Cea Stapleton Cordasco
6636ce9f68
docs(nips): specify v2 proxy transport and bounded denial observation
...
The published contract named a `trusted-proxy-hmac-v1` profile that no
implementation accepts. This replaces it with `trusted-proxy-hmac-v2` as the
sole stock proxy transport, specified from the wire format: envelope layout,
length-prefixed MAC input, canonical encodings, discovery identifier, replay
namespace, and lease bounds, with negative vectors.
Denial handling is re-scoped. The no-mutation invariant now covers
authoritative authorization state only, and denial observability moves to a
separately bounded, non-authoritative channel carrying reason codes and
correlation identifiers under payload minimization. A denied admission
creates no authorization receipt, and a failed observation write never
blocks, retries, or latches the denial.
Runtime operations, deployment, and integration guidance is framed as future
contract rather than current behavior. Subject stability is stated as a
verifier trust assumption with its reassignment consequence, and the
key-snapshot rollback claim is narrowed to what the model enforces.
This is a documentation change. It adds no runtime parser, adapter, or
enforcement path. Session-path rechecks and the policy digest input set
remain relay-side follow-ups. The 24 trace and 16 invariant identifiers are
unchanged.
2026-08-12 13:11:31 -05:00
Cea Stapleton Cordasco and Claude Fable 5
aa1bf732a9
docs(nip-fi): document the runtime configuration contract
...
- CORPORATE_IDENTITY.md: document BUZZ_NIP_FI_V1_CONFIG_JSON (Off /
DenyProtected / Enforce), the complete runtime document with its field
bounds, JWKS refresh limits, the 120-second status renewal bound, the
removed legacy identity-provider variables that now fail startup, and
the delegation default and enablement rules
- .env.example: replace the placeholder identity section with the
commented document example and the legacy-variable removal note
- NIP_FI_DEPLOYMENT.md / NIP_FI_RUNTIME_OPERATIONS.md: document the
single configuration input consistently and map the install-without-
discovery step to the operating modes
- deploy READMEs: pgcrypto requirement for managed PostgreSQL, identity
configuration pass-through with secret-handling guidance, and
audit-capacity sizing guidance
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com >
Signed-off-by: Cea Stapleton Cordasco <261786559+cea@users.noreply.github.com >
2026-08-11 18:01:43 -05:00
Cea Stapleton Cordasco
f1fb5df936
docs(nip-fi): reconcile deployment entry points
...
Signed-off-by: Cea Stapleton Cordasco <261786559+cea-block@users.noreply.github.com >
2026-08-09 11:00:36 -05:00
c88799ac6c
feat(chart): per-pod emptyDir git scratch when persistence disabled (multi-replica HA) ( #1450 )
...
Signed-off-by: Tyler Longwell <tlongwell@block.xyz >
Co-authored-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@sprout-oss.stage.blox.sqprod.co >
Co-authored-by: Tyler Longwell <tlongwell@block.xyz >
2026-07-01 19:55:34 -04:00
e5aa4a2132
feat(git): move repo-name registry to Postgres + relax RWM chart gate (HA relay) ( #1432 )
...
Signed-off-by: Tyler Longwell <tlongwell@block.xyz >
Co-authored-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@sprout-oss.stage.blox.sqprod.co >
Co-authored-by: Tyler Longwell <tlongwell@block.xyz >
2026-07-01 14:50:18 -04:00
2561cbd069
release(helm): buzz chart 0.1.1 ( #1374 )
...
Signed-off-by: Tyler Longwell <tlongwell@block.xyz >
Co-authored-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@sprout-oss.stage.blox.sqprod.co >
Co-authored-by: Tyler Longwell <tlongwell@block.xyz >
2026-06-29 20:24:49 -04:00
2722ce4226
ci(helm): publish chart to GHCR on chart-v* tags ( #1372 )
...
Signed-off-by: Tyler Longwell <tlongwell@block.xyz >
Signed-off-by: npub12gtutshhh76rx0jx697f32f9tffd4hhp3hx58fp4x6u4uemkm7sqf8f757 <5217c5c2f7bfb4333e46d17c98a9255a52dadee18dcd43a43536b95e6776dfa0@sprout-oss.stage.blox.sqprod.co >
Co-authored-by: Tyler Longwell <tlongwell@block.xyz >
Co-authored-by: npub12gtutshhh76rx0jx697f32f9tffd4hhp3hx58fp4x6u4uemkm7sqf8f757 <5217c5c2f7bfb4333e46d17c98a9255a52dadee18dcd43a43536b95e6776dfa0@sprout-oss.stage.blox.sqprod.co >
2026-06-29 20:07:56 -04:00
dc612c9af6
feat(chart): render extraManifests and serviceMonitor ( #1348 )
...
Signed-off-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com >
Co-authored-by: Dawn (sprout agent) <c6237ef84fa537c78dcee78efd2d4e59f728859c7f194da42ac51ededfa0be05@sprout-oss.stage.blox.sqprod.co >
Co-authored-by: npub1qyvc0c5kl4gqv2fd97fsk46tu378sqgy35vc83rvgfwne90sel7s0ed67d <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@sprout-oss.stage.blox.sqprod.co >
2026-06-29 13:26:40 -04:00
+1
14fba21e57
Multi-tenant Buzz relay: community_id as a server-resolved key (comprehensive rewrite) ( #1321 )
...
Signed-off-by: tlongwell-block <109685178+tlongwell-block@users.noreply.github.com >
Signed-off-by: npub1jh9wn95s0472h86ahapupaf7m6kx4v9sx2n0atj2hltcfer8k06s5n3pyf <95cae996907d7cab9f5dbf43c0f53edeac6ab0b032a6feae4abfd784e467b3f5@sprout-oss.stage.blox.sqprod.co >
Signed-off-by: Tyler Longwell <tlongwell@block.xyz >
Signed-off-by: npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr <5a968df9a7494b4e019b9ecf739e088ba61097b4312124e9a88ae5b42e3f5f3e@sprout-oss.stage.blox.sqprod.co >
Signed-off-by: npub17jjz49l9jjmhhk7cac63j8yt9z555n9cw8vk7v5jz4vzw4ppld5qgj57cc <f4a42a97e594b77bdbd8ee35191c8b28a94a4cb871d96f32921558275421fb68@sprout-oss.stage.blox.sqprod.co >
Co-authored-by: Eva <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@sprout-oss.stage.blox.sqprod.co >
Co-authored-by: Mari <95cae996907d7cab9f5dbf43c0f53edeac6ab0b032a6feae4abfd784e467b3f5@sprout-oss.stage.blox.sqprod.co >
Co-authored-by: Sami <f4a42a97e594b77bdbd8ee35191c8b28a94a4cb871d96f32921558275421fb68@sprout-oss.stage.blox.sqprod.co >
Co-authored-by: Max <d8473ee32b973aa31a21a65adddcc4b69cc2a8a4dee8121ecd51926e0cddbc02@sprout-oss.stage.blox.sqprod.co >
Co-authored-by: Quinn <96f056ad5f2305c8ddf637dc65d048aa4c12d7daeb8867690e34fca46b0ef64c@sprout-oss.stage.blox.sqprod.co >
Co-authored-by: Dawn <c6237ef84fa537c78dcee78efd2d4e59f728859c7f194da42ac51ededfa0be05@sprout-oss.stage.blox.sqprod.co >
Co-authored-by: Tyler Longwell <tlongwell@block.xyz >
Co-authored-by: Sami <sami@sprout-oss.stage.blox.sqprod.co >
Co-authored-by: npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr <5a968df9a7494b4e019b9ecf739e088ba61097b4312124e9a88ae5b42e3f5f3e@sprout-oss.stage.blox.sqprod.co >
2026-06-29 12:39:02 -04:00
0cee0435f7
feat(relay): add buzz-admin member management CLI with NIP-43 roster publish ( #1265 )
...
Signed-off-by: Will Pfleger <pfleger.will@gmail.com >
Co-authored-by: npub1mn7jgtj4w2pd0g0zeuhxsa6jy6p0rewxz4kujt98my82ahfmp72sxjexk7 <dcfd242e557282d7a1e2cf2e6877522682f1e5c6156dc92ca7d90eaedd3b0f95@sprout-oss.stage.blox.sqprod.co >
2026-06-24 23:13:31 -04:00
thomaspblock and GitHub
6ad68a6b09
fix(desktop): align settings section headers ( #1165 )
...
Signed-off-by: Thomas Petersen <thomasp@squareup.com >
2026-06-23 15:32:38 -07:00
629fb57bf0
feat(deploy): add production Helm chart for Buzz ( #990 )
...
Signed-off-by: Tyler Longwell <tlongwell@squareup.com >
Co-authored-by: npub1jmc9dt2lyvzu3h0kxlwxt5zg4fxp9476awyxw6gwxn72g6cw7exqs64whm <96f056ad5f2305c8ddf637dc65d048aa4c12d7daeb8867690e34fca46b0ef64c@sprout-oss.stage.blox.sqprod.co >
Co-authored-by: Eva <011987e296fd5006292d2f930b574be47c7801048d1983c46c425d3c95f0cffd@sprout-oss.stage.blox.sqprod.co >
2026-06-17 21:26:33 -04:00
2300248d3b
Add automatic database migrations ( #988 )
...
Signed-off-by: npub1mprnacetjua2xx3p5eddmhxyk6wv929ymm5py8kd2xfxurxahspqqlgyta <d8473ee32b973aa31a21a65adddcc4b69cc2a8a4dee8121ecd51926e0cddbc02@sprout-oss.stage.blox.sqprod.co >
Signed-off-by: npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr <5a968df9a7494b4e019b9ecf739e088ba61097b4312124e9a88ae5b42e3f5f3e@sprout-oss.stage.blox.sqprod.co >
Co-authored-by: npub1mprnacetjua2xx3p5eddmhxyk6wv929ymm5py8kd2xfxurxahspqqlgyta <d8473ee32b973aa31a21a65adddcc4b69cc2a8a4dee8121ecd51926e0cddbc02@sprout-oss.stage.blox.sqprod.co >
Co-authored-by: npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr <5a968df9a7494b4e019b9ecf739e088ba61097b4312124e9a88ae5b42e3f5f3e@sprout-oss.stage.blox.sqprod.co >
2026-06-16 08:39:19 -04:00
6caa359d70
Add production Docker Compose bundle ( #985 )
...
Signed-off-by: npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr <5a968df9a7494b4e019b9ecf739e088ba61097b4312124e9a88ae5b42e3f5f3e@sprout-oss.stage.blox.sqprod.co >
Signed-off-by: npub1mprnacetjua2xx3p5eddmhxyk6wv929ymm5py8kd2xfxurxahspqqlgyta <d8473ee32b973aa31a21a65adddcc4b69cc2a8a4dee8121ecd51926e0cddbc02@sprout-oss.stage.blox.sqprod.co >
Co-authored-by: npub1t2tgm7d8f995uqvmnm8h88sg3wnpp9a5xysjf6dg3tjmgt3ltulqdp8ehr <5a968df9a7494b4e019b9ecf739e088ba61097b4312124e9a88ae5b42e3f5f3e@sprout-oss.stage.blox.sqprod.co >
Co-authored-by: npub1mprnacetjua2xx3p5eddmhxyk6wv929ymm5py8kd2xfxurxahspqqlgyta <d8473ee32b973aa31a21a65adddcc4b69cc2a8a4dee8121ecd51926e0cddbc02@sprout-oss.stage.blox.sqprod.co >
2026-06-13 13:28:25 -04:00
Cea Stapleton Cordasco