Restriction profiles: rules as reusable values
Restriction profiles: rules as reusable values
A profile (kind 7712) is an immutable, content-addressed event that carries restriction entries and nothing else. Only carriers bind; profiles are vocabulary.
A profile (kind 7712) is an immutable, content-addressed event that carries restriction entries and nothing else. Only carriers bind; profiles are vocabulary.
A restriction profile
A restriction profile
kind 7712 · regular · tags: alt only
{"restrictions": [ … ]}

Immutable: its id is the hash of its bytes, so a reference pins exact content. Changing a rule means a new profile and an edited carrier.
No standing: anyone may publish one — a throwaway key is fine. The guardian whose carrier adopts it answers for it, and the trace names that carrier.
Shape only: kinds, schedules, direction, opacity and the one demand. No npubs, no hashtags — so a profile can never admit anyone, and never undo a deny.
Public plaintext: every rule that binds through a profile is readable by anyone. No secret law.
kind 7712 · regular · tags: alt only{"restrictions": [ … ]}Immutable: its id is the hash of its bytes, so a reference pins exactcontent. Changing a rule means a new profile and an edited carrier.No standing: anyone may publish one — a throwaway key is fine.The guardian whose carrier adopts it answers for it, and the tracenames that carrier.Shape only: kinds, schedules, direction, opacity and the onedemand. No npubs, no hashtags — so a profile can never admitanyone, and never undo a deny.Public plaintext: every rule that binds through a profile is readableby anyone. No secret law.
On a permission: grant-scoping
On a permission: grant-scoping
"profile": {"id": "…", "relays": […]} on one permission
Its entries form one more restriction set of that permission's entries: both the permission's own set and the profile's must allow. It only narrows that grant.
Unresolvable → the permission is inert: it grants nothing until the profile resolves.
"profile": {"id": "…", "relays": […]} on one permissionIts entries form one more restriction set of that permission's entries: both the permission'sown set and the profile's must allow. It only narrows that grant.Unresolvable → the permission is inert: it grants nothing until the profile resolves.
In the global set: restriction-driving
In the global set: restriction-driving
{"profile": {"id": "…", "relays": […]}} as a global entry
Its entries join the global set as if written inline: deny entries hold against everything; allow entries union with every other guardian's, so the widest whitelist applies.
Unresolvable → not loaded: the restriction lapses, visibly, and the guardians are told.
{"profile": {"id": "…", "relays": […]}} as a global entryIts entries join the global set as if written inline: deny entries hold against everything; allowentries union with every other guardian's, so the widest whitelist applies.Unresolvable → not loaded: the restriction lapses, visibly, and the guardians are told.
How a reference resolves
How a reference resolves
1 Fetch by exact event id from the subject's own discovery relays.
2 Only if that yields nothing: try the reference's relay hints, in order.
Hints first would turn the guardian's relay into an adoption beacon.
3 Keep a copy only if its recomputed id matches and its signature verifies.
4 Parse it strictly: an unknown key or a stray tag makes it unresolvable.
5 Resolved once, resolved for good: the bytes behind an id can never change.

Composition: a profile never references another profile. Profiles compose by authoring a flattened composite, so resolution is always exactly one step deep.
Availability: adopters, not authors, keep a profile available — guardian tooling mirrors it to the relays of every carrier that references it.
1 Fetch by exact event id from the subject's own discovery relays.2 Only if that yields nothing: try the reference's relay hints, in order.Hints first would turn the guardian's relay into an adoption beacon.3 Keep a copy only if its recomputed id matches and its signature verifies.4 Parse it strictly: an unknown key or a stray tag makes it unresolvable.5 Resolved once, resolved for good: the bytes behind an id can never change.Composition: a profile never references another profile. Profiles compose by authoring a flattenedcomposite, so resolution is always exactly one step deep.Availability: adopters, not authors, keep a profile available — guardian tooling mirrors it to the relaysof every carrier that references it.
The starter library: six profiles shipped with the specification
The starter library: six profiles shipped with the specification
profile
profile
shape
shape
what it decides
what it decides
cohort-age-13
cohort-age-13
cohort
cohort
Allows kinds 1, 20, 1063, 1111, 9802 — the signer tags them ["-"] (NIP-70) — and 13 more without the demand (housekeeping, reactions, messaging…). Regime 4 closes the rest.
Allows kinds 1, 20, 1063, 1111, 9802 — the signer tags them ["-"] (NIP-70) — and 13more without the demand (housekeeping, reactions, messaging…). Regime 4 closesthe rest.
school-night-curfew
school-night-curfew
modifier
modifier
Everything closed Sun–Thu 22:00–24:00 and Mon–Fri 00:00–06:30.
Everything closed Sun–Thu 22:00–24:00 and Mon–Fri 00:00–06:30.
school-hours-quiet
school-hours-quiet
modifier
modifier
No signing Mon–Fri 08:30–15:30 — a client's relay AUTH included.
No signing Mon–Fri 08:30–15:30 — a client's relay AUTH included.
sealed-sending-curfew
sealed-sending-curfew
modifier
modifier
No private messages sent Sun–Thu from 21:00; receiving is fine.
No private messages sent Sun–Thu from 21:00; receiving is fine.
no-longform-publishing
no-longform-publishing
modifier
modifier
Never sign a long-form article (kind 30023); reading stays open.
Never sign a long-form article (kind 30023); reading stays open.
age-13-school-household
age-13-school-household
composite
composite
The five above, flattened into one immutable profile.
The five above, flattened into one immutable profile.
Cohort: allow-shaped, so a complete policy. Modifier: deny-shaped, so partial. A household composes one cohort with any number of modifiers.
Two cohorts would widen each other, not intersect: allow entries union.
Cohort: allow-shaped, so a complete policy. Modifier: deny-shaped, so partial. A household composes one cohort with any number of modifiers.Two cohorts would widen each other, not intersect: allow entries union.
A week under the composite
A week under the composite
Mon
Mon
Tue
Tue
Wed
Wed
Thu
Thu
Fri
Fri
Sat
Sat
Sun
Sun
00:00
00:00
06:00
06:00
12:00
12:00
18:00
18:00
24:00
24:00
everything closed — curfew
everything closed — curfew
no signing — school hours
no signing — school hours
no private messages sent
no private messages sent
Long-form publishing is closed at every hour; kinds the cohort does not name are closed at every hour by regime 4. A day's window is matched against the instant's own weekday — which is why the curfew is two entries.
Long-form publishing is closed at every hour; kinds the cohort does not name are closed at every hour by regime 4. A day's window ismatched against the instant's own weekday — which is why the curfew is two entries.
TEPP Zeta · diagram 09 · statements: PROF-001–PROF-040, TERM-021, EVT-007, POL-089–POL-091, CONS-044, NF-027–NF-038, TOOL-020–TOOL-025 · profiles/README.md
TEPP Zeta · diagram 09 · statements: PROF-001–PROF-040, TERM-021, EVT-007, POL-089–POL-091, CONS-044, NF-027–NF-038, TOOL-020–TOOL-025 · profiles/README.md