mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
1c006822e4
Signed-off-by: npub12gtutshhh76rx0jx697f32f9tffd4hhp3hx58fp4x6u4uemkm7sqf8f757 <5217c5c2f7bfb4333e46d17c98a9255a52dadee18dcd43a43536b95e6776dfa0@sprout-oss.stage.blox.sqprod.co> Co-authored-by: npub12gtutshhh76rx0jx697f32f9tffd4hhp3hx58fp4x6u4uemkm7sqf8f757 <5217c5c2f7bfb4333e46d17c98a9255a52dadee18dcd43a43536b95e6776dfa0@sprout-oss.stage.blox.sqprod.co>
1.2 KiB
1.2 KiB
Stateful gateway safety model
The public gateway persists installation authority, encrypted APNs-token custody, relay delegations, replay reservations, and endpoint quotas in PostgreSQL. The relay separately owns lease matching, event authorization, coalescing, and durable delivery jobs.
The bounded executable model in nip-pl/delivery.py checks:
- delivery requires the NIP-98 signer sealed into the grant;
- installation, delegation, epoch, generation, and both expiries are live at admission;
- revocation/rotation and admission are ordered by one durable authority transaction;
- every admitted NIP-98 event id is burned, terminal request ids remain burned, and transient request ids are released only after disposition;
- quota is charged for every admitted attempt and never refunded;
- APNs-token custody failure cannot send;
- every actual send body is the byte constant registered by NIP-PL; and
- old-epoch grants cannot resurrect after endpoint rotation.
nip-pl/delivery_mutation.py weakens signer, epoch, terminal-burn, quota, and fixed-body checks and requires each mutant to be caught. The model does not claim exactly-once provider delivery, model PostgreSQL implementation details, or cover the not-yet-shipped relay matcher/worker.