Trust extension: members double as sources

Trust extension: members double as sources

Nobody can list the world by hand. A permission can adopt what a curator publishes, inherit what a peer is permitted, or follow a relay's operator — one hop, held to both sides' rules.

An issuing permission (example: via curator)

An issuing permission (example: via curator)

In one of the guardian's binding carriers, e.g.:
"extend/npub": [{
  "pubkeys": ["<curator C>"],
  "extend": {
    "via": "curator",
    "map": { "interact/npub": "interact",
             "view/npub": "view" } },
  "profile": { "id": "<profile id>" },
  "monitorRelays": ["wss://…"] }]

Its members are the sources. extend/* members are sources only; on a view or interact permission a member is admitted and can be a source too.
One route per permission: its via (peer or curator) for npub members; relay members always go through their operator.

In one of the guardian's binding carriers, e.g.:"extend/npub": [{"pubkeys": ["<curator C>"],"extend": {"via": "curator","map": { "interact/npub": "interact","view/npub": "view" } },"profile": { "id": "<profile id>" },"monitorRelays": ["wss://…"] }]Its members are the sources. extend/* members are sources only; on aview or interact permission a member is admitted and can be a sourcetoo.One route per permission: its via (peer or curator) for npub members;relay members always go through their operator.

via peer — inherit what a peer is permitted

via peer — inherit what a peer is permitted

via curator — adopt what a curator publishes

via curator — adopt what a curator publishes

a relay member — adopt what the relay's operator publishes

a relay member — adopt what the relay's operator publishes

Peer P
another subject

Peer Panother subject

P's association
17710
public portion only

P's association17710public portion only

P's public guardians

P's public guardians

their open binding carriers for P
37710:G:P

their open bindingcarriers for P37710:G:P

Curator C
any party

Curator Cany party

C's open general carriers
37710:C:<d that is not a subject address>
newest first, at most 16 per author by default

C's open general carriers37710:C:<d that is not a subject address>newest first, at most 16 per author by default

Relay R
a relay member

Relay Ra relay member

operator O
the pubkey in R's NIP-11 document

operator Othe pubkey in R's NIP-11document

O's open general carriers
harvested exactly as a curator's

O's open general carriersharvested exactly as a curator's

The map

selects which of the source's categories flow in, and at which mode:

"interact" kept as is

"view" demoted to view, stripped of routing

absent: not harvested

A view category can never be promoted to interact.

The mapselects which of thesource's categories flow in,and at which mode:"interact" kept as is"view" demoted to view,stripped of routingabsent: not harvestedA view category can neverbe promoted to interact.

Harvested entries

join the subject's construct and behave exactly as entries a guardian wrote: hits, coverage, the sealed channel.
One exception: a harvested relay entry never switches on the relay whitelist.

Each carries provenance: the issuing carrier, the route, the harvested carrier.

A verdict they decide names the layer extension.

Harvested entriesjoin the subject's constructand behave exactly as entriesa guardian wrote: hits,coverage, the sealed channel.One exception: a harvestedrelay entry never switches onthe relay whitelist.Each carries provenance: theissuing carrier, the route, theharvested carrier.A verdict they decide namesthe layer extension.

What a harvested entry carries

What a harvested entry carries

issuing permission's own restrictions

issuing permission'sown restrictions

∧

its profile's

∧

harvested permission's own restrictions

harvested permission'sown restrictions

∧

its profile's

Non-void only where all four allow: inheritance only narrows. A deny in any one voids the entry for that evaluation.
Routing law: the issuing permission's relays route every entry it gives rise to; a harvested entry never brings routing of its own — so no source can redirect where the subject's events go.

Non-void only where all four allow: inheritance only narrows. A deny in any one voids the entry for thatevaluation.Routing law: the issuing permission's relays route every entry it gives rise to; a harvested entry neverbrings routing of its own — so no source can redirect where the subject's events go.

The rules that keep it safe

The rules that keep it safe

• Single hop: harvested permissions arrive with their extension stripped.
• Deny beats harvest: a denied party is never a source, and a carrier it authored contributes nothing.
• A harvested carrier's deny and global sections never enter the subject's gates.
• Live: what a source adds arrives at the next refresh, with no further guardian act.
• Budgets: by default at most 1000 entries per source; breakage in a harvested carrier drops that carrier, never the household's assembly.

• Single hop: harvested permissions arrive with their extension stripped.• Deny beats harvest: a denied party is never a source, and a carrier it authoredcontributes nothing.• A harvested carrier's deny and global sections never enter the subject's gates.• Live: what a source adds arrives at the next refresh, with no further guardian act.• Budgets: by default at most 1000 entries per source; breakage in a harvested carrierdrops that carrier, never the household's assembly.

Choose interact deliberately

Adopting a source at interact gives every npub it names the standing of a direct grant — the sealed channel in both directions included — and keeps doing so as the source adds keys.

The closure is per source, on the extend permission's own profile: {deny,*,*,*,output,opaque} stops sealed sends; add {deny,*,*,*,input,opaque} to stop sealed arrivals.
A helpline in the same catalog is kept private by mirroring it as a direct grant.

Choose interact deliberatelyAdopting a source at interact gives every npub it names the standing of adirect grant — the sealed channel in both directions included — and keepsdoing so as the source adds keys.The closure is per source, on the extend permission's own profile:{deny,*,*,*,output,opaque} stops sealed sends; add{deny,*,*,*,input,opaque} to stop sealed arrivals.A helpline in the same catalog is kept private by mirroring it as a directgrant.

TEPP Zeta · diagram 05 · statements: CONS-012–CONS-057, POL-049–POL-053, POL-088, POL-092, POL-095–POL-107, ASSOC-039, CAPS-020, CAPS-021, TOOL-044, NF-041