Replace platform keyrings with daz-secrets

.env.example

@@ -137,12 +137,13 @@ RUST_LOG=buzz_relay=debug,buzz_datastore=info,buzz_db=debug,buzz_auth=debug,buzz
 # to a CLI flag of the same name (lowercase, hyphens → underscores). All values
 # are optional unless noted; defaults are shown in comments.
 #
-# Quick start:
-#   BUZZ_PRIVATE_KEY=<hex>  BUZZ_RELAY_URL=ws://localhost:3000  buzz-acp
+# Quick start (identity is read from daz-secrets):
+#   BUZZ_RELAY_URL=ws://localhost:3000 buzz-acp \
+#     --secret-service buzz-desktop --secret-account identity
 
 # ── Identity & auth ──────────────────────────────────────────────────────────
-# Nostr private key (hex or bech32). REQUIRED — identifies the agent on the relay.
-# BUZZ_PRIVATE_KEY=<32-byte hex or nsec1… private key>
+# Provider coordinates are non-secret CLI flags (`--secret-service` and
+# `--secret-account`). Private key bytes must never be placed in this file.
 
 # Relay WebSocket URL the harness connects to.
 # Note: the relay itself uses RELAY_URL (above); this is the ACP harness's
@@ -240,11 +241,6 @@ RUST_LOG=buzz_relay=debug,buzz_datastore=info,buzz_db=debug,buzz_auth=debug,buzz
 # high-throughput agents. Minimum 1.
 # BUZZ_ACP_EVENT_BUFFER=256
 
-# ── Legacy aliases ───────────────────────────────────────────────────────────
-# These are accepted for backward compatibility but the canonical names above
-# are preferred:
-#   BUZZ_ACP_PRIVATE_KEY  → BUZZ_PRIVATE_KEY
-
 # Optional relay join policy. Markdown is served by the relay so every join
 # surface can present the same documents. Each document and the independent age
 # attestation are optional; configuring any one enables policy acceptance.

.github/workflows/ci.yml

@@ -28,7 +28,7 @@
       web: ${{ steps.filter.outputs.web }}
       mobile: ${{ steps.filter.outputs.mobile }}
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 2
       - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
@@ -127,6 +127,25 @@
         uses: taiki-e/install-action@0fd46367812ee04360509b4169d9f659d6892bb2 # v2.79.15
         with:
           tool: cargo-nextest@0.9.136
+      - name: Install daz-secrets conformance provider
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          repository: darrenoakey/daz-secrets
+          ref: ef01d96a2fa8d661a6a2ad7dace77fce0f2f60aa
+          path: .ci/daz-secrets
+      - name: Configure isolated test credential provider
+        run: |
+          mkdir -p "$HOME/.config/daz-secrets" "$RUNNER_TEMP/daz-secrets"
+          go build -trimpath -o "$RUNNER_TEMP/daz-secrets/buzz-ci-provider" \
+            ./.ci/daz-secrets/cmd/daz-secrets-conformance-provider
+          chmod 0755 "$RUNNER_TEMP/daz-secrets/buzz-ci-provider"
+          printf '%s\n' \
+            'version = 1' \
+            "provider_path = \"$RUNNER_TEMP/daz-secrets/buzz-ci-provider\"" \
+            'provider_id = "buzz-ci-provider"' \
+            'timeout_ms = 2000' \
+            > "$HOME/.config/daz-secrets/provider.toml"
+          chmod 0600 "$HOME/.config/daz-secrets/provider.toml"
       - name: Unit tests
         run: just test-unit
 

AGENTS.md

@@ -164,10 +164,10 @@ check existing reply handlers for the pattern.
 
 ## Agent CLI (`buzz-cli`)
 
-`buzz` is the agent-first CLI. Auth env vars
-(`BUZZ_RELAY_URL`, `BUZZ_PRIVATE_KEY`, `BUZZ_AUTH_TAG`) are auto-injected
-by the ACP harness into managed agent subprocesses. In development, set
-`BUZZ_PRIVATE_KEY` and `BUZZ_RELAY_URL` in your environment manually.
+`buzz` is the agent-first CLI. Identity bytes come directly from the configured
+`daz-secrets` provider and must never be placed in env, argv, or files. Managed
+agents receive only the non-secret provider service/account coordinates. The
+relay URL and public owner-attestation metadata are supplied separately.
 
 ### Building the CLI