mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
Cea Stapleton Cordasco
6636ce9f68
The published contract named a `trusted-proxy-hmac-v1` profile that no implementation accepts. This replaces it with `trusted-proxy-hmac-v2` as the sole stock proxy transport, specified from the wire format: envelope layout, length-prefixed MAC input, canonical encodings, discovery identifier, replay namespace, and lease bounds, with negative vectors. Denial handling is re-scoped. The no-mutation invariant now covers authoritative authorization state only, and denial observability moves to a separately bounded, non-authoritative channel carrying reason codes and correlation identifiers under payload minimization. A denied admission creates no authorization receipt, and a failed observation write never blocks, retries, or latches the denial. Runtime operations, deployment, and integration guidance is framed as future contract rather than current behavior. Subject stability is stated as a verifier trust assumption with its reassignment consequence, and the key-snapshot rollback claim is narrowed to what the model enforces. This is a documentation change. It adds no runtime parser, adapter, or enforcement path. Session-path rechecks and the policy digest input set remain relay-side follow-ups. The 24 trace and 16 invariant identifiers are unchanged.