mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
Normative spec for authorizing a NIP-42/NIP-98-proven Nostr key only when a valid OIDC/JWT assertion resolves to the same active identity-to-key binding. Covers assertion transport (trusted-proxy and client-attached profiles), validation, per-domain binding bijection, enrollment modes (attested-key/provisioned/tofu), lease/session bounds, revocation and rotation, delegation composition, rejection semantics, discovery, and privacy. Companion formal model to follow on this branch. Generalizes the semantics implemented in #1476 into a provider-neutral standard per buzz-security thread 0d1aee9e. Co-authored-by: Tyler Longwell <tlongwell@block.xyz> Signed-off-by: Tyler Longwell <tlongwell@block.xyz>