Problem

Buzz stores each secret as a separate keychain item — the identity key plus one entry per managed agent (6 agents = 7 items total). On dev builds (old keychain, null ACL) every read and write triggers a prompt: 15–20+ on first launch. On release builds (DPK) the first launch prompts once per key (7 total). This is the root cause of the excessive prompting reported in the security channel.

Solution

Consolidate all secrets into a single JSON blob entry (service = "buzz-desktop", username = "secrets"). One keychain access per process lifetime on read, one on write. One prompt on first launch, zero after — the same pattern Goose uses.

SecretStore gains an in-memory Mutex<Option<HashMap<String,String>>> cache. After the first read the blob is cached; subsequent probe/load/store/delete calls within the same process never touch the keychain again. agent_secret_store() is cached via OnceLock so the blob cache survives across call sites (previously each call constructed a fresh SecretStore with a cold cache).

Migration

On first launch after upgrading from the per-key DPK format, the blob doesn't exist yet. probe() checks old per-key DPK/keyring entries via probe_legacy_key() so callers that gate load() on Present (like resolve_identity_with_store) still trigger migration — without this, probe() would return ReachableButEmpty for keys that exist only in the old format, causing silent identity rotation. load() then falls back to reading the old per-key DPK entry (macOS) or legacy keyring entry (all platforms), writes it into the new blob, and deletes the old item — one-time per key, transparent to callers. Agent keys that aren't found are re-populated from inline JSON by hydrate_keys on the same launch.

Behavior after this change

Relationship to #1266

The is_dpk_unavailable (-34018) fallback from #1266 is incorporated here — unsigned dev builds fall back to the legacy keyring crate for the single blob entry. This PR supersedes #1266 for the prompt-reduction goal; #1266 still fixes the dev-build panic independently and should merge first (this PR is based on main and is compatible either way).

Stack: #1266 → this PR

Tests

Four integration tests are marked #[ignore] — they require the real OS keychain and can't run in CI on unsigned builds. Run locally with:

cargo test -p buzz-desktop -- --ignored blob_

• blob_stores_and_retrieves_multiple_keys — multi-key store/load round-trip
• blob_probe_present_absent_unreachable — probe semantics with and without blob
• blob_delete_removes_key_not_others — key isolation on delete
• blob_migration_from_per_key_entry — end-to-end legacy key migration (seed old per-key entry → probe finds it → load migrates into blob → old entry deleted)

Files changed

• desktop/src-tauri/src/secret_store.rs — rewritten: blob storage, in-memory cache, legacy key probe/migration
• desktop/src-tauri/src/managed_agents/storage.rs — agent_secret_store() cached via OnceLock
• desktop/src-tauri/Cargo.lock — security-framework promoted to direct dep (was already transitive)

Caller interface

IdentityKeyStore and KeyStore traits in app_state.rs and managed_agents/storage.rs are unchanged. probe/load/store/delete semantics are preserved exactly.