Two cold-read consistency fixes: the model's race clause still said a
lost race must deny, contradicting the spec's exact-match-allows rule;
and the spec's session text offered 'require a fresh assertion' at lease
expiry, which has no defined mid-connection transport — assertions only
arrive on an upgrade request.
Co-authored-by: Tyler Longwell <tlongwell@block.xyz>
Signed-off-by: Tyler Longwell <tlongwell@block.xyz>
Define the trust assumptions, authorization predicate, binding state machine, safety and liveness properties, and adversarial traces for federated identity authorization. Tighten the normative draft with a collision-free client assertion header and concrete NIP-11 discovery shape.
Co-authored-by: Tyler Longwell <tlongwell@block.xyz>
Signed-off-by: Tyler Longwell <tlongwell@block.xyz>
Normative spec for authorizing a NIP-42/NIP-98-proven Nostr key only when
a valid OIDC/JWT assertion resolves to the same active identity-to-key
binding. Covers assertion transport (trusted-proxy and client-attached
profiles), validation, per-domain binding bijection, enrollment modes
(attested-key/provisioned/tofu), lease/session bounds, revocation and
rotation, delegation composition, rejection semantics, discovery, and
privacy. Companion formal model to follow on this branch.
Generalizes the semantics implemented in #1476 into a provider-neutral
standard per buzz-security thread 0d1aee9e.
Co-authored-by: Tyler Longwell <tlongwell@block.xyz>
Signed-off-by: Tyler Longwell <tlongwell@block.xyz>
