[wpfleger96]

Relays that enforce NIP-FI refuse any /git/... request without a Nostr-Federated-Identity header, so agent clones, fetches and pushes through the repo tool got 401: the tool's credentials carried only the NIP-98 Authorization header.

• app_agent_git_auth now goes through the agent's signer, as the agent's upload and media commands do, checks the evidence before handing it out, and returns the Authorization line plus a Nostr-Federated-Identity line when the community requires sign-in. Without evidence it returns only Authorization, as before.
• The repo tool prints one -c http.<url>.extraHeader=... per header line, the way the desktop's own Git runner already does.
• Tests cover both header shapes and the two-flag command.
• Git asks for evidence valid for at least 70 seconds (the minute the tool promises plus a margin). A cached assertion expiring sooner is re-minted on the existing refresh path; if a freshly minted one is still too short, the command fails with an explicit error that the community's sign-in does not last long enough for Git. Upload, media and posting pass zero and are unchanged.
• docs/identity.md and the app_agent_git_auth doc comment describe the one exception to assertions staying native: the repo tool's Git headers, with the NIP-98 proof bound to one repository for 60 seconds and the assertion relay-scoped and bound to the agent's key (NIP-FI, Assertion–key binding).
• Tests cover re-minting a short cached assertion and refusing a short freshly minted one.

[kalvinnchau]

🤖 Two contract corrections: document the exported assertion’s boundary/scope and enforce the requested lifetime for freshly issued evidence.

[TheSentinel454]

🤖 Approved at db7e855.