The published contract named a `trusted-proxy-hmac-v1` profile that no
implementation accepts. This replaces it with `trusted-proxy-hmac-v2` as the
sole stock proxy transport, specified from the wire format: envelope layout,
length-prefixed MAC input, canonical encodings, discovery identifier, replay
namespace, and lease bounds, with negative vectors.
Denial handling is re-scoped. The no-mutation invariant now covers
authoritative authorization state only, and denial observability moves to a
separately bounded, non-authoritative channel carrying reason codes and
correlation identifiers under payload minimization. A denied admission
creates no authorization receipt, and a failed observation write never
blocks, retries, or latches the denial.
Runtime operations, deployment, and integration guidance is framed as future
contract rather than current behavior. Subject stability is stated as a
verifier trust assumption with its reassignment consequence, and the
key-snapshot rollback claim is narrowed to what the model enforces.
This is a documentation change. It adds no runtime parser, adapter, or
enforcement path. Session-path rechecks and the policy digest input set
remain relay-side follow-ups. The 24 trace and 16 invariant identifiers are
unchanged.
- CORPORATE_IDENTITY.md: document BUZZ_NIP_FI_V1_CONFIG_JSON (Off /
DenyProtected / Enforce), the complete runtime document with its field
bounds, JWKS refresh limits, the 120-second status renewal bound, the
removed legacy identity-provider variables that now fail startup, and
the delegation default and enablement rules
- .env.example: replace the placeholder identity section with the
commented document example and the legacy-variable removal note
- NIP_FI_DEPLOYMENT.md / NIP_FI_RUNTIME_OPERATIONS.md: document the
single configuration input consistently and map the install-without-
discovery step to the operating modes
- deploy READMEs: pgcrypto requirement for managed PostgreSQL, identity
configuration pass-through with secret-handling guidance, and
audit-capacity sizing guidance
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Cea Stapleton Cordasco <261786559+cea@users.noreply.github.com>
Cea Stapleton Cordasco