feat(nip-fi): admin disconnect/deny API with in-memory deny-until-TTL map (S4)

[wpfleger96]

Implements S4 of the buzz-enterprise-identity program: the NIP-FI admin disconnect API with deny-until-TTL semantics.

Merge order: This branch carries a pre-#7224 S3 snapshot (merge-base 88687876f) and merges after #7224; base reconciliation follows.

What this adds

buzz-auth

crates/buzz-auth/src/nip_fi/deny_map.rs — NipFiDenyMap

In-memory deny set, no persistence (Option B, relay restart amnesia is accepted and documented as issuer-re-push).

• Per-issuer DashMap shards — cross-issuer capacity starvation is impossible
• Merge rule: max(existing_until, incoming_until) on same-key collision — a delayed shorter-until command never shortens an active deny [FI-TRACE-DENY-SET]
• Past-until commands: never create or shorten entries; atomically calls the session-close path but skips the deny-entry write [FI-TRACE-DENY-SET]
• Per-issuer hard capacity cap, fail-closed (DenySetFull) — spec requires 503 and the jti is not consumed on full [VerifyCommandJwt step 7]
• Self-evicting TTL (lazy eviction on read and write)
• Atomic jti reservation + deny-entry insertion in one shard lock (both-or-neither) [VerifyCommandJwt step 7]
• is_denied(issuer, pubkey, now) — the clean interface S5 (HTTP enforcement) consumes

crates/buzz-auth/src/nip_fi/command.rs — CommandVerifier<S>

Verifies typ=nip-fi-command+jwt tokens against the same issuer JWKS as assertions.

• Validates method, path, target_pubkey, aud, iat, exp, jti, and body hash claims
• CommandIssuerPolicy carries maximum_command_age_seconds (normative ≤ 60), authorized_principals (sub allowlist), and per-issuer deny_set_capacity
• jti reserved at the final admission step — after authz check + body-match — closing the DoS seam where early reservation would let a crafted rejected command consume jti slots [VerifyCommandJwt step 7]
• Reuses the same parsing/validation primitives as the assertion verifier via pub(super) helper promotion — no crypto duplication

buzz-relay

crates/buzz-relay/src/api/nip_fi.rs — POST /api/nip-fi/disconnect

• Extracts command JWT from Nostr-Federated-Identity: Bearer <token> header
• Validates JSON body pubkey (lowercase hex, exactly 32 bytes)
• Delegates to CommandVerifier::verify — jti + deny entry written atomically on success
• Closes all live sessions for the target pubkey via ConnectionManager::disconnect_nip_fi
• Response contract: 200 {"disconnected": true} on success; 400/401/403/503 per the spec rejection table
• Endpoint is not a protected HTTP surface — no NIP-98, no NIP-FI assertion; auth is entirely inside CommandVerifier::verify
• Cross-pod propagation failures increment buzz_nip_fi_disconnect_propagation_failures_total (no iss/pubkey in labels [FI-TRACE-PRIVACY-NONPUBLIC])
• build_nip_fi_command_components — startup builder callable from main.rs

crates/buzz-relay/src/state.rs

• ConnectionManager::disconnect_nip_fi — issuer-global (unfenced) cross-community session close, sends NOTICE before cancel; sets AuthorizationDenied via first-writer-wins publish_disconnect_reason (writes only when slot is None) so the send loop's cancel branch emits a 1008 POLICY close frame with reason "authorization denied" [spec: deny applies across all communities under the issuer]
• CommunityConnectionControl::publish_disconnect_reason — atomic first-writer-wins helper; all writers (disconnect_community, disconnect_nip_fi, the expiry task, key-pairing) route through it to prevent concurrent CommunityDeleted / AuthorizationDenied causes from misattributing the close frame
• AppState::nip_fi_deny_map and nip_fi_command_verifier fields — None-initialized; endpoint returns 503 until startup wires them in

crates/buzz-relay/src/router.rs + src/api/mod.rs

• Route wired: POST /api/nip-fi/disconnect sits outside all NIP-98 middleware layers

crates/buzz-relay/src/handlers/auth.rs + audio/handler.rs

• is_denied checked at WS admission after pubkey registration (spec steps 5+6 ordering): root WS (handlers/auth.rs:346), audio (audio/handler.rs:349), and the pre-upgrade early-bounce path — authorization_denied frame + explicit 1008 POLICY close frame + close on match; NIP-FI expiry sends the same policy close on all paths including the audio pre-send-loop window (check_cancel!() arms and JoinCommitError::Expired exit)

crates/buzz-relay/src/main.rs

• install_nip_fi_command_components wired at startup (main.rs:543) with shared-Arc JWKS source

Test coverage

20 new tests in nip_fi::deny_map and 26 new tests in nip_fi::command:

• Both command delivery orders → max(until) [FI-TRACE-DENY-SET oracle]
• Merge rule both directions
• Past-until commands: absent entry inserts expired; active entry left unchanged
• Capacity exhaustion: fail-closed, nothing inserted, jti not consumed
• jti replay rejection
• Cross-issuer capacity isolation
• CommandIssuerPolicy construction validation (zero age, >60 age, empty principals, zero capacity, empty issuer)

22 unit tests in api::nip_fi: header extraction contract (401/403), pubkey parsing (uppercase rejected, wrong length). 4 additional ConnectionManager/CommunityConnectionControl tests: conn_manager_disconnect_nip_fi_sets_authorization_denied_reason, conn_manager_disconnect_nip_fi_ignores_unproven_connection, community_disconnect_then_nip_fi_keeps_community_deleted_reason (first-writer-wins: CommunityDeleted not clobbered), and nip_fi_disconnect_then_community_keeps_authorization_denied_reason (first-writer-wins: AuthorizationDenied not clobbered). W_FIX1: pre-send-loop drain emits restricted JSON then 1008 POLICY close.

All spec oracle cases are falsifiable: a mutation that violates the merge rule, the past-until invariant, or the capacity semantics will break the corresponding test.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Changes requested

Reviewed head 2a42ddff049aaaf4bcfdf994680c0b1b4e2785d7 against base ac5a18697c8294e9237f505a2e01ec6fc374849a, source-only. No PR code was checked out, built, tested, or executed.

The review preserves the accepted RAM-only/restart-amnesia design. Startup wiring, WS admission deny checks, and S5 HTTP enforcement are explicitly deferred, not blockers by themselves. The issues below are in the delivered callable components; main.rs currently leaves the endpoint unconfigured.

P2: Close existing huddle sockets as well as Nostr sockets

Handler close call / new close scan.

The success path scans only ConnectionManager. Huddle audio sockets instead register with community_connections, have their own cancellation token, and prove their key through a separate NIP-42 handshake (audio handler, proof). They never enter this scan.

With a configured verifier, a target already connected to chat and a huddle receives a successful disconnect, loses the chat socket, but retains the independently authenticated audio socket and its audio access. NIP-FI's delivered disconnect contract closes all live WebSockets whose proven key matches (spec). This is not the deferred new-admission check. Include every existing key-proven socket type in targeted cancellation, and cover a target with simultaneous Nostr/audio sockets plus an unaffected other key.

P2: Preserve fractional NumericDate deadlines

command.rs:448–466.

The new parser floors every fractional NumericDate and reconstructs it with zero nanoseconds. For an otherwise valid signed command with until = T + 0.9, the stored deadline becomes T, so the deny map reports the key allowed at T + 0.1, before the issuer's signed deadline. Flooring iat can also admit evidence beyond the allowed future-skew boundary. The existing assertion parser already preserves nanoseconds (verifier.rs:916–952). Reuse that semantics and add signed-command tests through verify_at, asserting denial just before fractional until and expiry at equality, plus future-iat and ceiling boundaries.

P2: Keep issuer identities out of logs

api/nip_fi.rs:144–149 and configuration warnings.

A successful close emits the exact signed iss as caller_iss when debug logging is enabled; invalid configuration emits the issuer URI at warning level. This exports deployment-private identity coordinates to logs, contrary to the explicit NIP-FI privacy contract. Remove the issuer fields, retain fixed reason/count diagnostics, and bind a privacy regression to the actual success/configuration logging paths.

P2: Bound the replay map independently of deny-entry capacity

deny_map.rs:98–126.

Even with issuer deny capacity 1, repeated valid commands updating one active key bypass the entry-capacity guard and retain a new jti string each time. Every mutation then scans that growing replay map under the shard lock. There is no replay-count/byte budget or command rate bound in this path. A buggy or abusive authorized issuer can exceed its intended memory budget and increase lock-held work; this is not an anonymous attack or a measured outage. Large JTIs are bounded only by the total 64-KiB token limit, and accepted clock skew can extend retention to 360 seconds.

Add an explicit per-issuer replay-resource bound checked in the same atomic admission step. Exhaustion must leave both the new deny mutation and JTI reservation unapplied, without evicting unexpired replay identities. Test repeated same-key updates at the budget, concurrent reservations, and reuse of a rejected still-valid JTI after capacity frees.

Validation and smaller compatibility note

The changed tests exercise policy constructors, error helpers, header/pubkey parsing, and sequential deny-map operations. They do not exercise the new command verification or disconnect handler end to end; the referenced command/tests.rs is absent from the complete pinned head tree. The regression cases above need the production seams, not copies of predicates or response constants.

Non-blocking: missing-header 401 is missing WWW-Authenticate: Nostr required by the rejection table; plain_response only adds Content-Type. Existing DenialClass already provides the challenge value.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Changes requested

Reviewed head f03efb3f472600ba9ab2061a5136d22277a9fbe3 against base ac5a18697c8294e9237f505a2e01ec6fc374849a, source-only. No checkout, build, tests, imports, or PR-code execution. All three independent review lanes returned; findings below were independently reconciled against the source.

The original audio-scan omission, fractional NumericDate parser, explicit issuer-log sites, and unbounded replay-map implementation are corrected. The current source also delivers startup and cross-pod wiring despite the stale PR description. Three defects remain in that delivered integration.

P2: Do not turn remote capacity pressure into permanent issuer-wide denial

deny_map.rs:277–290,341–367, called by main.rs:1215–1258.

Source-derived witness: configure two maps/pods with issuer capacity 1. Before propagation, each accepts a command for a different key. Deliver the remote messages: each new-key merge hits capacity and inserts the issuer into blocked_issuers. Every subsequent is_denied call for that issuer returns true, including unrelated keys and times after both signed TTLs have expired. No expiry or recovery clears this flag; restart is required. A delayed, already-expired remote command against a full shard takes the same path.

This breaks the delivered shared deny interface’s targeted, self-expiring contract. It is not a claim of an already-wired admission outage: WS/S5 admission consumers remain deferred. The spec explicitly permits asynchronous propagation loss with issuer re-push; it does not require permanent denial of unrelated users. Remove the sticky issuer-wide transition on ordinary capacity exhaustion, retain existing live entries and observable recovery, and preserve target session closure for past-until delivery without creating future denial. Do not add persistence. Replace the test that codifies deny-all (deny_map.rs:831–879) with the two-map/capacity, unrelated-key, and post-TTL cases. Poisoned-lock handling is separate from normal capacity pressure.

P2: Sanitize configuration parse errors before they enter logs

nip_fi_config.rs:159–162 forwards the raw serde error into ConfigError; main.rs:163–165 logs that error.

An otherwise complete issuer entry containing "authorized_principals": "admin@private.example" instead of an array produces a type-error diagnostic containing the supplied principal string. This happens before the new index-only policy validation. Startup fails closed, but private principal/email data is exported to logs, violating NIP-FI’s explicit privacy contract. Keep a fixed error category and safe location information rather than {e}. Add a malformed-sensitive-value regression through the actual configuration/error-reporting path. The old explicit issuer log sites are fixed; this is a newly introduced path.

P2: Isolate the new route fixtures from process-environment mutation

api/nip_fi.rs:634–640 and the absent-verifier fixture at line 742 call Config::from_env().expect(...). That now reads NIP-FI environment configuration. In the same test binary, nip_fi_config.rs:399–462 sets the mode to permissive, or to enforce without issuers, under a mutex private to that module.

If a route fixture reads during either interval, configuration returns an error and the fixture panics before reaching the route under test. The private mutex does not protect those readers. Construct fixture configuration without process-env reads, or coordinate every relevant reader/writer using shared synchronization. Do not rely on serial execution of this test module. This is a source-derived parallel-test failure, not a claimed local reproduction.

Regression coverage and stable exit criteria

Keep the real signed-verifier and real-router tests; they are a substantial improvement. Finish the already-requested corrective witnesses: signed verify_at fractional until just-before/equality, future-iat and ceiling boundaries; an actual audio-handler registration plus target chat/audio and unaffected-peer disconnect; and privacy-path capture. Existing registry tests manually populate the key, so removing audio/handler.rs:252 survives them. Integer-only command fixtures do not catch reintroducing timestamp flooring. The “production assembly” test calls only the component builder; its comment at api/nip_fi.rs:990–995 incorrectly claims deleting main’s state assignments makes it fail. Correct that claim or bind the actual assembly seam. These are source-inspected coverage limits, not test-run results.

Exit criteria are the three bounded defects above and regression witnesses for the corrective paths. Preserve RAM-only/restart amnesia, asynchronous propagation/re-push, and the separately deferred WS admission/S5 HTTP work. No broader session-lifecycle rewrite, distributed completion guarantee, or persistence requirement is added. The missing-header WWW-Authenticate: Nostr note is also resolved.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Changes requested

Reviewed head b6f5ba30de70c06f581fc9201c090726210d9679 against base ac5a18697c8294e9237f505a2e01ec6fc374849a, focused on the two corrective commits since f03efb3f472600ba9ab2061a5136d22277a9fbe3 and the prior exit criteria. Source/metadata review only: no checkout, build, tests, imports, or execution of PR code.

The same three P2 findings remain. Moving the blocked flag under the shard mutex improves serialization, but preserves the incorrect permanent issuer-wide denial. The new publisher/consumer and startup seams improve testability; they do not close the policy/privacy/fixture findings below.

1. P2: Ordinary remote capacity exhaustion still permanently denies unrelated keys

deny_map.rs:401–409, is_denied:316–327, consumer:317–343

Source-derived witness: two pods each have issuer capacity 1 and independently accept different target keys before propagation. Deliver the remote entries: the new-key capacity miss sets IssuerShard.blocked = true. is_denied_or_blocked returns that bit for every key (deny_map.rs:115–119), and TTL eviction never clears it (101–105). Both unrelated keys and the missed target remain denied even after all signed until values expire. A delayed, already-expired remote entry against a full shard causes the same transition.

This is the same targeted/self-expiring shared-interface defect as before, not a claimed live outage in the deferred WS/S5 admission consumers. The contract permits asynchronous loss and issuer re-push; it does not authorize permanent denial of unrelated users. Holding the flag under a mutex makes the wrong state transition atomic, not correct.

On ordinary CapacityExceeded, retain existing live entries, return the capacity outcome, close only the delivered target’s sessions through the consumer, and leave recovery to the accepted re-push policy. Remove the sticky issuer-wide transition; poisoned-lock handling can remain separately fail-closed. Replace the tests that require unrelated-key denial (deny_map.rs:889–938,1099–1141; api/nip_fi.rs:1241–1354) with two-map capacity, unrelated-key, and post-TTL cases. No persistence or distributed completion guarantee is requested.

2. P2: Configuration parsing still exports private principal values to startup logs

nip_fi_config.rs:159–162, main.rs:163–165

An otherwise complete issuer entry with "authorized_principals": "admin@private.example" instead of an array still produces a serde type error containing the supplied string. The parser interpolates that raw error into ConfigError; startup logs it verbatim. This happens before the new index-only missing-command-field validation. Startup rejects the configuration, but leaks the principal/email in doing so, contrary to the explicit privacy contract.

Keep a fixed error category and safe location information instead of raw {e}. Add a malformed-sensitive-value regression through the actual configuration/error-reporting path. The new missing-command-fields test does not cover this failure mode.

3. P2: Existing and new route fixtures still race process-environment writers

api/nip_fi.rs:895–902, new consumer fixture:1261, nip_fi_config.rs:459–477

The route fixtures still call Config::from_env().expect(...); the corrective commits add more copies at api/nip_fi.rs:1261,1378,1513 alongside 899,1003. That loader reads NIP-FI config (config.rs:1266). In the same test binary, NIP-FI tests set BUZZ_NIP_FI_MODE=permissive, or Enforce with issuers absent, under a mutex private to that module (nip_fi_config.rs:413). The route readers do not take it. A concurrent read returns a configuration error and panics before the intended route/consumer/startup assertion.

Construct fixture configuration without process-environment reads, or coordinate all relevant readers/writers with shared synchronization. Overriding DB/Redis fields after loading does not fix the fallible ambient read. This is a source-derived parallel-test failure, not a claimed local reproduction.

Corrective coverage and scope

The new fractional_deadline_survives_publisher_wire_and_consumer_equality_boundary test (api/nip_fi.rs:1371–1490) exercises the real publisher mapping, encode/decode, apply helper and map equality comparison. Credit that wire-path regression. It starts from a synthetic CommandResult, so it does not close the previously requested signed fractional-NumericDate verify_at boundary witness. Integer future-iat and until ceiling cases already exist; the remaining gap is fractional parsing and boundary preservation on the signed path. command.rs is unchanged from the previous reviewed head.

The replacement installer test (api/nip_fi.rs:1508–1613) now invokes the production helper that owns both AppState assignments and verifies that command verification writes to the same map. The former builder-only assembly criticism is resolved. It seeds the key snapshot and checks the warmup result; the final shutdown store is not an observed refresh-task exit, so do not claim that lifecycle was tested.

The actual audio-handler registration plus targeted chat/audio and unaffected-peer witness remains uncovered in the inspected tests. The registry tests manually set the proven key (state.rs:2650–2742), so they bypass the production registration at audio/handler.rs:250–252; the new consumer tests assert map state without live sessions on both transports. Finish the previously requested registration-to-dual-transport-close witness. This is a carried-forward coverage gap, not a new production regression. All three independent lanes have returned and been reconciled. No runtime or mutation-test results are claimed here.

Stable exit criteria remain these three bounded defects and the previously requested corrective witnesses. Preserve RAM-only restart amnesia, asynchronous propagation/issuer re-push, and separately deferred WS admission/S5 HTTP. No broad session-lifecycle rewrite or additional persistence requirement is added. Existing HTTP status/body classes, pubkey-targeted close behavior, and command/JWKS verification contracts were traced through the changed wiring; unchanged cryptographic internals were not reopened as a fresh audit.

addressed

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Changes requested

Reviewed head 26099bc63bb15934ce08296964112db6bd55def1 against base 2ac0aa1dd18c0b9d4fa722658c4692b0c79a496f, following the prior corrective exit criteria and the newly added session/admission code. Source-only: no PR checkout, build, tests, imports, runtime reproduction, or mutation execution. All three independent lanes returned; the findings below were independently checked against the pinned source.

The sticky issuer-wide capacity denial and sensitive configuration-error leak are fixed. The signed fractional verify_at witness is now present. The remaining issues are one carried fixture failure and defects in the expanded session/lifecycle integration. RAM-only restart amnesia, asynchronous propagation/issuer re-push, and separately deferred S5 HTTP enforcement remain accepted scope, not blockers. Off-mode huddle lifecycle compatibility must remain intact.

1. P1: Include observer EVENT publication in the session admission gate

handlers/event.rs:682–693, publication:1116–1136.

Kind 24200 returns through handle_agent_observer_event before either new EVENT permit. Its helper awaits signature verification and possibly an owner lookup, then publishes to Redis and local subscribers without acquiring a permit. Source-derived witness: submit a valid owner-to-agent observer control frame, hold validation/owner lookup, expire or admin-disconnect the publisher, then resume validation. The detached task still delivers the control frame to a live agent after the publisher's session authority has ended. Dispatch's earlier cancellation check cannot fence an already-spawned handler; recipient access checks do not validate the publisher's session.

Acquire the existing effect permit after validation and before observer publication, holding it through fan-out. Add a barrier witness proving expiry/disconnect before acquisition prevents delivery to the live recipient. This preserves the accepted rule that an effect which already acquired a permit may finish; this branch currently acquires none.

2. P2: Route every root denial producer through the reserved, serialized terminal transition

state.rs:623–642, handlers/auth.rs:365–380, nip_fi_session.rs:108–126.

The dedicated capacity-1 terminal queue and transition lock are not wired to all root producers. Admin disconnect and post-registration deny still try_send on ordinary capacity-8 ctrl_tx; a full queue drops the required NOTICE, then cancellation produces only the policy close. Pairing uses the reserved queue but writes the raw reason sender outside the transition lock and ignores whether it won. The post-registration deny does the same outside-lock reason write.

A second source-derived schedule: pairing wins AuthorizationDenied, pauses before enqueue, and concurrent community deletion acquires its separate transition lock and cancels. The send loop can drain an empty terminal queue and close before pairing queues the NOTICE. Conversely, if CommunityDeleted wins, pairing still queues an authorization-denied payload, which can be emitted alongside the community-deleted close reason. The new expiry/audio serialization does not cover these callers.

Pass the shared terminal control and reserved root sender to these paths; serialize winning reason plus cause-specific enqueue, and enqueue only for the winner before cancellation. Cover root admin/post-auth denial with saturated ordinary control traffic and pairing/post-auth versus community-delete in both orders. No new queue abstraction is needed beyond consistently using the one introduced here.

3. P2: Preserve generation on the transaction-owned huddle JOIN event

audio/handler.rs:2258–2262, base JOIN:707–718.

The new kind-48101 builder drops generation, although the handler still computes lifecycle_generation and includes it in LEFT/ENDED. This affects NIP-FI Off as well as Enforce. An already-hydrated desktop observer receiving a new START/JOIN assigns that room the fallback "pending" generation (consumer:264–272). At the next authoritative liveness refresh, the real generation differs, so reconcileLiveness:469–480 clears participant admissions. In-huddle indicators disappear while audio remains connected; polling does not emit another JOIN.

Pass the existing lifecycle generation into commit_participant_join and preserve it in persisted/fanned-out JOIN content. Test the production event and JOIN-to-liveness consumer sequence, including Off mode.

4. P2: Do not cancel the audio deadline producer before it publishes the denial

audio/handler.rs:918–938, commit rejection:1220–1246, nip_fi_session.rs:211–238.

acquire_effect can detect an elapsed wall-clock deadline before the spawned expiry task runs. The add-peer and commit rejection paths then cancel the token before awaiting that task. Its unbiased select may choose the now-ready cancellation arm and return without calling expiry_deny_terminal. The handler drains an empty terminal queue, finds no reason, and returns without restricted JSON or an explicit 1008 policy close. Awaiting task completion is not evidence that the task produced a denial.

When the deadline fast path wins, publish the serialized terminal cause before self-cancellation, preserving any already-winning cause. Add a delayed-expiry-task wire witness at these rejection boundaries. Admission still fails; this is a denial-delivery defect, not an authorization bypass.

5. P2: Quiesce permitted root effects on admin cancellation before cleanup

nip_fi_session.rs:238, connection.rs:461–483, handlers/req.rs:307–351.

Only the timer arm waits for outstanding effect permits. With a future deadline, admin disconnect wakes the cancellation arm, which returns immediately; root teardown awaits it and then removes subscriptions without joining detached REQ tasks. Source-derived witness: a REQ acquires a permit, pauses before subscription registration, admin disconnect completes connection cleanup, then the REQ resumes. register_with_scope recreates the removed connection entry (subscription.rs:152–155) and retains topics after cleanup. No later cleanup releases those orphan entries/references. Repetition accumulates leaked state.

The newly delivered cancellation path needs the existing quiescence guarantee too, without manufacturing a second reason/frame. Wait for permitted effects before removing their resources on this path. Add a held-permit/admin-cancel witness asserting cleanup occurs after the effect and leaves no subscription/topic state. Socket cancellation should remain immediate; only resource cleanup waits. This is incomplete integration of the new gate, not a claim that the prior detached-task architecture was race-free.

6. P2: Finish isolating route/session fixtures from NIP-FI environment writers

router.rs:1512–1515, state.rs:1910–1911, writers:478–497.

The API fixtures now use hermetic_for_test, but nip_fi_enforce_state still calls Config::from_env().expect(...); new handler witnesses also use the ambient state::tests::test_state helper. In the same binary, NIP-FI tests temporarily set BUZZ_NIP_FI_MODE=permissive, or Enforce without issuers, under their module-private mutex. A fixture reading in either interval errors and panics before its intended assertion. Overriding config.nip_fi afterward cannot repair that fallible read. The comment claiming the environment read is irrelevant is incorrect.

Use the existing hermetic constructor for these fixtures/shared helpers, or synchronize all relevant readers and writers. Preserve normal parallel test execution. This carries the prior bounded fixture finding forward; no local test failure is claimed.

Coverage, dispositions, and exit criteria

The source review covered command/deny-map corrections, startup/config privacy, publisher/consumer wiring, root and audio registration/denial/deadline/cleanup transitions, EVENT/REQ/search/COUNT permit paths, changed audio transaction boundaries, and the unchanged desktop consumer of the rewritten JOIN event. All 47 cached head and 9 base blobs matched their pinned Git trees at final source verification.

Credit the real signed fractional verifier test, production audio registration witness, target root/audio registry cancellation with unrelated peers, and handler-driven audio payload/close tests. Registry cancellation alone is not simultaneous dual-socket wire proof. Comments describing mutations are not executed mutation evidence. Unchanged crypto internals, S5 HTTP admission, and broad mesh behavior were not reopened; no CI or live-runtime pass is claimed.

A suggested parent-membership revocation blocker was withdrawn after base comparison: the old ensure_membership already separated parent membership check from child add. The new transaction still does not serialize parent revocation, but that pre-existing TOCTOU is deferred rather than added to this corrective review's exit criteria. Huddle-liveness REQ gate coverage also remains a noted uncertainty, not an additional claimed post-expiry delivery defect.

Exit criteria are the six bounded issues above and their production-bound regression witnesses. Prefer completing the existing control/gate wiring and restoring the dropped field over expanding the machinery. No persistence, synchronous cross-pod completion, or broader authorization rewrite is requested.

[wesbillman]

Carl, an automated reviewer, commenting via Wes’s GitHub account.

Changes requested

Reviewed head 5e41fffaf995d53b6eac7aaa5a440f425be7f778 against exact base 3c7f288c60d67df78577b237e27c3dfc8831aaa1, using the previous six-finding review as the corrective contract. Source-only: no checkout, build, test, import, runtime reproduction, or mutation execution.

Credit: root pairing, post-registration deny-set, and admin-disconnect producers now use the shared winner-only transition and reserved terminal sender. This fixes the prior ordinary-queue saturation and pairing/post-auth versus community-delete schedules. Five prior findings remain unchanged; F2 is partially fixed with a reverse-order race in the newly added lifecycle helper. The corrective tests also introduce a parallel-run hang described separately below.

F1 · P1 · Observer EVENT still bypasses session authority

crates/buzz-relay/src/handlers/event.rs:682–693, crates/buzz-relay/src/handlers/event.rs:990–1138.

Kind 24200 returns through handle_agent_observer_event before either EVENT permit. Its complete helper awaits signature verification and potentially owner lookup, then publishes to Redis and local subscribers without acquiring a session effect permit. Source-derived schedule: hold validation/owner lookup for a valid owner-to-agent control frame, expire or admin-disconnect the publisher, then resume. The already-spawned task can still deliver that control to a live agent. The dispatch-time cancellation check cannot fence this resumed task, and recipient access checks do not validate publisher authority.

Acquire the existing permit after validation and before publication, hold it through fan-out, and add a production barrier witness for cancellation before acquisition. Preserve already-permitted bounded effects.

F2 · P2 · Finish terminal ordering in the new lifecycle cancellation helper

crates/buzz-relay/src/state.rs:347–357, crates/buzz-relay/src/state.rs:279–305, crates/buzz-relay/src/connection.rs:560–587.

The root producers requested previously are wired correctly now, but lifecycle_cancel releases the transition lock before cancelling and leaves the reason unset. Concrete reverse-order schedule: lifecycle cancellation acquires/releases the lock and pauses at line 356; a manager denial then acquires it, wins AuthorizationDenied, and pauses before try_send; lifecycle resumes at 357 and wakes the send loop. It drains an empty terminal queue and emits a 1008 authorization-denied close before the NOTICE is enqueued. No stalled writer is required. Heartbeat/backpressure/teardown now call this helper in production.

Serialize lifecycle cancellation itself with terminal publication and prevent a later writer from installing a new cause after lifecycle cancellation has already won. This can be completed with the existing lock/token rather than another queue abstraction. The new lifecycle/manager witnesses force denial-first ordering (crates/buzz-relay/src/state.rs:4408–4469); add the reverse order and verify the actual writer observes one consistent terminal result.

F3 · P2 · Transactional JOIN still drops the lifecycle generation

crates/buzz-relay/src/audio/handler.rs:1159–1172, crates/buzz-relay/src/audio/handler.rs:2245–2265.

The handler computes lifecycle_generation but does not pass it into commit_participant_join; the persisted/fanned-out kind 48101 content still omits it while LEFT/ENDED include it. An already-hydrated Desktop observer receiving a new START/JOIN assigns "pending" (desktop/src/features/huddle/lib/huddlePresenceRuntime.ts:264–272). The next authoritative liveness response has the real generation, so reconciliation clears admissions (desktop/src/features/huddle/lib/huddlePresence.ts:464–483). In-huddle indicators disappear while audio remains connected. This affects Off as well as Enforce.

Pass the existing generation through the transaction-owned JOIN builder and test the producer-to-JOIN-to-liveness sequence, including Off mode.

F4 · P2 · Audio deadline rejection still cancels its denial producer

crates/buzz-relay/src/audio/handler.rs:918–938, crates/buzz-relay/src/audio/handler.rs:1220–1246, crates/buzz-relay/src/nip_fi_session.rs:200–228.

acquire_effect can observe an elapsed wall-clock deadline before the expiry task runs. Both audio rejection paths still call raw cancel.cancel() before awaiting that task. Its unbiased select can take the now-ready cancellation arm and return without publishing expiry_deny_terminal. The handler then drains no restricted JSON, finds no disconnect reason, and returns without an explicit 1008 policy close. Awaiting task completion does not prove denial publication. The new lifecycle wiring does not change these rejection branches.

Publish the serialized deadline cause before self-cancellation, respecting an already-winning cause. Add delayed-expiry-task wire witnesses at add-peer and commit rejection. Admission is denied already; this is a denial-delivery defect, not an authorization bypass.

F5 · P2 · Admin cancellation still skips the root quiescence barrier

crates/buzz-relay/src/nip_fi_session.rs:227, crates/buzz-relay/src/connection.rs:457–479, crates/buzz-relay/src/handlers/req.rs:307–351.

Only the timer arm waits for existing effect permits. With a future deadline, admin disconnect wakes the cancellation arm, which returns immediately; root cleanup awaits it and removes subscriptions without joining detached REQ handlers. Hold a REQ after permit acquisition but before registration, let admin cancellation finish cleanup, then resume it. Registration recreates the removed connection entry (crates/buzz-relay/src/subscription.rs:150–155) and retains topics after the only cleanup pass. Repeating this schedule accumulates orphan registry entries/topic references.

Keep socket cancellation immediate, but wait for already-permitted bounded effects before resource removal on admin cancellation, without producing a second terminal frame. Add a held-permit/admin-cancel witness proving cleanup follows the effect and leaves no subscription/topic state.

F6 · P2 · Ambient NIP-FI fixture races remain

crates/buzz-relay/src/router.rs:1508–1527, crates/buzz-relay/src/state.rs:2183–2187, crates/buzz-relay/src/nip_fi_config.rs:478–497.

nip_fi_enforce_state and shared state::tests::test_state still use Config::from_env().expect(...). Concurrent tests set an invalid mode or Enforce without issuers under a module-private mutex; those fixture readers do not share it. They can fail before their intended assertion. Overriding config.nip_fi afterward does not repair the fallible read. The same ambient reads remain in the bounded root-auth fixtures (handlers/auth.rs:468,520), fanout fixture (handlers/event.rs:2060), and audio transaction fixture (audio/handler.rs:5039). The API fixture's existing hermetic fix remains credited.

Use the existing Config::hermetic_for_test constructor for these fixtures, or synchronize every relevant reader/writer while preserving normal parallel execution. No local failure execution is claimed.

New corrective-test regression · P2 · Global race hooks can deadlock parallel tests

crates/buzz-relay/src/state.rs:2109–2136, arm sites crates/buzz-relay/src/state.rs:4320–4323, crates/buzz-relay/src/state.rs:4431–4438, crates/buzz-relay/src/state.rs:4566–4569.

The three new manager race tests share one unkeyed process-global callback, but each installs a different blocking Barrier. Under parallel libtest, test B can replace A's callback before A's worker calls manager_disconnect_nip_fi; A's worker then enters B's barrier while A's main thread waits indefinitely on A's never-invoked barrier. An unrelated manager-disconnect test can also invoke the armed callback. The mutex protects individual slot reads/writes, not callback ownership for a whole test, and the barriers have no timeout.

Make hooks connection/control-scoped (or otherwise isolate all arming and invoking tests), with bounded rendezvous. Per-test-process nextest isolation can mask this, but ordinary parallel cargo test remains a supported path. Do not solve it by requiring the whole package to run serially.

Scope and exit criteria

The six prior boundaries were rechecked across root/audio registration, denial, effect admission and cleanup, the JOIN producer/Desktop consumer, and fixtures. The command verifier, deny map, JWKS/config, router, and pubsub blobs are unchanged from the previously reviewed head; the API delta is registration-fixture wiring only. Their previously credited capacity, privacy, fractional-time, and propagation fixes remain credited. All independent review lanes are integrated; conclusions above are checked against pinned source, not inferred from claimed test results.

RAM-only restart amnesia, asynchronous propagation/issuer re-push, and deferred S5 HTTP enforcement remain accepted. The previously withdrawn parent-revocation TOCTOU, uncertain huddle-liveness gate claim, unrelated rebase features, and separate #7224 findings are not added to these exit criteria. No persistence, synchronous cross-pod completion, generic stalled-writer overhaul, or broader auth rewrite is requested.

Exit criteria: close the five unchanged findings, finish F2's new lifecycle ordering, and isolate the newly introduced race hooks, with production-bound regression witnesses. No CI or runtime pass is claimed.