[bradseiler]

Summary

Apply relay mode consistently across protected HTTP, root/audio WebSocket, Git, media and V1 admission. Off requires no NIP-FI, including for stored required communities. Shadow enforces only stored community requirements and observes other communities. Enforce requires NIP-FI for every community. Durable requirements survive all mode changes.

Off retains ordinary tenant routing and authentication. It skips FI policy/dependency reads for admission, uses cached WebSocket tenant routing, and loads no FI binding snapshot at startup. Discovery reports requires_nip_fi=false and no FI capability in Off. Evaluating modes retain same-row WebSocket binding and immutable HTTP policy tenants, including host remaps, pending deletion and unarchive races. Global Enforce discovery retains its existing compatibility behavior.

Host-specific root NIP-11 and /info expose the additive requires_nip_fi field with no-store. In evaluating modes, an unavailable policy returns 503 and an unknown or non-serving host returns 404. Off uses ordinary routing; a discovery lookup failure returns 404. Stored requirements in Shadow require usable FI dependencies.

Admission does not establish activation. BUZZ-512 owns existing-session application, drain and mode-aware readback; its separate revision must report stored requirements as suspended in Off. Production baseline verification and human acceptance remain open.

Community status now shares the bounded host cache: 10,000 entries, one-second leases measured before checkout, coalesced fills, and no cached misses or errors. Git reuses one request policy. Root/audio retain the final primary binding check: two reads on a cold successful upgrade, one on a cache hit. Off creates no verifier or JWKS source and reads no FI policy. Proof metrics count stored-required Shadow enforcement.

Acceptance locks and validates the community row, takes the matching host advisory lock, and drains optional leases for 1.1 seconds before commit. Reads begun after commit see required across participating relay instances, even without Redis invalidation. The row lock closes single and double remap races. Admissions already in flight remain subject to BUZZ-512 activation fencing.

Related issue

BUZZ-511. BUZZ-510 / #8985 is merged; this PR now targets main.

The restack retains main’s #8974 denial telemetry and artifact capabilities. Related work includes #8526 tenant lookup errors and #8444 media authorization.

Rollout and containment

Keep BUZZ_NIP_FI_UPGRADES_ENABLED=false. The rollout plan starts in staging with zero required rows and a 30-minute before/after traffic comparison. Initial abort limits include any policy timeout/503, policy-read p99 above 50 ms, writer acquisition p99 above 20 ms or twice baseline, and a five-minute 503 increase above 0.1 percentage point. These are initial limits to validate against measured staging results, not production capacity claims.

Verify signed/unsigned free controls, real required root/audio upgrades, dependency failures, restart behavior and discovery before expansion. Also watch binding timeouts/errors and their current generic 404 responses on known serving hosts alongside writer-pool pressure; evaluating root/audio binding has a 500 ms budget; Off uses ordinary cached routing. In Shadow, a pre-511 rollback loses enforcement of accepted community requirements. Stop new upgrade calls, retain accepted policy and receipts, and repair with an enforcing binary or operator-approved containment. Never clear durable policy to restore access. Off deliberately suspends FI enforcement and must be an explicit operator mode choice. No production activation is claimed.

All acceptance paths must implement the lease protocol before upgrades are enabled. Keep upgrades disabled through a mixed-version rollout. For rollback, disable new acceptance before removing the protocol while caching pods remain. A cold policy fill uses a six-statement transaction and a 400 ms server timeout within the 500 ms lookup budget. A contended policy fill returns 503. During the drain, archive, deletion, ownership, issuer-binding and competing acceptance writers for that community may wait; ordinary serving reads and writes retain their existing behavior. Host-binding changes retain the existing one-second routing bound. Local and Redis invalidation accelerate refresh; safety does not depend on delivery. Deploy the verified Shadow revocation behavior from #8991 before accepting required communities in Shadow.

Testing

Published review-fix head: 39dfe79b1fc04f10ee3eb94d6ea42cf686bafe1e, tree 1e2e8d3abd39ee1d6821defe8c8d34de73726e08. McKeon cleared this cache delta. Full affected auth (291), DB (192), pubsub (31) and relay (1,682) package tests passed, including integration binaries. Two previously documented hardcoded-Redis audit tests remained excluded. All-target clippy, all 1,297 native PostgreSQL tests and the full pubsub Redis suite passed. The full ACP package and just ci passed after rebuilding cached test executables that embedded a removed checkout path. No ACP source changed. Tauri's generated lockfile delta was archived and restored; it is excluded from this candidate.

Both positive lease regressions passed. Four deliberately broken variants failed at the intended assertions: removing the drain left an optional lease alive after 202.935667 ms; skipping the fill lock failed contention refusal; moving the timestamp after the read failed the anchor check; taking the host lock before the row failed the remap-blocking check. Exact source was restored after each mutation. These are local validation results, not a deployed-fleet acceptance claim. All applicable normal push hooks passed. GitHub reports the exact tested head and tree; the published code has no delta from the reviewed candidate.

Earlier mode-correction evidence follows for context.

Current mode-correction head: aa9abf07284b56a88eb78a2014e590f39d705288, on main af54258f19ac32667c027f889652bdeb479c8e13. Its code equals reviewed f1e7da5fc5, plus the independently reviewed operator documentation follow-up; all 19 earlier remote patches are preserved. McKeon verified the correction and its mapping to the tested candidate.

The mode-correction candidate passed full auth (291) and relay (1,679) package tests, clippy, and four explicit native PostgreSQL policy workflows. There were 623 ignored relay tests and two excluded Redis tests. Real PostgreSQL checks cover an ordinary unsigned caller on a stored-required host in Off with no FI token or dependencies, discovery false, durable policy retained, root/audio upgrades, host remaps and the unarchive race in evaluating modes. The STORED_OFF mutation fails the enum truth table only; OFF_PRIMARY fails cached upgrade routing. Restored source hashes match. Earlier failed compile/fixture attempts remain recorded.

The first normal push hook attempt passed Tauri checks but failed the gateway startup verifier test (82/83 gateway tests passed). The remote remained unchanged. The retry rebuilt gateway artifacts with separate root and Tauri caches, then passed every normal push hook and published this head. No gateway source changes or hook bypasses were needed. Current-head hosted CI is tracked separately. Human acceptance and the staging binding-timeout/404 workflow remain open. The following retained validation and controls are historical and describe behavior before the mode correction; their Off-enforcement statements are superseded by the Summary above.

Published head: 9a717fa89725f9430ff4a8bb78cd600affb8836d, on main 1055f79d048ef22c878d02a7afb04f49c753564f. CI, three schema checks, 2,136 ordinary tests, all 291 auth tests, 12 Redis tests, all 1,300 native PostgreSQL tests and discovery passed. The required wrapper passed units, then exited 1 at unavailable Docker bootstrap. BUZZ-510 is complete at 95c8d31c835d6f7ff6e432fb1ed248771d4f06dd: CI, three schema checks, 2,127 ordinary tests, 12 Redis tests, all 1,295 native Postgres tests and discovery passed; its wrapper passed units and failed at unavailable Docker bootstrap.

The first native run at historical BUZZ-510 5380cb72 passed 1,291 tests and failed two event-follow-up queue assertions and the scale-sync case. All three passed serially, then the full 1,294-test run passed with normal concurrency. The original cause remains unresolved; failed runs and resource samples are retained.

Standalone BUZZ-511 checks exposed access-slot callers, a Clippy warning and early HTTP 503 attribution that had remained in the child. All are now corrected in the parent. The unchanged real-router refusal regression passed before the latest commit. BUZZ-512's final tree is unchanged by moving these parent prerequisites. The remaining 46-file child delta was audited; no additional parent prerequisite was found. Earlier compile and native failures remain archived.

The following earlier-head results and controls are historical; the current-head validation is reported above.

At 48388834f99b8d045e243b619904cb3e27b47146, based on BUZZ-510 130f14a675edd7cbe6a69d1c9d7818bd1a51f46c and reconciled main 152441ae0a56b204b42b6faa56a36ad2b98218b1:

• just ci: passed.
• Four-package ordinary suite: 2,069 passed; full buzz-auth package: 291 passed.
• Native Redis: 12 passed. Native PostgreSQL: 1,261 passed. PostgreSQL discovery checks passed.
• Required just test: units passed, then exited 1 because Docker service bootstrap was unavailable. Native service results above are separate.
• Real-router remap checks reject an A-only member under B policy, avoid A data after B admission, and advertise B in discovery despite a stale A cache. Removing each tenant pin separately fails its intended witness; restored source passes. An unmapped host cannot reuse a cached tenant.
• Deadline witnesses advance their clock during real HTTP signature verification and retain socket primary-lookup barriers. Removing either final enforced or shadow HTTP deadline check separately fails its intended witness; restored source passes both deadlines and the single-resolution control.
• Telemetry regression: unsigned dev proofs now expect the earlier NIP-98 missing denial; signed mismatched-key proofs retain pairing denial and signer attribution. Removing unsigned-proof rejection fails the exact two-counter assertion. Restored full relay package: 1,654 passed.
• Preserved failed runs: two prior bottom-layer desktop gates failed an immediate inventory assertion, repaired with a bounded wait for the same observable arrays and verified with delayed-notification and frozen-provider controls. An earlier BUZZ-511 native run passed 1,242 tests and failed two deadline fixtures that relied on the tenant lookup removed by the policy pin; the test-only adaptation above replaces that seam. These failures remain archived. The first native run on bottom-layer 130f14a6 passed 1,255 tests and failed partition contention; its focused original test and fresh full 1,256-test run passed without source changes. The cause remains unresolved. The first CI run at d8d88433 failed the old telemetry expectation; the test-only correction above preserves exact denial counts and attribution.

Earlier evidence at dddf05d8be8195d567db0f989f70825b1246a6c1 (historical head):

• cargo nextest run -p buzz-auth -p buzz-db -p buzz-relay --lib --tests: 2,139/2,139 passed.
• scripts/postgres-test-run.sh -p buzz-db -p buzz-relay --lib --tests --success-output final: 1,236/1,236 passed with native PostgreSQL 16 and Redis. Docker's legacy just test wrapper was unavailable.
• just ci: passed, including repository checks, tests and client builds.
• Pre-correction behavior (superseded): Real ES256 assertions through TCP root/audio upgrades: valid evidence upgrades; missing evidence denies in Off/Shadow, including submitted/inventoried/approved deletion stages. Restoring the old query makes the regression fail on an assertion-less Off/submitted/root HTTP 101.
• Pre-correction behavior (superseded): Deterministic unarchive race: Notify barriers pause an actual archived-host policy miss; the same required row becomes serving before binding. Both root/audio deny missing assertions and admit valid ES256 assertions in Off/Shadow. Ignoring bound-row policy makes this test fail on an assertion-less HTTP 101.
• The full rerun exposed an existing cancellation fixture whose synthetic five-second replica fence expired between probes. Refreshing that test fence per operation preserves its timeout assertions; the full suite now passes.
• Local probe: 100 serial uncached primary policy reads took 12.33 ms. Production latency is unmeasured.

No packaged-app, human or deployed-fleet acceptance run. Live activation awaits BUZZ-512 and the staging verification tickets.

Published with the three-layer stack in one atomic push through normal hooks. The published stack includes main 1055f79d048ef22c878d02a7afb04f49c753564f, including access logging, storage reporting and mobile read-state changes. Access-slot integration and early HTTP refusal attribution belong to BUZZ-511; activation callback refusal close owners belong to BUZZ-512. Every changed layer requires review at its published head and new-head CI. Fresh trunk, remote membership, queue and immutable-lease guards passed before publication. All nine normal pre-push hook lanes passed; no hooks were bypassed. Remote heads, chained bases, membership, ready/draft states and native tracking were verified after publication.

Trunk’s merged 0081 is unchanged. The parent upgrade expansion is 0082 and activation is 0083, with contiguous migrator versions, updated documentation and a populated-upgrade fixture starting at 81. Trunk’s storage-test repair supersedes our earlier local repair.

Before publication, main advanced three commits from 1055f79d048ef22c878d02a7afb04f49c753564f to ba7d7825ea (desktop deep-link settling and mobile pairing/sign-in). The normal branch-skew guard passed. Those later trunk commits are outside this validated published head; current-trunk CI and delta review remain required before merge.

Generated with Codex

[baxen]

🤖 Reviewed with a focus on the efficiency of the per-request policy design. I didn't find correctness problems in the mode logic. The main thing: outside Off, admission now costs uncached writer reads on every protected HTTP request (1), root/audio WS upgrade (2), Git request (2) and NIP-11 GET (1, unauthenticated). The policy columns are already selected by the cached host lookup, so folding them into tenant_host_cache (1s max-age, coalesced misses) would bring most of these to zero writer reads. Because the requirement is monotonic, that costs at most 1s of staleness on a false→true flip, and BUZZ-512's drain has to handle that moment anyway. Inline comments have specifics.

[baxen]

🤖 Two more items. Neither is on a changed line, so they're links instead of inline comments.

1. In Shadow, revocation doesn't close live sessions on required communities. The admin disconnect command and its cross-pod consumer still decide by the global mode:

• api/nip_fi.rs:141: local close
• api/nip_fi.rs:398: cross-pod close
• api/nip_fi.rs:175 and main.rs:841: the disconnect publish/subscribe channels also follow the global mode

In Shadow every disconnect records would_close and closes nothing. This PR makes Shadow the mode that enforces stored-required communities. So a revoked key on a required community is refused on new requests (the deny entry is kept), but its existing sockets stay open until they end on their own. I understand existing-session application belongs to BUZZ-512. Could that be called out explicitly as a precondition for accepting any requirement in Shadow? Alternatively, the close could key on whether the session was admitted with an enforced assertion rather than the global mode.

4. Enforcement metrics undercount required communities in Shadow. EnforcedProof::new (nip_fi_shadow.rs:536) is inert unless the global mode is Enforce. So buzz_nip_fi_enforce_strict_proof_total records nothing for requests that are actually enforced because their community is required under Shadow. Keying it on the request's effective mode (the per-request policy is already in scope inside the guard) would make the staging and rollout dashboards reflect real enforcement.

[baxen]

Approving, but see the comments above which i think need to be addressed before mergin