Buzz Signed Workspace Evidence

Run locally:

cd examples/buzz-signed-workspace-evidence
node cli.mjs <events.json> --out buzz-evidence.json

Rules:

1. Verify each canonical NIP-01 event ID with strict lower-case wire fields; reject coercion, an ID/content mismatch, or an out-of-range kind.
2. Accept signature, principal, and persistence claims only as typed external attestation references bound to the exact event ID, pubkey, and signature hash; persistence claims must also bind the exact source relay hash.
3. Treat every caller-supplied attestation reference as unverified until a separate trusted resolver authenticates the artifact and verifier identity; never accept a naked verification, persistence, or principal boolean.
4. Do not infer a principal or owner from a pubkey alone.
5. Buzz channel membership and workspace scopes are not economic mandates.
6. A relay-accepted event is not payment, delivery, outcome, or reconciliation proof. Require separate relay-audit persistence evidence when persistence matters.
7. Keep event content and source metadata hash-only by default. Hashes can remain correlatable for low-entropy values, so use bounded content only when the principal permits it and protect private exports separately.
8. Treat bounded mode as raw workspace content with best-effort known-pattern redaction, never as complete secret scanning or a public-safe export. Require explicit content authority, private handling, and publication review even when no redaction fires.
9. Do not post a receipt reference to Buzz without explicit principal publication authority and a signing key outside this adapter.
10. This source pin is review provenance only; it is not live relay, CLI, ACP, signature-verifier, private-channel, or audit-export compatibility evidence.
11. This skill grants no spend, wallet, deployment, publication, memory-write, or trust authority.

Report:

event count and types
exact upstream and NIP-01 source pin
canonical ID integrity
event-bound but unverified signature-attestation-reference state
event-bound but unverified principal-attestation-reference state
event-bound but unverified relay-audit-reference state
content policy and redactions
hash-only source references
event root and full security-envelope bundle root
bundle verification result and externally trusted expected root, when available
raw-content, redaction-assurance, and publication-review state
Transaction Assurance blockers
caller-claimed Transaction Assurance states and state_claims_verified: false
next safe action
authority granted: false