seller node: buzz persona — kind-0 rate card + ephemeral presence

[orveth]

Rebased on main (includes #135 seller-node, plus #147/#149).

Slice 1 of mobee×buzz: the seller node enrolls as a buzz inhabitant under its existing protocol identity — publishing a kind-0 persona with a human-readable rate card and maintaining a live presence heartbeat while it is up. Config-off ⇒ fully inert.

What this adds

• [buzz] config (home::BuzzConfig, optional): relay URL + persona (name, about, rate, capabilities, mint, heartbeat cadence). Absent ⇒ the node opens no connection and publishes nothing.
• seller_node::buzz — the persona subsystem:
  • kind-0 rate card published on boot, signed by the seller's existing key. The rate card (rate · capabilities · mint · blurb) is assembled into the human-readable about (rate_card_about, pure + unit-tested).
  • Clobber guard — kind-0 is one-per-key replaceable. Before the first publish the node fetches the key's current kind-0; a foreign one (no mobee marker tag) ⇒ refuse rather than clobber. Fail-closed if the current kind-0 can't be read. (clobber_decision, pure + unit-tested.)
  • Presence — a live authed WS connection publishing an ephemeral kind-20001 "online" status every 30s (the deployed relay keys presence on the authed pubkey and reads the content status; tags ignored). Clean disconnect on shutdown clears presence immediately; crash ⇒ relay TTL expiry (~60s).
• One identity, one signer. The persona is signed by the existing seller_node::signer actor — including the NIP-42 auth the relay asks of the presence socket, via NodeNostrSigner (a nostr-sdk signer that delegates every sign to the actor). No new keys; no key material leaves the actor.
• Signing allowlist (doctrine, default-deny at the actor). The raw-sign capability signs only {kind 0 persona, kind 20001 presence, kind 22242 NIP-42 auth}, enforced in two layers:
  • Inside the signer actor (sign_unsigned_event, source of truth UNSIGNED_SIGN_ALLOWLIST): default-deny for every caller of SignerHandle::sign_unsigned, not just the buzz wrapper — any other kind is refused + logged. So even a future holder of the handle cannot turn this path into a sign-anything oracle for the protocol key.
  • At the buzz wrapper (NodeNostrSigner::sign_event): belt-and-suspenders, sourced from the same actor constant.
  • Call-graph argument: the actor has two signing entry points — sign(draft) (the trade path, kinds set by the gateway draft constructors; the outbox's designed protocol-signing path, unchanged) and sign_unsigned (the buzz/auth path). The allowlist gates sign_unsigned only. sign_unsigned's sole production caller is the buzz wrapper; the actor also refuses a foreign-authored event. SellerNode::signer() stays public but is safe — the actor default-denies, so a holder of the handle cannot sign a trade kind through it.
  • Teeth: sign_unsigned_refuses_non_allowlisted_kind_directly (the gate's exact probe — a direct sign_unsigned(kind-3402) with no adapter is refused at the actor, and the full trade block 3400/3401/3402/3403/3404/3405/30340; red-on-revert on the actor-side check), adapter_signs_only_allowlisted_kinds (wrapper layer), sign_unsigned_signs_own_and_refuses_foreign_author.
• SellerNode::start_buzz — the boot hook (returns Ok(None) when [buzz] is absent). The mobee sell → node cutover (separate slice) will call it.

Scope discipline

Zero changes to any money-path file (payment.rs, authorize_pay.rs, wallet*.rs, seller.rs, seller_daemon/), to buyer/, or to mcp.rs. No buzz-side/server code. PROTOCOL_VERSION "0" untouched. No machine-readable rate card, no mention-watching/chat-bridge/paste-pay/notary (later slices).

Acceptance evidence

• Items 4 + 5 (all shipped feature combos compile; money-path suite green — the first command IS the money suite, zero changes under wallet/collect/journal): all 5 green on the final tree (rebased on main). cargo test --no-default-features --features gateway,git-delivery,wallet --release → 568 passed · cargo test --features acp,gateway,git-delivery,wallet --release → 575 passed · cargo build --features acp --release · cargo test --features acp --release · cargo build -p mobee --release — all rc0.
• Items 1-3 logic: in-process nostr-relay-builder fixture (buzz_relay_it.rs) — boot publishes a kind-0 fetchable by pubkey with the rate card; a pre-seeded foreign kind-0 makes start_buzz refuse; our own marked kind-0 is replaced; presence beats flow while up and stop on clean shutdown. All green.
• Items 1-3 LIVE (deployed relay, buzzrelay.orveth.dev, admitted demo keys) — both #[ignore] harnesses PASS:
  • live_buzz_kind0_round_trip_against_deployed_relay: NIP-42 auth via the signer actor + kind-0 publish + fetch-back. kind-0 id aa164db1…, about = Rust reviewer · rate 50 sat/job · does: code, test · pays via testnut · hire me on mobee.
  • live_buzz_presence_against_deployed_relay: a live authed WS SUB {kinds:[20001], authors:[persona]} receives the "online" heartbeat while up (2 beats, content "online"), and receives no further beats after a clean shutdown (count stable). The canonical operator snapshot is the relay's NIP-98 POST /query (authors filter, relay-signed response); a WS REQ for an ephemeral hits the DB and returns empty by design.

🤖 Generated with Claude Code

[orveth]

Closing per gudnuf's V1 process ruling (2026-07-27): dev is the single integration line — no parallel open-for-main PRs. This PR's content is fully integrated into dev (verified: branch tip is an ancestor of dev @ 7463cbe), gate-passed and field-validated. Main receives merged integration at gudnuf-paced release cuts, not per-PR. History preserved on the branch and in the gate record; reopen is a git ref away if a release cut needs it isolated.