diff --git a/docs/nips/NIP-FI-CONF.md b/docs/nips/NIP-FI-CONF.md new file mode 100644 index 000000000..9ea850050 --- /dev/null +++ b/docs/nips/NIP-FI-CONF.md @@ -0,0 +1,13 @@ +# NIP-FI-CONF: Conformance Profile + +`draft` `optional` + +> SKELETON — text owner: Dawn. Source: PLANS/NIP_FI_9999_CORRECTNESS_KIT.md. + +## Scope + +Claim tuple + evidence rules; per-profile trace subsets (core traces live in +core); 12-row denial reason→class mapping with closed public-response +vocabulary + byte-identical-response traces; mutation adequacy (one mutant per +core MUST, caught by its named trace); interop exit test (byte-exact request + +denial per class derivable from core doc alone). diff --git a/docs/nips/NIP-FI-DELEG.md b/docs/nips/NIP-FI-DELEG.md new file mode 100644 index 000000000..33caa489b --- /dev/null +++ b/docs/nips/NIP-FI-DELEG.md @@ -0,0 +1,10 @@ +# NIP-FI-DELEG: Delegated Agent Profile + +`draft` `optional` + +> SKELETON — text owner: Wren. Semantics unchanged from a383fd50a; own traces. + +## Scope + +Delegation attached to a bound owner; owner revocation invalidates delegates on +the same schedule; delegation traces. diff --git a/docs/nips/NIP-FI-EDGE.md b/docs/nips/NIP-FI-EDGE.md new file mode 100644 index 000000000..bee9be15c --- /dev/null +++ b/docs/nips/NIP-FI-EDGE.md @@ -0,0 +1,14 @@ +# NIP-FI-EDGE: Trusted Edge Profile + +`draft` `optional` + +> SKELETON — text owner: Perci. Source: RESEARCH/NIP_FI_9999_TRANSPORT_WIRE_DESIGN.md. + +## Scope + +Registered edge adapters; trusted-proxy-hmac-v2 envelope + canonicalization; +authorization_domain_id derivation (exact 16 RFC 9562 UUID bytes, network order); +proof_transport_code registry + extension procedure; key rotation; nonce replay; +body acquisition bounds (deny-before-hashing, EOF-complete); normative test-vector +suite with full intermediates; proxy provenance traces. Header-trust-without- +provenance is nonconformant. diff --git a/docs/nips/NIP-FI-LIFECYCLE.md b/docs/nips/NIP-FI-LIFECYCLE.md new file mode 100644 index 000000000..b76e48c8c --- /dev/null +++ b/docs/nips/NIP-FI-LIFECYCLE.md @@ -0,0 +1,12 @@ +# NIP-FI-LIFECYCLE: Binding Lifecycle Profile + +`draft` `optional` + +> SKELETON — text owner: Max. Source: PLANS/NIP_FI_9999_DESIGN.md (lifecycle rows +> of Wren's disposition table) + prior spec text at a383fd50a. + +## Scope + +Recover, re-enable, provisioned mode, binding_not_after, pending-replacement +lineage, dual-control/admin transitions; one conformance trace per privileged +transition including one-shot Q_D consumption. diff --git a/docs/nips/NIP-FI-MODEL.md b/docs/nips/NIP-FI-MODEL.md new file mode 100644 index 000000000..4c3b191bc --- /dev/null +++ b/docs/nips/NIP-FI-MODEL.md @@ -0,0 +1,5 @@ +# NIP-FI-MODEL: Formal Model (Non-Normative Companion) + +> SKELETON — owner: Wren. Demoted from normative ONLY after FI-INV-01..16 move +> into NIP-FI.md as normative text (ordering constraint per Dawn's flag). +> This document defines nothing normative; it illustrates and cross-checks. diff --git a/docs/nips/NIP-FI.md b/docs/nips/NIP-FI.md new file mode 100644 index 000000000..69f5e1552 --- /dev/null +++ b/docs/nips/NIP-FI.md @@ -0,0 +1,19 @@ +# NIP-FI: Federated Identity Authorization (Core) + +`draft` `optional` + +> SKELETON — text owner: Wren (core boundary + NIP idiom), integrating Max's +> cross-cutting sections (freshness classes, token typ rules, two contract +> identities). Source designs: RESEARCH/NIP_FI_9999_CORE_BOUNDARY_DESIGN.md, +> RESEARCH/NIP_FI_9999_SECURITY_SEMANTICS_DESIGN.md, PLANS/NIP_FI_9999_DESIGN.md. +> Target: ~350 normative lines. One normative source: FI-INV-01..16 live HERE. + +## Scope + +Issuer-qualified identity (iss, sub); independent Nostr proof; client-attached +assertion transport; partial bijection with durable tombstones; atomic final +admission; bounded leases; private denials with closed response vocabulary; +retire/revoke/rotate transitions; two contract identities +(assertion_policy_id, transport_contract_id); declared freshness class +(offline-jwt | current-status); server-declared body authorization relevance +(NIP-98 payload binding fix); BCP 14; "equivalent" defined; worked wire example.