveTests.

Jasonvdb · 2026-09-17T11:23:41Z

@codex review

chatgpt-codex-connector · 2026-09-17T11:23:57Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-21T13:23:00.619760Z	`d7e860e`	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 54c60ac13c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

…tate

Jasonvdb · 2026-09-17T11:53:28Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b94ba49ee7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Jasonvdb · 2026-09-17T12:31:34Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6c611c54f5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

greptile-apps · 2026-09-18T13:53:01Z

Confidence Score: 3/5

The PR is not yet safe to merge because contact import can perform authenticated writes through a borrowed identity before foreground source revocation has been validated.

Findings

Revoked Identity Can Write ▶

Summary

This PR replaces the legacy Pubky Ring relay flow with shared-Keychain identity discovery and adoption, while adding provenance checks, lifecycle serialization, mirror reconciliation, and deletion ordering.

Introduces validated, non-synchronizing shared identity records and app-private source references.
Restores and refreshes borrowed sessions without persisting Ring-owned private keys.
Mirrors Bitkit-owned identities for Ring and removes mirrors before destructive cleanup.
Updates profile selection and contact-import presentation for explicit identity choice.
One authenticated contact-write path is not ordered behind source revalidation.

Diagram

sequenceDiagram
    participant Ring
    participant SharedKC as Shared Keychain
    participant Bitkit
    participant Pubky as Pubky Service

    Ring->>SharedKC: Publish owned identity record
    Bitkit->>SharedKC: Discover public references
    Bitkit->>SharedKC: Load selected credential
    Bitkit->>Pubky: Establish external session
    Bitkit->>Bitkit: Store source reference only
    Ring-->>SharedKC: Remove credential
    Bitkit-->>Bitkit: Foreground validation task
    Bitkit->>Pubky: Import contacts using existing session
    Note over Bitkit,Pubky: Import is not ordered after source revalidation

_{Reviews (1) · Last reviewed commit: "chore: merge master into shared pubky ri..."}

jvsena42

Three LOW notes inline and no HIGH/MEDIUM. Pubky Ring adoption sits behind the Paykit UI flag, so all of this reaches only opted-in users on released builds.

Checked:

Borrowed secret is never persisted. persistSessionAccess(shouldStoreLocalSecret:false) handles that. It throws if a local secret already exists, the backup snapshot is nil while a reference exists, and the receiver marker is suppressed for borrowed identities.
validate. It pins version, sourceApp, pubky and a 64-hex secret, and re-derives the public key. A Ring record can't be attributed to another pubky, and a to.bitkit: record can't be adopted as Ring's.
No secrets in logs, URLs, the pasteboard or toasts.
Approval sheet. It resolves the key for the displayed publicKey, rejects local and shared keys coexisting, and approves the pinned request.rawUrl.
Adoption rollback order. Reference first, then signIn, then the pubky check. Failure runs clearExternalSessionAccess → deleteReference. createIdentityLocked and useSharedRingIdentityLocked refuse to run over existing state.
Lifecycle lock. No nested acquisition.
AppReset. Mirrors are deleted and re-verified before private state is touched. wipeEntireKeychain is now scoped to Env.keychainGroup. The fail-closed wipe is deliberate and tested, and the pubky.shared entitlement is present for Debug and Release.
Upgrade from v2.5.0. Existing keys are unchanged. With no reference, resolveSessionInitialization restores as before, and legacy relay sessions pass the new provenance guards.
Parity with synonymdev/bitkit-android#1109. Android disconnects on unavailable too, but it reads through a ContentProvider, so the locked-Keychain case below is iOS-only.
Figma, Handoff v62. Contacts Import, the identity cards, the key icon, the pubkyGreen token and the title/illustration layout all match.

Jasonvdb · 2026-09-21T10:52:40Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ab2d476f02

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Jasonvdb · 2026-09-21T11:47:40Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5cdcb0c45e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Jasonvdb · 2026-09-21T12:19:01Z

@codex review

jvsena42

Delta since my last pass (ab2d476f, 930ed301, f738e631, 9b7cde64, merge 5cdcb0c4): no HIGH, no MEDIUM. One LOW follow-up on my existing thread: disconnecting on definitive source loss still leaves the borrowed key's Paykit endpoints published.

Checked against the Android twin synonymdev/bitkit-android#1109:

createIdentity over a restored legacy Ring session: absent here. createIdentityLocked refuses a stored .paykitSession with no .pubkySecretKey. It shares the lifecycle lock with initializeLocked, and .profile swaps to ProfileView once isAuthenticated flips.
Private endpoints on Ring loss: present, and broader. iOS removes neither public nor private endpoints on that path (thread reply).

Clean in the delta:

ab2d476f. errSecItemNotFound still maps to sourceIdentityMissing. Locked or unavailable Keychain statuses, and non-vault errors, are deferred with the reference kept, so writes still fail source validation.
930ed301. Every Paykit request/proof mutation revalidates the borrowed source and checks cancellation before writing. No direct SDK mutation remains outside PubkyService, and the revalidation takes no lock.
f738e631. .wallet backup omits the SDK snapshot whenever a reference exists, and throws if the reference is unreadable, so the previous upload stays intact. Restoring a nil snapshot clears SDK state after the reference, session and secret are gone.
Borrowed secret. Still never persisted, backed up or logged. Keychain groups are unchanged.
9b7cde64. Create shows only after a successful empty discovery. Loading and error states show only their own card, and the error card has Retry. This matches what codex asked for.
Merge. No conflict resolutions.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9b7cde645b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Jasonvdb · 2026-09-21T13:15:38Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d7e860ec8a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-09-21T13:22:58Z

@@ -636,12 +641,14 @@ struct PaykitPaymentRequestService {
            acceptedPaymentEndpointIdentifiers: acceptedPaymentEndpointIdentifiers,


Gate all remaining SDK writes on source validation

When Ring revokes a borrowed identity while Bitkit remains foreground, this wrapper protects the proposal itself but not every subsequent mutation: synchronize() still invokes processPendingMessages() without revalidation, and ContactPaymentsService.setEnabled() reaches the public endpoint and receiver-marker SDK writers without this hook. Polling can therefore deliver a previously queued message, or the user can toggle Contact Payments, using the cached session after its owner has revoked access. Fresh evidence after the prior fix is these remaining write paths; enforce source validation at the common SDK mutation boundary rather than only around selected request operations.

Useful? React with 👍 / 👎.

jvsena42

Delta since 9b7cde64 (950899df, d7e860ec): no HIGH, no MEDIUM. One LOW inline. The endpoint-removal point on my Keychain thread is still open; d7e860ec addressed codex's local-cache point only. I added notes there on the ordering to use when fixing it.

Checked and clean:

950899df gating. isPaykitMaintenanceAllowed defaults to false, is reset on every .active, and is set from a validation that runs under identityLifecycleLock. Adoption and sign-in serialize on the same lock, so maintenance never runs for an unvalidated identity. A Bitkit-owned identity validates immediately (no reference), so pending sign-out and profile-deletion retries still run on foreground.
Endpoints. refreshPublicPaykitEndpoints returning empty only reaches applyPublishedEndpoints([]) through callers that are already gated. User toggles throw noSupportedEndpoint instead of unpublishing.
d7e860ec ordering. It runs session → closeAndClear → reference. The reference is kept if session deletion throws, and a missing session doesn't loop.
Key material. Neither commit touches the borrowed secret. The backup snapshot is still omitted while a reference exists.

This was referenced Jul 24, 2026

feat: share Pubky identities with Bitkit pubky/pubky-ring#342

Open

feat: reuse Pubky Ring identities synonymdev/bitkit-android#1109

Open

ovitrif force-pushed the codex/pubky-paykit-figma-alignment branch from d769ad1 to cc972d7 Compare July 27, 2026 15:54

Base automatically changed from codex/pubky-paykit-figma-alignment to master July 27, 2026 17:40

Jasonvdb added 9 commits September 17, 2026 10:27

feat: reuse pubky ring identities

5057d6e

chore: rename changelog fragment

835c786

fix: preserve bare pubkys beginning with prefix

26f99f3

fix: align Pubky import overview with designs

6494510

fix: treat a shared Pubky source as a stored identity

677938a

fix: serialize Pubky signup with identity lifecycle changes

ad82277

fix: keep stripping the pubky prefix from non-canonical display keys

4a1e141

fix: refuse pubky signup over an unrecoverable session

3db6cf4

fix: never publish a receiver marker for a borrowed pubky

fbbf510

Jasonvdb force-pushed the codex/shared-pubky-ring branch from dcf89bb to 54c60ac Compare September 17, 2026 11:17

chatgpt-codex-connector Bot reviewed Sep 17, 2026

View reviewed changes

Comment thread Bitkit/Services/SharedPubkyIdentityVault.swift Outdated

Comment thread Bitkit/Managers/PubkyProfileManager.swift

Jasonvdb added 2 commits September 17, 2026 13:39

fix: erase every Bitkit-owned shared mirror before deleting private s…

d59bb19

…tate

fix: revalidate a borrowed pubky source before deleting the profile

1dbe1e0

chatgpt-codex-connector Bot reviewed Sep 17, 2026

View reviewed changes

Comment thread Bitkit/Managers/PubkyProfileManager.swift

fix: revalidate a borrowed pubky source before erasing contacts

efd3661

chatgpt-codex-connector Bot reviewed Sep 17, 2026

View reviewed changes

Comment thread Bitkit/Managers/PubkyProfileManager.swift

Comment thread Bitkit/Views/Profile/PubkyChoiceView.swift Outdated

Jasonvdb added 2 commits September 18, 2026 08:16

refactor: remove obsolete ring requester flow

a4e4d83

chore: merge master into shared pubky ring

acd5269

Jasonvdb marked this pull request as ready for review September 18, 2026 13:47

greptile-apps Bot reviewed Sep 18, 2026

View reviewed changes

Comment thread Bitkit/Views/Profile/PubkyChoiceView.swift

jvsena42 reviewed Sep 18, 2026

View reviewed changes

Comment thread Bitkit/Services/SharedPubkyIdentityVault.swift Outdated

Comment thread Bitkit/Managers/PubkyProfileManager.swift

Comment thread Bitkit/Views/Profile/PubkyChoiceView.swift Outdated

fix: harden borrowed pubky access and recovery

ab2d476

Jasonvdb force-pushed the codex/shared-pubky-ring branch from 14de1dd to ab2d476 Compare September 21, 2026 10:49

chatgpt-codex-connector Bot reviewed Sep 21, 2026

View reviewed changes

Comment thread Bitkit/Managers/PubkyProfileManager.swift

Comment thread Bitkit/Managers/PubkyProfileManager.swift

chore: merge master into shared pubky ring

5cdcb0c

chatgpt-codex-connector Bot reviewed Sep 21, 2026

View reviewed changes

Comment thread Bitkit/Views/Profile/PubkyChoiceView.swift Outdated

Jasonvdb added 3 commits September 21, 2026 14:04

fix: revalidate borrowed pubky writes

930ed30

fix: exclude borrowed paykit backup state

f738e63

fix: wait for pubky discovery before create

9b7cde6

jvsena42 reviewed Sep 21, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed Sep 21, 2026

View reviewed changes

Comment thread Bitkit/AppScene.swift Outdated

Comment thread Bitkit/Managers/PubkyProfileManager.swift Outdated

Jasonvdb added 2 commits September 21, 2026 15:13

fix: gate foreground paykit maintenance

950899d

fix: clear borrowed paykit state on disconnect

d7e860e

chatgpt-codex-connector Bot reviewed Sep 21, 2026

View reviewed changes

fix: remove paykit endpoints before shared teardown

ac9207b

jvsena42 reviewed Sep 21, 2026

View reviewed changes

Comment thread Bitkit/ViewModels/WalletViewModel.swift Outdated

fix: replay gated paykit channel refresh

f0266f1

		@@ -636,12 +641,14 @@ struct PaykitPaymentRequestService {
		acceptedPaymentEndpointIdentifiers: acceptedPaymentEndpointIdentifiers,

Conversation

Jasonvdb commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Release gate

Design

Validation

Manual Tests

Automated coverage

Uh oh!

Jasonvdb commented Sep 17, 2026

Uh oh!

chatgpt-codex-connector Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Jasonvdb commented Sep 17, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Jasonvdb commented Sep 17, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

greptile-apps Bot commented Sep 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 3/5

Findings

Summary

Diagram

Uh oh!

Uh oh!

jvsena42 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Jasonvdb commented Sep 21, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Jasonvdb commented Sep 21, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Jasonvdb commented Sep 21, 2026

Uh oh!

jvsena42 left a comment

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Jasonvdb commented Sep 21, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Jasonvdb commented Jul 24, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Sep 17, 2026 •

edited

Loading

greptile-apps Bot commented Sep 18, 2026 •

edited

Loading