[brow]

Follows #8654.

Deriving an x-only public key from a secret key with nostr.Keys(secret).public costs about 5.6 ms in pure Dart on an iPhone SE (2nd gen, Profile). The app does it in 10 places, including relay config, the signed-event relay's pubkey getter, push lease checks, status updates, and the settings identity row's build method. This routes all of them through derivePublicKeyHex from #8654, which takes 16.5 µs on the same device.

Behavior is unchanged for valid keys: output is the same lowercase hex. For a malformed or out-of-range key the thrown type changes from nostr's InvalidKeyException to ArgumentError; every affected site either catches all errors or rethrows its own FormatException/StateError, and nothing in lib or test matches on the old type.

Sites that need a full nostr.Keys object (key generation, AccountIdentityStore) are unchanged.

Validation

• derivePublicKeyHex is checked against nostr.Keys for 64 random keys in perf(mobile): sign events with native libsecp256k1 on iOS and Android #8654's event_signing_test.dart.
• Full mobile analyze and test suite pass on this branch after rebasing onto main, including the package's own tests.
• iPhone 12 mini, Profile build of this stack (with perf(mobile): compute NIP-44 ECDH with native libsecp256k1 #8656 and perf(mobile): verify signatures with native libsecp256k1 #8657 on top): paired to the internal Buzz community through Desktop; relay auth, identity row, avatar, and channel/DM/inbox loading all worked under the derived key.

buzz-review-completed (agent review, Codex and security review clean; device validation above; human app test not applicable under the mobile testing exception)

🤖 Generated with Claude Code

[brow]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T23:33:32.186814Z	4f36965	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: 58bf4c40f1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[brow]

@codex review

[github-actions]

🔐 Codex Security Review

Note: This is an automated, security-focused review generated by Codex.
Use it as a supplement to human review; false positives are possible.

Scope

• Exact PR diff: 4ff02bf03b73b6e07ac45beca833652e0272478a...4f369657c48fee342fe79a656e3631421d59002b
• Model: gpt-6.1-sol

💡 Click "edited" above to see earlier reviews for this PR.

---

Review Summary

Overall Risk: NONE

No concrete security, correctness, or reliability regressions identified in the authorized PR range.

Findings

No concrete security, correctness, or reliability findings were identified.

Notes

• Review used read-only source, history, and test inspection. Builds and tests were not executed, as requested.

---

_{Generated by Codex Security Review |
Requested by: @brow |
Workflow run}

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: 4f369657c4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".