buzz/docs/nips/NIP-FI.md

NIP-FI
======

Federated identity authorization — stateless core
---------------------------------------------------

`draft` `optional` `relay`

**Protocol dependencies**: NIP-01, NIP-42, NIP-98.

The key words "MUST", "MUST NOT", "REQUIRED", "SHOULD", "SHOULD NOT", and
"MAY" in this document are to be interpreted as described in BCP 14 (RFC 2119
and RFC 8174) when, and only when, they appear in all capitals.

## Abstract

NIP-FI authorizes a Nostr key when two independent facts agree: a valid
issuer-qualified identity assertion that names the key, and fresh NIP-42 proof
of possession of that key.  No relay-side identity state is required.  The
relay verifies the assertion offline against configured per-issuer JWKS
snapshots and enforces the resolved community's audience and issuer
authorization policy; other identity decisions remain the assertion issuer's
responsibility.

This NIP defines the assertion contract, the offline verification procedure,
session lifetime policy, and an authenticated issuer→relay disconnect API.
Enrollment, rotation, revocation decisions, identity↔key registry, one-identity
one-key enforcement, audit, and directory integration are issuer concerns outside
this spec.

## Terms

- **identity** (`i`): the exact tuple `(iss, sub)` returned by assertion
  validation.  Email, display name, opaque user ID, and a bare `sub` are not
  identities.  Equal `sub` values under different `iss` values are distinct
  identities.  [FI-TRACE-CROSS-DOMAIN-COLLISION]
- **actor** (`k`): the 32-byte public key returned by NIP-42 proof validation.
- **assertion**: a compact JWS minted by the assertion issuer, binding `i`
  to `k`.
- **assertion issuer**: the deployment-specific identity authority (e.g. an
  OIDC identity provider integration) that authenticates users and mints
  assertions.  The relay trusts only the issuer's assertion; it does not
  contact the IdP directly.
- **community**: the tenant resolved from a connection's `Host`.  A community
  has one configured canonical host URI, which is its assertion audience, and
  an explicit set of issuer URIs authorized to mint assertions for it.

## Assertion contract

The assertion is a compact JWS carrying the following claims.

### Required claims

| Claim | Type | Semantics |
|---|---|---|
| `iss` | string | Exact issuer URI.  The relay selects an issuer policy by exact match; no normalization is applied. |
| `sub` | string | Opaque, stable, non-reassignable subject identifier for the account lifetime.  Never an email address or display name. |
| `nostr_pubkey` | string | Lowercase hexadecimal encoding of exactly one 32-byte Nostr public key.  Other encodings deny. |
| `aud` | string or array | Audience.  MUST be present.  The configured audience value for each community MUST be that community's canonical host URI, following the resource-indicator practice in RFC 8707.  One community MUST map to one canonical audience value; distinct communities MUST NOT share an audience value.  The relay MUST require the assertion audience to exactly match the expected audience of the community resolved from the connection's `Host`; issuer policy selection by `iss` MUST NOT broaden this community binding. |
| `iat` | NumericDate | Issuance time. |
| `exp` | NumericDate | Expiry time.  MUST be finite.  The deployment MUST configure a positive finite maximum TTL; the relay enforces both the token `exp` and the configured `maximum_assertion_age`. |

### Optional claims

| Claim | Type | Semantics |
|---|---|---|
| `nbf` | NumericDate | Not-before time.  When present, the relay enforces `nbf <= now + skew`. |

### Token type

Policy selects exactly one token class before parsing claims:

- **`nip-fi+jwt`**: a dedicated assertion whose protected `typ` is exactly
  `nip-fi+jwt`.
- **`at+jwt` access token**: a resource access token whose protected `typ` is
  exactly `at+jwt`.  When this class is selected:
  - The assertion MUST contain a non-empty `client_id` claim.
  - The issuer policy MUST name exactly one authenticated marker claim and two
    non-empty, disjoint value sets: one for resource-owner subjects and one for
    client-subject tokens.  A token whose marker value matches neither set, both
    sets, or whose marker claim is absent is ambiguous and denies.
  - When client-subject tokens are admitted, the issuer policy MUST record the
    non-collision posture: the issuer MUST guarantee that resource-owner and
    client-subject `(iss, sub)` coordinates are disjoint.
  - Absent, unknown, or ambiguous classification always denies; no fallback to
    the other class is attempted.

OIDC ID tokens always deny, even when `iss`, `aud`, and `sub` match.  A
generic or absent `typ` has no accepted class.  Failure under one class never
triggers validation under another.  [FI-TRACE-TOKEN-CLASS]

### Time bounds

**Required claims:** `iat` and `exp` MUST be present; absence denies.

**Policy knobs:** the relay enforces the following rules.  `maximum_assertion_age`
is a required positive finite configuration; a missing or non-positive
configuration denies.  `skew` is a non-negative finite maximum with default `0`;
it narrows acceptable bounds and cannot be omitted to mean "unchecked".

- `now < exp` — equality at expiry is expired
- `iat <= now + skew` — issuance is not in the future beyond allowable skew
- `now < iat + maximum_assertion_age` — caps total assertion age independent of `exp`
- `nbf <= now + skew` — when `nbf` is present (optional claim; absence is not an error)

[FI-TRACE-ASSERTION-VALIDATION]

### Assertion–key binding

`nostr_pubkey` MUST name the exact key the client proves via NIP-42.  The relay
denies any token whose `nostr_pubkey` does not match the NIP-42 `pubkey`.
[FI-TRACE-ASSERTION-KEY-MISMATCH]

This is the entire identity-to-key binding.  There is no relay-side binding
ledger; the assertion is the binding claim, and it is the assertion issuer's
responsibility to ensure the assertion names the correct key.

Community resolution MUST precede assertion verification.  The relay MUST resolve the
connection's `Host` to exactly one community, its expected audience, and its
configured issuer allowlist; an unknown or unresolvable host, or unavailable
community configuration, MUST fail closed with `authorization_unavailable`.
After bounded decoding looks up the exact issuer policy by `iss`, the relay MUST
immediately require that issuer to be authorized for the resolved community
before touching any issuer-specific dependency, including JWKS.  An untrusted
`iss` is used only to select or reject a candidate policy; it grants no
authority.  Signature verification remains mandatory before acceptance.
`VerifyAssertion` MUST compare `aud` with the resolved community's expected
audience; issuer policy selection by `iss` MUST NOT broaden either binding.

### Agent keys

An issuer MAY issue an assertion whose `nostr_pubkey` names an agent key
acting for an owner key.  Such an assertion MUST carry `nostr_owner_pubkey`:
the lowercase hexadecimal encoding of one 32-byte public key, distinct from
`nostr_pubkey`.  An issuer MUST NOT issue an assertion without
`nostr_owner_pubkey` for a key it has issued an agent assertion for, and MUST
NOT issue an agent assertion while the owner is not authorized by the issuer.

A relay advertising `agent_assertions: true` MUST verify `nostr_owner_pubkey`
as part of the assertion.  A malformed value, or one equal to `nostr_pubkey`,
MUST deny `evidence_rejected`.  The relay MUST record the value as the
owner of the session or request the assertion admits.  If the relay already
associates a different owner with the asserted key in the resolved community,
it MUST deny `authorization_denied`.
For every agent assertion, regardless of whether the asserted key is itself
authorized in the community, the relay MUST deny when the community bans the
asserted key or the owner, or when the issuer has denied either key.  Only
then, when the asserted key is not itself authorized in the community, the
relay MUST authorize it if and only if the issuer is trusted for the community
and the owner is authorized in the community when access is decided.  A relay
not advertising `agent_assertions: true` MUST deny an assertion carrying
`nostr_owner_pubkey` `evidence_rejected`.

### Unverified claims

Relays MUST ignore claims they do not verify.  An unverified claim — including
`sid`, `jti`, or issuer-private blocks such as `enterprise_identity` — grants no
authority and MUST NOT be logged or exposed in discovery or error responses.
Issuers SHOULD minimize claims in assertions visible to relays to reduce
unnecessary disclosure.

### Policy identity

```text
AssertionPolicyId = H(canonical assertion-policy contract)
TransportContractId = H(canonical transport contract)
```

`AssertionPolicyId` covers the canonical issuer, community issuer
association, audience, token class, allowed algorithms, key-source contract,
identity/key/claim mapping, time and size rules, and compiled verifier
behavior.  JWKS key rotation changes the snapshot, not the policy ID.
The key-source contract includes the JWKS transport. A mesh transport tag is
encoded only when `jwks_transport` is `mesh`; `public_https` is represented by
the absence of that tag.
`TransportContractId` covers the client-attached field, parsing, attachment,
and no-fallback semantics.

## Client-attached transport

The client sends exactly one `Nostr-Federated-Identity` field on the
WebSocket upgrade request or protected HTTP request (see HTTP ingress):

```text
Nostr-Federated-Identity: Bearer <compact-JWS>
```

`Authorization` remains reserved for NIP-98.  Missing, repeated,
comma-combined, empty, malformed, non-Bearer, or mixed-profile fields deny.
Assertions MUST NOT appear in URLs, query parameters, Nostr events, tags, or
filters.  [FI-TRACE-TRANSPORT-CLOSED]

Server configuration selects `client-attached` before any protected traffic is
accepted.  Request fields cannot select, negotiate, or downgrade the transport.
Failure never falls back to another transport.

## Verification

The relay verifies assertions **offline** against configured per-issuer JWKS
snapshots.  No IdP contact occurs at admission time.

### Community issuer authorization

Each configured community MUST declare an explicit allowlist of issuer URIs
that may authorize identities for that community.  An issuer policy selected by
exact `iss` matching is usable only when that issuer is present in the resolved
community's allowlist.  A global `IssuerRegistry` MAY hold the shared policy and
JWKS configuration, but it MUST NOT by itself authorize an issuer for every
community.  Deployments MUST reject a community configuration that has no
canonical host URI, has an ambiguous Host mapping, or grants an issuer access
without an explicit community association.

The community allowlist and its canonical audience are deployment policy, not
claims supplied by the requester.  The relay MUST resolve them before assertion
verification and MUST fail closed with `authorization_unavailable` when the
community configuration is missing or unavailable.

### Multi-issuer registry

The global `IssuerRegistry` remains
shared for issuer policy and JWKS lookup; community authorization is a separate
deployment mapping from canonical host URI to
`(expected_aud, authorized_issuers)`.  `VerifyAssertion` consumes the
Host-resolved mapping, so a globally known issuer is not implicitly trusted by
every community.

The `nostr_pubkey` claim is unconditionally required — absence rejects
regardless of issuer policy.

### JWKS snapshot

Each issuer policy configures:

- `jwks_uri`: selects the authenticated key source. With the default
  `public_https` transport, it MUST use HTTPS and contain no credentials or
  fragment. DNS address checks and pinning are specified under
  [Security considerations](#security-considerations).
- `jwks_transport`: optional per-issuer transport, defaulting to
  `public_https`. The explicit value `mesh` permits an HTTP URI only when it
  uses a DNS hostname rather than an IP literal and has no userinfo, query,
  fragment, or backslash. The only accepted IPv4 ranges are RFC 1918 (`10/8`,
  `172.16/12`, and `192.168/16`), CGNAT (`100.64/10`), reserved `240/4` except
  `255.255.255.255`, and loopback `127/8`. The only accepted IPv6 ranges or
  addresses are ULA (`fc00::/7`) and `::1`. Every other IPv4 or IPv6 class is
  rejected. IPv4-mapped, IPv4-compatible, NAT64, 6to4, and SIIT-translated
  IPv6 addresses are also rejected; embedded IPv4 does not inherit eligibility.
  Every DNS answer is checked and the first allowed address is pinned. Empty or
  mixed answers deny the fetch. Loopback is accepted for isolated local use;
  in production it can reach services on the relay host, so operators MUST
  constrain endpoint selection and egress accordingly. Mesh transport does not
  authenticate itself: selecting it is an operator assertion that the
  deployment enforces mutual TLS peer authentication and integrity protection,
  endpoint authorization, and egress restrictions. The relay cannot verify
  those properties. Unauthenticated HTTP permits JWKS key substitution and
  issuer impersonation. There is no public-network fallback.
- `refresh_interval_seconds`: positive, ≤ 1 year, strictly less than
  `key_snapshot_hard_deadline_seconds`.
- `key_snapshot_hard_deadline_seconds`: the outer time bound after which no
  assertion verified under this snapshot can authorize.

The snapshot is re-fetched periodically.  A key added to the JWKS is accepted
after the next fetch; a key removed from the JWKS causes any assertion verified
under that key to deny on next revalidation.  [FI-TRACE-JWKS-ADD]
[FI-TRACE-JWKS-REMOVE]

The snapshot is authenticated: no external consumer can relabel one issuer's
JWKS as another's.  The maximum number of keys per snapshot is bounded before
any attacker-controlled `kid` lookup.

### Verification procedure

```text
VerifyAssertion(token, community, D, R_t):
  // `community` is the immutable result of Host resolution by the caller;
  // it contains `expected_aud` and the authorized issuer URI allowlist.
  AssertCommunityConfig(community) or DENY(authorization_unavailable)

  // 1. Select issuer policy and authorize it for this community
  (header, claims) := BoundedJwsDecode(token) or DENY(evidence_rejected)
  policy := IssuerRegistry[claims.iss] or DENY(evidence_rejected)
  AssertIssuerAuthorized(policy.iss, community.authorized_issuers) or DENY(evidence_rejected)

  // 2. Validate token class, typ, and algorithm
  ValidateTokenClass(policy, header) or DENY(evidence_rejected)
  AssertAsymmetricAlgorithm(header.alg) or DENY(evidence_rejected)

  // 3. Validate signature against current authenticated JWKS
  snapshot := policy.key_source.get_snapshot() or DENY(authorization_unavailable)
  key := snapshot.find(header.kid) or DENY(evidence_rejected)
  VerifySignature(token, key) or DENY(evidence_rejected)

  // 4. Validate remaining claims against the resolved community and issuer policy
  AssertExactIss(claims.iss, policy.iss) or DENY(evidence_rejected)
  AssertAudienceMatch(claims.aud, community.expected_aud) or DENY(evidence_rejected)
  AssertTimeBounds(claims, policy) or DENY(evidence_rejected)  // [FI-TRACE-ASSERTION-VALIDATION]
  k_claimed := ParseHexKey(claims.nostr_pubkey) or DENY(evidence_rejected)
  owner := absent
  if claims.nostr_owner_pubkey is present:
    AssertAgentAssertionsAdvertised(relay) or DENY(evidence_rejected)
    owner := ParseHexKey(claims.nostr_owner_pubkey) or DENY(evidence_rejected)
    AssertNotEqual(owner, k_claimed) or DENY(evidence_rejected)

  return VerifiedAssertion(identity=(claims.iss, claims.sub), asserted_key=k_claimed,
                           owner=owner,
                           authority_deadlines=ComputeDeadlines(claims, snapshot))
```

The verifier is **fail-closed**: any unreadable, missing, ambiguous, or
expired input denies.  A missing or unavailable JWKS snapshot or community
configuration denies with `authorization_unavailable`; all other failures deny
with `evidence_rejected`.
[FI-TRACE-DEPENDENCY-FAIL-CLOSED]

### Admission at connection

On WebSocket upgrade:

1. Resolve the connection's `Host` to `community`, including its canonical
   `expected_aud` and configured issuer allowlist; unknown, ambiguous, or
   unavailable community resolution → deny `authorization_unavailable`.
2. Extract the compact JWS `token` from `Nostr-Federated-Identity`; missing or
   malformed → deny `missing_evidence` or `evidence_rejected`.
3. Call `VerifyAssertion(token, community, D, R_t)`; any error → deny per the
   rejection table.
4. Complete NIP-42 handshake; validate AUTH event, extract `k`.
5. Assert `verified.asserted_key == k`; mismatch → deny `authorization_denied`.
   [FI-TRACE-ASSERTION-KEY-MISMATCH]
6. Register the session's proven `k` and admitting issuer `iss` in the
   relay's session table, making it visible to the disconnect close scan.
   Registration includes the session's owner, if any.
   Registration MUST occur before the deny-set check in step 7.  This ordering
   ensures any connection that straddles a concurrent disconnect is caught by
   one side or the other: either the close scan sees the registered session, or
   the deny-set check (step 7) sees the inserted entry.  Both checks use the
   same keys: `(iss, k)` and, for a session with an owner,
   `(iss, verified.owner)`.  A concurrent disconnect close scan MAY cancel
   this registered connection before step 8; cancellation is terminal, so a
   cancelled connection MUST NOT be admitted.
7. Check the deny set for `(iss, k)` and, if `verified.owner` is present, for
   `(iss, verified.owner)`.  Either active entry (`now < until`) denies
   `authorization_denied`.
   [FI-TRACE-DENY-SET]
8. Admit the connection only if it remains live and uncancelled.  The session's
   authority deadline is the minimum of all `authority_deadlines`; see Session
   policy.

## Session policy

### Maximum connection lifetime

Every NIP-FI deployment MUST configure a positive finite
`max_connection_lifetime_seconds`.  This is a **required deployment knob**;
there is no default that permits an indefinite session.  Operators MUST select
a value; infosec policy governs the specific bound.

A connected session MUST be terminated no later than `connection_time + max_connection_lifetime_seconds`,
regardless of assertion expiry.

The effective session deadline is:

```
session_deadline = min(
    connection_time + max_connection_lifetime_seconds,
    min(authority_deadlines),        // from VerifiedAssertion
    key_snapshot_hard_deadline       // from the issuer policy
)
```

Equality at any deadline is expired.  Arithmetic is overflow-safe.
[FI-TRACE-LEASE-BOUND]

### Re-authentication

There is **no in-band session renewal**.  When a session expires, the relay
closes the WebSocket.  The client must open a new connection with a fresh
assertion on the upgrade request and complete a fresh NIP-42 proof.  A silent
re-mint riding an existing issuer/IdP session is an issuer implementation
detail; the relay never sees anything other than a new upgrade request.

### Reconnect after expiry

A client whose session expired due to normal TTL expiry may reconnect
immediately provided the issuer can supply a fresh assertion.  Session expiry
does not imply key revocation or identity loss; that is the issuer's domain.
Clients SHOULD proactively obtain a fresh assertion before expiry and reconnect
with it.  Nothing in this section forbids early re-exchange; renewal remains
out of band rather than an in-band session operation.

## Admin disconnect API

The assertion issuer can terminate live relay sessions for a specific public key via an
authenticated `disconnect` call.

### Semantics (deny-until-TTL)

A disconnect call causes the relay to:

1. Insert a **deny entry** keyed by `(iss, target_pubkey)` into the relay's
   in-memory deny set, with an absolute expiry of `until` (a Unix timestamp
   carried in the signed command JWT; see Command JWT).  If an entry for
   `(iss, target_pubkey)` already exists, the relay MUST retain
   `max(existing_until, command.until)` — an accepted disconnect MUST NOT
   shorten an active deny.  A past-`until` command still closes sessions but
   MUST NOT clear or shorten an independently active entry.  Any subsequent
   connection or admission attempt for that pubkey under the same issuer is
   denied `authorization_denied` until `now >= until`.  If the deny set is at
   capacity and a new entry cannot be inserted, the relay MUST reject the command
   `503`; no sessions are closed and no replay state is consumed.
2. Close all live WebSocket connections registered under the command's issuer
   whose proven `k` equals the target pubkey or whose recorded owner equals
   the target pubkey, whether or not admission has completed, synchronously.
   Disconnect cancellation is terminal: a cancelled in-progress connection
   MUST NOT be subsequently admitted.  Connections
   registered under another issuer are not affected.

The deny set is held **in relay memory only** — no durable storage, no schema
changes.  A relay restart MAY forget active deny entries.  If the issuer stops
issuing assertions and re-push completes before any expired-entry reconnection
attempt, the residual exposure after a restart is bounded by
`max(0, min(exp, iat + maximum_assertion_age) - now)`.  If the issuer continues
issuing or re-push does not complete in time, that formula does not apply and
access may continue beyond it.  [FI-TRACE-DENY-SET]

The relay MUST bound the deny set size **per issuer**.  Capacity exhaustion under
one issuer MUST NOT cause rejection of another issuer's commands; the `503`
capacity check is evaluated against the command's own issuer bound.
Implementations MUST evict only expired entries; when an issuer's partition is
at capacity and all entries are still active, the relay MUST reject the new
command `503` without removing any existing entry.

The `until` timestamp MUST NOT exceed the maximum possible remaining assertion
validity for any assertion the issuer could currently mint.  Because an
assertion accepted at the future-skew boundary (`iat <= now + skew`) remains
valid until `iat + maximum_assertion_age`, the latest possible authority deadline
is `now + skew + maximum_assertion_age`; the relay MUST enforce
`until <= now + skew + maximum_assertion_age` for this issuer policy.  An
`until` that exceeds this ceiling is rejected `400`.  Supplying an
`until` in the past is a no-op disconnect (sessions are still closed, deny entry
is immediately expired); this is not an error.

The deny entry is keyed `(iss, target_pubkey)` and applies to admission
across **all communities** served by the relay under that issuer.
Key-level revocation is intentionally not community-partial: a key revoked
by its issuer loses access in every community that issuer governs.

In a deployment with multiple relay processes, the deployment MUST propagate
both the session-close and the deny entry to every process serving admissions
for the issuer's communities.  The propagation mechanism is deployment-defined
(for example, the existing inter-process message bus — the same posture as JWKS
snapshot convergence); each process holds its own RAM copy.  Propagation is
asynchronous with no protocol-level completion bound.  The issuer re-push duty
specified below is the recovery path for lost propagation, exactly as for relay
restart.  A success response from the receiving process does not imply
cluster-wide application.

### Transport

The disconnect endpoint is an authenticated issuer→relay API, not a public
Nostr protocol.

### Command JWT

Authentication uses a short-lived signed command JWT with a dedicated token
type.  The relay verifies it with a **dedicated command verifier** that reuses
the same `IssuerRegistry`, bounded JWS parsing, issuer-bound JWKS snapshots,
signature verification, audience, and time-bound primitives as assertion
verification, but operates over a distinct token type and produces a closed
command result.  The `VerifyAssertion` primitive is not used here.

The command JWT protected header MUST carry `"typ": "nip-fi-command+jwt"`.
Any other `typ` value denies before claim parsing.

The command JWT MUST carry the following claims:

| Claim | Requirement |
|---|---|
| `iss` | Exact issuer URI matching an authorized issuer in the registry. |
| `sub` | Issuer principal identifier.  The relay checks this is an authorized issuer principal. |
| `aud` | Audience matching the relay's configured audience value for this issuer. |
| `iat` | Issuance time.  MUST satisfy `iat <= now + skew`. |
| `exp` | Expiry time.  MUST be finite; relay enforces `now < exp`. |
| `jti` | Unique, non-guessable identifier for this command.  Used for replay prevention; see below. |
| `method` | Exactly `"POST"` (uppercase literal).  Binds the command to the HTTP method. |
| `path` | Exactly `"/api/nip-fi/disconnect"` (literal string).  Binds the command to the endpoint. |
| `cmd` | Exactly `"disconnect"` (literal string).  Operation selector. |
| `target_pubkey` | Lowercase hexadecimal encoding of the target 32-byte Nostr public key — the same encoding required for the assertion `nostr_pubkey` claim. |
| `until` | Unix timestamp (NumericDate) at which the deny entry expires.  MUST NOT exceed `now + skew + maximum_assertion_age` for this issuer policy.  The relay validates this ceiling; a value that exceeds it rejects `400`. |

The `maximum_command_age` policy knob is a required positive finite
configuration per authorized issuer, with a normative upper bound of
60 seconds.  The relay enforces `0 < maximum_command_age <= 60` and
`now < iat + maximum_command_age` in addition to `now < exp`.  A missing,
non-positive, or out-of-range configuration denies.

The `VerifyCommandJwt` procedure:

```text
VerifyCommandJwt(token, request_method, request_path, request_body_pubkey):
  // 1. Bounded decode and type check
  (header, claims) := BoundedJwsDecode(token) or DENY(evidence_rejected)
  assert header.typ == "nip-fi-command+jwt" or DENY(evidence_rejected)

  // 2. Select issuer policy; verify signature
  policy := IssuerRegistry[claims.iss] or DENY(evidence_rejected)
  AssertAsymmetricAlgorithm(header.alg) or DENY(evidence_rejected)
  snapshot := policy.key_source.get_snapshot() or DENY(authorization_unavailable)
  key := snapshot.find(header.kid) or DENY(evidence_rejected)
  VerifySignature(token, key) or DENY(evidence_rejected)

  // 3. Validate claims (pure verification — no side effects)
  AssertExactIss(claims.iss, policy.iss) or DENY(evidence_rejected)
  AssertAudienceMatch(claims.aud, policy.aud) or DENY(evidence_rejected)
  AssertCommandTimeBounds(claims, policy) or DENY(evidence_rejected)
      // enforces: now < exp, iat <= now + skew, now < iat + maximum_command_age
  assert claims.method == request_method or DENY(evidence_rejected)
  assert claims.path   == request_path   or DENY(evidence_rejected)
  assert claims.cmd    == "disconnect"   or DENY(evidence_rejected)
  target_k := ParseHexKey(claims.target_pubkey) or DENY(evidence_rejected)
  until := claims.until or DENY(evidence_rejected)

  // 4. Validate until ceiling
  deny_ceiling := now + policy.skew + policy.maximum_assertion_age
  assert until <= deny_ceiling or REJECT(400)  // out-of-range until, not an auth failure

  // 5. Principal authorization (pure check — no side effects)
  AssertAuthorizedIssuerPrincipal(claims.iss, claims.sub) or DENY(authorization_denied)

  // 6. Signed-target / request-body agreement (pure check — no side effects)
  // The body carries the target pubkey so the relay can route the disconnect
  // without parsing the JWS first; the signed claim MUST agree with this
  // independently parsed input.  `until` has no such external routing role —
  // the signed claim is the sole authority and is not repeated in the body.
  assert target_k == request_body_pubkey or DENY(authorization_denied)

  // 7. Atomically reserve jti and insert deny entry — single all-or-nothing
  // admission mutation, after all pure authorization checks and before any
  // session close.  Combining both mutations here ensures a capacity failure
  // leaves neither behind: the jti is not burned, and the caller may safely
  // retry the same signed command.  Performing the jti reservation alone
  // (without the deny-entry insertion) would burn the command identity on a
  // capacity failure, making the 503 contract unimplementable.  Capacity
  // is checked against the per-issuer bound for claims.iss; a different
  // issuer's capacity exhaustion does not produce a 503 here.
  // On same-key collision: retain max(existing_until, until) — never shorten
  // an active deny.  A past-until command merges as max(existing, past) which
  // preserves any active entry; a fresh entry with a past-until inserts with
  // an already-expired value (immediately inactive for future admissions).
  effective_expiry := min(claims.exp, claims.iat + policy.maximum_command_age)
  AtomicReserveJtiAndDenyEntry(
      iss=claims.iss, jti=claims.jti, effective_expiry=effective_expiry,
      target_pubkey=target_k, until=until
  ) or DENY(authorization_denied)  // replay: jti already reserved
    or REJECT(503)                 // capacity: deny set full; neither mutation applied

  return CommandResult(target_pubkey=target_k, caller=(claims.iss, claims.sub))
```

Any failure at any step is fail-closed: no side effects occur and the relay
returns the appropriate error.

### Request

```text
POST /api/nip-fi/disconnect HTTP/1.1
Nostr-Federated-Identity: Bearer <compact-command-JWS>
Content-Type: application/json

{"pubkey": "<lowercase-hex-32-byte-pubkey>"}
```

The relay calls `VerifyCommandJwt` passing the request method, path, and
body `pubkey` field; any failure denies per the rejection table.  `VerifyCommandJwt`
performs all pure authorization checks and then, as its single atomic admission
mutation (step 7), simultaneously reserves the `(iss, jti)` replay identity and
inserts the deny entry — both or neither.  A capacity failure at that step rejects
`503`; neither the jti nor the deny entry is recorded, and the caller may safely
retry the same signed command.  On success, the relay MUST close every live connection
registered under the command's issuer (`claims.iss`) whose proven key equals
`CommandResult.target_pubkey` or whose recorded owner equals
`CommandResult.target_pubkey`, whether or not admission has completed.
Disconnect cancellation is terminal: a cancelled in-progress connection MUST NOT
be subsequently admitted.  This close scan matches the deny
entry's `target_pubkey` against each connection's proven key and recorded
owner; connections registered under
another issuer are not affected.  The `until` expiry is taken exclusively from
the signed command JWT claim; the request body carries no `until` field.  An
unknown or unprovable pubkey is not an error; the relay responds `200`
with `{"disconnected": true}`.  An `until` value in the past is not an error;
sessions are closed.  Absent an active same-key deny entry the past-`until`
creates no future denial; if an active entry already exists it remains unchanged
under the merge rule.

### Response

| Condition | Status | Body |
|---|---|---|
| Authorized; action taken or no-op | `200` | `{"disconnected": true}` |
| Missing or invalid command JWT | `401` / `403` | Per the rejection table |
| Malformed request body or `until` exceeds ceiling | `400` | `bad request\n` |
| Deny set at capacity | `503` | `deny set full\n` |

## HTTP ingress

In enforce mode, every protected HTTP request MUST carry both a NIP-98
authorization event and a NIP-FI assertion bound to the same key, and the
deployment verifies both.  NIP-98 proves key possession; NIP-FI proves
identity.  Without the assertion check, a principal holding an active key
can mint fresh NIP-98 events indefinitely and retain HTTP access for as long
as the key remains accepted — the assertion's TTL provides no bound because
the assertion is never examined.  Pairing introduces the assertion lifetime
bound; an active deny-set entry blocks the next request immediately.

### Protected surfaces

A **protected HTTP surface** is a deployment-configured set of routes for
which the deployment enforces NIP-FI admission.  In enforce mode, the
deployment MUST apply NIP-FI verification to all routes in the protected
set; unprotected routes outside the set are not governed by this spec.  The
protected set MUST be configured fail-closed: a route that cannot be
classified as exempt MUST be treated as protected.  Deployment operators
define the set; this spec assigns no normative route names.

The NIP-FI issuer→relay administrative API (e.g. `/api/nip-fi/disconnect`)
is **not** a protected HTTP surface.  It is a distinct administrative
transport governed exclusively by the command-JWT contract in Admin
disconnect API.  It carries `Nostr-Federated-Identity` for its command JWS,
not for an identity assertion, and MUST NOT be subjected to the HTTP ingress
admission procedure.

> **Non-normative examples of surfaces that may appear in a protected set:**
> HTTP API bridge, invite redemption, media storage, git smart-HTTP.

### Git smart-HTTP NIP-98 credential-helper exemption

Git smart-HTTP endpoints (`info/refs`, `git-upload-pack`, and
`git-receive-pack`) use the git credential-helper proof pattern. The
credential helper signs a single NIP-98 event at credential-fetch time against
the repository-root URL with method `GET`, and Git reuses that event across the
session. For these endpoints, the NIP-98 event is exempt from method binding,
endpoint-URL binding, and the `payload` tag requirement. This exemption applies
to all three requirements on all three endpoints, including both POST
endpoints; it is not a payload-only exemption.

This exemption is required by Git's credential protocol. The credential helper
receives only credential metadata and never sees request bodies, so a body
hash cannot exist in the signed event. This limitation is architectural to
Git's credential protocol.

The NIP-FI assertion and pairing requirement is unchanged and applies per
request on every one of these endpoints. Each request MUST still carry and
pass a verified NIP-FI assertion, satisfy `nostr_pubkey` == the NIP-98 event
pubkey, and pass the deny-map check. These requirements are not satisfied by a
prior request or by reuse of the NIP-98 event. The offboarding guarantee is
therefore fully intact on Git: an offboarded key is denied on its next request.

The following compensating controls are REQUIRED for this proof pattern:

1. NIP-FI assertion verification MUST run on every request.
2. The reused proof's signature and timestamp MUST be re-verified on every
   request.
3. The proof timestamp MUST remain within a `±60s` window for every request.
4. Production deployments MUST use TLS.
5. The NIP-98 event MUST bind to the repository-root URL. This binding is
   repo-scoped, not endpoint-scoped or service-scoped.
6. Git endpoint routing MUST separate clone endpoints from push endpoints.
7. Every push MUST pass pre-receive hook push authorization.

This exemption applies solely to the Git credential-helper proof pattern on
these three endpoints. It is not a precedent for any other surface.

### Media possession-proof exception (Blossom, kind 24242)

Kind `24242` Blossom auth events are accepted as the NIP-FI pairing possession
proof for media routes **only**.  This is a media-only, operation-specific
alternative possession format — not a general "signed Nostr event" escape hatch
and not precedent for any other surface.  Any future alternative proof format
requires an explicit axis-by-axis security review covering: payload/resource
binding, method/operation scope, audience/tenant scope, freshness, signature/key
pairing, transport cardinality, and cross-endpoint replay.

#### Scope fence

Kind-24242 proofs are valid **only** on the following routes and operations:

| Proof type (`t` tag) | Valid route | Method |
|---|---|---|
| `upload` | `PUT /upload`, `PUT /media/upload` | PUT |
| `get` | `GET /media/{hash…}`, `HEAD /media/{hash…}` | GET, HEAD |

No other protected route may accept a kind-24242 proof.  A kind-24242 event
presented on any other route MUST be rejected as `evidence_rejected`.

#### Upload proofs

Upload proofs MUST carry exactly one `x` tag whose value is the lowercase
hexadecimal SHA-256 of the exact consumed request body bytes.  The signed `x`
MUST be verified against the completed body; temporal admission is checked
before the body is consumed.

Upload proofs MUST carry exactly one `server` tag whose value matches the
request's already-resolved tenant host.  An upload proof with an absent or
mismatched `server` tag MUST be rejected as `evidence_rejected`.

#### Read proofs

Read proofs MAY be host-wide: no `x` tag is required for reads, and a valid
read proof authorizes reads of any blob on the one bound tenant host.

Read proofs MUST carry exactly one `server` tag whose value matches the
request's already-resolved tenant host.  A read proof with an absent or
mismatched `server` tag MUST be rejected as `evidence_rejected`.

If an `x` tag is present on a read proof: there MUST be exactly one, and it
MUST match the requested parent blob hash.  A mismatched `x` tag MUST be
rejected as `evidence_rejected`.

> **Named residual:** within a window of at most 60 seconds from minting (plus
> a bounded 5-second future-skew allowance), a captured full header set allows
> reading any media blob on exactly one tenant host.  This access is read-only,
> membership-checked, and revocable via assertion expiry or deny-map
> enforcement.  It is not state-changing and does not cross tenant boundaries.

#### Freshness

The following freshness rules apply to all kind-24242 proofs (upload and read):

- `created_at <= now + 5s` — bounded future skew; a proof dated more than 5
  seconds in the future MUST be rejected as `evidence_rejected`.
- `now - created_at <= 60s` — a proof older than 60 seconds MUST be rejected
  as `evidence_rejected`.
- Exactly one `expiration` tag MUST be present, MUST be valid (strictly in the
  future at admission time), and MUST satisfy `expiration <= created_at + 60s`.
  An absent, duplicate, expired, or out-of-range `expiration` tag MUST be
  rejected as `evidence_rejected`.

#### Transport and cardinality

The following cardinality rules apply to all kind-24242 proofs:

- A missing `Authorization` header field MUST be treated as `missing_evidence`.
  Repeated, comma-combined, empty, malformed, or wrong-scheme `Authorization`
  values MUST be rejected as `evidence_rejected`.
- Exactly one `t` tag MUST be present.  A missing, duplicate, or unrecognized
  `t` value MUST be rejected as `evidence_rejected`.
- Exactly one `expiration` tag MUST be present (see Freshness above).
- Exactly one `server` tag MUST be present on all kind-24242 proofs (see
  Upload proofs and Read proofs above).
- If `x` is present, exactly one instance is permitted (see Upload proofs and
  Read proofs above).
- Malformed, empty, duplicate, or conflicting instances of any of these fields
  MUST be rejected as `evidence_rejected`.

#### Per-request pairing

Every kind-24242 proof MUST be subject to the full NIP-FI per-request pairing
requirement: full assertion verification, exact key equality between the
assertion's `nostr_pubkey` claim and the kind-24242 event's public key, and
deny-map enforcement (see Admission procedure, steps 1–6).

### Request format

Each protected HTTP request MUST present both of the following:

```text
Authorization: Nostr <base64-NIP-98-event>
Nostr-Federated-Identity: Bearer <compact-JWS>
```

`Authorization` carries the NIP-98 authorization event as specified in NIP-98.
The field MUST be present exactly once, MUST use the `Nostr` scheme with a
single base64-encoded event value, and MUST NOT be repeated, comma-combined,
empty, use an alternative scheme, or carry a fallback credential.  Missing,
repeated, comma-combined, empty, malformed, non-`Nostr`, or wrong-scheme
`Authorization` values deny.

`Nostr-Federated-Identity` carries the compact-JWS assertion, identical in
format to the WebSocket transport field.  The field names are distinct; they
serve different roles and MUST NOT be combined or substituted for each other.
A request presenting only one of the two is denied.  The rules for
`Nostr-Federated-Identity` from Client-attached transport apply unchanged:
missing, repeated, comma-combined, empty, malformed, non-Bearer, or
mixed-profile fields deny.  [FI-TRACE-TRANSPORT-CLOSED]

### Admission procedure

On each protected HTTP request:

1. Resolve the connection's `Host` to `community`, including its canonical
   `expected_aud` and configured issuer allowlist; unknown, ambiguous, or
   unavailable community resolution → deny `authorization_unavailable`.
2. Extract the compact JWS `token` from `Nostr-Federated-Identity`; missing or
   malformed → deny `missing_evidence` or `evidence_rejected`.
3. Call `VerifyAssertion(token, community, D, R_t)`; any error → deny per the
   rejection table.
4. Validate the NIP-98 `Authorization` event per NIP-98; extract the proven
   pubkey `k` from the event.  An absent, malformed, or invalid NIP-98 event
   → deny `missing_evidence` or `evidence_rejected` as appropriate.
   For requests with an authorization-relevant body, the NIP-98 event MUST
   contain exactly one `payload` tag whose value is the lowercase hexadecimal
   SHA-256 hash of the exact consumed request body bytes.  An absent,
   duplicate, or mismatched `payload` tag on such a request → deny
   `evidence_rejected`.  [FI-TRACE-HTTP-INGRESS]
5. Assert `verified.asserted_key == k`; mismatch → deny `authorization_denied`.
   [FI-TRACE-ASSERTION-KEY-MISMATCH]
6. Check the deny set for `(iss, k)` and, if `verified.owner` is present, for
   `(iss, verified.owner)`.  Either active entry (`now < until`) denies
   `authorization_denied`.
   [FI-TRACE-DENY-SET]
7. Admit the request.

A body is **authorization-relevant** whenever any body byte influences the
authorization decision, target resource, requested capability, effect
selector, or state change.  Every state-changing body is authorization-relevant.
A body may be classified non-authorization-relevant only if none of those
properties derive from body fields that are not otherwise bound.  The
classification MUST be fail-closed: a body that cannot be classified as
non-authorization-relevant MUST be treated as authorization-relevant and a
`payload` tag required.

### Per-request verification

HTTP is sessionless.  **Every** protected request re-executes the full
admission procedure above; there is no session lifetime, no cached admission
decision, and no carry-over from a prior request.  The cumulative residual
bound `max(0, min(exp, iat + maximum_assertion_age) - now)` applies per
request — there is no per-connection lifetime partition to shorten it
further.  Issuers SHOULD configure short assertion TTLs consistent with the
deployment's acceptable revocation latency.

### Denial responses

Denial on a protected HTTP request produces an HTTP response (not a Nostr
text frame).  The same public denial classes, status codes, and fixed body
bytes from the Rejection and privacy table apply.  The response contains no
free text, reason code, issuer, subject, key, claim, or timing hint.
[FI-TRACE-DENIAL-ORACLE]

## Rejection and privacy

Public class is a function only of evidence the requester supplied, never of
private per-principal server state; `authorization_unavailable` is the sole
exception and reveals only that a required dependency or community/Host mapping
is unavailable.

| Private condition | Public class | Nostr text | HTTP response |
|---|---|---|---|
| assertion or proof absent | `missing_evidence` | `auth-required: authentication required` | `401`; `WWW-Authenticate: Nostr`; `Content-Type: text/plain; charset=utf-8`; body `authentication required\n` |
| unknown or community-unauthorized issuer; malformed, invalid, or expired evidence | `evidence_rejected` | `restricted: evidence rejected` | `403`; `Content-Type: text/plain; charset=utf-8`; body `evidence rejected\n` |
| assertion–key mismatch; unauthorized issuer principal, signed-target–body mismatch, or replayed `jti` on a signed command; active deny-set entry for pubkey | `authorization_denied` | `restricted: authorization denied` | `403`; `Content-Type: text/plain; charset=utf-8`; body `authorization denied\n` |
| required JWKS snapshot or community/Host resolution unavailable | `authorization_unavailable` | `restricted: authorization unavailable` | `503`; `Content-Type: text/plain; charset=utf-8`; body `authorization unavailable\n` |

A denial decided on a WebSocket upgrade is the HTTP response in place of `101`.
A denial decided on a protected HTTP request is the HTTP response.
A denial decided after a WebSocket connection is established is the Nostr text.
Responses contain no free text, reason code, issuer, subject, key, claim, or
timing hint.  [FI-TRACE-DENIAL-ORACLE]

NIP-FI defines no public identity projection.  Raw assertions, `iss`, `sub`,
email, display name, and private claims MUST NOT appear in public events, tags,
filters, discovery, logs, metrics, or traces.  [FI-TRACE-PRIVACY-NONPUBLIC]

## Out of scope

The following are issuer and deployment concerns.  This spec defines no
normative behavior for them:

- Identity↔key registry, key ownership records, and the one-identity one-key
  constraint: issuer-side.
- Key rotation, re-enrollment after device loss: issuer-side.
- Per-session (`sid`-level) revocation: issuer-side.  The relay's revocation
  primitive is pubkey-scoped and community-wide, keyed `(iss, target_pubkey)`
  (see Admin disconnect API).  If an issuer revokes an entire identity, it
  disconnects each key it has asserted for that identity.  A disconnect of an
  owner key also covers that owner's agent keys at relays advertising
  `agent_assertions: true`.
  Individual session/device logout is handled by assertion expiry within the
  configured TTL window.
- Revocation signaling to the issuer/IdP: issuer-side; the issuer stops
  issuing assertions, which closes the relay window within assertion TTL.
- Directory integration and account-offboarding automation: issuer-side.
- Audit logging beyond what the relay operator chooses to retain: issuer-side.
- Delegation other than "Agent keys": out of scope.

## Discovery

A relay SHOULD advertise core support in NIP-11 as:

```json
{
  "limitation": { "federated_identity": true },
  "federated_identity": {
    "core": "client-attached",
    "assertion_freshness": {
      "class": "offline-jwt",
      "maximum_residual_upstream_revocation_seconds": null
    }
  }
}
```

`maximum_residual_upstream_revocation_seconds` is `null` for the
`offline-jwt` class because this spec provides no unconditional finite
upstream-revocation bound.  The deny-until-TTL mechanism closes the
reconnect window when the issuer issues a well-formed disconnect command
and the relay retains the entry, but neither condition is guaranteed by
the protocol: `until` is an upper ceiling on deny duration, not a lower
bound ensuring denial outlasts all live assertions; a past or short
`until` is valid; and a relay restart MAY forget active entries.  If the
issuer stops issuance after a successful deny, the residual ceiling is
`max(0, min(exp, iat + maximum_assertion_age) - now)` — but this is an
issuer-operational property, not a protocol invariant this field can
advertise unconditionally.

`agent_assertions` (boolean, optional).  `true` means the relay admits agent
assertions as defined in "Agent keys".  Absent or `false` means it does not.
An issuer MUST NOT issue an agent assertion for a community whose relay does
not advertise `agent_assertions: true`.

Discovery MUST NOT state issuer URLs, audiences, claim names, tenant IDs, or
deployment-local identifiers.  [FI-TRACE-DISCOVERY-PRIVATE]

## Behavioral oracles

| ID | Required outcome |
|---|---|
| `FI-TRACE-TRANSPORT-CLOSED` | Exact one-header input succeeds; missing, repeated, combined, malformed, and fallback variants deny. |
| `FI-TRACE-ASSERTION-VALIDATION` | Valid boundary input passes; each signature, key-selection, issuer, audience, time, size, and missing-configuration negative denies; a missing or unavailable community configuration denies `authorization_unavailable`; a known-but-community-unauthorized issuer denies `evidence_rejected` without touching its key source, indistinguishably from an unknown issuer, including when that issuer's snapshot is unavailable; an issuer authorized only for community A cannot authorize community B merely by signing an assertion with community B's audience; an assertion for community A presented on a `Host` resolved to community B denies on the community binding; an unknown, ambiguous, or unresolvable `Host` denies `authorization_unavailable`. |
| `FI-TRACE-TOKEN-CLASS` | `at+jwt` and `nip-fi+jwt` pass only their selected class; ID tokens, wrong or generic types, and cross-class fallback deny. |
| `FI-TRACE-ASSERTION-KEY-MISMATCH` | Mismatch between `nostr_pubkey` and the NIP-42 proven key denies with the private-state response. |
| `FI-TRACE-JWKS-ADD` | A key added to the JWKS is accepted after the next snapshot refresh. |
| `FI-TRACE-JWKS-REMOVE` | Connections verified under a removed key deny on next revalidation or reconnect. |
| `FI-TRACE-DEPENDENCY-FAIL-CLOSED` | An unreadable JWKS snapshot denies `authorization_unavailable`; no degraded Nostr-only access. |
| `FI-TRACE-LEASE-BOUND` | A session closes at its earliest deadline; equality at any deadline is expired. |
| `FI-TRACE-DENY-SET` | A pubkey in the deny set is denied `authorization_denied` on admission until `now >= until`; an expired or absent entry does not deny; a past-`until` command closes sessions — absent an active same-key entry it creates no future denial, while an active entry remains unchanged under the merge rule; a deny-set-full command is rejected `503` without closing sessions and without removing any existing entry; capacity is evaluated per issuer — one issuer's capacity exhaustion MUST NOT reject another issuer's command; a connection that passes the deny-set check before a concurrent deny-entry insertion but completes admission after MUST still be terminated (the session's proven `k` and admitting issuer are registered before the deny-set check, ensuring the close scan catches it); a registered-but-not-admitted connection caught by the close scan MUST be cancelled terminally and MUST NOT later be admitted; a disconnect command from one issuer MUST NOT close a same-key connection registered under a different issuer, whether or not admission has completed; two overlapping commands for the same `(iss, pubkey)` in either delivery order result in `until = max(until_A, until_B)` — delivery order does not shorten the longer deny; a past-`until` command arriving over an active entry leaves the active entry's `until` unchanged; a successful disconnect responds `{"disconnected": true}` regardless of how many sessions were closed; the deny entry applies across all communities served by the relay under that issuer. |
| `FI-TRACE-HTTP-INGRESS` | A protected HTTP request with both valid headers and matching pubkeys is admitted; absent, mismatched, or invalid assertion or NIP-98 event denies; a request presenting only one of the two denies; an active deny-set entry denies; a route that cannot be classified as exempt is treated as protected; repeated, comma-combined, wrong-scheme, or alternative-credential `Authorization` fields deny `evidence_rejected`; a missing `Authorization` field denies `missing_evidence`; an authorization-relevant body without exactly one matching `payload` tag denies; the NIP-FI administrative API is not a protected surface.  For kind-24242 (Blossom) proofs on media routes: a `t=upload` proof with valid `x`, `server`, `expiration`, and freshness is admitted on `PUT /upload`; a `t=get` proof with valid `server`, `expiration`, and freshness is admitted on `GET\|HEAD /media/{hash…}`; a kind-24242 proof on any other route denies; an upload proof with absent or mismatched `server` tag denies; a read proof with absent or mismatched `server` tag denies; a proof with a duplicate, missing, or out-of-range `expiration` tag denies; a proof dated more than 5 seconds in the future denies; a proof older than 60 seconds denies; key mismatch between assertion `nostr_pubkey` and the kind-24242 event pubkey denies; an active deny-set entry denies. |
| `FI-TRACE-DENIAL-ORACLE` | Each public-class row produces its exact fixed bytes; all private-state rows compare byte-identical. |
| `FI-TRACE-DISCOVERY-PRIVATE` | Complete discovery bytes do not expose issuer, audience, or deployment-private state. |
| `FI-TRACE-CROSS-DOMAIN-COLLISION` | Equal `sub` values under different `iss` values remain distinct identities. |
| `FI-TRACE-PRIVACY-NONPUBLIC` | Private identity does not enter public surfaces. |

## Security considerations

**Assertion theft.** A stolen assertion cannot authorize without also proving
the named `nostr_pubkey` via NIP-42.  The relay's assertion–key binding check
is the primary control against assertion replay across keys.

**TTL window after revocation.** Offline JWT verification means the relay
cannot observe IdP-side revocation until the current assertion expires.  The
deployment MUST configure a `max_connection_lifetime_seconds` and
assertion TTL consistent with the organization's acceptable revocation latency.

For upstream revocation without an explicit disconnect call (issuer stops
issuing assertions; no active session termination), access persists until the
live session's effective authority deadlines expire.  After the session closes
naturally, a reconnect requires an assertion that remains valid when reverified.
Previously issued assertions that have not yet expired remain valid for
reconnection until `min(exp, iat + maximum_assertion_age)` (subject to possible
earlier termination from a snapshot refresh failure, hard-deadline expiry without
key replacement, or signing-key removal).  Stopping issuance prevents minting
assertions that extend this window; it does not invalidate already-issued
assertions.  If the issuer continues issuing assertions, access continues.

For the deny-until-TTL disconnect model (issuer issues a successful disconnect
call with an `until` timestamp), the relay inserts a deny entry for the target
pubkey with expiry `until` and then closes all matching connections synchronously.
Here, matching means connections registered under that issuer whose proven `k`
equals that target pubkey or whose recorded owner equals the target pubkey,
whether or not admission has completed; disconnect
cancellation is terminal, so a cancelled in-progress connection MUST NOT be
subsequently admitted.  Connections registered under another issuer are not
affected.  Any subsequent admission attempt for that pubkey under the same issuer
is denied `authorization_denied`
until `now >= until`.  The `until` ceiling enforced by the relay is
`now + skew + maximum_assertion_age`; this limits how long a deny entry may last —
it does not ensure denial outlasts all live assertions.  A short or past
`until` is valid, and if the issuer continues issuing after the entry
expires, access resumes.  The issuer SHOULD set `until` to outlast the
longest still-live assertion it has issued to ensure no unexpired assertion
slides through the expiry boundary; this is an operational recommendation,
not a protocol invariant.

A relay restart clears the in-memory deny set.  The issuer SHOULD re-push
still-active entries on observed restart, but re-push is not required and
carries no specified completion bound.  If the issuer stops issuing
assertions and re-push completes before any expired-entry reconnection
attempt, the residual exposure after restart is bounded by
`max(0, min(exp, iat + maximum_assertion_age) - now)`.  If the issuer
continues issuing or re-push does not complete in time, that formula does
not apply and access may continue beyond it.

**HTTP ingress bypass.** Without the pairing rule, a principal holding an
active key can mint fresh NIP-98 events indefinitely and retain HTTP access
for as long as the key remains accepted — the assertion TTL provides no
bound when the assertion is never examined.  The pairing rule closes this
gap by requiring assertion verification on every protected HTTP request.
The per-request re-verification model means there is no cached admission
window; a deny-set entry takes effect on the very next request.

**JWKS SSRF.** `public_https` MUST validate an HTTPS URI, reject every
resolved address on its IP deny-list, pin the checked address to prevent DNS
rebinding, and deny redirects. The IP deny-list covers the complete IANA
Special-Purpose address registry. The `mesh` address allow-list and operator
security boundary are defined in the [JWKS snapshot contract](#jwks-snapshot).
Both modes MUST resolve once, validate every answer before pinning the first
permitted address, disable proxies, deny redirects, enforce a 10-second
whole-fetch deadline, cap the streamed response at 512 KiB, reject non-2xx
responses, and provide no fallback network path.

**Issuer compromise.** A compromised assertion issuer can impersonate any
identity but cannot prove possession of the assertion-named Nostr key.  The NIP-42
proof remains an independent control.

**Algorithm confusion.** The verifier enforces asymmetric algorithms only;
`alg=none` and symmetric algorithms deny.  The exact `kid`-based key selection
is bounded before any attacker-controlled lookup.

## Sources

- NIP-42 authentication: <https://github.com/nostr-protocol/nips/blob/6d2979b3f503a8539c983efbcdcf901bbcf9ed23/42.md>
- NIP-98 HTTP authorization: <https://github.com/nostr-protocol/nips/blob/ae0fd96907d0767f07fb54ca1de9f197c600cb27/98.md>
- JWT BCP: <https://www.rfc-editor.org/rfc/rfc8725>
- JWT access-token profile: <https://www.rfc-editor.org/rfc/rfc9068>
- Resource Indicators for OAuth 2.0: <https://www.rfc-editor.org/rfc/rfc8707>
- DPoP: <https://www.rfc-editor.org/rfc/rfc9449>