Output evaluation: may the subject sign this?
Output evaluation: may the subject sign this?
At the subject's signer, in a fixed order; the first failure decides. What the subject names must resolve and be covered, and nothing denied that the sweep reaches may be amplified.
At the subject's signer, in a fixed order; the first failure decides. What the subject names must resolve and be covered, and nothing denied that the sweep reaches may be amplified.
Inputs: the construct snapshot · the unsigned request · the instant · the destination set the client supplies · for encrypted requests, optionally a disclosure of the counterparty
Inputs: the construct snapshot · the unsigned request · the instant · the destination set the client supplies · for encrypted requests, optionally a disclosure of the counterparty
Sanity
The request is under the subject's own key — or it is refused outright, with no verdict.
SanityThe request is under thesubject's own key — or it isrefused outright, with noverdict.
1
1
Reduction
Encrypted? Establish the counterparty, recover the surface. It must reduce.
ReductionEncrypted? Establish thecounterparty, recover thesurface. It must reduce.
2
2
The gate
The global set for output, at every kind; the layer-0 deny check, relay tags included.
The gateThe global set for output, atevery kind; the layer-0 denycheck, relay tags included.
3
3
The deny sweep
Fetch what it references, then what those reference — any deny reached denies.
The deny sweepFetch what it references,then what those reference —any deny reached denies.
4
4
Coverage
Every element covered by a non-void interact entry — or by the subject's own authorship.
CoverageEvery element covered by anon-void interact entry — orby the subject's ownauthorship.
5
5
The one edit
If a demanding allow entry matched: append NIP-70's ["-"] tag. Never denies.
The one editIf a demanding allow entrymatched: append NIP-70's["-"] tag. Never denies.
6
6
Destinations
No denied relay; within the relay whitelist where one is active.
DestinationsNo denied relay; within therelay whitelist where one isactive.
7
7
REFUSED
no verdict · transport error
REFUSEDno verdict · transport error
DENY
opaque · unverifiable
DENYopaque · unverifiable
DENY
global · blocklist
DENYglobal · blocklist
DENY
blocklist · global · unresolved
DENYblocklist · global · unresolved
DENY
unmatched — names the element
DENYunmatched — names the element
DENY
destination
DENYdestination
PERMIT
signed · trace layer covered
PERMITsigned · trace layer covered
A kind-17710 request is checked, right after sanity, for being a ratification of an offer; one that is not is deny · unmatched · no-offer.
A kind-17710 request is checked, right after sanity, for being a ratification of anoffer; one that is not is deny · unmatched · no-offer.
What must be covered
What must be covered
A person it names — a p or P tag, an npub in the text, the counterparty of a private message: an interact grant on that npub.
An event it references — e, q, a, a note or address in the text: an interact grant on that exact event, or on its author, or the event is the subject's own.

• A view grant never covers anything on output.
• Every guardian is covered by being a guardian.
• A ratified offer covers the guardians it names, for that one act.
The subject's own key is never an element; a request that names nothing is covered vacuously.
A person it names — a p or P tag, an npub in the text, the counterparty of a private message:an interact grant on that npub.An event it references — e, q, a, a note or address in the text: an interact grant on that exactevent, or on its author, or the event is the subject's own.• A view grant never covers anything on output.• Every guardian is covered by being a guardian.• A ratified offer covers the guardians it names, for that one act.The subject's own key is never an element; a request that names nothing is coveredvacuously.
Example: the subject replies in a thread
Example: the subject replies in a thread
element of a reply
element of a reply
covered by
covered by
here
here
F's note (e tag)
F's note (e tag)
interact/npub on its author F
interact/npub on its author F
✓
✓
F (p tag)
F (p tag)
interact/npub on F
interact/npub on F
✓
✓
X (p tag, a stranger in the thread)
X (p tag, a stranger in the thread)
nothing
nothing
✗
✗
npub1…Y in the text
npub1…Y in the text
interact/npub on Y
interact/npub on Y
✓
✓
deny · unmatched — naming X. The subject can ask a guardian for a grant on X, or send a reply that does not name X.
deny · unmatched — naming X. The subject can ask a guardian for a grant on X, or send a reply that does notname X.
Why so strict?
Why so strict?
A tag in a signed event is an act: clients notify everyone tagged, and relays index it.

So the subject answers for every element under its signature — and never amplifies denied material the sweep reaches, by default up to 16 references deep.

Encrypted or not makes no difference: a private message needs exactly what a public mention needs — a household can only narrow that, by restriction.
A tag in a signed event is an act: clients notify everyonetagged, and relays index it.So the subject answers for every element under its signature— and never amplifies denied material the sweep reaches, bydefault up to 16 references deep.Encrypted or not makes no difference: a private messageneeds exactly what a public mention needs — a household canonly narrow that, by restriction.
The deny sweep
The deny sweep
Follows references recursively — by default up to depth 16 — deny-checking every event it reaches.
Layer 0 is fatal: what the subject itself names must resolve and verify in time — or nothing is signed (unresolved).
Beyond layer 0: a branch that cannot be followed is pruned and reported as sweep-incomplete. A deny hiding there goes unseen — a stated limit.
Follows references recursively — by default up to depth 16 — deny-checking every event itreaches.Layer 0 is fatal: what the subject itself names must resolve and verify in time — or nothing issigned (unresolved).Beyond layer 0: a branch that cannot be followed is pruned and reported assweep-incomplete. A deny hiding there goes unseen — a stated limit.
The one edit: ["-"]
The one edit: ["-"]
If a matching allow entry carries rebroadcast: "deny", the signer appends NIP-70's ["-"] and signs that — the only change it ever makes, and it is traced.
Never on an envelope such as a seal, never on TEPP's own kinds.
The returned event is authoritative: a client publishes it verbatim. Protection holds only on relays that implement NIP-70; everywhere the post stays public.
If a matching allow entry carries rebroadcast: "deny", the signer appends NIP-70's ["-"] andsigns that — the only change it ever makes, and it is traced.Never on an envelope such as a seal, never on TEPP's own kinds.The returned event is authoritative: a client publishes it verbatim. Protection holds only onrelays that implement NIP-70; everywhere the post stays public.
Destinations and monitor copies
Destinations and monitor copies
Never a denied relay, whatever the label.
Once any direct interact/relay grant exists, every destination the client supplies must be a member relay — a covered recipient's declared inbox still passes. With no destination set at all, the check is reported as unenforced.
On permit, the covering entries' interactionRelays join the destinations and their monitorRelays receive a copy of the signed event.
Never a denied relay, whatever the label.Once any direct interact/relay grant exists, every destination the client supplies must bea member relay — a covered recipient's declared inbox still passes. With no destinationset at all, the check is reported as unenforced.On permit, the covering entries' interactionRelays join the destinations and theirmonitorRelays receive a copy of the signed event.
TEPP Zeta · diagram 12 · statements: OUT-001–OUT-072, SURF-045–SURF-050, CERE-002, CERE-032, OPQ-089–OPQ-099, OPQ-119, RBC-001–RBC-014, ORD-030, CAPS-013, NF-082
TEPP Zeta · diagram 12 · statements: OUT-001–OUT-072, SURF-045–SURF-050, CERE-002, CERE-032, OPQ-089–OPQ-099, OPQ-119, RBC-001–RBC-014, ORD-030, CAPS-013, NF-082