The permissions guide states the tentative role/root assumptions. In this first policy, grants are exact-resource, admin-issued and independently revocable except permanent admins. Writers can read; admins can read/write. A hosting service has a proven reader principal because receiving plaintext gives it custody.

Bob opens a private resource R with a signed invitation/source bundle. His daemon verifies the expected root and hosting principal, authenticates on the peer connection, then calls GetControl for allowed grant/revocation evidence. It does not trust a root or permission just because a peer supplied a CID.

Next OpenScope captures a filtered data view and a watch cursor at the same index boundary. ReconcileBlobs finds missing CIDs; FetchBlobs obtains and verifies bytes. The daemon indexes the node statement, its change ancestors and apply implementation, then materializes state. It prioritizes text/structure before large attachments and finally watches from that captured cursor.

A selected node CID commits the signed version declaration. Computed state CID is a separate derived commitment. Missing dependencies or an unsupported apply implementation are reported honestly. A utility snapshot never becomes authoritative merely because replay is inconvenient.

An already-local document can render its verified cached version immediately, followed by control refresh and watch/reconciliation repair. Offline retained display has stale authority knowledge; it is not a fresh network read grant.

Carol's daemon signs the new immutable change/node blobs, indexes locally and commits an outbox. Offline work remains queued. Once connected, it refreshes control and verifies the host's reader/custody rights before sending private IDs or bytes.

OfferBlobs records a stable request ID/body digest and lets the host pull wanted bytes using a recipient-bound export token. The host distinguishes received, hash-verified/stored, waiting for evidence, indexed and rejected stages. A durable indexed receipt comes after the index transaction commits. After a lost reply, status lookup returns the committed receipt rather than making another publication. A relay can deliver Carol's signed statement without becoming its author.

The detailed workflows cover local/offline publication, first sync with multiple identities, reconnects and crash recovery. The peer contract includes exact candidate protobuf definitions.

A frozen view freezes the data set, not read authority. Before each page, fingerprint, metadata item or block response, check current permission. A revocation invalidates the relevant view or prevents the next response. A recursive view's policy stamp covers every included child's authority and visible membership; checking only the root is insufficient.

The daemon commits grant/revocation changes, revision fences, selected statements, scope invalidation, durable events and receipts together. Tree repair may happen afterward, but old tree membership never bypasses current access checks. The SQLite model gives tables, queries and this transaction order.

WatchScope is a filtered projection of the local durable event log. Persist a cursor only after durably scheduling the corresponding work. Resume after disconnect; duplicate events are harmless. A compacted log or index rebuild yields reset, control refresh and RBSR repair. Local event sequence is not global authority ordering. Watch hints and fingerprints do not prove a peer knows every revocation.

State ancestors and required attachments belong to typed dependency closure. An ordinary mention or hyperlink does not add its private target. Even a structural reference must pass origin/publication checks before a receiver binds a previously private blob to a new audience: publisher-supplied bytes, existing authorized association, public disclosure or verified source-read context with deliberate publication. A bare CID is insufficient.

One file can have several resource associations. Deduplicate its physical bytes while keeping rights and provenance separate. Likewise, several identities can share one local byte store without sharing their query permissions. Personal revocation evidence remains obtainable after content access is removed; unrelated membership is not exposed.

Reader revocation stops future serving by honest nodes that have learned it. It cannot recall old bytes or instantly reach offline peers. The tentative authority policy also reevaluates a revoked writer's statements, which can roll back selected state and later revive it after regrant. This consequential choice is not adopted; historical authorization needs a different mechanism if that behavior is unacceptable.

For a first live-republish procedure, use a dedicated reader-of-source/writer-of-destination automation that explicitly copies validated versions into ordinary signed destination statements. Source revocation stops future copying, while prior disclosed copies remain. This works with the proposed exchange but does not settle the native republish placeholder's wire payload.

Use existing scoped RBSR first, with tentative CID-only canonical ordering and explicitly encoded fingerprints. Test access-domain Prolly roots as an overlay for metadata/snapshots, using the same allowed sets. Compare disclosure, bytes, CPU, round trips, overlap and revocation cost before changing the core representation. A content-addressed tree is not itself an access policy or global-completeness proof.

Read remaining decisions for the alternatives and sources for current-code evidence and limits.