Manage community NIP-FI policy with enable, disable and status

.env.example

@@ -470,9 +470,9 @@ RUST_LOG=buzz_relay=debug,buzz_datastore=info,buzz_db=debug,buzz_auth=debug,buzz
 # key and NIP-FI enforcement. Profiles are historical records and are never
 # retracted.
 
-# New irreversible community FI acceptances stay disabled until the fleet's
-# enforcement and activation baseline is verified. Disabling preserves receipts.
-BUZZ_NIP_FI_UPGRADES_ENABLED=false
+# Permit community FI policy enables and disables only after the whole fleet
+# supports policy management. A closed gate preserves receipt recovery/status.
+BUZZ_NIP_FI_CHANGES=false
 
 # NIP-CL compact membership discovery. Deploy fleet-wide dark before enabling.
 BUZZ_MEMBERSHIP_SNAPSHOT_ENABLED=false

Justfile

@@ -468,7 +468,7 @@ test-unit:
         # parser, validation, and propagation-evidence tests, and the partition
         # audit outcome contract, NIP-FI policy/backfill, and user-deletion intake.
         cargo nextest run -p buzz-admin \
-            -E 'test(storage_snapshot) + test(/^communities::tests::/) + test(/^tests::communities_/) + test(=tests::partition_audit_outcomes_keep_their_json_names_and_exit_codes) + test(/^nip_fi::tests::/) + test(/^user_deletions::tests::/)'
+            -E 'test(storage_snapshot) + test(/^communities::tests::/) + test(/^tests::communities_/) + test(=tests::partition_audit_outcomes_keep_their_json_names_and_exit_codes) + test(/^nip_fi::tests::/) + test(/^nip_fi_policy::tests::/) + test(/^user_deletions::tests::/)'
         # Multi-tenant conformance gate (buzz-conformance): the independent
         # replay checker + golden fixtures. No infra — pure in-process trace
         # replay — so it belongs in the unit job. Run all targets (lib + the

crates/buzz-admin/Cargo.toml

@@ -27,6 +27,9 @@ serde_json = { workspace = true }
 serde = { workspace = true }
 anyhow = { workspace = true }
 hex = { workspace = true }
+base64 = { workspace = true }
+reqwest = { workspace = true }
+sha2 = { workspace = true }
 # Redis TLS (rediss://, e.g. ElastiCache) uses rustls, which needs a process
 # CryptoProvider installed at startup. The workspace redis TLS feature compiles
 # both aws-lc-rs and ring in transitively, so rustls can't auto-select one — we
@@ -39,4 +42,6 @@ uuid = { workspace = true }
 clap = { version = "4", features = ["derive"] }
 
 [dev-dependencies]
+axum = { workspace = true }
+tempfile = "3"
 tokio = { workspace = true, features = ["test-util"] }

crates/buzz-admin/src/main.rs

@@ -22,6 +22,7 @@
 mod communities;
 mod deletions;
 mod nip_fi;
+mod nip_fi_policy;
 mod user_deletions;
 
 use std::future::Future;
@@ -124,6 +125,8 @@ enum Command {
         #[command(subcommand)]
         command: nip_fi::NipFiCommand,
     },
+    /// Change or inspect a community stored NIP-FI requirement.
+    NipFiPolicy(nip_fi_policy::Args),
     /// Durable CLI-only whole-community deletion control plane.
     Deletions {
         #[command(subcommand)]
@@ -213,6 +216,11 @@ async fn run(cli: Cli) -> Result<i32> {
         Command::Deletions { command } => deletions::run(command).await,
         Command::UserDeletions { command } => user_deletions::run(command).await,
         Command::NipFi { command } => nip_fi::run(command).await,
+        // Retain transport/file causes for this operator command without changing
+        // the diagnostics of other admin commands. Key parse errors are redacted.
+        Command::NipFiPolicy(args) => nip_fi_policy::run(args)
+            .await
+            .map_err(|e| anyhow::anyhow!("{e:#}")),
         Command::ReconcileChannels { channel, relay_key } => {
             reconcile_channels(channel, relay_key).await?;
             Ok(0)