Enforcement is the union of what the TEPP-compliant loci enforce — a signer and a client, each running the full construct — bounded by the spaces the subject inhabits.
Enforcement is the union of what the TEPP-compliant loci enforce — a signer and a client, each running the full construct — bounded by the spaces the subject inhabits.
TEPP signer + any client
TEPP signer + any client
any client
any client
TEPP signer
TEPP signer
sign · encrypt · decrypt
sign · encrypt ·decrypt
The home of output. Every client use of the key passes one of three policed oracles, so swapping clients evades nothing. It never sees plain input: add a TEPP client for the feed.
The home of output. Every client use of the key passes one ofthree policed oracles, so swapping clients evades nothing. Itnever sees plain input: add a TEPP client for the feed.
TEPP client, key loaded
TEPP client, key loaded
TEPP client + nsec
TEPP client + nsec
Holds the key in-process and runs the full construct in both directions: what may reach the subject, and what the subject may sign.
Holds the key in-process and runs the full construct in bothdirections: what may reach the subject, and what the subjectmay sign.
keyless TEPP client + a signer
keyless TEPP client + a signer
keyless TEPP client
keyless TEPP client
plain signer
plain signer
sign · encrypt · decrypt
sign · encrypt ·decrypt
Runs and enforces the full construct itself. It reads the sealed policy through the signer's decrypt oracle. Another client on that same plain signer is not policed.
Runs and enforces the full construct itself. It reads the sealedpolicy through the signer's decrypt oracle. Another client on thatsame plain signer is not policed.
relays and spaces
relays and spaces
relay
relay
A relay never enforces a subject's regime. It may run the engine for a regime of its own — a space — deciding what it accepts and serves, published as open general carriers anyone can adopt.
A relay never enforces a subject's regime. It may run the enginefor a regime of its own — a space — deciding what it acceptsand serves, published as open general carriers anyone canadopt.
Axis by locus
Axis by locus
axis
axis
TEPP signer
TEPP signer
TEPP client, key loaded
TEPP client, key loaded
keyless TEPP client
keyless TEPP client
deny gates, by value
deny gates, by value
full
full
full
full
full — its gates assembled through policy reads
full — its gates assembled through policy reads
global set and kinds
global set and kinds
full, every recovered layer
full, every recovered layer
full, every recovered layer
full, every recovered layer
full, every recovered layer
full, every recovered layer
weekday and time of day
weekday and time of day
full
full
full
full
full
full
arrival relay (input)
arrival relay (input)
only when a decrypt request carries it
only when a decrypt request carries it
full where it can vouch; else omitted
full where it can vouch; else omitted
full where it can vouch; else omitted
full where it can vouch; else omitted
opacity restriction
opacity restriction
everywhere
everywhere
everywhere
everywhere
everywhere
everywhere
reduction, admission of opaque material
reduction, admission of opaque material
yes
yes
yes
yes
yes, through its signer's decrypt oracle
yes, through its signer's decrypt oracle
sealed policy carriers
sealed policy carriers
computed address
computed address
computed address
computed address
learned once, by trial decryption
learned once, by trial decryption
There is no relay column: a relay is not an enforcing locus. Within a regime of its own, a space enforces the deny gates, kinds, times and opacity — never what needs the key.
There is no relay column: a relay is not an enforcing locus. Within a regime of its own, a space enforces the deny gates, kinds, times and opacity — never what needs the key.
What a locus supplies — and never guesses
What a locus supplies — and never guesses
The instant with its local weekday and minute (mandatory) · the arrival relay · the discovery relay set · the labelled destination set · timeouts · for encrypted material, the enclosing event and a disclosure. An arrival relay, enclosing event or destination set it cannot supply is omitted, and the axis it feeds is reported as unenforced — never guessed, never treated as satisfied. The arrival relay is a locus claim: the relay axis is exactly as sound as the locus that reports it.
The instant with its local weekday and minute (mandatory) · the arrival relay · the discovery relay set · the labelled destination set · timeouts· for encrypted material, the enclosing event and a disclosure.An arrival relay, enclosing event or destination set it cannot supply is omitted, and the axis it feeds is reported as unenforced — neverguessed, never treated as satisfied.The arrival relay is a locus claim: the relay axis is exactly as sound as the locus that reports it.
Several loci, one subject
Several loci, one subject
A subject can run a TEPP signer and TEPP clients at once. Each keeps its own known world, refreshes on its own, and evaluates against its own snapshot. Between a keyless client and its signer the inputs travel — never the assembled construct: each locus assembles for itself. Where either can act, a signer's enforcement cannot be bypassed by swapping clients; a client's can, on a plain signer.
A subject can run a TEPP signer and TEPP clients at once. Each keeps its own known world, refreshes on its own, and evaluates againstits own snapshot.Between a keyless client and its signer the inputs travel — never the assembled construct: each locus assembles for itself.Where either can act, a signer's enforcement cannot be bypassed by swapping clients; a client's can, on a plain signer.