Replace the flat future configuration draft with a multi-domain revision, separate denial observation from the non-reclaimable authorization-audit budget, and clarify current runtime behavior.
Document lifecycle and denial-oracle rationale and carry the complete transport, lease, invalidation, and conformance obligations into the implementation handoff.
Signed-off-by: Cea Stapleton Cordasco <261786559+cea@users.noreply.github.com>
Define the stock and private registered transport contracts without adding a deployment-specific profile to public discovery. Keep HMAC-v2 optional to deploy but exact when selected, and bind conformance evidence to versioned profile contracts.
Unify every adapter on one normalized authorization contract, finite deadlines, current dependency revalidation, and the existing final-admission authority.
Signed-off-by: Cea Stapleton Cordasco <261786559+cea@users.noreply.github.com>
The published contract named a `trusted-proxy-hmac-v1` profile that no
implementation accepts. This replaces it with `trusted-proxy-hmac-v2` as the
sole stock proxy transport, specified from the wire format: envelope layout,
length-prefixed MAC input, canonical encodings, discovery identifier, replay
namespace, and lease bounds, with negative vectors.
Denial handling is re-scoped. The no-mutation invariant now covers
authoritative authorization state only, and denial observability moves to a
separately bounded, non-authoritative channel carrying reason codes and
correlation identifiers under payload minimization. A denied admission
creates no authorization receipt, and a failed observation write never
blocks, retries, or latches the denial.
Runtime operations, deployment, and integration guidance is framed as future
contract rather than current behavior. Subject stability is stated as a
verifier trust assumption with its reassignment consequence, and the
key-snapshot rollback claim is narrowed to what the model enforces.
This is a documentation change. It adds no runtime parser, adapter, or
enforcement path. Session-path rechecks and the policy digest input set
remain relay-side follow-ups. The 24 trace and 16 invariant identifiers are
unchanged.
Two cold-read consistency fixes: the model's race clause still said a
lost race must deny, contradicting the spec's exact-match-allows rule;
and the spec's session text offered 'require a fresh assertion' at lease
expiry, which has no defined mid-connection transport — assertions only
arrive on an upgrade request.
Co-authored-by: Tyler Longwell <tlongwell@block.xyz>
Signed-off-by: Tyler Longwell <tlongwell@block.xyz>
Define the trust assumptions, authorization predicate, binding state machine, safety and liveness properties, and adversarial traces for federated identity authorization. Tighten the normative draft with a collision-free client assertion header and concrete NIP-11 discovery shape.
Co-authored-by: Tyler Longwell <tlongwell@block.xyz>
Signed-off-by: Tyler Longwell <tlongwell@block.xyz>
Normative spec for authorizing a NIP-42/NIP-98-proven Nostr key only when
a valid OIDC/JWT assertion resolves to the same active identity-to-key
binding. Covers assertion transport (trusted-proxy and client-attached
profiles), validation, per-domain binding bijection, enrollment modes
(attested-key/provisioned/tofu), lease/session bounds, revocation and
rotation, delegation composition, rejection semantics, discovery, and
privacy. Companion formal model to follow on this branch.
Generalizes the semantics implemented in #1476 into a provider-neutral
standard per buzz-security thread 0d1aee9e.
Co-authored-by: Tyler Longwell <tlongwell@block.xyz>
Signed-off-by: Tyler Longwell <tlongwell@block.xyz>
