[bradseiler]

Trusted operators can choose initial_requires_nip_fi on create-only community provisioning. True commits required policy (generation 1), validated issuer bindings and the owner with the new community in one transaction. Omitted, null or false preserves optional creation; a non-null field in legacy ensure mode returns coded 400. Missing effective bindings refuses required insertion without leaving a row.

The response reports policy read from the stored row. Same-owner create-only replay now accurately reports existed instead of created; it stays successful and read-only, including after policy disable or issuer-config changes. Different-owner conflict, legacy ensure, bootstrap and the operator authorization gate retain their behavior. This adds no schema changes or server-wide default flag.

Upgrade the whole serving relay fleet before callers request true. An old writer may ignore the field and insert an optional row: response checks detect it but cannot undo it, and later lookup remains read-only. Turn caller targeting off before relay rollback. Mode off stores policy but bypasses enforcement, independently of the upgrade gate.

Related issue

Replaces closed #9172. The separate lifecycle API remains in #9176.

Validation

Draft head: bf16a1e0aba102c3be86f9621bd53d2cae98661c. Independent source review covers this head. Formatting, diff sanity, Clippy, build, all 14 signed HTTP scenarios and full local just ci pass at this head. GitHub reports 59 successful and 38 skipped checks, with none pending or failing in the collected snapshot.

At parent b9d9423a6058387f42c310f5a7e4dbe0c8d8b40f, all 1,978 package tests and 1,346 PostgreSQL tests passed (PostgreSQL concurrency 2). Four deliberate mutations were detected and restored. Clippy then found seven needless borrows in the new HTTP test; this head removes those borrows only. Earlier validation passed 1,344/1,346 PostgreSQL tests at concurrency 8; the replay assertion was corrected and the timeout disappeared at concurrency 2. Failed-run evidence is retained.

At this head, the first mandatory push-hook attempt failed all nine boot-lifecycle tests on child startup deadlines. A subsequent serial run passed all nine (seven PostgreSQL-only cases skipped), with unchanged deadlines and source. The first diagnostic was interrupted during compilation without a result; all evidence is retained. A normal-hook retry was stopped when the author explicitly authorized one push with --no-verify for this exact commit. That exception skips local pre-push hooks for publication only; failed hooks and remaining validation still gate readiness.

Explicit human runtime confirmation remains a separate acceptance step; agents have not attested it.

Generated with Codex

Validation update at the same draft head: Clippy, build and all 14 signed HTTP workflow scenarios passed, including atomic required creation, stored-policy replay after disable without a current binding, and refusal without leaving a row. The first live harness run stopped after 12 checks because its SQL helper fetched rows after an UPDATE without RETURNING; that harness query was corrected and the complete workflow passed. Relay source stayed unchanged.

The full local just ci run failed in mobile-check: Dart formatting reported 266 changes among 1,068 files, with unresolved flutter_lints configuration warnings. The format check used --output=none; the worktree remains clean. Repository validation is therefore not green. That failure is retained as historical evidence; see the successful setup-corrected rerun below. Explicit human runtime confirmation remains separate.

Final local validation: after just mobile-install, mobile-check passed without formatting edits, and full just ci completed successfully at bf16a1e0aba102c3be86f9621bd53d2cae98661c. Tracked files remained clean after installation and after the complete run. This confirms the earlier mobile formatting failure resulted from missing worktree dependencies. All failed runs remain preserved. GitHub's current ready-for-review state is preserved; no agent added buzz-review-completed or attested human runtime acceptance.

[github-actions]

🔐 Codex Security Review

Note: This is an automated, security-focused review generated by Codex.
Use it as a supplement to human review; false positives are possible.

Scope

• Exact PR diff: 01d9778606bd5a1bbe80a743a1c2cc659721cf12...bf16a1e0aba102c3be86f9621bd53d2cae98661c
• Model: gpt-6.1-sol

💡 Click "edited" above to see earlier reviews for this PR.

---

Review Summary

Overall Risk: NONE

No concrete security, correctness, or reliability findings in the authorized PR range.

Findings

No concrete security, correctness, or reliability findings were identified.

Notes

• Review used read-only inspection of the diff, surrounding source, callers, migrations, tests, and history. Builds and tests were not executed.

---

_{Generated by Codex Security Review |
Requested by: @bradseiler |
Workflow run}

[wpfleger96]

🤖 Reviewed the diff against main. No blocking findings.

• The policy field is gated after the operator allowlist check, and only create-only mode accepts it (any non-null value in ensure mode returns a coded 400).
• Required creation with no effective bindings errors inside the open transaction, so the community insert rolls back and no row is left behind. Replays and the concurrent-create loser read the stored policy back and never rewrite it.
• status: "existed" on a same-owner replay is compatible with the only in-repo caller (loadgen provision_host checks only for a 2xx status).