Policy is ordinary Nostr events. The kind number is the type and the version: a breaking change is a new kind, never a version field.
Policy is ordinary Nostr events. The kind number is the type and the version: a breaking change is a new kind, never a version field.
Who governs
Who governs
17710 · The association
17710 · The association
author the subject content public guardians as p tags; private guardians NIP-44-encrypted to the subject's own key tagsp · alt rule the newest valid one applies; none valid → unbound: nothing is signed
author the subjectcontent public guardians as p tags; private guardians NIP-44-encrypted to thesubject's own keytags p · altrule the newest valid one applies; none valid → unbound: nothing is signed
replaceable
replaceable
7710 · Open offer
7710 · Open offer
author a current guardian content the offer template: replaces, public — its sealed stays empty tagsexpiration · alt — no p tag: offers are found by author rule proposes the successor association; the subject ratifies or ignores it
author a current guardiancontent the offer template: replaces, public — its sealed stays emptytags expiration · alt — no p tag: offers are found by authorrule proposes the successor association; the subject ratifies or ignores it
regular
regular
7711 · Sealed offer
7711 · Sealed offer
author a current guardian content the same template, NIP-44-encrypted to the subject tagsexpiration · alt rule required whenever the current or the proposed association has a private guardian
author a current guardiancontent the same template, NIP-44-encrypted to the subjecttags expiration · altrule required whenever the current or the proposed association has a privateguardian
regular
regular
What is allowed
What is allowed
Reusable rules
Reusable rules
37710 · Open policy carrier
37710 · Open policy carrier
author a guardian (binding) — or anyone (general) content the policy document: global, deny, permissions tagsd · alt rule binding at 37710:G:S; a general carrier binds nobody directly
author a guardian (binding) — or anyone (general)content the policy document: global, deny, permissionstags d · altrule binding at 37710:G:S; a general carrier binds nobody directly
addressable
addressable
37711 · Sealed policy carrier
37711 · Sealed policy carrier
author a current guardian content the same policy document, NIP-44-encrypted to the subject tagsd · alt — no p tag rule binding at 37711:G:blind(G,S); grants exactly as an open one
author a current guardiancontent the same policy document, NIP-44-encrypted to the subjecttags d · alt — no p tagrule binding at 37711:G:blind(G,S); grants exactly as an open one
addressable
addressable
7712 · Restriction profile
7712 · Restriction profile
author anyone — authorship gives no standing content{"restrictions": [ … ]} — public plaintext tagsalt only: immutable, referenced by its event id rule binds nobody until a carrier references it; can never admit anyone
author anyone — authorship gives no standingcontent {"restrictions": [ … ]} — public plaintexttags alt only: immutable, referenced by its event idrule binds nobody until a carrier references it; can never admit anyone
regular
regular
Where a subject's policy lives
Where a subject's policy lives
Guardian G and subject S
Guardian Gandsubject S
open binding coordinate 37710 : G : S — the d tag is S's pubkey a public statement of the relationship; authoring clients warn
open binding coordinate37710 : G : S — the d tag is S's pubkeya public statement of the relationship; authoring clients warn
sealed binding coordinate 37711 : G : blind(G,S) blind = hex(SHA-256("tepp-sealed-policy-addr" ‖ convkey(G,S)))[0..32] only G and S can compute it; to anyone else it is noise
sealed binding coordinate37711 : G : blind(G,S)blind = hex(SHA-256("tepp-sealed-policy-addr" ‖ convkey(G,S)))[0..32]only G and S can compute it; to anyone else it is noise
A carrier binds S if and only if its author is a current guardian of S and it sits at one of those two addresses. So the subject knows exactly where to look: at most two coordinates per guardian, computable in advance.
A withheld carrier is not silence. On first load, if every counting relay answers, none returns a carrier and nothing is stored, the coordinate is known-missing — a conclusive outcome. A carrier already held is never removed by silence.
A carrier binds Sif and only if its author is a current guardian of S and it sits at one ofthose two addresses. So the subject knows exactly where to look: atmost two coordinates per guardian, computable in advance.A withheld carrier is not silence. On first load, if every counting relayanswers, none returns a carrier and nothing is stored, the coordinateis known-missing — a conclusive outcome. A carrier already held isnever removed by silence.
Strict by design Every TEPP event's tags are an allow-list, and TEPP's own JSON payloads are parsed strictly: an unknown key, a duplicate key or a null invalidates the payload — loudly.
A keyless client, which cannot compute blind(G,S), learns the sealed address once by trial decryption through its signer.
A carrier is retired by republishing {} at its coordinate.
Strict by designEvery TEPP event's tags are an allow-list, and TEPP's own JSONpayloads are parsed strictly: an unknown key, a duplicate key or a nullinvalidates the payload — loudly.A keyless client, which cannot compute blind(G,S), learns the sealedaddress once by trial decryption through its signer.A carrier is retired by republishing {} at its coordinate.