docs(nips): complete NIP-FI authorization draft

[cea-block]

Why

Continue Tyler's #1485 as a separate stacked draft so reviewers can evaluate the three-commit NIP-FI continuation without modifying #1485, Tyler's branch, or #1476.

Stack identity

• Base: nip-fi-federated-identity at 805f1131b8c946cfdcff4508d20f1758515a5990 (NIP-FI: Federated Identity Authorization (spec + formal model) #1485)
• Head: cea/nip-fi-continuation at 674440ffcfa8976fd10e3efd883c173ad7ffa6b3
• Continuation: exactly three commits on top of NIP-FI: Federated Identity Authorization (spec + formal model) #1485
• Tyler's NIP-FI: Federated Identity Authorization (spec + formal model) #1485 branch is unchanged; feat(relay): add relay-verified identity binding #1476 is outside this stack and is not modified by this PR

What

• Preserve NIP-FI: Federated Identity Authorization (spec + formal model) #1485's four commits and add provider-neutral lifecycle, enrollment, lease, delegation, privacy, and discovery semantics
• Define literal (iss, sub) identity, trusted server-resolved domains, durable lifecycle gates, and atomic recovery/re-enablement
• Add a 56-trace conformance matrix covering success, denial, concurrency, lifecycle, session, delegation, disclosure, and privacy behavior
• Document feat(relay): add relay-verified identity binding #1476 as a compatible, disabled partial foundation without including changes to feat(relay): add relay-verified identity binding #1476 in this stack

Reviewer scope

Review only the exact 805f1131b8c946cfdcff4508d20f1758515a5990..674440ffcfa8976fd10e3efd883c173ad7ffa6b3 continuation:

1. 2eec4460225e718872b7cfd8ede8489aab3eef83 — enforce NIP-FI v1 semantics
2. 18507ce9f790f1c647854eada853abd72db94078 — add the NIP-FI conformance matrix
3. 674440ffcfa8976fd10e3efd883c173ad7ffa6b3 — resolve NIP-FI review findings

Out of scope:

• Tyler's four NIP-FI: Federated Identity Authorization (spec + formal model) #1485 commits and branch
• Runtime changes to feat(relay): add relay-verified identity binding #1476
• Upstream NIP acceptance

Non-blocking points for human reviewers to scrutinize:

• Binding expiry and exact-match lifecycle-denial semantics
• Lifecycle authority plus replacement-proof operation, domain, target, and transport binding
• Delegation lease maximum, dependency invalidation, and delegate-key denial parity across the documents
• Conformance negative cases and wire-denial-class/anchor parity

CI

• Exact-head hosted CI: run 30574494174
• Result: completed successfully at 674440ffcfa8976fd10e3efd883c173ad7ffa6b3
• Check rollup: 25/25 terminal-good, 0 failing or nonterminal checks
• Retargeting did not create a newer workflow run

Independent exact-head review

All reviews ran through Databricks with GOOSE_DISABLE_KEYRING=1, independently evaluated the exact three-commit continuation, and reported no critical issues. No review comments were posted.

Family	Databricks model	Verdict	Score
Claude	databricks-claude-opus-4-8	APPROVE	9/10
GPT	databricks-gpt-5-5	APPROVE	8/10
Gemini	databricks-gemini-3-1-pro	APPROVE	9/10

Because the exact diff exceeded the single-packet limit, every reviewer evaluated all three file packets. Packet SHA-256 evidence:

• docs/nips/NIP-FI.md: 7d6be77b54c6f9d2b9728cf23cd11cbc0ce14a7f4553052e66d82397b13d4c18
• docs/nips/NIP-FI-MODEL.md: 928683def7a8650270d81219a25c3a9396536f1f2b91e48e638507f5ff6700a6
• docs/nips/NIP-FI-CONFORMANCE.md: b34900dbad1f53e7506a9781013ff653bff400d67b7257411aefd85edbf435c2

Consensus verdict: APPROVE for human review. The scrutiny points above are non-blocking reviewer suggestions, not unresolved critical findings.

Risk assessment

Low — documentation only; no runtime code or configuration changes. This Buzz-local draft does not represent upstream NIP acceptance.

Generated with Codex