mirror of
https://github.com/block/buzz.git
synced 2026-10-27 12:40:30 +00:00
56e74141e7
External line-by-line review against the implementation found compositions no internal-consistency pass could see: rules that contradict each other across documents, and registry text that denies the wire the deployed proxy actually signs. Every reading failed closed, but a correct implementation could not be built from the text alone. Fixes, one per defect: - EDGE strip rule no longer removes the NIP-98 proof: requirement 1 named "authorization" among the fields every trusted edge strips, while core reserves the Authorization header for the NIP-98 proof that must reach final admission. The rule now names the three NIP-FI fields plus other edge profiles' fields, explicitly preserves Authorization, and a negative conformance sentence makes stripping or rewriting it nonconformant. - Proof-transport codes 0x03 (Git smart-HTTP session) and 0x04 (Blossom media) are reserved with fixed meanings: the deployed proxy emits both inside the MAC input, and the registry declared them unassigned, so a conforming verifier denied every Git and Blossom envelope. Allocation completes when each transport contract is published; until then the codes are valid only under an explicit shared proxy/verifier contract and are not portable interoperability. - Replay moves from evidence_rejected to authorization_denied: replay status is committed per-principal server state, so classing it as evidence rejection contradicted the supplied-evidence privacy rule and let an attacker resubmit captured evidence to learn whether the original request committed. The CONF fixture table mirrors the move. - The current-status witness match now requires issuer equality: the witness tuple carried iss but the match rule checked only subject and session, so on a shared status source an issuer-B witness could satisfy a pre-revocation issuer-A assertion. The stale-status oracle gains the mismatch arm. - The interoperability exit test is deferrable while no independent implementation exists (machine-readable reason, re-evidenced when the second implementation claims), and the canonical shared exit fixture gains provenance: editor-authored, published at docs/nips/fixtures/nip-fi-conf-exit.json with its SHA-256 digest. A required gate no implementation could ever pass was, by this document's own standard, a defect in the document. - The "RFC 9068 access token" class is renamed at+jwt access token at all three sites: it selects on typ and aud and validates under this document's claim contract, not the full RFC 9068 profile. - EDGE states the unbound-body-metadata rule directly instead of by cross-document inference, and the negative matrix gains the Content-Type/Content-Encoding mutation row. - Absent or incomplete edge provenance maps to missing_evidence; present but failing provenance maps to evidence_rejected. The CONF fixture table gains the absent-provenance row; rows are renumbered, which is safe because CONF itself requires that no text reference rows by number. - A payload tag on an authorization-irrelevant body is validated identically, closing a verifier divergence the text left open. Oracle census is unchanged at 58 (30 core, 6 EDGE, 11 LIFECYCLE, 7 DELEG, 4 CONF): the two table additions are a negative-matrix row and a denial-fixture row, neither in the oracle denominator. One review item (equivalence classification of revalidation dependencies) is deliberately not in this commit pending model verification that the reclassification opens no authority-extension path. Co-authored-by: Eva <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz> Signed-off-by: Eva <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@buzz.block.builderlab.xyz>