docs(nips): allow relay-bounded agent ownership chains

[tlongwell-block]

Summary

Allow agents to authorize child agents using existing NIP-OA credentials, with NIP-AA admission bounded by a relay-configurable ownership depth.

• NIP-OA: allow agent owners and discoverable endorsements on signed kind:0 profiles. No new event kind, tag field, signing preimage, or credential format.
• NIP-AA: resolve the ownership chain to an independently admitted, active non-agent root. Count ownership edges: human → agent is depth 1. Default n=1; n=0 disables virtual admission; operators explicitly enable deeper chains.
• Reject missing/invalid ancestry, cycles, local disablement, depth/work exhaustion, and conditional intermediate endorsements. Known agents cannot skip ancestry validation through explicit membership or omitted profiles.
• Keep leaf credential condition handling and actor-key resource permissions unchanged. Retain the verified path in session state; update revocation, root quota aggregation, privacy wording, and admission examples consistently.

Deliberate tradeoffs

Enabling n>1 lets existing unconditional endorsements sponsor descendants without a new root signature. Intermediate endorsements must have empty conditions rather than introducing condition-composition semantics. This supplies neither signed per-agent delegation budgets nor immutable parent-path binding/global revocation. Profile changes affect the next authentication, not an established session's retained path; immediate revocation still requires disconnecting affected sessions.

The direct-membership bypass is removed for known agents even at n=1; relay classification must survive missing profiles. This is a normative spec change, not a claim of backward-compatible runtime behavior.

Docs only: no relay/client implementation, config variable, provisioning UI, or executable formal model is included.

Related issue

Related: #7003 — a smaller recursive-lookup alternative using the existing OA/AA wire format, rather than introducing immutable grant-chain events. Does not close or modify that PR.

Testing

• Reviewed both complete specifications and walked direct admission, depth 0/1/2, over-depth, cycles, missing/malformed profiles, intermediate conditions, direct-member bypass, root removal, ancestor disablement, and session replacement semantics.
• git diff --check passed; original OA credential rules/test-vector bytes and AA Step 4 verified unchanged; JSON code examples parse; new relative link target/heading checked.
• Pre-commit and pre-push hooks passed (docs-only paths skip code lanes; differential file-size gate passed).
• Required just ci failed during test-unit in unchanged buzz-acp test acp::tests::keepalive_resets_idle_past_deadline: “keepalive should reset idle past the deadline; elapsed only 162.263917ms”. That lane stopped after 76/899 tests; later CI recipes did not run. Run was on base 70895b355fcea9f99894b426c020052b715bd368 with the docs patch; final wording clarifications followed. No green full-suite claim.
• New chain examples are prose expectations, not executable protocol tests or formal proofs. Runtime conformance testing belongs with implementation.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 70895b355fcea9f99894b426c020052b715bd368...38d39e82a88e79a027be76b508c473a6ecc30369.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 38d39e82a88e79a027be76b508c473a6ecc30369 to authorize a new review.
Any previous review applies only to its recorded range.