Replace the flat future configuration draft with a multi-domain revision, separate denial observation from the non-reclaimable authorization-audit budget, and clarify current runtime behavior.
Document lifecycle and denial-oracle rationale and carry the complete transport, lease, invalidation, and conformance obligations into the implementation handoff.
Signed-off-by: Cea Stapleton Cordasco <261786559+cea@users.noreply.github.com>
Define the stock and private registered transport contracts without adding a deployment-specific profile to public discovery. Keep HMAC-v2 optional to deploy but exact when selected, and bind conformance evidence to versioned profile contracts.
Unify every adapter on one normalized authorization contract, finite deadlines, current dependency revalidation, and the existing final-admission authority.
Signed-off-by: Cea Stapleton Cordasco <261786559+cea@users.noreply.github.com>
The published contract named a `trusted-proxy-hmac-v1` profile that no
implementation accepts. This replaces it with `trusted-proxy-hmac-v2` as the
sole stock proxy transport, specified from the wire format: envelope layout,
length-prefixed MAC input, canonical encodings, discovery identifier, replay
namespace, and lease bounds, with negative vectors.
Denial handling is re-scoped. The no-mutation invariant now covers
authoritative authorization state only, and denial observability moves to a
separately bounded, non-authoritative channel carrying reason codes and
correlation identifiers under payload minimization. A denied admission
creates no authorization receipt, and a failed observation write never
blocks, retries, or latches the denial.
Runtime operations, deployment, and integration guidance is framed as future
contract rather than current behavior. Subject stability is stated as a
verifier trust assumption with its reassignment consequence, and the
key-snapshot rollback claim is narrowed to what the model enforces.
This is a documentation change. It adds no runtime parser, adapter, or
enforcement path. Session-path rechecks and the policy digest input set
remain relay-side follow-ups. The 24 trace and 16 invariant identifiers are
unchanged.
- CORPORATE_IDENTITY.md: document BUZZ_NIP_FI_V1_CONFIG_JSON (Off /
DenyProtected / Enforce), the complete runtime document with its field
bounds, JWKS refresh limits, the 120-second status renewal bound, the
removed legacy identity-provider variables that now fail startup, and
the delegation default and enablement rules
- .env.example: replace the placeholder identity section with the
commented document example and the legacy-variable removal note
- NIP_FI_DEPLOYMENT.md / NIP_FI_RUNTIME_OPERATIONS.md: document the
single configuration input consistently and map the install-without-
discovery step to the operating modes
- deploy READMEs: pgcrypto requirement for managed PostgreSQL, identity
configuration pass-through with secret-handling guidance, and
audit-capacity sizing guidance
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea@users.noreply.github.com>
