tornquist 8ebe3b881c Record that owner deletion consent is an operator assertion ...

The admission path reads as if the relay had verified the owner's consent.
It has not: the mediating operator authenticates the owner and collects
the acknowledgement out of band, and the request reaching the relay
carries only that operator's NIP-98 signature. The relay checks operator
authority and current ownership, and stores the owner pubkey, operator
pubkey, and acknowledgement version as provenance for the upstream
ceremony — never an owner-signed attestation.

Also record how manual handoff converges. Owner provenance pins
`requested_by` to `owner_pubkey`, so `buzz-admin deletions submit` must
repeat the owner pubkey to adopt an admitted request; the operator's own
pubkey conflicts with the one-active-request invariant instead.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: tornquist <tornquist@squareup.com>

2026-09-25 18:03:39 +00:00

..

src

Record that owner deletion consent is an operator assertion

2026-09-25 18:03:39 +00:00

Cargo.toml

feat(deletion): add durable whole-community deletion (#4425)

2026-08-12 09:25:58 -07:00