Ten steps turn what a locus has stored — its known world — into one construct. What cannot be loaded is left out and reported; only a contradiction refuses.
Ten steps turn what a locus has stored — its known world — into one construct. What cannot be loaded is left out and reported; only a contradiction refuses.
The known worldthe locus's durable storeassociationsbinding carriersreferenced listsresolved profilesharvested materialNIP-11 operators
The association Resolve and verify it; the newest valid one applies. None valid → unbound.
The associationResolve and verify it; the newest valid one applies. None valid → unbound.
1
1
The guardians One implied guardian entry per guardian — interact, npub, the guardian — written by no one.
The guardiansOne implied guardian entry per guardian — interact, npub, the guardian —written by no one.
2
2
The binding carriers Each guardian's open and sealed coordinate: verify, decrypt, size-check, parse strictly, check the anti-rollback mark.
The binding carriersEach guardian's open and sealed coordinate: verify, decrypt, size-check, parsestrictly, check the anti-rollback mark.
3
3
Gates and global set Union every carrier's deny gates and global entries; read deny lists; resolve restriction-driving profiles; no deny may name a guardian.
Gates and global setUnion every carrier's deny gates and global entries; read deny lists; resolverestriction-driving profiles; no deny may name a guardian.
4
4
Admission Merge every carrier's permissions 1-of-N. Fix who is ineligible as a source: deny beats harvest.
AdmissionMerge every carrier's permissions 1-of-N. Fix who is ineligible as a source: denybeats harvest.
5
5
Members Resolve direct members and list references, one level deep.
MembersResolve direct members and list references, one level deep.
6
6
Grant-scoping profiles Resolve each directly-written permission's profile.
Grant-scoping profilesResolve each directly-written permission's profile.
7
7
Extension Harvest from every source by its route, through its map, within its budget — one hop.
ExtensionHarvest from every source by its route, through its map, within its budget — onehop.
8
8
Audit Report inert permissions, dead demands and a severed household channel. Advisory: it changes nothing.
AuditReport inert permissions, dead demands and a severed household channel.Advisory: it changes nothing.
9
9
The remaining caps Total construct size, then total deny entries.
The remaining capsTotal construct size, then total deny entries.
10
10
The construct
entries implied guardian entries first; then guardian by guardian, open carrier before sealed, in a fixed canonical order
deny gates every deny value with the carrier that lists it
the global set one restriction set
Swapped in atomically as an immutable snapshot after every change to the store. The construct in use always equals a full assembly.
The constructentriesimplied guardian entries first; thenguardian by guardian, open carrier beforesealed, in a fixed canonical orderdeny gatesevery deny value with the carrier that listsitthe global setone restriction setSwapped in atomically as an immutablesnapshot after every change to the store.The construct in use always equals a fullassembly.
The loading rule — what cannot be loaded is absent, and said so
The loading rule — what cannot be loaded is absent, and said so
A carrier, list or profile that cannot be fetched or verified is simply not in this construct. It carries an unloaded finding: • surfaced to the subject at once; • retried at every refresh tick; • delivered to every guardian once it has stood 24 hours (the default), and again each further period, over the household channel.
On the grant side a failed load only narrows: an unloadable list or profile leaves its permission inert. On the deny side it is an accepted, reported risk: a deny list that has not loaded is absent until it loads — a denied party still needs a grant to get in. A silent gap — a drop that emits no finding where one is due — is a conformance failure.
A carrier, list or profile that cannot be fetched or verified is simply not in this construct. It carries an unloaded finding:• surfaced to the subject at once;• retried at every refresh tick;• delivered to every guardian once it has stood 24 hours (the default), and again each further period, over the household channel.On the grant side a failed load only narrows: an unloadable list or profile leaves its permission inert. On the deny side it is an accepted,reported risk: a deny list that has not loaded is absent until it loads — a denied party still needs a grant to get in.A silent gap — a drop that emits no finding where one is due — is a conformance failure.
Refusal — for five contradictions and nothing else
Refusal — for five contradictions and nothing else
1
1
no valid association
no valid association
unbound · absent | invalid
unbound · absent | invalid
2
2
a regression below an anti-rollback mark
a regression below an anti-rollback mark
refusal · regression
refusal · regression
3
3
a deny gate naming a current guardian
a deny gate naming a current guardian
refusal · guardian-denied
refusal · guardian-denied
4
4
malformed content in a binding carrier
malformed content in a binding carrier
refusal · malformed
refusal · malformed
5
5
an integrity cap breached — deny or binding side
an integrity cap breached — deny or binding side
refusal · cap
refusal · cap
Under unbound or a refusal the signer signs nothing, and every evaluation, in both directions, is deny. Staleness is never a refusal: an offline household keeps enforcing what it holds, visibly aged. The engine may still authenticate to relays to load policy.
Under unbound or a refusal the signer signs nothing, and every evaluation, in both directions, is deny.Staleness is never a refusal: an offline household keeps enforcing what it holds, visibly aged. The engine may still authenticate to relaysto load policy.