Repository navigation

feat(relay): add NIP-FI shadow mode for HTTP, WebSocket and admin - #8034

Merged

wpfleger96 merged 71 commits into

mainfrom

hayt/nip-fi-shadow-mode

Oct 2, 2026

Commits on Sep 29, 2026

feat(nip-fi): admin disconnect/deny API with in-memory deny-until-TTL map (S4)

committed
906500c
test(nip-fi): tighten S4 deny witnesses and wire pubsub tests into CI

committed
2e5e1bc
test(relay): pin deny-map clean-key baseline and fix stale audio comments

committed
c57fe3d
perf(nip-fi): sweep deny map only at capacity and bound jti length
wpfleger96
committed
ca579b7
fix(nip-fi): subscribe to cross-pod disconnects before the Redis subscriber starts
wpfleger96
committed
ff3bb85
fix(nip-fi): clamp cross-pod until to the local ceiling instead of rejecting
wpfleger96
committed
d974df5
fix(nip-fi): send one authorization_denied close frame on every WS path
wpfleger96
committed
b629422
Merge remote-tracking branch 'origin/main' into duncan/nip-fi-deny-api-port
wpfleger96
committed
5e65b38

Commits on Sep 30, 2026

test(buzz-relay): characterize NIP-FI assertion evaluation and pairing

Hayt
and
wpfleger96
committed
ba0cfd3
refactor(buzz-relay): share NIP-FI assertion evaluation across adapters

Hayt
and
wpfleger96
committed
fb8597b
test(buzz-relay): witness routed NIP-FI guard-plus-admission reverification

Hayt
and
wpfleger96
committed
7a2f3ec
test(relay): pin exact rate-limit response in routed NIP-FI control

Hayt
and
wpfleger96
committed
04a2ad6
fix(nip-fi): fence command jti replay across pods with a shared Redis claim
wpfleger96
committed
655ba2c
Merge remote-tracking branch 'origin/main' into duncan/nip-fi-deny-api-port

Duncan
and
wpfleger96
committed
5c89d62
fix(nip-fi): round the command claim TTL up to whole seconds

Duncan
and
wpfleger96
committed
b769d2b
test(nip-fi): pin authenticate-before-claim and observe disconnect publishes

Duncan
and
wpfleger96
committed
d55d89d
test(nip-fi): barrier publish counts on a sentinel command

Duncan
and
wpfleger96
committed
40ed911
test(buzz-relay): characterize NIP-FI disconnect route rejections

Hayt
and
wpfleger96
committed
d62db55
refactor(buzz-relay): share header parsing and denial bodies in NIP-FI disconnect

Hayt
and
wpfleger96
committed
225471a
Merge #7977 fix round (origin/duncan/nip-fi-deny-api-port) into hayt/nip-fi-auth-consolidation

Hayt
and
wpfleger96
committed
ca878a5
test(relay): make NIP-FI transport rejections distinguishable

Hayt
and
wpfleger96
committed
17a6b7e
fix(relay): fail closed instead of panicking on command status

Hayt
and
wpfleger96
committed
74e8a58

Commits on Oct 1, 2026

fix(auth): reserve the local deny slot before the shared jti claim

Duncan
and
wpfleger96
committed
76b553a
test(relay): make the NIP-FI publish-count barrier strict

Duncan
and
wpfleger96
committed
9a9def8
fix(auth): let a cross-pod deny fill its pending key's slot

Duncan
and
wpfleger96
committed
5711c84
docs(buzz-relay): fix NIP-FI module docs and stale cross-references
wpfleger96
committed
68c4d44
refactor(buzz-relay): render NIP-FI denials without panicking
wpfleger96
committed
2e5349e
test(buzz-relay): share one scripted NIP-FI verifier across test modules
wpfleger96
committed
3d53525
test(buzz-relay): build NIP-FI session test connections with the shared builder
wpfleger96
committed
91cf175
test(buzz-relay): pin the NIP-FI disconnect deny-set-full metric
wpfleger96
committed
0ce2151
feat(nip-fi): bind assertions to the request Host's community

Duncan
and
wpfleger96
committed
462cb7f
Merge remote-tracking branch 'origin/hayt/nip-fi-auth-consolidation' into duncan/nip-fi-community-binding
Duncan
committed
5621ea0
chore: merge #7977 final tip 5711c84e2

Hayt
and
wpfleger96
committed
a7223be
chore: merge origin/main after #7977 squash

Hayt
and
wpfleger96
committed
0211525
fix(relay): drop needless struct update in NipFiCommunities::from_entries

Duncan
and
wpfleger96
committed
be778a1
Merge remote-tracking branch 'origin/hayt/nip-fi-auth-consolidation' into duncan/nip-fi-community-binding

Duncan
and
wpfleger96
committed
11ffe5f
fix(relay): reject non-canonical NIP-FI community URIs at startup

Duncan
and
wpfleger96
committed
6467474
fix(relay): require Host-normalized NIP-FI community authorities

Duncan
and
wpfleger96
committed
f5a6bf9
test(relay): require valid row to boot in blank-Host resolver test

Duncan
and
wpfleger96
committed
43fe5d5
Merge main before #7990 squash into duncan/nip-fi-community-binding

Duncan
and
wpfleger96
committed
74d2a63
Merge #7990 squash (9b083957f) into duncan/nip-fi-community-binding

Duncan
and
wpfleger96
committed
299a160
feat(relay): add NIP-FI shadow mode for HTTP, upgrade and admin

Hayt
and
wpfleger96
committed
81e19fa
chore: merge community ban gaps fix into shadow mode branch
Hayt
committed
9832d0c
chore: merge main into shadow mode branch

Hayt
and
wpfleger96
committed
3922d46

Commits on Oct 2, 2026

fix(relay): keep shadow out of git's wildcard mode arm

Hayt
and
wpfleger96
committed
619ead9
fix(relay): record each shadow verdict once and only on real proofs

Hayt
and
wpfleger96
committed
487ec5c
fix(relay): keep shadow disconnects and replay claims off enforce pods

Hayt
and
wpfleger96
committed
ee5cead
chore: merge main into hayt/nip-fi-shadow-mode
Hayt
committed
928a2a7
fix(relay): record shadow verdicts on every pre-admission exit

Hayt
and
wpfleger96
committed
006902a
fix(relay): drop production expect and pin strict-proof outcomes

Hayt
and
wpfleger96
committed
77a151d
fix(relay): record shadow git credential failures without a dropped admission

Hayt
and
wpfleger96
committed
31fdec8
fix(relay): observe shadow WebSocket sessions after login on root and audio

Hayt
and
wpfleger96
committed
f29288c
test(relay): pin enforce guard 401 and exempt rows before shadow replay

Hayt
and
wpfleger96
committed
3c82b1a
fix(relay): replay the HTTP guard first in shadow verdicts

Hayt
and
wpfleger96
committed
641609e
fix(relay): keep shadow off the real NIP-FI disconnect metrics

Hayt
and
wpfleger96
committed
e17020a
fix(relay): drop the per-verdict shadow info log

Hayt
and
wpfleger96
committed
b6e6630
refactor(relay): type shadow stages and split strict-proof metric

Hayt
and
wpfleger96
committed
700cd1b
test(relay): pin shadow startup wiring and the lifetime refusal

Hayt
and
wpfleger96
committed
0103bfb
test(relay): pin shadow parity on seeded-host bridge, Blossom and Git rows

Hayt
and
wpfleger96
committed
c54488e
test(relay): pin Off parity for the remaining shadow routes

Hayt
and
wpfleger96
committed
b35563d
docs(relay): describe shadow mode in stale NIP-FI comments

Hayt
and
wpfleger96
committed
2605fea
docs(relay): document the shadow NIP-FI metrics and their denominators

Hayt
and
wpfleger96
committed
5c46d0b
fix(relay): settle shadow session revocation and pending lifetime

Hayt
and
wpfleger96
committed
920bcc8
fix(relay): label shadow upgrade would-denies by ingress

Hayt
and
wpfleger96
committed
e846b56
test(relay): move the shadow AppState witness to the Redis lane

Hayt
and
wpfleger96
committed
b2f0d3b
test(relay): select the shadow suites in both unit runners

Hayt
and
wpfleger96
committed
295a265
docs(relay): narrow shadow logging and disconnect metric claims

Hayt
and
wpfleger96
committed
f1d4d37
fix(relay): serialize shadow session transitions and fence them on cancel

Hayt
and
wpfleger96
committed
fc23873
fix(relay): record the audio shadow admit at the join commit

Hayt
and
wpfleger96
committed
3c88027
fix(relay): retire audio shadow sessions before refusal cleanup

Hayt
and
wpfleger96
committed
2d1d115
test(relay): give shadow test state an unreachable database

Hayt
and
wpfleger96
committed
902b352