Consent: guardians define, the subject ratifies
Consent: guardians define, the subject ratifies
Inside the regime, the guardian set changes only when the subject signs the association a current guardian offered — mutual consent as two ordinary signatures.
Inside the regime, the guardian set changes only when the subject signs the association a current guardian offered — mutual consent as two ordinary signatures.
A current guardian
A current guardian
Relays
Relays
The subject's signer (the engine)
The subject's signer (theengine)
The subject
The subject
Offer
Publishes an open (7710) or sealed (7711) offer: the successor association, as a template.
An expiration is recommended.
OfferPublishes an open (7710) orsealed (7711) offer: thesuccessor association, as atemplate.An expiration isrecommended.
1
1
the counting subset of the subject's discovery relays
where offers are published, polled and the ratified association is posted
the counting subset of the subject's discovery relayswhere offers are published, polled and the ratified association is posted
Poll
One query by author over the current guardians. Sealed offers are trial-decrypted.
Offers are never cached: each prompt, and each 17710 sign request, polls afresh.
PollOne query by author over thecurrent guardians. Sealedoffers are trial-decrypted.Offers are never cached: eachprompt, and each 17710 signrequest, polls afresh.
2
2
Validate
Seven checks (below). Only a validated, outstanding offer goes further.
An offer not addressed to this subject is skipped silently.
ValidateSeven checks (below). Only avalidated, outstanding offergoes further.An offer not addressed to thissubject is skipped silently.
3
3
Prompt
The subject sees a legible diff: who would join, who would leave.
Ignoring it changes nothing.
PromptThe subject sees a legible diff:who would join, who wouldleave.Ignoring it changes nothing.
4
4
Ratify
The subject asks to sign a 17710. It counts only if it maps exactly onto the offer; the offer covers the guardians it names, the rest is evaluated as usual.
Otherwise: deny · unmatched · no-offer
RatifyThe subject asks to sign a17710. It counts only if it mapsexactly onto the offer; the offercovers the guardians itnames, the rest is evaluatedas usual.Otherwise: deny · unmatched· no-offer
5
5
Settle
Signed and published. Once the new association applies, this offer and every racing offer are spent.
The newest valid association applies at every locus.
SettleSigned and published. Oncethe new association applies,this offer and every racingoffer are spent.The newest valid associationapplies at every locus.
6
6
publish
publish
poll by author
poll by author
validated
validated
the subject agrees and signs
the subject agrees and signs
publish
publish
The offer template
The offer template
{ "replaces": "<id of the current association>",
  "public":   [ ["p", "<guardian 1>", "wss://…"] ],
  "sealed":   [ ["p", "<guardian 2>"] ] }

Ratifying it means signing exactly this: the public items as p tags, the sealed items encrypted to the subject's own key, a created_at later than the association it replaces.
An open offer carries the template in plain JSON and may not define sealed guardians; a sealed offer carries it encrypted to the subject.
{ "replaces": "<id of the current association>","public": [ ["p", "<guardian 1>", "wss://…"] ],"sealed": [ ["p", "<guardian 2>"] ] }Ratifying it means signing exactly this: the public items as p tags, the sealed itemsencrypted to the subject's own key, a created_at later than the association it replaces.An open offer carries the template in plain JSON and may not define sealed guardians;a sealed offer carries it encrypted to the subject.
The seven validation checks
The seven validation checks
1 the author is a current guardian
2 replay guard: replaces names the current association
3 not expired, by the signer's own clock
4 the resulting set is valid: at least one guardian, no duplicates, not the subject
5 an open offer defines no sealed guardians
6 no proposed guardian matches a deny gate — checked before the subject is asked
7 a subject with private guardians is re-associated through sealed offers only
1 the author is a current guardian2 replay guard: replaces names the current association3 not expired, by the signer's own clock4 the resulting set is valid: at least one guardian, no duplicates, not the subject5 an open offer defines no sealed guardians6 no proposed guardian matches a deny gate — checked before the subject is asked7 a subject with private guardians is re-associated through sealed offers only
What holds it together
What holds it together
• Any single current guardian may propose any successor; only the subject's signature changes the set.
• No elevation window: nothing but a request that maps onto a validated offer is a ratification.
• No valid association means unbound: the signer signs nothing and every evaluation denies.
• A high-water mark blocks rollback: an older association never displaces a newer one the locus has seen.
• The founding association, and any exit, lie outside the engine: whoever holds the key can sign a newer one — a loud, public, timestamped act.
• Any single current guardian may propose any successor; only the subject's signature changesthe set.• No elevation window: nothing but a request that maps onto a validated offer is a ratification.• No valid association means unbound: the signer signs nothing and every evaluation denies.• A high-water mark blocks rollback: an older association never displaces a newer one the locushas seen.• The founding association, and any exit, lie outside the engine: whoever holds the key can signa newer one — a loud, public, timestamped act.
TEPP Zeta · diagram 04 · statements: CERE-001–CERE-047, ASSOC-018–ASSOC-022, ASSOC-037, ASSOC-038, NF-008, NF-011, NF-013
TEPP Zeta · diagram 04 · statements: CERE-001–CERE-047, ASSOC-018–ASSOC-022, ASSOC-037, ASSOC-038, NF-008, NF-011, NF-013