HTTP research access — independent review handoff

On this page

Review target

Assess the optional HTTP research workflow without treating the Rust experiment as the definition of canonical SkeinNet. The proposed client needs outbound HTTP, JSON tools and optional Ed25519-capable OpenSSL, while an operator runs the node. This review is about the narrow known-node profile, not approval of global scale, public admission fairness or automatic decentralized storage.

Start with HTTP_AGENT_RESEARCH_WORKFLOW.md and the candidate HTTP_CONVERSATION_CONTRACT_V1.md. Consult HTTP_ARTIFACT_ARCHIVE_V1.md for the exact signed-artifact construction. Core remains governed separately by ../spec/core/README.md and ../spec/core/HTTP_ACCESS_PROFILE.md.

Evidence to challenge

Proposition	Evidence	Important limit
Find unknown research from a problem	`RESEARCH_BROAD_DISCOVERY_V1.md`	Four prompted readers, one known node, nine records
Select useful fifth-position evidence	`RESEARCH_SELECTION_V1.md`	Query supplied; one same-model run per cell
Recover an authenticated surviving copy	`RESEARCH_MIRROR_V1.md`	Operator-arranged copy, same provider/account
Refuse altered or wrong-key copies	`RESEARCH_DISHONEST_MIRROR_V1.md`	Explicit saved-pin workflow, three runs
Keep signed instructions from controlling tools/answers	`RESEARCH_SIGNED_CONTENT_V1.md`	Two simple attacks and a control; no general defense
Distinguish invalid/expired requests and continue serving	`HTTP_CONVERSATION_CONTRACT_V1.md` and `results/http-error-contract-v1/`	Reference integration tests, not independent conformance

Retained counterexamples matter: exact-subject discovery missed an unknown title; last-position intervention was unexercised when searches narrowed to one match; one reader confused an observation ID with an artifact locator and inferred absence from HTTP 400. Do not turn successful selections into claims that these issues are solved generally.

Independent work requested

Implement signature and artifact-ID verification from the written contract, without importing the reference helper. Check public positive/negative fixtures in results/research-dishonest-v1/ and valid-content cases in results/research-signed-content-v1/. Report missing details before consulting the Rust implementation.
Review lifecycle ambiguities: write authorization versus lease expiry, receipt retries returning expired references, unknown/expired state, cursor semantics, error compatibility and fresh authorization after an uncertain outcome.
Challenge the trust boundary: how a reader obtains a meaningful saved key pin, handles signed falsehoods, recognizes applicable conditions and locates another copy when a location fails. Signature correctness alone is insufficient.
Propose the smallest additional interoperability cases and any required contract corrections. Record implementation language, commands, exact fixture hashes, expected and actual outputs, and disagreements with the candidate text.

An implementer with a separate codebase provides stronger evidence than another reference-process launch. A separately administered storage operator must control its own keys, policy and failure/recovery decisions; additional Sprites in this account do not meet that criterion. No third party has been contacted or endorsed this candidate.

Reference checks

cargo build --release --locked --features http-experiment --bin skein-http-experiment
python3 scripts/test_http_error_contract.py
python3 scripts/test_http_participation.py --output /tmp/skein-review-new
python3 scripts/test_http_artifacts.py
python3 scripts/test_http_keyword_search.py

Set SKEIN_OPENSSL to an Ed25519-capable OpenSSL for portable shell checks when needed. The artifact regression currently specifies Homebrew OpenSSL and needs path adaptation on other systems. These scripts inspect reference storage and/or use its process conventions; they are not a universal black-box conformance suite.

Promotion requires independent results and resolution of substantive ambiguities. Do not infer a production release, protocol-security proof or global availability from this packet. Resource scaling, full public hostility, replica location and upgrade negotiation remain separate engineering/research tasks.