[bradseiler]

Summary

Cold login currently downloads full channel rosters to learn the viewer's memberships. This defines compact discovery in NIP-CL and reserves relay-only kind 39008 for a signed, request-bound response. Full kind-39002 rosters remain compatible.

The contract binds a complete snapshot to the community, viewer, NIP-98 request and requested channel types. It defines a primary database cut, overflow errors, lazy-roster precedence, reconnect repair and safe fallback across mixed relay versions. The next PR implements both query modes. This PR does not enable either capability.

A separate membership_public capability uses relay-only kind 39009 for lookups of any subject’s listed-open forum, stream and workflow memberships. It preserves roles and archived state while excluding private, unlisted, DM and system channels. Signed answers bind requester, subject and public scope; they cannot grant membership or sending permissions. The self-mode contract is unchanged.

Related issue

BUZZ-615. No duplicate compact-membership implementation found. Related work: #8898 protects full-roster signing; #9060 caches membership lookups.

Testing

McKeon independently reviewed the contract and the fixes to request binding, per-channel race fencing and mixed-version fallback. Content checks parse every JSON example and resolve relative links. Paul’s review fixes remove implementation details from the normative text and move the existing 39009 registration and regression test into this PR. Protocol behavior is unchanged. Runtime validation belongs to the implementation PR. This description does not attest human testing.

Implementation and operator notes

Both kinds are registered in crates/buzz-core/src/kind.rs, included in ALL_KINDS, and rejected as client-submitted events by the relay-only guard. The dependent implementation uses one primary SQL statement’s MVCC snapshot over active channel_members joined to nondeleted channels, supported by the partial (community_id, pubkey) WHERE removed_at IS NULL index. Public requests share the existing community/requester ApiCalls quota configured by human_api_calls_per_min.

BUZZ_MEMBERSHIP_SNAPSHOT_ENABLED and BUZZ_MEMBERSHIP_PUBLIC_ENABLED independently default to false. Deploy support across the fleet with both flags off, then enable capabilities independently. Disable the affected capability to roll back; client fallback and back-off behavior remain specified in NIP-CL. Client opt-in and production-shaped throttled validation follow separately.

Generated with Codex

[github-actions]

🔐 Codex Security Review

Note: This is an automated, security-focused review generated by Codex.
Use it as a supplement to human review; false positives are possible.

Scope

• Exact PR diff: f82944e3180e28502f5ea599ac9973aa6398ddb3...57c95a36819908f2f92a127bfa2bd471dd7f3289
• Model: gpt-6.1-sol

💡 Click "edited" above to see earlier reviews for this PR.

---

Review Summary

Overall Risk: NONE

No concrete findings in the authorized PR range. The changes define compact membership protocol contracts and reserve two event kinds, both rejected by the shared HTTP and WebSocket ingest guard.

Findings

No concrete security, correctness, or reliability findings were identified.

Notes

• Compact membership query modes are specified but not implemented in this PR.
• Review used read-only inspection; builds and tests were not executed as instructed.

---

_{Generated by Codex Security Review |
Requested by: @bradseiler |
Workflow run}

[wpfleger96]

🤖 Rechecked at 17a481a. The normative text now describes protocol behavior only, with no implementation references or rollout notes. Kind 39009 is registered as relay-only alongside 39008, with a regression test. LGTM.