This is a tentative operational recommendation, not an adopted protocol or a runtime implementation. It fills the gaps needed by the peer contract and workflows. Existing schema drafts remain unchanged. Every assumption below can be revised independently of transport or storage.

The proposed first policy

Question	Tentative answer	Consequence
Scope	An exact original node CID	No implicit subtree grant. Recursive sync checks each resource.
Roles	Reader = read; writer = read + write; irrevocable-admin = read + write + grant + revoke	No fourth relay role; role implication is a recommendation, not a prior decision.
Delegation	Only admins issue grants in the first implementation	Readers/writers cannot invite others merely through those roles.
Proof	Grants issued by a delegated admin bind to one exact permanent admin proof; root-issued grants may omit it	Proofs are binding dependencies, not advisory graph hints. Reader/writer proofs allowed structurally by the draft are not authorized issuers under this tentative policy.
Multiple grants	Effective rights are the union of independently valid grants	Revoking one grant does not ban a key with another route.
Creation	The expected root principal signs the initial node and its initial resource policy	Delegated writers edit existing resources; delegated creation needs a later explicit rule.
Current writes	Evaluate node statement signers against current known authority	Writer revocation can change the selected node statement. There is no invented timestamp-based revocation cut.
History reads	Current readers may read history adopted by currently authorized statements	No join-time restriction; retained local audit bytes outside that closure are not automatically advertised.
Plaintext custody	A hosting principal needs reader rights; the uploader verifies its principal before offering private data	A service receives plaintext as a reader, not through an implicit transport privilege.

The user-settled rules remain intact: admins may grant irrevocable-admin, all admin grants and their ancestry are permanent, and only a matching-scope admin revokes reader/writer grants. Issuer and recipient cancellation are not additional powers.

Root bootstrap and public/private policy

A CID authenticates bytes, not a trusted authority root. A client begins with (resource original CID, expected root principal) from a space address, a signed invitation or an explicitly accepted identity. A server must not substitute a different root from its own response.

Proposed additional signed fact, not a published schema: ResourcePolicy uses the existing signed envelope and contains:

resource: CID of the initial node
root: expected root principal bytes
publicRead: boolean, initially false unless explicitly published
proof: optional CID of the signing admin grant

The initial policy must be signed by the expected root and refer to the root-signed initial node. Its CID becomes the immutable root binding recorded by the receiver. Later policies must keep resource/root unchanged and be root-signed or carry a valid permanent admin proof for that exact resource. Tentatively select the policy with highest signed timestamp, then lexicographically greatest binary CID on a tie. This policy ordering does not order grants or revocations. The root key is an implicit admin for its bound resource.

Public reading is a policy, not a fourth role or a grant to an invented key. A policy making a resource public marks the then-disclosed blob closure public. Public disclosure of a blob is irreversible locally: later private policy prevents new private versions being disclosed but cannot make old public bytes secret. A receiver must distinguish current resource access from fetching already-public immutable bytes. An anonymous scope can contain those old public bytes without exposing current private heads, paths, counts or policy revisions.

This extra fact is a deliberate proposed extension: the current BaseNode fields and principal-only capability format do not express trusted root binding or public audience policy. Keeping it separate avoids silently adding authority meaning to parent/name. Group audiences, subtree attenuation and inherited authority are deferred.

Exact evaluation algorithm

For one trusted resource R, within one consistent index revision:

Verify hashes, envelope signatures and closed structural rules. Unknown format is not authority. Missing dependencies yield UNKNOWN, not success.

Ground the admin graph at R's trusted root. A root-issued admin grant with matching subject is valid. A delegated admin grant is valid only when its exact proof is a valid admin grant on R, the proof's delegate equals its signer, and its own subject is R. Require proof for non-root issuers. Iterate to a fixed point; ungrounded cycles remain invalid. Never consult revocations for this admin graph.

Validate reader/writer grants using the same issuer/proof checks. The proof must be an admin proof under this tentative issuance policy. An exact-grant revocation is valid only if its signer matches the delegate of its required valid admin proof and its target is a reader/writer grant on R. The target must be known before this check completes. A root revoking also supplies a valid self-admin grant as the required proof; provision that once rather than weakening the draft's required-proof rule.

Mark a reader/writer grant inactive if any valid revocation targets its CID. Arrival order does not matter after dependencies are present. A revoke is permanent for that grant CID. A newly issued grant is a different CID and may restore rights. Admin grants remain valid regardless of attempted revocations.

Union rights from valid active grants per principal. Root/admin yields mask 7; writer yields 3; reader yields 1. Also evaluate public reading independently. Caches record the resource authority revision and evidence dependencies; a cache row never creates authority.

Node candidates need a valid signature, valid structural fields, correct original identity and a signer currently able to write R. Select highest signed timestamp, with binary CID as the tentative tie-break. Missing state dependencies do not turn the older statement into the latest: select the new statement but mark its materialization incomplete. Unknown apply formats likewise yield unsupported materialization. Malformed signed structure is rejected. Placement is derived separately. Tentatively permit writers to rename/move their own resource only within the same trusted root namespace; cross-root placement is unsupported in this first policy. This permits a resource writer to move it between same-root folders without gaining authority over those folders. Unknown parents remain unresolved. Detect cycles in current parent edges and disable the edge whose child original CID is lexicographically greatest in each cycle. This deterministic placement repair does not change signed node selection or state, and placement grants no authority.

The admin graph is a bound-proof DAG, while a principal's effective rights can have multiple independent routes. This distinction resolves the prior guides' ambiguity without claiming to implement Keyline's late-bound delegation semantics. The source record compares those models.

What writer revocation means for state

This policy deliberately chooses current-standing evaluation, because the current node format has no signed historical authorization receipt or reliable authority-time cut. Revoking Carol's last writer grant makes her node statements ineligible as the current statement. The next authorized candidate wins, which can roll the displayed resource back. Dependencies and signed bytes remain retained for audit, and a surviving authorized statement may still adopt Carol's historical changes in its DAG. A change dependency is data adopted by an authorized node statement, not an independent right to select that statement.

Regranting Carol can make old statements eligible again, including a high-timestamp statement. That is an explicit consequence to review, not hidden behavior. To keep a version stable across revocation, an admin can publish an authorized statement adopting its state/history. If this rollback/revival behavior is unacceptable, the alternative requires signed adoption receipts or a serialized authority cut and different node authorization rules. This proposal does not pretend an integer epoch or wall-clock timestamp supplies them.

Snapshot statements are authoritative redeclarations. Change statements derive state from their DAG and immutable apply-function CID; utility snapshots are only caches and a mismatch loses to replay. Tentatively use a topological order with binary CID tie-break among ready changes, preserving operation order within each change. This chooses an order, not CRDT convergence semantics; applications requiring stronger merge behavior need an apply contract that actually supplies it. The executable format remains unspecified, so materialization can truthfully be UNSUPPORTED_APPLY even when the statement and grants are valid.

Revocation knowledge and the control-data exception

Every decision means authorized relative to the verified facts this node currently knows. A node cannot prove global absence of an unseen revocation. Control reconciliation should run before content serving where possible. Offline clients may render retained content with a stale-authority indicator; that is a local retained-data policy, not fresh network permission.

Readers of R may fetch authority evidence needed for their own access and the authorized state they receive, including relevant writer grants and permanent admin evidence. Only admins receive the full grant roster. Anonymous public readers receive only evidence for disclosed public statements, not unrelated reader memberships. This least-disclosure control policy is a tentative choice. A removed principal retains a narrower control right: after authenticating as the grant's delegate and presenting that signed grant/evidence, it may fetch that grant's revocation records and their required admin/root dependencies. It may not enumerate unrelated members or fetch resource content. This narrow right is based on a historical signed grant, so it survives content revocation without making the whole graph public.

A control reply is a claim about that serving node's indexed knowledge. Its opaque observation token and optional signed digest are not globally complete checkpoints. Prefer the root/admin's designated sources and multiple relevant replicas, but do not promise an instantaneous revocation deadline. Receiving a valid revocation blocks subsequent responses locally at the commit boundary, regardless of how stale another source is.

Cases the policy must pass

A circular admin proof pair with no root connection grants nothing.

Two reader grants to Bob; revoking one preserves the other. A principal-wide ban is a distinct feature.

A revocation arrives before its target. It waits; when the target arrives, the same transaction indexes the revoke before publishing effective rights.

A root-issued admin grant, an admin-to-admin grant and a delegated writer grant validate without any admin-revocation lookup.

A writer loses its final grant: its current node statement falls out, retained changes remain, an admin adoption can preserve state, and a later regrant can revive statements.

A removed reader can retrieve its own revocation evidence but no roster, private metadata or content.

A hosting peer with no proven reader principal receives no private announcement or block.

A move changes parent/name while direct resource grants remain unchanged. Recursive listings still filter each child's metadata.

The SQL fixtures exercise representative derived-index behavior, not signature verification or a complete evaluator. See node index for that limit.