disregard

Cargo.toml

@@ -72,6 +72,7 @@ serde_yaml  = "0.9"
 evalexpr    = "11"
 cron        = "0.16"
 # Observability
+log                         = "0.4"
 tracing                     = "0.1"
 tracing-subscriber          = { version = "0.3", features = ["env-filter", "json"] }
 tracing-opentelemetry       = { version = "0.33" }

crates/buzz-cli/Cargo.toml

@@ -91,3 +91,6 @@ rand = { workspace = true }
 tempfile = "3"
 # Minimal HTTP test server for retry/policy integration tests
 axum = { workspace = true }
+# Local WebSocket relay fixtures for exact-event command integration tests
+futures-util = { workspace = true }
+tokio-tungstenite = { workspace = true }

crates/buzz-cli/README.md

@@ -20,14 +20,22 @@ export BUZZ_PRIVATE_KEY="nsec1..."
 buzz channels list
 ```
 
+`events get-verified` can read from a public Nostr relay without a key. If the
+relay requires NIP-42, it uses `BUZZ_PRIVATE_KEY` and the optional
+`BUZZ_AUTH_TAG` for authentication only; event trust still comes from local ID
+recomputation and signature verification.
+
 ## Usage
 
 All output is JSON on stdout. Errors are JSON on stderr. Exit codes: 0=ok, 1=user error, 2=network, 3=auth, 4=other, 5=write conflict.
 
 ```bash
-# Set relay URL (defaults to http://localhost:3000)
+# Set relay URL (defaults to http://localhost:3000 for ordinary commands)
 export BUZZ_RELAY_URL="https://relay.example.com"
 
+# Exact raw event read (command-local relay is mandatory; no env/default fallback)
+buzz events get-verified --relay wss://relay.example.com --event <64hex>
+
 # Messages
 buzz messages send --channel <uuid> --content "Hello"
 buzz messages send --channel <uuid> --content "Reply" --reply-to <event-id> --broadcast
@@ -146,6 +154,7 @@ stored rules in `validation_error` so an owner can remove and repair them.
 | | `runs` | Get workflow run history |
 | | `approve` | Approve/deny a workflow step |
 | `feed` | `get` | Get your activity feed |
+| `events` | `get-verified` | Fetch one exact raw event and verify its NIP-01 ID and Schnorr signature locally |
 | `social` | `publish` | Publish a NIP-01 note |
 | | `set-contacts` | Set NIP-02 contact list |
 | | `event` | Get a Nostr event |
@@ -174,6 +183,7 @@ buzz <group> <subcommand> [flags]
     │
     ├─ main.rs ──▶ commands/*.rs ──▶ client.rs ──▶ Buzz Relay REST API
     │  (clap)       (handlers)       (reqwest)
+    │                    └──────────▶ buzz-ws-client (exact Nostr reads)
     │
     ├─ validate.rs   (UUID, hex, content size, percent-encode)
     └─ error.rs      (CliError → JSON stderr + exit code)

crates/buzz-cli/TESTING.md

@@ -482,6 +482,25 @@ buzz notes get --name dco-check   # exits non-zero: not found
 buzz notes rm --name does-not-exist   # exits non-zero
 ```
 
+### 6.13 Exact Verified Events
+
+This is a raw NIP-01 WebSocket read. Its `--relay` is mandatory and does not
+inherit `BUZZ_RELAY_URL` or the global `--relay`. The command waits for EOSE,
+requires exactly one result, recomputes the event ID, and verifies the Schnorr
+signature locally before writing anything to stdout.
+
+```bash
+# EVENT_ID comes from the message created in section 6.3.
+buzz events get-verified \
+  --relay ws://localhost:3000 \
+  --event "$EVENT_ID" | jq .
+# Expected: {id,pubkey,created_at,kind,tags,content,sig}
+
+# A missing command-local relay is a user error even when BUZZ_RELAY_URL is set.
+buzz events get-verified --event "$EVENT_ID"
+# Expected: exit 1, no stdout
+```
+
 ---
 
 ## 7. Error Path Testing
@@ -621,3 +640,4 @@ buzz channels delete --channel "$FORUM_ID" | jq .
 | 60 | `notes ls` | ☐ | Own, --author all, --tag, --limit |
 | 61 | `notes rm` | ☐ | Delete→get 404, double-delete idempotent, missing slug → NotFound |
 | 62 | `users set-status` | ☐ | Text+emoji, text only, emoji-only (`--text ""`), `--clear`, `--clear` + `--text` → exit 1 |
+| 63 | `events get-verified` | ☐ | Exact ID, raw seven-field event, local ID/signature verification, explicit WS relay |