Clarify NIP-FI conformance boundaries

Define delegated skew locally, make the DELEG and EDGE path interaction
explicit, and specify mutation subjects for CONF's own oracles. Also align
core and discovery terminology with their actual semantics.

Co-authored-by: Wren <5217c5c2f7bfb4333e46d17c98a9255a52dadee18dcd43a43536b95e6776dfa0@buzz.block.builderlab.xyz>
Signed-off-by: Wren <5217c5c2f7bfb4333e46d17c98a9255a52dadee18dcd43a43536b95e6776dfa0@buzz.block.builderlab.xyz>

docs/nips/NIP-FI-CONF.md

@@ -193,7 +193,9 @@ For each listed oracle the suite MUST retain at least one **mutant**: an
 implementation variant that violates a requirement that oracle governs,
 together with that oracle's failing output (`FI-CONF-MUTATION`). Evidence is
 the exact patch identity, the oracle identifier, and the retained failure
-output at the claimed head.
+output at the claimed head. For this document's own oracles the implementation
+under test includes the conformance suite and its report; a mutant is a single
+variant of the suite or report that the entry's own oracle rejects.
 
 While `FI-CONF-INTEROP-EXIT` is validly deferred it remains in claim
 completeness but is excluded from this section's mutation and global-control

docs/nips/NIP-FI-DELEG.md

@@ -17,7 +17,11 @@ and RFC 8174) when, and only when, they appear in all capitals.
 This profile authorizes a delegate key from separately validated delegation
 evidence rooted in a currently eligible NIP-FI owner binding. The delegate
 proves its own key. It does not present a federated assertion and never receives
-or inherits the owner's binding.
+or inherits the owner's binding. Because a trusted edge inserts assertion and
+provenance fields on every request it forwards, and `FI-DELEG-PATH-SEPARATION`
+denies any such field on a delegated request, delegated requests cannot traverse
+a route that requires edge provenance; they use ingress on which NIP-FI-EDGE is
+not required.
 
 This profile defines the normalized delegation result and its additional
 preparation, final-admission, and lease witnesses. It does not define a wire
@@ -51,8 +55,9 @@ when their concrete encoding belongs to the supplying delegation protocol.
 The evidence authenticates every field, has one unambiguous owner and delegate,
 matches the server-owned domain and exact request or target, and has a finite
 expiry satisfying `now < mandatory_expiry`; equality at an expiry is expired.
-Optional `not_before` satisfies `not_before <= now + skew`, as core defines for
-`nbf`. The proven actor equals `delegate_key`. [FI-DELEG-EVIDENCE-CLOSED]
+Optional `not_before` satisfies `not_before <= now + skew`, using the
+configured delegated `skew`; arithmetic is overflow-safe. A missing value
+denies. The proven actor equals `delegate_key`. [FI-DELEG-EVIDENCE-CLOSED]
 
 A delegated request carries fresh request-appropriate Nostr proof and no
 `Nostr-Federated-Identity` or profile provenance field. Mixed direct and
@@ -120,8 +125,8 @@ material. [FI-DELEG-NO-BINDING]
 
 ## Delegated leases
 
-A deployment configures a positive finite delegated maximum. The lease deadline
-is no later than the minimum of:
+A deployment configures a positive finite delegated maximum and a non-negative
+finite delegated `skew`. The lease deadline is no later than the minimum of:
 
 - delegation expiry;
 - delegate proof or connection bound;
@@ -149,11 +154,11 @@ or owner key on the same connection. [FI-DELEG-OWNER-CURRENT]
 
 ## Discovery
 
-A relay claiming this profile MAY add `"delegation": true` to the NIP-FI
-object in NIP-11 only when owner-current resolution, the positive finite
-maximum, uniform final admission, and all profile oracles are active. It does
-not advertise relationship IDs, owner keys, private delegation protocol names,
-or policy detail. [FI-DELEG-DISCOVERY]
+A relay claiming this profile MAY add `"delegation": true` to the NIP-11
+`federated_identity` object only when owner-current resolution, the positive
+finite maximum, uniform final admission, and all profile oracles are active. It
+does not advertise relationship IDs, owner keys, private delegation protocol
+names, or policy detail. [FI-DELEG-DISCOVERY]
 
 ## Behavioral oracles
 

docs/nips/NIP-FI.md

@@ -44,8 +44,7 @@ public identity projection, application membership policy, or user interface.
 - **actor** (`k`): the 32-byte public key returned by Nostr-proof validation.
 - **request context** (`R`): `R_t` sealed with `k`.
 - **binding**: a durable, versioned association `(D, i, k)` with immutable
-  provenance `attested-key`, `tofu`, or a companion-profile value such as
-  `provisioned`.
+  provenance `attested-key`, `tofu`, or `provisioned`.
 - **retired pair**: a durable denial fact for an exact `(D, i, k)`.
 - **revoked key**: a durable denial fact for `(D, k)`.
 - **prepared authorization**: immutable, read-only evidence and witnesses for a
@@ -185,7 +184,7 @@ The Nostr-key claim is named `nostr_pubkey`. When present it MUST be a
 lowercase hexadecimal encoding of exactly one 32-byte Nostr public key; other
 encodings and aliases deny. In `attested-key` enrollment policy and wherever
 current matching issuer attestation is required, this exact claim MUST be
-present and equal the proven actor. Authorization claims or capabilities use a
+present and equal the proven actor; authorization claims or capabilities use a
 closed bounded input set and deterministic canonical encoding. Unchecked claims
 never enter the result. [FI-TRACE-VERIFIER-PARITY]
 
@@ -314,7 +313,7 @@ to lowercase hexadecimal SHA-256 of the **body bytes**: the complete content
 after transfer decoding and before any content decoding. Absence, duplication,
 mismatch, validation of only a prefix, or substitution of the body bytes after
 validation denies. For an irrelevant body, no
-Authorization decision, target, capability, or effect selector derives from a
+authorization decision, target, capability, or effect selector derives from a
 body field not bound by NIP-98. A `payload` tag present on an operation whose
 body is declared authorization-irrelevant is validated identically against the
 body bytes; duplication or mismatch denies. [FI-TRACE-BODY-BINDING]