Plan: wire parent-control to real backends + phone-first host model

[hanwencheng]

closes #163

Stacked on #136 (base = claude/pensive-poincare-1a631e) because the docs/plan/web-flow/ files it amends live on that branch, not yet on main. GitHub will auto-retarget to main once #136 merges.

This PR was split out of #136 (the wiring plan + docs were cherry-picked here so #136 stays a clean UI-only PR; #136 also dropped 1,658 lines of superseded dead frontend code in the same cleanup).

What's here

1. wire-real-paths.md — how to wire every narrated/stub path to the real backends the wire demo already uses

Daemon-as-orchestrator (desktop host): reuse the proxy.rs broker client + shell to scripts/heima-*.sh for chain writes + the real cap→STS→worker→S3 memory path. Per-flow tables (onboarding §9, pairing §10.2, memory) map UI surface → data-model.md endpoint → real call → arch ref. Sequenced W0–W6 + harness-parity test.

2. §0.5 — phone-first host model (consistency)

Most operators will have only a phone, so the master plane can't depend on a localhost daemon. Decision: one portable agentkeys-core hosted three ways behind the same AgentKeysClient contract — WASM (web) / native lib (mobile, via UniFFI) / daemon (desktop). Consistency is structural (one Rust crate, no TS reimplementation); the daemon is demoted to one host; the broker is the only always-on component; the master plane is event-driven + biometric-gated (push-woken).

3. §11 — gating decision (VERIFIED against the contracts)

Read SidecarRegistry.sol + AgentKeysScope.sol: every master write is msg.sender-bound to the operator's secp256k1 key (operatorMasterWallet[omni] = msg.sender at bootstrap; msg.sender != master → revert everywhere; K11 P-256 assertion is an additional gate, not a substitute). So no relayer/key-free path without a contract change. Phone holds the secp256k1 key in the Keychain (SE is P-256-only → it seals the K11 passkey, not the EVM key); browser/WASM can't custody it → delegates broadcast. Fork: (A) keep msg.sender-bound (phone holds key, no contract work — recommended for MVP) vs (B) assertion-only auth (enables key-free/web/relayer masters, needs contract redesign + security review).

4. §12 — WASM lift scope

agentkeys-core carve-out (X0) → wasm-bindgen exports (X1) → CoreBackend behind AgentKeysClient (X2) → WebAuthn interop (X3) → chain-write delegation (X4). Shared investment with the future mobile UniFFI shell.

Also: data-model.md flags the browser-direct prohibition as desktop-first (relaxed for the master plane); arch.md §22c.3 gets a master control-plane host-model paragraph deferring to this plan.

No code in this PR — the actual wiring is the W0–W6 / X0–X4 work, to be scheduled after the plan is approved.

🤖 Generated with Claude Code

[hanwencheng]

Adversarial security review of §11 gating (codex) — committed as wire-real-paths-security-review.md

Verdict: fork (A) (keep msg.sender-bound) is the right direction — the current contracts are not assertion-only-safe — but (A) is NOT sound as written. The msg.sender-bound claim holds for post-bootstrap writes only.

Findings (full doc + required-changes checklist in docs/plan/web-flow/wire-real-paths-security-review.md, §11 callout updated):

• CRITICAL — registerFirstMasterDevice is unauthenticated first-call-wins → front-runnable operator lockout (SidecarRegistry.sol:100-123). Needs an on-chain first-master authorization proof.
• HIGH — registerAgentDevice / revokeAgentDevice are msg.sender-only, no K11 (SidecarRegistry.sol:214-251) → a compromised master EVM key binds rogue agents with no biometric (contradicts arch.md:608-612).
• HIGH — add-master K11 challenge omits newActorOmni + K11 cred/pubkey/attestation (SidecarRegistry.sol:167-193) → assertion reuse with substituted params.
• HIGH — "the phone holds the key" = a software secp256k1 root (Keychain/biometric-ACL, not SE-sealed) — weaker than the K11 hardware promise.
• HIGH — single global operatorMasterWallet (:66) ⇒ multi-device + recovery story is incomplete.
• HIGH — browser→host delegation needs a native confirmation that re-derives the K11 challenge + renders calldata (confused-deputy otherwise).
• MEDIUM — AgentKeysScope doesn't update WebAuthn signCount; fork (B) is unsafe until full-intent K11 binding lands on every path.

Also confirms the relayer analysis: a non-custodial relayer under (A) is impossible without meta-tx / ERC-4337 — EIP-2771 sponsors gas but still needs the secp key.