[bradseiler]

Why

Login currently uses full channel rosters to learn the viewer’s memberships. BUZZ-615 introduces a smaller signed response that separates membership discovery from peer rosters. This first slice adds the verified read path needed by that migration.

What

Add dedicated native and browser host operations that build the filter, sign the HTTP request, and return that attempt’s request ID, signer, origin and response together. Validate the signed snapshot and schedule reads through the existing reader.

How

The validator checks signature, event ID, tenant, viewer, request ID, host including port, type scope, completeness and content identity. Each read fetches fresh capability metadata from the same origin and pins its signing key. Only explicit unsupported behavior selects legacy fallback; denials, cancellation, malformed results and outages remain errors.

Each compact read starts a fresh attempt. The later session integration must serialize refreshes per viewer/community and accept only its newest outstanding attempt. Normal refresh costs two relay reads: NIP-11 and /query. An array or 404 adds one descriptor refresh, for three reads.

Risk

This slice is dark: startup remains legacy, no consumer requests compact snapshots, and session.ts is unchanged. It reuses native signing, cancellation and HTTP admission, so regressions in those shared paths still matter. PR 1 can merge before block/buzz#9117 and #9118 because no runtime consumer calls this path. Success means green CI and unchanged app behavior. Revert PR 1 if its shared-path changes regress behavior; the relay capability flag becomes the rollback lever when the later startup slice calls this path.

Testing

Published restack: 52fbf9bcc7eeecf0f3e6b007f888718d2c3836ad on main 22e4efd2e4d5e0c1d413869da322a1d82729748b. All six parent patches replay unchanged. Mandatory publication hooks passed from child 6b92e2070; parent CI run 42320998300 is pending. Full local validation at the stacked child is pending. Earlier test and workflow evidence below keeps its original commit scope. Human testing remains pending.

Exercised an actual local relay at relay head da52f34397f120e00046470f4dfbe713936b5078 with 468 memberships: signature, request binding, content identity, removal and role change passed. The real relay-to-client-validator witness accepted a signed host with its port and rejected the same result when the expected origin omitted the port.

Coverage spans membership-snapshot.test.ts, native.test.ts, reader.test.ts and browser-host/membership-broker.test.mjs. Ran pnpm exec vitest run at 7cff167b3: 18,183 passed, 22 skipped. At the published head, pnpm exec vitest run src/features/relay/native.test.ts passed 70 tests; required pre-push checks passed with BUZZ_TEST_WORKERS=2. Local workflow commands were node OUTBOX/BUZZ_615_LOCAL_WORKFLOW.mjs and node OUTBOX/BUZZ_615_CLIENT_HOST_PORT.mjs from the validation workspace.

Human testing is pending. Full native tests crashed with SIGSEGV in existing window-state code; the same crash also reproduces on baseline 3ce52cefc. Browser startup throughput and zero-roster startup acceptance belong to the later startup slice.

Bigger picture

Part 1 of BUZZ-615, based on the relay contract in block/buzz#9117. Follow-ups migrate viewer authority, add bounded peer-roster demand, then switch compact startup with hint fencing, cache isolation and reconnect repair. No deployment or production enablement is included.

Generated with Codex

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}