From d3bf876202f98e9a5382e3dd3bd0e34dbc3d7f84 Mon Sep 17 00:00:00 2001 From: Brad Seiler Date: Fri, 6 Nov 2026 12:28:00 -0500 Subject: [PATCH] Clarify community FI policy operator safeguards Co-authored-by: Honor Signed-off-by: Brad Seiler --- .env.example | 4 ++-- crates/buzz-relay/src/config.rs | 2 +- docs/community-auth-upgrades.md | 6 ++++-- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/.env.example b/.env.example index 9d821ab559..ba4c9cf230 100644 --- a/.env.example +++ b/.env.example @@ -470,8 +470,8 @@ RUST_LOG=buzz_relay=debug,buzz_datastore=info,buzz_db=debug,buzz_auth=debug,buzz # key and NIP-FI enforcement. Profiles are historical records and are never # retracted. -# New irreversible community FI acceptances stay disabled until the fleet's -# enforcement and activation baseline is verified. Disabling preserves receipts. +# Permit community FI policy enables and disables only after the whole fleet +# supports policy management. A closed gate preserves receipt recovery/status. BUZZ_NIP_FI_UPGRADES_ENABLED=false # NIP-CL compact membership discovery. Deploy fleet-wide dark before enabling. diff --git a/crates/buzz-relay/src/config.rs b/crates/buzz-relay/src/config.rs index 215c1472fc..fc0ea1e62c 100644 --- a/crates/buzz-relay/src/config.rs +++ b/crates/buzz-relay/src/config.rs @@ -408,7 +408,7 @@ pub struct Config { /// Parsed whatever the NIP-FI mode, since creation happens in every mode. pub nip_fi_provision_binding: Option, - /// Permit new irreversible FI upgrade acceptances. Default off; receipt + /// Permit new community FI policy enables and disables. Default off; receipt /// recovery/status remain available (`BUZZ_NIP_FI_UPGRADES_ENABLED`). pub nip_fi_upgrades_enabled: bool, diff --git a/docs/community-auth-upgrades.md b/docs/community-auth-upgrades.md index 1692b5ee52..751fc536da 100644 --- a/docs/community-auth-upgrades.md +++ b/docs/community-auth-upgrades.md @@ -127,8 +127,10 @@ Stop an uncertain initiating caller and preserve its operation evidence. Read current policy before deciding whether to issue a new explicit CAS disable. A timeout is not permission to discard the original request or edit SQL. Disable is a supported operator action; acceptance is no longer monotonic. -Last-issuer removal is allowed after disable, and re-enable must recheck trust -and the exact binding. Removing trust never implicitly clears stored policy. +Disable removes the required-policy block on last-issuer removal; the separate +last-binding guard still applies. The operator unbind command keeps the last +issuer for bindable hosts. Re-enable must recheck trust and the exact binding. +Removing trust never implicitly clears stored policy. Close the mutation gate to stop new changes while keeping recovery available. Use established archive/lifecycle containment or repair FI trust as appropriate;