ohstr · naliyi · Sep 4, 2026 · Sep 4, 2026 · Sep 4, 2026 · Sep 4, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,15 @@
 # Changelog
 
+## [Unreleased]
+
+### Fixed
+
+- `apply stream`/`sync` no longer silently drop an event at the destination
+  relay just because its `nonce` tag overclaims its NIP-13 difficulty --
+  regardless of `strictPow`/`--strict-pow`, since that setting only ever
+  governed ncli's own read-side check, never the relay's. Bumps
+  `github.com/ohstr/nmilat` to v0.2.7, which fixes this on the relay side.
+
 ## [0.4.5]
 
 ### Added

diff --git a/README.md b/README.md
@@ -232,13 +232,14 @@ ncli find --search "jack" -k 1 -l 5 -s localhost:5500
 ```
 
 Require NIP-13 proof-of-work on published events with a `pow:` block —
-`min: 0` (the default) accepts everything; a non-zero `min` is advertised to
-clients via NIP-11 either way, and `strict: true` is what actually turns on
-rejecting events that fall short:
+`min: 0` (the default) accepts everything, even a lying `nonce` tag; a
+non-zero `min` is advertised via NIP-11 either way, and `strict: true` is
+what actually rejects events, both under-difficulty ones and ones whose
+`nonce` tag doesn't match reality:
 
 ```yaml
 pow:
-  strict: false # true rejects under-difficulty events; false just advertises min
+  strict: false # true rejects under-difficulty and self-contradictory nonce tags
   min: 20       # required leading-zero-bit difficulty; 0 = no requirement
 ```
 
@@ -509,14 +510,14 @@ composes-into-CI/scripts convention as `miner check`.
 [`examples/apply/`](examples/apply/) — the snippets below are trimmed to
 the essentials.
 
-`--strict-pow` is a flag on `apply` (default `false`) that applies to both
-`stream` and `sync`: since NIP-13 proof-of-work is optional per event, an
-untrusted event with a `nonce` tag that doesn't meet its declared
-difficulty is accepted by default, same as one with no `nonce` tag at all.
-Enable strict checking either via the flag or the spec's own `strictPow:
-true` field (both kinds support it) to reject it instead — the flag, when
-passed explicitly, overrides whatever the spec file says. A `trusted: true`
-flow is never subject to this check either way.
+`--strict-pow` (default `false`) makes `apply` reject an untrusted event
+whose `nonce` tag doesn't meet its declared PoW difficulty, instead of
+accepting it — settable via the flag or the spec's own `strictPow: true`
+field, flag wins when passed explicitly.
+
+See [`skills/ncli-apply/SKILL.md`](skills/ncli-apply/SKILL.md) for the full
+walkthrough, including `trusted: true` exemptions and relay-side PoW
+enforcement.
 
 **`stream`** — tail events live, forwarding everything matching `filters`
 from every `from` flow to every `to` flow until interrupted (any number of

diff --git a/go.mod b/go.mod
@@ -1,6 +1,6 @@
 module github.com/ohstr/ncli
 
-go 1.26.1
+go 1.26.8
 
 require (
 	github.com/btcsuite/btcd/btcec/v2 v2.3.4
@@ -69,7 +69,7 @@ require (
 	github.com/charmbracelet/bubbles v1.0.0
 	github.com/charmbracelet/bubbletea v1.3.10
 	github.com/charmbracelet/lipgloss v1.1.0
-	github.com/ohstr/nmilat v0.2.5
+	github.com/ohstr/nmilat v0.2.7
 	golang.org/x/sync v0.20.0
 	golang.org/x/sys v0.45.0
 	golang.org/x/term v0.43.0

diff --git a/go.sum b/go.sum
@@ -89,8 +89,8 @@ github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELU
 github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo=
 github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc=
 github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
-github.com/ohstr/nmilat v0.2.5 h1:Gza6dDyPP+6VIoZSVd9WfSYl3VH65eEqaPm0znu3APs=
-github.com/ohstr/nmilat v0.2.5/go.mod h1:jWIyGhWgCuWv+cDZ0hdivvCmYjSh8bTxnk54NxXtqvA=
+github.com/ohstr/nmilat v0.2.7 h1:i+pt8Kd8TBqYW7MgQjqGU8jRgMF4ChnSJnVc2d2uL0w=
+github.com/ohstr/nmilat v0.2.7/go.mod h1:+6B0CT40RAJmnZESl1sBukc07RkdyPn5/EQ8ROVof0Y=
 github.com/pelletier/go-toml/v2 v2.2.3 h1:YmeHyLY8mFWbdkNWwpr+qIL2bEqT0o95WSdkNHvL12M=
 github.com/pelletier/go-toml/v2 v2.2.3/go.mod h1:MfCQTFTvCcUyyvvwm1+G6H/jORL20Xlb6rzQu9GuUkc=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=

diff --git a/skills/ncli-apply/SKILL.md b/skills/ncli-apply/SKILL.md
@@ -43,6 +43,11 @@ Failures counter); for `sync` it's silently dropped from the pulled batch
 `trusted: true` flow is never subject to this check, regardless of
 `strictPow` — same as it already skips signature verification.
 
+`strictPow` only governs `apply`'s own read-side check — it has no bearing
+on what a `to` relay decides once `apply` forwards the event. A relay you
+don't control can still reject it on its own terms, no matter what
+`strictPow` is set to here.
+
 | kind | what it does | writes anything? |
 |---|---|---|
 | `stream` | Tails live events matching `filters` from every `from` flow to every `to` flow, until interrupted | Yes, continuously |