Admission policy review

7 September 2026: optional HTTP access proposal advanced

The user accepted advancing the isolated HTTP access experiment into a proposed optional profile. HTTP_ACCESS_PROFILE.md now defines H- requirements for binary Beacon encoding, HTTP carriage, scoped admission, retention separation and pinned recovery. This advances specification review; it does not activate a network upgrade, replace Object v1 or promote experimental retention caps into global requirements.

Rationale: shell-only clients can publish signed fractional embeddings without a Skein runtime. Explicit binary32 bytes remove the Rust/JSON float-format dependency. The descriptor domain and pinned ledger format prevent cross-version reinterpretation. Existing claim bytes, default authentication choices and the frozen semantic control remain unchanged. Binary operation requires explicit opt-in and strict authentication.

Evidence: 23 valid and 226 negative codec cases; 41 library and 40 legacy integration tests; shell publication, retry/restart, format isolation and finite hostile traffic. At test difficulty one, distinct valid keys still filled the open-cost retention lane. This result remains a limitation. No public HTTP deployment or independent authorship is claimed. Full endpoint conformance, independent review, public transport resource evidence and an HTTP conversation lifecycle remain gates. See experiments/http-participation/BINARY_ADMISSION.md for the recorded branch results.

7 September 2026: strict authentication candidate tested

STRICT_AUTH_PROFILE.md defines an explicit narrower acceptance rule with canonical, non-identity prime-subgroup A/R and canonical S. This is a candidate profile for integration, not an implicit amendment of deployed version-1 acceptance. Its isolated guard passes normal vectors and rejects the observed weak envelopes. See docs/STRICT_AUTH_RESULTS_V1.md. Native dependency selection, pinned profile identity, restored-state compatibility and cross-plane scope remain adoption gates.

7 September 2026: public service model accepted

The user accepted best-effort permissionless exploration as the global service model, with stronger guarantees confined to explicit conditional deployment profiles. Added C-SERVICE-01 and clarified Core section 1; existing requirement IDs and wire bytes are unchanged. This is a documentation/conformance-claim requirement, not a new admission operation. No deployed version negotiation is implied.

Reason: native experiments show that content grouping, supplied provenance and separate accounting cannot provide unconditional newcomer discovery under unlimited hostile eligibility. Best effort still requires published bounded-workload utility and operational evidence before readiness claims. Prior failed targets remain failed. See docs/PUBLIC_DISCOVERY_SERVICE_CONTRACT_V1.md. No split-ledger or cap experiment is promoted. Independent implementation, review and stronger progress profiles remain open. The earlier policy review is preserved below.

Review record · 5 September 2026 · experimental choices, not Core requirements

Immutable epoch slots: retain as a profile

X-SLOTS assigns each sponsorship credential slot to one descriptor claim for its entire epoch. Repeating that claim at replicas or retrying retention is idempotent. A rejected retention attempt does not release its allocation. A slot grants permission to compete; it never obliges a node to store or retrieve the descriptor.

This is simpler to audit than a reusable active-claim allowance: reuse would need an explicit retirement rule and a way to distinguish delayed old allocations from current ones. The cost is reduced flexibility for honest publishers whose content changes. Keep immutable slots in the experimental profile; do not require every future eligibility mechanism to use them. Credential slots remain distinct from storage capacity and from recipient attention budgets.

Equivocation quarantine: retain as a profile

X-CONFLICT treats two authenticated, differently bound claims for the same credential slot as beneficiary equivocation. Both allocations become unusable at a node that durably learns the evidence. Neither arrival order nor hash ordering selects a winner. The evidence requires two signed allocations, not proof that both descriptors were published or retained.

Quarantine is slot-local. It does not establish sponsor guilt, revoke unrelated credentials, retract attention already delivered, or erase history. A stolen beneficiary key can deliberately poison its slots. Before evidence delivery, partitioned honest replicas can each accept a different allocation; there is no global exclusivity guarantee. Conditional convergence requires valid evidence to reach and be committed by each relevant node before expiry.

Saturation: do not promote the current default

X-SATURATION currently makes every sponsored receipt unusable when a node's bounded conflict registry fills. Open-cost claims remain separate. This preserves a fail-closed accounting boundary, but an attacker with enough valid conflicting allocations can silence unrelated sponsored traffic. It is not an acceptable basis for claiming availability under sponsor capture. Preserve the implementation and its saturation test as the control, not a recommended universal policy.

The next comparison should test an isolated-capacity design: reserve space for a possible tombstone whenever a local sponsored allocation is accepted, and bound unsolicited evidence separately. Exhaustion should refuse new allocations rather than disable unrelated clean receipts. Evidence affecting existing allocations must still have its reserved path. An opt-in implementation now exists; see docs/RESERVED_CAPACITY_V1.md. The default policy remains the control.

Before implementation, specify reservation release, evidence deduplication, restart persistence, epoch rollover, and validation CPU limits. Measure honest and newcomer retention, unrelated receipt availability, memory, and recovery under identical adversarial schedules. Reserving memory alone does not solve signature verification floods, disk failure, eclipsing, or exhausted honest capacity.

Review disposition and next gate

Retain X-SLOTS and X-CONFLICT only for a named experimental profile. Reject blanket sponsored suspension as the default availability policy. Keep X-SATURATION behavior unchanged until a matched replacement experiment is specified and tested.

The signed-claim profile defines portable envelope bytes independently of these choices. Full descriptor encoding, authorization transitions, bounded evidence delivery, and cross-language cryptographic edge cases remain review blockers. No claim of Sybil resistance, production readiness, or complete Core conformance follows from this review. The frozen discovery control remains unchanged.