Summary
A hosted-community owner can retain the valid owner identity on Buzz Mobile yet be unable to recover Desktop access or administer the community. Mobile exposes neither a secure identity export/reveal nor the owner-only member-administration flow needed to admit a replacement Desktop key.
Incident
After Desktop lost the founder's owner identity, the phone remained logged in with the true owner key. The community had exactly one member row, the owner. Source inspection showed:
- Desktop pairing is source-only: Desktop sends its nsec to Mobile; Mobile cannot send the identity back.
- Mobile offers no nsec reveal/export.
- Mobile offers no member-administration UI that could add or elevate a replacement Desktop identity.
- Relay administration authorizes against the signer's own member row.
- NIP-OA delegation gives an agent access through the owner but does not grant owner/admin rights.
The corrected incident record is public at https://github.com/Seven-Day-Inc/centrifuge/issues/301#issuecomment-5133776152.
Expected behavior
A still-authenticated owner on Mobile needs at least one secure, supported recovery path:
- An encrypted identity export that can be imported on Desktop, or
- An owner-only mobile flow to add/elevate a replacement identity, with clear confirmation and audit evidence.
Ideally both exist, with the app prompting owners to establish and verify a second recovery copy before they become single-device owners.
Impact
The owner could still use the account on Mobile but could not restore Desktop ownership. Recovery required relay-operator intervention or rebuilding the community and re-minting every agent identity, auth tag, and host configuration.
Summary
A hosted-community owner can retain the valid owner identity on Buzz Mobile yet be unable to recover Desktop access or administer the community. Mobile exposes neither a secure identity export/reveal nor the owner-only member-administration flow needed to admit a replacement Desktop key.
Incident
After Desktop lost the founder's owner identity, the phone remained logged in with the true owner key. The community had exactly one member row, the owner. Source inspection showed:
The corrected incident record is public at https://github.com/Seven-Day-Inc/centrifuge/issues/301#issuecomment-5133776152.
Expected behavior
A still-authenticated owner on Mobile needs at least one secure, supported recovery path:
Ideally both exist, with the app prompting owners to establish and verify a second recovery copy before they become single-device owners.
Impact
The owner could still use the account on Mobile but could not restore Desktop ownership. Recovery required relay-operator intervention or rebuilding the community and re-minting every agent identity, auth tag, and host configuration.