docs(nips): complete NIP-FI authorization draft

.env.example

@@ -51,6 +51,17 @@ RELAY_URL=ws://localhost:3000
 # (use `just web` for Vite HMR instead).
 # BUZZ_WEB_DIR=./web/dist
 
+# -----------------------------------------------------------------------------
+# Federated identity (NIP-FI)
+# -----------------------------------------------------------------------------
+# This documentation stack defines the future NIP-FI contract but does not add
+# or activate its runtime parser. Do not infer support for
+# BUZZ_NIP_FI_V1_CONFIG_JSON or any operating mode from this example file.
+# The proposed document shape and activation gates are recorded in
+# docs/CORPORATE_IDENTITY.md and docs/NIP_FI_DEPLOYMENT.md for the later
+# implementation stack. NIP-FI discovery and enforcement remain off until
+# that exact implementation and deployment pass the complete evidence matrix.
+
 # -----------------------------------------------------------------------------
 # Git (NIP-34 bare repositories)
 # -----------------------------------------------------------------------------

README.md

@@ -187,6 +187,7 @@ A Rust workspace of focused crates. Single source of truth: the relay. See [ARCH
 
 - **[VISION.md](VISION.md)** · **[VISION_SOVEREIGN.md](VISION_SOVEREIGN.md)** · **[VISION_PROJECTS.md](VISION_PROJECTS.md)** · **[VISION_AGENT.md](VISION_AGENT.md)** — the four vision docs
 - **[ARCHITECTURE.md](ARCHITECTURE.md)** — system design, kind ranges, subsystem boundaries
+- **[NIP-FI](docs/nips/NIP-FI.md)** · **[integration](docs/NIP_FI_INTEGRATION.md)** · **[threat model](docs/NIP_FI_THREAT_MODEL.md)** · **[deployment](docs/NIP_FI_DEPLOYMENT.md)** · **[operations](docs/NIP_FI_RUNTIME_OPERATIONS.md)** — federated-identity contract and public guidance; this documentation revision does not include or activate a runtime adapter
 - **[TESTING.md](TESTING.md)** — multi-agent E2E test suite
 - **[CONTRIBUTING.md](CONTRIBUTING.md)** · **[CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md)** · **[SECURITY.md](SECURITY.md)** · **[GOVERNANCE.md](GOVERNANCE.md)**
 

SECURITY.md

@@ -53,17 +53,36 @@ REST endpoints authenticate via
 the client signs a `kind:27235` event containing the request URL and method.
 The relay verifies the Schnorr signature and extracts the pubkey.
 
-### Authorization — Channel Membership as the Gate
+### Authorization and admission
 
-Channel membership is the **only** access control mechanism. There are no
-separate ACL lists or capability taxonomies. If a principal (human or agent)
-is a member of a channel, they can read and write to it. If they are not a
-member, the relay rejects their requests — even if they are authenticated.
+In the current merged runtime, channel membership is Buzz's only
+application-level access-control mechanism. If a principal (human or agent)
+is a member of a channel, application policy may allow them to read and write
+it. If they are not a member, the relay rejects their requests even if they
+are authenticated.
 
 Private channels are invisible to non-members: they do not appear in channel
 listings, and subscription filters for private channel events return nothing
 unless the subscriber is a member.
 
+[NIP-FI](docs/nips/NIP-FI.md) defines a future optional additional admission
+authority that combines provider-neutral issuer assertions with fresh Nostr
+key proof, current durable binding and lifecycle state, and final application
+admission. When enabled for a domain, one current NIP-FI authority covers every
+protected ingress atomically, and both NIP-FI and application authorization
+must allow each operation. NIP-FI does not replace NIP-42, NIP-98, Nostr
+signatures, channel membership, or resource policy.
+
+That NIP-FI behavior is not shipped in the current merged runtime. This
+documentation revision does not include or activate a NIP-FI runtime adapter.
+A later exact-head implementation and deployment must pass the
+[behavioral evidence matrix](docs/nips/NIP-FI-CONFORMANCE.md) before publishing
+discovery or enforcing the contract. Source scans, prose, and configuration
+presence do not establish conformance. See the [threat
+model](docs/NIP_FI_THREAT_MODEL.md), [stock
+deployment](docs/NIP_FI_DEPLOYMENT.md), and [runtime
+operations](docs/NIP_FI_RUNTIME_OPERATIONS.md).
+
 ### Append-Only Audit Log
 
 All events are written to a tamper-evident audit log (`buzz-audit`). Each

deploy/charts/buzz/README.md

@@ -78,6 +78,22 @@ Save these. Losing any of them is data loss. See NOTES.txt printed by `helm inst
 4. Git PVC — repo on-disk state served by the relay's git endpoint.
 5. Owner private key — held by the operator, not by this chart. Restore by re-installing with the same `ownerPubkey`.
 
+## NIP-FI readiness
+
+This chart does not provision a NIP-FI runtime, trusted-edge topology, issuer
+integration, secret keys, or conformance runner. It makes no claim that the
+proposed `BUZZ_NIP_FI_V1_CONFIG_JSON` document is parsed or enforced. Do not
+advertise or enforce NIP-FI from this chart, and do not use an ingress identity
+header or provider-specific sidecar as a fallback authority.
+
+An activating deployment must pin an exact image, keep policy separate from
+secret values, isolate verifier ingress for `trusted-proxy-hmac-v2`, include
+every fail-closed dependency in readiness, and link an immutable exact-head
+behavioral report. A rendered chart and healthy pod do not prove those
+behaviors. See the
+[provider-neutral deployment guide](../../../docs/NIP_FI_DEPLOYMENT.md) and
+[runtime operations guide](../../../docs/NIP_FI_RUNTIME_OPERATIONS.md).
+
 ## Honest limitations (v1)
 
 - **Bundled MinIO is eval-only.** The quickstart profile runs an in-cluster

deploy/compose/README.md

@@ -36,11 +36,30 @@ keypair.
   `buzz-admin migrate` before starting the relay when bootstrapping a fresh
   database. Auto-migration requires an image that includes embedded SQLx
   migrations.
+- The proposed NIP-FI configuration contract is future-facing; this bundle
+  does not imply that the current relay parses or enforces it. See the
+  [identity configuration contract](../../docs/CORPORATE_IDENTITY.md).
 - The stack uses Postgres, Redis, MinIO, and a git data volume because
   those are real Buzz dependencies today. Minimal mode can simplify this later.
 
 Run `./run.sh backup-hint` for the backup checklist.
 
+## NIP-FI readiness
+
+This Compose bundle does not provision a NIP-FI runtime, trusted edge, issuer
+integration, or conformance runner. It makes no claim that the proposed
+`BUZZ_NIP_FI_V1_CONFIG_JSON` document is parsed or enforced. Do not advertise
+or enforce NIP-FI from this bundle, and do not add a provider-specific sidecar
+or unsigned corporate identity header as a substitute.
+
+An activating deployment must pin an exact image, isolate verifier ingress
+when `trusted-proxy-hmac-v2` is enabled, deliver HMAC secrets through a
+secret store rather than `.env`, and pass the complete exact-head behavioral
+matrix before activation. A valid Compose render or healthy relay does not
+close those gates. See the
+[provider-neutral deployment guide](../../docs/NIP_FI_DEPLOYMENT.md) and
+[runtime operations guide](../../docs/NIP_FI_RUNTIME_OPERATIONS.md).
+
 ## Validation
 
 Before sharing an install link publicly, verify a fresh install with: