jerry/buzz
1
0
Fork 0
mirror of https://github.com/block/buzz.git synced 2026-10-28 21:11:48 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
a89eae5dce18bb3b604d354294cd9d5f4e2dfcd4
buzz/docs/owned-agent-discovery.md
Logan Johnson 709c7c5b36 fix(desktop): discover authenticated owned relay agents 
Extract native discovery and signed ownership, policy and current membership verification together from #7114.

Co-authored-by: Larry <627498bd4bd1f281a16431e3c6cce3b5c25b6692798c78672298aefbf2f8f8b5@buzz.block.builderlab.xyz>
Signed-off-by: Logan Johnson <loganj@squareup.com>
(cherry picked from commit f3ad8ad2d202047da1170516ba8d072ecec777e0)
Signed-off-by: Logan Johnson <loganj@squareup.com>
(cherry picked from commit 19f392548c6b08749533d5938a9a9769b4d61b2b)
Signed-off-by: Logan Johnson <loganj@squareup.com>
2026-09-01 11:54:40 -04:00

2.1 KiB
Raw Blame History

Authenticated owned-agent discovery

An owner-authored kind 30177 coordinate seeds discovery independently of local runtime inventory and shared-channel membership. It is not ownership proof. The latest agent kind 0 profile must have a valid envelope and exactly one valid NIP-OA auth tag. Every signed condition is evaluated against event time, never wall-clock time. The owner remains provenance, not the agent's author identity.

Owner policy coordinates must match that verified owner and have valid signed envelopes. Invalid latest policy reserves the coordinate and fails closed: it cannot revive a legacy permission. Missing policy retains existing OSS legacy compatibility; marked builds require verified owner policy. This change does not invent a missing-policy default or broaden policy audiences.

Membership comes from the latest relay-signed kind 39002 snapshot for each channel. Known owned agents need not carry the cosmetic bot role. Ownership does not fabricate membership: a nonmember may be discovered with empty channel_ids. Selection queries constrain exact requested keys and destination. Relay authority is obtained through the existing community-bound relay admission boundary.

This native change expands discovery only. Preparing an invitation and freshly authorizing publication to its exact destination belong to the subsequent mention-routing change; discovery alone does not authorize a message.

Regression gates

  • commands/agent_discovery/relay_directory/owned_tests.rs: signed loopback discovery with no local record, forged ownership exclusion, ordinary-role membership, wrong destination, revocation and unsupported latest policy.
  • nostr_convert/oa_profile_tests.rs: signed envelope, duplicate/malformed auth, canonical conditions and signed-event time, wrong-owner policy, invalid latest policy, forged and stale membership.
  • nostr_convert/tests.rs: signed conversion fixtures and OSS compatibility.

NIP-OA time conditions are not wall-clock expiry (see docs/nips/NIP-OA.md). Relay membership and policy reads remain separate snapshots, not an atomic publication transaction. Independent security review is required before landing.