From edc66ef8d80f2d7dcb38d4515429b83494b64315 Mon Sep 17 00:00:00 2001
From: Eva
 <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz>
Date: Mon, 17 Aug 2026 14:38:02 -0400
Subject: [PATCH] docs(nip-fi): add the promised worked wire example

The PR description promises a worked wire example in core; none existed.
Add one compact non-normative section: a protected HTTP POST under
client-attached with NIP-98 proof and a relevant body, showing how the
two evidence fields, body binding, and the admission phases compose on
the wire. Byte-exact values remain the province of the NIP-FI-CONF exit
fixture; the example elides credentials so it cannot be mistaken for a
conformance vector.

Twenty-six lines, kept deliberately smaller than the alternative of
striking the promise would save in credibility.

Co-authored-by: Eva <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz>
Signed-off-by: Eva <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz>
---
 docs/nips/NIP-FI.md | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/docs/nips/NIP-FI.md b/docs/nips/NIP-FI.md
index e8cfeb14fb..3e82bc5347 100644
--- a/docs/nips/NIP-FI.md
+++ b/docs/nips/NIP-FI.md
@@ -502,6 +502,32 @@ may distinguish the configured mode. Profile documents own only non-enrollment
 public claims.
 [FI-TRACE-DISCOVERY-PRIVATE]
 
+## Worked example (non-normative)
+
+A protected HTTP POST under `client-attached` with NIP-98 proof and an
+authorization-relevant body. Credentials are elided; the NIP-FI-CONF exit
+fixture pins complete byte-exact values.
+
+```text
+POST /media HTTP/1.1
+Host: relay.example
+Nostr-Federated-Identity: Bearer eyJhbGciOiJFUzI1NiIsInR5cCI6ImF0K2p3dCIs...
+Authorization: Nostr eyJpZCI6IjE1ZTI3ZDc0Li4uIiwicHVia2V5IjoiOTljNzQ4Li4u...
+Content-Type: application/octet-stream
+Content-Length: 4
+
+abcd
+```
+
+The bearer JWS validates under the configured assertion policy: exact `iss`
+and `aud`, token class `at+jwt`, live time claims, and `nostr_pubkey` equal to
+the NIP-98 event's `pubkey`. The NIP-98 event binds the server-resolved method
+and URL, and its single `payload` tag equals the SHA-256 of the four body
+bytes. Admission then follows Direct preparation and Final admission; success
+returns the application response, and every failure class returns exactly the
+bytes fixed in the Rejection table. On a WebSocket upgrade the same header
+attaches to the upgrade request and NIP-42 supplies the proof after connect.
+
 ## Core behavioral oracles
 
 A core claim covers every applicable oracle below at one implementation and