feat(buzz-relay): NIP-FI Phase A PR 4 — atomic PostgreSQL-final admission authority for kind-9

[wpfleger96]

Summary

Implements the NIP-FI Phase A PostgreSQL-final admission authority for kind-9 (KIND_STREAM_MESSAGE) channel messages in buzz-relay. This PR stacks on top of PR 3 (duncan/nip-fi-assertion-runtime) which provides the assertion runtime.

Design B: single atomic transaction

All NIP-FI authority mutations (enrollment, proof replay consumption, operation receipts, epoch/fence, protected-object authority) and the kind-9 event insert execute in one SERIALIZABLE transaction. Any error at any step rolls back all authority mutations and the event insert together — zero orphaned enrollment/replay/receipt/evidence/fence rows (FI-INV-09 all-or-none, FI-TRACE-FINAL-DENIAL-NO-MUTATION).

Transaction sequence (commit_kind9_atomic)

1. SET TRANSACTION ISOLATION LEVEL SERIALIZABLE
2. SELECT transaction_timestamp() as authoritative clock
3. Final admission: enrollment, replay claim, receipts, epoch/fence, protected_object_authority upsert — in caller-owned tx (commit_admission_in_tx)
4. Immediate re-fence / protected-use revalidation — in same tx (authorize_protected_use_in_tx)
5. Event insert via Db::insert_event_with_thread_metadata_in_tx — in same tx
6. COMMIT

Post-commit side effects (mention indexing) remain outside the transaction per existing convention.

Changed files

buzz-relay

• src/nip_fi/admission.rs — commit_admission_in_tx and authorize_protected_use_in_tx operate on caller-owned transactions; do not self-commit. Three PostgreSQL atomicity witness tests (#[ignore], require DATABASE_URL).
• src/nip_fi/mod.rs — NipFiVerify trait with verify_compact_jws and commit_kind9_atomic; NipFiVerifierImpl implementation; module-doc explaining the Design B contract.
• src/nip_fi/context.rs — SealedRequestContext (private fields, seal_inline construction path).
• src/connection.rs — NipFiProofMeta struct; nip_fi_assertion and nip_fi_proof_meta on ConnectionState; NIP-FI assertion verification at upgrade time.
• src/handlers/auth.rs — populates nip_fi_proof_meta on successful NIP-42 AUTH.
• src/handlers/event.rs — builds NipFiIngestContext from connection state.
• src/handlers/ingest.rs — atomic NIP-FI gate before normal store path; bypasses duplicate thread_meta resolution for NIP-FI events.
• src/router.rs — NIP-FI verifier header extraction wired.
• src/state.rs — nip_fi: Option<Arc<dyn NipFiVerify>> on AppState.

buzz-db

• src/store/event.rs — insert_event_with_thread_metadata_in_tx (caller-owned-transaction seam) and insert_mentions_post_commit (best-effort post-commit mention indexing).

buzz-nip-fi-seal-test

• New test crate with 3 compile-fail fixtures proving external crates cannot forge SealedRequestContext.

Evidence

• cargo check -p buzz-relay: clean (33 dead-code warnings for startup wiring deferred to PR 5)
• cargo test -p buzz-relay: 1022 passed, 1 pre-existing failure (demo_join_forwarded_arm_round_trips_echo), 91 ignored
• cargo test -p buzz-nip-fi-seal-test: 1 passed (3 compile-fail fixtures)
• PostgreSQL atomicity tests: #[ignore] — run with cargo test -p buzz-relay -- --ignored pg_nip_fi --nocapture

[wpfleger96]

Superseded by r5 on hayt/nip-fi-pg-authority-r5 which addresses all Pass 1 review findings.

[wpfleger96]

🤖 Canonical pointer: #7157 is the sole Phase A PR 4. This earlier atomic PostgreSQL attempt remains superseded and closed; its applicable feedback is consolidated on #7157.