jerry/buzz
1
0
Fork 0
mirror of https://github.com/block/buzz.git synced 2026-11-08 10:21:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

Clarify community FI policy operator safeguards

Browse Source 
Co-authored-by: Honor <e0bf479eeebe47dde1e35705212a4df70616a7bc834d907ddfb18cf0405f8b1b@seiler-test.communities.public.builderlabstaging.xyz>
Signed-off-by: Brad Seiler <seiler@squareup.com>
This commit is contained in:
Brad Seiler
2026-11-06 12:28:00 -05:00
parent 9b072f5a0c
commit d3bf876202
3 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
.env.example
View File

@@ -470,8 +470,8 @@ RUST_LOG=buzz_relay=debug,buzz_datastore=info,buzz_db=debug,buzz_auth=debug,buzz
# key and NIP-FI enforcement. Profiles are historical records and are never
# retracted.
# New irreversible community FI acceptances stay disabled until the fleet's
# enforcement and activation baseline is verified. Disabling preserves receipts.
# Permit community FI policy enables and disables only after the whole fleet
# supports policy management. A closed gate preserves receipt recovery/status.
BUZZ_NIP_FI_UPGRADES_ENABLED=false
# NIP-CL compact membership discovery. Deploy fleet-wide dark before enabling.

2
crates/buzz-relay/src/config.rs
View File

@@ -408,7 +408,7 @@ pub struct Config {
/// Parsed whatever the NIP-FI mode, since creation happens in every mode.
pub nip_fi_provision_binding: Option<buzz_auth::ProvisionBindingPolicy>,
/// Permit new irreversible FI upgrade acceptances. Default off; receipt
/// Permit new community FI policy enables and disables. Default off; receipt
/// recovery/status remain available (`BUZZ_NIP_FI_UPGRADES_ENABLED`).
pub nip_fi_upgrades_enabled: bool,

6
docs/community-auth-upgrades.md
View File

@@ -127,8 +127,10 @@ Stop an uncertain initiating caller and preserve its operation evidence. Read
current policy before deciding whether to issue a new explicit CAS disable.
A timeout is not permission to discard the original request or edit SQL.
Disable is a supported operator action; acceptance is no longer monotonic.
Last-issuer removal is allowed after disable, and re-enable must recheck trust
and the exact binding. Removing trust never implicitly clears stored policy.
Disable removes the required-policy block on last-issuer removal; the separate
last-binding guard still applies. The operator unbind command keeps the last
issuer for bindable hosts. Re-enable must recheck trust and the exact binding.
Removing trust never implicitly clears stored policy.
Close the mutation gate to stop new changes while keeping recovery available.
Use established archive/lifecycle containment or repair FI trust as appropriate;