[bradseiler]

Summary

Community NIP-FI upgrades need evidence that identity is preserved, unrelated communities retain their expected access, and active status follows actual target drain. This adds the BUZZ-516 acceptance procedure, failure matrix and evidence requirements.

The mode matrix follows the owner’s revised contract: Off performs no FI enforcement, including for stored-required communities; Shadow enforces stored requirements; Enforce requires FI everywhere. Off retains durable policy and receipts but cannot report active FI enforcement. The procedure covers missing dependencies, transitions back to Shadow, recovery after the default-off upgrade-admission gate closes, and the merged operator contract. Mode and upgrade-switch scenarios require a dedicated staging deployment with an explicit allowlist, transitions and incarnation obligations. Shared staging remains protected.

Every live matrix row remains blocked on the BUZZ-511 correction to the operator contract. deny_protected is a separate repair mode.

The harness receipt contract is pinned to an immutable source revision. Actual candidate artifacts, admitted routing/security policies, platform-config provenance, startup receipts and per-incarnation drain evidence remain required before live acceptance.

Incomplete draft: this PR contains the procedure only. Executable cross-component acceptance tests, current prerequisite validation, Postgres execution and live/render evidence remain outstanding. Component tests will be reused from their owning BUZZ-510–515 changes. This PR does not complete BUZZ-516.

Related issue

BUZZ-516. BUZZ-510 #8985 is merged. Admission/discovery #8988, activation #8991, and the remaining module, staging and harness prerequisites retain their own review and validation gates.

Testing

Documentation content, local links/anchors, cited source paths and diff checks were verified after rebase onto main af54258f19ac32667c027f889652bdeb479c8e13, which contains merged #8985. All 11 inherited patches replayed unchanged. This changes no runtime code; no application, package, PostgreSQL or staging tests were run for this revision. Skipped test jobs are unexecuted.

Historical local validation did not establish a full pass: the initial just ci stopped at mobile setup, the retry has no captured completion, and the PostgreSQL lane exited before discovery because its admin URL was unset. Those attempts are not evidence for the rebased revision.

No deployment, Job execution or live mutation is included. Human acceptance and independently reviewed prerequisite implementations remain required.

Generated with Codex