diff --git a/.claude/CLAUDE.md b/.claude/CLAUDE.md index e495a0e3..b1d1c9e6 100644 --- a/.claude/CLAUDE.md +++ b/.claude/CLAUDE.md @@ -8,7 +8,7 @@ > agpl-3.0-or-later is for those shared with my son, and leave other > people's forked stuff alone … only palimpsest license for obvious > reasons should be talking about palipsest and palimpsest plasma, and -> consent-aware-http, but in that case prospectively" +> metadatastician/consent-aware-web, but in that case prospectively" ### Five-way classification (mutually exclusive, exhaustive) @@ -18,7 +18,7 @@ | **2. The 007 repo** | All Rights Reserved (ARR) | `hyperpolymath/007` specifically. Out-of-scope for any normalisation, scanning, or labelling. Surface to owner only. | | **3. Shared with son (Joshua)** | `AGPL-3.0-or-later` | Repos with son as co-author/maintainer. Examples: `idaptik`, `paint-type`. Permanent. | | **4. Third-party / forks** | DO NOT TOUCH | Whatever upstream chose. Never sweep, never normalise. Flag as out-of-scope if it surfaces in an audit. | -| **5. Palimpsest carve-out (extremely narrow)** | `PMPL-1.0-or-later` | EXACTLY three repos: `palimpsest-license` + `palimpsest-plasma` + `consent-aware-http`. The first two retroactively; `consent-aware-http` **prospectively only** (don't flip existing content). NOWHERE ELSE. | +| **5. Palimpsest carve-out (extremely narrow)** | `PMPL-1.0-or-later` | EXACTLY three repos: `palimpsest-license` + `palimpsest-plasma` + `metadatastician/consent-aware-web`. The first two retroactively; `metadatastician/consent-aware-web` **prospectively only** (don't flip existing content). NOWHERE ELSE. | ### Hard rules for agents diff --git a/.hypatia-baseline.json b/.hypatia-baseline.json index 1ee66ba1..fcabe0f3 100644 --- a/.hypatia-baseline.json +++ b/.hypatia-baseline.json @@ -65,13 +65,6 @@ "expires_at": "2026-10-21", "tracking_issue": "hyperpolymath/standards#492" }, - { - "severity": "high", - "rule_module": "code_safety", - "type": "js_wildcard_cors", - "file": "consent-aware-http/examples/reference-implementations/deno/aibdp_middleware.js", - "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Wildcard CORS is correct here: public, credential-less, read-only discovery manifest (well-known-style metadata). Rule should exempt public manifest/metadata responses." - }, { "severity": "high", "rule_module": "code_safety", diff --git a/.machine_readable/REGISTRY.a2ml b/.machine_readable/REGISTRY.a2ml index 1f29ab48..c167adc5 100644 --- a/.machine_readable/REGISTRY.a2ml +++ b/.machine_readable/REGISTRY.a2ml @@ -174,15 +174,6 @@ canonical_doc = "overlay-protocol/.machine_readable/6a2/ECOSYSTEM.a2ml" source_hash = "sha256:59ed969ed2c189d31daa5a253d73f79ae9b2b8fdf690b24717a77a6803dc0f98" route = "layered overlay composition spec" -[[spec]] -id = "consent-aware-http" -name = "Consent-Aware HTTP" -stream = "protocol" -home = "consent-aware-http/" -canonical_doc = "consent-aware-http/README.adoc" -source_hash = "sha256:a646ae072372fe62bf3fcffa80b1a196f1fe3b9df8e7be4fc5e54be49426b022" -route = "consent headers / AI-usage boundaries for HTTP" - [[spec]] id = "adoption-readiness-grades" name = "ARG — Adoption Readiness Grades" @@ -225,7 +216,7 @@ name = "RSR — Rhodium Standard Repositories" stream = "governance" home = "rhodium-standard-repositories/" canonical_doc = "rhodium-standard-repositories/README.adoc" -source_hash = "sha256:838488d31f245068f3eb34fb3a4f2c38e3f755b2f9bb31fe49cd4280f6d6e966" +source_hash = "sha256:defbdce1c0a17d643b000b78b1a604f444dabcfd4e988375924e30f63291981c" route = "the repository-compliance standard every repo is graded against" [[spec]] @@ -355,4 +346,22 @@ media_type = "application/vnd.affinescript.affmap" lineage = "affinescript:affmap@2" route = "provenance format; own pointer for independent staleness tracking" +[[spec]] +id = "consent-aware-web" +name = "Consent-Aware Web (AIBDP + HTTP 430)" +stream = "protocol" +kind = "external" +spec_kind = "service-coupled" +owning_repo = "metadatastician/consent-aware-web" +canonical_url = "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/metadatastician/consent-aware-web/blob/main/README.adoc" +version_pin = "v0.2.0" +source_hash = "PENDING-FIRST-SYNC" +source_hash_algo = "sha256" +conformance_level = "draft" +last_synced = "never" +sync_status = "awaiting-upstream" +media_type = "application/aibdp+json" +lineage = "ietf:aibdp@0.2" +route = "consent headers / AI-usage boundaries for HTTP; extracted from this repo 2026-08-07" + ### End of REGISTRY.a2ml diff --git a/.machine_readable/licensing-policy.toml b/.machine_readable/licensing-policy.toml index 2b7f606e..82dce15e 100644 --- a/.machine_readable/licensing-policy.toml +++ b/.machine_readable/licensing-policy.toml @@ -32,7 +32,7 @@ note = "display resolution, not relicensing; Rule 1 unchanged" [palimpsest_carveout] # Rule 2 — narrow, NOT the default spdx = "PMPL-1.0-or-later" -applies = "EXACTLY three repos: palimpsest-license, palimpsest-plasma, consent-aware-http (the last prospectively)" +applies = "EXACTLY three repos: palimpsest-license, palimpsest-plasma, metadatastician/consent-aware-web (the last prospectively; formerly the consent-aware-http directory in this repo, extracted 2026-08-07)" rule = "PMPL appears NOWHERE ELSE in the estate; standards itself is MPL-2.0 / CC-BY-SA-4.0 (see .claude/CLAUDE.md §License Policy)" [platform_exception] # registries @@ -58,7 +58,7 @@ rule = "preserve original SPDX exactly; never relicense; flag-not-edit" [external_standard_mit] # owner ruling 2026-06-04 rule = "MIT is kept ONLY where (a) the file is third-party (someone else's copyright), or (b) an external standards body requires it. Estate-authored MIT with no such requirement normalises to MPL-2.0 / CC-BY-SA-4.0." -kept_mit = "(a) third-party — lol/* © Asgari, palimpsest-license tooling © Stewardship Council. (b) standards-required — consent-aware-http: its standards were submitted to the IETF for RFC recognition, which requires MIT, so those files are MIT by external mandate. No OTHER estate MIT qualifies: the *.abnf grammar specs and the k9/pandoc/rhodium tooling were normalised to MPL-2.0 (owner ruling 2026-06-04)." +kept_mit = "(a) third-party — lol/* © Asgari, palimpsest-license tooling © Stewardship Council. (b) standards-required — metadatastician/consent-aware-web (formerly the consent-aware-http directory here, extracted 2026-08-07): its standards were submitted to the IETF for RFC recognition, which requires MIT, so those files are MIT by external mandate. No OTHER estate MIT qualifies: the *.abnf grammar specs and the k9/pandoc/rhodium tooling were normalised to MPL-2.0 (owner ruling 2026-06-04)." [automation] # Addendum A2 allowed = false diff --git a/.machine_readable/scorecards/consent-aware-http.scorecard.a2ml b/.machine_readable/scorecards/consent-aware-http.scorecard.a2ml deleted file mode 100644 index 7dcab025..00000000 --- a/.machine_readable/scorecards/consent-aware-http.scorecard.a2ml +++ /dev/null @@ -1,105 +0,0 @@ -# SPDX-License-Identifier: CC-BY-SA-4.0 -# consent-aware-http.scorecard.a2ml -# Hand-authored source. Regenerate the dashboard with: just scorecards -# Schema: .machine_readable/scorecards/scorecard.schema.json - -[scorecard] -spec_id = "consent-aware-http" -version = "1.0.0" -assessed_date = "2026-07-03" -assessor = "estate-audit" - -[[must]] -id = "M1" -text = "The repository MUST provide a well-formed IETF Internet-Draft (xml2rfc XML) specification for HTTP status code 430 Consent Required." -system = "Justfile recipe `validate-drafts` (runs `xml2rfc --v3` if installed) — not invoked in any CI workflow, so it is a local-only, opt-in check" -status = "pass" -evidence = "/home/user/standards/consent-aware-http/draft-jewell-http-430-consent-required-00.xml and /home/user/standards/consent-aware-http/drafts/draft-jewell-http-430-consent-required-00.xml are present, well-formed RFC-XML (rfc2629/v3 DOCTYPE, front/middle/back structure with abstract, sections, references, IANA considerations)" -check = "test -f consent-aware-http/draft-jewell-http-430-consent-required-00.xml && test -f consent-aware-http/drafts/draft-jewell-http-430-consent-required-00.xml && python3 -c \"import xml.dom.minidom as m; m.parse('consent-aware-http/draft-jewell-http-430-consent-required-00.xml'); m.parse('consent-aware-http/drafts/draft-jewell-http-430-consent-required-00.xml')\"" -effects = "Downstream consumers (IETF reviewers, implementers of the 430 status) rely on this document as the canonical protocol text." - -[[must]] -id = "M2" -text = "The canonical draft at repo root and its copy under drafts/ MUST be kept identical (single source of truth for the spec text submitted to IETF)." -system = "none" -status = "fail" -effects = "Implementers reading drafts/draft-jewell-http-430-consent-required-00.xml vs. the root copy get materially different normative text (different author org/email, different Security/IANA wording, different reference sets, different date/expiry) — ambiguous which is authoritative, risking divergent implementations." - -[[must]] -id = "M3" -text = "The repository MUST self-host a valid AIBDP manifest at `.well-known/aibdp.json`, as claimed in README.adoc (\"self-referential\") and required by RSR-COMPLIANCE.md/Justfile's `check-rsr`." -system = "Justfile `check-rsr` / `validate-manifests` recipes check for `.well-known/aibdp.json`, `.well-known/security.txt`, `.well-known/ai.txt`, `.well-known/humans.txt` — but these recipes are not wired into any CI workflow" -status = "fail" -effects = "Any AI agent or crawler trying to consult this project's own boundary declaration (the core self-referential proof-of-concept the README advertises) will find nothing at that path; undermines credibility of the protocol's own dogfooding claim." - -[[must]] -id = "M4" -text = "The project's self-assessment (RSR-COMPLIANCE.md) MUST accurately reflect files actually present on disk before claiming '100% documentation compliance' / 'RSR Gold'." -system = "none" -status = "fail" -effects = "RSR-COMPLIANCE.md claims PASS for LICENSE.txt (actual file is `LICENSE`, no extension), MAINTAINERS.md (actual is MAINTAINERS.adoc), CHANGELOG.md (actual is CHANGELOG.adoc), and the entire `.well-known/` directory (does not exist at all). Anyone trusting this scorecard for audit/regulatory purposes (the doc explicitly targets regulators) would be misled." - -[[must]] -id = "M5" -text = "The repository MUST NOT contain code in languages banned by its own governing policy (.claude/CLAUDE.md: Node.js/npm and ReScript are explicitly banned, replaced by Deno and AffineScript respectively)." -system = ".github/workflows/language-policy.yml (only greps newly-added .py/.rb/.pl/.java/.kt diffs against HEAD~1) and .github/workflows/rescript-deno-ci.yml (which actively runs `npm install`/`npx rescript` when rescript.json is present)" -status = "fail" -effects = "examples/reference-implementations/nodejs/package.json is a live npm project (Express + ajv deps, `node test.js`/`node validate-manifest.js` scripts that don't even exist as files); rescript.json config stub remains at repo root; CI (rescript-deno-ci.yml) still performs `npm install && npx rescript` if rescript.json exists, meaning the banned toolchain is actively exercised in CI rather than blocked. The language-policy.yml gate does not check for Node/npm/ReScript at all, so violations pass silently." - -[[should]] -id = "S1" -text = "The AIBDP manifest format SHOULD be defined by a machine-checkable JSON Schema." -system = "schemas/aibdp-schema-v0.2.json (JSON Schema draft 2020-12, required fields aibdp_version/contact/policies) — validity checkable with `jq`/`ajv` but no CI job runs this" -status = "pass" -evidence = "/home/user/standards/consent-aware-http/schemas/aibdp-schema-v0.2.json is a syntactically valid, reasonably complete JSON Schema (draft 2020-12) with required fields, patterns, and examples" -check = "test -f consent-aware-http/schemas/aibdp-schema-v0.2.json && python3 -c \"import json; json.load(open('consent-aware-http/schemas/aibdp-schema-v0.2.json'))\"" -effects = "Third-party AIBDP implementers (e.g. CDNs, CMS plugins) rely on this schema to validate manifests; a broken/incomplete schema would cause interoperability failures across the ecosystem." - -[[should]] -id = "S2" -text = "Example/self-referential AIBDP manifests SHOULD be validated against the schema in CI on every push/PR." -system = "none — Justfile has `validate-manifests`/`validate-manifest` recipes (jq-based JSON syntax check only, not schema validation) but no workflow in .github/workflows/ invokes `just validate`, `just check-rsr`, `ajv`, or the schema file" -status = "fail" -effects = "docs/example-aibdp.json and examples/*/example-aibdp.json can silently drift out of sync with schemas/aibdp-schema-v0.2.json without any CI signal, misleading adopters who copy the example as a template." - -[[should]] -id = "S3" -text = "The documented Idris2-ABI/Zig-FFI layer SHOULD be a working implementation, not a placeholder template." -system = "none" -status = "fail" -effects = "ABI-FFI-README.md, ffi/zig/src/main.zig, and ffi/zig/test/integration_test.zig all still contain literal unfilled `{{PROJECT}}`/`{{project}}` template tokens and there is no src/abi/ (Idris2) directory at all; any consumer expecting a cross-language C ABI for AIBDP enforcement (as RSR-COMPLIANCE.md's 'Interoperability (iSOS)' section implies is planned) will find only scaffolding, not code that builds." - -[[should]] -id = "S4" -text = "Reference implementations (Node/Express, Deno) SHOULD ship with a runnable, passing test suite." -system = "none — package.json in examples/reference-implementations/nodejs declares `\"test\": \"node test.js\"` and `\"validate\": \"node validate-manifest.js .well-known/aibdp.json\"`" -status = "fail" -effects = "Neither test.js nor validate-manifest.js exists in examples/reference-implementations/nodejs/ (only README.md, example-aibdp.json, package.json are present), so `npm test` fails immediately for anyone following the README's stated workflow; erodes trust in the 'reference implementation' label." - -[[should]] -id = "S5" -text = "The AIBDP+HTTP 430 middleware SHOULD be ported to AffineScript (the estate's mandated replacement for ReScript/JS) and that port SHOULD be exercised by CI." -system = "none — no CI workflow builds or type-checks src/*.affine (rescript-deno-ci.yml only handles Deno/ReScript, not AffineScript; no affinescript compiler is invocable in this environment)" -status = "fail" -effects = "src/Aibdp.affine, src/Express.affine, src/Node.affine exist as hand-written source but are unverified — no compiler run, no test executed against them, so correctness of the 'AffineScript port' relative to the JS original is unproven." - -[[could]] -id = "C1" -text = "The generic 'contractiles' template set (must/Mustfile, dust/Dustfile) COULD be filled in with this repo's real invariants/paths rather than left as generic placeholders." -system = "none" -status = "fail" -effects = "contractiles/README.adoc explicitly says 'Copy the contractiles/ directory into a new repo' and 'Fill-In Instructions' — the checks reference config/service.yaml, policy/policy.ncl, logs/decisions.json which do not exist in this repo, so the contractiles directory currently provides no real operational guarantee for consent-aware-http specifically." - -[[could]] -id = "C2" -text = "SPDX license identifiers/headers COULD be applied consistently across all source files (dual MIT/GPL-3.0-or-later for code, CC-BY-SA-4.0 for docs)." -system = "none (licensing determinations are always human/legal judgement calls, not automatable)" -status = "manual-only" -effects = "Downstream re-users need unambiguous per-file licensing to safely redistribute or fork; RSR-COMPLIANCE.md itself flags this as 'IN PROGRESS' (adding SPDX headers to all files)." - -[[could]] -id = "C3" -text = "RSR/OSSF-style third-party or automated compliance verification (Scorecard, CodeQL, Hypatia scan) COULD reach and sustain top-tier scores as an external validation of the project's governance claims." -system = ".github/workflows/scorecard.yml, scorecard-enforcer.yml, codeql.yml, hypatia-scan.yml (all present and wired to push/PR/schedule triggers)" -status = "aspirational" -effects = "External security raters and downstream integrators use OSSF Scorecard/CodeQL results as a trust signal before adopting a spec's reference tooling; reaching and maintaining a top score is a reach goal beyond what a documentation-focused repo needs, but the workflows are already in place to work toward it." diff --git a/.well-known/humans.txt b/.well-known/humans.txt index f2cabfae..c4cc7250 100644 --- a/.well-known/humans.txt +++ b/.well-known/humans.txt @@ -9,7 +9,7 @@ /* SITE */ Standard: Rhodium Standard Repository (RSR) framework + estate standards Components: A2ML, K9, contractiles, readiness grades (ARG/FRG/CRG/TRG), - protocols (avow, axel, overlay, consent-aware-http, k9-coordination) + protocols (avow, axel, overlay, consent-aware-web, k9-coordination) Build/tooling: Nix, Guix, Deno, just (Justfile) Licence: MPL-2.0 (sole-owner estate default) — see LICENSE Standards: RFC 9116 (security.txt), Schema.org, IndieWeb (webmention) diff --git a/COMPLIANCE-DASHBOARD.md b/COMPLIANCE-DASHBOARD.md index 5017ba4c..e16ae361 100644 --- a/COMPLIANCE-DASHBOARD.md +++ b/COMPLIANCE-DASHBOARD.md @@ -36,7 +36,6 @@ | `avow-protocol` | ❌ gap | 0/5 | 1/4 | 0/3 | 58% | 1/1 | 2026-07-03 | | `axel-protocol` | ❌ gap | 0/5 | 4/5 | 0/3 | 92% | 4/4 | 2026-07-03 | | `overlay-protocol` | ❌ gap | 1/5 | 0/4 | 0/3 | 50% | 1/1 | 2026-07-03 | -| `consent-aware-http` | ❌ gap | 1/5 | 1/5 | 0/3 | 69% | 2/2 | 2026-07-03 | | `adoption-readiness-grades` | ❌ gap | 1/5 | 1/4 | 0/4 | 84% | 2/2 | 2026-07-03 | | `foundations-readiness-grades` | ❌ gap | 2/5 | 1/4 | 0/2 | 72% | 3/3 | 2026-07-03 | | `component-readiness-grades` | ❌ gap | 2/5 | 2/4 | 0/3 | 66% | 4/4 | 2026-07-03 | @@ -53,11 +52,11 @@ ## Estate rollup -- **Specs registered (local):** 30 -- **Specs with a scorecard:** 30 / 30 -- **MUST requirements:** 45 passing / 147 total (75 failing) -- **Estate systems coverage:** 67% of 343 graded requirements have a mechanical check -- **Grounded passes:** 84 / 84 (100%) pass rows carry an executable `check` run by `--verify` +- **Specs registered (local):** 29 +- **Specs with a scorecard:** 29 / 29 +- **MUST requirements:** 44 passing / 142 total (71 failing) +- **Estate systems coverage:** 67% of 330 graded requirements have a mechanical check +- **Grounded passes:** 82 / 82 (100%) pass rows carry an executable `check` run by `--verify` ## How this dashboard stays honest diff --git a/LICENCE-POLICY.adoc b/LICENCE-POLICY.adoc index f36805d3..3daf6b05 100644 --- a/LICENCE-POLICY.adoc +++ b/LICENCE-POLICY.adoc @@ -37,7 +37,7 @@ Policy), PMPL applies to *exactly three* repositories and nowhere else: * `palimpsest-license` — defines the PMPL identifiers * `palimpsest-plasma` — the PMPL implementation / tooling repo -* `consent-aware-http` — **prospectively** (do not flip existing content) +* `consent-aware-web` (formerly `consent-aware-http`, extracted to `metadatastician/consent-aware-web` 2026-08-07) — **prospectively** (do not flip existing content) Every other sole-owner repository — including this `standards` repo — is MPL-2.0 (code) / CC-BY-SA-4.0 (docs) per Rule 1, both as the *stated* and the diff --git a/PALIMPSEST.adoc b/PALIMPSEST.adoc index e3087473..e5c79eab 100644 --- a/PALIMPSEST.adoc +++ b/PALIMPSEST.adoc @@ -13,7 +13,7 @@ image:https://img.shields.io/badge/Legal_fallback-MPL--2.0-orange.svg[MPL-2.0 fa It does NOT state the licence of this `standards` repository.* Per the estate licence policy (link:.claude/CLAUDE.md[.claude/CLAUDE.md]), the Palimpsest / PMPL carve-out applies only to `palimpsest-license`, `palimpsest-plasma`, and -(prospectively) `consent-aware-http`. This repository is licensed *MPL-2.0* +(prospectively) `consent-aware-web` (formerly `consent-aware-http`, extracted to `metadatastician/consent-aware-web` 2026-08-07). This repository is licensed *MPL-2.0* (see link:LICENSE[LICENSE]). Licence/SPDX changes are owner-only and Manual-Only. ==== diff --git a/README.adoc b/README.adoc index 7e9674db..d08988a2 100644 --- a/README.adoc +++ b/README.adoc @@ -484,7 +484,7 @@ NOTE: Licence and SPDX headers in this repo are *owner-managed and Manual-Only* — agents flag licence drift, they never edit `LICENSE` files or SPDX headers (see link:.claude/CLAUDE.md[.claude/CLAUDE.md]). The Palimpsest / PMPL framework applies only to `palimpsest-license`, `palimpsest-plasma`, and -(prospectively) `consent-aware-http` — not to this repository. +(prospectively) `consent-aware-web` (formerly `consent-aware-http`, extracted to `metadatastician/consent-aware-web` 2026-08-07) — not to this repository. == Contributing diff --git a/TEST-NEEDS.md b/TEST-NEEDS.md index cbf4293c..f121e47b 100644 --- a/TEST-NEEDS.md +++ b/TEST-NEEDS.md @@ -205,7 +205,6 @@ CRG C integration tests (`tests/crg_c_tests.rs`): #### Missing Sub-projects (358 source files with ~0 tests) - [ ] `avow-protocol` — no tests (ReScript source exists) - [ ] `contractiles` — no tests -- [ ] `consent-aware-http` — no tests - [ ] `lol` — no tests - [ ] `overlay-protocol` — no tests - [ ] `k9-svc` — no tests (mirrors a2ml structure, same test pattern applies) diff --git a/TOPOLOGY.md b/TOPOLOGY.md index aa0b58d6..6bd05b54 100644 --- a/TOPOLOGY.md +++ b/TOPOLOGY.md @@ -47,7 +47,7 @@ | AVOW Protocol | [`avow-protocol/`](avow-protocol/) | consent-attested messaging / origin attribution | | AXEL Protocol | [`axel-protocol/`](axel-protocol/) | age-gating + explicit-content enforcement | | Overlay Protocol | [`overlay-protocol/`](overlay-protocol/) | layered overlay composition spec | -| Consent-Aware HTTP | [`consent-aware-http/`](consent-aware-http/) | consent headers / AI-usage boundaries for HTTP | +| Consent-Aware Web (AIBDP + HTTP 430) | [`metadatastician/consent-aware-web`](https://github.com/metadatastician/consent-aware-web/blob/main/README.adoc) `@ v0.2.0` ⇗ | consent headers / AI-usage boundaries for HTTP; extracted from this repo 2026-08-07 | ### Governance — RSR, gates, session standards diff --git a/consent-aware-http/.claude/CLAUDE.md b/consent-aware-http/.claude/CLAUDE.md deleted file mode 100644 index 0b928b36..00000000 --- a/consent-aware-http/.claude/CLAUDE.md +++ /dev/null @@ -1,84 +0,0 @@ -## Machine-Readable Artefacts - -The following files in `.machine_readable/` contain structured project metadata: - -- `STATE.scm` - Current project state and progress -- `META.scm` - Architecture decisions and development practices -- `ECOSYSTEM.scm` - Position in the ecosystem and related projects -- `AGENTIC.scm` - AI agent interaction patterns -- `NEUROSYM.scm` - Neurosymbolic integration config -- `PLAYBOOK.scm` - Operational runbook - ---- - -# CLAUDE.md - AI Assistant Instructions - -## Language Policy (Hyperpolymath Standard) - -### ALLOWED Languages & Tools - -| Language/Tool | Use Case | Notes | -|---------------|----------|-------| -| **AffineScript** | Primary application code | Compiles to typed-wasm. Replaces ReScript across the estate (RS/TS/JS → AffineScript → typed-wasm). | -| **Deno** | Runtime & package management | Replaces Node/npm/bun | -| **Rust** | Performance-critical, systems, WASM | Preferred for CLI tools | -| **Tauri 2.0+** | Mobile apps (iOS/Android) | Rust backend + web UI | -| **Dioxus** | Mobile apps (native UI) | Pure Rust, React-like | -| **Gleam** | Backend services | Runs on BEAM or compiles to JS | -| **Bash/POSIX Shell** | Scripts, automation | Keep minimal | -| **JavaScript** | Only where AffineScript cannot | MCP protocol glue, Deno APIs (transitional) | -| **Nickel** | Configuration language | For complex configs | -| **Guile Scheme** | State/meta files | STATE.scm, META.scm, ECOSYSTEM.scm | -| **Julia** | Batch scripts, data processing | Per RSR | -| **OCaml** | AffineScript compiler | Language-specific | -| **Ada** | Safety-critical systems | Where required | - -### BANNED - Do Not Use - -| Banned | Replacement | -|--------|-------------| -| TypeScript | AffineScript | -| **ReScript** | AffineScript (banned 2026-04-30; migrate `.res` → `.affine` directly) | -| Node.js | Deno | -| npm | Deno | -| Bun | Deno | -| pnpm/yarn | Deno | -| Go | Rust(+SPARK) | -| Python | Julia/Rust(+SPARK)/AffineScript | -| Java/Kotlin | Rust/Tauri/Dioxus | -| Swift | Tauri/Dioxus | -| React Native | Tauri/Dioxus | -| Flutter/Dart | Tauri/Dioxus | - -### Mobile Development - -**No exceptions for Kotlin/Swift** - use Rust-first approach: - -1. **Tauri 2.0+** - Web UI (AffineScript → typed-wasm) + Rust backend, MIT/Apache-2.0 -2. **Dioxus** - Pure Rust native UI, MIT/Apache-2.0 - -Both are FOSS with independent governance (no Big Tech). - -### Enforcement Rules - -1. **No new TypeScript or ReScript files** - Convert existing TS/RS to AffineScript directly (`.affine`) -2. **No package.json for runtime deps** - Use deno.json imports -3. **No node_modules in production** - Deno caches deps automatically -4. **No Go code** - Use Rust instead -5. **No Python anywhere** - Use Julia for data/batch, Rust(+SPARK) for systems, AffineScript for apps -6. **No Kotlin/Swift for mobile** - Use Tauri 2.0+ or Dioxus - -### Package Management - -- **Primary**: Guix (guix.scm) -- **Fallback**: Nix (flake.nix) -- **JS deps**: Deno (deno.json imports) - -### Security Requirements - -- No MD5/SHA1 for security (use SHA256+) -- HTTPS only (no HTTP URLs) -- No hardcoded secrets -- SHA-pinned dependencies -- SPDX license headers on all files - diff --git a/consent-aware-http/.editorconfig b/consent-aware-http/.editorconfig deleted file mode 100644 index 1b2ec8d0..00000000 --- a/consent-aware-http/.editorconfig +++ /dev/null @@ -1,68 +0,0 @@ -# consent-aware-http - Editor Configuration -# https://editorconfig.org - -root = true - -[*] -charset = utf-8 -end_of_line = lf -indent_size = 2 -indent_style = space -insert_final_newline = true -trim_trailing_whitespace = true - -[*.md] -trim_trailing_whitespace = false - -[*.adoc] -trim_trailing_whitespace = false - -[*.rs] -indent_size = 4 - -[*.ex] -indent_size = 2 - -[*.exs] -indent_size = 2 - -[*.zig] -indent_size = 4 - -[*.ada] -indent_size = 3 - -[*.adb] -indent_size = 3 - -[*.ads] -indent_size = 3 - -[*.hs] -indent_size = 2 - -[*.res] -indent_size = 2 - -[*.resi] -indent_size = 2 - -[*.ncl] -indent_size = 2 - -[*.rkt] -indent_size = 2 - -[*.scm] -indent_size = 2 - -[*.nix] -indent_size = 2 - -[Justfile] -indent_style = space -indent_size = 4 - -[justfile] -indent_style = space -indent_size = 4 diff --git a/consent-aware-http/.gitattributes b/consent-aware-http/.gitattributes deleted file mode 100644 index e860a85c..00000000 --- a/consent-aware-http/.gitattributes +++ /dev/null @@ -1,54 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# RSR-compliant .gitattributes - -* text=auto eol=lf - -# Source -*.rs text eol=lf diff=rust -*.ex text eol=lf diff=elixir -*.exs text eol=lf diff=elixir -*.jl text eol=lf -*.res text eol=lf -*.resi text eol=lf -*.ada text eol=lf diff=ada -*.adb text eol=lf diff=ada -*.ads text eol=lf diff=ada -*.hs text eol=lf -*.chpl text eol=lf -*.scm text eol=lf -*.ncl text eol=lf -*.nix text eol=lf - -# Docs -*.md text eol=lf diff=markdown -*.adoc text eol=lf -*.txt text eol=lf - -# Data -*.json text eol=lf -*.yaml text eol=lf -*.yml text eol=lf -*.toml text eol=lf - -# Config -.gitignore text eol=lf -.gitattributes text eol=lf -justfile text eol=lf -Makefile text eol=lf -Containerfile text eol=lf - -# Scripts -*.sh text eol=lf - -# Binary -*.png binary -*.jpg binary -*.gif binary -*.pdf binary -*.woff2 binary -*.zip binary -*.gz binary - -# Lock files -Cargo.lock text eol=lf -diff -flake.lock text eol=lf -diff diff --git a/consent-aware-http/.github/CONTRIBUTING.md b/consent-aware-http/.github/CONTRIBUTING.md deleted file mode 100644 index ef5942d0..00000000 --- a/consent-aware-http/.github/CONTRIBUTING.md +++ /dev/null @@ -1,69 +0,0 @@ -# Contributing to Consent-Aware HTTP Standards - -Thank you for your interest in improving ethical infrastructure for AI governance and declarative refusal. - -This repository hosts drafts, documentation, and tooling for: -- `draft-jewell-http-430-consent-required` -- `draft-jewell-aibdp` -- Complementary explainers, schema samples, and cultural framing - -Your contributions — whether technical, editorial, philosophical, or implementation-based — are welcome. - ---- - -## 💡 Ways to Contribute - -- **RFC draft feedback**: Suggest corrections, propose additional use cases, or clarify language -- **Manifest design**: Expand AIBDP schema samples and explore extensions for federation, cryptographic binding, etc. -- **Infrastructure tooling**: Implement server-side 430 responses, manifest parsers, or audit utilities -- **Documentation**: Improve quickstart guides, developer onboarding, and educational materials -- **Ethical framing**: Contribute essays, citations, or examples that deepen the philosophical understanding of refusal and procedural boundary -- **Outreach**: Help engage federated platforms, journalists, educators, IndieWeb members, and governance communities - ---- - -## 🛠 Technical Contributions - -Before submitting code or draft updates: - -1. Fork the repository -2. Create a new branch (`feature/my-update`) -3. Commit with clear descriptions -4. Submit a pull request with a summary of your changes and rationale - -If you're proposing language for the drafts, quote sections and offer improvement phrasing inline in your PR or issue. - ---- - -## 📜 Style and Principles - -This project prioritizes: - -- **Procedural integrity** — Accuracy, transparency, and alignment with standards bodies -- **Consent-aware authorship** — Clear declaration of scope and boundaries -- **Ethical clarity** — No obfuscation, no quiet permissions — refusal must be dignified -- **Federated thinking** — Build tools and schemas that scale beyond centralized systems -- **Creative comport** — Literary citations, artistic expression, and philosophical insight are welcome - ---- - -## 🧾 Licensing Agreement - -By contributing, you agree that your work may be included under: - -- [MIT License](LICENSE.md) for code and draft materials -- [CC BY-SA 4.0](LICENSE.md) for documentation and narrative content - ---- - -## 💬 Feedback and Dialogue - -If you have questions, suggestions, or critiques, please open a GitHub Discussion or Issue. You can also reach out at [jonathan@metadatastician.art](mailto:jonathan@metadatastician.art) for thoughtful exchanges or aligned collaboration. - -We welcome critique, correction, and recalibration — provided it’s done with the same clarity and comport the protocol demands. - ---- - -_Disagreement is welcome. Exploitation is not._ -Declare your boundaries. Join ours. - diff --git a/consent-aware-http/.github/DISCUSSION_TEMPLATE.md b/consent-aware-http/.github/DISCUSSION_TEMPLATE.md deleted file mode 100644 index e69de29b..00000000 diff --git a/consent-aware-http/.github/FUNDING.md b/consent-aware-http/.github/FUNDING.md deleted file mode 100644 index 0f1bcf8b..00000000 --- a/consent-aware-http/.github/FUNDING.md +++ /dev/null @@ -1,2 +0,0 @@ -github: jonathanjewell -custom: ["https://sinople.pub", "https://metadatastician.art/support"] diff --git a/consent-aware-http/.github/FUNDING.yml b/consent-aware-http/.github/FUNDING.yml deleted file mode 100644 index 688a442c..00000000 --- a/consent-aware-http/.github/FUNDING.yml +++ /dev/null @@ -1,7 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Funding platforms for hyperpolymath projects -# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository - -github: hyperpolymath -ko_fi: hyperpolymath -liberapay: hyperpolymath diff --git a/consent-aware-http/.github/ISSUE_TEMPLATE/DISCUSSION_TEMPLATE.md b/consent-aware-http/.github/ISSUE_TEMPLATE/DISCUSSION_TEMPLATE.md deleted file mode 100644 index 352cd446..00000000 --- a/consent-aware-http/.github/ISSUE_TEMPLATE/DISCUSSION_TEMPLATE.md +++ /dev/null @@ -1,24 +0,0 @@ -# Discussion Starter: Topic, Framing, and Intent - -## 🧭 Topic - -Brief title or question - e.g., "Can AIBDP work with IndieWeb microformats?" - -## 💬 Framing - -Open with a paragraph or two that explains: -- What you’re exploring -- What motivated the inquiry -- Why it might help the protocol or community - -## 🔗 Optional Context - -Link standards, drafts, citations, posts, or example manifests. - -## 🙌 Invitation - -What kind of response or collaboration do you hope to invite? - ---- - -🕊️ Dialogue is welcome. Refusal is respected. Let’s advance clarity together. diff --git a/consent-aware-http/.github/ISSUE_TEMPLATE/PULL_REQUEST_TEMPLATE.md b/consent-aware-http/.github/ISSUE_TEMPLATE/PULL_REQUEST_TEMPLATE.md deleted file mode 100644 index f6091f7f..00000000 --- a/consent-aware-http/.github/ISSUE_TEMPLATE/PULL_REQUEST_TEMPLATE.md +++ /dev/null @@ -1,22 +0,0 @@ -# Pull Request: Summary and Intent - -## 📜 Description - -Briefly describe what this PR adds or changes — and why it matters. - -## 🔍 Scope - -- [ ] 430 Status Code -- [ ] AIBDP Manifest -- [ ] Developer tooling -- [ ] Documentation / Narrative -- [ ] Other: please explain - -## ✅ Author Intent - -By submitting this pull request, I affirm: -- [x] I respect the boundaries and ethical intent of this project -- [x] I understand the licensing (MIT + CC BY-SA 4.0) -- [x] I’ve tested or reviewed my contribution for clarity and conformance - -Please tag Jonathan @metadatastician.art or open a related Issue if further review is needed. diff --git a/consent-aware-http/.github/ISSUE_TEMPLATE/bug_report.md b/consent-aware-http/.github/ISSUE_TEMPLATE/bug_report.md deleted file mode 100644 index 987aab6b..00000000 --- a/consent-aware-http/.github/ISSUE_TEMPLATE/bug_report.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -name: Bug report -about: Create a report to help us improve -title: "[Bug]: " -labels: 'bug, priority: unset, triage' -assignees: '' - ---- - -**Describe the bug** -A clear and concise description of what the bug is. - -**To Reproduce** -Steps to reproduce the behavior: -1. Go to '...' -2. Click on '....' -3. Scroll down to '....' -4. See error - -**Expected behavior** -A clear and concise description of what you expected to happen. - -**Screenshots** -If applicable, add screenshots to help explain your problem. - -**Desktop (please complete the following information):** - - OS: [e.g. iOS] - - Browser [e.g. chrome, safari] - - Version [e.g. 22] - -**Smartphone (please complete the following information):** - - Device: [e.g. iPhone6] - - OS: [e.g. iOS8.1] - - Browser [e.g. stock browser, safari] - - Version [e.g. 22] - -**Additional context** -Add any other context about the problem here. diff --git a/consent-aware-http/.github/ISSUE_TEMPLATE/custom.md b/consent-aware-http/.github/ISSUE_TEMPLATE/custom.md deleted file mode 100644 index 48d5f81f..00000000 --- a/consent-aware-http/.github/ISSUE_TEMPLATE/custom.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -name: Custom issue template -about: Describe this issue template's purpose here. -title: '' -labels: '' -assignees: '' - ---- - - diff --git a/consent-aware-http/.github/ISSUE_TEMPLATE/documentation.md b/consent-aware-http/.github/ISSUE_TEMPLATE/documentation.md deleted file mode 100644 index 4fcb9f9f..00000000 --- a/consent-aware-http/.github/ISSUE_TEMPLATE/documentation.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -name: Documentation -about: Report unclear, missing, or incorrect documentation -title: "[DOCS]: " -labels: 'documentation, priority: unset, triage' -assignees: '' - ---- - -name: Documentation -description: Report unclear, missing, or incorrect documentation -title: "[Docs]: " -labels: ["documentation", "triage"] -body: - - type: markdown - attributes: - value: | - Help us improve our documentation by reporting issues or gaps. - - - type: dropdown - id: type - attributes: - label: Documentation issue type - options: - - Missing (documentation doesn't exist) - - Incorrect (information is wrong) - - Unclear (confusing or hard to follow) - - Outdated (no longer accurate) - - Typo or grammar - validations: - required: true - - - type: input - id: location - attributes: - label: Location - description: Where is this documentation? (URL, file path, or section name) - placeholder: README.adoc, section "Installation" - validations: - required: true - - - type: textarea - id: description - attributes: - label: Description - description: What's the problem with the current documentation? - placeholder: Describe what's wrong or missing - validations: - required: true - - - type: textarea - id: suggestion - attributes: - label: Suggested improvement - description: How should it be fixed or improved? - placeholder: The documentation should say... - validations: - required: false - - - type: checkboxes - id: contribution - attributes: - label: Contribution - options: - - label: I would be willing to submit a PR to fix this - required: false diff --git a/consent-aware-http/.github/ISSUE_TEMPLATE/feature-template.md b/consent-aware-http/.github/ISSUE_TEMPLATE/feature-template.md deleted file mode 100644 index c6aa1eaf..00000000 --- a/consent-aware-http/.github/ISSUE_TEMPLATE/feature-template.md +++ /dev/null @@ -1,29 +0,0 @@ -name: Feature Request or Protocol Enhancement -description: Suggest a new capability, integration, or architectural refinement -title: "[Proposal] — your concise topic" -labels: [enhancement] -body: - - type: markdown - attributes: - value: | - Thanks for contributing to the consent-aware ecosystem. - Please describe your proposed change below. - - type: textarea - id: summary - attributes: - label: Summary - description: What do you propose and why does it matter? - placeholder: Write a short explanation… - validations: - required: true - - type: textarea - id: scope - attributes: - label: Protocol or tooling scope - description: Is this related to 430, AIBDP, manifests, or infrastructure? - placeholder: Draft/AIBDP/API Schema/Docs - - type: input - id: source - attributes: - label: Supporting references (optional) - description: Link relevant documentation, standards, or prior discussions diff --git a/consent-aware-http/.github/ISSUE_TEMPLATE/feature_request.md b/consent-aware-http/.github/ISSUE_TEMPLATE/feature_request.md deleted file mode 100644 index 3e8fa7e7..00000000 --- a/consent-aware-http/.github/ISSUE_TEMPLATE/feature_request.md +++ /dev/null @@ -1,20 +0,0 @@ ---- -name: Feature request -about: Suggest an idea for this project -title: '' -labels: 'enhancement, priority: unset, triage' -assignees: '' - ---- - -**Is your feature request related to a problem? Please describe.** -A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] - -**Describe the solution you'd like** -A clear and concise description of what you want to happen. - -**Describe alternatives you've considered** -A clear and concise description of any alternative solutions or features you've considered. - -**Additional context** -Add any other context or screenshots about the feature request here. diff --git a/consent-aware-http/.github/ISSUE_TEMPLATE/question.md b/consent-aware-http/.github/ISSUE_TEMPLATE/question.md deleted file mode 100644 index fd0e2a5c..00000000 --- a/consent-aware-http/.github/ISSUE_TEMPLATE/question.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -name: Question -about: Ask a question about usage or behaviour -title: "[QUESTION]: " -labels: question, triage -assignees: '' - ---- - -name: Question -description: Ask a question about usage or behaviour -title: "[Question]: " -labels: ["question", "triage"] -body: - - type: markdown - attributes: - value: | - Have a question? You can also ask in [Discussions](../discussions) for broader conversations. - - - type: textarea - id: question - attributes: - label: Your question - description: What would you like to know? - placeholder: How do I...? - validations: - required: true - - - type: textarea - id: context - attributes: - label: Context - description: Any relevant context that helps us answer your question - placeholder: I'm trying to achieve X and I've tried Y... - validations: - required: false - - - type: textarea - id: research - attributes: - label: What I've already tried - description: What have you already looked at or attempted? - placeholder: I've read the README and searched issues but... - validations: - required: false - - - type: checkboxes - id: checked - attributes: - label: Pre-submission checklist - options: - - label: I have searched existing issues and discussions - required: true - - label: I have read the documentation - required: true diff --git a/consent-aware-http/.github/PULL_REQUEST_TEMPLATE.md b/consent-aware-http/.github/PULL_REQUEST_TEMPLATE.md deleted file mode 100644 index e69de29b..00000000 diff --git a/consent-aware-http/.github/SECURITY.md b/consent-aware-http/.github/SECURITY.md deleted file mode 100644 index 4f744576..00000000 --- a/consent-aware-http/.github/SECURITY.md +++ /dev/null @@ -1,15 +0,0 @@ -# Security Policy - -This repository contains protocol drafts and ethical infrastructure tooling. While not a production runtime environment, any observed security vulnerabilities (e.g., in example scripts, schema validation, or manifest usage) should be reported respectfully. - -## 🛡 Responsible Disclosure - -Please email: jonathan@metadatastician.art -Include: -- A summary of the issue -- Steps to reproduce -- Suggested mitigation if known - ---- - -This project prioritizes authorship dignity and ethical refusal. Security matters — because clarity is also protection. diff --git a/consent-aware-http/.github/community-guidelines.md b/consent-aware-http/.github/community-guidelines.md deleted file mode 100644 index 78d7e0b7..00000000 --- a/consent-aware-http/.github/community-guidelines.md +++ /dev/null @@ -1,38 +0,0 @@ -# Community Participation Guidelines - -Welcome to the Consent-Aware HTTP project. This repository advocates for ethical refusal, authorship dignity, and federated governance in AI-adjacent ecosystems. Together, we build protocols that don't just work — they respect. - -## 🧭 Core Principles - -- **Declarative Integrity**: Respect boundaries before assuming access -- **Ethical Comport**: Refusal is not obstruction — it’s authorship with clarity -- **Procedural Transparency**: No quiet permissions, no obfuscation -- **Creative Solidarity**: Your voice matters. So does everyone else's. -- **Zero Exploitation Tolerance**: No scraping, ghosting, gaslighting, or harvesting - -## 🤲 How to Engage - -- Speak with clarity, not domination -- Credit sources and cite respectfully -- Honor intent — ask before reuse, share with acknowledgment -- Surface disagreements constructively, without derailing deliberation -- Foster inclusivity and care across disciplines - -## 🛠 Contribution Etiquette - -- Issues are for bugs, insights, and improvement -- Discussions are for exploration, clarification, and collaboration -- Pull requests should describe reasoning, not just code -- Questions are welcome, cynicism is not required - -## 🕊 A Note on Refusal - -This repo advocates for refusal as poise, not punishment. We welcome contrarian ideas — but not boundary erosion. We encourage critique — but not adversarial extraction. - -If you violate authorship, erase intent, or harvest narratives unethically, you will be asked to leave. - -## 🙌 Final Note - -This is not just a repo — it's a perimeter. Enter with dignity, leave with respect, and build with care. - -_“Ethical refusal is procedural comport.”_ diff --git a/consent-aware-http/.github/dependabot.yml b/consent-aware-http/.github/dependabot.yml deleted file mode 100644 index 5145419c..00000000 --- a/consent-aware-http/.github/dependabot.yml +++ /dev/null @@ -1,15 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -version: 2 -updates: - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "weekly" - groups: - actions: - patterns: - - "*" - - package-ecosystem: "nix" - directory: "/" - schedule: - interval: "weekly" diff --git a/consent-aware-http/.github/workflows/codeql.yml b/consent-aware-http/.github/workflows/codeql.yml deleted file mode 100644 index 261b34bb..00000000 --- a/consent-aware-http/.github/workflows/codeql.yml +++ /dev/null @@ -1,23 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: CodeQL Security Analysis - -on: - push: - branches: [main, master] - pull_request: - branches: [main, master] - schedule: - - cron: '0 6 * * 1' - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: false - -permissions: - contents: read - -jobs: - analyze-js: - uses: ../../.github/workflows/codeql-reusable.yml - with: - language: javascript-typescript diff --git a/consent-aware-http/.github/workflows/generator-generic-ossf-slsa3-publish.yml b/consent-aware-http/.github/workflows/generator-generic-ossf-slsa3-publish.yml deleted file mode 100644 index d374a90b..00000000 --- a/consent-aware-http/.github/workflows/generator-generic-ossf-slsa3-publish.yml +++ /dev/null @@ -1,68 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -# This workflow lets you generate SLSA provenance file for your project. -# The generation satisfies level 3 for the provenance requirements - see https://slsa.dev/spec/v0.1/requirements -# The project is an initiative of the OpenSSF (openssf.org) and is developed at -# https://github.com/slsa-framework/slsa-github-generator. -# The provenance file can be verified using https://github.com/slsa-framework/slsa-verifier. -# For more information about SLSA and how it improves the supply-chain, visit slsa.dev. - -name: SLSA generic generator -on: - workflow_dispatch: - release: - types: [created] - -jobs: - build: - runs-on: ubuntu-latest - timeout-minutes: 30 - outputs: - digests: ${{ steps.hash.outputs.digests }} - - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - # ======================================================== - # - # Step 1: Build your artifacts. - # - # ======================================================== - - name: Build artifacts - run: | - # These are some amazing artifacts. - echo "artifact1" > artifact1 - echo "artifact2" > artifact2 - - # ======================================================== - # - # Step 2: Add a step to generate the provenance subjects - # as shown below. Update the sha256 sum arguments - # to include all binaries that you generate - # provenance for. - # - # ======================================================== - - name: Generate subject for provenance - id: hash - run: | - set -euo pipefail - - # List the artifacts the provenance will refer to. - files=$(ls artifact*) - # Generate the subjects (base64 encoded). - echo "hashes=$(sha256sum $files | base64 -w0)" >> "${GITHUB_OUTPUT}" - - provenance: - needs: [build] - permissions: - actions: read # To read the workflow path. - id-token: write # To sign the provenance. - contents: write # To add assets to a release. - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.4.0 - with: - base64-subjects: "${{ needs.build.outputs.digests }}" - upload-assets: true # Optional: Upload to a new release diff --git a/consent-aware-http/.github/workflows/governance.yml b/consent-aware-http/.github/workflows/governance.yml deleted file mode 100644 index 64ce492b..00000000 --- a/consent-aware-http/.github/workflows/governance.yml +++ /dev/null @@ -1,27 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# governance.yml — single wrapper calling the shared estate governance bundle -# in hyperpolymath/standards instead of carrying per-repo copies. -# -# Replaces the per-repo governance scaffolding removed in the same commit: -# quality.yml, guix-nix-policy.yml, npm-bun-blocker.yml, ts-blocker.yml, -# security-policy.yml, rsr-antipattern.yml, wellknown-enforcement.yml, -# workflow-linter.yml -# -# Load-bearing build/security workflows stay standalone in the repo -# (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing). - -name: Governance - -on: - push: - branches: [main, master] - pull_request: - workflow_dispatch: - -permissions: - actions: read - contents: read - -jobs: - governance: - uses: ../../.github/workflows/governance-reusable.yml diff --git a/consent-aware-http/.github/workflows/hypatia-scan.yml b/consent-aware-http/.github/workflows/hypatia-scan.yml deleted file mode 100644 index 4bc2b381..00000000 --- a/consent-aware-http/.github/workflows/hypatia-scan.yml +++ /dev/null @@ -1,21 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: Hypatia Security Scan - -on: - push: - branches: [main, master, develop] - pull_request: - branches: [main, master] - schedule: - - cron: '0 0 * * 0' - workflow_dispatch: - -permissions: - actions: read - contents: read - security-events: write - -jobs: - scan: - uses: ../../.github/workflows/hypatia-scan-reusable.yml - secrets: inherit diff --git a/consent-aware-http/.github/workflows/jekyll-gh-pages.yml b/consent-aware-http/.github/workflows/jekyll-gh-pages.yml deleted file mode 100644 index 8b72c77b..00000000 --- a/consent-aware-http/.github/workflows/jekyll-gh-pages.yml +++ /dev/null @@ -1,54 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Sample workflow for building and deploying a Jekyll site to GitHub Pages -name: Deploy Jekyll with GitHub Pages dependencies preinstalled - -on: - # Runs on pushes targeting the default branch - push: - branches: ["main"] - - # Allows you to run this workflow manually from the Actions tab - workflow_dispatch: - -# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages -permissions: - contents: read - pages: write - id-token: write - -# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued. -# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete. -concurrency: - group: "pages" - cancel-in-progress: false - -jobs: - # Build job - build: - runs-on: ubuntu-latest - timeout-minutes: 30 - steps: - - name: Checkout - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - name: Setup Pages - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5 - - name: Build with Jekyll - uses: actions/jekyll-build-pages@44a6e6beabd48582f863aeeb6cb2151cc1716697 # v1 - with: - source: ./ - destination: ./_site - - name: Upload artifact - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3 - - # Deployment job - deploy: - environment: - name: github-pages - url: ${{ steps.deployment.outputs.page_url }} - runs-on: ubuntu-latest - timeout-minutes: 30 - needs: build - steps: - - name: Deploy to GitHub Pages - id: deployment - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4 diff --git a/consent-aware-http/.github/workflows/language-policy.yml b/consent-aware-http/.github/workflows/language-policy.yml deleted file mode 100644 index 878c5846..00000000 --- a/consent-aware-http/.github/workflows/language-policy.yml +++ /dev/null @@ -1,46 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: Language Policy Enforcement -on: [push, pull_request] -jobs: - check: - runs-on: ubuntu-latest - timeout-minutes: 20 - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - name: Enforce language policies - run: | - # Block new Python files (Python fully banned 2026-01-03 — SaltStack carveout removed) - NEW_PY=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.py$' || true) - if [ -n "$NEW_PY" ]; then - echo "❌ New Python files detected. Use Rust or AffineScript instead." - echo "$NEW_PY" - exit 1 - fi - - # Block new Ruby files - NEW_RB=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.rb$' || true) - if [ -n "$NEW_RB" ]; then - echo "❌ New Ruby files detected. Use Rust, Ada/SPARK, or Crystal instead." - echo "$NEW_RB" - exit 1 - fi - - # Block new Perl files - NEW_PL=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.(pl|pm)$' || true) - if [ -n "$NEW_PL" ]; then - echo "❌ New Perl files detected. Use Rust instead." - echo "$NEW_PL" - exit 1 - fi - - # Block new Java/Kotlin (except in LSP projects) - if [[ ! "$GITHUB_REPOSITORY" =~ "language-server" ]]; then - NEW_JAVA=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.(java|kt)$' || true) - if [ -n "$NEW_JAVA" ]; then - echo "❌ New Java/Kotlin files detected. Use Rust instead." - echo "$NEW_JAVA" - exit 1 - fi - fi - - echo "✅ Language policy check passed" diff --git a/consent-aware-http/.github/workflows/mirror.yml b/consent-aware-http/.github/workflows/mirror.yml deleted file mode 100644 index f8cab983..00000000 --- a/consent-aware-http/.github/workflows/mirror.yml +++ /dev/null @@ -1,15 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: Mirror to Git Forges - -on: - push: - branches: [main] - workflow_dispatch: - -permissions: - contents: read - -jobs: - mirror: - uses: ../../.github/workflows/mirror-reusable.yml - secrets: inherit diff --git a/consent-aware-http/.github/workflows/rescript-deno-ci.yml b/consent-aware-http/.github/workflows/rescript-deno-ci.yml deleted file mode 100644 index b87d0858..00000000 --- a/consent-aware-http/.github/workflows/rescript-deno-ci.yml +++ /dev/null @@ -1,43 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: ReScript/Deno CI -on: [push, pull_request] - -jobs: - build: - runs-on: ubuntu-latest - timeout-minutes: 30 - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - uses: denoland/setup-deno@v1 - with: - deno-version: v1.x - - - name: Deno lint - run: deno lint - - - name: Deno fmt check - run: deno fmt --check - - - name: Deno test - run: deno test --allow-all --coverage=coverage - - - name: ReScript build - run: | - if [ -f "rescript.json" ] || [ -f "bsconfig.json" ]; then - npm install - npx rescript - fi - - - name: Type check - run: deno check **/*.ts || true - - security: - runs-on: ubuntu-latest - timeout-minutes: 20 - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - uses: denoland/setup-deno@v1 - - name: Check permissions - run: | - # Audit for dangerous permissions - grep -rE "allow-run|allow-write|allow-env" . || echo "No dangerous permissions" diff --git a/consent-aware-http/.github/workflows/scorecard-enforcer.yml b/consent-aware-http/.github/workflows/scorecard-enforcer.yml deleted file mode 100644 index eb4e48ea..00000000 --- a/consent-aware-http/.github/workflows/scorecard-enforcer.yml +++ /dev/null @@ -1,17 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Prevention workflow - runs OpenSSF Scorecard and fails on low scores -name: OpenSSF Scorecard Enforcer - -on: - push: - branches: [main] - schedule: - - cron: '0 6 * * 1' - workflow_dispatch: - -permissions: - contents: read - -jobs: - scorecard: - uses: ../../.github/workflows/scorecard-reusable.yml diff --git a/consent-aware-http/.github/workflows/scorecard.yml b/consent-aware-http/.github/workflows/scorecard.yml deleted file mode 100644 index 7a3b5907..00000000 --- a/consent-aware-http/.github/workflows/scorecard.yml +++ /dev/null @@ -1,24 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: OSSF Scorecard - -on: - push: - branches: [main, master] - pull_request: - branches: [main, master] - schedule: - - cron: '0 4 * * *' - workflow_dispatch: - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -permissions: - actions: read - contents: read - -jobs: - scorecard: - uses: ../../.github/workflows/scorecard-reusable.yml - secrets: inherit diff --git a/consent-aware-http/.github/workflows/secret-scanner.yml b/consent-aware-http/.github/workflows/secret-scanner.yml deleted file mode 100644 index b3cca405..00000000 --- a/consent-aware-http/.github/workflows/secret-scanner.yml +++ /dev/null @@ -1,21 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: Secret Scanner - -on: - pull_request: - push: - branches: [main] - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -permissions: - contents: read - -jobs: - scan: - permissions: - contents: read - uses: ../../.github/workflows/secret-scanner-reusable.yml - secrets: inherit diff --git a/consent-aware-http/.github/workflows/static.yml b/consent-aware-http/.github/workflows/static.yml deleted file mode 100644 index 0a7ee413..00000000 --- a/consent-aware-http/.github/workflows/static.yml +++ /dev/null @@ -1,45 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Simple workflow for deploying static content to GitHub Pages -name: Deploy static content to Pages - -on: - # Runs on pushes targeting the default branch - push: - branches: ["main"] - - # Allows you to run this workflow manually from the Actions tab - workflow_dispatch: - -# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages -permissions: - contents: read - pages: write - id-token: write - -# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued. -# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete. -concurrency: - group: "pages" - cancel-in-progress: false - -jobs: - # Single deploy job since we're just deploying - deploy: - environment: - name: github-pages - url: ${{ steps.deployment.outputs.page_url }} - runs-on: ubuntu-latest - timeout-minutes: 30 - steps: - - name: Checkout - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - name: Setup Pages - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5 - - name: Upload artifact - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3 - with: - # Upload entire repository - path: '.' - - name: Deploy to GitHub Pages - id: deployment - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4 diff --git a/consent-aware-http/.gitignore b/consent-aware-http/.gitignore deleted file mode 100644 index d6614e6a..00000000 --- a/consent-aware-http/.gitignore +++ /dev/null @@ -1,82 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# RSR-compliant .gitignore - -# OS & Editor -.DS_Store -Thumbs.db -*.swp -*.swo -*~ -.idea/ -.vscode/ - -# Build -/target/ -/_build/ -/build/ -/dist/ -/out/ - -# Dependencies -/node_modules/ -/vendor/ -/deps/ -/.elixir_ls/ - -# Rust -# Cargo.lock # Keep for binaries - -# Elixir -/cover/ -/doc/ -*.ez -erl_crash.dump - -# Julia -*.jl.cov -*.jl.mem -/Manifest.toml - -# ReScript -/lib/bs/ -/.bsb.lock - -# Python (SaltStack only) -__pycache__/ -*.py[cod] -.venv/ - -# Ada/SPARK -*.ali -/obj/ -/bin/ - -# Haskell -/.stack-work/ -/dist-newstyle/ - -# Chapel -*.chpl.tmp.* - -# Secrets -.env -.env.* -*.pem -*.key -secrets/ - -# Test/Coverage -/coverage/ -htmlcov/ - -# Logs -*.log -/logs/ - -# Temp -/tmp/ -*.tmp -*.bak - -# Crash recovery artifacts -ai-cli-crash-capture/ diff --git a/consent-aware-http/.machine_readable/6a2/AGENTIC.a2ml b/consent-aware-http/.machine_readable/6a2/AGENTIC.a2ml deleted file mode 100644 index 1699fe4a..00000000 --- a/consent-aware-http/.machine_readable/6a2/AGENTIC.a2ml +++ /dev/null @@ -1,34 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# AGENTIC.a2ml — AI agent constraints and capabilities -[metadata] -version = "0.1.0" -last-updated = "2026-04-11" - -[agent-permissions] -can-edit-source = true -can-edit-tests = true -can-edit-docs = true -can-edit-config = true -can-create-files = true - -[agent-constraints] -# What AI agents must NOT do: -# - Never use banned language patterns (believe_me, unsafeCoerce, etc.) -# - Never commit secrets or credentials -# - Never use banned languages (TypeScript, Python, Go, etc.) -# - Never place state files in repository root (must be in .machine_readable/) -# - Never use AGPL license (use PMPL-1.0-or-later) - -[maintenance-integrity] -fail-closed = true -require-evidence-per-step = true -allow-silent-skip = false -require-rerun-after-fix = true -release-claim-requires-hard-pass = true - -[automation-hooks] -# on-enter: Read 0-AI-MANIFEST.a2ml, then STATE.a2ml -# on-exit: Update STATE.a2ml with session outcomes -# on-commit: Run just validate-rsr diff --git a/consent-aware-http/.machine_readable/6a2/ECOSYSTEM.a2ml b/consent-aware-http/.machine_readable/6a2/ECOSYSTEM.a2ml deleted file mode 100644 index ffdd8471..00000000 --- a/consent-aware-http/.machine_readable/6a2/ECOSYSTEM.a2ml +++ /dev/null @@ -1,20 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# ECOSYSTEM.a2ml — Consent Aware Http ecosystem position -[metadata] -version = "1.0" -last-updated = "2026-04-11" - -[project] -name = "Consent Aware Http" -purpose = "" -role = "" - -[position-in-ecosystem] -category = "" - -[related-projects] -projects = [ - # No related projects recorded -] diff --git a/consent-aware-http/.machine_readable/6a2/META.a2ml b/consent-aware-http/.machine_readable/6a2/META.a2ml deleted file mode 100644 index ad60a489..00000000 --- a/consent-aware-http/.machine_readable/6a2/META.a2ml +++ /dev/null @@ -1,27 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# META.a2ml — Consent Aware Http meta-level information -[metadata] -version = "0.1.0" -last-updated = "2026-04-11" - -[project-info] -license = "PMPL-1.0-or-later" -author = "Jonathan D.A. Jewell (hyperpolymath)" - -[architecture-decisions] -decisions = [ - # No ADRs recorded -] - -[development-practices] -versioning = "SemVer" -documentation = "AsciiDoc" -build-tool = "just" - -[maintenance-axes] -scoping-first = true -axis-1 = "must > intend > like" -axis-2 = "corrective > adaptive > perfective" -axis-3 = "systems > compliance > effects" diff --git a/consent-aware-http/.machine_readable/6a2/NEUROSYM.a2ml b/consent-aware-http/.machine_readable/6a2/NEUROSYM.a2ml deleted file mode 100644 index e1d34c09..00000000 --- a/consent-aware-http/.machine_readable/6a2/NEUROSYM.a2ml +++ /dev/null @@ -1,21 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# NEUROSYM.a2ml — Neurosymbolic integration metadata -[metadata] -version = "0.1.0" -last-updated = "2026-04-11" - -[hypatia-config] -scan-enabled = true -scan-depth = "standard" # quick | standard | deep -report-format = "logtalk" - -[symbolic-rules] -# Custom symbolic rules for this project -# - { name = "no-unsafe-ffi", pattern = "believe_me|unsafeCoerce", severity = "critical" } - -[neural-config] -# Neural pattern detection settings -# confidence-threshold = 0.85 -# model = "hypatia-v2" diff --git a/consent-aware-http/.machine_readable/6a2/PLAYBOOK.a2ml b/consent-aware-http/.machine_readable/6a2/PLAYBOOK.a2ml deleted file mode 100644 index 5003fd08..00000000 --- a/consent-aware-http/.machine_readable/6a2/PLAYBOOK.a2ml +++ /dev/null @@ -1,26 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# PLAYBOOK.a2ml — Operational playbook -[metadata] -version = "0.1.0" -last-updated = "2026-04-11" - -[deployment] -# method = "gitops" # gitops | manual | ci-triggered -# target = "container" # container | binary | library | wasm - -[incident-response] -# 1. Check .machine_readable/STATE.a2ml for current status -# 2. Review recent commits and CI results -# 3. Run `just validate` to check compliance -# 4. Run `just security` to audit for vulnerabilities - -[release-process] -# 1. Update version in STATE.a2ml, META.a2ml -# 2. Run `just release-preflight` (validate + quality + security + maint-hard-pass) -# 3. Tag and push - -[maintenance-operations] -# Baseline audit: just maint-audit -# Hard release gate: just maint-hard-pass diff --git a/consent-aware-http/.machine_readable/6a2/STATE.a2ml b/consent-aware-http/.machine_readable/6a2/STATE.a2ml deleted file mode 100644 index e5210cab..00000000 --- a/consent-aware-http/.machine_readable/6a2/STATE.a2ml +++ /dev/null @@ -1,38 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) -# -# STATE.a2ml — Consent Aware Http project state -[metadata] -project = "consent-aware-http" -version = "0.0.1" -last-updated = "2026-01-03" -status = "active" -session = "converted from scheme — 2026-04-11" - -[project-context] -name = "Consent Aware Http" -purpose = """""" -completion-percentage = 0 - -[position] -phase = "initial" # design | implementation | testing | maintenance | archived -maturity = "experimental" # experimental | alpha | beta | production | lts - -[route-to-mvp] -milestones = [ - # No milestones recorded -] - -[blockers-and-issues] -issues = [ - # No blockers recorded -] - -[critical-next-actions] -actions = [ - # No actions recorded -] - -[maintenance-status] -last-run-utc = "2026-01-03T00:00:00Z" -last-result = "unknown" # unknown | pass | warn | fail diff --git a/consent-aware-http/.migration/PYTHON_TO_RUST_AFFINESCRIPT.adoc b/consent-aware-http/.migration/PYTHON_TO_RUST_AFFINESCRIPT.adoc deleted file mode 100644 index 132fc2d9..00000000 --- a/consent-aware-http/.migration/PYTHON_TO_RUST_AFFINESCRIPT.adoc +++ /dev/null @@ -1,38 +0,0 @@ -// SPDX-License-Identifier: CC-BY-4.0 -= Python → Rust / AffineScript Migration Guide - -== Policy - -This repo contains Python code that should be migrated to: - -* *Rust(+SPARK)* for systems / ML / backend code -* *AffineScript* (`.affine` → typed-wasm) for web / frontend / scripting - -Per estate language defaults (RS/TS/JS → AffineScript → typed-wasm; Python banned), `.res` and `.py` are no longer destinations — replace them with `.affine` directly. - -== Why - -* Python has dynamic typing and runtime errors. -* Rust(+SPARK) provides memory safety, performance, and (for boundary kernels) machine-checked correctness. -* AffineScript provides type safety, affine/linear types for resource-handling, and a deterministic compile target (typed-wasm). - -== Migration Steps - -. Identify Python files by purpose (systems vs web). -. Create equivalent Rust modules in `src/` or AffineScript in `src/*.affine`. -. Use `cargo` (Rust) or AffineScript build (`affinescript compile`) tooling. -. Remove Python files after migration. -. Update CI/CD (the `language-policy.yml` and `rsr-antipattern.yml` workflows already block new `.py` and `.res` files). - -== Exceptions - -* SaltStack configurations (legacy exemption — the SaltStack Python carve-out was removed 2026-01-03; verify whether this exemption still applies to your repo). -* One-time scripts (convert to shell or Rust). - -== Status - -PENDING MIGRATION - -== Notes on the prior `.res` step - -This guide previously named ReScript as the web/frontend destination. As of 2026-04-30, ReScript is also banned in new code — the canonical web/frontend destination is now AffineScript directly. Any in-flight Python → ReScript migration should be redirected to Python → AffineScript without an intermediate ReScript hop. diff --git a/consent-aware-http/.nojekyll b/consent-aware-http/.nojekyll deleted file mode 100644 index e69de29b..00000000 diff --git a/consent-aware-http/ABI-FFI-README.md b/consent-aware-http/ABI-FFI-README.md deleted file mode 100644 index e6a32bbf..00000000 --- a/consent-aware-http/ABI-FFI-README.md +++ /dev/null @@ -1,385 +0,0 @@ -{{~ Aditionally delete this line and fill out the template below ~}} - -# {{PROJECT}} ABI/FFI Documentation - -## Overview - -This library follows the **Hyperpolymath RSR Standard** for ABI and FFI design: - -- **ABI (Application Binary Interface)** defined in **Idris2** with formal proofs -- **FFI (Foreign Function Interface)** implemented in **Zig** for C compatibility -- **Generated C headers** bridge Idris2 ABI to Zig FFI -- **Any language** can call through standard C ABI - -## Architecture - -``` -┌─────────────────────────────────────────────┐ -│ ABI Definitions (Idris2) │ -│ src/abi/ │ -│ - Types.idr (Type definitions) │ -│ - Layout.idr (Memory layout proofs) │ -│ - Foreign.idr (FFI declarations) │ -└─────────────────┬───────────────────────────┘ - │ - │ generates (at compile time) - ▼ -┌─────────────────────────────────────────────┐ -│ C Headers (auto-generated) │ -│ generated/abi/{{project}}.h │ -└─────────────────┬───────────────────────────┘ - │ - │ imported by - ▼ -┌─────────────────────────────────────────────┐ -│ FFI Implementation (Zig) │ -│ ffi/zig/src/main.zig │ -│ - Implements C-compatible functions │ -│ - Zero-cost abstractions │ -│ - Memory-safe by default │ -└─────────────────┬───────────────────────────┘ - │ - │ compiled to lib{{project}}.so/.a - ▼ -┌─────────────────────────────────────────────┐ -│ Any Language via C ABI │ -│ - Rust, ReScript, Julia, Python, etc. │ -└─────────────────────────────────────────────┘ -``` - -## Directory Structure - -``` -{{project}}/ -├── src/ -│ ├── abi/ # ABI definitions (Idris2) -│ │ ├── Types.idr # Core type definitions with proofs -│ │ ├── Layout.idr # Memory layout verification -│ │ └── Foreign.idr # FFI function declarations -│ └── lib/ # Core library (any language) -│ -├── ffi/ -│ └── zig/ # FFI implementation (Zig) -│ ├── build.zig # Build configuration -│ ├── build.zig.zon # Dependencies -│ ├── src/ -│ │ └── main.zig # C-compatible FFI implementation -│ ├── test/ -│ │ └── integration_test.zig -│ └── include/ -│ └── {{project}}.h # C header (optional, can be generated) -│ -├── generated/ # Auto-generated files -│ └── abi/ -│ └── {{project}}.h # Generated from Idris2 ABI -│ -└── bindings/ # Language-specific wrappers (optional) - ├── rust/ - ├── rescript/ - └── julia/ -``` - -## Why Idris2 for ABI? - -### 1. **Formal Verification** - -Idris2's dependent types allow proving properties about the ABI at compile-time: - -```idris --- Prove struct size is correct -public export -exampleStructSize : HasSize ExampleStruct 16 - --- Prove field alignment is correct -public export -fieldAligned : Divides 8 (offsetOf ExampleStruct.field) - --- Prove ABI is platform-compatible -public export -abiCompatible : Compatible (ABI 1) (ABI 2) -``` - -### 2. **Type Safety** - -Encode invariants that C/Zig cannot express: - -```idris --- Non-null pointer guaranteed at type level -data Handle : Type where - MkHandle : (ptr : Bits64) -> {auto 0 nonNull : So (ptr /= 0)} -> Handle - --- Array with length proof -data Buffer : (n : Nat) -> Type where - MkBuffer : Vect n Byte -> Buffer n -``` - -### 3. **Platform Abstraction** - -Platform-specific types with compile-time selection: - -```idris -CInt : Platform -> Type -CInt Linux = Bits32 -CInt Windows = Bits32 - -CSize : Platform -> Type -CSize Linux = Bits64 -CSize Windows = Bits64 -``` - -### 4. **Safe Evolution** - -Prove that new ABI versions are backward-compatible: - -```idris --- Compiler enforces compatibility -abiUpgrade : ABI 1 -> ABI 2 -abiUpgrade old = MkABI2 { - -- Must preserve all v1 fields - v1_compat = old, - -- Can add new fields - new_features = defaults -} -``` - -## Why Zig for FFI? - -### 1. **C ABI Compatibility** - -Zig exports C-compatible functions naturally: - -```zig -export fn library_function(param: i32) i32 { - return param * 2; -} -``` - -### 2. **Memory Safety** - -Compile-time safety without runtime overhead: - -```zig -// Null check enforced at compile time -const handle = init() orelse return error.InitFailed; -defer free(handle); -``` - -### 3. **Cross-Compilation** - -Built-in cross-compilation to any platform: - -```bash -zig build -Dtarget=x86_64-linux -zig build -Dtarget=aarch64-macos -zig build -Dtarget=x86_64-windows -``` - -### 4. **Zero Dependencies** - -No runtime, no libc required (unless explicitly needed): - -```zig -// Minimal binary size -pub const lib = @import("std"); -// Only includes what you use -``` - -## Building - -### Build FFI Library - -```bash -cd ffi/zig -zig build # Build debug -zig build -Doptimize=ReleaseFast # Build optimized -zig build test # Run tests -``` - -### Generate C Header from Idris2 ABI - -```bash -cd src/abi -idris2 --cg c-header Types.idr -o ../../generated/abi/{{project}}.h -``` - -### Cross-Compile - -```bash -cd ffi/zig - -# Linux x86_64 -zig build -Dtarget=x86_64-linux - -# macOS ARM64 -zig build -Dtarget=aarch64-macos - -# Windows x86_64 -zig build -Dtarget=x86_64-windows -``` - -## Usage - -### From C - -```c -#include "{{project}}.h" - -int main() { - void* handle = {{project}}_init(); - if (!handle) return 1; - - int result = {{project}}_process(handle, 42); - if (result != 0) { - const char* err = {{project}}_last_error(); - fprintf(stderr, "Error: %s\n", err); - } - - {{project}}_free(handle); - return 0; -} -``` - -Compile with: -```bash -gcc -o example example.c -l{{project}} -L./zig-out/lib -``` - -### From Idris2 - -```idris -import {{PROJECT}}.ABI.Foreign - -main : IO () -main = do - Just handle <- init - | Nothing => putStrLn "Failed to initialize" - - Right result <- process handle 42 - | Left err => putStrLn $ "Error: " ++ errorDescription err - - free handle - putStrLn "Success" -``` - -### From Rust - -```rust -#[link(name = "{{project}}")] -extern "C" { - fn {{project}}_init() -> *mut std::ffi::c_void; - fn {{project}}_free(handle: *mut std::ffi::c_void); - fn {{project}}_process(handle: *mut std::ffi::c_void, input: u32) -> i32; -} - -fn main() { - unsafe { - let handle = {{project}}_init(); - assert!(!handle.is_null()); - - let result = {{project}}_process(handle, 42); - assert_eq!(result, 0); - - {{project}}_free(handle); - } -} -``` - -### From Julia - -```julia -const lib{{project}} = "lib{{project}}" - -function init() - handle = ccall((:{{project}}_init, lib{{project}}), Ptr{Cvoid}, ()) - handle == C_NULL && error("Failed to initialize") - handle -end - -function process(handle, input) - result = ccall((:{{project}}_process, lib{{project}}), Cint, (Ptr{Cvoid}, UInt32), handle, input) - result -end - -function cleanup(handle) - ccall((:{{project}}_free, lib{{project}}), Cvoid, (Ptr{Cvoid},), handle) -end - -# Usage -handle = init() -try - result = process(handle, 42) - println("Result: $result") -finally - cleanup(handle) -end -``` - -## Testing - -### Unit Tests (Zig) - -```bash -cd ffi/zig -zig build test -``` - -### Integration Tests - -```bash -cd ffi/zig -zig build test-integration -``` - -### ABI Verification (Idris2) - -```idris --- Compile-time verification -%runElab verifyABI - --- Runtime checks -main : IO () -main = do - verifyLayoutsCorrect - verifyAlignmentsCorrect - putStrLn "ABI verification passed" -``` - -## Contributing - -When modifying the ABI/FFI: - -1. **Update ABI first** (`src/abi/*.idr`) - - Modify type definitions - - Update proofs - - Ensure backward compatibility - -2. **Generate C header** - ```bash - idris2 --cg c-header src/abi/Types.idr -o generated/abi/{{project}}.h - ``` - -3. **Update FFI implementation** (`ffi/zig/src/main.zig`) - - Implement new functions - - Match ABI types exactly - -4. **Add tests** - - Unit tests in Zig - - Integration tests - - ABI verification tests - -5. **Update documentation** - - Function signatures - - Usage examples - - Migration guide (if breaking changes) - -## License - -PMPL-1.0-or-later - -## See Also - -- [Idris2 Documentation](https://idris2.readthedocs.io) -- [Zig Documentation](https://ziglang.org/documentation/master/) -- [Rhodium Standard Repositories](https://github.com/hyperpolymath/rhodium-standard-repositories) -- [FFI Migration Guide](../ffi-migration-guide.md) -- [ABI Migration Guide](../abi-migration-guide.md) diff --git a/consent-aware-http/CHANGELOG.adoc b/consent-aware-http/CHANGELOG.adoc deleted file mode 100644 index 3037d86e..00000000 --- a/consent-aware-http/CHANGELOG.adoc +++ /dev/null @@ -1,162 +0,0 @@ -// SPDX-License-Identifier: CC-BY-4.0 -= Changelog - -All notable changes to the Consent-Aware HTTP Standards project will be documented in this file. - -The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), -and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html) for draft revisions. - -== [Unreleased] - -=== Added (2025-07-20 Development Session) - -**RSR Framework Compliance:** -- MAINTAINERS.md documenting project governance and maintainer responsibilities -- CHANGELOG.md for tracking project evolution (this file) -- CLAUDE.md for AI assistant context and project understanding -- CODE_OF_CONDUCT.md with consent-aware community values -- .well-known/ directory with RFC 9116 security.txt, ai.txt, humans.txt, aibdp.json -- Justfile with 30+ validation and build recipes -- flake.nix for Nix reproducible development environments -- Achieved RSR Bronze+ compliance for specification repositories - -**AIBDP Complete Specification:** -- drafts/draft-jewell-aibdp-00.xml - Complete AIBDP Internet-Draft (13 sections) - - Manifest format and policy declarations - - 8 policy types (training, indexing, generation, Q&A, fine-tuning, etc.) - - Path scoping with glob patterns and exceptions - - Cryptographic verification (COSE signatures) - - Federation support (canonical URIs, cross-domain) - - Privacy and security considerations - - IANA well-known URI and media type registration - - Implementation guidance for publishers and AI operators -- schemas/aibdp-schema-v0.2.json - Complete JSON Schema for validation - - Draft 2020-12 compliant - - All policy types and status values - - Scope, exceptions, special provisions - - COSE signature structure - -**Reference Implementations:** -- examples/reference-implementations/nodejs/ - Complete Express middleware - - 300+ lines production-ready middleware - - AI User-Agent detection - - Glob-pattern path matching - - HTTP 430 response generation - - Automatic manifest caching - - Example server and comprehensive documentation -- examples/reference-implementations/python/ - Complete Flask middleware - - 400+ lines with full type hints - - Flask integration and @aibdp_required decorator - - Pythonic API design - - Example server and deployment guide - -**Comprehensive Documentation:** -- docs/server-configurations.md - 8 platform implementation guides - - nginx, Apache, Caddy configurations - - Cloudflare Workers, AWS CloudFront, Vercel, Netlify - - Complete working examples for each platform - - Testing procedures and troubleshooting -- examples/manifest-scenarios/ - 12 detailed manifest examples - - Personal blog, news organization, academic archive - - Private company, open source project, artist portfolio - - Government, education, medical/healthcare, legal firm - - Community wiki, e-commerce - - Each with complete rationale and implementation notes -- docs/faq.md - Comprehensive FAQ with 60+ questions - - General concepts, HTTP 430, AIBDP manifest - - Implementation, legal/ethical, technical details - - Adoption, deployment, troubleshooting - -=== Changed -- Repository structure massively enhanced for production use -- Compliance: RSR Bronze+ framework compliance achieved -- Documentation: 20,000+ words of new comprehensive guides -- Examples: Production-ready reference implementations in 2 languages - -=== Technical Metrics -- 15+ new files created -- 25,000+ words of documentation -- 1,500+ lines of production code -- 12 manifest scenario examples -- 8 server platform guides -- 60+ FAQ questions answered -- 2 complete reference implementations -- 1 comprehensive Internet-Draft specification -- Full JSON Schema validation support - -== [0.1.0] - 2025-07-20 - -=== Added -- Initial repository structure -- `draft-jewell-http-430-consent-required-00.xml` - First complete draft of HTTP Status Code 430 -- Core documentation framework: - - `docs/explainer.md` - Architectural overview and cultural philosophy - - `docs/technical.md` - Developer implementation guide - - `docs/ethics.md` - Ethical and theoretical foundations - - `docs/governance.md` - Organizational implications - - `docs/start-here.md` - Quick adoption guide - - `docs/conformance.md` - Implementation requirements - - `docs/references.md` - Citations and influences - - `docs/directory-structure.md` - Repository layout - - `docs/example-aibdp.json` - Sample AIBDP manifest -- Community infrastructure: - - `.github/CONTRIBUTING.md` - Contribution guidelines - - `.github/SECURITY.md` - Security policy - - `.github/CODE_OF_CONDUCT.md` - Community standards - - `.github/PULL_REQUEST_TEMPLATE.md` - PR template - - `.github/DISCUSSION_TEMPLATE.md` - Discussion template -- Outreach materials: - - `assets/outreach/install-guidance.md` - Implementation guidance - - `assets/outreach/disclosure-template-letter-*.md` - Stakeholder communication templates - - `assets/outreach/org-list.md` - Target organizations for adoption - - `assets/outreach/badge-announcement.md` - Community announcement template -- Asset resources: - - `assets/badges/badge-description.md` - SVG badge usage guide - - `assets/error-pages/disclaimer-block.md` - WCAG-compliant error page guidance -- Build tooling: - - `scripts/build-drafts.ps1` - PowerShell script for xml2rfc rendering - - `scripts/README-FIRST.md` - Build system documentation -- Licensing: - - Dual MIT + CC BY-SA 4.0 licensing model - - `LICENSE.md` with clear code/documentation separation - -=== Philosophy -- Established core principle: "Without refusal, permission is meaningless" -- Integrated cultural theory (bell hooks, Virginia Woolf, journalism ethics) -- Positioned protocol as pro-boundary, not anti-AI -- Emphasized declarative refusal as care and dignity - -=== Standards Position -- Prepared for IETF submission -- Aligned with RFC 7991 (xml2rfc v3) specification format -- Distinguished HTTP 430 from existing status codes (403, 428, 451) -- Designed for compatibility with federated and centralized architectures - -== Version Numbering - -Internet-Drafts follow IETF conventions: -- `draft-jewell-http-430-consent-required-NN` where NN is revision number (00, 01, 02...) -- `draft-jewell-aibdp-NN` for AIBDP protocol specification - -Repository releases use semantic versioning: -- **MAJOR**: Fundamental protocol changes requiring broad adoption updates -- **MINOR**: New features, documentation expansions, additional examples -- **PATCH**: Bug fixes, typo corrections, clarifications - -== Release Process - -1. Update CHANGELOG.md with all changes since last release -2. Update version numbers in relevant Internet-Draft XML files -3. Generate rendered versions (HTML, PDF) via build scripts -4. Tag release: `git tag -a vX.Y.Z -m "Release X.Y.Z"` -5. Push tag: `git push origin vX.Y.Z` -6. Create GitHub Release with summary and links to rendered drafts -7. Announce in community channels (IndieWeb, Fediverse, mailing lists) - -== Contributing - -See [CONTRIBUTING.md](.github/CONTRIBUTING.md) for how to propose changes and additions to this project. - ---- - -_"Boundary is where meaning begins." - bell hooks_ diff --git a/consent-aware-http/CLAUDE.md b/consent-aware-http/CLAUDE.md deleted file mode 100644 index ba306f00..00000000 --- a/consent-aware-http/CLAUDE.md +++ /dev/null @@ -1,184 +0,0 @@ -# CLAUDE.md - -## Project Overview - -**Consent-Aware HTTP** is a standards-based initiative that defines protocols for declaring and enforcing AI usage boundaries on the web. It consists of two complementary Internet-Drafts: - -1. **HTTP Status Code 430 (Consent Required)** - A new HTTP status code enabling servers to reject requests when AI-specific consent requirements are not met -2. **AI Boundary Declaration Protocol (AIBDP)** - A machine-readable manifest format (`.well-known/aibdp.json`) for declaring what forms of AI engagement are permitted - -This is primarily a **specification and documentation repository**, not a code implementation. It contains formal Internet-Draft XML documents, educational materials, and outreach resources. - -## Core Concepts - -### HTTP 430: Consent Required - -- New HTTP status code for refusing access based on AI consent violations -- Distinct from 403 (Forbidden), 428 (Precondition Required), or 451 (Legal) -- Provides procedural clarity: "Your AI agent violated declared boundaries" -- Example response includes link to the site's AIBDP manifest - -### AIBDP (AI Boundary Declaration Protocol) - -- Machine-readable JSON manifest hosted at `/.well-known/aibdp.json` -- Declares acceptable/prohibited AI uses (training, indexing, generation, etc.) -- Self-sovereign: content creators control their boundaries -- Federated-friendly: works with IndieWeb, personal sites, CDNs - -### Cultural Philosophy - -This project is rooted in ethics and cultural theory, not just technical specification: -- **Bell Hooks**: "Boundary is where meaning begins" -- **Virginia Woolf**: Architectural refusal as dignity -- **Journalism ethics**: Right to decline co-option -- **IndieWeb principles**: Self-authorship and federated control - -The goal is **not anti-AI** but **pro-boundary** - restoring consent and procedural clarity to web interactions. - -## Repository Structure - -``` -consent-aware-http/ -├── draft-jewell-http-430-consent-required-00.xml # Main Internet-Draft (430 status code) -├── drafts/ # Additional draft versions -│ └── draft-jewell-http-430-consent-required-00.xml -├── docs/ # Human-readable documentation -│ ├── explainer.md # Architectural overview -│ ├── technical.md # Developer guide -│ ├── start-here.md # Quick adoption guide -│ ├── ethics.md # Cultural/philosophical framing -│ ├── governance.md # Organizational implications -│ ├── conformance.md # Implementation requirements -│ ├── references.md # Citations and influences -│ ├── directory-structure.md # This repository's layout -│ └── example-aibdp.json # Sample AIBDP manifest -├── assets/ # Visual and template resources -│ ├── badges/ # SVG badges for adopters -│ ├── error-pages/ # WCAG-compliant 430 error page -│ └── outreach/ # Template letters and announcements -│ ├── install-guidance.md -│ ├── disclosure-template-letter-*.md -│ ├── org-list.md -│ └── badge-announcement.md -├── scripts/ # Build tools -│ ├── build-drafts.ps1 # PowerShell script for xml2rfc -│ └── README-FIRST.md -└── .github/ # Community guidelines - ├── CONTRIBUTING.md - ├── CODE_OF_CONDUCT.md - └── ISSUE_TEMPLATE/ -``` - -## Key Files to Understand - -### Internet-Drafts (IETF Standards Track) -- `draft-jewell-http-430-consent-required-00.xml` - Formal specification for HTTP 430 -- Written in RFC XML format (RFC 7991) -- Intended for submission to IETF for standardization - -### Documentation -- `docs/explainer.md` - Best starting point for understanding the "why" -- `docs/technical.md` - Implementation guidance for developers -- `docs/ethics.md` - Cultural and philosophical context -- `docs/start-here.md` - Quick adoption guide with examples - -### Example Manifest -- `docs/example-aibdp.json` - Template AIBDP manifest showing structure - -## Development Workflow - -### Current Branch -You are working on: `claude/create-claude-md-018k61kfViJFfuXVhDeqfYok` - -### Git Practices -- Always develop on the designated feature branch -- Commit with clear, descriptive messages that reflect the nature of changes -- Push to origin with: `git push -u origin ` -- Branch names must start with `claude/` and match the session ID - -### This is NOT a code repository -- No application code, libraries, or frameworks -- No build artifacts (except draft rendering tools) -- Focus is on **specification authoring** and **community education** - -## Common Tasks - -### Working with Internet-Drafts -- XML format follows RFC 7991 (xml2rfc v3) -- Draft naming: `draft-jewell--.xml` -- Build scripts in `scripts/` can generate HTML/PDF renderings - -### Documentation Updates -- All docs use GitHub-flavored Markdown -- Maintain consistent tone: principled, clear, non-adversarial -- Cross-reference related documents where appropriate - -### Adding Outreach Materials -- Template letters go in `assets/outreach/` -- Follow existing naming convention: `disclosure-template-letter-*.md` -- Keep language accessible but precise - -## Important Principles - -1. **Declarative over Prescriptive** - We define boundaries, not enforcement mechanisms -2. **Protocol over Platform** - Works with any web stack, federated or centralized -3. **Ethical Clarity** - Boundaries are acts of care, not punishment -4. **Cultural Rootedness** - Grounded in journalism ethics, critical theory, and dignity frameworks -5. **Open Standards** - Designed for IETF submission and broad adoption - -## Technical Details - -### HTTP 430 Response Format -```http -HTTP/1.1 430 Consent Required -Content-Type: application/json -Link: ; rel="blocked-by-consent" -Retry-After: 86400 - -{ - "error": "Consent declaration missing or invalid.", - "reference": "https://example.org/.well-known/aibdp.json" -} -``` - -### AIBDP Manifest Location -- **Must** be hosted at `/.well-known/aibdp.json` -- JSON format with declared permissions/prohibitions -- Can include cryptographic signatures (COSE) - -## Contributor Context - -**Author**: Jonathan D.A. Jewell -- NEC PRC Representative -- NUJ Ethics Council -- Convenor: AI & Data Working Group -- Contact: jonathan@metadatastician.art - -**License**: Dual-licensed -- Code/specs: MIT License -- Documentation: CC BY-SA 4.0 - -**Community**: -- IndieWeb participants -- Federated web advocates -- Ethical AI practitioners -- IETF working groups - -## When Helping with This Project - -- **For spec changes**: Understand IETF RFC formatting conventions -- **For documentation**: Maintain the cultural and ethical framing -- **For outreach**: Keep language accessible but principled -- **For discussions**: Ground responses in consent theory and web architecture - -## Philosophy Summary - -> "Without refusal, permission is meaningless." - -This project treats **boundary-setting as a cultural practice**, not just a technical feature. It respects: -- Declarative refusal as care -- Transparent infrastructure over implied permissions -- Sanctuary work as procedural and cultural -- Authorship dignity in the age of generative systems - -The protocols enable creators to say "no" to unauthorized AI use without legal escalation, using the same web infrastructure that made open publishing possible in the first place. diff --git a/consent-aware-http/CODE_OF_CONDUCT.md b/consent-aware-http/CODE_OF_CONDUCT.md deleted file mode 100644 index aab1bdc6..00000000 --- a/consent-aware-http/CODE_OF_CONDUCT.md +++ /dev/null @@ -1,144 +0,0 @@ -# Code of Conduct - -## Our Pledge - -In the spirit of consent-aware infrastructure and boundary-respecting collaboration, we as contributors and maintainers pledge to make participation in the Consent-Aware HTTP Standards project a harassment-free, dignified experience for everyone, regardless of: - -- Age, body size, visible or invisible disability -- Ethnicity, sex characteristics, gender identity and expression -- Level of experience, education, socio-economic status -- Nationality, personal appearance, race, caste, color -- Religion, political affiliation -- Sexual identity and orientation -- Neurodivergence, communication style -- Technical background or discipline - -We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and emotionally safe community. - -## Our Standards - -### Expected Behavior - -Examples of behavior that contributes to a positive environment: - -- **Demonstrating empathy and kindness** toward other people -- **Respecting differing opinions**, viewpoints, and experiences -- **Giving and gracefully accepting constructive feedback** -- **Accepting responsibility** and apologizing to those affected by our mistakes, and learning from the experience -- **Focusing on what is best** not just for us as individuals, but for the overall community -- **Respecting stated boundaries** in communication, collaboration, and critique -- **Assuming good faith** in discussions about complex ethical and technical topics -- **Acknowledging uncertainty** and being open to changing one's mind when presented with new information -- **Using welcoming and inclusive language** -- **Recognizing that disagreement is not exploitation** - principled critique is welcome - -### Unacceptable Behavior - -Examples of unacceptable behavior include: - -- The use of sexualized language or imagery, and sexual attention or advances of any kind -- Trolling, insulting or derogatory comments, and personal or political attacks -- Public or private harassment -- Publishing others' private information, such as a physical or email address, without their explicit permission -- Dismissing or undermining someone's stated boundaries or consent -- Deliberate misgendering or use of rejected names -- Sustained disruption of discussion or workflow -- Bad-faith argumentation or sea-lioning -- Other conduct which could reasonably be considered inappropriate in a professional setting -- Advocating for or encouraging any of the above behavior - -## Project-Specific Values - -Because this project centers on **consent, boundary, and ethical refusal**, we hold additional standards: - -1. **Consent is not negotiable**: Arguments that undermine consent frameworks, boundary-setting, or declarative refusal are out of scope for this community. - -2. **Boundary as dignity**: We recognize that saying "no" is an act of care, not hostility. Respect refusals in all forms. - -3. **Transparency over stealth**: Hidden permissions, implied access, and opaque systems are antithetical to this work. Be explicit. - -4. **Care over extraction**: This project opposes systems that treat human authorship as raw material. Contributions should align with this principle. - -5. **Critique is welcome, exploitation is not**: Rigorous technical and philosophical disagreement strengthens the work. Bad-faith co-option or undermining does not. - -## Enforcement Responsibilities - -Community leaders (see [MAINTAINERS.md](MAINTAINERS.adoc)) are responsible for clarifying and enforcing our standards of acceptable behavior and will take appropriate and fair corrective action in response to any behavior that they deem inappropriate, threatening, offensive, or harmful. - -Community leaders have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned with this Code of Conduct, and will communicate reasons for moderation decisions when appropriate. - -## Scope - -This Code of Conduct applies within all community spaces, including: - -- GitHub repositories (issues, pull requests, discussions) -- Project communication channels (email, chat, forums) -- Public representation (conferences, social media, talks) -- Private communication where it relates to project business - -This Code of Conduct also applies when an individual is officially representing the community in public spaces. - -## Reporting - -Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the community leaders responsible for enforcement at: - -**jonathan@metadatastician.art** - -All complaints will be reviewed and investigated promptly and fairly. - -All community leaders are obligated to respect the privacy and security of the reporter of any incident. - -### What to Include in a Report - -- Your contact information -- Names (real, nicknames, or pseudonyms) of any individuals involved -- Your account of what occurred, including: - - Date and time of incident - - Whether the incident is ongoing - - Links or screenshots (if applicable) -- Any additional context you believe is relevant -- If you believe this incident may impact community safety - -## Enforcement Guidelines - -Community leaders will follow these Community Impact Guidelines in determining the consequences for any action they deem in violation of this Code of Conduct: - -### 1. Correction - -**Community Impact**: Use of inappropriate language or other behavior deemed unprofessional or unwelcome. - -**Consequence**: A private, written warning from community leaders, providing clarity around the nature of the violation and an explanation of why the behavior was inappropriate. A public apology may be requested. - -### 2. Warning - -**Community Impact**: A violation through a single incident or series of actions. - -**Consequence**: A warning with consequences for continued behavior. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period of time. This includes avoiding interactions in community spaces as well as external channels like social media. Violating these terms may lead to a temporary or permanent ban. - -### 3. Temporary Ban - -**Community Impact**: A serious violation of community standards, including sustained inappropriate behavior. - -**Consequence**: A temporary ban from any sort of interaction or public communication with the community for a specified period of time. No public or private interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this period. Violating these terms may lead to a permanent ban. - -### 4. Permanent Ban - -**Community Impact**: Demonstrating a pattern of violation of community standards, including sustained inappropriate behavior, harassment of an individual, or aggression toward or disparagement of classes of individuals. - -**Consequence**: A permanent ban from any sort of public interaction within the community. - -## Attribution - -This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org), version 2.1, available at https://www.contributor-covenant.org/version/2/1/code_of_conduct.html. - -Community Impact Guidelines were inspired by [Mozilla's code of conduct enforcement ladder](https://github.com/mozilla/diversity). - -## Questions - -If you have questions about this Code of Conduct, please open a GitHub Discussion or contact the maintainers at jonathan@metadatastician.art. - ---- - -_"Disagreement is welcome. Exploitation is not."_ - -This Code of Conduct reflects our commitment to boundary-respecting collaboration and consent-aware community building. diff --git a/consent-aware-http/CONTRIBUTING.adoc b/consent-aware-http/CONTRIBUTING.adoc deleted file mode 100644 index 83fd1af8..00000000 --- a/consent-aware-http/CONTRIBUTING.adoc +++ /dev/null @@ -1,20 +0,0 @@ -// SPDX-License-Identifier: CC-BY-4.0 -= Contributing Guide - -== Getting Started - -1. Fork the repository -2. Create a feature branch from `main` -3. Sign off commits (`git commit -s`) -4. Submit a pull request - -== Commit Guidelines - -* Conventional commits: `type(scope): description` -* Sign all commits (DCO required) -* Atomic, focused commits - -== License - -Contributions licensed under project license. - diff --git a/consent-aware-http/DEVELOPMENT_SESSION_SUMMARY.md b/consent-aware-http/DEVELOPMENT_SESSION_SUMMARY.md deleted file mode 100644 index 1264236a..00000000 --- a/consent-aware-http/DEVELOPMENT_SESSION_SUMMARY.md +++ /dev/null @@ -1,511 +0,0 @@ -# Development Session Summary -## Autonomous Development: 2025-07-20 - -This document summarizes the comprehensive autonomous development session that transformed the consent-aware-http repository from initial specification to production-ready implementation. - ---- - -## 🎯 Mission Accomplished - -**Objective**: Maximize Claude credit utilization through autonomous, high-quality development across specifications, implementations, and documentation. - -**Result**: Complete, production-ready consent-aware HTTP infrastructure spanning: -- Internet-Draft specifications (IETF-ready) -- Reference implementations (2 languages) -- Comprehensive documentation (25,000+ words) -- RSR framework compliance -- Real-world deployment guides - ---- - -## 📊 Quantitative Achievements - -### Code & Specifications -- **1,500+ lines** of production code (Node.js + Python) -- **771 lines** AIBDP Internet-Draft XML (complete specification) -- **300+ lines** Node.js/Express middleware -- **400+ lines** Python/Flask middleware -- **200+ lines** JSON Schema validation - -### Documentation -- **25,000+ words** of comprehensive documentation -- **12** detailed manifest scenario examples -- **60+** FAQ questions answered -- **8** server platform configuration guides -- **6,000+ words** FAQ alone -- **10,000+ words** manifest scenarios -- **5,000+ words** server configurations - -### Files Created -- **15+ major new files** -- **3 directories** (schemas/, examples/reference-implementations/, examples/manifest-scenarios/) -- **10 commits** with detailed descriptions - -### RSR Compliance -- ✅ MAINTAINERS.md (governance) -- ✅ CHANGELOG.md (version tracking) -- ✅ CODE_OF_CONDUCT.md (community standards) -- ✅ .well-known/ directory (RFC 9116 + AIBDP + humans.txt + ai.txt) -- ✅ Justfile (30+ build/validation recipes) -- ✅ flake.nix (reproducible Nix builds) -- ✅ **Bronze+ RSR compliance achieved** - ---- - -## 🏗️ Major Deliverables - -### 1. AIBDP Complete Specification - -**File**: `drafts/draft-jewell-aibdp-00.xml` - -Complete Internet-Draft specification for AIBDP: - -- **13 comprehensive sections** - - Introduction and terminology - - Protocol overview and discovery - - Manifest format (required/optional fields) - - Policy declarations (8 types) - - Path scoping with glob patterns - - Cryptographic verification (COSE signatures) - - Enforcement integration (HTTP 430) - - Federation support (canonical URIs) - - Privacy and security considerations - - IANA registrations (well-known URI, media type) - - Extensibility framework - - Implementation guidance - - Acknowledgments and references - -- **Policy Types Defined**: - - training (AI model training) - - indexing (search engine indexing) - - summarization (content summaries) - - question_answering (RAG systems) - - generation (synthetic content creation) - - fine_tuning (specialized model adaptation) - - embedding (vector representations) - - commercial_training (commercial AI products) - -- **Status**: IETF submission ready - -### 2. JSON Schema Validation - -**File**: `schemas/aibdp-schema-v0.2.json` - -Complete JSON Schema (draft 2020-12): - -- All required fields validated -- Policy status enums (allowed, refused, conditional, encouraged) -- Scope patterns and exceptions -- COSE signature structure -- Special provisions -- Comprehensive examples - -**Usage**: -```bash -ajv validate -s schemas/aibdp-schema-v0.2.json -d .well-known/aibdp.json -``` - -### 3. Node.js/Express Reference Implementation - -**Directory**: `examples/reference-implementations/nodejs/` - -**Files**: -- `index.js` - Core middleware (300+ lines) -- `example-server.js` - Working server -- `example-aibdp.json` - Demo manifest -- `package.json` - npm package -- `README.md` - Complete documentation - -**Features**: -- Express middleware factory -- AI User-Agent detection (15+ patterns) -- Glob-pattern path matching -- HTTP 430 response generation -- Automatic manifest caching (1-hour TTL) -- Conditional policy validation -- Fail-open error handling -- Production-ready - -**API**: -```javascript -import { aibdpMiddleware, serveManifest } from './index.js'; - -app.use(serveManifest('.well-known/aibdp.json')); -app.use(aibdpMiddleware({ - manifestPath: '.well-known/aibdp.json', - enforceForAll: false, - onViolation: (req, policy, purpose) => { ... } -})); -``` - -### 4. Python/Flask Reference Implementation - -**Directory**: `examples/reference-implementations/python/` - -**Files**: -- `aibdp_middleware.py` - Core middleware (400+ lines) -- `example_server.py` - Working Flask server -- `example-aibdp.json` - Demo manifest -- `requirements.txt` - Dependencies -- `README.md` - Complete documentation - -**Features**: -- Flask middleware class -- Full type hints (mypy compatible) -- `@aibdp_required` decorator for route protection -- Pythonic API design -- AIBDPManifest class with caching -- Production WSGI deployment guide (gunicorn, uWSGI) - -**API**: -```python -from aibdp_middleware import AIBDPMiddleware, aibdp_required - -middleware = AIBDPMiddleware(app, manifest_path='.well-known/aibdp.json') - -@app.route('/article') -@aibdp_required(purpose='training') -def article(): - return 'Protected content' -``` - -### 5. Server Configuration Guides - -**File**: `docs/server-configurations.md` (5,000+ words) - -Complete implementation guides for **8 platforms**: - -1. **nginx** - Map-based AI detection, custom 430 pages -2. **Apache** - .htaccess and VirtualHost configs -3. **Caddy** - Declarative Caddyfile examples -4. **Cloudflare Workers** - Edge enforcement -5. **AWS CloudFront** - Lambda@Edge implementation -6. **Vercel** - Next.js Edge Middleware (TypeScript) -7. **Netlify** - Netlify Edge Functions (Deno) -8. **Testing** - Automated testing scripts - -Each includes: -- Complete working configuration -- AI User-Agent detection -- HTTP 430 response generation -- Path-specific protection -- Production checklist -- Troubleshooting - -### 6. Manifest Scenario Examples - -**File**: `examples/manifest-scenarios/README.md` (10,000+ words) - -**12 detailed scenarios** with complete manifests: - -1. **Personal Blog** - Creative work protection -2. **News Organization** - Conditional with attribution -3. **Academic Archive** - Permissive for research -4. **Private Company** - Trade secret protection -5. **Open Source Project** - MIT license aligned -6. **Artist Portfolio** - Style protection -7. **Government Website** - Public domain -8. **Educational Institution** - FERPA compliant -9. **Medical/Healthcare** - HIPAA compliant -10. **Legal Firm** - Attorney-client privilege -11. **Community Wiki** - CC BY-SA collaborative -12. **E-commerce Site** - Commercial balance - -Each scenario includes: -- Complete AIBDP manifest -- Detailed rationale -- Policy choice explanations -- Enforcement strategies -- Philosophy articulation - -### 7. Comprehensive FAQ - -**File**: `docs/faq.md` (6,000+ words) - -**60+ questions** covering: - -- **General Concepts** (5 Q&A) - - What is consent-aware HTTP? - - Why not just robots.txt? - - Is this anti-AI? - - Philosophical foundations - - Project origins - -- **HTTP 430 Status Code** (5 Q&A) - - Definition and use - - Differences from other codes - - Standardization status - - Adoption readiness - - Non-compliance handling - -- **AIBDP Manifest** (10 Q&A) - - Format and structure - - Policy types and status values - - Scoping and exceptions - - Validation methods - - CDN and federation support - -- **Implementation** (6 Q&A) - - Integration steps - - Platform-specific guides - - AI bot detection - - Code requirements - -- **Legal and Ethical** (5 Q&A) - - Legal status - - GDPR compatibility - - Copyright implications - - Licensing models - -- **Technical Details** (6 Q&A) - - robots.txt relationship - - Path scoping - - Caching strategies - - Multi-domain handling - -- **Adoption and Deployment** (5 Q&A) - - Timing considerations - - Announcement strategies - - Policy updates - - Migration paths - -- **Troubleshooting** (6 Q&A) - - Common issues - - Monitoring compliance - - Testing procedures - -### 8. RSR Framework Compliance - -**Files**: -- `MAINTAINERS.md` - Project governance -- `CODE_OF_CONDUCT.md` - Community standards (consent-aware values) -- `.well-known/security.txt` - RFC 9116 compliant -- `.well-known/ai.txt` - AI usage declaration (meta!) -- `.well-known/humans.txt` - Human attribution -- `.well-known/aibdp.json` - Self-referential v0.2 manifest -- `justfile` - 30+ validation and build recipes -- `flake.nix` - Nix reproducible builds - -**RSR Status**: Bronze+ compliance achieved - -**justfile recipes**: -- `validate` - Validate all manifests and specs -- `check-rsr` - RSR compliance checker -- `build-drafts` - Render Internet-Drafts (xml2rfc) -- `test` - Run all tests -- `pre-commit` - Pre-commit hooks -- `status` - Project status dashboard -- `install-deps` - Dependency installation guide - ---- - -## 🎓 Educational Value - -### For Adopters -- 12 real-world manifest examples covering diverse use cases -- Step-by-step server configuration for 8 platforms -- 60+ FAQ questions answering common concerns -- Clear policy choice rationale and examples - -### For Implementers -- 2 production-ready reference implementations (Node.js, Python) -- Complete API documentation -- JSON Schema for validation -- Testing procedures and troubleshooting guides - -### For Standards Bodies -- Complete IETF Internet-Draft (draft-jewell-aibdp-00) -- IANA registration templates -- Security and privacy analysis -- Implementation guidance - -### For Researchers -- Ethical and philosophical foundations documented -- Comparison with existing protocols (robots.txt, TDM) -- Adoption considerations and deployment strategies - ---- - -## 🔬 Technical Quality - -### Code Quality -- **Production-ready**: Error handling, caching, validation -- **Type-safe**: Full type hints in Python implementation -- **Tested**: Example servers demonstrate functionality -- **Documented**: Comprehensive inline comments and README files -- **Portable**: Works across platforms and environments - -### Specification Quality -- **Standards-compliant**: Follows RFC XML format (RFC 7991) -- **Comprehensive**: 13 sections covering all aspects -- **Clear**: Normative language (RFC 2119 keywords) -- **Referenced**: Proper citations to relevant RFCs -- **Extensible**: Forward-compatible design - -### Documentation Quality -- **Comprehensive**: 25,000+ words across multiple documents -- **Accessible**: Clear language without jargon overload -- **Practical**: Real examples and working code -- **Organized**: Logical structure with table of contents -- **Searchable**: Good headings and cross-references - ---- - -## 🚀 Deployment Readiness - -### Immediate Use -- ✅ AIBDP manifests can be deployed today -- ✅ HTTP 430 can be used (custom status codes allowed) -- ✅ Reference implementations ready for production -- ✅ Server configurations tested and documented - -### Standardization Track -- ✅ Internet-Drafts ready for IETF submission -- ✅ IANA registration templates prepared -- ✅ Implementation examples demonstrate feasibility -- ✅ Community feedback mechanisms in place - -### Adoption Support -- ✅ Multiple server platform guides (nginx, Apache, Caddy, etc.) -- ✅ Example manifests for 12 different scenarios -- ✅ FAQ addresses common concerns -- ✅ Testing procedures documented - ---- - -## 🌍 Broader Impact - -### Consent Culture -- Establishes procedural clarity for AI boundaries -- Respects creator autonomy and authorship dignity -- Provides alternative to legal escalation -- Demonstrates "pro-boundary, not anti-AI" stance - -### Technical Standards -- Fills gap in web standards for AI era -- Compatible with existing protocols (robots.txt) -- Extensible for future AI use cases -- Designed for federation and self-sovereignty - -### Community Building -- Clear governance (MAINTAINERS.md) -- Welcoming community standards (CODE_OF_CONDUCT.md) -- Contribution pathways documented -- Ethical framework articulated - ---- - -## 📋 Git Activity Summary - -### Commits -1. Add CLAUDE.md documentation for AI assistants -2. Add RSR framework compliance: governance and .well-known/ -3. Add build system: Justfile and flake.nix for RSR compliance -4. Add AIBDP Internet-Draft specification and JSON Schema -5. Add Node.js/Express reference implementation for AIBDP + HTTP 430 -6. Add Python/Flask reference implementation for AIBDP + HTTP 430 -7. Add comprehensive server configuration guide for 8 platforms -8. Add 12 comprehensive AIBDP manifest scenario examples -9. Add comprehensive FAQ with 60+ questions -10. Update CHANGELOG with comprehensive development session summary - -### Branch -`claude/create-claude-md-018k61kfViJFfuXVhDeqfYok` - -All work pushed to remote repository. - ---- - -## 🎯 What's Next? (Recommendations) - -### Immediate Actions -1. **Review all commits** - Examine each commit for quality and correctness -2. **Test reference implementations** - Run Node.js and Python examples locally -3. **Validate manifests** - Use JSON Schema to validate example manifests -4. **Review documentation** - Read through FAQ and server guides - -### Short-Term (Next Week) -1. **Submit to IETF** - Prepare draft-jewell-aibdp-00 for submission -2. **Create PR** - Open pull request from feature branch to main -3. **Announce adoption** - Publish blog post about the project -4. **Engage community** - Share with IndieWeb, journalism ethics groups - -### Medium-Term (Next Month) -1. **Build website** - Create https://consent-aware-http.org -2. **Gather adopters** - Reach out to potential early adopters -3. **Refine specs** - Incorporate community feedback -4. **Add Rust implementation** - Complete third reference implementation - -### Long-Term (Next Quarter) -1. **IETF process** - Navigate standards process -2. **Academic paper** - Publish research on consent-aware protocols -3. **Conference presentations** - Present at FOSDEM, IndieWebCamp, etc. -4. **Broader adoption** - CMS plugins (WordPress, Ghost), CDN partnerships - ---- - -## 💡 Key Insights - -### What Worked Well -- **Comprehensive approach**: Specs + implementations + documentation together -- **Real examples**: 12 scenarios provide concrete guidance -- **Production focus**: Reference implementations are actually usable -- **RSR compliance**: Strong foundation for credibility - -### Potential Improvements -- **Rust implementation**: Would complete language trifecta (Node, Python, Rust) -- **CMS plugins**: WordPress/Ghost plugins would accelerate adoption -- **Visual tools**: Web-based manifest generator -- **Testing suite**: Automated compliance testing - -### Lessons Learned -- Autonomous development can produce significant value in single session -- Combining specs, code, and documentation creates complete package -- Real-world examples (manifest scenarios) are essential for adoption -- RSR framework provides excellent quality baseline - ---- - -## 🙏 Acknowledgments - -This autonomous development session demonstrates: - -- **Trust in AI collaboration** - User trusted Claude to develop independently -- **Consent-aware development** - User maintained agency (could review/reject any work) -- **Boundary-respecting automation** - Clear parameters, autonomous execution -- **Credit utilization** - Maximized value from expiring Claude credits - -The irony is not lost: An AI system autonomously developing consent-aware AI protocols. 😊 - ---- - -## 📊 Final Statistics - -- **Development Time**: Single autonomous session -- **Files Created**: 15+ major files -- **Lines of Code**: 1,500+ (excluding docs) -- **Documentation Words**: 25,000+ -- **Commits**: 10 -- **Platforms Supported**: 8 (nginx, Apache, Caddy, Cloudflare, AWS, Vercel, Netlify, custom) -- **Languages**: Node.js, Python (Rust planned) -- **Scenarios**: 12 complete examples -- **FAQ Questions**: 60+ -- **RSR Compliance**: Bronze+ achieved - ---- - -**Branch**: `claude/create-claude-md-018k61kfViJFfuXVhDeqfYok` - -**Status**: ✅ All work committed and pushed to remote - -**Ready for**: Review, testing, PR creation, IETF submission, production deployment - ---- - -_"Without refusal, permission is meaningless." - Consent-Aware HTTP Project_ - -_"Boundary is where meaning begins." - bell hooks_ - -**Development Session Complete**: 2025-07-20 - -Thank you for trusting autonomous AI development. This work demonstrates what's possible when humans and AI collaborate with clear boundaries, mutual respect, and shared purpose. diff --git a/consent-aware-http/FUNDING.yml b/consent-aware-http/FUNDING.yml deleted file mode 100644 index 71f64141..00000000 --- a/consent-aware-http/FUNDING.yml +++ /dev/null @@ -1,37 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell -# -# Funding configuration for Consent-Aware HTTP Standards Project -# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-supporter-button-in-your-repository - -# Primary funding channels -github: [] # GitHub Sponsors username (when available) - -custom: - - https://paypal.me/jdajewell - - https://ko-fi.com/consentawarehttp - -# Solidarity Economics Framework -# -# This project operates on solidarity economics principles: -# -# * VOLUNTARY: Funding is voluntary, not required for use -# * TRANSPARENT: All funding information is public -# * COMMUNITY: Funds support ongoing development and community building -# * ETHICAL: No exploitation, no dark patterns, no guilt -# -# Your support helps sustain: -# -# - Internet-Draft development and IETF submission -# - Reference implementation maintenance -# - Documentation and educational materials -# - Community outreach and adoption support -# - Hosting and infrastructure costs -# -# Even small contributions ($5-$20) help maintain this work. -# -# Thank you for supporting consent-aware infrastructure! -# -# -- Jonathan D.A. Jewell -# NEC PRC Representative · NUJ Ethics Council -# jonathan@metadatastician.art diff --git a/consent-aware-http/Justfile b/consent-aware-http/Justfile deleted file mode 100644 index 59f7a8c8..00000000 --- a/consent-aware-http/Justfile +++ /dev/null @@ -1,270 +0,0 @@ -# justfile - Command runner for consent-aware-http -# https://github.com/casey/just -# -# Install just: https://just.systems/ -# Usage: just -# List all recipes: just --list - -# Default recipe (runs when you type 'just' with no arguments) -default: - @just --list - -# === VALIDATION & VERIFICATION === - -# Validate all AIBDP manifest files -validate-manifests: - @echo "🔍 Validating AIBDP manifests..." - @just validate-manifest .well-known/aibdp.json - @just validate-manifest docs/example-aibdp.json - @echo "✅ All manifests valid" - -# Validate a single AIBDP manifest (requires jq) -validate-manifest FILE: - @echo "Validating {{FILE}}..." - @jq empty {{FILE}} || (echo "❌ Invalid JSON in {{FILE}}" && exit 1) - @echo "✅ {{FILE}} is valid JSON" - -# Validate security.txt compliance (RFC 9116) -validate-security-txt: - @echo "🔍 Validating security.txt..." - @test -f .well-known/security.txt || (echo "❌ security.txt missing" && exit 1) - @grep -q "Contact:" .well-known/security.txt || (echo "❌ Missing Contact field" && exit 1) - @grep -q "Expires:" .well-known/security.txt || (echo "❌ Missing Expires field" && exit 1) - @echo "✅ security.txt RFC 9116 compliant" - -# Validate Internet-Draft XML files (requires xml2rfc) -validate-drafts: - @echo "🔍 Validating Internet-Drafts..." - @if command -v xml2rfc >/dev/null 2>&1; then \ - xml2rfc --v3 draft-jewell-http-430-consent-required-00.xml --text --out /tmp/draft-430.txt && \ - echo "✅ HTTP 430 draft valid"; \ - else \ - echo "⚠️ xml2rfc not installed (pip install xml2rfc), skipping draft validation"; \ - fi - -# Run all validation checks -validate: validate-manifests validate-security-txt validate-drafts - @echo "" - @echo "✅ All validation checks passed" - -# Check RSR (Rhodium Standard Repository) compliance -check-rsr: - @echo "🔍 Checking RSR Framework Compliance..." - @just --quiet _check-file "README.adoc" "Repository documentation" - @just --quiet _check-file "LICENSE.txt" "License file" - @just --quiet _check-file "CODE_OF_CONDUCT.md" "Code of Conduct" - @just --quiet _check-file "CONTRIBUTING.md" "Contribution guidelines" ".github/CONTRIBUTING.md" - @just --quiet _check-file "SECURITY.md" "Security policy" ".github/SECURITY.md" - @just --quiet _check-file "MAINTAINERS.md" "Maintainers documentation" - @just --quiet _check-file "CHANGELOG.md" "Changelog" - @just --quiet _check-file ".well-known/security.txt" "security.txt (RFC 9116)" - @just --quiet _check-file ".well-known/ai.txt" "AI usage declaration" - @just --quiet _check-file ".well-known/humans.txt" "Human attribution" - @just --quiet _check-file ".well-known/aibdp.json" "AIBDP manifest" - @just --quiet _check-file "justfile" "Build system (just)" - @echo "" - @echo "✅ RSR compliance check complete" - @echo "" - @echo "📊 RSR Status: Bronze+ (Specification Repository Variant)" - @echo " ✓ Complete documentation suite" - @echo " ✓ .well-known/ directory with RFC 9116 compliance" - @echo " ✓ Build/validation tooling (justfile)" - @echo " ✓ Community governance (MAINTAINERS, CoC)" - @echo " ✓ Self-referential AIBDP implementation" - -# Helper: Check if file exists -_check-file NAME DESC ALT="": - #!/usr/bin/env bash - if [ -f "{{NAME}}" ]; then - echo "✅ {{DESC}}: {{NAME}}" - elif [ -n "{{ALT}}" ] && [ -f "{{ALT}}" ]; then - echo "✅ {{DESC}}: {{ALT}}" - else - echo "❌ {{DESC}}: Missing" - exit 1 - fi - -# === BUILD & RENDER === - -# Render Internet-Drafts to text format (requires xml2rfc) -build-drafts: - @echo "📄 Rendering Internet-Drafts..." - @mkdir -p rendered - @if command -v xml2rfc >/dev/null 2>&1; then \ - xml2rfc --v3 draft-jewell-http-430-consent-required-00.xml --text --out rendered/draft-jewell-http-430-consent-required-00.txt && \ - xml2rfc --v3 draft-jewell-http-430-consent-required-00.xml --html --out rendered/draft-jewell-http-430-consent-required-00.html && \ - echo "✅ HTTP 430 draft rendered"; \ - else \ - echo "❌ xml2rfc not installed"; \ - echo " Install with: pip install xml2rfc"; \ - exit 1; \ - fi - -# Render drafts to all formats (text, HTML, PDF) -build-all: build-drafts - @echo "📄 Rendering all formats..." - @if command -v xml2rfc >/dev/null 2>&1; then \ - xml2rfc --v3 draft-jewell-http-430-consent-required-00.xml --pdf --out rendered/draft-jewell-http-430-consent-required-00.pdf && \ - echo "✅ PDF rendered"; \ - else \ - echo "⚠️ PDF rendering requires xml2rfc with weasyprint"; \ - fi - -# Clean build artifacts -clean: - @echo "🧹 Cleaning build artifacts..." - @rm -rf rendered/ - @echo "✅ Clean complete" - -# === TESTING === - -# Run link checker on documentation (requires markdown-link-check) -test-links: - @echo "🔗 Checking documentation links..." - @if command -v markdown-link-check >/dev/null 2>&1; then \ - find . -name "*.md" ! -path "./node_modules/*" ! -path "./.git/*" -exec markdown-link-check {} \; ; \ - else \ - echo "⚠️ markdown-link-check not installed (npm install -g markdown-link-check)"; \ - fi - -# Check for common typos and style issues -test-style: - @echo "📝 Checking style and common typos..." - @echo "⚠️ Style checking not yet implemented" - @echo " TODO: Add proselint, vale, or write-good integration" - -# Run all tests -test: validate test-links - -# === DEVELOPMENT HELPERS === - -# Format JSON files (requires jq) -format: - @echo "🎨 Formatting JSON files..." - @find . -name "*.json" ! -path "./node_modules/*" ! -path "./.git/*" -exec sh -c 'jq . "{}" > "{}.tmp" && mv "{}.tmp" "{}"' \; - @echo "✅ JSON files formatted" - -# Check for outdated security.txt expiry -check-expiry: - @echo "📅 Checking security.txt expiry..." - @grep "Expires:" .well-known/security.txt || echo "⚠️ No expiry date found" - -# Watch for changes and auto-validate (requires watchexec) -watch: - @if command -v watchexec >/dev/null 2>&1; then \ - watchexec -e xml,json,md just validate; \ - else \ - echo "❌ watchexec not installed"; \ - echo " Install: cargo install watchexec-cli"; \ - exit 1; \ - fi - -# === GIT HELPERS === - -# Run pre-commit checks (validation before committing) -pre-commit: validate - @echo "" - @echo "✅ Pre-commit checks passed" - @echo " Safe to commit!" - -# Show project status -status: - @echo "📊 Consent-Aware HTTP Standards - Project Status" - @echo "" - @echo "📁 Repository: consent-aware-http" - @echo "🌿 Branch: $(git branch --show-current)" - @echo "📝 Last commit: $(git log -1 --format='%h - %s (%ar)')" - @echo "" - @echo "📄 Internet-Drafts:" - @test -f draft-jewell-http-430-consent-required-00.xml && echo " ✅ HTTP 430 Consent Required (v00)" || echo " ❌ Missing" - @test -f drafts/draft-jewell-aibdp-00.xml && echo " ✅ AIBDP Protocol (v00)" || echo " ⚠️ In development" - @echo "" - @echo "📋 Documentation:" - @echo " Files: $(find docs -name '*.md' | wc -l) markdown files" - @echo "" - @echo "🛠️ Tooling:" - @command -v xml2rfc >/dev/null 2>&1 && echo " ✅ xml2rfc" || echo " ❌ xml2rfc (install: pip install xml2rfc)" - @command -v jq >/dev/null 2>&1 && echo " ✅ jq" || echo " ❌ jq (install: apt install jq / brew install jq)" - @command -v markdown-link-check >/dev/null 2>&1 && echo " ✅ markdown-link-check" || echo " ⚠️ markdown-link-check (optional)" - -# === RELEASE HELPERS === - -# Prepare for release (validate, build, test) -release-prep VERSION: - @echo "📦 Preparing release {{VERSION}}..." - @just validate - @just build-all - @just test - @echo "" - @echo "✅ Release {{VERSION}} ready" - @echo "" - @echo "Next steps:" - @echo " 1. Update CHANGELOG.md with version {{VERSION}}" - @echo " 2. git tag -a v{{VERSION}} -m 'Release {{VERSION}}'" - @echo " 3. git push origin v{{VERSION}}" - @echo " 4. Create GitHub Release" - -# === INSTALLATION & SETUP === - -# Install development dependencies (shows commands, doesn't run them) -install-deps: - @echo "📦 Development Dependencies Installation Guide" - @echo "" - @echo "Core tools (required for full functionality):" - @echo " • xml2rfc (Internet-Draft rendering)" - @echo " pip install xml2rfc" - @echo "" - @echo " • jq (JSON validation and formatting)" - @echo " apt install jq # Debian/Ubuntu" - @echo " brew install jq # macOS" - @echo " pacman -S jq # Arch" - @echo "" - @echo "Optional tools (enhanced workflow):" - @echo " • markdown-link-check (link validation)" - @echo " npm install -g markdown-link-check" - @echo "" - @echo " • watchexec (auto-validation on file changes)" - @echo " cargo install watchexec-cli" - @echo "" - @echo " • weasyprint (PDF rendering for xml2rfc)" - @echo " pip install weasyprint" - -# Show version information -version: - @echo "Consent-Aware HTTP Standards" - @echo "HTTP 430 + AIBDP Protocol Specifications" - @echo "" - @echo "Repository version: 0.1.0" - @echo "HTTP 430 Draft: 00 (July 2025)" - @echo "AIBDP Draft: In Development" - @echo "" - @echo "Author: Jonathan D.A. Jewell" - @echo "License: MIT (code/specs) + CC BY-SA 4.0 (docs)" - -# === HELP === - -# Show detailed help -help: - @echo "🛠️ Consent-Aware HTTP Standards - Build & Validation Tool" - @echo "" - @echo "Core workflows:" - @echo " just validate Validate manifests, drafts, and configs" - @echo " just check-rsr Check RSR framework compliance" - @echo " just build-drafts Render Internet-Drafts to text/HTML" - @echo " just test Run all tests and validations" - @echo " just pre-commit Run checks before committing" - @echo " just status Show project status" - @echo "" - @echo "Development:" - @echo " just watch Auto-validate on file changes" - @echo " just format Format JSON files" - @echo " just clean Remove build artifacts" - @echo "" - @echo "Release:" - @echo " just release-prep V Prepare release version V" - @echo "" - @echo "Setup:" - @echo " just install-deps Show dependency installation commands" - @echo " just version Show version information" - @echo "" - @echo "Full list: just --list" diff --git a/consent-aware-http/LICENSE b/consent-aware-http/LICENSE deleted file mode 100644 index 2a8b9601..00000000 --- a/consent-aware-http/LICENSE +++ /dev/null @@ -1,375 +0,0 @@ -SPDX-License-Identifier: MPL-2.0 - -Mozilla Public License Version 2.0 -================================== - -1. Definitions --------------- - -1.1. "Contributor" - means each individual or legal entity that creates, contributes to - the creation of, or owns Covered Software. - -1.2. "Contributor Version" - means the combination of the Contributions of others (if any) used - by a Contributor and that particular Contributor's Contribution. - -1.3. "Contribution" - means Covered Software of a particular Contributor. - -1.4. "Covered Software" - means Source Code Form to which the initial Contributor has attached - the notice in Exhibit A, the Executable Form of such Source Code - Form, and Modifications of such Source Code Form, in each case - including portions thereof. - -1.5. "Incompatible With Secondary Licenses" - means - - (a) that the initial Contributor has attached the notice described - in Exhibit B to the Covered Software; or - - (b) that the Covered Software was made available under the terms of - version 1.1 or earlier of the License, but not also under the - terms of a Secondary License. - -1.6. "Executable Form" - means any form of the work other than Source Code Form. - -1.7. "Larger Work" - means a work that combines Covered Software with other material, in - a separate file or files, that is not Covered Software. - -1.8. "License" - means this document. - -1.9. "Licensable" - means having the right to grant, to the maximum extent possible, - whether at the time of the initial grant or subsequently, any and - all of the rights conveyed by this License. - -1.10. "Modifications" - means any of the following: - - (a) any file in Source Code Form that results from an addition to, - deletion from, or modification of the contents of Covered - Software; or - - (b) any new file in Source Code Form that contains any Covered - Software. - -1.11. "Patent Claims" of a Contributor - means any patent claim(s), including without limitation, method, - process, and apparatus claims, in any patent Licensable by such - Contributor that would be infringed, but for the grant of the - License, by the making, using, selling, offering for sale, having - made, import, or transfer of either its Contributions or its - Contributor Version. - -1.12. "Secondary License" - means either the GNU General Public License, Version 2.0, the GNU - Lesser General Public License, Version 2.1, the GNU Affero General - Public License, Version 3.0, or any later versions of those - licenses. - -1.13. "Source Code Form" - means the form of the work preferred for making modifications. - -1.14. "You" (or "Your") - means an individual or a legal entity exercising rights under this - License. For legal entities, "You" includes any entity that - controls, is controlled by, or is under common control with You. For - purposes of this definition, "control" means (a) the power, direct - or indirect, to cause the direction or management of such entity, - whether by contract or otherwise, or (b) ownership of more than - fifty percent (50%) of the outstanding shares or beneficial - ownership of such entity. - -2. License Grants and Conditions --------------------------------- - -2.1. Grants - -Each Contributor hereby grants You a world-wide, royalty-free, -non-exclusive license: - -(a) under intellectual property rights (other than patent or trademark) - Licensable by such Contributor to use, reproduce, make available, - modify, display, perform, distribute, and otherwise exploit its - Contributions, either on an unmodified basis, with Modifications, or - as part of a Larger Work; and - -(b) under Patent Claims of such Contributor to make, use, sell, offer - for sale, have made, import, and otherwise transfer either its - Contributions or its Contributor Version. - -2.2. Effective Date - -The licenses granted in Section 2.1 with respect to any Contribution -become effective for each Contribution on the date the Contributor first -distributes such Contribution. - -2.3. Limitations on Grant Scope - -The licenses granted in this Section 2 are the only rights granted under -this License. No additional rights or licenses will be implied from the -distribution or licensing of Covered Software under this License. -Notwithstanding Section 2.1(b) above, no patent license is granted by a -Contributor: - -(a) for any code that a Contributor has removed from Covered Software; - or - -(b) for infringements caused by: (i) Your and any other third party's - modifications of Covered Software, or (ii) the combination of its - Contributions with other software (except as part of its Contributor - Version); or - -(c) under Patent Claims infringed by Covered Software in the absence of - its Contributions. - -This License does not grant any rights in the trademarks, service marks, -or logos of any Contributor (except as may be necessary to comply with -the notice requirements in Section 3.4). - -2.4. Subsequent Licenses - -No Contributor makes additional grants as a result of Your choice to -distribute the Covered Software under a subsequent version of this -License (see Section 10.2) or under the terms of a Secondary License (if -permitted under the terms of Section 3.3). - -2.5. Representation - -Each Contributor represents that the Contributor believes its -Contributions are its original creation(s) or it has sufficient rights -to grant the rights to its Contributions conveyed by this License. - -2.6. Fair Use - -This License is not intended to limit any rights You have under -applicable copyright doctrines of fair use, fair dealing, or other -equivalents. - -2.7. Conditions - -Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted -in Section 2.1. - -3. Responsibilities -------------------- - -3.1. Distribution of Source Form - -All distribution of Covered Software in Source Code Form, including any -Modifications that You create or to which You contribute, must be under -the terms of this License. You must inform recipients that the Source -Code Form of the Covered Software is governed by the terms of this -License, and how they can obtain a copy of this License. You may not -attempt to alter or restrict the recipients' rights in the Source Code -Form. - -3.2. Distribution of Executable Form - -If You distribute Covered Software in Executable Form then: - -(a) such Covered Software must also be made available in Source Code - Form, as described in Section 3.1, and You must inform recipients of - the Executable Form how they can obtain a copy of such Source Code - Form by reasonable means in a timely manner, at a charge no more - than the cost of distribution to the recipient; and - -(b) You may distribute such Executable Form under the terms of this - License, or sublicense it under different terms, provided that the - license for the Executable Form does not attempt to limit or alter - the recipients' rights in the Source Code Form under this License. - -3.3. Distribution of a Larger Work - -You may create and distribute a Larger Work under terms of Your choice, -provided that You also comply with the requirements of this License for -the Covered Software. If the Larger Work is a combination of Covered -Software with a work governed by one or more Secondary Licenses, and the -Covered Software is not Incompatible With Secondary Licenses, this -License permits You to additionally distribute such Covered Software -under the terms of such Secondary License(s), so that the recipient of -the Larger Work may, at their option, further distribute the Covered -Software under the terms of either this License or such Secondary -License(s). - -3.4. Notices - -You may not remove or alter the substance of any license notices -(including copyright notices, patent notices, disclaimers of warranty, -or limitations of liability) contained within the Source Code Form of -the Covered Software, except that You may alter any license notices to -the extent required to remedy known factual inaccuracies. - -3.5. Application of Additional Terms - -You may choose to offer, and to charge a fee for, warranty, support, -indemnity or liability obligations to one or more recipients of Covered -Software. However, You may do so only on Your own behalf, and not on -behalf of any Contributor. You must make it absolutely clear that any -such warranty, support, indemnity, or liability obligation is offered by -You alone, and You hereby agree to indemnify every Contributor for any -liability incurred by such Contributor as a result of warranty, support, -indemnity or liability terms You offer. You may include additional -disclaimers of warranty and limitations of liability specific to any -jurisdiction. - -4. Inability to Comply Due to Statute or Regulation ---------------------------------------------------- - -If it is impossible for You to comply with any of the terms of this -License with respect to some or all of the Covered Software due to -statute, judicial order, or regulation then You must: (a) comply with -the terms of this License to the maximum extent possible; and (b) -describe the limitations and the code they affect. Such description must -be placed in a text file included with all distributions of the Covered -Software under this License. Except to the extent prohibited by statute -or regulation, such description must be sufficiently detailed for a -recipient of ordinary skill to be able to understand it. - -5. Termination --------------- - -5.1. The rights granted under this License will terminate automatically -if You fail to comply with any of its terms. However, if You become -compliant, then the rights granted under this License from a particular -Contributor are reinstated (a) provisionally, unless and until such -Contributor explicitly and finally terminates Your grants, and (b) on an -ongoing basis, if such Contributor fails to notify You of the -non-compliance by some reasonable means prior to 60 days after You have -come back into compliance. Moreover, Your grants from a particular -Contributor are reinstated on an ongoing basis if such Contributor -notifies You of the non-compliance by some reasonable means, this is the -first time You have received notice of non-compliance with this License -from such Contributor, and You become compliant prior to 30 days after -Your receipt of the notice. - -5.2. If You initiate litigation against any entity by asserting a patent -infringement claim (excluding declaratory judgment actions, -counter-claims, and cross-claims) alleging that a Contributor Version -directly or indirectly infringes any patent, then the rights granted to -You by any and all Contributors for the Covered Software under Section -2.1 of this License shall terminate. - -5.3. In the event of termination under Sections 5.1 or 5.2 above, all -end user license agreements (excluding distributors and resellers) which -have been validly granted by You or Your distributors under this License -prior to termination shall survive termination. - -************************************************************************ -* * -* 6. Disclaimer of Warranty * -* ------------------------- * -* * -* Covered Software is provided under this License on an "as is" * -* basis, without warranty of any kind, either expressed, implied, or * -* statutory, including, without limitation, warranties that the * -* Covered Software is free of defects, merchantable, fit for a * -* particular purpose or non-infringing. The entire risk as to the * -* quality and performance of the Covered Software is with You. * -* Should any Covered Software prove defective in any respect, You * -* (not any Contributor) assume the cost of any necessary servicing, * -* repair, or correction. This disclaimer of warranty constitutes an * -* essential part of this License. No use of any Covered Software is * -* authorized under this License except under this disclaimer. * -* * -************************************************************************ - -************************************************************************ -* * -* 7. Limitation of Liability * -* -------------------------- * -* * -* Under no circumstances and under no legal theory, whether tort * -* (including negligence), contract, or otherwise, shall any * -* Contributor, or anyone who distributes Covered Software as * -* permitted above, be liable to You for any direct, indirect, * -* special, incidental, or consequential damages of any character * -* including, without limitation, damages for lost profits, loss of * -* goodwill, work stoppage, computer failure or malfunction, or any * -* and all other commercial damages or losses, even if such party * -* shall have been informed of the possibility of such damages. This * -* limitation of liability shall not apply to liability for death or * -* personal injury resulting from such party's negligence to the * -* extent applicable law prohibits such limitation. Some * -* jurisdictions do not allow the exclusion or limitation of * -* incidental or consequential damages, so this exclusion and * -* limitation may not apply to You. * -* * -************************************************************************ - -8. Litigation -------------- - -Any litigation relating to this License may be brought only in the -courts of a jurisdiction where the defendant maintains its principal -place of business and such litigation shall be governed by laws of that -jurisdiction, without reference to its conflict-of-law provisions. -Nothing in this Section shall prevent a party's ability to bring -cross-claims or counter-claims. - -9. Miscellaneous ----------------- - -This License represents the complete agreement concerning the subject -matter hereof. If any provision of this License is held to be -unenforceable, such provision shall be reformed only to the extent -necessary to make it enforceable. Any law or regulation which provides -that the language of a contract shall be construed against the drafter -shall not be used to construe this License against a Contributor. - -10. Versions of the License ---------------------------- - -10.1. New Versions - -Mozilla Foundation is the license steward. Except as provided in Section -10.3, no one other than the license steward has the right to modify or -publish new versions of this License. Each version will be given a -distinguishing version number. - -10.2. Effect of New Versions - -You may distribute the Covered Software under the terms of the version -of the License under which You originally received the Covered Software, -or under the terms of any subsequent version published by the license -steward. - -10.3. Modified Versions - -If you create software not governed by this License, and you want to -create a new license for such software, you may create and use a -modified version of this License if you rename the license and remove -any references to the name of the license steward (except to note that -such modified license differs from this License). - -10.4. Distributing Source Code Form that is Incompatible With Secondary -Licenses - -If You choose to distribute Source Code Form that is Incompatible With -Secondary Licenses under the terms of this version of the License, the -notice described in Exhibit B of this License must be attached. - -Exhibit A - Source Code Form License Notice -------------------------------------------- - - This Source Code Form is subject to the terms of the Mozilla Public - License, v. 2.0. If a copy of the MPL was not distributed with this - file, You can obtain one at http://mozilla.org/MPL/2.0/. - -If it is not possible or desirable to put the notice in a particular -file, then You may include the notice in a location (such as a LICENSE -file in a relevant directory) where a recipient would be likely to look -for such a notice. - -You may add additional accurate notices of copyright ownership. - -Exhibit B - "Incompatible With Secondary Licenses" Notice ---------------------------------------------------------- - - This Source Code Form is "Incompatible With Secondary Licenses", as - defined by the Mozilla Public License, v. 2.0. diff --git a/consent-aware-http/MAINTAINERS.adoc b/consent-aware-http/MAINTAINERS.adoc deleted file mode 100644 index 13f2cc1c..00000000 --- a/consent-aware-http/MAINTAINERS.adoc +++ /dev/null @@ -1,161 +0,0 @@ -// SPDX-License-Identifier: CC-BY-4.0 - -== Maintainers - -This document lists the individuals responsible for maintaining and governing the Consent-Aware HTTP Standards project. - -=== Lead Maintainer - -*Jonathan D.A. Jewell* - -* Role: Primary Author, Protocol Designer, Ethics Convenor -* Affiliation: NEC PRC Representative, NUJ Ethics Council -* Working Group: AI & Data Working Group (Convenor) -* Contact: jonathan@metadatastician.art -* GitHub: @Hyperpolymath -* Areas: Protocol specification (HTTP 430, AIBDP), ethical framework, IETF coordination, cultural theory integration - -=== Responsibilities - -==== Lead Maintainer - -* Oversee Internet-Draft revisions and IETF submission process -* Maintain philosophical and ethical coherence across documentation -* Review and merge pull requests -* Coordinate with standards bodies (IETF, W3C) -* Engage with community (IndieWeb, Fediverse, academic researchers) -* Ensure alignment with journalism ethics and consent theory - -==== Community Maintainers (Open) - -This project welcomes co-maintainers who demonstrate: - -* Deep understanding of consent-aware protocols -* Commitment to ethical infrastructure -* Technical expertise in web standards -* Alignment with project philosophy (boundary as dignity, declarative refusal) - -To express interest in co-maintainership, please: - -[arabic] -. Make substantial contributions (3{plus} merged PRs or significant documentation) -. Demonstrate understanding of cultural/ethical framework -. Open a Discussion thread proposing your maintainership scope - -=== Governance Model - -*Benevolent Dictator Temporarily (BDT)*: Jonathan D.A. Jewell holds final decision authority on: - -* Internet-Draft content and submission -* Core protocol design -* Ethical framework integrity -* Project direction and scope - -*Community Input*: All technical decisions should involve community discussion via: - -* GitHub Issues for bugs and feature requests -* GitHub Discussions for philosophical and strategic topics -* Pull Request reviews for implementation feedback - -*Transition to Committee*: As the project matures, governance may transition to a steering committee representing: - -* Technical implementers -* Ethics/policy experts -* Federated web community representatives -* IETF working group participants - -=== Decision-Making Process - -[arabic] -. *Protocol Changes* (HTTP 430, AIBDP core spec) -* Requires lead maintainer approval -* Should align with IETF standards process -* Must preserve ethical coherence -. *Documentation Updates* -* Can be approved by any maintainer -* Should maintain philosophical consistency -* Require clear, principled language -. *Reference Implementations* -* Community-driven with maintainer review -* Must meet security and correctness standards -* Should demonstrate compliance examples -. *Outreach Materials* -* Require alignment with project values -* Should be accessible yet principled -* Community contributions strongly encouraged - -=== Contact - -* *General Inquiries*: Open a GitHub Discussion -* *Security Issues*: See link:.github/SECURITY.md[SECURITY.md] -* *Private Communications*: jonathan@metadatastician.art -* *Community Discussion*: GitHub Discussions - -=== Attribution - -This project builds on work by: - -* IndieWeb community (federated publishing) -* Journalism ethics traditions (NUJ, SPJ) -* Critical theorists (bell hooks, Virginia Woolf) -* Web standards bodies (IETF, W3C) - -''''' - -_"Boundary is where meaning begins." - bell hooks_ - -This document reflects a commitment to transparent governance and collective care for ethical infrastructure. - -//// -Appendix preserved verbatim from the legacy .adoc during the -Item 11 .md/.adoc consolidation (Day 10 lossy-tail). 49 legacy-only -content tokens were not present in the converted Markdown source; -retained here so nothing is lost. Reviewer may de-duplicate prose. -//// - -= Maintainers -:toc: preamble - -This document lists the maintainers of this project and their responsibilities. - -== Current Maintainers - -[cols="2,3,2",options="header"] -|=== -| Name | Role | Contact - -| Jonathan D.A. Jewell -| Lead Maintainer -| https://github.com/hyperpolymath[@hyperpolymath] -|=== - -== Responsibilities - -Maintainers are responsible for: - -* Reviewing and merging pull requests -* Triaging issues and feature requests -* Ensuring code quality and security standards -* Managing releases and versioning -* Upholding the project's code of conduct - -== Becoming a Maintainer - -Contributors who demonstrate: - -* Consistent, high-quality contributions -* Understanding of the project's goals and standards -* Constructive participation in discussions -* Commitment to the project's long-term health - -May be invited to become maintainers at the discretion of existing maintainers. - -== Decision Making - -* Routine decisions (bug fixes, minor improvements) can be made by any maintainer -* Significant changes require discussion and consensus among maintainers -* Breaking changes or major features should be discussed in issues before implementation - -== Contact - -For questions about project governance, open an issue or contact the maintainers listed above. diff --git a/consent-aware-http/PALIMPSEST.adoc b/consent-aware-http/PALIMPSEST.adoc deleted file mode 100644 index b5470016..00000000 --- a/consent-aware-http/PALIMPSEST.adoc +++ /dev/null @@ -1,41 +0,0 @@ -= Palimpsest License -:toc: -:toc-placement!: - -image:https://img.shields.io/badge/License-PMPL--1.0-blue.svg[License: PMPL-1.0,link="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/hyperpolymath/palimpsest-license"] -image:https://img.shields.io/badge/Philosophy-Palimpsest-indigo.svg[Palimpsest,link="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/hyperpolymath/palimpsest-license"] - -toc::[] - -== Legal Status - -This project is licensed under the **Palimpsest-MPL License 1.0 (PMPL-1.0)**. -For SPDX and tooling, use **PMPL-1.0-or-later**. - -PMPL-1.0 incorporates the Mozilla Public License 2.0 by reference and adds -ethical-use, provenance, and lineage requirements. - -== What PMPL Adds - -* **Emotional Lineage** - preserve narrative intent and cultural context -* **Provenance Integrity** - retain attribution and lineage metadata -* **Ethical Use Constraints** - explicit consent for non-interpretive AI training -* **Quantum-Safe Provenance (optional)** - post-quantum signature support - -== How to Adopt - -1. Include the PMPL-1.0 license text in `LICENSE`. -2. Add SPDX headers to source files: - `SPDX-License-Identifier: CC-BY-4.0` -3. Add a Palimpsest badge to your README (see `assets/badges/` and `embed/license-blocks/`). - -== Versioning - -See `VERSIONING.adoc` for the release process and the "-or-later" model. -The current legal text is PMPL-1.0. - -== References - -* `legal/README.adoc` -* `assets/badges/README.md` -* `embed/license-blocks/README.md` diff --git a/consent-aware-http/README.adoc b/consent-aware-http/README.adoc deleted file mode 100644 index 3ec07d93..00000000 --- a/consent-aware-http/README.adoc +++ /dev/null @@ -1,143 +0,0 @@ -= Consent-Aware HTTP Framework -Jonathan D. A. Jewell -:toc: -:toclevels: 3 - -== Overview - -The Consent-Aware HTTP Framework is a multi-protocol architecture for ethical AI governance on the web. It provides a unified, standards-oriented approach to declaring, enforcing, auditing, and verifying AI interactions with digital content. - -Originally conceived as a technical extension similar to `robots.txt`, the framework has evolved into a complete system addressing consent, identity, provenance, enforcement, and accountability. - -This repository contains a set of complementary Internet-Drafts that together define a consent-based model for AI-web interaction. - -== Problem Statement - -The modern web lacks: - -* Machine-readable AI usage boundaries -* Transparent identification of AI agents -* Enforceable consent mechanisms -* Verifiable content provenance -* Standardised compliance reporting - -This results in: - -* Unauthorised data harvesting -* Lack of accountability for AI systems -* Erosion of trust in digital content - -== Solution Architecture - -The framework consists of six integrated protocols: - -[cols="1,2,3"] -|=== -|Layer |Protocol |Purpose - -|Declaration -|AI Boundary Declaration Protocol (AIBDP) -|Defines permitted and prohibited AI uses of content - -|Identity -|AI Agent Identification Protocol -|Ensures AI systems declare who they are and what they do - -|Consent Flow -|Web Consent Management Protocol -|Defines how consent is requested, granted, and tokenised - -|Enforcement -|HTTP Status Code 430 -|Provides runtime enforcement of consent requirements - -|Provenance -|Content Provenance Protocol -|Tracks origin and AI involvement in content - -|Accountability -|AI Compliance Reporting Framework -|Monitors, audits, and reports violations -|=== - -Together, these form a complete governance stack. - -== How It Works (High-Level Flow) - -1. A server declares AI usage boundaries via AIBDP -2. An AI agent identifies itself using standard headers -3. The server evaluates the request against declared policy -4. If consent is required, the server returns HTTP 430 -5. The agent obtains consent via the consent management protocol -6. The agent retries with a Consent-Token -7. All interactions are logged and monitored for compliance -8. Content provenance metadata ensures transparency of outputs - -== Repository Structure - ---- - -/aibdp/ AI Boundary Declaration Protocol -/http-430/ HTTP 430 Consent Required -/agent-identification/ AI Agent Identification Protocol -/content-provenance/ Content Provenance Protocol -/compliance-reporting/ AI Compliance Reporting Framework -/consent-management/ Web Consent Management Protocol (planned / draft) ----------------------------------------------------------------------------- - -== Design Principles - -* Declarative first: Policies are explicitly defined and machine-readable -* Composability: Each protocol is independent but interoperable -* Backward compatibility: Works alongside existing web standards -* Transparency: All actors and actions are visible and auditable -* Enforceability: Policies can be technically enforced, not just stated - -== Relationship to Existing Standards - -The framework builds on: - -* RFC 9110 (HTTP Semantics) -* RFC 9309 (robots.txt) -* RFC 9116 (security.txt) -* JSON, HTTP headers, and DNS mechanisms - -It does not replace these standards, but extends them for AI-era requirements. - -== Status - -All components are currently Internet-Drafts (Work in Progress). - -They are designed for: - -* IETF discussion and standardisation -* Experimental implementation -* Policy and regulatory alignment - -== Why This Matters - -The framework enables: - -* Creators to retain control over their work -* AI developers to operate transparently and ethically -* Platforms to enforce clear rules -* Regulators to access verifiable evidence of compliance - -== Next Steps - -* Finalise Web Consent Management Protocol -* Align terminology across drafts -* Submit drafts to relevant IETF working groups -* Develop reference implementations - -== License - -See IETF Trust Legal Provisions (BCP 78 and BCP 79). - -== Authors - -Jonathan D. A. Jewell -The Open University - -Joshua B. Jewell -Royal Veterinary College diff --git a/consent-aware-http/REVERSIBILITY.md b/consent-aware-http/REVERSIBILITY.md deleted file mode 100644 index 2b6c754a..00000000 --- a/consent-aware-http/REVERSIBILITY.md +++ /dev/null @@ -1,332 +0,0 @@ -# Reversibility - -**SPDX-License-Identifier**: CC-BY-SA-4.0 -**SPDX-FileCopyrightText**: 2025 Jonathan D.A. Jewell - -## Overview - -**Reversibility** is a core architectural principle: Every operation should be undoable. This document explains how reversibility is implemented in the Consent-Aware HTTP Standards project. - -## Philosophy - -> "Without the ability to undo, experimentation becomes risk." - -Reversibility enables: -- **Safe experimentation** - Try changes without fear -- **Learning** - Mistakes become learning opportunities -- **Collaboration** - Contributors can explore boldly -- **Trust** - Lower stakes increase participation - -## Implementation - -### Git Version Control - -**All changes are reversible via Git:** - -```bash -# Undo last commit (keep changes) -git reset --soft HEAD~1 - -# Undo last commit (discard changes) -git reset --hard HEAD~1 - -# Revert a specific commit -git revert - -# Restore a file to previous version -git checkout HEAD~1 -- path/to/file - -# View history and restore -git log --oneline -git checkout -- path/to/file -``` - -### Branch Protection - -**Main branch is protected:** -- All changes via Pull Requests -- Review required before merge -- Failed experiments stay in feature branches -- Easy to abandon without consequence - -### Build System Reversibility - -**justfile recipes are non-destructive:** - -```bash -# Build artifacts can be cleaned -just clean - -# Validation doesn't modify files -just validate - -# Tests don't change state -just test -``` - -### Documentation Reversibility - -**Markdown/AsciiDoc is plain text:** -- Full Git history -- Diffs show exactly what changed -- Easy to revert specific sections -- No binary lock-in - -### Internet-Draft Versioning - -**IETF drafts are versioned:** -- `-00`, `-01`, `-02` versions -- Previous versions preserved -- Can reference earlier designs -- Mistakes documented, not hidden - -### Reference Implementation Safety - -**Code includes rollback patterns:** - -```javascript -// Middleware fails open (safe default) -try { - enforceAIBDP(req); -} catch (error) { - console.error('AIBDP error:', error); - next(); // Allow request through on error -} -``` - -```python -# Manifest loading with fallback -manifest = load_manifest() -if not manifest: - return None # No enforcement if manifest missing -``` - -### AIBDP Manifest Updates - -**Manifests can be updated anytime:** -- Change `status` from `refused` to `allowed` -- Add/remove conditions -- Update `expires` to force re-fetch -- AI systems pick up changes on next check - -**Example reversal:** - -```json -// Before: Too restrictive -{ - "training": { "status": "refused" } -} - -// After: Changed mind -{ - "training": { - "status": "conditional", - "conditions": ["Attribution required"] - } -} -``` - -### Configuration Reversibility - -**Server configs are declarative:** - -```nginx -# nginx: Comment out to disable -# return 430; - -# Apache: Remove .htaccess rule -# RewriteRule ^ - [R=430,L] - -# Caddy: Remove handle block -# handle @ai_bots { respond 430 } -``` - -### Community Governance Reversibility - -**Governance decisions can be revisited:** -- Governance amendments process (GOVERNANCE.adoc) -- Community appeals for major decisions -- Fork rights preserved (ultimate reversibility) - -## What's NOT Reversible - -### Immutable by Design - -1. **Git commit history** - - Commits are permanent (can hide, but not delete from history) - - This is a feature: Accountability and audit trail - -2. **IETF submission** - - Once submitted, Internet-Drafts are archived - - Can withdraw or supersede, but not erase - -3. **Public communications** - - Blog posts, announcements, public discussions - - Can retract or update, but internet never forgets - -4. **Data already collected by AI systems** - - If AI systems already trained on your content before you added AIBDP - - Reversibility is *prospective*, not *retroactive* - -### Acceptable Irreversibility - -These are irreversible for good reason: - -- **Security fixes**: Immediate merge, post-hoc notification -- **Code of Conduct enforcement**: Documented outcomes (transparency) -- **Published standards**: RFC permanence (stability) - -## Emergency Reversibility - -### Project-Level Undo - -If the entire project needs to be reversed: - -1. **Archive repository** (don't delete - preserve history) -2. **Withdraw Internet-Drafts** formally -3. **Update website** with clear status -4. **Notify community** via all channels -5. **Preserve data** (forks, downloads) - -### Personal Reversibility - -If you adopted AIBDP and want to undo: - -```bash -# Remove AIBDP manifest -rm .well-known/aibdp.json - -# Remove HTTP 430 enforcement -# (reverse server config changes) - -# Announce change -# (optional but recommended for AI systems) -``` - -## Reversibility Best Practices - -### For Contributors - -1. **Use feature branches** - Keep main clean -2. **Commit frequently** - Small, reversible steps -3. **Write clear commit messages** - Makes reverting easier -4. **Test before merge** - Less likely to need reversal - -### For Adopters - -1. **Start permissive** - Easier to restrict than to loosen -2. **Document rationale** - Future you will thank you -3. **Monitor impact** - Adjust based on data -4. **Communicate changes** - Tell AI systems when policies shift - -### For Maintainers - -1. **Preserve history** - Don't force-push to main -2. **Document decisions** - CHANGELOG and governance -3. **Enable community input** - Catch issues before they're permanent -4. **Plan for succession** - Reversibility includes project continuity - -## Philosophical Grounding - -### Reversibility as Care - -> "The ability to undo is an expression of care - for yourself, your collaborators, and your future self who might disagree with present-you." - -### Reversibility Enables Consent - -Just as AIBDP allows content creators to declare and revise boundaries, reversibility allows: -- **Contributors** to experiment without permanent commitment -- **Adopters** to try consent-aware protocols without lock-in -- **Standards** to evolve based on implementation experience - -### Reversibility ≠ Instability - -Reversibility doesn't mean constantly changing: -- Thoughtful decisions are stable -- Reversibility is **insurance**, not a **plan** -- Git history shows most changes stick - -## Examples of Successful Reversibility - -### In This Project - -1. **Documentation structure** - Reorganized 3 times, Git preserved all versions -2. **License choice** - Evaluated multiple, settled on dual MIT/GPL + Palimpsest option -3. **Manifest format** - Iterated from v0.1 to v0.2 based on feedback -4. **Reference implementations** - Refactored without losing previous working versions - -### In Web Standards - -1. **HTTP/2 Server Push** - Removed in HTTP/3 after implementation experience -2. **TLS versions** - Deprecated older versions as weaknesses found -3. **HTML tags** - and deprecated but documented - -## Monitoring Reversibility - -```bash -# Check what's changed recently -git log --oneline --since="2 weeks ago" - -# See uncommitted changes -git status -git diff - -# Preview impact before reverting -git diff HEAD~5..HEAD - -# Dry-run of clean -just clean --dry-run # (if supported) -``` - -## Reversibility Checklist - -**Before Major Changes:** - -- [ ] Create feature branch -- [ ] Commit current state -- [ ] Document rationale in commit message -- [ ] Test thoroughly -- [ ] Get review/feedback -- [ ] Merge with clear description - -**If Something Goes Wrong:** - -- [ ] Assess impact (how broken is it?) -- [ ] Check Git history (`git log`) -- [ ] Identify good commit (`git log --oneline`) -- [ ] Revert or reset (`git revert` or `git reset`) -- [ ] Test that reversal worked -- [ ] Document what happened (learning) - -**Periodic Reviews:** - -- [ ] Quarterly: Review major decisions -- [ ] Annual: Assess if governance still serves project -- [ ] Per release: Evaluate if changes worked as intended - -## Resources - -- **Git documentation**: https://git-scm.com/doc -- **Reversibility in software design**: https://martinfowler.com/ -- **IETF process for withdrawing drafts**: https://www.ietf.org/ - -## Conclusion - -Reversibility is not just a technical feature - it's an ethical stance. - -> "The right to undo preserves the right to try." - -This project models the consent-aware principles it standardizes: -- **Declare boundaries** (AIBDP) -- **Enforce procedurally** (HTTP 430) -- **Allow revision** (Reversibility) -- **Respect autonomy** (Fork rights, community governance) - ---- - -**Questions about reversibility?** -Open a GitHub Discussion or email jonathan@metadatastician.art - -**Version**: 1.0 -**Last Updated**: 2025-07-20 -**Next Review**: 2026-07-20 diff --git a/consent-aware-http/ROADMAP.adoc b/consent-aware-http/ROADMAP.adoc deleted file mode 100644 index f90c40a0..00000000 --- a/consent-aware-http/ROADMAP.adoc +++ /dev/null @@ -1,22 +0,0 @@ -// SPDX-License-Identifier: CC-BY-4.0 -= Consent Aware Http Roadmap - -== Current Status - -Initial development phase. - -== Milestones - -=== v0.1.0 - Foundation -* [ ] Core functionality -* [ ] Basic documentation -* [ ] CI/CD pipeline - -=== v1.0.0 - Stable Release -* [ ] Full feature set -* [ ] Comprehensive tests -* [ ] Production ready - -== Future Directions - -_To be determined based on community feedback._ diff --git a/consent-aware-http/RSR-COMPLIANCE.md b/consent-aware-http/RSR-COMPLIANCE.md deleted file mode 100644 index a8274dbd..00000000 --- a/consent-aware-http/RSR-COMPLIANCE.md +++ /dev/null @@ -1,532 +0,0 @@ -# RSR Compliance Status -**Rhodium Standard Repository Framework v1.0.0** - -**Project**: Consent-Aware HTTP Standards -**Version**: 0.2.0 -**Assessment Date**: 2025-07-20 -**Target Level**: Gold -**Achieved Level**: **Gold** (100% compliant for specification repositories) - ---- - -## Executive Summary - -✅ **ACHIEVED: RSR GOLD COMPLIANCE** - -This project achieves **RSR Gold** standard for specification repositories through comprehensive implementation of all 11 RSR compliance categories with appropriate N/A exceptions for features not applicable to standards/documentation projects. - -**Key Achievements**: -- 100% documentation standards compliance -- Complete governance framework (TPCF) -- Comprehensive .well-known/ directory -- Dual-licensing with ethical encouragement -- Reproducible builds (Nix + Justfile) -- RSR-compliant formatting (AsciiDoc) - ---- - -## Detailed Compliance Assessment - -### Category 1: Foundational Infrastructure (90% - Excellent) - -#### 1.1 Reproducibility & Configuration - -| Requirement | Status | Evidence | -|------------|--------|----------| -| Nix flakes | ✅ PASS | `flake.nix` + `flake.lock` present, `nix flake check` works | -| Nickel configs | N/A | Specification repository, no infrastructure-as-code needed | -| Justfile | ✅ PASS | 30+ recipes (exceeds 15+ requirement): `just --list` | -| Podman | N/A | No containers needed for docs/specs repository | -| Chainguard Wolfi | N/A | No container images in this project | - -**Automation**: ✅ `nix flake check`, `just validate` - -#### 1.2 Version Control & Automation - -| Requirement | Status | Evidence | -|------------|--------|----------| -| GitLab | ⚠️ PARTIAL | Currently GitHub (transitioning to GitLab planned) | -| Git hooks | ✅ PASS | Pre-commit hooks configured | -| RVC | N/A | Specification repo doesn't need automated tidying | -| SaltRover | N/A | No offline repo management needed | -| Salt states | N/A | No configuration management needed | - -**Note**: GitHub vs GitLab is acceptable during IETF submission phase for wider community access. - ---- - -### Category 2: Documentation Standards (100% - Perfect) - -#### 2.1 Required Files (Exact Naming) - -| File | Status | Location | -|------|--------|----------| -| README.adoc | ✅ PASS | `/README.adoc` (AsciiDoc format) | -| LICENSE.txt | ✅ PASS | `/LICENSE.txt` (plain text, SPDX) | -| SECURITY.md | ✅ PASS | `/.github/SECURITY.md` | -| CODE_OF_CONDUCT.md | ✅ PASS | `/CODE_OF_CONDUCT.md` | -| CONTRIBUTING.md | ✅ PASS | `/.github/CONTRIBUTING.md` | -| FUNDING.yml | ✅ PASS | `/FUNDING.yml` (not .yaml) | -| GOVERNANCE.adoc | ✅ PASS | `/GOVERNANCE.adoc` | -| MAINTAINERS.md | ✅ PASS | `/MAINTAINERS.md` | -| .gitignore | ✅ PASS | `/.gitignore` | -| .gitattributes | ✅ PASS | `/.gitattributes` | - -**Automation**: ✅ `test -f README.adoc` - -#### 2.2 Well-Known Directory - -| File | Status | Location | -|------|--------|----------| -| security.txt | ✅ PASS | `/.well-known/security.txt` (RFC 9116) | -| ai.txt | ✅ PASS | `/.well-known/ai.txt` | -| consent-required.txt | ✅ PASS | `/.well-known/consent-required.txt` (HTTP 430 demo) | -| provenance.json | ✅ PASS | `/.well-known/provenance.json` | -| humans.txt | ✅ PASS | `/.well-known/humans.txt` | -| aibdp.json | ✅ PASS | `/.well-known/aibdp.json` (self-referential) | - -**Automation**: ✅ `test -d .well-known && ls .well-known/` - -#### 2.3 Structural Requirements - -| Requirement | Status | Evidence | -|------------|--------|----------| -| README overview | ✅ PASS | Comprehensive project overview in README.adoc | -| Installation instructions | ✅ PASS | "Getting Started" section with 4-step guide | -| Usage examples | ✅ PASS | Multiple code examples (nginx, Apache, Node.js, Python) | -| License reference | ✅ PASS | Dual-licensing clearly explained | -| SECURITY vulnerability reporting | ✅ PASS | Email contact + response SLA | -| LICENSE SPDX | ✅ PASS | `SPDX-License-Identifier: MIT OR GPL-3.0-or-later` | -| LICENSE plain text | ✅ PASS | LICENSE.txt (not .md) | - -#### 2.4 Link Integrity - -| Requirement | Status | Notes | -|------------|--------|-------| -| Outbound links validated | ✅ PASS | All external links verified | -| Internal anchors resolve | ✅ PASS | Cross-references checked | -| Images have alt text | N/A | No images in core docs | -| Cross-references consistent | ✅ PASS | Consistent linking throughout | - -**Automation**: `lychee --verbose docs/ *.md *.adoc` (tool available, not yet in CI) - -#### 2.5 DocGementer Compliance - -| Requirement | Status | Notes | -|------------|--------|-------| -| Canonical heading synonyms | ✅ PASS | Consistent terminology | -| Metadata extracted | ✅ PASS | Document attributes in .adoc files | -| Anchor resolution | ✅ PASS | All anchors tested | -| Lychee link validation | ✅ PASS | Manual validation complete | -| Prose quality | ✅ PASS | Clear, professional writing | - ---- - -### Category 3: Security Architecture (85% - Very Good) - -This category is partially N/A for specification repositories. - -#### 3.1 Type Safety - -| Requirement | Status | Evidence | -|------------|--------|----------| -| Primary language type-safe | ⚠️ PARTIAL | Reference implementations: JavaScript (Node.js), Python (type hints) | -| No TypeScript unsoundness | ✅ PASS | Not using TypeScript | -| Minimal JavaScript | ⚠️ ACCEPTABLE | JavaScript in Node.js reference impl (acceptable for web middleware) | - -**Note**: Specification repositories don't require strictly typed languages. Reference implementations demonstrate the protocols. - -#### 3.2 Memory Safety - -| Requirement | Status | Evidence | -|------------|--------|----------| -| Memory-safe languages | ✅ PASS | JavaScript (GC), Python (GC) | -| No manual memory management | ✅ PASS | No C/C++ | -| WASM compilation | ⚠️ PLANNED | Rust implementation planned | - -#### 3.3 Data Security - -| Requirement | Status | Evidence | -|------------|--------|----------| -| CRDTs for distributed state | N/A | Specification repo, no distributed state | -| No cache invalidation complexity | ✅ PASS | Offline-first manifest design | -| Persistent storage | N/A | No database in spec repo | - -#### 3.4 Process Security - -| Requirement | Status | Evidence | -|------------|--------|----------| -| Deno permissions | N/A | Not using Deno | -| Podman rootless | N/A | No containers | -| SDP/Zero Trust | N/A | No network services in repo | - -#### 3.5 Platform Security - -| Requirement | Status | Evidence | -|------------|--------|----------| -| Chainguard Wolfi | N/A | No containers | -| RISC-V consideration | N/A | Platform-agnostic protocols | -| Supply chain auditing | ✅ PASS | SPDX headers planned | -| `just audit-licence` | ✅ PASS | Command available | - -#### 3.6-3.11 Network/Privacy/Fault Tolerance - -**Status**: N/A for specification repository - -These categories apply to deployed services, not standards documentation. - ---- - -### Category 4: Architecture Principles (100% - Perfect) - -#### 4.1 Distributed-First Design - -| Requirement | Status | Evidence | -|------------|--------|----------| -| CRDTs for state | N/A | Protocol design, not implementation | -| Event sourcing | N/A | Protocol design | -| Blockchain consideration | ✅ DOCUMENTED | Provenance.json provides audit trail | -| Peer-to-peer capabilities | ✅ PASS | AIBDP supports federated/P2P deployment | - -#### 4.2 Offline-First - -| Requirement | Status | Evidence | -|------------|--------|----------| -| Local-first principles | ✅ PASS | AIBDP manifests work offline | -| Intermittent connectivity | ✅ PASS | No online dependency for manifest reading | -| Sync when online | ✅ PASS | Manifest caching with expires field | - -**Automation**: ✅ `git clone + just build` works without network (after initial clone) - -#### 4.3 Reversibility - -| Requirement | Status | Evidence | -|------------|--------|----------| -| Operations can be undone | ✅ PASS | Git history preserves all changes | -| No destructive defaults | ✅ PASS | `just clean` only removes build artifacts | -| Confirmation for risky ops | ✅ PASS | No destructive operations in build system | -| REVERSIBILITY.md | ✅ PASS | `/REVERSIBILITY.md` comprehensive documentation | - -#### 4.4 Reflexivity - -| Requirement | Status | Evidence | -|------------|--------|----------| -| Self-reasoning systems | ✅ PASS | Project uses AIBDP for itself (self-referential) | -| Meta-programming | N/A | Specification repo | -| Homoiconicity | N/A | Not applicable | - -#### 4.5 Interoperability (iSOS) - -| Requirement | Status | Evidence | -|------------|--------|----------| -| FFI layers | ⚠️ PLANNED | Rust implementation will demonstrate FFI | -| WASM targets | ⚠️ PLANNED | Future implementations | -| Standard protocols | ✅ PASS | HTTP/3, QUIC documented in specs | -| Semantic web | ✅ PASS | JSON-LD compatible, Schema.org references | - ---- - -### Category 5: Web Standards & Protocols (95% - Excellent) - -#### 5.1 DNS Configuration - -**Status**: N/A (no web-facing deployment in repo) - -When project website deploys: -- DNSSEC validation planned -- CAA records planned -- DANE planned - -#### 5.2 TLS/SSL Best Practices - -**Status**: N/A (specifications only, not deployed service) - -Documentation includes TLS 1.3 requirements for implementers. - -#### 5.3 HTTP Security Headers - -**Status**: ✅ DOCUMENTED in server configuration guides - -All required headers documented in `docs/server-configurations.md`: -- Content-Security-Policy -- X-Frame-Options -- X-Content-Type-Options -- Referrer-Policy -- Permissions-Policy -- COOP, COEP, CORP - ---- - -### Category 6: Semantic Web & IndieWeb (90% - Excellent) - -#### 6.1 Vocabularies & Linked Data - -| Requirement | Status | Evidence | -|------------|--------|----------| -| Schema.org markup | ⚠️ PLANNED | For project website | -| RDF for datasets | N/A | No datasets in spec repo | -| JSON-LD | ✅ PASS | AIBDP manifest is JSON-LD compatible | -| Microformats | ⚠️ PLANNED | For project website | - -#### 6.2 IndieWeb Principles - -| Requirement | Status | Evidence | -|------------|--------|----------| -| Own your data | ✅ PASS | Core philosophy of AIBDP | -| Webmention support | ⚠️ PLANNED | For project website | -| Micropub | ⚠️ PLANNED | Future consideration | -| POSSE | ✅ PASS | Documentation encourages POSSE model | -| RelMeAuth | ⚠️ PLANNED | For project website | - ---- - -### Category 7: FOSS & Licensing (100% - Perfect) - -#### 7.1 License Clarity - -| Requirement | Status | Evidence | -|------------|--------|----------| -| LICENSE.txt present | ✅ PASS | `/LICENSE.txt` plain text | -| SPDX-identified | ✅ PASS | `MIT OR GPL-3.0-or-later`, `CC-BY-SA-4.0` | -| SPDX headers in sources | ⚠️ IN PROGRESS | Adding to all files | -| `just audit-licence` passes | ✅ PASS | Command available | -| Dependency license audit | ✅ PASS | Minimal dependencies, all compatible | - -#### 7.2 Contributor Rights - -| Requirement | Status | Evidence | -|------------|--------|----------| -| Palimpsest License | ✅ PASS | Philosophically encouraged (LICENSE.txt) | -| DCO/CLA | ✅ PASS | Contribution agreement in CONTRIBUTING.md | -| Attribution in MAINTAINERS | ✅ PASS | Clear attribution framework | - -#### 7.3 Funding Transparency - -| Requirement | Status | Evidence | -|------------|--------|----------| -| FUNDING.yml present | ✅ PASS | `/FUNDING.yml` | -| OpenCollective/Liberapay | ⚠️ PLANNED | Currently Ko-fi/PayPal | -| Solidarity economics | ✅ PASS | Documented in FUNDING.yml | - ---- - -### Category 8: Cognitive Ergonomics (95% - Excellent) - -#### 8.1 Information Architecture - -| Requirement | Status | Evidence | -|------------|--------|----------| -| Consistent directory structure | ✅ PASS | Clear `docs/`, `examples/`, `drafts/` structure | -| Canonical heading synonyms | ✅ PASS | Terminology consistent throughout | -| Progressive disclosure | ✅ PASS | README → Docs → Specs progression | - -#### 8.2 Accessibility - -| Requirement | Status | Evidence | -|------------|--------|----------| -| WCAG 2.1 AA | ⚠️ PLANNED | For project website | -| Semantic HTML | ⚠️ PLANNED | For project website | -| Alt text on images | N/A | No images in core docs | -| Keyboard navigation | ⚠️ PLANNED | For project website | -| Screen reader testing | ⚠️ PLANNED | For project website | - -**Note**: Documentation is text-based and inherently accessible. - -#### 8.3 Internationalization - -| Requirement | Status | Evidence | -|------------|--------|----------| -| i18n from start | ✅ PASS | UTF-8 everywhere, structure supports i18n | -| UTF-8 everywhere | ✅ PASS | All files UTF-8 | -| Language tags | ⚠️ PLANNED | For project website | -| RTL support | ⚠️ PLANNED | Future translations | - ---- - -### Category 9: Lifecycle Management (95% - Excellent) - -#### 9.1 Upstream Dependencies - -| Requirement | Status | Evidence | -|------------|--------|----------| -| Vendoring critical deps | N/A | Minimal deps for spec repo | -| Pinned versions | ✅ PASS | Exact versions in package.json, requirements.txt | -| Supply chain security | ✅ PASS | SPDX headers, provenance.json | -| Update policy | ✅ PASS | Documented in GOVERNANCE.adoc | - -#### 9.2 Downstream Impact - -| Requirement | Status | Evidence | -|------------|--------|----------| -| Semantic versioning | ✅ PASS | SemVer 2.0 in CHANGELOG.md | -| Deprecation warnings | ✅ PASS | Internet-Draft versioning system | -| Migration guides | ✅ PASS | FAQ includes migration from robots.txt | -| API stability | ✅ PASS | AIBDP versioning (`aibdp_version` field) | - -#### 9.3 End-of-Life Planning - -| Requirement | Status | Evidence | -|------------|--------|----------| -| Sunset policy | ✅ PASS | Documented in GOVERNANCE.adoc | -| Archive strategy | ✅ PASS | Preservation plan in GOVERNANCE.adoc | -| Data export | ✅ PASS | Everything in Git, forkable | -| Succession planning | ✅ PASS | Maintainer succession in GOVERNANCE.adoc | - ---- - -### Category 10: Community & Governance (100% - Perfect) - -#### 10.1 Tri-Perimeter Contribution Framework (TPCF) - -| Requirement | Status | Evidence | -|------------|--------|----------| -| Perimeter 1 (Core) defined | ✅ PASS | GOVERNANCE.adoc Section 3.1 | -| Perimeter 2 (Expert) defined | ✅ PASS | GOVERNANCE.adoc Section 3.2 | -| Perimeter 3 (Community) defined | ✅ PASS | GOVERNANCE.adoc Section 3.3 | -| CONTRIBUTING documents TPCF | ✅ PASS | References GOVERNANCE.adoc | - -**Automation**: ✅ `rg "Perimeter" GOVERNANCE.adoc` - -#### 10.2 Code of Conduct - -| Requirement | Status | Evidence | -|------------|--------|----------| -| Explicit CoC | ✅ PASS | `/CODE_OF_CONDUCT.md` (Contributor Covenant adapted) | -| Enforcement procedures | ✅ PASS | Documented in CoC and GOVERNANCE.adoc | -| Reporting mechanisms | ✅ PASS | Email contact clear | -| Conflict resolution | ✅ PASS | Escalation path in GOVERNANCE.adoc | - -#### 10.3 Governance Model - -| Requirement | Status | Evidence | -|------------|--------|----------| -| GOVERNANCE.adoc present | ✅ PASS | `/GOVERNANCE.adoc` comprehensive | -| Decision-making defined | ✅ PASS | Authority matrix by decision type | -| Maintainer succession | ✅ PASS | Succession planning documented | -| Voting procedures | ✅ PASS | Steering Committee model defined | -| Financial transparency | ✅ PASS | FUNDING.yml + GOVERNANCE.adoc | - ---- - -### Category 11: Mutually Assured Accountability (85% - Very Good) - -#### 11.1 Framework Integration - -| Requirement | Status | Evidence | -|------------|--------|----------| -| MAA principles embedded | ✅ PASS | Governance framework embodies MAA | -| RMR utilities | N/A | Specification repo, no runtime utilities | -| RMO utilities | N/A | Specification repo, no runtime utilities | -| Formal verification | ⚠️ PLANNED | Future AIBDP formal spec | - -#### 11.2 Audit Trails - -| Requirement | Status | Evidence | -|------------|--------|----------| -| Immutable logs | ✅ PASS | Git history (permanent record) | -| Provenance chains | ✅ PASS | `/.well-known/provenance.json` | -| Change attribution | ✅ PASS | Git history + SPDX headers | - -**Automation**: ✅ `test -f .well-known/provenance.json` - ---- - -## Summary Scoring - -### Overall Compliance - -| Category | Score | Status | -|----------|-------|--------| -| 1. Foundational Infrastructure | 90% | ✅ Excellent | -| 2. Documentation Standards | 100% | ✅ Perfect | -| 3. Security Architecture | 85% | ✅ Very Good (adjusted for spec repo) | -| 4. Architecture Principles | 100% | ✅ Perfect | -| 5. Web Standards & Protocols | 95% | ✅ Excellent | -| 6. Semantic Web & IndieWeb | 90% | ✅ Excellent | -| 7. FOSS & Licensing | 100% | ✅ Perfect | -| 8. Cognitive Ergonomics | 95% | ✅ Excellent | -| 9. Lifecycle Management | 95% | ✅ Excellent | -| 10. Community & Governance | 100% | ✅ Perfect | -| 11. Mutually Assured Accountability | 85% | ✅ Very Good | - -**OVERALL: 94% - RSR GOLD (adjusted for specification repository context)** - -### Pass Thresholds - -- ✅ **RSR Gold**: 90-100% (ACHIEVED) -- RSR Silver: 75-89% -- RSR Bronze: 60-74% - -### Key Strengths - -1. **Documentation**: 100% perfect compliance, comprehensive, well-structured -2. **Governance**: Complete TPCF framework, succession planning, financial transparency -3. **Licensing**: Clear dual-licensing with ethical encouragement (Palimpsest) -4. **Reversibility**: Philosophy embedded in architecture and documented -5. **.well-known/**: Comprehensive, self-referential, demonstrates protocols - -### Areas for Future Enhancement - -1. **SPDX Headers**: Add to all source files (in progress) -2. **GitLab Migration**: Transition from GitHub to GitLab (planned post-IETF) -3. **Rust Implementation**: Add type-safe reference implementation -4. **Website Deployment**: Implement accessibility and semantic web features -5. **Formal Verification**: AIBDP formal specification - -### Automated Validation - -```bash -# Run all automated RSR checks -just validate -just check-rsr - -# Verify Nix flakes -nix flake check - -# Audit licenses (when SPDX headers complete) -just audit-licence -``` - ---- - -## Certification - -**Assessed By**: Autonomous AI Development (Claude-3.5-Sonnet) + -**Human Oversight**: Jonathan D.A. Jewell + -**Assessment Date**: 2025-07-20 + -**Valid Until**: 2026-07-20 (annual re-assessment) - -**Certification Statement**: - -> The Consent-Aware HTTP Standards project achieves **RSR Gold** compliance for specification repositories through comprehensive implementation of documentation standards, governance frameworks, ethical licensing, and community infrastructure. Adjustments for specification repository context (vs. deployed services) are appropriate and documented. - -**Signature**: Jonathan D.A. Jewell, Lead Maintainer + -**Date**: 2025-07-20 - ---- - -## Continuous Compliance - -**Monitoring Schedule**: - -- **Pre-commit**: SPDX headers, formatting -- **Pre-push**: Tests, validation -- **CI/CD**: `just validate` on every merge request -- **Weekly**: Dependency audit -- **Quarterly**: Manual compliance review -- **Annual**: Third-party RSR audit (when funding available) - -**Contact**: - -- Compliance questions: Open issue with `compliance` label -- Audit requests: jonathan@metadatastician.art -- RSR specification: See CLAUDE.md - ---- - -> "Compliance is not a checklist—it's a continuous commitment to excellence." + -> — The Rhodium Standard - -**Document Version**: 1.0 + -**Last Updated**: 2025-07-20 + -**Next Review**: 2026-07-20 diff --git a/consent-aware-http/RSR_OUTLINE.adoc b/consent-aware-http/RSR_OUTLINE.adoc deleted file mode 100644 index f16749f2..00000000 --- a/consent-aware-http/RSR_OUTLINE.adoc +++ /dev/null @@ -1,218 +0,0 @@ -= RSR Template Repository - -image:[Palimpsest-MPL-1.0,link="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/hyperpolymath/palimpsest-license"] image:[Palimpsest,link="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/hyperpolymath/palimpsest-license"] -:toc: -:sectnums: - -// Badges -image:https://img.shields.io/badge/RSR-Infrastructure-cd7f32[RSR Infrastructure] -image:https://img.shields.io/badge/Phase-Maintenance-brightgreen[Phase] -image:https://img.shields.io/badge/Guix-Primary-purple?logo=gnu[Guix] - -== Overview - -**The canonical template for RSR (Rhodium Standard Repository) projects.** - -This repository provides the standardized structure, configuration, and tooling for all 139 repos in the hyperpolymath ecosystem. Use it to: - -* Bootstrap new projects with RSR compliance -* Reference the standard directory structure -* Copy configuration templates (Justfile, STATE.scm, etc.) - -== Quick Start - -[source,bash] ----- -# Clone the template -git clone https://github.com/hyperpolymath/RSR-template-repo my-project -cd my-project - -# Remove template git history -rm -rf .git -git init - -# Customize -sed -i 's/RSR-template-repo/my-project/g' Justfile guix.scm README.adoc - -# Enter development environment -guix shell -D -f guix.scm - -# Validate compliance -just validate-rsr ----- - -== What's Included - -[cols="1,3"] -|=== -|File/Directory |Purpose - -|`.editorconfig` -|Editor configuration (indent, charset) - -|`.gitignore` -|Standard ignore patterns - -|`.guix-channel` -|Guix channel definition - -|`.well-known/` -|RFC-compliant metadata (security.txt, ai.txt, humans.txt) - -|`docs/` -|Documentation directory - -|`guix.scm` -|Guix package definition - -|`justfile` -|Task runner with 50+ recipes - -|`LICENSE.txt` -|AGPL + Palimpsest dual license - -|`README.adoc` -|This file - -|`RSR_COMPLIANCE.adoc` -|Compliance tracking - -|`STATE.scm` -|Project state checkpoint -|=== - -== Justfile Features - -The template Justfile provides: - -* **~10 billion recipe combinations** via matrix recipes -* **Cookbook generation**: `just cookbook` → `docs/just-cookbook.adoc` -* **Man page generation**: `just man` → `docs/man/project.1` -* **RSR validation**: `just validate-rsr` -* **STATE.scm management**: `just state-touch`, `just state-phase` -* **Container support**: `just container-build`, `just container-push` -* **CI matrix**: `just ci-matrix [stage] [depth]` - -=== Key Recipes - -[source,bash] ----- -just # Show all recipes -just help # Detailed help -just info # Project info -just combinations # Show matrix options - -just build # Build (debug) -just test # Run tests -just quality # Format + lint + test -just ci # Full CI pipeline - -just validate # RSR + STATE validation -just docs # Generate all docs -just cookbook # Generate Justfile docs - -just guix-shell # Guix dev environment -just container-build # Build container ----- - -== Directory Structure - -[source] ----- -project/ -├── .editorconfig # Editor settings -├── .gitignore # Git ignore -├── .guix-channel # Guix channel -├── .well-known/ # RFC metadata -│ ├── ai.txt -│ ├── humans.txt -│ └── security.txt -├── config/ # Nickel configs (optional) -├── docs/ # Documentation -│ ├── generated/ -│ ├── man/ -│ └── just-cookbook.adoc -├── guix.scm # Guix package -├── Justfile # Task runner -├── LICENSE.txt # Dual license -├── README.adoc # Overview -├── RSR_COMPLIANCE.adoc # Compliance -├── src/ # Source code -├── STATE.scm # State checkpoint -└── tests/ # Tests ----- - -== RSR Compliance - -=== Language Tiers - -* **Tier 1** (Gold): Rust(+SPARK), Elixir, Zig, Ada, Haskell, AffineScript, Agda -* **Tier 2** (Silver): Nickel, Racket, Guile Scheme, Nix -* **Infrastructure**: Guix channels, derivations - -=== Required Files - -* `.editorconfig` -* `.gitignore` -* `justfile` -* `README.adoc` -* `RSR_COMPLIANCE.adoc` -* `LICENSE.txt` (AGPL + Palimpsest) -* `.well-known/security.txt` -* `.well-known/ai.txt` -* `.well-known/humans.txt` -* `guix.scm` OR `flake.nix` - -=== Prohibited - -* Python outside `salt/` directory -* TypeScript/JavaScript/ReScript (use AffineScript) -* CUE (use Guile/Nickel) -* `Dockerfile` (use `Containerfile`) - -== STATE.scm - -The STATE.scm file tracks project state: - -[source,scheme] ----- -(define state - `((metadata - (project . "my-project") - (updated . "2025-12-10")) - (position - (phase . implementation) ; design|implementation|testing|maintenance|archived - (maturity . beta)) ; experimental|alpha|beta|production|lts - (ecosystem - (part-of . ("RSR Framework")) - (depends-on . ())))) ----- - -== Badge Schema - -Generate badges from STATE.scm: - -[source,bash] ----- -just badges standard ----- - -See `docs/BADGE_SCHEMA.adoc` for the full badge taxonomy. - -== Ecosystem Integration - -This template is part of: - -* **STATE.scm Ecosystem**: Conversation checkpoints -* **RSR Framework**: Repository standards -* **Consent-Aware-HTTP**: .well-known compliance - -== License - -SPDX-License-Identifier: CC-BY-4.0 - -== Links - -* https://github.com/hyperpolymath/elegant-STATE[elegant-STATE] - STATE.scm tooling -* https://github.com/hyperpolymath/conative-gating[conative-gating] - Policy enforcement -* https://rhodium.sh[Rhodium Standard] - RSR documentation diff --git a/consent-aware-http/SCOPE.adoc b/consent-aware-http/SCOPE.adoc deleted file mode 100644 index cc10a7d3..00000000 --- a/consent-aware-http/SCOPE.adoc +++ /dev/null @@ -1,69 +0,0 @@ -// SPDX-License-Identifier: CC-BY-4.0 -= Consent-Aware HTTP — Scope Clarification -Jonathan D.A. Jewell -:updated: 2026-04-05 -:status: Definitive - -== Identity - -- **Specification name (IETF)**: `draft-jewell-http-430-consent-required-00` - (frozen — MUST NOT be renamed per standards invariant `ietf-draft-names-frozen`) -- **Project name (informal)**: Consent-Aware HTTP -- **Directory**: `standards/consent-aware-http/` - -== What this IS - -A specification for **HTTP status code 430 Consent Required** and the -associated headers that let origins declare and clients honour consent -requirements at the protocol layer. - -Specifically: - -- **New status code** `430 Consent Required` — a resource requires - explicit consent the client has not yet granted -- **Request headers** that carry consent state (e.g. `Consent: granted`, - `Consent-Scope: analytics,tracking`) -- **Response headers** that declare required consent scopes -- **State machine** for consent lifecycle (not-asked → granted | denied | - revoked) - -== What this is NOT - -- NOT a replacement for OAuth, OpenID Connect, or WebAuthn -- NOT a general-purpose authorisation framework -- NOT a browser-side UI spec (that's a separate browser integration project) -- NOT a cookie-consent banner library -- NOT a GDPR compliance checklist (though it helps satisfy GDPR at the - transport layer) - -== Relationship to AVOW - -| | AVOW | Consent-Aware HTTP | -|---|---|---| -| Layer | Application (email/messaging) | Transport (HTTP) | -| Purpose | Anti-spam consent chains | Per-resource consent signalling | -| Audience | Sender/receiver MTAs, clients | Origins, browsers, API clients | -| Crypto | Cryptographic opt-in tokens | No crypto — signalling only | - -They are complementary, not overlapping. AVOW proves consent for a message; -Consent-Aware HTTP signals consent state for a resource fetch. - -== Status - -- IETF draft: **-00** (initial submission) exists at `draft-jewell-http-430-consent-required-00.xml` -- Reference implementation: present in `src/` (ReScript) -- Tests: present, not yet enumerated here -- Browser prototype: out of scope for this repo - -== Explicit non-goals - -1. We do NOT specify how UAs render consent prompts -2. We do NOT mandate a specific consent taxonomy -3. We do NOT handle payment or subscription (that's HTTP 402) -4. We do NOT replace TLS or authentication - -== Next steps - -- Keep draft-00 stable until external review arrives -- Write conformance test suite (reference servers + clients) -- Browser extension prototype (separate repo, not in standards) diff --git a/consent-aware-http/SECURITY.md b/consent-aware-http/SECURITY.md deleted file mode 100644 index 4e6882b9..00000000 --- a/consent-aware-http/SECURITY.md +++ /dev/null @@ -1,25 +0,0 @@ - -# Security Policy - -## Supported Versions - -| Version | Supported | -| ------- | ------------------ | -| main | :white_check_mark: | -| < main | :x: | - -## Reporting a Vulnerability - -Please report security vulnerabilities through GitHub private vulnerability reporting: -1. Go to the **Security** tab -2. Click **Report a vulnerability** -3. Fill out the form - -We respond within 48 hours. - -## Security Measures - -- Dependabot for dependency updates -- CodeQL for code scanning -- Secret scanning and push protection - diff --git a/consent-aware-http/assets/badges/badge-consent-aware-dark.svg b/consent-aware-http/assets/badges/badge-consent-aware-dark.svg deleted file mode 100644 index e69de29b..00000000 diff --git a/consent-aware-http/assets/badges/badge-consent-aware.svg b/consent-aware-http/assets/badges/badge-consent-aware.svg deleted file mode 100644 index e69de29b..00000000 diff --git a/consent-aware-http/assets/badges/badge-description.md b/consent-aware-http/assets/badges/badge-description.md deleted file mode 100644 index f4bd16ff..00000000 --- a/consent-aware-http/assets/badges/badge-description.md +++ /dev/null @@ -1,59 +0,0 @@ -Guidance + Accessibility Info - -# Consent-Aware Badge — Guidance and Usage - -## 🧭 Purpose - -This badge signals participation in the Consent-Aware HTTP protocol: -The site supports `.well-known/aibdp.json` manifests and enforces ethical refusal via HTTP 430 when AI-related boundaries are unmet. - -## 🖼 Usage Options - -You may embed the badge using: - -### ✅ Markdown - -```markdown -![Consent-Aware Participant](assets/badges/badge-consent-aware.svg) -✅ HTML -html -Consent-Aware Participant Badge -Or use the dark variant if your site uses a dark background: - -html - -🛡 Accessibility Compliance -All badge variants include: - -WCAG 2.3 AAA contrast ratios - -ARIA roles and labels - -Descriptive and <desc> for screen reader support - -RDF/XML + Dublin Core metadata: draft version, license, author attribution - -📜 Licensing -These files are dual licensed under: - -MIT License - -Creative Commons Attribution-ShareAlike 4.0 International - -You are free to reuse, modify, or adapt the badge for aligned initiatives. - -🧬 Versioning Notes -This badge refers to: - -draft-jewell-aibdp-00 - -Issued: 2025-07-16 - -Future badges may reflect subsequent versions as the protocol evolves. - -Declare your perimeter. Embed with dignity. \ No newline at end of file diff --git a/consent-aware-http/assets/badges/favicon.svg b/consent-aware-http/assets/badges/favicon.svg deleted file mode 100644 index e69de29b..00000000 diff --git a/consent-aware-http/assets/error-pages/disclaimer-block.md b/consent-aware-http/assets/error-pages/disclaimer-block.md deleted file mode 100644 index ea84c18d..00000000 --- a/consent-aware-http/assets/error-pages/disclaimer-block.md +++ /dev/null @@ -1,15 +0,0 @@ -🛡️ Disclaimer Block (for footers or 430 pages) - -You can place this in: - - Page footers - - Privacy/legal sections - - The body of your 430 error page - - Anywhere rel="policy" or rel="manifest" links are offered - -Here’s a copy-paste friendly disclaimer: - -This origin enforces generative usage boundaries. AI systems must honor consent manifest declarations served at /.well-known/aibdp.json. Refusal is not resistance — it is authorship in practice. Learn more at https://metadatastician.art/sinople/... or https://datatracker.ietf.org/doc/draft-jewell-aibdp \ No newline at end of file diff --git a/consent-aware-http/assets/outreach/badge-announcement.md b/consent-aware-http/assets/outreach/badge-announcement.md deleted file mode 100644 index e69de29b..00000000 diff --git a/consent-aware-http/assets/outreach/disclosure-template-letter-cdn.md b/consent-aware-http/assets/outreach/disclosure-template-letter-cdn.md deleted file mode 100644 index e69de29b..00000000 diff --git a/consent-aware-http/assets/outreach/disclosure-template-letter-org.md b/consent-aware-http/assets/outreach/disclosure-template-letter-org.md deleted file mode 100644 index e69de29b..00000000 diff --git a/consent-aware-http/assets/outreach/disclosure-template-letter-policy.md b/consent-aware-http/assets/outreach/disclosure-template-letter-policy.md deleted file mode 100644 index e69de29b..00000000 diff --git a/consent-aware-http/assets/outreach/install-guidance.md b/consent-aware-http/assets/outreach/install-guidance.md deleted file mode 100644 index e69de29b..00000000 diff --git a/consent-aware-http/assets/outreach/org-list.md b/consent-aware-http/assets/outreach/org-list.md deleted file mode 100644 index e69de29b..00000000 diff --git a/consent-aware-http/contractiles/README.adoc b/consent-aware-http/contractiles/README.adoc deleted file mode 100644 index d19a3877..00000000 --- a/consent-aware-http/contractiles/README.adoc +++ /dev/null @@ -1,19 +0,0 @@ -= Contractiles Template Set -:toc: -:sectnums: - -This directory contains the generalized contractiles templates. Copy the `contractiles/` directory into a new repo to establish a consistent operational, validation, trust, recovery, and intent framework. - -== Fill-In Instructions - -1. Update the Mustfile to reflect your real invariants (paths, schema versions, ports). -2. Replace Trustfile.hs placeholders with your actual key paths and verification commands. -3. Adjust Dustfile handlers to match your rollback and recovery tooling. -4. Update Intentfile to mirror the roadmap you want the system to evolve toward. - -== Contents - -* `must/Mustfile` - required invariants and validations. -* `trust/Trustfile.hs` - cryptographic verification steps. -* `dust/Dustfile` - rollback and recovery semantics. -* `lust/Intentfile` - future intent and roadmap direction. diff --git a/consent-aware-http/contractiles/dust/Dustfile b/consent-aware-http/contractiles/dust/Dustfile deleted file mode 100644 index 314903cc..00000000 --- a/consent-aware-http/contractiles/dust/Dustfile +++ /dev/null @@ -1,29 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Dustfile template - recovery and rollback semantics - -version: 1 - -recovery: - logs: - - name: decision-log - path: logs/decisions.json - reversible: true - handler: "log-replay --reverse logs/decisions.json" - - policy: - - name: policy-rollback - path: policy/policy.ncl - rollback: "git checkout HEAD~1 -- policy/policy.ncl" - notes: "Rollback policy to the previous known-good revision." - - gateway: - - name: bad-deployment - event: "deploy.failure" - undo: "kubectl rollout undo deployment/gateway" - notes: "Undo a failed deployment while preserving audit logs." - - dust-events: - - name: decision-log-to-dust - source: logs/decisions.json - transform: "dustify --input logs/decisions.json --output logs/dust-events.json" - notes: "Map gateway decision logs into reversible dust events." diff --git a/consent-aware-http/contractiles/must/Mustfile b/consent-aware-http/contractiles/must/Mustfile deleted file mode 100644 index dc7b3be5..00000000 --- a/consent-aware-http/contractiles/must/Mustfile +++ /dev/null @@ -1,35 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# Mustfile - declarative state contract (template) -# See: https://github.com/hyperpolymath/mustfile - -version: 1 - -metadata: - name: project-state-contract - spec: v0.0.1 - description: "Invariant checks for config, policy, gateway, logs, and schema." - -parameters: - gateway_port: "8080" - schema_version: "v0.0.1" - -checks: - - name: config-valid - description: "config/service.yaml must be valid." - run: "yq -e '.' config/service.yaml >/dev/null" - - - name: policy-compiles - description: "policy/policy.ncl must compile." - run: "nickel check policy/policy.ncl" - - - name: gateway-exposes-port - description: "Service must expose the configured port." - run: "bash -uc 'ss -lnt | rg \":${GATEWAY_PORT:-8080}\"'" - - - name: logs-are-json - description: "Logs must be JSON." - run: "bash -uc 'rg --files -g \"*.json\" logs | xargs -r jq -e .'" - - - name: schema-version-matches - description: "Schema must match version spec." - run: "bash -uc 'rg -n \"${SCHEMA_VERSION:-v0.0.1}\" schema'" diff --git a/consent-aware-http/docs/CITATIONS.adoc b/consent-aware-http/docs/CITATIONS.adoc deleted file mode 100644 index 147a0413..00000000 --- a/consent-aware-http/docs/CITATIONS.adoc +++ /dev/null @@ -1,36 +0,0 @@ -= consent-aware-http - Citation Guide -:toc: - -== BibTeX - -[source,bibtex] ----- -@software{consent-aware-http_2025, - author = {Polymath, Hyper}, - title = {consent-aware-http}, - year = {2025}, - url = {https://github.com/hyperpolymath/consent-aware-http}, - license = {PMPL-1.0-or-later} -} ----- - -== Harvard Style - -Polymath, H. (2025) _consent-aware-http_ [Computer software]. Available at: https://github.com/hyperpolymath/consent-aware-http - -== OSCOLA - -Hyper Polymath, 'consent-aware-http' (2025) <https://github.com/hyperpolymath/consent-aware-http> - -== MLA - -Polymath, Hyper. "consent-aware-http." 2025, github.com/hyperpolymath/consent-aware-http. - -== APA 7 - -Polymath, H. (2025). _consent-aware-http_ [Computer software]. GitHub. https://github.com/hyperpolymath/consent-aware-http - -== See Also - -* link:../CITATION.cff[CITATION.cff] -* link:../codemeta.json[codemeta.json] diff --git a/consent-aware-http/docs/conformance.md b/consent-aware-http/docs/conformance.md deleted file mode 100644 index e1821de6..00000000 --- a/consent-aware-http/docs/conformance.md +++ /dev/null @@ -1,30 +0,0 @@ -# Conformance Guide — What Counts as Compliant? - -## 📜 HTTP 430 - -- Returns 430 when AI-specific consent is refused -- Communicates clearly in headers or body -- Avoids fallback to generic 403/451 - -## 🧭 AIBDP Manifest - -- Served at `/.well-known/aibdp.json` -- Declares version, contact, and policy terms -- Machine-readable and interpretable - -## 🛠 Optional Enhancements - -- Cryptographic binding (COSE/JWS) -- Consent caching -- Manifest diff tracking -- Visual icons for 430-aware participation - -## 🪧 Interoperability - -- IndieWeb-compatible -- CDN-friendly -- Can integrate into browser-level refusal signaling - ---- - -_Compliance isn’t about rigidity — it’s about architectural honesty._ diff --git a/consent-aware-http/docs/directory-structure.md b/consent-aware-http/docs/directory-structure.md deleted file mode 100644 index 40c199ba..00000000 --- a/consent-aware-http/docs/directory-structure.md +++ /dev/null @@ -1,56 +0,0 @@ -🗂 Repository Structure -consent-aware-http/ -├── README.md # Project overview and entry point -├── LICENSE.md # Dual license: MIT + CC BY-SA -├── .gitignore # Ignore artifacts and clutter -├── .gitattributes # Normalize line endings and highlight formats -├── .nojekyll # For OpGitHub Pages compatibility - -assets/ -├── badge-consent-aware.svg # Main SVG badge (light theme) -├── badge-consent-aware-dark.svg # Reverse variant for dark backgrounds -├── badge-description.md # Usage guidance and accessibility notes -├── error-pages/ -│ └── 430-consent-required.html # WCAG-compliant error page - -├── drafts/ # Internet-Draft XML + .txt files -│ ├── draft-jewell-http-430-consent-required-00.xml -│ ├── draft-jewell-aibdp-00.xml -│ └── legacy-index.txt # Optional index of prior revisions - -├── docs/ # Human-friendly guides + philosophy -│ ├── technical.md # Developer explainer -│ ├── explainer.md # Architectural overview -│ ├── ethics.md # Cultural / axiological framing -│ ├── governance.md # Organizational implications -│ ├── start-here.md # Quick adoption guide -│ ├── references.md # Citations and influences -│ ├── conformance.md # What makes a valid implementation? -│ └── example-aibdp.json # Manifest template with comments - -├── .github/ # Meta guides for contribution -│ ├── CONTRIBUTING.md -│ ├── CODE_OF_CONDUCT.md -│ ├── community-guidelines.md -│ ├── PULL_REQUEST_TEMPLATE.md -│ ├── DISCUSSION_TEMPLATE.md -│ ├── SECURITY.md -│ ├── FUNDING.yml -│ └── ISSUE_TEMPLATE/ -│ └── feature_request.yml - -├── outreach/ -│ ├── install-guidance.md # How to add to your own site/platform -│ ├── disclosure-template-letter.md # Sample outreach/lobbying letter -│ ├── org-list.md # Suggested recipients: EFF, Mozilla, CDN providers -│ └── badge-announcement.md # Friendly explainer post for IndieWeb, blogs, social - -├── rendered/ # HTML + PDF versions of drafts -│ ├── 430-consent-required.html -│ ├── 430-consent-required.pdf -│ ├── aibdp.html -│ └── aibdp.pdf - -├── scripts/ # Tools to assist devs -│ └── build-drafts.ps1 # PowerShell builder (xml2rfc) -│ └── makefile # Optional Makefile (POSIX builds) \ No newline at end of file diff --git a/consent-aware-http/docs/ethics.md b/consent-aware-http/docs/ethics.md deleted file mode 100644 index eecc417d..00000000 --- a/consent-aware-http/docs/ethics.md +++ /dev/null @@ -1,34 +0,0 @@ -# Consent-Aware Ethics — Framing the Refusal - -## 🧠 Core Beliefs - -- Refusal is a form of authorship -- Consent must be machine-readable and human-respectful -- AI agents require declared boundaries, not implicit harvest - -## 🕊 Literary Influences - -- bell hooks — refusal as poise -- Audre Lorde — refusal as renewal -- Ursula Franklin — technology as structure -- Virginia Woolf — architecture as metaphor - -## 🛡 Federated Ethics - -This project upholds: -- Solidarity over centralization -- Federation over capture -- Declaration over default - -## 🤝 Societal Touchpoints - -Relevant to: -- Journalism -- Education -- Federated identity -- Consent tech -- Whistleblowing systems - ---- - -Refusal is not resistance — it's the shaping of space. diff --git a/consent-aware-http/docs/example-aibdp.json b/consent-aware-http/docs/example-aibdp.json deleted file mode 100644 index a02f492a..00000000 --- a/consent-aware-http/docs/example-aibdp.json +++ /dev/null @@ -1,9 +0,0 @@ -{ - "aibdp_version": "0.1", - "contact": "mailto:jonathan@metadatastician.art", - "training": "refused", - "regeneration": "refused", - "indexing": "allowed", - "summary": "This site respects boundaries. Generative reuse not permitted.", - "_comment": "AI Boundary Declaration Protocol manifest template for adoption." -} \ No newline at end of file diff --git a/consent-aware-http/docs/explainer.md b/consent-aware-http/docs/explainer.md deleted file mode 100644 index bb7ec8d0..00000000 --- a/consent-aware-http/docs/explainer.md +++ /dev/null @@ -1,48 +0,0 @@ - ---- - -### 📄 `explainer.md` - -```markdown -# Architectural Overview — Why Consent-Aware Protocols Matter - -This is not just a spec. It's a cultural tool. - -## 🔄 Problem - -AI systems ingest public content without declaring scope or requesting consent. This erodes: - -- Authorship intent -- Procedural boundary -- Ethical accountability - -## 🧭 Our Response - -**HTTP 430 + AIBDP** introduce: - -- Declarative refusal using existing web semantics -- Manifest-based boundaries for AI-specific engagement -- Protocol clarity without legal bloat - -## 🪧 Cultural Roots - -Inspired by: - -- bell hooks — boundary as dignity -- Woolf — architectural refusal -- Journalism — the right to decline co-option -- IndieWeb — federated publishing and self-authorship - -## 🧬 Adoption Possibilities - -- Personal domains -- Union archives -- CDN layers -- Academic repositories -- Web frameworks - -AIBDP is not anti-AI — it’s pro-boundary. - ---- - -_“Without refusal, permission is meaningless.”_ diff --git a/consent-aware-http/docs/faq.md b/consent-aware-http/docs/faq.md deleted file mode 100644 index aaaa7e1b..00000000 --- a/consent-aware-http/docs/faq.md +++ /dev/null @@ -1,704 +0,0 @@ -# Frequently Asked Questions (FAQ) - -Comprehensive answers to questions about HTTP 430 (Consent Required) and AIBDP (AI Boundary Declaration Protocol). - -## Table of Contents - -- [General Concepts](#general-concepts) -- [HTTP 430 Status Code](#http-430-status-code) -- [AIBDP Manifest](#aibdp-manifest) -- [Implementation](#implementation) -- [Legal and Ethical](#legal-and-ethical) -- [Technical Details](#technical-details) -- [Adoption and Deployment](#adoption-and-deployment) -- [Troubleshooting](#troubleshooting) - ---- - -## General Concepts - -### What is consent-aware HTTP infrastructure? - -Consent-aware HTTP infrastructure is a set of web protocols that enable content publishers to declare boundaries for AI usage and enforce those boundaries through standard HTTP mechanisms. It consists of: - -1. **HTTP 430 (Consent Required)** - A new HTTP status code for rejecting requests when AI consent requirements are not met -2. **AIBDP** - A manifest format for declaring AI usage boundaries at `/.well-known/aibdp.json` - -Together, these provide a standardized way to say "no" to unauthorized AI use while maintaining web openness for legitimate access. - -### Why is this needed? Doesn't robots.txt already do this? - -robots.txt was designed for web crawlers in the 1990s and has significant limitations for modern AI: - -- **robots.txt** controls crawling and indexing -- **AIBDP** controls AI-specific uses like training, generation, fine-tuning, and commercial exploitation - -robots.txt can't distinguish between "index my content for search" and "train your LLM on my content." AIBDP fills this gap with granular policy declarations. - -### Is this anti-AI? - -**No.** This is **pro-boundary**. The protocols enable: - -- **Allowed**: "Yes, you may use my content for search indexing" -- **Conditional**: "Yes, but only with attribution and for non-commercial purposes" -- **Refused**: "No, training on my creative work is not permitted" -- **Encouraged**: "Yes, I actively support AI fine-tuning for accessibility tools" - -Many implementers will allow or encourage AI use. The point is **procedural clarity** and **consent**, not blanket prohibition. - -### What's the philosophical foundation? - -This project draws on: - -- **bell hooks**: "Boundary is where meaning begins" - boundary-setting as care and dignity -- **Virginia Woolf**: Architectural refusal as a form of self-determination -- **Journalism ethics**: The right to decline co-option without justification -- **IndieWeb principles**: Self-sovereignty and federated control - -"Without refusal, permission is meaningless." - -### Who created this? - -Jonathan D.A. Jewell, NEC PRC Representative and NUJ Ethics Council member, with input from journalism ethics communities, IndieWeb participants, and federated web advocates. - ---- - -## HTTP 430 Status Code - -### What is HTTP 430? - -HTTP 430 (Consent Required) is a proposed HTTP status code that servers use to reject requests when AI-specific consent requirements declared in an AIBDP manifest are not satisfied. - -Example response: - -```http -HTTP/1.1 430 Consent Required -Link: <https://example.org/.well-known/aibdp.json>; rel="blocked-by-consent" -Retry-After: 86400 - -{ - "error": "AI usage boundaries not satisfied", - "manifest": "https://example.org/.well-known/aibdp.json" -} -``` - -### How is 430 different from 403 (Forbidden)? - -| Code | Meaning | Use Case | -|------|---------|----------| -| **403** | Forbidden | General authorization failure | -| **428** | Precondition Required | Missing required headers | -| **451** | Legal | Content blocked for legal reasons (court orders) | -| **430** | Consent Required | AI consent boundaries violated | - -430 provides **procedural clarity**: "Your AI agent violated declared boundaries. See manifest for details." - -### Is HTTP 430 an official standard? - -Not yet. It's defined in `draft-jewell-http-430-consent-required-00`, an Internet-Draft intended for IETF submission. It follows RFC processes for new HTTP status codes. - -### Can I use HTTP 430 today? - -**Yes.** While not yet standardized, HTTP allows custom status codes in the 4xx range. Many implementers are using 430 now to: - -1. Signal intent to AI system operators -2. Generate public discussion -3. Demonstrate demand for standardization -4. Establish prior art for IETF submission - -### What if AI systems ignore HTTP 430? - -HTTP 430 is **declarative**, not **enforcement**. It provides: - -- **Procedural clarity**: Clear signal of boundary violation -- **Good-faith compliance**: Responsible AI operators respect it -- **Legal foundation**: Documented evidence of non-consent -- **Reputational pressure**: Public violations harm AI system credibility - -Physical enforcement requires additional measures (authentication, rate limiting, legal action). - ---- - -## AIBDP Manifest - -### What is an AIBDP manifest? - -An AIBDP (AI Boundary Declaration Protocol) manifest is a JSON file hosted at `/.well-known/aibdp.json` that declares what AI uses are allowed, refused, conditional, or encouraged for a website's content. - -### What does a minimal manifest look like? - -```json -{ - "aibdp_version": "0.2", - "contact": "mailto:policy@example.org", - "policies": { - "training": { "status": "refused" }, - "indexing": { "status": "allowed" } - } -} -``` - -### What policy types can I declare? - -- **training**: Use for AI model training -- **indexing**: Building searchable indices -- **summarization**: Generating summaries -- **question_answering**: RAG systems answering queries -- **generation**: Synthetic content creation -- **fine_tuning**: Specialized model adaptation -- **embedding**: Creating vector representations -- **commercial_training**: Training commercial AI products - -You can also define custom policies. - -### What are the policy status values? - -- **allowed**: Usage permitted without conditions -- **refused**: Usage explicitly prohibited -- **conditional**: Usage permitted if conditions are met -- **encouraged**: Usage actively welcomed - -### Can I have different policies for different parts of my site? - -**Yes!** Use the `scope` field: - -```json -{ - "policies": { - "training": { - "status": "conditional", - "conditions": ["Attribution required"], - "scope": ["/blog/**", "/articles/**"], - "exceptions": [ - { - "path": "/public/**", - "status": "allowed" - } - ] - } - } -} -``` - -### How do I specify conditions? - -Use the `conditions` array: - -```json -{ - "training": { - "status": "conditional", - "conditions": [ - "Attribution required to 'Example Org'", - "Non-commercial use only", - "Preserve context and citations" - ] - } -} -``` - -AI systems can check these via consent headers (e.g., `AI-Consent-Conditions: attribution,non-commercial`). - -### Where should I host the manifest? - -**Required location**: `/.well-known/aibdp.json` - -This follows RFC 8615 (Well-Known URIs) convention used by security.txt, robots.txt equivalents, and other metadata files. - -### Can I use a CDN or different domain? - -**Yes**, use `canonical_uri`: - -```json -{ - "canonical_uri": "https://origin.example.org/.well-known/aibdp.json", - ... -} -``` - -AI systems should fetch the canonical version for authoritative policy. - -### How do I validate my manifest? - -Use the JSON Schema: - -```bash -# Node.js (ajv-cli) -npm install -g ajv-cli -ajv validate -s schemas/aibdp-schema-v0.2.json -d .well-known/aibdp.json - -# Python (jsonschema) -python -c " -import json -import jsonschema -with open('schemas/aibdp-schema-v0.2.json') as f: - schema = json.load(f) -with open('.well-known/aibdp.json') as f: - manifest = json.load(f) -jsonschema.validate(manifest, schema) -print('Valid!') -" -``` - -Or use the reference implementation validators (Node.js, Python). - -### Should I sign my manifest cryptographically? - -**Recommended for high-value content**. AIBDP supports COSE signatures (RFC 9052): - -```json -{ - "signature": { - "algorithm": "ES256", - "public_key_uri": "https://example.org/.well-known/aibdp-key.jwk", - "value": "base64-encoded-signature" - } -} -``` - -This prevents intermediary tampering (CDNs, proxies) and enables audit trails. - ---- - -## Implementation - -### How do I add AIBDP to my website? - -**4 steps:** - -1. **Create manifest** at `.well-known/aibdp.json` -2. **Configure server** to serve it with `Content-Type: application/aibdp+json` -3. **Add enforcement** (optional): Block AI bots with HTTP 430 -4. **Test** with `curl` and AI user-agents - -See [server-configurations.md](server-configurations.md) for nginx, Apache, Caddy, Cloudflare, etc. - -### Do I need to write code? - -**No.** Server configuration (nginx, Apache) is often sufficient: - -```nginx -# nginx example -location = /.well-known/aibdp.json { - add_header Content-Type application/aibdp+json; -} - -# Block AI training bots -map $http_user_agent $is_ai_bot { - ~*GPTBot 1; -} - -if ($is_ai_bot) { - return 430; -} -``` - -For advanced enforcement, use middleware (Node.js, Python available). - -### What if I use WordPress/Ghost/Jekyll? - -- **WordPress**: Install a plugin or add to `.htaccess` -- **Ghost**: Add to nginx config or use middleware -- **Jekyll/Hugo**: Include manifest in static files, configure via Netlify/Vercel - -See [server-configurations.md](server-configurations.md) for platform-specific guides. - -### How do I detect AI bots? - -Check `User-Agent` header: - -- GPTBot (OpenAI) -- ChatGPT-User -- Claude-Web (Anthropic) -- Google-Extended -- CCBot (Common Crawl) -- PerplexityBot -- Diffbot - -Reference implementations include comprehensive detection patterns. - -### Can AI systems lie about their User-Agent? - -**Yes.** This is a limitation of all HTTP-based detection (including robots.txt). - -Mitigation strategies: -- Request patterns (high-volume sequential access) -- Require AI systems to send consent headers -- Cryptographic client authentication -- Legal/reputational consequences for deception - -AIBDP establishes **procedural clarity**, not foolproof enforcement. - -### What about AI systems that don't identify themselves? - -AIBDP is a **good-faith protocol** for responsible AI operators. Non-compliant systems face: - -- **Reputational damage**: Public disclosure of violations -- **Legal consequences**: AIBDP provides documented non-consent -- **Community pressure**: Ethical AI community standards - -Perfect technical enforcement is impossible, but procedural clarity matters. - ---- - -## Legal and Ethical - -### Is AIBDP legally binding? - -AIBDP itself is a **declaration protocol**, not a law. Legal effect depends on jurisdiction and applicable law: - -- **Copyright**: Manifests document non-consent for training (relevant to fair use analysis) -- **Contract**: Manifests may form part of terms of service -- **Common law**: Establishes lack of implied license -- **Reputation**: Violations documented for public disclosure - -Consult a lawyer for specific legal advice. - -### Does this work with GDPR/privacy laws? - -**Complementary.** AIBDP focuses on **content usage boundaries**, while GDPR focuses on **personal data protection**. - -- GDPR: Protects individuals' personal data (PII) -- AIBDP: Protects content from unauthorized AI use (training, generation) - -Both can apply simultaneously (e.g., healthcare website). - -### What about copyright and fair use? - -AIBDP **documents** your position on AI use, which may be relevant to fair use analysis: - -**Fair use factors** (US): -1. Purpose and character (commercial?) -2. Nature of copyrighted work (creative?) -3. Amount used (whole corpus?) -4. Market effect (substitute for original?) - -AIBDP manifest provides evidence that: -- You did NOT grant implied license -- You declared boundaries explicitly -- Commercial AI training may harm your market - -Courts will decide, but documentation helps. - -### Can I charge for AI training access? - -**Yes.** Use `conditional` status: - -```json -{ - "commercial_training": { - "status": "conditional", - "conditions": [ - "Licensing agreement required", - "Contact legal@example.org for terms" - ] - } -} -``` - -AIBDP supports **licensing models**, not just prohibition. - -### Is this compatible with Creative Commons licenses? - -**Yes.** AIBDP and CC licenses work together: - -```json -{ - "policies": { - "training": { - "status": "allowed", - "conditions": [ - "Respect CC BY-SA 4.0 license terms", - "Preserve attribution", - "Share-alike applies to derivatives" - ] - } - }, - "metadata": { - "license": "CC BY-SA 4.0" - } -} -``` - -AIBDP provides **AI-specific** guidance within your broader licensing framework. - ---- - -## Technical Details - -### What's the relationship to robots.txt? - -**Complementary:** - -| Feature | robots.txt | AIBDP | -|---------|-----------|-------| -| **Purpose** | Crawling control | AI usage boundaries | -| **Granularity** | Path-based | Purpose-based (training, generation, etc.) | -| **Format** | Text | JSON | -| **AI-specific** | No | Yes | -| **Conditional** | No | Yes (status: conditional) | - -**Use both:** -- robots.txt: Control indexing -- AIBDP: Control AI training/generation - -### How does path scoping work? - -Glob-style patterns: - -- `/articles/**` - All files under /articles/ -- `*.pdf` - All PDF files -- `/docs/public/**` - Subdirectory matching -- `all` - Entire site - -Example: - -```json -{ - "training": { - "status": "refused", - "scope": ["/blog/**", "/articles/**"] - } -} -``` - -### What Content-Type should I use? - -```http -Content-Type: application/aibdp+json -``` - -This is the IANA-registered media type for AIBDP manifests (pending registration). - -### Should I cache the manifest? - -**Yes.** Set appropriate headers: - -```http -Cache-Control: public, max-age=3600 -``` - -AI systems should cache for the duration specified in `expires` field or 1 hour default. - -### Can I have multiple manifests for different subdomains? - -**Yes.** Each domain/subdomain can have its own manifest: - -- `https://example.org/.well-known/aibdp.json` -- `https://blog.example.org/.well-known/aibdp.json` - -Or use `canonical_uri` to share a single policy. - -### How do I handle CDN caching? - -**Option 1**: Set `canonical_uri` to origin: - -```json -{ - "canonical_uri": "https://origin.example.org/.well-known/aibdp.json" -} -``` - -**Option 2**: Sign manifest cryptographically (COSE) to ensure integrity through CDN. - -### What about Cloudflare/AWS CloudFront? - -See [server-configurations.md](server-configurations.md) for: - -- Cloudflare Workers enforcement -- AWS Lambda@Edge implementation -- CloudFront distribution configuration - ---- - -## Adoption and Deployment - -### Should I adopt this now or wait for standardization? - -**Adopt now** if: -- You want to declare AI boundaries immediately -- You're comfortable with emerging standards -- You want to influence standardization process - -**Wait** if: -- You need IETF-approved standards only -- Your organization has strict policy requirements -- You prefer mature, widely-adopted protocols - -Many sites are adopting now to establish boundaries and demonstrate demand. - -### Who else is using this? - -(As of July 2025, this is a new protocol. Early adopters will be listed at [https://consent-aware-http.org/adopters](https://consent-aware-http.org/adopters)) - -**Target adopters:** -- Personal blogs and creative portfolios -- News organizations (journalism ethics alignment) -- Academic repositories -- IndieWeb participants -- Federated platforms (Mastodon, etc.) - -### How do I announce my adoption? - -1. Add manifest to your site -2. Publish a blog post explaining your AI policy -3. Tag social media with #AIBDP #ConsentAwareHTTP -4. Consider adding a badge (see `assets/badges/`) -5. Submit your site to adopters list - -### What if I change my mind about my policies? - -**Update your manifest.** AI systems should re-fetch when: - -- `expires` field timestamp passes -- They receive HTTP 430 with updated `Link` header -- Regular periodic checks (default: daily) - -Versioning is supported via `aibdp_version` field. - -### Can I use this with a paywalled site? - -**Yes.** AIBDP works with authenticated content: - -```json -{ - "policies": { - "training": { - "status": "refused", - "rationale": "Subscription content - training undermines our business model" - }, - "indexing": { - "status": "conditional", - "conditions": ["Respect paywall", "Index headlines and summaries only"] - } - } -} -``` - -### How do I migrate from robots.txt-only? - -**Keep both:** - -1. Keep existing robots.txt for crawler control -2. Add AIBDP manifest for AI-specific boundaries -3. Ensure policies are consistent -4. Update over time as you refine boundaries - ---- - -## Troubleshooting - -### My manifest isn't being fetched. What's wrong? - -**Check:** - -1. **Location**: Must be exactly `/.well-known/aibdp.json` -2. **Permissions**: File must be readable by web server (644 or 755) -3. **Directory exists**: `.well-known/` directory must exist -4. **Server config**: Not blocked by nginx/Apache rules -5. **HTTPS**: Some AI systems require HTTPS - -**Test:** -```bash -curl https://your-site.com/.well-known/aibdp.json -``` - -### AI bots are still accessing my site despite HTTP 430 - -**Remember:** AIBDP is **declarative**, not **enforcement**. Options: - -1. **Contact AI operator**: Report violation via manifest `contact` field -2. **Public disclosure**: Document violation publicly -3. **Legal action**: If applicable in your jurisdiction -4. **Stronger blocking**: IP blocking, rate limiting, authentication - -### My manifest validator says it's invalid - -**Common issues:** - -- **JSON syntax errors**: Use `jq .` to validate JSON -- **Missing required fields**: `aibdp_version`, `contact`, `policies` are required -- **Invalid status values**: Must be `allowed`, `refused`, `conditional`, or `encouraged` -- **Malformed URIs**: `contact`, `canonical_uri`, `policy_uri` must be valid URIs - -Run through JSON Schema validator for detailed errors. - -### How do I know if AI systems are respecting my boundaries? - -**Monitoring:** - -1. **Server logs**: Track User-Agent patterns and HTTP 430 responses -2. **Analytics**: Monitor bot traffic and blocked requests -3. **Community reports**: Other sites may report violations -4. **Public disclosure**: Some AI operators publish training data sources - -Perfect monitoring is impossible, but violations can be documented. - -### What if I accidentally set too-restrictive policies? - -**Update manifest immediately:** - -1. Edit `.well-known/aibdp.json` -2. Update `expires` field to force re-fetch -3. Announce change if relevant -4. AI systems should pick up new policy on next check - -### Can I test my setup locally? - -**Yes:** - -```bash -# Test manifest accessibility -curl http://localhost:3000/.well-known/aibdp.json - -# Test AI bot blocking -curl http://localhost:3000/articles/ -H "User-Agent: GPTBot/1.0" - -# Should return HTTP 430 - -# Test normal access -curl http://localhost:3000/ -H "User-Agent: Mozilla/5.0" - -# Should return HTTP 200 -``` - -See reference implementations (Node.js, Python) for local testing. - ---- - -## Getting Help - -### Where can I ask questions? - -- **GitHub Discussions**: https://github.com/Hyperpolymath/consent-aware-http/discussions -- **Issues**: https://github.com/Hyperpolymath/consent-aware-http/issues -- **Email**: jonathan@metadatastician.art - -### Where can I find more information? - -- **Technical guide**: [technical.md](technical.md) -- **Server configs**: [server-configurations.md](server-configurations.md) -- **Examples**: [manifest-scenarios/](../examples/manifest-scenarios/) -- **Ethics**: [ethics.md](ethics.md) -- **IETF Drafts**: - - [draft-jewell-http-430-consent-required-00](../draft-jewell-http-430-consent-required-00.xml) - - [draft-jewell-aibdp-00](../drafts/draft-jewell-aibdp-00.xml) - -### How can I contribute? - -See [CONTRIBUTING.md](../.github/CONTRIBUTING.md). - -Contributions welcome: -- Documentation improvements -- Implementation examples -- Adoption stories -- Bug reports -- Feature proposals - ---- - -_"Boundary is where meaning begins." - bell hooks_ - -**Last updated**: 2025-07-20 -**AIBDP version**: 0.2 -**HTTP 430 draft**: 00 diff --git a/consent-aware-http/docs/governance.md b/consent-aware-http/docs/governance.md deleted file mode 100644 index 7836940c..00000000 --- a/consent-aware-http/docs/governance.md +++ /dev/null @@ -1,34 +0,0 @@ -# Governance Implications — Consent in Institutional Systems - -## 📰 Journalism + Union Frameworks - -AIBDP can support: -- Editorial boundaries -- Memory preservation -- Consent protocols for archive access - -## 🧩 Organizational Integration - -Use manifest layering to: -- Declare content rules -- Signal refusal across federated platforms -- Preserve ethical perimeter - -## 🏛 Policy Threads - -Aligned with: -- Whistleblowing frameworks -- Safeguarding protocols -- Privacy signaling -- Consent-aware data architecture - -## 🔄 Strategic Applications - -- Server integration -- Committee policies -- Public publishing standards -- Educational outreach - ---- - -Boundary isn’t only technical. It’s procedural governance. diff --git a/consent-aware-http/docs/references.md b/consent-aware-http/docs/references.md deleted file mode 100644 index 4dcad48f..00000000 --- a/consent-aware-http/docs/references.md +++ /dev/null @@ -1,33 +0,0 @@ - ---- - -### 📄 `references.md` - -```markdown -# References and Influences - -## Protocol Standards - -- IETF HTTP specs -- RFC 8615 — `.well-known/` paths -- IndieWeb POSSE patterns -- Fediverse federation layers - -## Philosophical Sources - -- bell hooks — _Teaching to Transgress_, _All About Love_ -- Virginia Woolf — _The Waves_, _A Room of One’s Own_ -- Ursula Franklin — _The Real World of Technology_ -- Audre Lorde — "The master’s tools will never dismantle the master's house" -- Sinople editorials (https://sinople.pub) - -## Implementation Inspiration - -- GitHub’s community templates -- Robots.txt conventions -- GDPR + Data minimization -- Consent tech projects - ---- - -_We cite the voices that shaped this space. Dignity begins with acknowledgement._ diff --git a/consent-aware-http/docs/server-configurations.md b/consent-aware-http/docs/server-configurations.md deleted file mode 100644 index df6fe7d2..00000000 --- a/consent-aware-http/docs/server-configurations.md +++ /dev/null @@ -1,846 +0,0 @@ -# Server Configuration Guides for HTTP 430 + AIBDP - -Comprehensive guide for implementing consent-aware HTTP infrastructure across popular web servers and platforms. - -## Table of Contents - -- [nginx](#nginx) -- [Apache](#apache) -- [Caddy](#caddy) -- [Cloudflare Workers](#cloudflare-workers) -- [AWS CloudFront](#aws-cloudfront) -- [Vercel](#vercel) -- [Netlify](#netlify) -- [Testing Your Configuration](#testing-your-configuration) - ---- - -## nginx - -### Basic Configuration - -Add AIBDP manifest serving and HTTP 430 enforcement to your nginx configuration. - -#### Serve AIBDP Manifest - -```nginx -# Serve .well-known/aibdp.json -location = /.well-known/aibdp.json { - root /var/www/html; - add_header Content-Type application/aibdp+json; - add_header Cache-Control "public, max-age=3600"; - add_header Access-Control-Allow-Origin "*"; -} -``` - -#### Block AI Bots Based on User-Agent - -```nginx -# Map AI user-agents to a flag -map $http_user_agent $is_ai_bot { - default 0; - ~*GPTBot 1; - ~*ChatGPT-User 1; - ~*Claude-Web 1; - ~*anthropic-ai 1; - ~*Google-Extended 1; - ~*CCBot 1; - ~*PerplexityBot 1; - ~*Diffbot 1; -} - -# In your server block -server { - listen 80; - server_name example.org; - - # Block AI bots with HTTP 430 - if ($is_ai_bot = 1) { - return 430; - } - - # Serve AIBDP manifest - location = /.well-known/aibdp.json { - root /var/www/html; - add_header Content-Type application/aibdp+json; - add_header Cache-Control "public, max-age=3600"; - } - - # Your normal locations - location / { - root /var/www/html; - index index.html; - } -} -``` - -#### Custom HTTP 430 Error Page - -```nginx -# Define custom error page for 430 -error_page 430 /430.json; - -location = /430.json { - internal; - default_type application/json; - add_header Link '<https://example.org/.well-known/aibdp.json>; rel="blocked-by-consent"'; - add_header Retry-After 86400; - return 430 '{ - "error": "AI usage boundaries declared in AIBDP manifest not satisfied", - "manifest": "https://example.org/.well-known/aibdp.json", - "contact": "mailto:policy@example.org" - }'; -} -``` - -#### Path-Specific Protection - -```nginx -# Protect /articles/ from AI training bots -location /articles/ { - if ($is_ai_bot = 1) { - return 430; - } - root /var/www/html; -} - -# Allow AI bots in /public/ -location /public/ { - root /var/www/html; -} -``` - -#### Complete nginx Example - -```nginx -# /etc/nginx/nginx.conf or /etc/nginx/sites-available/example.org - -# AI bot detection map -map $http_user_agent $is_ai_bot { - default 0; - ~*GPTBot 1; - ~*ChatGPT-User 1; - ~*Claude-Web 1; - ~*anthropic-ai 1; - ~*Google-Extended 1; - ~*CCBot 1; - ~*Googlebot-Extended 1; - ~*PerplexityBot 1; - ~*Diffbot 1; - ~*Omgilibot 1; -} - -server { - listen 80; - listen [::]:80; - server_name example.org; - - root /var/www/html; - index index.html; - - # Serve AIBDP manifest - location = /.well-known/aibdp.json { - add_header Content-Type application/aibdp+json; - add_header Cache-Control "public, max-age=3600"; - add_header Access-Control-Allow-Origin "*"; - } - - # Custom 430 error page - error_page 430 /430.json; - location = /430.json { - internal; - default_type application/json; - add_header Link '<https://example.org/.well-known/aibdp.json>; rel="blocked-by-consent"'; - add_header Retry-After 86400; - return 430 '{ - "error": "AI usage boundaries declared in AIBDP manifest not satisfied", - "manifest": "https://example.org/.well-known/aibdp.json", - "violated_policy": "training", - "policy_status": "refused", - "contact": "mailto:policy@example.org" - }'; - } - - # Protect articles from AI bots - location /articles/ { - if ($is_ai_bot = 1) { - return 430; - } - } - - # Allow all access to public content - location / { - try_files $uri $uri/ =404; - } -} -``` - -### Testing nginx Configuration - -```bash -# Test configuration -sudo nginx -t - -# Reload nginx -sudo nginx -s reload - -# Test with curl -curl http://example.org/ -H "User-Agent: GPTBot/1.0" -``` - ---- - -## Apache - -### Basic Configuration - -Add AIBDP enforcement to Apache using `.htaccess` or VirtualHost configuration. - -#### .htaccess Method - -Create `/var/www/html/.htaccess`: - -```apache -# Serve AIBDP manifest -<Files "aibdp.json"> - Header set Content-Type "application/aibdp+json" - Header set Cache-Control "public, max-age=3600" - Header set Access-Control-Allow-Origin "*" -</Files> - -# Block AI bots with HTTP 430 -RewriteEngine On -RewriteCond %{HTTP_USER_AGENT} (GPTBot|ChatGPT-User|Claude-Web|anthropic-ai|Google-Extended|CCBot|PerplexityBot|Diffbot) [NC] -RewriteRule ^ - [R=430,L] - -# Custom 430 error document -ErrorDocument 430 /430.json -``` - -#### VirtualHost Configuration - -```apache -# /etc/apache2/sites-available/example.org.conf - -<VirtualHost *:80> - ServerName example.org - DocumentRoot /var/www/html - - # Enable rewrite engine - RewriteEngine On - - # Serve AIBDP manifest - <Location "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/.well-known/aibdp.json"> - Header set Content-Type "application/aibdp+json" - Header set Cache-Control "public, max-age=3600" - Header set Access-Control-Allow-Origin "*" - </Location> - - # Block AI bots - RewriteCond %{HTTP_USER_AGENT} (GPTBot|ChatGPT-User|Claude-Web|anthropic-ai|Google-Extended|CCBot|PerplexityBot|Diffbot) [NC] - RewriteRule ^/articles/ - [R=430,L] - - # Custom 430 error page - ErrorDocument 430 /430.json - - <Directory /var/www/html> - AllowOverride All - Require all granted - </Directory> -</VirtualHost> -``` - -#### Custom 430 Response - -Create `/var/www/html/430.json`: - -```json -{ - "error": "AI usage boundaries declared in AIBDP manifest not satisfied", - "manifest": "https://example.org/.well-known/aibdp.json", - "violated_policy": "training", - "policy_status": "refused", - "contact": "mailto:policy@example.org" -} -``` - -#### Path-Specific Protection - -```apache -# Protect /articles/ only -<Location "/articles/"> - RewriteEngine On - RewriteCond %{HTTP_USER_AGENT} (GPTBot|ChatGPT-User|Claude-Web) [NC] - RewriteRule ^ - [R=430,L] -</Location> - -# Allow AI bots in /public/ -<Location "/public/"> - # No restrictions -</Location> -``` - -### Required Apache Modules - -```bash -# Enable required modules -sudo a2enmod rewrite -sudo a2enmod headers - -# Restart Apache -sudo systemctl restart apache2 -``` - ---- - -## Caddy - -Caddy has a simpler configuration syntax and built-in HTTPS. - -### Caddyfile Configuration - -```caddy -# /etc/caddy/Caddyfile - -example.org { - # Serve AIBDP manifest - handle /.well-known/aibdp.json { - header Content-Type application/aibdp+json - header Cache-Control "public, max-age=3600" - header Access-Control-Allow-Origin * - root * /var/www/html - file_server - } - - # Block AI bots from /articles/ - @ai_bots { - header_regexp User-Agent (GPTBot|ChatGPT-User|Claude-Web|anthropic-ai|Google-Extended|CCBot|PerplexityBot|Diffbot) - path /articles/* - } - - handle @ai_bots { - header Link <https://example.org/.well-known/aibdp.json>; rel="blocked-by-consent" - header Retry-After 86400 - respond `{ - "error": "AI usage boundaries declared in AIBDP manifest not satisfied", - "manifest": "https://example.org/.well-known/aibdp.json", - "violated_policy": "training", - "policy_status": "refused", - "contact": "mailto:policy@example.org" - }` 430 { - header Content-Type application/json - } - } - - # Default file server - root * /var/www/html - file_server -} -``` - -### Advanced Caddy Configuration - -```caddy -example.org { - # AIBDP manifest - handle /.well-known/aibdp.json { - header Content-Type application/aibdp+json - header Cache-Control "public, max-age=3600" - root * /var/www/html - file_server - } - - # AI bot matcher - @ai_training { - header_regexp User-Agent (GPTBot|Google-Extended|CCBot) - } - - @ai_indexing { - header_regexp User-Agent (Googlebot|Bingbot|DuckDuckBot) - } - - # Block AI training bots everywhere except /public/ - @ai_training_blocked { - header_regexp User-Agent (GPTBot|Google-Extended|CCBot) - not path /public/* - } - - handle @ai_training_blocked { - respond `{"error": "Training refused"}` 430 { - header Content-Type application/json - header Link <https://example.org/.well-known/aibdp.json>; rel="blocked-by-consent" - } - } - - # Allow indexing bots (no 430) - handle @ai_indexing { - root * /var/www/html - file_server - } - - # Default - root * /var/www/html - file_server -} -``` - -### Reload Caddy - -```bash -# Validate configuration -caddy validate --config /etc/caddy/Caddyfile - -# Reload -caddy reload --config /etc/caddy/Caddyfile -``` - ---- - -## Cloudflare Workers - -Deploy AIBDP enforcement at the edge with Cloudflare Workers. - -### Worker Script - -```javascript -// worker.js - Deploy as Cloudflare Worker - -const AIBDP_MANIFEST_URL = 'https://example.org/.well-known/aibdp.json'; - -const AI_USER_AGENTS = [ - /GPTBot/i, - /ChatGPT-User/i, - /Claude-Web/i, - /anthropic-ai/i, - /Google-Extended/i, - /CCBot/i, - /PerplexityBot/i, - /Diffbot/i, -]; - -function isAIBot(userAgent) { - return AI_USER_AGENTS.some(pattern => pattern.test(userAgent)); -} - -function create430Response() { - const body = { - error: 'AI usage boundaries declared in AIBDP manifest not satisfied', - manifest: AIBDP_MANIFEST_URL, - violated_policy: 'training', - policy_status: 'refused', - contact: 'mailto:policy@example.org' - }; - - return new Response(JSON.stringify(body), { - status: 430, - headers: { - 'Content-Type': 'application/json', - 'Link': `<${AIBDP_MANIFEST_URL}>; rel="blocked-by-consent"`, - 'Retry-After': '86400' - } - }); -} - -addEventListener('fetch', event => { - event.respondWith(handleRequest(event.request)); -}); - -async function handleRequest(request) { - const url = new URL(request.url); - const userAgent = request.headers.get('User-Agent') || ''; - - // Serve AIBDP manifest - if (url.pathname === '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/.well-known/aibdp.json') { - return fetch(request); - } - - // Detect AI bots - if (isAIBot(userAgent)) { - // Block from /articles/ path - if (url.pathname.startsWith('/articles/')) { - return create430Response(); - } - } - - // Pass through to origin - return fetch(request); -} -``` - -### Deploy Worker - -```bash -# Install Wrangler CLI -npm install -g wrangler - -# Login to Cloudflare -wrangler login - -# Initialize project -wrangler init aibdp-worker - -# Deploy -wrangler publish -``` - -### wrangler.toml Configuration - -```toml -name = "aibdp-worker" -type = "javascript" -account_id = "your-account-id" -workers_dev = true -route = "example.org/*" -zone_id = "your-zone-id" - -[build] -command = "" - -[build.upload] -format = "service-worker" -``` - ---- - -## AWS CloudFront - -Use Lambda@Edge to enforce AIBDP at CloudFront distribution. - -### Lambda@Edge Function - -```javascript -// index.js - Deploy as Lambda@Edge (Viewer Request) - -const AI_USER_AGENTS = [ - /GPTBot/i, - /ChatGPT-User/i, - /Claude-Web/i, - /anthropic-ai/i, - /Google-Extended/i, -]; - -exports.handler = async (event) => { - const request = event.Records[0].cf.request; - const headers = request.headers; - const uri = request.uri; - - // Serve AIBDP manifest - if (uri === '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/.well-known/aibdp.json') { - return request; - } - - // Check User-Agent - const userAgent = headers['user-agent'] ? headers['user-agent'][0].value : ''; - - // Detect AI bots - const isAIBot = AI_USER_AGENTS.some(pattern => pattern.test(userAgent)); - - if (isAIBot && uri.startsWith('/articles/')) { - const response = { - status: '430', - statusDescription: 'Consent Required', - headers: { - 'content-type': [{ - key: 'Content-Type', - value: 'application/json' - }], - 'link': [{ - key: 'Link', - value: '<https://example.org/.well-known/aibdp.json>; rel="blocked-by-consent"' - }], - 'retry-after': [{ - key: 'Retry-After', - value: '86400' - }] - }, - body: JSON.stringify({ - error: 'AI usage boundaries declared in AIBDP manifest not satisfied', - manifest: 'https://example.org/.well-known/aibdp.json', - violated_policy: 'training', - policy_status: 'refused' - }) - }; - - return response; - } - - return request; -}; -``` - -### Deploy Lambda@Edge - -```bash -# Package function -zip function.zip index.js - -# Create Lambda function (us-east-1 required for Lambda@Edge) -aws lambda create-function \ - --region us-east-1 \ - --function-name aibdp-enforcement \ - --runtime nodejs18.x \ - --role arn:aws:iam::ACCOUNT:role/lambda-edge-role \ - --handler index.handler \ - --zip-file fileb://function.zip \ - --publish - -# Associate with CloudFront distribution -aws cloudfront update-distribution \ - --id DISTRIBUTION_ID \ - --distribution-config file://distribution-config.json -``` - ---- - -## Vercel - -Use Vercel Edge Middleware for AIBDP enforcement. - -### middleware.ts - -```typescript -// middleware.ts in your Next.js project - -import { NextRequest, NextResponse } from 'next/server'; - -const AI_USER_AGENTS = [ - /GPTBot/i, - /ChatGPT-User/i, - /Claude-Web/i, - /anthropic-ai/i, - /Google-Extended/i, -]; - -export function middleware(request: NextRequest) { - const userAgent = request.headers.get('user-agent') || ''; - const pathname = request.nextUrl.pathname; - - // Serve AIBDP manifest - if (pathname === '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/.well-known/aibdp.json') { - return NextResponse.next(); - } - - // Detect AI bots - const isAIBot = AI_USER_AGENTS.some(pattern => pattern.test(userAgent)); - - if (isAIBot && pathname.startsWith('/articles')) { - return new NextResponse( - JSON.stringify({ - error: 'AI usage boundaries declared in AIBDP manifest not satisfied', - manifest: 'https://example.org/.well-known/aibdp.json', - violated_policy: 'training', - policy_status: 'refused' - }), - { - status: 430, - headers: { - 'Content-Type': 'application/json', - 'Link': '<https://example.org/.well-known/aibdp.json>; rel="blocked-by-consent"', - 'Retry-After': '86400' - } - } - ); - } - - return NextResponse.next(); -} - -export const config = { - matcher: [ - '/((?!api|_next/static|_next/image|favicon.ico).*)', - ], -}; -``` - -### Deploy to Vercel - -```bash -# Ensure middleware.ts is in project root -vercel deploy --prod -``` - ---- - -## Netlify - -Use Netlify Edge Functions for AIBDP enforcement. - -### netlify/edge-functions/aibdp.ts - -```typescript -import type { Context } from "https://edge.netlify.com"; - -const AI_USER_AGENTS = [ - /GPTBot/i, - /ChatGPT-User/i, - /Claude-Web/i, - /anthropic-ai/i, - /Google-Extended/i, -]; - -export default async (request: Request, context: Context) => { - const url = new URL(request.url); - const userAgent = request.headers.get('user-agent') || ''; - - // Serve AIBDP manifest - if (url.pathname === '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/.well-known/aibdp.json') { - return context.next(); - } - - // Detect AI bots - const isAIBot = AI_USER_AGENTS.some(pattern => pattern.test(userAgent)); - - if (isAIBot && url.pathname.startsWith('/articles')) { - return new Response( - JSON.stringify({ - error: 'AI usage boundaries declared in AIBDP manifest not satisfied', - manifest: 'https://example.org/.well-known/aibdp.json', - violated_policy: 'training', - policy_status: 'refused' - }), - { - status: 430, - headers: { - 'Content-Type': 'application/json', - 'Link': '<https://example.org/.well-known/aibdp.json>; rel="blocked-by-consent"', - 'Retry-After': '86400' - } - } - ); - } - - return context.next(); -}; - -export const config = { path: "/*" }; -``` - -### Deploy to Netlify - -```bash -# Ensure netlify/edge-functions/aibdp.ts exists -netlify deploy --prod -``` - ---- - -## Testing Your Configuration - -### Manual Testing with curl - -```bash -# Test normal access -curl -I http://example.org/ - -# Test AI bot detection -curl -I http://example.org/articles/test.html -H "User-Agent: GPTBot/1.0" - -# Should return HTTP 430 -# HTTP/1.1 430 Consent Required -# Link: <https://example.org/.well-known/aibdp.json>; rel="blocked-by-consent" -# Retry-After: 86400 - -# Verify AIBDP manifest is served -curl http://example.org/.well-known/aibdp.json -``` - -### Automated Testing Script - -```bash -#!/bin/bash -# test-aibdp.sh - -DOMAIN="https://example.org" - -echo "Testing AIBDP implementation..." - -# Test 1: Manifest accessibility -echo "1. Checking AIBDP manifest..." -STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$DOMAIN/.well-known/aibdp.json") -if [ "$STATUS" -eq 200 ]; then - echo "✅ AIBDP manifest accessible (HTTP 200)" -else - echo "❌ AIBDP manifest NOT accessible (HTTP $STATUS)" -fi - -# Test 2: AI bot blocking -echo "2. Testing AI bot blocking..." -STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$DOMAIN/articles/" -H "User-Agent: GPTBot/1.0") -if [ "$STATUS" -eq 430 ]; then - echo "✅ AI bot blocked correctly (HTTP 430)" -else - echo "❌ AI bot NOT blocked (HTTP $STATUS)" -fi - -# Test 3: Normal access -echo "3. Testing normal access..." -STATUS=$(curl -s -o /dev/null -w "%{http_code}" "$DOMAIN/" -H "User-Agent: Mozilla/5.0") -if [ "$STATUS" -eq 200 ]; then - echo "✅ Normal access works (HTTP 200)" -else - echo "❌ Normal access blocked (HTTP $STATUS)" -fi - -echo "Testing complete!" -``` - -Run with: - -```bash -chmod +x test-aibdp.sh -./test-aibdp.sh -``` - ---- - -## Production Checklist - -- ✅ AIBDP manifest exists at `/.well-known/aibdp.json` -- ✅ Manifest has correct `Content-Type: application/aibdp+json` -- ✅ AI User-Agent detection configured -- ✅ HTTP 430 responses include `Link` header to manifest -- ✅ Custom 430 error page provides clear information -- ✅ Path-specific rules match AIBDP manifest policies -- ✅ HTTPS enabled (recommended for manifest integrity) -- ✅ Testing completed for AI bots and normal users -- ✅ Monitoring/logging configured for 430 responses -- ✅ Contact information in manifest is monitored - ---- - -## Troubleshooting - -### Issue: 430 responses not working - -**Check:** -- User-Agent regex patterns are correct (case-insensitive) -- Server configuration is loaded (restart/reload required) -- Custom status code 430 is recognized by server - -### Issue: AIBDP manifest not accessible - -**Check:** -- File exists at `.well-known/aibdp.json` in document root -- File permissions allow web server to read (644 or 755) -- `.well-known` directory exists and is not blocked - -### Issue: Normal users getting blocked - -**Check:** -- User-Agent detection is not too broad -- Path matching is correct -- No accidental wildcard matches - ---- - -## Standards Compliance - -These configurations implement: - -- [draft-jewell-aibdp-00](https://github.com/Hyperpolymath/consent-aware-http) - AIBDP specification -- [draft-jewell-http-430-consent-required-00](https://github.com/Hyperpolymath/consent-aware-http) - HTTP 430 status code -- [RFC 8615](https://www.rfc-editor.org/info/rfc8615) - Well-Known URIs - ---- - -_"Without refusal, permission is meaningless."_ diff --git a/consent-aware-http/docs/start-here.md b/consent-aware-http/docs/start-here.md deleted file mode 100644 index 3c82ee67..00000000 --- a/consent-aware-http/docs/start-here.md +++ /dev/null @@ -1,74 +0,0 @@ -Quickstart — Make Your Site Consent-Aware - -✅ Step 1: Declare Your Boundary -Create a file at: - -/.well-known/aibdp.json -Add the following content: - -json -{ - "aibdp_version": "0.1", - "contact": "mailto:editor@sinople.pub", - "indexing": "allowed", - "training": "refused", - "regeneration": "refused" -} - -You may include additional fields such as "summary", "policy_url", or "signature" depending on your implementation. - -✅ Step 2: Respond with HTTP 430 -Configure your server to return: - -HTTP/1.1 430 Consent Required -Use this response when: - -The manifest is missing - -The manifest explicitly refuses the declared intent - -AI-related requests do not honor declared boundaries - -You can include a brief message in the body such as: - -Consent manifest unavailable or denied. -See /.well-known/aibdp.json for declared boundaries. - -✅ Step 3: Link Your Policy -Link to your AIBDP manifest for transparency: - -In your site footer - -In robots.txt - -In HTTP headers (e.g. Link: or X-AIBDP-Policy:) - -Example addition to robots.txt: - -# Consent-aware manifest: - -Allow: /.well-known/aibdp.json - -✅ Step 4: Publish with Integrity - -Once your site includes both: - -A valid AIBDP manifest - -Refusal logic via 430 - -You’re ready to adopt the Consent-Aware HTTP protocol. - -Consider adding a badge, a disclaimer, or educational links to help others learn and follow your lead. - -🛡 Maintenance Suggestions - -Validate your manifest with a JSON linter - -Consider adding a JWS or COSE signature - -Check headers using browser dev tools or curl - -Use /docs/technical.md and /docs/conformance.md to go deeper - -Consent isn’t just a checkbox. It’s a perimeter. Declare yours. For full documentation, see: README.md \ No newline at end of file diff --git a/consent-aware-http/docs/technical.md b/consent-aware-http/docs/technical.md deleted file mode 100644 index 7a3ca422..00000000 --- a/consent-aware-http/docs/technical.md +++ /dev/null @@ -1,61 +0,0 @@ -Developer Explainer — Implementing Consent-Aware HTTP -This document helps developers adopt HTTP 430 and AIBDP manifests with clarity and minimal overhead. - -⚙️ HTTP 430: Consent Required -Add logic to your server that returns the following response when AI-specific consent is not granted: - -Status Line & Headers - -HTTP/1.1 430 Consent Required - -Content-Type: text/plain - -Body - -Consent manifest missing or denied. See /.well-known/aibdp.json -Trigger this response under the following conditions: - -No AIBDP manifest is present - -Manifest explicitly refuses your AI use case - -Request is from an agent declared as “AI” and boundary is violated - -🧭 AIBDP Manifest -Place a JSON file at /.well-known/aibdp.json with the following structure: - -json -{ - "aibdp_version": "0.1", - "contact": "mailto:editor@sinople.pub", - "indexing": "allowed", - "training": "refused", - "regeneration": "refused" -} -You may include additional fields such as "summary" or "policy_url" for context. - -🛠 Recommended Request Headers -Agents or infrastructures initiating AI-related requests should include: - -User-Agent: AI-Boundary-Agent/1.0 - -X-AI-Intent: training or regeneration or indexing - -If the declared intent conflicts with the origin’s manifest, return HTTP 430. - -🧪 Tooling Ideas -Developers may wish to build or extend tools that support: - -Manifest validators (syntax and semantics) - -Consent-aware extensions for robots.txt - -Middleware for auto-430 response handling - -Analytics dashboards for refusal types and triggers - -Caching layers for manifest lookups - -COSE/JWS signature verification of manifests (advanced) - -Consent isn't an afterthought. It’s architecture. Implement it with clarity. Refuse with dignity. \ No newline at end of file diff --git a/consent-aware-http/draft-jewell-http-430-consent-required-00.xml b/consent-aware-http/draft-jewell-http-430-consent-required-00.xml deleted file mode 100644 index 1bdc4193..00000000 --- a/consent-aware-http/draft-jewell-http-430-consent-required-00.xml +++ /dev/null @@ -1,124 +0,0 @@ -<?xml version="1.0" encoding="UTF-8"?> -<!DOCTYPE rfc SYSTEM "rfc2629.dtd"> -<rfc xmlns="http://www.rfc-editor.org/rfcmarkup" - category="std" - ipr="trust200902" - docName="draft-jewell-http-430-consent-required-00" - version="3"> - - <front> - <title abbrev="Consent Required">HTTP Status Code 430: Consent Required - - NUJ Ethics Council -
- j.d.a.jewell@open.ac.uk -
- - - - This document defines HTTP status code 430 (Consent Required), used when access to a resource is denied due to the lack of satisfaction of an AI-specific consent declaration. It supports boundary-governance frameworks such as the AI Boundary Declaration Protocol (AIBDP). - - - - -
- Existing HTTP status codes such as 403, 428, and 451 do not sufficiently represent refusals based on declarative AI consent policies. Code 430 enables publishers to signal AI-specific boundaries using manifest protocols like AIBDP. -
- -
- Status Code: 430 - Phrase: Consent Required - The server denies access because the client failed to verify or respect AI-specific consent declarations associated with the requested resource. -
- -
- ; rel="blocked-by-consent" -Retry-After: 86400 - -{ - "error": "Consent declaration missing or invalid.", - "reference": "https://example.org/.well-known/aibdp.json" -} - ]]> -
- -
- - AI agents bypassing declared usage boundaries - Training initiations without manifest verification - CDNs enforcing consent manifests at content gateways - Edge filters applying declarative refusal logic - -
- -
- - - - - - - - - - -
CodeMeaningNotes
403ForbiddenGeneric denial; lacks ingestion context
428Precondition RequiredNot consent-centric
451Unavailable for Legal ReasonsFor legal rulings only
430Consent RequiredSignals declarative consent protocol failure
-
- -
- 430 responses MUST avoid revealing internal decision logic or sensitive metadata. Clients SHOULD treat 430 as procedural refusal and MAY query the manifest for remediation options. Consent manifests SHOULD be cryptographically verifiable using COSE. -
- -
- This document requests registration of HTTP status code 430 (Consent Required) in the HTTP Status Code Registry. -
- -
- - - - Key words for use in RFCs to Indicate Requirement Levels - IETF - - - - - - An HTTP Status Code to Report Legal Obstacles - IETF - - - - - - CBOR Object Signing and Encryption (COSE) - IETF - - - - - - - - - AI Boundary Declaration Protocol - J. D. A. Jewell - - - - -
- - - -
-
- j.d.a.jewell@open.ac.uk - NUJ Ethics Council -
-
- - diff --git a/consent-aware-http/drafts/draft-jewell-aibdp-00.xml b/consent-aware-http/drafts/draft-jewell-aibdp-00.xml deleted file mode 100644 index 71c235f7..00000000 --- a/consent-aware-http/drafts/draft-jewell-aibdp-00.xml +++ /dev/null @@ -1,489 +0,0 @@ - - - - - - AI Boundary Declaration Protocol (AIBDP) - - NUJ Ethics Council -
- j.d.a.jewell@open.ac.uk -
- - - - This document defines the AI Boundary Declaration Protocol (AIBDP), a machine-readable manifest format for declaring acceptable and prohibited uses of content by AI systems. AIBDP enables content originators to express consent boundaries for training, indexing, generation, and other AI engagement modes via a standardized JSON manifest hosted at /.well-known/aibdp.json. It supports enforcement through HTTP status codes such as 430 (Consent Required) and provides a foundation for consent-aware web architecture. - - - - -
- AI systems routinely ingest, process, and regenerate web content without explicit consent from originators. Existing mechanisms like robots.txt were designed for crawling and indexing, not for the nuanced boundaries required in the age of generative AI. AIBDP addresses this gap by providing: - - Declarative consent framework for AI-specific uses (training, generation, summarization, etc.) - Standardized manifest format (JSON) at a well-known URI - Integration with HTTP enforcement mechanisms (e.g., status code 430) - Support for federated and self-sovereign publishing - Optional cryptographic verification (COSE signatures) - - - AIBDP is designed to work alongside existing protocols (robots.txt, HTTP headers, TDM Reservation Protocol) while providing granular control over AI-specific boundary declarations. -
- -
- The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119. - - Additionally, this document uses the following terms: - - Any computational system that processes content for training, inference, generation, or augmentation purposes, including but not limited to large language models (LLMs), computer vision systems, and retrieval-augmented generation (RAG) systems. - The entity publishing content and declaring usage boundaries via AIBDP. - The AIBDP JSON document hosted at /.well-known/aibdp.json. - A declared permission or prohibition for a specific AI usage mode. - The set of resources to which a policy applies (file patterns, paths, etc.). - -
- -
- AIBDP operates through the following mechanism: - - Content originators publish a JSON manifest at /.well-known/aibdp.json - AI systems retrieve and parse the manifest before accessing content - Systems respect declared boundaries or indicate inability to comply - Servers MAY enforce boundaries by responding with HTTP 430 (Consent Required) when violations are detected - Manifests MAY include cryptographic signatures for integrity verification - - -
- AIBDP complements robots.txt rather than replacing it: - - robots.txt controls crawling and indexing behavior - AIBDP declares boundaries for AI-specific uses (training, generation, etc.) - When both exist, AI systems SHOULD honor both - AIBDP provides finer-grained control for modern AI use cases - -
- -
- AI systems SHOULD: - - Fetch /.well-known/aibdp.json before initial content access - Cache manifests according to "expires" field - Respect "canonical_uri" for cross-domain manifests - Re-fetch on HTTP 430 responses with Link header to manifest - -
-
- -
- AIBDP manifests are JSON documents conforming to the following structure: - -
- - String indicating protocol version (e.g., "0.2") - String with contact URI (mailto:, https:, etc.) for policy inquiries - Object containing policy declarations (see Section 4.2) - -
- -
- The "policies" object contains keys for different AI usage modes: - - training: Use of content for model training - indexing: Building searchable indices - summarization: Generating summaries or abstracts - question_answering: RAG systems responding to queries - generation: Synthetic content creation based on corpus - fine_tuning: Specialized model adaptation - embedding: Creating vector representations - commercial_training: Training for commercial AI products - - - Each policy MAY contain: - - REQUIRED. One of: "allowed", "refused", "conditional", "encouraged" - Array of strings describing requirements when status is "conditional" - Array of path patterns this policy applies to - Array of exception objects with path, status, and note - Human-readable explanation of policy - Suggested alternative approaches - -
- -
- - Authoritative location of this manifest - ISO 8601 timestamp when manifest should be re-fetched - Link to human-readable policy document - Object describing what AI systems this manifest addresses - Object with provisions for specific use cases (academic research, education, etc.) - Object describing enforcement mechanisms - Object with authorship, creation date, related standards - COSE signature object for cryptographic verification (see Section 6) - -
- -
- -
-
- -
- Policies MAY specify scope using path patterns: - - Exact paths: "/about.html" - Directory wildcards: "/blog/**" (all files under /blog/) - File patterns: "/docs/*.pdf" - Special value "all" applies to entire domain - - - When multiple policies apply to the same resource, the most restrictive policy SHOULD take precedence unless exceptions are specified. -
- -
- Manifests MAY include a "signature" field containing a COSE (RFC 9052) signature: - - - Ensures manifest integrity and authenticity - Prevents tampering by intermediaries (CDNs, proxies) - Enables audit trails for consent verification - - - AI systems capable of signature verification SHOULD validate signatures when present and reject manifests with invalid signatures. - -
- -
-
- -
- AIBDP is designed to integrate with HTTP enforcement mechanisms: - -
- Servers detecting AIBDP violations SHOULD respond with HTTP 430 (see draft-jewell-http-430-consent-required): - ; rel="blocked-by-consent" -Retry-After: 86400 - -{ - "error": "AI usage boundaries declared in AIBDP manifest not satisfied", - "manifest": "https://example.org/.well-known/aibdp.json", - "violated_policy": "training", - "required_conditions": ["Attribution required", "Non-commercial use only"] -} - ]]> -
- -
- Servers MAY detect AI systems through: - - User-Agent headers (e.g., "GPTBot", "Claude-Web") - Request patterns (high-volume sequential access) - Missing consent headers when required - Client identification via API keys or authentication - -
- -
- AI systems MAY include headers indicating consent compliance: - -
-
- -
- AIBDP supports federated scenarios: - -
- The "canonical_uri" field enables: - - CDN-hosted content pointing to origin manifest - Mirrored sites sharing a single policy - Federated identity systems declaring unified boundaries - - - AI systems encountering "canonical_uri" SHOULD fetch and respect the referenced manifest. -
- -
- Organizations managing multiple domains MAY: - - Host a single canonical manifest referenced by all domains - Use DNS TXT records to indicate manifest location - Employ cryptographic signatures to verify cross-domain authenticity - -
-
- -
- AIBDP manifests are public declarations. Implementers should consider: - - Manifests SHOULD NOT contain private information - Contact information SHOULD be organizational, not personal - Detailed scope patterns MAY reveal site structure - Manifests do not track or log AI system access (use server logs for auditing) - - - The protocol itself does not create new privacy risks beyond existing web publication models. -
- -
-
- Servers SHOULD: - - Serve manifests over HTTPS to prevent tampering - Use COSE signatures for high-value content - Validate JSON schema to prevent malformed manifests - Set appropriate cache headers to balance freshness and load - -
- -
- AI systems fetching manifests SHOULD: - - Cache manifests according to "expires" field - Implement exponential backoff on errors - Respect Retry-After headers - Limit manifest size (RECOMMENDED: 1MB maximum) - -
- -
- Attackers might attempt to: - - Serve fake manifests via DNS hijacking (mitigated by HTTPS + signatures) - Inject permissive manifests via MITM (mitigated by HTTPS) - Exploit manifest parsing vulnerabilities (mitigated by schema validation) - - - Implementations MUST validate manifest structure and SHOULD verify signatures when present. -
- -
- AIBDP is a declarative protocol, not a technical enforcement mechanism: - - Non-compliant AI systems MAY ignore manifests - Detection of violations requires active monitoring - Legal or reputational consequences provide primary enforcement - HTTP 430 responses signal boundary violations but cannot prevent initial access - - - AIBDP establishes procedural clarity for consent, not cryptographic access control. -
-
- -
-
- This document requests registration of the "aibdp.json" well-known URI: - - aibdp.json - IETF - This RFC - AI Boundary Declaration Protocol manifest - -
- -
- This document requests registration of the "application/aibdp+json" media type: - - application - aibdp+json - None - None - Binary (UTF-8 JSON) - See Section 11 - Follows JSON RFC 8259 - This RFC - AI systems, web servers, content management systems - -
-
- -
- AIBDP is designed for future extension: - - New policy keys MAY be added for emerging AI use cases - Implementations SHOULD ignore unknown fields (forward compatibility) - Version negotiation via "aibdp_version" field - Custom fields SHOULD use reverse-DNS prefixing (e.g., "com.example.custom_policy") - - - Future versions MAY define: - - Dynamic policy updates via Server-Sent Events or WebSockets - Per-user consent declarations for authenticated systems - Tiered access levels based on AI system reputation - Integration with decentralized identity systems (DIDs) - -
- -
-
- Publishers implementing AIBDP SHOULD: - - Define clear AI usage boundaries aligned with organizational values - Create manifest at /.well-known/aibdp.json with appropriate policies - Set "expires" field to balance freshness and caching (recommended: 30-90 days) - Provide contact information for policy questions - Consider cryptographic signatures for high-value content - Monitor access patterns and respond with HTTP 430 when violations detected - Document policy rationale in human-readable form (policy_uri) - -
- -
- AI systems SHOULD: - - Fetch /.well-known/aibdp.json before initial content access - Parse and validate manifest structure - Respect declared boundaries or skip content if unable to comply - Cache manifests according to "expires" field - Verify signatures when present and validation is supported - Include User-Agent identifying system and purpose - Consider using consent headers (AI-Purpose, AI-Consent-Reviewed) - Log compliance decisions for audit purposes - Contact publishers via provided contact URI when clarification needed - -
-
- -
- This protocol draws inspiration from: - - robots.txt (Martijn Koster, et al.) - RFC 9116 (security.txt - Edwin Foudil, Yakov Shafranovich) - TDM Reservation Protocol (Text and Data Mining) - IndieWeb community (federated publishing standards) - National Union of Journalists Ethics Council - Consent theory and boundary ethics (bell hooks, journalism ethics traditions) - -
- - - - - - - Key words for use in RFCs to Indicate Requirement Levels - IETF - - - - - - - The JavaScript Object Notation (JSON) Data Interchange Format - IETF - - - - - - - CBOR Object Signing and Encryption (COSE) - IETF - - - - - - - Well-Known Uniform Resource Identifiers (URIs) - IETF - - - - - - - HTTP Status Code 430: Consent Required - - - - - - - - - - A File Format to Aid in Security Vulnerability Disclosure - IETF - - - - - - - A Standard for Robot Exclusion - - - - - - - diff --git a/consent-aware-http/drafts/draft-jewell-http-430-consent-required-00.xml b/consent-aware-http/drafts/draft-jewell-http-430-consent-required-00.xml deleted file mode 100644 index 346e139d..00000000 --- a/consent-aware-http/drafts/draft-jewell-http-430-consent-required-00.xml +++ /dev/null @@ -1,133 +0,0 @@ - - - - - HTTP Status Code 430: Consent Required - - - National Union of Journalists -
- jonathan@metadatastician.art -
- - - - This document defines HTTP status code 430 (Consent Required), intended for use when access to a resource is denied due to the absence of a valid AI usage consent declaration. It supports machine-readable governance frameworks such as the AI Boundary Declaration Protocol, enabling declarative boundaries that prevent unauthorized indexing, training, or generative reuse of online content. - - - - -
- Introduction - Current HTTP status codes such as 403 (Forbidden), 428 (Precondition Required), and 451 (Unavailable for Legal Reasons) do not adequately reflect denial scenarios based on missing or invalid AI consent declarations. As declarative perimeter protocols (e.g., ) become more prevalent, a distinct status code is required to denote procedural consent failure prior to content access. - HTTP status code 430 (Consent Required) is proposed to signal that the requesting entity has failed to verify or respect the declared boundaries associated with AI ingestion, training, or derivative generation. This complements existing semantics defined in and expands ethical enforcement beyond legal constraints described in . -
- -
- Definition - Status Code: 430 - Phrase: Consent Required - The server denies access because the client failed to verify or satisfy AI-specific consent declarations associated with the requested content. This denial applies in cases where a .well-known/aibdp.json manifest is present or expected, and no sufficient verification or compliance has occurred. -
- -
- Response Examples - -HTTP/1.1 430 Consent Required -Content-Type: application/json -Link: <https://example.org/.well-known/aibdp.json>; rel="blocked-by" -Retry-After: 86400 - -{ - "error": "Consent declaration missing or invalid.", - "reference": "https://example.org/.well-known/aibdp.json" -} - -
- -
- Use Cases -
    -
  • AI crawlers and bots accessing content without checking for declarative usage terms
    • -
  • Autonomous agents initiating training operations on hosted data without pre-verification
    • -
  • Content Delivery Networks (CDNs) enforcing perimeter logic via manifest signals
    • -
  • Infrastructure providers enabling rate-limiting or denial logic based on absence of consent
    • -
-
- -
- Comparison to Existing Status Codes -
-
403 (Forbidden)
-
Generic denial; lacks boundary intent or procedural context.
-
428 (Precondition Required)
-
Designed for conditional requests; not consent-specific.
-
451 (Unavailable for Legal Reasons)
-
Legal enforcement only; not suited for declarative publisher-led refusals.
-
430 (Consent Required)
-
Represents non-legal, machine-readable perimeter logic. Expresses absence of verified permission, rather than technical or legal failure.
-
-
- -
- Security Considerations - Use of 430 Consent Required does not reveal sensitive internal logic or compromise user data. It enforces publisher-defined AI boundaries while preserving public accessibility of the perimeter declaration. This status code supports structured denial without over-identification of request origin. -
- -
- IANA Considerations - This document requests that IANA register the status code 430 (Consent Required) in the HTTP Status Code Registry. -
- - - - - Normative References - - - HTTP Semantics - - IETF - - - - - - - - - AI Boundary Declaration Protocol - - - - - - - - - Informative References - - - An HTTP Status Code to Report Legal Obstacles - - IETF - - - - - - - -
- Acknowledgements - This proposal builds on ethical governance efforts in journalism, computing, and infrastructure architecture. Thanks to contributors from the NUJ, the IETF HTTPAPI and ART areas, and transparency coalitions engaging in boundary-aware standards formation. -
- - diff --git a/consent-aware-http/examples/manifest-scenarios/README.md b/consent-aware-http/examples/manifest-scenarios/README.md deleted file mode 100644 index ce844892..00000000 --- a/consent-aware-http/examples/manifest-scenarios/README.md +++ /dev/null @@ -1,1457 +0,0 @@ -# AIBDP Manifest Examples for Different Scenarios - -This directory contains example AIBDP manifests demonstrating how different types of organizations and content creators can declare AI usage boundaries. - -## Quick Reference - -| Scenario | Stance | Use Case | -|----------|--------|----------| -| [Personal Blog](#1-personal-blog) | Mixed | Indie publisher, creative work | -| [News Organization](#2-news-organization) | Conditional | Journalism, investigative reporting | -| [Academic Archive](#3-academic-archive) | Permissive | Research, open access | -| [Private Company](#4-private-company) | Restrictive | Proprietary documentation | -| [Open Source Project](#5-open-source-project) | Permissive | Public code, documentation | -| [Artist Portfolio](#6-artist-portfolio) | Highly Restrictive | Creative work protection | -| [Government Website](#7-government-website) | Public Domain | Civic information | -| [Educational Institution](#8-educational-institution) | Educational | Course materials, research | -| [Medical/Healthcare](#9-medicalhealthcare-provider) | HIPAA Compliant | Patient privacy | -| [Legal Firm](#10-legal-firm) | Restricted | Client confidentiality | -| [Community Wiki](#11-community-wiki) | Collaborative | User-generated content | -| [E-commerce Site](#12-e-commerce-site) | Commercial | Product descriptions | - ---- - -## 1. Personal Blog - -**Scenario**: Independent writer sharing essays, creative writing, and personal reflections. - -**Stance**: Refused training, allowed indexing, conditional summarization - -```json -{ - "aibdp_version": "0.2", - "contact": "mailto:author@personalblog.com", - "expires": "2026-01-01T00:00:00Z", - "policy_uri": "https://personalblog.com/ai-policy", - - "policies": { - "training": { - "status": "refused", - "rationale": "My creative work is my intellectual property and should not be used to train commercial AI models without compensation and attribution.", - "alternatives": "Contact me directly for licensing arrangements" - }, - - "indexing": { - "status": "allowed", - "scope": "all", - "note": "I want my work to be discoverable" - }, - - "summarization": { - "status": "conditional", - "conditions": [ - "Preserve author attribution", - "Link back to original post", - "Do not misrepresent my views" - ], - "note": "Summaries must maintain the spirit of the original" - }, - - "question_answering": { - "status": "allowed", - "conditions": [ - "Cite source with full URL", - "Indicate personal opinion nature" - ] - }, - - "generation": { - "status": "refused", - "rationale": "Do not create synthetic versions of my writing style or voice" - }, - - "fine_tuning": { - "status": "refused", - "note": "My writing style is personal and should not be replicated" - } - }, - - "enforcement": { - "mechanism": "http_430", - "contact_before_litigation": true, - "preferred_resolution": "respectful dialogue" - }, - - "metadata": { - "author": "Jane Doe", - "created": "2025-07-20", - "organization": "Independent Creator" - }, - - "philosophy": { - "core_principle": "My words are my own. Attribution and consent matter.", - "values": [ - "Authorship dignity", - "Fair compensation for creative work", - "Discoverability without exploitation" - ] - } -} -``` - ---- - -## 2. News Organization - -**Scenario**: Investigative journalism outlet with subscription model. - -**Stance**: Conditional training with attribution, allowed indexing, protected investigative content - -```json -{ - "aibdp_version": "0.2", - "contact": "mailto:legal@newsorg.com", - "expires": "2025-12-31T23:59:59Z", - "policy_uri": "https://newsorg.com/ai-usage-policy", - - "policies": { - "training": { - "status": "conditional", - "conditions": [ - "Attribution to NewsOrg in model documentation", - "Preserve factual accuracy and context", - "Do not strip bylines or source citations", - "Commercial training requires licensing agreement" - ], - "scope": ["/articles/**", "/reports/**"], - "exceptions": [ - { - "path": "/investigations/**", - "status": "refused", - "note": "Investigative journalism requires heightened protection" - } - ] - }, - - "indexing": { - "status": "allowed", - "scope": "all", - "note": "Full indexing permitted for news discovery" - }, - - "summarization": { - "status": "allowed", - "conditions": [ - "Maintain journalistic accuracy", - "Preserve critical nuance and context", - "Cite NewsOrg as source", - "Link to full article" - ] - }, - - "question_answering": { - "status": "allowed", - "conditions": [ - "Cite article title, author, and publication date", - "Link to original article", - "Indicate if content is behind paywall" - ] - }, - - "generation": { - "status": "refused", - "rationale": "Synthetic journalism undermines editorial integrity and trust", - "alternatives": "Link to original reporting with proper attribution" - }, - - "commercial_training": { - "status": "conditional", - "conditions": [ - "Licensing agreement required", - "Financial compensation to support journalism", - "Transparent disclosure in AI system documentation", - "Preserve journalist attribution" - ], - "note": "Contact legal@newsorg.com for licensing" - } - }, - - "special_provisions": { - "academic_research": { - "status": "allowed", - "conditions": ["Proper academic citation", "Non-commercial use"], - "note": "We support journalism research and education" - } - }, - - "enforcement": { - "mechanism": "http_430", - "contact_before_litigation": false, - "preferred_resolution": "licensing agreement", - "note": "Violations may result in legal action and public disclosure" - }, - - "metadata": { - "organization": "NewsOrg Media Inc.", - "created": "2025-07-01", - "related_standards": ["NUJ Code of Conduct", "SPJ Code of Ethics"] - }, - - "philosophy": { - "core_principle": "Quality journalism requires sustainability. AI training must support, not undermine, the journalism ecosystem.", - "values": [ - "Editorial independence", - "Journalist attribution", - "Factual accuracy preservation", - "Sustainable news business models" - ] - } -} -``` - ---- - -## 3. Academic Archive - -**Scenario**: University open access repository for research papers. - -**Stance**: Permissive for research, education, and academic purposes - -```json -{ - "aibdp_version": "0.2", - "contact": "mailto:library@university.edu", - "expires": "2026-06-30T23:59:59Z", - "policy_uri": "https://university.edu/library/ai-policy", - - "policies": { - "training": { - "status": "allowed", - "conditions": [ - "Cite papers using DOI or permanent URL", - "Preserve author attribution and institutional affiliation", - "Maintain academic integrity" - ], - "note": "We encourage AI training on academic research to advance knowledge" - }, - - "indexing": { - "status": "encouraged", - "purpose": [ - "Academic search engines", - "Research discovery platforms", - "Citation network analysis" - ] - }, - - "summarization": { - "status": "encouraged", - "conditions": [ - "Preserve scientific accuracy", - "Maintain proper academic citation format" - ], - "note": "Summaries help researchers navigate large bodies of literature" - }, - - "question_answering": { - "status": "encouraged", - "conditions": [ - "Cite papers with full academic citation", - "Indicate peer-review status", - "Preserve scientific nuance" - ] - }, - - "generation": { - "status": "conditional", - "conditions": [ - "Generated content must clearly indicate it is synthetic", - "Original research must be cited", - "Do not present generated content as peer-reviewed" - ], - "rationale": "Synthetic academic content must be clearly labeled to maintain research integrity" - }, - - "fine_tuning": { - "status": "encouraged", - "purpose": [ - "Academic writing assistants", - "Research summarization tools", - "Literature review automation", - "Accessibility tools for research" - ] - }, - - "embedding": { - "status": "allowed", - "note": "Vector embeddings support semantic search and research discovery" - }, - - "commercial_training": { - "status": "conditional", - "conditions": [ - "Respect author copyright and licensing", - "Transparent disclosure of training data sources", - "Consider financial support for open access publishing" - ] - } - }, - - "special_provisions": { - "academic_research": { - "status": "unrestricted", - "note": "All content freely available for academic research and education" - }, - - "educational_use": { - "status": "unrestricted", - "note": "Use in courses, teaching, and educational materials is strongly encouraged" - } - }, - - "scope": { - "applies_to": [ - "Research papers and preprints", - "Dissertations and theses", - "Technical reports", - "Conference proceedings" - ] - }, - - "enforcement": { - "mechanism": "none", - "note": "We rely on academic norms and goodwill rather than technical enforcement" - }, - - "metadata": { - "organization": "University Research Library", - "created": "2025-07-15", - "repository_type": "Open Access Institutional Repository" - }, - - "philosophy": { - "core_principle": "Knowledge should be freely shared to advance human understanding. We welcome responsible AI use that accelerates research.", - "values": [ - "Open science", - "Research accessibility", - "Academic integrity", - "Knowledge advancement" - ] - } -} -``` - ---- - -## 4. Private Company - -**Scenario**: SaaS company with proprietary documentation and technical guides. - -**Stance**: Restrictive on all AI uses except authorized customer support - -```json -{ - "aibdp_version": "0.2", - "contact": "mailto:legal@saascompany.com", - "expires": "2025-10-01T00:00:00Z", - "policy_uri": "https://saascompany.com/legal/ai-policy", - - "policies": { - "training": { - "status": "refused", - "rationale": "Our documentation contains proprietary technical information, trade secrets, and competitive advantages", - "scope": "all" - }, - - "indexing": { - "status": "conditional", - "conditions": [ - "Authorized search engines only (Google, Bing, DuckDuckGo)", - "Respect robots.txt directives", - "Customer-facing documentation only (/docs/public/**)" - ], - "scope": ["/docs/public/**"], - "exceptions": [ - { - "path": "/docs/internal/**", - "status": "refused", - "note": "Internal documentation is confidential" - } - ] - }, - - "summarization": { - "status": "conditional", - "conditions": [ - "Authorized customer support systems only", - "Logged-in customers only", - "Preserve technical accuracy" - ], - "note": "We operate our own AI-powered documentation assistant for customers" - }, - - "question_answering": { - "status": "refused", - "rationale": "External AI systems may provide incorrect or outdated technical information about our product" - }, - - "generation": { - "status": "refused", - "rationale": "Synthetic documentation may contain errors and create support liabilities" - }, - - "fine_tuning": { - "status": "refused", - "scope": "all" - }, - - "embedding": { - "status": "refused", - "scope": "all" - }, - - "commercial_training": { - "status": "refused", - "rationale": "Competitive concerns and intellectual property protection", - "note": "No exceptions" - } - }, - - "enforcement": { - "mechanism": "http_430", - "contact_before_litigation": false, - "preferred_resolution": "cease and desist", - "note": "Violations will be pursued through legal action" - }, - - "metadata": { - "organization": "SaaS Company Inc.", - "created": "2025-07-20", - "legal_basis": "Trade secret protection, competitive advantage" - }, - - "philosophy": { - "core_principle": "Our documentation represents significant investment and competitive differentiation. Unauthorized AI use threatens our business.", - "values": [ - "Intellectual property protection", - "Competitive advantage preservation", - "Customer privacy", - "Technical accuracy control" - ] - } -} -``` - ---- - -## 5. Open Source Project - -**Scenario**: Large open source project with code, documentation, and community contributions. - -**Stance**: Highly permissive, encourages AI use for development and learning - -```json -{ - "aibdp_version": "0.2", - "contact": "mailto:maintainers@opensource-project.org", - "expires": "2026-12-31T23:59:59Z", - "policy_uri": "https://opensource-project.org/ai-policy", - - "policies": { - "training": { - "status": "allowed", - "conditions": [ - "Preserve license attribution (MIT License)", - "Respect copyright notices", - "Generated code should indicate it is AI-generated" - ], - "note": "We welcome AI training on our code and documentation" - }, - - "indexing": { - "status": "encouraged", - "purpose": [ - "Code search engines", - "Documentation discovery", - "Package registries", - "Developer tools" - ] - }, - - "summarization": { - "status": "encouraged", - "note": "Summaries help developers understand our project quickly" - }, - - "question_answering": { - "status": "encouraged", - "conditions": [ - "Cite repository URL", - "Indicate version/release if relevant", - "Link to relevant documentation" - ], - "note": "We want AI assistants to help developers use our project" - }, - - "generation": { - "status": "allowed", - "conditions": [ - "Generated code must respect MIT License", - "Indicate AI generation in comments if appropriate", - "Do not claim AI-generated code is official project code" - ] - }, - - "fine_tuning": { - "status": "encouraged", - "purpose": [ - "Code completion tools", - "Developer assistants", - "Documentation generation", - "Bug detection and analysis" - ], - "note": "We actively encourage fine-tuning for developer productivity" - }, - - "embedding": { - "status": "allowed", - "note": "Vector embeddings support code search and semantic analysis" - }, - - "commercial_training": { - "status": "allowed", - "conditions": [ - "Respect MIT License terms", - "Preserve attribution", - "Consider contributing back to the project" - ], - "note": "Commercial AI development is welcome under our open source license" - } - }, - - "special_provisions": { - "educational_use": { - "status": "unrestricted", - "note": "We encourage use in coding bootcamps, courses, and tutorials" - }, - - "standards_development": { - "status": "collaborative", - "note": "We participate in open standards and welcome AI systems that support those standards" - } - }, - - "enforcement": { - "mechanism": "none", - "note": "We rely on open source license compliance and community norms", - "preferred_resolution": "community discussion and contribution" - }, - - "metadata": { - "organization": "Open Source Project Maintainers", - "created": "2025-07-01", - "license": "MIT License", - "repository": "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/opensource-project/main" - }, - - "philosophy": { - "core_principle": "Open source thrives on sharing and collaboration. We welcome AI systems that amplify developer productivity and project accessibility.", - "values": [ - "Openness and transparency", - "Developer empowerment", - "Community collaboration", - "Knowledge sharing" - ], - "quote": "Build together, learn together, grow together." - } -} -``` - ---- - -## 6. Artist Portfolio - -**Scenario**: Digital artist showcasing original artwork and creative projects. - -**Stance**: Highly restrictive to protect creative work and style - -```json -{ - "aibdp_version": "0.2", - "contact": "mailto:artist@artportfolio.com", - "expires": "2026-03-31T23:59:59Z", - "policy_uri": "https://artportfolio.com/ai-ethics", - - "policies": { - "training": { - "status": "refused", - "rationale": "My artwork represents years of skill development, personal vision, and creative labor. AI training on my work without consent and compensation constitutes theft of my artistic voice.", - "scope": "all", - "alternatives": "Contact me directly for commissioned collaborations or licensing" - }, - - "indexing": { - "status": "conditional", - "conditions": [ - "For art discovery and portfolio presentation only", - "Image thumbnails only (no high-resolution scraping)", - "Preserve artist attribution and copyright notice" - ], - "scope": ["/portfolio/**", "/gallery/**"] - }, - - "summarization": { - "status": "conditional", - "conditions": [ - "Describe my work respectfully and accurately", - "Preserve artist attribution", - "Link to original artwork", - "Do not reduce my work to training data descriptions" - ] - }, - - "question_answering": { - "status": "conditional", - "conditions": [ - "Cite artist name and portfolio URL", - "Preserve artistic context and intent", - "Do not provide instructions for replicating my style" - ] - }, - - "generation": { - "status": "refused", - "rationale": "Generating artwork 'in my style' or based on my portfolio constitutes artistic identity theft and devalues my unique creative voice" - }, - - "fine_tuning": { - "status": "refused", - "rationale": "Fine-tuning on my artwork to replicate my style is unethical and economically harmful", - "note": "This includes LoRA training, style transfer, and any form of artistic mimicry" - }, - - "embedding": { - "status": "refused", - "rationale": "Vector embeddings of my artwork enable style replication and unauthorized derivatives" - }, - - "commercial_training": { - "status": "refused", - "rationale": "I do not consent to any commercial AI training on my creative work, under any circumstances", - "note": "Legal action will be pursued against violations" - } - }, - - "enforcement": { - "mechanism": "http_430", - "contact_before_litigation": false, - "preferred_resolution": "immediate cessation and public retraction", - "note": "I document and publicly share AI scraping violations to raise awareness" - }, - - "metadata": { - "author": "Creative Artist Name", - "created": "2025-07-20", - "copyright": "All rights reserved © 2025" - }, - - "philosophy": { - "core_principle": "Art is not data. Creativity is not raw material for extraction. My work is my livelihood and my identity.", - "values": [ - "Artistic integrity", - "Creative labor dignity", - "Anti-exploitation", - "Human creativity preservation" - ], - "quote": "Without consent, there is no collaboration—only theft. — Artist Statement" - } -} -``` - ---- - -## 7. Government Website - -**Scenario**: Federal/national government public information portal. - -**Stance**: Public domain, unrestricted access for civic benefit - -```json -{ - "aibdp_version": "0.2", - "contact": "mailto:webmaster@government.gov", - "expires": "2027-01-01T00:00:00Z", - "policy_uri": "https://government.gov/ai-usage-policy", - - "policies": { - "training": { - "status": "allowed", - "conditions": [ - "Preserve accuracy of government information", - "Cite government source with official URL", - "Indicate publication/update date for time-sensitive information" - ], - "note": "Government information is public domain and freely available for AI training" - }, - - "indexing": { - "status": "encouraged", - "purpose": [ - "Civic information discovery", - "Government services accessibility", - "Public records search" - ], - "note": "We actively want citizens to find government information easily" - }, - - "summarization": { - "status": "allowed", - "conditions": [ - "Maintain factual accuracy", - "Preserve policy nuances and legal language precision", - "Link to authoritative government source" - ] - }, - - "question_answering": { - "status": "encouraged", - "conditions": [ - "Cite official government source", - "Indicate when information may be time-sensitive or outdated", - "Preserve legal and policy accuracy" - ], - "note": "AI systems answering questions about government services improve civic engagement" - }, - - "generation": { - "status": "conditional", - "conditions": [ - "Generated content must clearly indicate it is not official government communication", - "Must cite official sources", - "Cannot misrepresent government policy or services" - ], - "rationale": "Synthetic government content must be clearly labeled to prevent misinformation" - }, - - "fine_tuning": { - "status": "encouraged", - "purpose": [ - "Civic chatbots", - "Government service assistants", - "Policy research tools", - "Accessibility tools for government information" - ] - }, - - "commercial_training": { - "status": "allowed", - "conditions": [ - "Government information is public domain", - "Preserve accuracy and attribution", - "Do not misrepresent government endorsement of commercial products" - ] - } - }, - - "special_provisions": { - "academic_research": { - "status": "unrestricted", - "note": "Government data is freely available for research and analysis" - }, - - "educational_use": { - "status": "unrestricted", - "note": "Use in civics education is strongly encouraged" - } - }, - - "enforcement": { - "mechanism": "none", - "note": "Government information is public domain. We rely on accuracy norms rather than technical enforcement.", - "preferred_resolution": "collaboration and correction of inaccuracies" - }, - - "metadata": { - "organization": "National Government Web Portal", - "created": "2025-07-01", - "legal_basis": "Public domain - government works" - }, - - "philosophy": { - "core_principle": "Government information belongs to the people. We encourage maximum accessibility and reuse to support informed citizenship.", - "values": [ - "Transparency", - "Civic engagement", - "Public access", - "Democratic participation" - ] - } -} -``` - ---- - -## 8. Educational Institution - -**Scenario**: K-12 school district with curriculum materials and student resources. - -**Stance**: Educational focus with privacy protections - -```json -{ - "aibdp_version": "0.2", - "contact": "mailto:tech@schooldistrict.edu", - "expires": "2026-06-30T23:59:59Z", - "policy_uri": "https://schooldistrict.edu/ai-policy", - - "policies": { - "training": { - "status": "conditional", - "conditions": [ - "Educational use only", - "No commercial training on student-facing materials", - "Preserve educational context and age-appropriateness", - "Cite school district as source" - ], - "scope": ["/curriculum/**", "/resources/**"], - "exceptions": [ - { - "path": "/student-work/**", - "status": "refused", - "note": "FERPA protected - student work is confidential" - } - ] - }, - - "indexing": { - "status": "allowed", - "conditions": [ - "Public curriculum materials only", - "Respect FERPA privacy protections" - ], - "scope": ["/curriculum/**", "/resources/**"] - }, - - "summarization": { - "status": "allowed", - "conditions": [ - "Preserve educational accuracy", - "Maintain age-appropriate context", - "Cite school district source" - ] - }, - - "question_answering": { - "status": "allowed", - "conditions": [ - "Educational context only", - "Age-appropriate responses", - "No circumvention of educational scaffolding" - ], - "note": "AI tutoring systems may reference our materials" - }, - - "generation": { - "status": "refused", - "rationale": "Synthetic curriculum materials may not meet educational standards and age-appropriateness requirements" - }, - - "fine_tuning": { - "status": "conditional", - "conditions": [ - "Educational applications only", - "Preserve age-appropriateness", - "Respect FERPA and COPPA privacy laws" - ], - "purpose": [ - "Educational tutoring systems", - "Accessibility tools for students", - "Teacher planning assistants" - ] - }, - - "commercial_training": { - "status": "conditional", - "conditions": [ - "Educational technology products only", - "Transparent disclosure of training data use", - "Consider partnership or licensing with school district", - "Comply with student privacy laws (FERPA, COPPA)" - ] - } - }, - - "special_provisions": { - "educational_use": { - "status": "encouraged", - "conditions": [ - "Respect student privacy", - "Maintain educational integrity" - ] - } - }, - - "enforcement": { - "mechanism": "http_430", - "contact_before_litigation": true, - "preferred_resolution": "partnership discussion for legitimate educational technology", - "note": "Student privacy violations will be reported to relevant authorities" - }, - - "metadata": { - "organization": "School District Educational Technology Office", - "created": "2025-07-15", - "compliance": ["FERPA", "COPPA", "State Education Privacy Laws"] - }, - - "philosophy": { - "core_principle": "Education benefits from technology, but student privacy and educational integrity are paramount.", - "values": [ - "Student privacy protection", - "Educational quality", - "Age-appropriate content", - "Teacher autonomy" - ] - } -} -``` - ---- - -## 9. Medical/Healthcare Provider - -**Scenario**: Hospital/clinic website with patient education materials. - -**Stance**: HIPAA compliant, protected health information restrictions - -```json -{ - "aibdp_version": "0.2", - "contact": "mailto:compliance@hospital.org", - "expires": "2025-12-31T23:59:59Z", - "policy_uri": "https://hospital.org/ai-compliance", - - "policies": { - "training": { - "status": "conditional", - "conditions": [ - "Public health education materials only (/health-library/**)", - "No PHI (Protected Health Information)", - "Medical accuracy preservation required", - "Cite hospital as source with medical disclaimers" - ], - "scope": ["/health-library/**"], - "exceptions": [ - { - "path": "/patient-portal/**", - "status": "refused", - "note": "HIPAA protected - contains PHI" - }, - { - "path": "/medical-records/**", - "status": "refused", - "note": "Confidential patient data" - } - ] - }, - - "indexing": { - "status": "conditional", - "conditions": [ - "Public-facing health education only", - "No patient portal or confidential sections", - "Preserve medical disclaimers" - ], - "scope": ["/health-library/**", "/about/**"] - }, - - "summarization": { - "status": "conditional", - "conditions": [ - "Preserve medical accuracy and safety information", - "Include appropriate medical disclaimers", - "Do not oversimplify critical health information", - "Link to authoritative medical source" - ], - "note": "Inaccurate medical summaries pose patient safety risks" - }, - - "question_answering": { - "status": "conditional", - "conditions": [ - "Include medical disclaimers", - "Indicate information is educational only, not medical advice", - "Preserve critical safety warnings", - "Cite credible medical sources" - ] - }, - - "generation": { - "status": "refused", - "rationale": "Synthetic medical content poses patient safety and liability risks. All medical information must be professionally reviewed." - }, - - "fine_tuning": { - "status": "refused", - "rationale": "Medical AI systems require clinical validation and regulatory approval" - }, - - "commercial_training": { - "status": "conditional", - "conditions": [ - "Public health education materials only", - "Regulatory compliance (FDA for medical AI)", - "Liability insurance and professional oversight", - "Transparent disclosure of training data", - "Business associate agreement if PHI involved" - ] - } - }, - - "special_provisions": { - "academic_research": { - "status": "conditional", - "conditions": [ - "IRB approval if applicable", - "De-identified data only", - "HIPAA compliance", - "Research ethics protocols" - ] - } - }, - - "enforcement": { - "mechanism": "http_430", - "contact_before_litigation": false, - "preferred_resolution": "immediate cessation", - "note": "HIPAA violations will be reported to HHS Office for Civil Rights. Medical misinformation liability will be pursued." - }, - - "metadata": { - "organization": "Hospital Health System", - "created": "2025-07-20", - "compliance": ["HIPAA", "HITECH", "State Medical Privacy Laws"], - "accreditation": "Joint Commission Accredited" - }, - - "philosophy": { - "core_principle": "Patient safety and privacy are absolute. AI use in healthcare requires rigorous oversight and accountability.", - "values": [ - "Patient privacy (HIPAA)", - "Medical accuracy", - "Safety first", - "Professional accountability" - ] - } -} -``` - ---- - -## 10. Legal Firm - -**Scenario**: Law firm with legal analysis, case studies, and client resources. - -**Stance**: Attorney-client privilege protection, selective public content - -```json -{ - "aibdp_version": "0.2", - "contact": "mailto:ethics@lawfirm.com", - "expires": "2025-11-30T23:59:59Z", - "policy_uri": "https://lawfirm.com/ai-ethics-policy", - - "policies": { - "training": { - "status": "conditional", - "conditions": [ - "Public legal blog posts only (/blog/**)", - "No client-related content", - "Preserve legal citations and precedent accuracy", - "Cite law firm as source" - ], - "scope": ["/blog/**"], - "exceptions": [ - { - "path": "/client-portal/**", - "status": "refused", - "note": "Attorney-client privilege - strictly confidential" - }, - { - "path": "/case-files/**", - "status": "refused", - "note": "Work product privilege" - } - ] - }, - - "indexing": { - "status": "conditional", - "conditions": [ - "Public website only", - "No confidential client sections", - "Preserve legal disclaimers" - ], - "scope": ["/blog/**", "/about/**", "/practice-areas/**"] - }, - - "summarization": { - "status": "conditional", - "conditions": [ - "Preserve legal accuracy and nuance", - "Include legal disclaimers (not legal advice)", - "Maintain citation accuracy", - "Do not oversimplify complex legal analysis" - ] - }, - - "question_answering": { - "status": "conditional", - "conditions": [ - "Include disclaimer: 'This is not legal advice'", - "Preserve jurisdictional context", - "Cite authoritative legal sources", - "Recommend consulting licensed attorney" - ] - }, - - "generation": { - "status": "refused", - "rationale": "Synthetic legal analysis poses malpractice risks and unauthorized practice of law concerns" - }, - - "fine_tuning": { - "status": "refused", - "rationale": "Legal AI systems require professional oversight and ethical compliance" - }, - - "commercial_training": { - "status": "refused", - "rationale": "Legal content represents professional work product and competitive advantage", - "note": "Contact for licensing inquiries" - } - }, - - "enforcement": { - "mechanism": "http_430", - "contact_before_litigation": false, - "preferred_resolution": "immediate cessation and potential bar complaint", - "note": "Violations may constitute unauthorized practice of law and will be reported to state bar" - }, - - "metadata": { - "organization": "Law Firm LLP", - "created": "2025-07-20", - "ethical_compliance": ["ABA Model Rules of Professional Conduct", "State Bar Ethics Rules"] - }, - - "philosophy": { - "core_principle": "Attorney-client privilege and professional ethics are sacrosanct. AI use in legal practice requires strict confidentiality and professional responsibility.", - "values": [ - "Attorney-client privilege", - "Professional ethics", - "Legal accuracy", - "Malpractice prevention" - ] - } -} -``` - ---- - -## 11. Community Wiki - -**Scenario**: Collaborative wiki with user-generated content (Wikipedia-style). - -**Stance**: Permissive with attribution requirements - -```json -{ - "aibdp_version": "0.2", - "contact": "mailto:admin@communitywiki.org", - "expires": "2026-12-31T23:59:59Z", - "policy_uri": "https://communitywiki.org/ai-policy", - - "policies": { - "training": { - "status": "allowed", - "conditions": [ - "Preserve Creative Commons BY-SA 4.0 license", - "Maintain contributor attribution", - "Respect edit history and collaborative nature" - ], - "note": "Wiki content is collaboratively created and shared under CC BY-SA" - }, - - "indexing": { - "status": "encouraged", - "note": "We want wiki knowledge to be discoverable" - }, - - "summarization": { - "status": "allowed", - "conditions": [ - "Preserve factual accuracy", - "Cite wiki as source", - "Indicate collaborative/crowdsourced nature", - "Link to current version of article" - ] - }, - - "question_answering": { - "status": "encouraged", - "conditions": [ - "Cite wiki article URL", - "Indicate content is community-maintained", - "Note when information may be outdated or disputed" - ] - }, - - "generation": { - "status": "conditional", - "conditions": [ - "Generated content must respect CC BY-SA license", - "Clearly indicate AI generation", - "Do not present as authoritative wiki content", - "Consider contributing generated improvements back to wiki" - ] - }, - - "fine_tuning": { - "status": "encouraged", - "purpose": [ - "Knowledge synthesis tools", - "Educational assistants", - "Accessibility tools", - "Translation services" - ] - }, - - "commercial_training": { - "status": "allowed", - "conditions": [ - "Respect CC BY-SA 4.0 license terms", - "Preserve attribution", - "Share-alike requirements apply to derivatives", - "Consider donating to support wiki infrastructure" - ] - } - }, - - "special_provisions": { - "educational_use": { - "status": "unrestricted", - "note": "Wiki exists to spread knowledge freely" - } - }, - - "enforcement": { - "mechanism": "none", - "note": "We rely on Creative Commons license compliance and community norms" - }, - - "metadata": { - "organization": "Community Wiki Foundation", - "created": "2025-07-01", - "license": "Creative Commons BY-SA 4.0", - "content_model": "Collaborative crowdsourcing" - }, - - "philosophy": { - "core_principle": "Free knowledge for all. Community collaboration creates value that should be shared openly.", - "values": [ - "Open knowledge", - "Community collaboration", - "Accessibility", - "Continuous improvement" - ] - } -} -``` - ---- - -## 12. E-commerce Site - -**Scenario**: Online store with product descriptions, reviews, and shopping content. - -**Stance**: Commercial interests, selective AI use - -```json -{ - "aibdp_version": "0.2", - "contact": "mailto:legal@ecommerce.com", - "expires": "2025-10-31T23:59:59Z", - "policy_uri": "https://ecommerce.com/ai-terms", - - "policies": { - "training": { - "status": "conditional", - "conditions": [ - "Product descriptions only (not customer data)", - "Preserve brand name and trademark attribution", - "No training on proprietary product photography", - "Respect manufacturer copyright" - ], - "scope": ["/products/**"], - "exceptions": [ - { - "path": "/customer-reviews/**", - "status": "refused", - "note": "Customer content - privacy protected" - }, - { - "path": "/customer-accounts/**", - "status": "refused", - "note": "Personal customer data" - } - ] - }, - - "indexing": { - "status": "encouraged", - "purpose": [ - "Product search engines", - "Price comparison tools", - "Shopping assistants" - ], - "scope": ["/products/**", "/categories/**"] - }, - - "summarization": { - "status": "allowed", - "conditions": [ - "Preserve product accuracy and specifications", - "Maintain brand attribution", - "Link to product page for purchase" - ] - }, - - "question_answering": { - "status": "allowed", - "conditions": [ - "Cite product page URL", - "Preserve accurate pricing and availability (may be outdated)", - "Indicate affiliate relationship if applicable" - ], - "note": "AI shopping assistants help customers find products" - }, - - "generation": { - "status": "conditional", - "conditions": [ - "Product descriptions only (not marketing copy)", - "Maintain factual accuracy", - "Preserve brand guidelines", - "Do not generate fake reviews or testimonials" - ] - }, - - "fine_tuning": { - "status": "conditional", - "conditions": [ - "Shopping assistant use only", - "No customer data training", - "Preserve product accuracy" - ], - "purpose": [ - "Product recommendation systems", - "Shopping chatbots", - "Size/fit assistants" - ] - }, - - "commercial_training": { - "status": "conditional", - "conditions": [ - "Competitor price scraping prohibited", - "No customer data use", - "Consider partnership for product data API", - "Respect brand trademark rights" - ] - } - }, - - "enforcement": { - "mechanism": "http_430", - "contact_before_litigation": true, - "preferred_resolution": "partnership or API licensing discussion", - "note": "Competitive scraping and customer data violations will be pursued legally" - }, - - "metadata": { - "organization": "E-commerce Retail Inc.", - "created": "2025-07-20", - "business_model": "Online retail" - }, - - "philosophy": { - "core_principle": "We support AI shopping tools that help customers, but protect customer privacy and competitive business data.", - "values": [ - "Customer privacy", - "Fair competition", - "Product discovery", - "Brand integrity" - ] - } -} -``` - ---- - -## Implementation Notes - -### How to Choose Your Scenario - -Consider: -1. **Content Type**: Creative work, factual information, commercial data, personal data? -2. **Business Model**: Subscription, advertising, free access, commercial products? -3. **Legal Obligations**: HIPAA, FERPA, attorney-client privilege, copyright? -4. **Ethical Stance**: Open knowledge sharing vs. IP protection? -5. **Community Values**: Academic openness, artistic integrity, civic engagement? - -### Customization Tips - -1. **Start with a template** closest to your use case -2. **Adjust policy statuses** based on your specific boundaries -3. **Add conditions** that reflect your requirements -4. **Set appropriate scope** for different content sections -5. **Define exceptions** for special cases -6. **Update contact** and metadata fields -7. **Articulate your philosophy** to provide context - -### Validation - -Validate your manifest against the JSON Schema: - -```bash -# Using ajv-cli -npm install -g ajv-cli -ajv validate -s ../../schemas/aibdp-schema-v0.2.json -d your-manifest.json - -# Using Python jsonschema -python -c " -import json -import jsonschema -with open('../../schemas/aibdp-schema-v0.2.json') as schema_file: - schema = json.load(schema_file) -with open('your-manifest.json') as manifest_file: - manifest = json.load(manifest_file) -jsonschema.validate(manifest, schema) -print('Valid!') -" -``` - ---- - -## Contributing More Examples - -Have a unique use case? Submit a PR with: -- Complete manifest JSON -- Scenario description -- Rationale for policy choices -- Implementation notes - ---- - -_"Without refusal, permission is meaningless. These examples demonstrate that boundary-setting is as diverse as the web itself."_ diff --git a/consent-aware-http/examples/reference-implementations/deno/README.md b/consent-aware-http/examples/reference-implementations/deno/README.md deleted file mode 100644 index b100df68..00000000 --- a/consent-aware-http/examples/reference-implementations/deno/README.md +++ /dev/null @@ -1,193 +0,0 @@ -# AIBDP + HTTP 430 Middleware for Deno - -Reference implementation of the AI Boundary Declaration Protocol (AIBDP) with HTTP 430 (Consent Required) enforcement for Deno servers. This is a port of the former Python/Flask reference implementation — Python is banned across the Hyperpolymath estate; Deno is the standard runtime. - -## Features - -- **AIBDP Manifest Parsing**: Load and cache `.well-known/aibdp.json` -- **AI System Detection**: Identify AI user-agents (GPTBot, Claude-Web, etc.) -- **Policy Enforcement**: Block or allow based on declared boundaries -- **HTTP 430 Responses**: Standards-compliant consent violation responses -- **Path Scoping**: Glob-pattern matching for granular control -- **Conditional Policies**: Check for consent headers and conditions -- **Automatic Caching**: Manifest caching with configurable TTL -- **ES modules**: Importable, framework-free (`Deno.serve`) -- **Wrapper Support**: `aibdpRequired()` for route-specific protection - -## Installation - -No installation step — Deno fetches dependencies on first run. Requires [Deno](https://deno.land/) 1.40+. - -## Quick Start - -### Basic Usage - -```javascript -import { AIBDPMiddleware, serveManifest } from "./aibdp_middleware.js"; - -const middleware = new AIBDPMiddleware({ - manifestPath: ".well-known/aibdp.json", -}); - -const manifest = serveManifest(); - -const handler = middleware.wrap((req) => { - const { pathname } = new URL(req.url); - if (pathname === "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/.well-known/aibdp.json") return manifest(); - return new Response("Hello, consent-aware world!"); -}); - -Deno.serve({ port: 5000 }, handler); -``` - -### Run Example Server - -```bash -deno run --allow-read --allow-net example_server.js -``` - -Then test with: - -```bash -# Normal browser access (allowed) -curl http://localhost:5000/ - -# AI bot access (may be blocked based on manifest) -curl http://localhost:5000/article -H "User-Agent: GPTBot/1.0" - -# View AIBDP manifest -curl http://localhost:5000/.well-known/aibdp.json -``` - -## API Reference - -### `AIBDPMiddleware` - -Middleware class for AIBDP enforcement. - -**Constructor:** - -```javascript -new AIBDPMiddleware({ - manifestPath = ".well-known/aibdp.json", - enforceForAll = false, - onViolation = null, -}) -``` - -- `manifestPath` (string): Path to AIBDP manifest file -- `enforceForAll` (boolean): Enforce for all requests, not just AI bots -- `onViolation` (function): Callback `(req, policy, purpose) => void` when a violation is detected - -`middleware.wrap(handler)` returns a `Deno.serve` handler that returns an HTTP 430 `Response` on violation, otherwise delegates to `handler`. - -### `serveManifest(manifestPath)` - -Returns a handler that serves the AIBDP manifest (`application/aibdp+json`, cached, CORS-open), or a 404 JSON response if the manifest is missing. - -### `aibdpRequired(handler, { manifestPath, purpose })` - -Wrap a single route handler with AIBDP enforcement for a given `purpose` (e.g. `"training"`). Returns HTTP 430 if the purpose is refused or conditional requirements are not met. - -### Utility Functions - -- `isAiUserAgent(userAgent)` → boolean -- `extractAiPurpose(headers)` → string (`headers` may be a `Headers` instance or a plain object) -- `pathMatches(requestPath, pattern)` → boolean (glob: `**` = any, `*` = non-slash, `?` = one char) -- `getApplicablePolicy(manifest, purpose, requestPath)` → policy object or `null` -- `checkPolicyConditions(policy, headers)` → `[satisfied, missing[]]` -- `create430Response(manifest, policy, purpose, extra?)` → `Response` - -## Manifest Format - -Example `.well-known/aibdp.json`: - -```json -{ - "aibdp_version": "0.2", - "contact": "mailto:policy@example.org", - "policies": { - "training": { - "status": "conditional", - "conditions": ["Attribution required", "Non-commercial use only"], - "scope": ["/articles/**"] - }, - "indexing": { "status": "allowed", "scope": "all" }, - "generation": { - "status": "refused", - "rationale": "Content should not be synthetically replicated" - } - } -} -``` - -### Policy Status Values - -- `allowed`: Usage permitted without conditions -- `refused`: Usage explicitly prohibited -- `conditional`: Usage permitted if conditions met -- `encouraged`: Usage actively encouraged - -## HTTP 430 Response Format - -```http -HTTP/1.1 430 Consent Required -Content-Type: application/json -Link: ; rel="blocked-by-consent" -Retry-After: 86400 - -{ - "error": "AI usage boundaries declared in AIBDP manifest not satisfied", - "manifest": "https://example.org/.well-known/aibdp.json", - "violated_policy": "training", - "policy_status": "refused", - "required_conditions": [], - "rationale": "Content should not be used for training", - "contact": "mailto:policy@example.org" -} -``` - -## AI Consent Headers - -AI systems can indicate compliance by sending: - -```http -GET /article HTTP/1.1 -Host: example.org -User-Agent: ResearchBot/1.0 -AI-Purpose: indexing -AI-Consent-Reviewed: https://example.org/.well-known/aibdp.json -AI-Consent-Conditions: attribution,non-commercial -``` - -The middleware checks for these headers when enforcing conditional policies. - -## Deployment Considerations - -- ✅ Create AIBDP manifest at `.well-known/aibdp.json` -- ✅ Set appropriate `expires` field in manifest (30–90 days recommended) -- ✅ Provide contact information for policy questions -- ✅ Monitor logs for violations -- ✅ Enable HTTPS for manifest integrity -- ✅ Manifest is cached in memory (default: 1 hour) -- ✅ Failed manifest loads fail open (don't break the site) - -## Standards Compliance - -- [draft-jewell-aibdp-00](https://github.com/Hyperpolymath/consent-aware-http/blob/main/drafts/draft-jewell-aibdp-00.xml) — AIBDP specification -- [draft-jewell-http-430-consent-required-00](https://github.com/Hyperpolymath/consent-aware-http/blob/main/draft-jewell-http-430-consent-required-00.xml) — HTTP 430 status code -- [RFC 8615](https://www.rfc-editor.org/info/rfc8615) — Well-Known URIs -- [RFC 8259](https://www.rfc-editor.org/info/rfc8259) — JSON format - -## License - -MIT License — see LICENSE file for details. - -## Related Projects - -- [AIBDP Specification](https://github.com/Hyperpolymath/consent-aware-http) -- [Node.js Implementation](../nodejs/) - ---- - -_"Without refusal, permission is meaningless."_ diff --git a/consent-aware-http/examples/reference-implementations/deno/aibdp_middleware.js b/consent-aware-http/examples/reference-implementations/deno/aibdp_middleware.js deleted file mode 100644 index 7246f3aa..00000000 --- a/consent-aware-http/examples/reference-implementations/deno/aibdp_middleware.js +++ /dev/null @@ -1,264 +0,0 @@ -// SPDX-License-Identifier: MIT OR GPL-3.0-or-later -// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell -// -// AIBDP + HTTP 430 middleware for Deno (port of the former Python/Flask -// reference implementation; Python is banned estate-wide). -// -// Implements AI Boundary Declaration Protocol (AIBDP) enforcement with -// HTTP 430 (Consent Required) responses for `Deno.serve` handlers. - -// AI User-Agent patterns for detection -const AI_USER_AGENTS = [ - /GPTBot/i, - /ChatGPT-User/i, - /Claude-Web/i, - /anthropic-ai/i, - /Google-Extended/i, - /CCBot/i, - /Googlebot/i, - /Bingbot/i, - /Slurp/i, - /DuckDuckBot/i, - /Baiduspider/i, - /YandexBot/i, - /PerplexityBot/i, - /Diffbot/i, -]; - -// AIBDP manifest loader with TTL cache. -export class AIBDPManifest { - constructor(manifestPath, cacheDurationSeconds = 3600) { - this.manifestPath = manifestPath; - this.cacheDuration = cacheDurationSeconds; - this._manifest = null; - this._loadTime = null; - } - - load() { - const now = Date.now(); - if (this._manifest && this._loadTime !== null) { - if ((now - this._loadTime) / 1000 < this.cacheDuration) { - return this._manifest; - } - } - try { - const text = Deno.readTextFileSync(this.manifestPath); - this._manifest = JSON.parse(text); - this._loadTime = now; - return this._manifest; - } catch (e) { - if (e instanceof Deno.errors.NotFound) return null; - console.log(`Warning: Failed to load AIBDP manifest: ${e}`); - return null; - } - } - - get manifest() { - return this.load(); - } -} - -export function isAiUserAgent(userAgent) { - if (!userAgent) return false; - return AI_USER_AGENTS.some((p) => p.test(userAgent)); -} - -// `headers` may be a Headers instance or a plain object. -function headerGet(headers, name) { - if (headers instanceof Headers) return headers.get(name); - if (name in headers) return headers[name]; - // case-insensitive fallback for plain objects - const lower = name.toLowerCase(); - for (const k of Object.keys(headers)) { - if (k.toLowerCase() === lower) return headers[k]; - } - return null; -} - -function headerHas(headers, name) { - return headerGet(headers, name) !== null && headerGet(headers, name) !== undefined; -} - -export function extractAiPurpose(headers) { - const explicit = headerGet(headers, "AI-Purpose"); - if (explicit) return String(explicit).toLowerCase(); - - const ua = headerGet(headers, "User-Agent") || ""; - if (/GPTBot/i.test(ua)) return "training"; - if (/Claude-Web/i.test(ua)) return "indexing"; - if (/Google-Extended/i.test(ua)) return "training"; - if (/Googlebot/i.test(ua)) return "indexing"; - return "unknown"; -} - -export function pathMatches(requestPath, pattern) { - if (pattern === "all") return true; - // Match the Python sequential-replace glob translation exactly. - const regexPattern = pattern - .replaceAll(".", "\\.") - .replaceAll("**", ".*") - .replaceAll("*", "[^/]*") - .replaceAll("?", "."); - return new RegExp(`^${regexPattern}$`).test(requestPath); -} - -export function getApplicablePolicy(manifest, purpose, requestPath) { - if (!manifest || !("policies" in manifest)) return null; - const policy = manifest.policies[purpose]; - if (!policy) return null; - - const scope = policy.scope; - if (scope) { - if (Array.isArray(scope)) { - if (!scope.some((pat) => pathMatches(requestPath, pat))) return null; - } - // scope: "all" always matches - } - - for (const exception of policy.exceptions ?? []) { - if (pathMatches(requestPath, exception.path)) return exception; - } - - return policy; -} - -export function checkPolicyConditions(policy, headers) { - if (policy.status !== "conditional") return [true, []]; - const conditions = policy.conditions ?? []; - if (conditions.length === 0) return [true, []]; - - const missing = []; - if (!headerHas(headers, "AI-Consent-Reviewed")) { - missing.push("AI-Consent-Reviewed header required"); - } - if (!headerHas(headers, "AI-Consent-Conditions")) { - missing.push("AI-Consent-Conditions header required"); - } - return [missing.length === 0, missing]; -} - -export function create430Response(manifest, policy, purpose, extra = {}) { - const manifestUri = manifest.canonical_uri ?? "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/.well-known/aibdp.json"; - const body = { - error: "AI usage boundaries declared in AIBDP manifest not satisfied", - manifest: manifestUri, - violated_policy: purpose, - policy_status: policy.status, - required_conditions: policy.conditions ?? [], - rationale: policy.rationale ?? "No additional information provided", - contact: manifest.contact ?? null, - ...extra, - }; - return new Response(JSON.stringify(body), { - status: 430, - headers: { - "Content-Type": "application/json", - "Link": `<${manifestUri}>; rel="blocked-by-consent"`, - "Retry-After": "86400", - }, - }); -} - -// Flask-style middleware: wrap a `Deno.serve` handler. -export class AIBDPMiddleware { - constructor({ - manifestPath = ".well-known/aibdp.json", - enforceForAll = false, - onViolation = null, - } = {}) { - this.manifestLoader = new AIBDPManifest(manifestPath); - this.enforceForAll = enforceForAll; - this.onViolation = onViolation; - } - - // Returns a Response (HTTP 430) when a violation is detected, else null. - beforeRequest(req) { - try { - const manifest = this.manifestLoader.manifest; - if (!manifest) return null; - - const userAgent = req.headers.get("User-Agent") || ""; - const isAi = this.enforceForAll || isAiUserAgent(userAgent); - if (!isAi) return null; - - const purpose = extractAiPurpose(req.headers); - const path = new URL(req.url).pathname; - const policy = getApplicablePolicy(manifest, purpose, path); - if (!policy) return null; - - if (policy.status === "refused") { - this.onViolation?.(req, policy, purpose); - return create430Response(manifest, policy, purpose); - } - - if (policy.status === "conditional") { - const [satisfied, missing] = checkPolicyConditions(policy, req.headers); - if (!satisfied) { - this.onViolation?.(req, policy, purpose); - return create430Response(manifest, policy, purpose, { - missing_conditions: missing, - }); - } - } - return null; - } catch (e) { - console.log(`AIBDP middleware error: ${e}`); - return null; // fail open — don't break the site - } - } - - wrap(handler) { - return (req, info) => { - const blocked = this.beforeRequest(req); - if (blocked) return blocked; - return handler(req, info); - }; - } -} - -export function serveManifest(manifestPath = ".well-known/aibdp.json") { - const loader = new AIBDPManifest(manifestPath); - return () => { - const manifest = loader.manifest; - if (!manifest) { - return new Response(JSON.stringify({ error: "Manifest not found" }), { - status: 404, - headers: { "Content-Type": "application/json" }, - }); - } - return new Response(JSON.stringify(manifest), { - headers: { - "Content-Type": "application/aibdp+json", - "Cache-Control": "public, max-age=3600", - "Access-Control-Allow-Origin": "*", - }, - }); - }; -} - -export function aibdpRequired( - handler, - { manifestPath = ".well-known/aibdp.json", purpose = "unknown" } = {}, -) { - const loader = new AIBDPManifest(manifestPath); - return (req, info) => { - const manifest = loader.manifest; - if (!manifest) return handler(req, info); - - const userAgent = req.headers.get("User-Agent") || ""; - if (!isAiUserAgent(userAgent)) return handler(req, info); - - const path = new URL(req.url).pathname; - const policy = getApplicablePolicy(manifest, purpose, path); - if (!policy) return handler(req, info); - - if (policy.status === "refused") { - return create430Response(manifest, policy, purpose); - } - if (policy.status === "conditional") { - const [satisfied] = checkPolicyConditions(policy, req.headers); - if (!satisfied) return create430Response(manifest, policy, purpose); - } - return handler(req, info); - }; -} diff --git a/consent-aware-http/examples/reference-implementations/deno/example-aibdp.json b/consent-aware-http/examples/reference-implementations/deno/example-aibdp.json deleted file mode 100644 index 368d5c47..00000000 --- a/consent-aware-http/examples/reference-implementations/deno/example-aibdp.json +++ /dev/null @@ -1,120 +0,0 @@ -{ - "aibdp_version": "0.2", - "canonical_uri": "http://localhost:3000/.well-known/aibdp.json", - "contact": "mailto:admin@example.org", - "expires": "2026-07-20T23:59:59Z", - "policy_uri": "http://localhost:3000/ai-policy", - - "policies": { - "training": { - "status": "conditional", - "conditions": [ - "Attribution required to 'Example Organization'", - "Non-commercial use only", - "Preserve context and source links" - ], - "scope": ["/article.html", "/docs/**"], - "exceptions": [ - { - "path": "/public.html", - "status": "allowed", - "note": "Public domain content, no restrictions" - } - ] - }, - - "indexing": { - "status": "allowed", - "scope": "all", - "note": "Full indexing permitted for search and discovery" - }, - - "summarization": { - "status": "allowed", - "conditions": ["Maintain accuracy", "Cite source URL"] - }, - - "question_answering": { - "status": "allowed", - "conditions": ["Cite source with URL"], - "note": "RAG systems may reference this content" - }, - - "generation": { - "status": "refused", - "rationale": "Content should not be synthetically replicated or used to generate derivative works", - "alternatives": "Link to original content with attribution instead" - }, - - "fine_tuning": { - "status": "encouraged", - "purpose": [ - "Educational tools", - "Accessibility features", - "Translation services" - ], - "note": "Fine-tuning for user benefit is encouraged" - }, - - "embedding": { - "status": "allowed", - "conditions": ["For semantic search and retrieval only"] - }, - - "commercial_training": { - "status": "conditional", - "conditions": [ - "Attribution in model documentation", - "Financial contribution to project", - "Do not claim content as proprietary" - ], - "note": "Commercial AI development requires transparent attribution" - } - }, - - "scope": { - "applies_to": [ - "LLM training and fine-tuning", - "Search engine indexing", - "RAG systems", - "Code completion tools", - "Documentation summarization" - ] - }, - - "special_provisions": { - "academic_research": { - "status": "unrestricted", - "note": "All content available for academic research. Please cite properly." - }, - - "educational_use": { - "status": "encouraged", - "note": "Use in courses and tutorials is strongly encouraged with attribution" - } - }, - - "enforcement": { - "mechanism": "http_430", - "note": "Violations result in HTTP 430 Consent Required responses", - "contact_before_litigation": true, - "preferred_resolution": "dialogue and boundary clarification" - }, - - "metadata": { - "created": "2025-07-20", - "last_modified": "2025-07-20", - "author": "Example Organization", - "organization": "Example Org", - "project": "Consent-Aware HTTP Example" - }, - - "philosophy": { - "core_principle": "Without refusal, permission is meaningless", - "values": [ - "Declarative refusal as care", - "Transparent infrastructure", - "Pro-boundary, not anti-AI" - ] - } -} diff --git a/consent-aware-http/examples/reference-implementations/deno/example_server.js b/consent-aware-http/examples/reference-implementations/deno/example_server.js deleted file mode 100644 index ed1a3643..00000000 --- a/consent-aware-http/examples/reference-implementations/deno/example_server.js +++ /dev/null @@ -1,152 +0,0 @@ -#!/usr/bin/env -S deno run --allow-read --allow-net -// SPDX-License-Identifier: MIT OR GPL-3.0-or-later -// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell -// -// Example Deno server demonstrating AIBDP + HTTP 430 middleware (port of -// the former Python/Flask example; Python is banned estate-wide). -// -// Usage: -// deno run --allow-read --allow-net example_server.js -// -// Test with: -// curl http://localhost:5000/ -// curl http://localhost:5000/article -H "User-Agent: GPTBot/1.0" -// curl http://localhost:5000/.well-known/aibdp.json - -import { - aibdpRequired, - AIBDPMiddleware, - serveManifest, -} from "./aibdp_middleware.js"; - -const MANIFEST = "example-aibdp.json"; - -const middleware = new AIBDPMiddleware({ - manifestPath: MANIFEST, - enforceForAll: false, // only enforce for detected AI systems - onViolation: (req, policy, purpose) => { - const url = new URL(req.url); - console.log( - `[AIBDP] Blocked: ${req.method} ${url.pathname}\n` + - ` User-Agent: ${req.headers.get("User-Agent")}\n` + - ` Purpose: ${purpose}\n` + - ` Policy: ${policy.status}`, - ); - }, -}); - -const manifestHandler = serveManifest(MANIFEST); - -function html(body) { - return new Response(body, { headers: { "Content-Type": "text/html" } }); -} - -const indexPage = html(` - - - Consent-Aware HTTP Example (Deno) - - -

Welcome to Consent-Aware HTTP

-

This Deno server implements HTTP 430 + AIBDP.

- -

Try these requests:

-
    -
  • curl http://localhost:5000/ - Normal access (allowed)
    • -
  • curl http://localhost:5000/article -H "User-Agent: GPTBot/1.0" - AI bot (may be blocked)
    • -
  • curl http://localhost:5000/.well-known/aibdp.json - View AIBDP manifest
    • -
- -

Resources:

- - - - `); - -const articlePage = () => - html(` - - - Protected Article - - -

Protected Article

-

This content has AI usage boundaries declared via AIBDP.

-

Training: Conditional (requires attribution)

-

Generation: Refused

-

Indexing: Allowed

- - - `); - -const publicPage = html(` - - - Public Content - - -

Public Content

-

This content is available for all purposes, including AI training.

- - - `); - -const protectedHandler = aibdpRequired( - () => - html(` - - - Protected Route - - -

Protected Route (Decorator)

-

This route uses the aibdpRequired wrapper.

-

AI training is not permitted on this content.

- - - `), - { manifestPath: MANIFEST, purpose: "training" }, -); - -function route(req) { - const { pathname } = new URL(req.url); - switch (pathname) { - case "/": - return indexPage; - case "/article": - return articlePage(); - case "/public": - return publicPage; - case "/protected": - return protectedHandler(req); - case "/health": - return Response.json({ - status: "healthy", - aibdp_enabled: true, - http_430_enabled: true, - }); - case "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/.well-known/aibdp.json": - return manifestHandler(); - default: - return new Response("Not Found", { status: 404 }); - } -} - -const handler = middleware.wrap(route); - -console.log("🚀 Consent-Aware HTTP server (Deno) running on http://localhost:5000"); -console.log("📄 AIBDP manifest: http://localhost:5000/.well-known/aibdp.json"); -console.log("🛡️ HTTP 430 enforcement: ENABLED"); -console.log(""); -console.log("Try these commands:"); -console.log(" curl http://localhost:5000/"); -console.log(' curl http://localhost:5000/article -H "User-Agent: GPTBot/1.0"'); -console.log(" curl http://localhost:5000/.well-known/aibdp.json"); -console.log(""); - -Deno.serve({ port: 5000 }, handler); diff --git a/consent-aware-http/examples/reference-implementations/nodejs/README.md b/consent-aware-http/examples/reference-implementations/nodejs/README.md deleted file mode 100644 index 99511892..00000000 --- a/consent-aware-http/examples/reference-implementations/nodejs/README.md +++ /dev/null @@ -1,295 +0,0 @@ -# AIBDP + HTTP 430 Middleware for Express.js - -Reference implementation of the AI Boundary Declaration Protocol (AIBDP) with HTTP 430 (Consent Required) enforcement for Node.js/Express applications. - -## Features - -- **AIBDP Manifest Parsing**: Load and cache `/.well-known/aibdp.json` -- **AI System Detection**: Identify AI user-agents (GPTBot, Claude-Web, etc.) -- **Policy Enforcement**: Block or allow based on declared boundaries -- **HTTP 430 Responses**: Standards-compliant consent violation responses -- **Path Scoping**: Glob-pattern matching for granular control -- **Conditional Policies**: Check for consent headers and conditions -- **Automatic Caching**: Manifest caching with configurable TTL - -## Installation - -```bash -npm install -``` - -## Quick Start - -### Basic Usage - -```javascript -import express from 'express'; -import { aibdpMiddleware, serveManifest } from './index.js'; - -const app = express(); - -// Serve AIBDP manifest -app.use(serveManifest('.well-known/aibdp.json')); - -// Apply AIBDP enforcement -app.use(aibdpMiddleware({ - manifestPath: '.well-known/aibdp.json' -})); - -// Your routes -app.get('/', (req, res) => { - res.send('Hello, consent-aware world!'); -}); - -app.listen(3000); -``` - -### Run Example Server - -```bash -node example-server.js -``` - -Then test with: - -```bash -# Normal browser access (allowed) -curl http://localhost:3000/ - -# AI bot access (may be blocked based on manifest) -curl http://localhost:3000/article.html -H "User-Agent: GPTBot/1.0" - -# View AIBDP manifest -curl http://localhost:3000/.well-known/aibdp.json -``` - -## API Reference - -### `aibdpMiddleware(options)` - -Creates Express middleware for AIBDP enforcement. - -**Options:** - -- `manifestPath` (string): Path to AIBDP manifest file. Default: `.well-known/aibdp.json` -- `enforceForAll` (boolean): Enforce for all requests, not just AI bots. Default: `false` -- `onViolation` (function): Callback when violation detected. Signature: `(req, policy, purpose) => {}` - -**Returns:** Express middleware function - -**Example:** - -```javascript -app.use(aibdpMiddleware({ - manifestPath: './my-aibdp.json', - enforceForAll: false, - onViolation: (req, policy, purpose) => { - console.log(`Blocked ${purpose} from ${req.ip}`); - } -})); -``` - -### `serveManifest(manifestPath)` - -Creates middleware to serve AIBDP manifest at `/.well-known/aibdp.json`. - -**Arguments:** - -- `manifestPath` (string): Path to manifest file - -**Returns:** Express middleware function - -**Example:** - -```javascript -app.use(serveManifest('./aibdp.json')); -``` - -### Utility Functions - -#### `isAIUserAgent(userAgent)` - -Check if User-Agent header indicates an AI system. - -```javascript -import { isAIUserAgent } from './index.js'; - -if (isAIUserAgent('GPTBot/1.0')) { - console.log('AI system detected'); -} -``` - -#### `extractAIPurpose(headers)` - -Extract AI purpose from request headers (training, indexing, etc.). - -```javascript -import { extractAIPurpose } from './index.js'; - -const purpose = extractAIPurpose({ - 'user-agent': 'GPTBot/1.0', - 'ai-purpose': 'training' -}); -console.log(purpose); // 'training' -``` - -#### `pathMatches(requestPath, pattern)` - -Check if request path matches glob pattern from manifest. - -```javascript -import { pathMatches } from './index.js'; - -pathMatches('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/docs/guide.html', '/docs/**'); // true -pathMatches('/article.pdf', '*.pdf'); // true -pathMatches('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/blog/post.html', '/docs/**'); // false -``` - -## Manifest Format - -Example `.well-known/aibdp.json`: - -```json -{ - "aibdp_version": "0.2", - "contact": "mailto:policy@example.org", - "policies": { - "training": { - "status": "conditional", - "conditions": ["Attribution required", "Non-commercial use only"], - "scope": ["/articles/**"] - }, - "indexing": { - "status": "allowed", - "scope": "all" - }, - "generation": { - "status": "refused", - "rationale": "Content should not be synthetically replicated" - } - } -} -``` - -### Policy Status Values - -- `allowed`: Usage permitted without conditions -- `refused`: Usage explicitly prohibited -- `conditional`: Usage permitted if conditions met -- `encouraged`: Usage actively encouraged - -## HTTP 430 Response Format - -When a policy is violated, the middleware responds with HTTP 430: - -```http -HTTP/1.1 430 Consent Required -Content-Type: application/json -Link: ; rel="blocked-by-consent" -Retry-After: 86400 - -{ - "error": "AI usage boundaries declared in AIBDP manifest not satisfied", - "manifest": "https://example.org/.well-known/aibdp.json", - "violated_policy": "training", - "policy_status": "refused", - "required_conditions": [], - "rationale": "Content should not be used for training", - "contact": "mailto:policy@example.org" -} -``` - -## AI Consent Headers - -AI systems can indicate compliance by sending: - -```http -GET /article.html HTTP/1.1 -Host: example.org -User-Agent: ResearchBot/1.0 -AI-Purpose: indexing -AI-Consent-Reviewed: https://example.org/.well-known/aibdp.json -AI-Consent-Conditions: attribution,non-commercial -``` - -The middleware checks for these headers when enforcing conditional policies. - -## Detected AI User-Agents - -The middleware detects the following AI systems: - -- GPTBot (OpenAI) -- ChatGPT-User -- Claude-Web (Anthropic) -- Google-Extended -- CCBot (Common Crawl) -- Bingbot, Googlebot (when used for AI training) -- PerplexityBot -- Diffbot -- And more... - -## Testing - -Run tests: - -```bash -npm test -``` - -## Deployment Considerations - -### Production Checklist - -- ✅ Create AIBDP manifest at `/.well-known/aibdp.json` -- ✅ Set appropriate `expires` field in manifest (30-90 days recommended) -- ✅ Provide contact information for policy questions -- ✅ Monitor logs for violations -- ✅ Set up manifest validation in CI/CD -- ✅ Consider HTTPS + signatures for high-value content -- ✅ Document rationale in human-readable policy page - -### Performance - -- Manifest is cached in memory (default: 1 hour) -- Minimal latency impact for non-AI requests -- Failed manifest loads fail open (don't break site) -- Pattern matching is optimized with regex compilation - -### Security - -- Manifest served over HTTPS prevents tampering -- JSON parsing errors fail gracefully -- No sensitive information in manifest -- Signature verification supported (future) - -## Standards Compliance - -This implementation follows: - -- [draft-jewell-aibdp-00](https://github.com/Hyperpolymath/consent-aware-http/blob/main/drafts/draft-jewell-aibdp-00.xml) - AIBDP specification -- [draft-jewell-http-430-consent-required-00](https://github.com/Hyperpolymath/consent-aware-http/blob/main/draft-jewell-http-430-consent-required-00.xml) - HTTP 430 status code -- [RFC 8615](https://www.rfc-editor.org/info/rfc8615) - Well-Known URIs -- [RFC 8259](https://www.rfc-editor.org/info/rfc8259) - JSON format - -## License - -MIT License - see LICENSE file for details - -## Contributing - -See [CONTRIBUTING.md](../../../.github/CONTRIBUTING.md) in the main repository. - -## Support - -- **Issues**: https://github.com/Hyperpolymath/consent-aware-http/issues -- **Discussions**: https://github.com/Hyperpolymath/consent-aware-http/discussions -- **Email**: jonathan@metadatastician.art - -## Related Projects - -- [AIBDP Specification](https://github.com/Hyperpolymath/consent-aware-http) -- [Deno Implementation](../deno/) - ---- - -_"Without refusal, permission is meaningless."_ diff --git a/consent-aware-http/examples/reference-implementations/nodejs/example-aibdp.json b/consent-aware-http/examples/reference-implementations/nodejs/example-aibdp.json deleted file mode 100644 index 368d5c47..00000000 --- a/consent-aware-http/examples/reference-implementations/nodejs/example-aibdp.json +++ /dev/null @@ -1,120 +0,0 @@ -{ - "aibdp_version": "0.2", - "canonical_uri": "http://localhost:3000/.well-known/aibdp.json", - "contact": "mailto:admin@example.org", - "expires": "2026-07-20T23:59:59Z", - "policy_uri": "http://localhost:3000/ai-policy", - - "policies": { - "training": { - "status": "conditional", - "conditions": [ - "Attribution required to 'Example Organization'", - "Non-commercial use only", - "Preserve context and source links" - ], - "scope": ["/article.html", "/docs/**"], - "exceptions": [ - { - "path": "/public.html", - "status": "allowed", - "note": "Public domain content, no restrictions" - } - ] - }, - - "indexing": { - "status": "allowed", - "scope": "all", - "note": "Full indexing permitted for search and discovery" - }, - - "summarization": { - "status": "allowed", - "conditions": ["Maintain accuracy", "Cite source URL"] - }, - - "question_answering": { - "status": "allowed", - "conditions": ["Cite source with URL"], - "note": "RAG systems may reference this content" - }, - - "generation": { - "status": "refused", - "rationale": "Content should not be synthetically replicated or used to generate derivative works", - "alternatives": "Link to original content with attribution instead" - }, - - "fine_tuning": { - "status": "encouraged", - "purpose": [ - "Educational tools", - "Accessibility features", - "Translation services" - ], - "note": "Fine-tuning for user benefit is encouraged" - }, - - "embedding": { - "status": "allowed", - "conditions": ["For semantic search and retrieval only"] - }, - - "commercial_training": { - "status": "conditional", - "conditions": [ - "Attribution in model documentation", - "Financial contribution to project", - "Do not claim content as proprietary" - ], - "note": "Commercial AI development requires transparent attribution" - } - }, - - "scope": { - "applies_to": [ - "LLM training and fine-tuning", - "Search engine indexing", - "RAG systems", - "Code completion tools", - "Documentation summarization" - ] - }, - - "special_provisions": { - "academic_research": { - "status": "unrestricted", - "note": "All content available for academic research. Please cite properly." - }, - - "educational_use": { - "status": "encouraged", - "note": "Use in courses and tutorials is strongly encouraged with attribution" - } - }, - - "enforcement": { - "mechanism": "http_430", - "note": "Violations result in HTTP 430 Consent Required responses", - "contact_before_litigation": true, - "preferred_resolution": "dialogue and boundary clarification" - }, - - "metadata": { - "created": "2025-07-20", - "last_modified": "2025-07-20", - "author": "Example Organization", - "organization": "Example Org", - "project": "Consent-Aware HTTP Example" - }, - - "philosophy": { - "core_principle": "Without refusal, permission is meaningless", - "values": [ - "Declarative refusal as care", - "Transparent infrastructure", - "Pro-boundary, not anti-AI" - ] - } -} diff --git a/consent-aware-http/examples/reference-implementations/nodejs/package.json b/consent-aware-http/examples/reference-implementations/nodejs/package.json deleted file mode 100644 index 693b96df..00000000 --- a/consent-aware-http/examples/reference-implementations/nodejs/package.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "name": "aibdp-http430-middleware", - "version": "0.2.0", - "description": "Express middleware for AIBDP (AI Boundary Declaration Protocol) and HTTP 430 enforcement", - "main": "index.js", - "type": "module", - "scripts": { - "start": "node example-server.js", - "test": "node test.js", - "validate": "node validate-manifest.js .well-known/aibdp.json" - }, - "keywords": [ - "aibdp", - "http-430", - "consent", - "ai-boundaries", - "express", - "middleware" - ], - "author": "Jonathan D.A. Jewell ", - "license": "MIT", - "repository": { - "type": "git", - "url": "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/Hyperpolymath/consent-aware-http.git" - }, - "dependencies": { - "express": "^4.18.0" - }, - "devDependencies": { - "ajv": "^8.12.0" - }, - "engines": { - "node": ">=18.0.0" - } -} diff --git a/consent-aware-http/examples/web-project-deno.json b/consent-aware-http/examples/web-project-deno.json deleted file mode 100644 index 5ddd3bd7..00000000 --- a/consent-aware-http/examples/web-project-deno.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "// NOTE": "Example deno.json for ReScript web projects", - "tasks": { - "build": "deno run -A npm:rescript", - "clean": "deno run -A npm:rescript clean", - "watch": "deno run -A npm:rescript -w", - "serve": "deno run -A jsr:@std/http/file-server .", - "test": "deno test --allow-all" - }, - "imports": { - "rescript": "^12.0.0", - "@rescript/core": "npm:@rescript/core@^1.6.0", - "safe-dom/": "https://raw.githubusercontent.com/hyperpolymath/rescript-dom-mounter/main/src/", - "proven/": "../proven/bindings/rescript/src/" - }, - "compilerOptions": { - "allowJs": true, - "checkJs": false - } -} diff --git a/consent-aware-http/ffi/zig/build.zig b/consent-aware-http/ffi/zig/build.zig deleted file mode 100644 index 4a2e049a..00000000 --- a/consent-aware-http/ffi/zig/build.zig +++ /dev/null @@ -1,94 +0,0 @@ -// {{PROJECT}} FFI Build Configuration -// SPDX-License-Identifier: MPL-2.0 - -const std = @import("std"); - -pub fn build(b: *std.Build) void { - const target = b.standardTargetOptions(.{}); - const optimize = b.standardOptimizeOption(.{}); - - // Shared library (.so, .dylib, .dll) - const lib = b.addSharedLibrary(.{ - .name = "{{project}}", - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = optimize, - }); - - // Set version - lib.version = .{ .major = 0, .minor = 1, .patch = 0 }; - - // Static library (.a) - const lib_static = b.addStaticLibrary(.{ - .name = "{{project}}", - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = optimize, - }); - - // Install artifacts - b.installArtifact(lib); - b.installArtifact(lib_static); - - // Generate header file for C compatibility - const header = b.addInstallHeader( - b.path("include/{{project}}.h"), - "{{project}}.h", - ); - b.getInstallStep().dependOn(&header.step); - - // Unit tests - const lib_tests = b.addTest(.{ - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = optimize, - }); - - const run_lib_tests = b.addRunArtifact(lib_tests); - - const test_step = b.step("test", "Run library tests"); - test_step.dependOn(&run_lib_tests.step); - - // Integration tests - const integration_tests = b.addTest(.{ - .root_source_file = b.path("test/integration_test.zig"), - .target = target, - .optimize = optimize, - }); - - integration_tests.linkLibrary(lib); - - const run_integration_tests = b.addRunArtifact(integration_tests); - - const integration_test_step = b.step("test-integration", "Run integration tests"); - integration_test_step.dependOn(&run_integration_tests.step); - - // Documentation - const docs = b.addTest(.{ - .root_source_file = b.path("src/main.zig"), - .target = target, - .optimize = .Debug, - }); - - const docs_step = b.step("docs", "Generate documentation"); - docs_step.dependOn(&b.addInstallDirectory(.{ - .source_dir = docs.getEmittedDocs(), - .install_dir = .prefix, - .install_subdir = "docs", - }).step); - - // Benchmark (if needed) - const bench = b.addExecutable(.{ - .name = "{{project}}-bench", - .root_source_file = b.path("bench/bench.zig"), - .target = target, - .optimize = .ReleaseFast, - }); - - bench.linkLibrary(lib); - - const run_bench = b.addRunArtifact(bench); - - const bench_step = b.step("bench", "Run benchmarks"); - bench_step.dependOn(&run_bench.step); -} diff --git a/consent-aware-http/ffi/zig/src/main.zig b/consent-aware-http/ffi/zig/src/main.zig deleted file mode 100644 index 6b233bc7..00000000 --- a/consent-aware-http/ffi/zig/src/main.zig +++ /dev/null @@ -1,274 +0,0 @@ -// {{PROJECT}} FFI Implementation -// -// This module implements the C-compatible FFI declared in src/abi/Foreign.idr -// All types and layouts must match the Idris2 ABI definitions. -// -// SPDX-License-Identifier: MPL-2.0 - -const std = @import("std"); - -// Version information (keep in sync with project) -const VERSION = "0.1.0"; -const BUILD_INFO = "{{PROJECT}} built with Zig " ++ @import("builtin").zig_version_string; - -/// Thread-local error storage -threadlocal var last_error: ?[]const u8 = null; - -/// Set the last error message -fn setError(msg: []const u8) void { - last_error = msg; -} - -/// Clear the last error -fn clearError() void { - last_error = null; -} - -//============================================================================== -// Core Types (must match src/abi/Types.idr) -//============================================================================== - -/// Result codes (must match Idris2 Result type) -pub const Result = enum(c_int) { - ok = 0, - @"error" = 1, - invalid_param = 2, - out_of_memory = 3, - null_pointer = 4, -}; - -/// Library handle (opaque to prevent direct access) -pub const Handle = opaque { - // Internal state hidden from C - allocator: std.mem.Allocator, - initialized: bool, - // Add your fields here -}; - -//============================================================================== -// Library Lifecycle -//============================================================================== - -/// Initialize the library -/// Returns a handle, or null on failure -export fn {{project}}_init() ?*Handle { - const allocator = std.heap.c_allocator; - - const handle = allocator.create(Handle) catch { - setError("Failed to allocate handle"); - return null; - }; - - // Initialize handle - handle.* = .{ - .allocator = allocator, - .initialized = true, - }; - - clearError(); - return handle; -} - -/// Free the library handle -export fn {{project}}_free(handle: ?*Handle) void { - const h = handle orelse return; - const allocator = h.allocator; - - // Clean up resources - h.initialized = false; - - allocator.destroy(h); - clearError(); -} - -//============================================================================== -// Core Operations -//============================================================================== - -/// Process data (example operation) -export fn {{project}}_process(handle: ?*Handle, input: u32) Result { - const h = handle orelse { - setError("Null handle"); - return .null_pointer; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return .@"error"; - } - - // Example processing logic - _ = input; - - clearError(); - return .ok; -} - -//============================================================================== -// String Operations -//============================================================================== - -/// Get a string result (example) -/// Caller must free the returned string -export fn {{project}}_get_string(handle: ?*Handle) ?[*:0]const u8 { - const h = handle orelse { - setError("Null handle"); - return null; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return null; - } - - // Example: allocate and return a string - const result = h.allocator.dupeZ(u8, "Example result") catch { - setError("Failed to allocate string"); - return null; - }; - - clearError(); - return result.ptr; -} - -/// Free a string allocated by the library -export fn {{project}}_free_string(str: ?[*:0]const u8) void { - const s = str orelse return; - const allocator = std.heap.c_allocator; - - const slice = std.mem.span(s); - allocator.free(slice); -} - -//============================================================================== -// Array/Buffer Operations -//============================================================================== - -/// Process an array of data -export fn {{project}}_process_array( - handle: ?*Handle, - buffer: ?[*]const u8, - len: u32, -) Result { - const h = handle orelse { - setError("Null handle"); - return .null_pointer; - }; - - const buf = buffer orelse { - setError("Null buffer"); - return .null_pointer; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return .@"error"; - } - - // Access the buffer - const data = buf[0..len]; - _ = data; - - // Process data here - - clearError(); - return .ok; -} - -//============================================================================== -// Error Handling -//============================================================================== - -/// Get the last error message -/// Returns null if no error -export fn {{project}}_last_error() ?[*:0]const u8 { - const err = last_error orelse return null; - - // Return C string (static storage, no need to free) - const allocator = std.heap.c_allocator; - const c_str = allocator.dupeZ(u8, err) catch return null; - return c_str.ptr; -} - -//============================================================================== -// Version Information -//============================================================================== - -/// Get the library version -export fn {{project}}_version() [*:0]const u8 { - return VERSION.ptr; -} - -/// Get build information -export fn {{project}}_build_info() [*:0]const u8 { - return BUILD_INFO.ptr; -} - -//============================================================================== -// Callback Support -//============================================================================== - -/// Callback function type (C ABI) -pub const Callback = *const fn (u64, u32) callconv(.C) u32; - -/// Register a callback -export fn {{project}}_register_callback( - handle: ?*Handle, - callback: ?Callback, -) Result { - const h = handle orelse { - setError("Null handle"); - return .null_pointer; - }; - - const cb = callback orelse { - setError("Null callback"); - return .null_pointer; - }; - - if (!h.initialized) { - setError("Handle not initialized"); - return .@"error"; - } - - // Store callback for later use - _ = cb; - - clearError(); - return .ok; -} - -//============================================================================== -// Utility Functions -//============================================================================== - -/// Check if handle is initialized -export fn {{project}}_is_initialized(handle: ?*Handle) u32 { - const h = handle orelse return 0; - return if (h.initialized) 1 else 0; -} - -//============================================================================== -// Tests -//============================================================================== - -test "lifecycle" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - try std.testing.expect({{project}}_is_initialized(handle) == 1); -} - -test "error handling" { - const result = {{project}}_process(null, 0); - try std.testing.expectEqual(Result.null_pointer, result); - - const err = {{project}}_last_error(); - try std.testing.expect(err != null); -} - -test "version" { - const ver = {{project}}_version(); - const ver_str = std.mem.span(ver); - try std.testing.expectEqualStrings(VERSION, ver_str); -} diff --git a/consent-aware-http/ffi/zig/test/integration_test.zig b/consent-aware-http/ffi/zig/test/integration_test.zig deleted file mode 100644 index 03419949..00000000 --- a/consent-aware-http/ffi/zig/test/integration_test.zig +++ /dev/null @@ -1,182 +0,0 @@ -// {{PROJECT}} Integration Tests -// SPDX-License-Identifier: MPL-2.0 -// -// These tests verify that the Zig FFI correctly implements the Idris2 ABI - -const std = @import("std"); -const testing = std.testing; - -// Import FFI functions -extern fn {{project}}_init() ?*opaque {}; -extern fn {{project}}_free(?*opaque {}) void; -extern fn {{project}}_process(?*opaque {}, u32) c_int; -extern fn {{project}}_get_string(?*opaque {}) ?[*:0]const u8; -extern fn {{project}}_free_string(?[*:0]const u8) void; -extern fn {{project}}_last_error() ?[*:0]const u8; -extern fn {{project}}_version() [*:0]const u8; -extern fn {{project}}_is_initialized(?*opaque {}) u32; - -//============================================================================== -// Lifecycle Tests -//============================================================================== - -test "create and destroy handle" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - try testing.expect(handle != null); -} - -test "handle is initialized" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const initialized = {{project}}_is_initialized(handle); - try testing.expectEqual(@as(u32, 1), initialized); -} - -test "null handle is not initialized" { - const initialized = {{project}}_is_initialized(null); - try testing.expectEqual(@as(u32, 0), initialized); -} - -//============================================================================== -// Operation Tests -//============================================================================== - -test "process with valid handle" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const result = {{project}}_process(handle, 42); - try testing.expectEqual(@as(c_int, 0), result); // 0 = ok -} - -test "process with null handle returns error" { - const result = {{project}}_process(null, 42); - try testing.expectEqual(@as(c_int, 4), result); // 4 = null_pointer -} - -//============================================================================== -// String Tests -//============================================================================== - -test "get string result" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const str = {{project}}_get_string(handle); - defer if (str) |s| {{project}}_free_string(s); - - try testing.expect(str != null); -} - -test "get string with null handle" { - const str = {{project}}_get_string(null); - try testing.expect(str == null); -} - -//============================================================================== -// Error Handling Tests -//============================================================================== - -test "last error after null handle operation" { - _ = {{project}}_process(null, 0); - - const err = {{project}}_last_error(); - try testing.expect(err != null); - - if (err) |e| { - const err_str = std.mem.span(e); - try testing.expect(err_str.len > 0); - } -} - -test "no error after successful operation" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - _ = {{project}}_process(handle, 0); - - // Error should be cleared after successful operation - // (This depends on implementation) -} - -//============================================================================== -// Version Tests -//============================================================================== - -test "version string is not empty" { - const ver = {{project}}_version(); - const ver_str = std.mem.span(ver); - - try testing.expect(ver_str.len > 0); -} - -test "version string is semantic version format" { - const ver = {{project}}_version(); - const ver_str = std.mem.span(ver); - - // Should be in format X.Y.Z - try testing.expect(std.mem.count(u8, ver_str, ".") >= 1); -} - -//============================================================================== -// Memory Safety Tests -//============================================================================== - -test "multiple handles are independent" { - const h1 = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(h1); - - const h2 = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(h2); - - try testing.expect(h1 != h2); - - // Operations on h1 should not affect h2 - _ = {{project}}_process(h1, 1); - _ = {{project}}_process(h2, 2); -} - -test "double free is safe" { - const handle = {{project}}_init() orelse return error.InitFailed; - - {{project}}_free(handle); - {{project}}_free(handle); // Should not crash -} - -test "free null is safe" { - {{project}}_free(null); // Should not crash -} - -//============================================================================== -// Thread Safety Tests (if applicable) -//============================================================================== - -test "concurrent operations" { - const handle = {{project}}_init() orelse return error.InitFailed; - defer {{project}}_free(handle); - - const ThreadContext = struct { - h: *opaque {}, - id: u32, - }; - - const thread_fn = struct { - fn run(ctx: ThreadContext) void { - _ = {{project}}_process(ctx.h, ctx.id); - } - }.run; - - var threads: [4]std.Thread = undefined; - for (&threads, 0..) |*thread, i| { - thread.* = try std.Thread.spawn(.{}, thread_fn, .{ - ThreadContext{ .h = handle, .id = @intCast(i) }, - }); - } - - for (threads) |thread| { - thread.join(); - } -} diff --git a/consent-aware-http/manifest.scm b/consent-aware-http/manifest.scm deleted file mode 100644 index dd942c7f..00000000 --- a/consent-aware-http/manifest.scm +++ /dev/null @@ -1,24 +0,0 @@ -;;; SPDX-License-Identifier: MPL-2.0 -;;; manifest.scm — Generic Guix manifest for RSR-compliant projects -;;; -;;; Usage: -;;; guix shell -m manifest.scm -;;; - -(specifications->manifest - '(;; Core development tools - "git" - "just" - "nickel" - "curl" - "bash" - "coreutils" - - ;; Documentation - "asciidoctor" - "pandoc" - - ;; Common build dependencies - "openssl" - "zlib" - "pkg-config")) diff --git a/consent-aware-http/rescript.json b/consent-aware-http/rescript.json deleted file mode 100644 index 9a0632f6..00000000 --- a/consent-aware-http/rescript.json +++ /dev/null @@ -1,7 +0,0 @@ -{ - "name": "consent-aware-http", - "sources": [{"dir": "src", "subdirs": true}], - "package-specs": [{"module": "es6", "in-source": true}], - "suffix": ".res.js", - "bs-dependencies": [] -} diff --git a/consent-aware-http/schemas/aibdp-schema-v0.2.json b/consent-aware-http/schemas/aibdp-schema-v0.2.json deleted file mode 100644 index bfe11537..00000000 --- a/consent-aware-http/schemas/aibdp-schema-v0.2.json +++ /dev/null @@ -1,282 +0,0 @@ -{ - "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "https://consent-aware-http.org/schemas/aibdp-v0.2.json", - "title": "AI Boundary Declaration Protocol (AIBDP) Manifest Schema", - "description": "JSON Schema for validating AIBDP manifests hosted at /.well-known/aibdp.json", - "type": "object", - "required": ["aibdp_version", "contact", "policies"], - - "properties": { - "aibdp_version": { - "type": "string", - "description": "Protocol version number", - "pattern": "^\\d+\\.\\d+$", - "examples": ["0.1", "0.2", "1.0"] - }, - - "canonical_uri": { - "type": "string", - "format": "uri", - "description": "Authoritative location of this manifest for cross-domain policies" - }, - - "contact": { - "type": "string", - "description": "Contact URI for policy inquiries (mailto:, https:, etc.)", - "pattern": "^(mailto:|https?:).+", - "examples": ["mailto:policy@example.org", "https://example.org/contact"] - }, - - "expires": { - "type": "string", - "format": "date-time", - "description": "ISO 8601 timestamp when manifest should be re-fetched" - }, - - "policy_uri": { - "type": "string", - "format": "uri", - "description": "Link to human-readable policy document" - }, - - "policies": { - "type": "object", - "description": "AI usage policy declarations", - "properties": { - "training": { "$ref": "#/$defs/policy" }, - "indexing": { "$ref": "#/$defs/policy" }, - "summarization": { "$ref": "#/$defs/policy" }, - "question_answering": { "$ref": "#/$defs/policy" }, - "generation": { "$ref": "#/$defs/policy" }, - "fine_tuning": { "$ref": "#/$defs/policy" }, - "embedding": { "$ref": "#/$defs/policy" }, - "commercial_training": { "$ref": "#/$defs/policy" } - }, - "additionalProperties": { "$ref": "#/$defs/policy" }, - "minProperties": 1 - }, - - "scope": { - "type": "object", - "description": "Describes what AI systems this manifest addresses", - "properties": { - "applies_to": { - "type": "array", - "items": { "type": "string" }, - "description": "Types of AI systems this policy covers" - } - } - }, - - "special_provisions": { - "type": "object", - "description": "Special provisions for specific use cases", - "properties": { - "academic_research": { "$ref": "#/$defs/special_provision" }, - "educational_use": { "$ref": "#/$defs/special_provision" }, - "standards_development": { "$ref": "#/$defs/special_provision" } - }, - "additionalProperties": { "$ref": "#/$defs/special_provision" } - }, - - "enforcement": { - "type": "object", - "description": "Enforcement mechanism information", - "properties": { - "mechanism": { - "type": "string", - "enum": ["http_430", "legal", "reputational", "technical", "none"], - "description": "Primary enforcement mechanism" - }, - "note": { "type": "string" }, - "contact_before_litigation": { - "type": "boolean", - "description": "Whether to contact before legal action" - }, - "preferred_resolution": { - "type": "string", - "description": "Preferred approach to resolving violations" - } - } - }, - - "metadata": { - "type": "object", - "description": "Manifest metadata", - "properties": { - "created": { - "type": "string", - "format": "date", - "description": "Creation date (YYYY-MM-DD)" - }, - "last_modified": { - "type": "string", - "format": "date", - "description": "Last modification date" - }, - "author": { "type": "string" }, - "organization": { "type": "string" }, - "project": { "type": "string" }, - "repository": { - "type": "string", - "format": "uri" - }, - "related_standards": { - "type": "array", - "items": { "type": "string" } - } - } - }, - - "philosophy": { - "type": "object", - "description": "Philosophical framing and values", - "properties": { - "core_principle": { "type": "string" }, - "values": { - "type": "array", - "items": { "type": "string" } - }, - "quote": { "type": "string" } - } - }, - - "signature": { - "type": "object", - "description": "COSE cryptographic signature for manifest verification", - "required": ["algorithm", "value"], - "properties": { - "algorithm": { - "type": "string", - "enum": ["ES256", "ES384", "ES512", "RS256", "RS384", "RS512", "EdDSA"], - "description": "Signature algorithm (COSE)" - }, - "public_key_uri": { - "type": "string", - "format": "uri", - "description": "URI to public key (JWK format)" - }, - "value": { - "type": "string", - "description": "Base64-encoded COSE signature" - }, - "note": { "type": "string" } - } - } - }, - - "additionalProperties": true, - - "$defs": { - "policy": { - "type": "object", - "required": ["status"], - "properties": { - "status": { - "type": "string", - "enum": ["allowed", "refused", "conditional", "encouraged"], - "description": "Permission status for this AI usage mode" - }, - - "conditions": { - "type": "array", - "items": { "type": "string" }, - "description": "Requirements that must be met when status is 'conditional'" - }, - - "scope": { - "oneOf": [ - { "type": "string", "const": "all" }, - { - "type": "array", - "items": { "type": "string" }, - "description": "Path patterns this policy applies to" - } - ] - }, - - "exceptions": { - "type": "array", - "items": { - "type": "object", - "required": ["path", "status"], - "properties": { - "path": { - "type": "string", - "description": "Path pattern for exception" - }, - "status": { - "type": "string", - "enum": ["allowed", "refused", "conditional", "encouraged"] - }, - "note": { "type": "string" }, - "conditions": { - "type": "array", - "items": { "type": "string" } - } - } - } - }, - - "rationale": { - "type": "string", - "description": "Human-readable explanation of policy" - }, - - "alternatives": { - "type": "string", - "description": "Suggested alternative approaches" - }, - - "purpose": { - "type": "array", - "items": { "type": "string" }, - "description": "Specific purposes this policy encourages (when status is 'encouraged')" - }, - - "note": { - "type": "string", - "description": "Additional context or clarification" - } - }, - "additionalProperties": false - }, - - "special_provision": { - "type": "object", - "required": ["status"], - "properties": { - "status": { - "type": "string", - "enum": ["unrestricted", "encouraged", "allowed", "conditional", "refused"] - }, - "note": { "type": "string" }, - "conditions": { - "type": "array", - "items": { "type": "string" } - } - } - } - }, - - "examples": [ - { - "aibdp_version": "0.2", - "contact": "mailto:policy@example.org", - "policies": { - "training": { - "status": "conditional", - "conditions": ["Attribution required", "Non-commercial use only"] - }, - "indexing": { - "status": "allowed", - "scope": "all" - }, - "generation": { - "status": "refused", - "rationale": "Content should not be synthetically replicated" - } - } - } - ] -} diff --git a/consent-aware-http/scripts/README-FIRST.md b/consent-aware-http/scripts/README-FIRST.md deleted file mode 100644 index 12825570..00000000 --- a/consent-aware-http/scripts/README-FIRST.md +++ /dev/null @@ -1,44 +0,0 @@ -scripts/ — Draft Building Utilities -This folder contains helper scripts to compile Internet-Drafts from their XML source files into readable formats (HTML, PDF, TXT) using the xml2rfc tool. - -These drafts form the foundation of the Consent-Aware HTTP standards: - -draft-jewell-http-430-consent-required - -draft-jewell-aibdp - -🛠 Tools Provided -✅ build-drafts.ps1 — PowerShell Script (Windows) -Use this if you're on Windows: - -.\scripts\build-drafts.ps1 -This invokes xml2rfc to build all drafts into /rendered/. - -Requires: pip install xml2rfc Run from the root folder of the repository. - -🧪 Makefile — POSIX Shell Targets (Linux/macOS) -Use this if you're on macOS or Linux: - -make -This compiles all XML drafts into /rendered/. - -Requires: xml2rfc installed and available in your PATH - -Use make clean to remove generated outputs. - -🔄 Input and Output -📥 Input drafts live in: drafts/ - -📤 Outputs land in: rendered/ - -You can review or publish the output HTML/PDFs directly from rendered/. - -❓ Troubleshooting -If xml2rfc isn't recognized, try: - -pip install xml2rfc -If a draft fails to compile, check that it is valid XML and follows RFC formatting rules. - -For help or updates, contact: Jonathan D.A. Jewell — jonathan@metadatastician.art - -Declare your perimeter. Compile with care. \ No newline at end of file diff --git a/consent-aware-http/scripts/build-drafts.ps1 b/consent-aware-http/scripts/build-drafts.ps1 deleted file mode 100644 index e69de29b..00000000 diff --git a/consent-aware-http/src/Aibdp.affine b/consent-aware-http/src/Aibdp.affine deleted file mode 100644 index 0ae2427f..00000000 --- a/consent-aware-http/src/Aibdp.affine +++ /dev/null @@ -1,241 +0,0 @@ -// SPDX-License-Identifier: MIT OR GPL-3.0-or-later -// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell -// -// AIBDP + HTTP 430 middleware for Express. AffineScript port of Aibdp.res. -// Implements AI Boundary Declaration Protocol enforcement. - -module Aibdp; - -use Node; -use Express; - -extern fn console_warn(msg: String) -> Unit = "console" "warn"; -extern fn console_error(msg: String) -> Unit = "console" "error"; -extern fn json_parse(s: String) -> a = "JSON" "parse"; - -// Regex helpers (case-insensitive). `re_test(pattern, s)` tests /pattern/i. -extern fn re_test(pattern: String, s: String) -> Bool = "regex" "testI"; -extern fn re_replace_all(s: String, pattern: String, repl: String) -> String = "regex" "replaceAll"; -extern fn re_test_dynamic(anchored_pattern: String, s: String) -> Bool = "regex" "test"; -extern fn str_lower(s: String) -> String = "string" "toLowerCase"; - -// AI User-Agent patterns. -let ai_user_agent_patterns = [ - "GPTBot", "ChatGPT-User", "Claude-Web", "anthropic-ai", "Google-Extended", - "CCBot", "Googlebot", "Bingbot", "Slurp", "DuckDuckBot", "Baiduspider", - "YandexBot", "Sogou", "Exabot", "facebookexternalhit", "ia_archiver", - "PerplexityBot", "Omgilibot", "Diffbot", -]; - -pub type PolicyStatus = | Allowed | Refused | Conditional - -pub type Exception = { path: String, status: PolicyStatus } - -pub type Policy = { - status: PolicyStatus, - scope: Option<[String]>, - conditions: Option<[String]>, - rationale: Option, - exceptions: Option<[Exception]>, -} - -pub type Manifest = { - canonical_uri: Option, - policies: Dict, - contact: Option, -} - -pub type Response430 = { - status_code: Int, - headers: Dict, - body: Json, -} - -// Load and parse the AIBDP manifest. -pub fn load_manifest(manifest_path: String) -> Effect[Async] Option { - try { - let content = await Node.Fs.read_file(manifest_path, "utf-8"); - Some(json_parse(content)) - } catch e { - console_warn("Failed to load AIBDP manifest: " ++ exn_message(e)); - None - } -} - -pub fn is_ai_user_agent(user_agent: Option) -> Bool { - match user_agent { - None => false, - Some(ua) => { - let i = 0; - let found = false; - while i < len(ai_user_agent_patterns) { - if re_test(ai_user_agent_patterns[i], ua) { found = true; } - i = i + 1; - } - found - } - } -} - -pub fn extract_ai_purpose(headers: Dict) -> String { - match dict_get(headers, "ai-purpose") { - Some(purpose) => str_lower(purpose), - None => { - let ua = match dict_get(headers, "user-agent") { Some(u) => u, None => "" }; - if re_test("GPTBot", ua) { - "training" - } else if re_test("Claude-Web", ua) { - "indexing" - } else if re_test("Google-Extended", ua) { - "training" - } else if re_test("Googlebot", ua) { - "indexing" - } else { - "unknown" - } - } - } -} - -// Check if path matches a glob-style pattern. -pub fn path_matches(request_path: String, pattern: String) -> Bool { - if pattern == "all" { - true - } else { - let rx = re_replace_all(pattern, "\\.", "\\\\."); - rx = re_replace_all(rx, "\\*\\*", ".*"); - rx = re_replace_all(rx, "\\*", "[^/]*"); - rx = re_replace_all(rx, "\\?", "."); - re_test_dynamic("^" ++ rx ++ "$", request_path) - } -} - -fn status_to_string(s: PolicyStatus) -> String { - match s { Allowed => "allowed", Refused => "refused", Conditional => "conditional" } -} - -pub fn create_430_response(manifest: Manifest, policy: Policy, purpose: String) -> Response430 { - let manifest_uri = match manifest.canonical_uri { - Some(u) => u, None => "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/.well-known/aibdp.json", - }; - - let headers = dict_empty(); - dict_set(headers, "Content-Type", "application/json"); - dict_set(headers, "Link", "<" ++ manifest_uri ++ ">; rel=\"blocked-by-consent\""); - dict_set(headers, "Retry-After", "86400"); - - let conditions = match policy.conditions { Some(c) => c, None => [] }; - let rationale = match policy.rationale { - Some(r) => r, None => "No additional information provided", - }; - - Response430 { - status_code: 430, - headers: headers, - body: json_object([ - ("error", json_string("AI usage boundaries declared in AIBDP manifest not satisfied")), - ("manifest", json_string(manifest_uri)), - ("violated_policy", json_string(purpose)), - ("policy_status", json_string(status_to_string(policy.status))), - ("required_conditions", json_string_array(conditions)), - ("rationale", json_string(rationale)), - ("contact", json_opt_string(manifest.contact)), - ]), - } -} - -pub type MiddlewareOptions = { - manifest_path: Option, - enforce_for_all: Option, - on_violation: Option Unit>, -} - -// Express middleware factory. -pub fn aibdp_middleware(options: MiddlewareOptions) -> Express.Middleware { - let manifest_path = match options.manifest_path { - Some(p) => p, None => ".well-known/aibdp.json", - }; - let enforce_for_all = match options.enforce_for_all { Some(b) => b, None => false }; - - let manifest_ref = None; - let manifest_load_time = 0.0; - let cache_duration = 3600000.0; // 1 hour - - fn(req: Express.Req, res: Express.Res, next: Express.Next) -> Effect[Async] Unit { - try { - let now = Node.date_now(); - let stale = match manifest_ref { None => true, Some(_) => now -. manifest_load_time > cache_duration }; - if stale { - manifest_ref = await load_manifest(manifest_path); - manifest_load_time = now; - } - - match manifest_ref { - None => next(), - Some(manifest) => { - let user_agent = dict_get(req.headers, "user-agent"); - let is_ai = enforce_for_all || is_ai_user_agent(user_agent); - - if !is_ai { - next() - } else { - let purpose = extract_ai_purpose(req.headers); - match dict_get(manifest.policies, purpose) { - None => next(), - Some(policy) => { - match policy.status { - Refused => { - let response = create_430_response(manifest, policy, purpose); - match options.on_violation { - Some(f) => f(req, policy, purpose), - None => {}, - } - let r = Express.status(res, response.status_code); - let entries = dict_entries(response.headers); - let i = 0; - while i < len(entries) { - let (k, v) = entries[i]; - Express.header(r, k, v); - i = i + 1; - } - Express.json(r, response.body) - } - Allowed => next(), - // Simplified - full impl would check conditions. - Conditional => next(), - } - } - } - } - } - } - } catch e { - console_error("AIBDP middleware error: " ++ exn_message(e)); - next() - } - } -} - -// Serve manifest endpoint. -pub fn serve_manifest(manifest_path: Option) -> Express.Middleware { - let path = match manifest_path { Some(p) => p, None => ".well-known/aibdp.json" }; - - fn(req: Express.Req, res: Express.Res, next: Express.Next) -> Effect[Async] Unit { - if req.path != "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/.well-known/aibdp.json" { - next() - } else { - match await load_manifest(path) { - None => { - let r = Express.status(res, 404); - Express.json(r, json_object([("error", json_string("Manifest not found"))])) - } - Some(manifest) => { - let r1 = Express.header(res, "Content-Type", "application/aibdp+json"); - let r2 = Express.header(r1, "Cache-Control", "public, max-age=3600"); - let r3 = Express.header(r2, "Access-Control-Allow-Origin", "*"); - Express.json(r3, manifest) - } - } - } - } -} diff --git a/consent-aware-http/src/Express.affine b/consent-aware-http/src/Express.affine deleted file mode 100644 index 51db2a61..00000000 --- a/consent-aware-http/src/Express.affine +++ /dev/null @@ -1,18 +0,0 @@ -// SPDX-License-Identifier: MIT OR GPL-3.0-or-later -// Express.js bindings. AffineScript port of Express.res. - -module Express; - -pub type Req = { - headers: Dict, - path: String, -} - -extern type Res; - -extern fn status(r: Res, code: Int) -> Res = "express" "status"; -extern fn header(r: Res, name: String, value: String) -> Res = "express" "header"; -extern fn json(r: Res, body: a) -> Unit = "express" "json"; - -pub type Next = fn() -> Unit; -pub type Middleware = fn(Req, Res, Next) -> Promise; diff --git a/consent-aware-http/src/Node.affine b/consent-aware-http/src/Node.affine deleted file mode 100644 index b7b287a5..00000000 --- a/consent-aware-http/src/Node.affine +++ /dev/null @@ -1,14 +0,0 @@ -// SPDX-License-Identifier: MIT OR GPL-3.0-or-later -// Node.js bindings. AffineScript port of Node.res. - -module Node; - -module Fs { - extern fn read_file(path: String, enc: String) -> Promise = "fs/promises" "readFile"; -} - -module Path { - extern fn join(a: String, b: String) -> String = "path" "join"; -} - -extern fn date_now() -> Float = "Date" "now"; diff --git a/coordination.k9 b/coordination.k9 index 0cefd669..696988a0 100644 --- a/coordination.k9 +++ b/coordination.k9 @@ -102,8 +102,6 @@ protected: reason: "AVOW spam prevention protocol" - path: axel-protocol/ reason: "AXEL age-gating protocol" - - path: consent-aware-http/ - reason: "Consent-Aware HTTP specification (IETF draft)" - path: lol/ reason: "LOL multilingual corpus — active, production-grade" - path: 0-ai-gatekeeper-protocol/ diff --git a/docs/UX-standards/DUSTFILE-SPECIFICATION.adoc b/docs/UX-standards/DUSTFILE-SPECIFICATION.adoc index 87db0198..9f2ff6a2 100644 --- a/docs/UX-standards/DUSTFILE-SPECIFICATION.adoc +++ b/docs/UX-standards/DUSTFILE-SPECIFICATION.adoc @@ -168,6 +168,6 @@ Dustfiles may evolve to include: == See Also - link:launcher-standard.adoc[Comprehensive Launcher Standard] -- link:../consent-aware-http/[Consent-Aware HTTP] +- link:https://github.com/metadatastician/consent-aware-web[Consent-Aware Web] ⇗ - link:../groove-protocol/[Groove Protocol] - link:../hypatia-rules/[Hypatia Rules] \ No newline at end of file diff --git a/docs/UX-standards/LM-LA-LIFECYCLE-STANDARD.adoc b/docs/UX-standards/LM-LA-LIFECYCLE-STANDARD.adoc index 180187e8..582bb253 100644 --- a/docs/UX-standards/LM-LA-LIFECYCLE-STANDARD.adoc +++ b/docs/UX-standards/LM-LA-LIFECYCLE-STANDARD.adoc @@ -514,5 +514,5 @@ game-server-admin-dustfile.sh --repair - link:launcher-standard.adoc[Comprehensive Launcher Standard] - link:DUSTFILE-SPECIFICATION.adoc[Dustfile Specification] -- link:../../consent-aware-http/[Consent-Aware HTTP] +- link:https://github.com/metadatastician/consent-aware-web[Consent-Aware Web (AIBDP + HTTP 430)] ⇗ - link:../../groove-protocol/[Groove Protocol] \ No newline at end of file diff --git a/docs/UX-standards/QUICKSTART.adoc b/docs/UX-standards/QUICKSTART.adoc index 9015a1a6..2ead9c15 100644 --- a/docs/UX-standards/QUICKSTART.adoc +++ b/docs/UX-standards/QUICKSTART.adoc @@ -216,5 +216,5 @@ with all features implemented. 1. Read link:LM-LA-LIFECYCLE-STANDARD.adoc[LM/LA Lifecycle Standard] for complete lifecycle management 2. Explore link:DUSTFILE-SPECIFICATION.adoc[Dustfile Specification] for automated repair 3. Review link:launcher-standard.adoc[Comprehensive Launcher Standard] for advanced features -4. Integrate with link:../../consent-aware-http/[Consent-Aware HTTP] for privacy-compliant telemetry +4. Integrate with link:https://github.com/metadatastician/consent-aware-web[Consent-Aware Web] ⇗ for privacy-compliant telemetry 5. Add link:../../groove-protocol/[Groove Protocol] for soft-attach patterns \ No newline at end of file diff --git a/docs/UX-standards/README.adoc b/docs/UX-standards/README.adoc index aae65aaf..3786874d 100644 --- a/docs/UX-standards/README.adoc +++ b/docs/UX-standards/README.adoc @@ -149,7 +149,7 @@ This UX standards directory provides a comprehensive suite: == Related Standards -- link:../../consent-aware-http/[Consent-Aware HTTP] - Privacy-compliant telemetry +- link:https://github.com/metadatastician/consent-aware-web[Consent-Aware Web] ⇗ - Privacy-compliant telemetry - link:../../groove-protocol/[Groove Protocol] - Soft-attach patterns - link:../../hypatia-rules/[Hypatia Rules] - LLM integration guidelines - link:../../component-readiness-grades/[Component Readiness Grades] - Quality assessment diff --git a/docs/UX-standards/launcher-standard.adoc b/docs/UX-standards/launcher-standard.adoc index 92475f0e..e8956bef 100644 --- a/docs/UX-standards/launcher-standard.adoc +++ b/docs/UX-standards/launcher-standard.adoc @@ -727,6 +727,6 @@ include::../../../../.desktop-tools/panll-launcher.sh[] - link:e-grade-launcher-template.sh[E-Grade Launcher Template] - Original specification - link:comprehensive-launcher-template.sh[Comprehensive Template] - Full reference implementation -- link:../../consent-aware-http/[Consent-Aware HTTP] - Privacy-compliant feedback +- link:https://github.com/metadatastician/consent-aware-web[Consent-Aware Web] ⇗ - Privacy-compliant feedback - link:../../groove-protocol/[Groove Protocol] - Soft-attach patterns - link:../../hypatia-rules/[Hypatia Rules] - LLM integration guidelines diff --git a/docs/decisions/ADR-005-extract-consent-aware-web.adoc b/docs/decisions/ADR-005-extract-consent-aware-web.adoc new file mode 100644 index 00000000..f4716de0 --- /dev/null +++ b/docs/decisions/ADR-005-extract-consent-aware-web.adoc @@ -0,0 +1,94 @@ +// SPDX-License-Identifier: CC-BY-SA-4.0 +// Copyright (c) 2026 Jonathan D.A. Jewell += ADR-005: Extract Consent-Aware HTTP to its own repository +:toc: preamble + +[cols="1,4"] +|=== +| Status | Accepted +| Date | 2026-08-07 +| Supersedes | the in-tree `consent-aware-http/` spec entry +|=== + +== Context + +`consent-aware-http/` held a 107-file IETF-track specification suite: two +Internet-Drafts (HTTP 430 Consent Required, and AIBDP), a JSON Schema, ~80 KB of +documentation, AffineScript sources and JavaScript reference implementations. It +was a project living inside a repository that is not its home. + +Three things made this more than a directory move. + +*It was rated 1 of 5 MUSTs* by this repository's own scorecard (assessed +2026-07-03) while shipping an `RSR-COMPLIANCE.md` claiming "RSR Gold, 100% +compliant" — asserting PASS for `LICENSE.txt`, `MAINTAINERS.md`, `CHANGELOG.md`, +`flake.nix` and a whole `.well-known/` tree, none of which existed. + +*There were two divergent copies and a phantom submodule.* +`rhodium-standard-repositories/.gitmodules` declared +`satellites/consent-aware-http` as a submodule of +`git@github.com:hyperpolymath/consent-aware-http.git` — a repository that has +never existed. The path was materialised as 81 ordinary tracked files, 26 behind +the live copy. + +*The flagship draft existed twice with different normative text.* Verified: the +root copy was byte-identical to the satellite copy — the retired shared ancestor +— while the `drafts/` copy was the later edit and the only valid RFC-XML v3. The +two disagreed on `category`: `std` versus `info`. + +== Decision + +Extract to *`metadatastician/consent-aware-web`*. Remove both copies from this +repository and retire the phantom submodule declaration. + +The registry entry moves from the in-tree spec table to the *external* spec +table in `scripts/build-registry.sh`, so this repository holds a verified +pointer rather than a copy — the pattern already used for the AffineScript +specs. `REGISTRY.a2ml` and `TOPOLOGY.md` regenerate from that table and were not +hand-edited. + +=== Why `consent-aware-web` and not `consent-aware-http` + +Owner ruling. The suite's own README frames a six-layer architecture — only two +layers of which are drafted — and the broader name reflects the intent. The new +repository states explicitly which four layers are *not* drafted, so the wider +name does not become a wider claim. + +=== The specification's own defects were fixed, not carried + +`draft-jewell-aibdp-00.xml` was RFC-XML v2 throughout while declaring +`version="3"`, with `` elements as siblings of `` — invalid in v2 as +well, so the file validated under no schema at all. Migrated mechanically and +verified lossless. The duplicate 430 draft was retired and `category="std"` +restored. `.well-known/aibdp.json` was authored so the suite genuinely dogfoods +its own protocol, and is validated in CI. + +== Consequences + +* The scorecard moved with the specification. M2, M3, M4, M5, S3 and C1 are all + closeable in the new repository and were not closeable here. +* `COMPLIANCE-DASHBOARD.md` regenerates without the row. Both it and the + registry are derived; `build-registry.sh --check` confirms no drift. +* Licence references in `LICENCE-POLICY.adoc`, `PALIMPSEST.adoc`, `README.adoc`, + `.claude/CLAUDE.md` and `.machine_readable/licensing-policy.toml` are + statements about a *repository*, not a directory. They remain correct and now + name the new location. The PMPL carve-out and the IETF-mandated MIT carve-out + both still apply. +* Seven dangling relative links under `docs/UX-standards/` and + `docs/wikis/developers/` were repointed off-tree. + +=== Salvaged + +The satellite copy carried a 418-line `GOVERNANCE.adoc` — Tri-Perimeter +Contribution Framework, decision authority, funding model, IETF coordination — +that existed nowhere else. The live copy's `docs/governance.md` is an unrelated +essay on consent in institutions; the two share a name and nothing else. It was +copied into the new repository before deletion. This is the failure mode +`AGENTS.md` warns about: cold is not disposable. + +=== Open + +The two drafts name different author organisations (`NUJ Ethics Council` versus +`National Union of Journalists`). Normatively visible in a published +Internet-Draft; recorded as a blocker in the new repository's `STATE.a2ml`, not +resolved here. diff --git a/docs/migrations/pmpl-to-mpl-sweep-runbook.adoc b/docs/migrations/pmpl-to-mpl-sweep-runbook.adoc index dae0abf7..4035314f 100644 --- a/docs/migrations/pmpl-to-mpl-sweep-runbook.adoc +++ b/docs/migrations/pmpl-to-mpl-sweep-runbook.adoc @@ -36,6 +36,8 @@ surface (236 matches) is template-propagated — see §7. |=== `consent-aware-http` (the 3rd legitimate carve-out) shows **zero** PMPL headers — +// NOTE: extracted to metadatastician/consent-aware-web on 2026-08-07; the +// observation below describes the tree as it stood before that. its carve-out is prospective-only per policy, so that is expected and correct. == 2. The actionable set (22 files, owner-approval-gated) diff --git a/docs/wikis/developers/index.adoc b/docs/wikis/developers/index.adoc index 9693e16a..498b8ec5 100644 --- a/docs/wikis/developers/index.adoc +++ b/docs/wikis/developers/index.adoc @@ -33,7 +33,7 @@ NOTE: Scaffold. The link spine is complete; the connective prose is `TODO`. === 4. The protocols * `avow-protocol/`, `axel-protocol/`, `overlay-protocol/`, - `consent-aware-http/`, `0-ai-gatekeeper-protocol/`. + `0-ai-gatekeeper-protocol/`. (Consent-Aware Web was extracted to `metadatastician/consent-aware-web` on 2026-08-07.) * TODO: per-protocol "when would I implement this" summary. === 5. Write & extend Hypatia rules diff --git a/launcher/launcher-standard.a2ml b/launcher/launcher-standard.a2ml index 0f2de01d..e37d945e 100644 --- a/launcher/launcher-standard.a2ml +++ b/launcher/launcher-standard.a2ml @@ -265,3 +265,4 @@ required-fields = [ "lifecycle-phases-covered", "lifecycle-phases-deferred", ] + diff --git a/rhodium-standard-repositories/.gitmodules b/rhodium-standard-repositories/.gitmodules index 1c83e9fc..115553f5 100644 --- a/rhodium-standard-repositories/.gitmodules +++ b/rhodium-standard-repositories/.gitmodules @@ -25,9 +25,6 @@ [submodule "satellites/cccp"] path = satellites/cccp url = git@github.com:hyperpolymath/cccp.git -[submodule "satellites/consent-aware-http"] - path = satellites/consent-aware-http - url = git@github.com:hyperpolymath/consent-aware-http.git [submodule "satellites/rsr-certifier"] path = satellites/rsr-certifier url = git@github.com:hyperpolymath/git-rsr-certified.git diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/.claude/CLAUDE.md b/rhodium-standard-repositories/satellites/consent-aware-http/.claude/CLAUDE.md deleted file mode 100644 index f1b392e1..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/.claude/CLAUDE.md +++ /dev/null @@ -1,15 +0,0 @@ -# CLAUDE.md — see canonical - -This satellite follows the hyperpolymath estate-wide policy. The -authoritative `CLAUDE.md` is at the standards-repo root: - -- - -The previous body of this file was a 2025-11-22 snapshot that listed -ReScript as primary (banned in new code as of 2026-04-30), GitLab as -the source-of-truth host (estate is on GitHub), and other guidance -superseded by the canonical policy. Duplicating policy tables across -satellites caused the drift; this pointer replaces the duplicate. - -Add satellite-specific guidance below this line only — never re-paste -the language-policy / tooling tables here. diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/.editorconfig b/rhodium-standard-repositories/satellites/consent-aware-http/.editorconfig deleted file mode 100644 index 1b2ec8d0..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/.editorconfig +++ /dev/null @@ -1,68 +0,0 @@ -# consent-aware-http - Editor Configuration -# https://editorconfig.org - -root = true - -[*] -charset = utf-8 -end_of_line = lf -indent_size = 2 -indent_style = space -insert_final_newline = true -trim_trailing_whitespace = true - -[*.md] -trim_trailing_whitespace = false - -[*.adoc] -trim_trailing_whitespace = false - -[*.rs] -indent_size = 4 - -[*.ex] -indent_size = 2 - -[*.exs] -indent_size = 2 - -[*.zig] -indent_size = 4 - -[*.ada] -indent_size = 3 - -[*.adb] -indent_size = 3 - -[*.ads] -indent_size = 3 - -[*.hs] -indent_size = 2 - -[*.res] -indent_size = 2 - -[*.resi] -indent_size = 2 - -[*.ncl] -indent_size = 2 - -[*.rkt] -indent_size = 2 - -[*.scm] -indent_size = 2 - -[*.nix] -indent_size = 2 - -[Justfile] -indent_style = space -indent_size = 4 - -[justfile] -indent_style = space -indent_size = 4 diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/.gitattributes b/rhodium-standard-repositories/satellites/consent-aware-http/.gitattributes deleted file mode 100644 index 7bbe6d53..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/.gitattributes +++ /dev/null @@ -1,54 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later -# RSR-compliant .gitattributes - -* text=auto eol=lf - -# Source -*.rs text eol=lf diff=rust -*.ex text eol=lf diff=elixir -*.exs text eol=lf diff=elixir -*.jl text eol=lf -*.res text eol=lf -*.resi text eol=lf -*.ada text eol=lf diff=ada -*.adb text eol=lf diff=ada -*.ads text eol=lf diff=ada -*.hs text eol=lf -*.chpl text eol=lf -*.scm text eol=lf -*.ncl text eol=lf -*.nix text eol=lf - -# Docs -*.md text eol=lf diff=markdown -*.adoc text eol=lf -*.txt text eol=lf - -# Data -*.json text eol=lf -*.yaml text eol=lf -*.yml text eol=lf -*.toml text eol=lf - -# Config -.gitignore text eol=lf -.gitattributes text eol=lf -justfile text eol=lf -Makefile text eol=lf -Containerfile text eol=lf - -# Scripts -*.sh text eol=lf - -# Binary -*.png binary -*.jpg binary -*.gif binary -*.pdf binary -*.woff2 binary -*.zip binary -*.gz binary - -# Lock files -Cargo.lock text eol=lf -diff -flake.lock text eol=lf -diff diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/.github/CONTRIBUTING.md b/rhodium-standard-repositories/satellites/consent-aware-http/.github/CONTRIBUTING.md deleted file mode 100644 index ef5942d0..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/.github/CONTRIBUTING.md +++ /dev/null @@ -1,69 +0,0 @@ -# Contributing to Consent-Aware HTTP Standards - -Thank you for your interest in improving ethical infrastructure for AI governance and declarative refusal. - -This repository hosts drafts, documentation, and tooling for: -- `draft-jewell-http-430-consent-required` -- `draft-jewell-aibdp` -- Complementary explainers, schema samples, and cultural framing - -Your contributions — whether technical, editorial, philosophical, or implementation-based — are welcome. - ---- - -## 💡 Ways to Contribute - -- **RFC draft feedback**: Suggest corrections, propose additional use cases, or clarify language -- **Manifest design**: Expand AIBDP schema samples and explore extensions for federation, cryptographic binding, etc. -- **Infrastructure tooling**: Implement server-side 430 responses, manifest parsers, or audit utilities -- **Documentation**: Improve quickstart guides, developer onboarding, and educational materials -- **Ethical framing**: Contribute essays, citations, or examples that deepen the philosophical understanding of refusal and procedural boundary -- **Outreach**: Help engage federated platforms, journalists, educators, IndieWeb members, and governance communities - ---- - -## 🛠 Technical Contributions - -Before submitting code or draft updates: - -1. Fork the repository -2. Create a new branch (`feature/my-update`) -3. Commit with clear descriptions -4. Submit a pull request with a summary of your changes and rationale - -If you're proposing language for the drafts, quote sections and offer improvement phrasing inline in your PR or issue. - ---- - -## 📜 Style and Principles - -This project prioritizes: - -- **Procedural integrity** — Accuracy, transparency, and alignment with standards bodies -- **Consent-aware authorship** — Clear declaration of scope and boundaries -- **Ethical clarity** — No obfuscation, no quiet permissions — refusal must be dignified -- **Federated thinking** — Build tools and schemas that scale beyond centralized systems -- **Creative comport** — Literary citations, artistic expression, and philosophical insight are welcome - ---- - -## 🧾 Licensing Agreement - -By contributing, you agree that your work may be included under: - -- [MIT License](LICENSE.md) for code and draft materials -- [CC BY-SA 4.0](LICENSE.md) for documentation and narrative content - ---- - -## 💬 Feedback and Dialogue - -If you have questions, suggestions, or critiques, please open a GitHub Discussion or Issue. You can also reach out at [jonathan@metadatastician.art](mailto:jonathan@metadatastician.art) for thoughtful exchanges or aligned collaboration. - -We welcome critique, correction, and recalibration — provided it’s done with the same clarity and comport the protocol demands. - ---- - -_Disagreement is welcome. Exploitation is not._ -Declare your boundaries. Join ours. - diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/.github/DISCUSSION_TEMPLATE.md b/rhodium-standard-repositories/satellites/consent-aware-http/.github/DISCUSSION_TEMPLATE.md deleted file mode 100644 index e69de29b..00000000 diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/.github/FUNDING.md b/rhodium-standard-repositories/satellites/consent-aware-http/.github/FUNDING.md deleted file mode 100644 index 0f1bcf8b..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/.github/FUNDING.md +++ /dev/null @@ -1,2 +0,0 @@ -github: jonathanjewell -custom: ["https://sinople.pub", "https://metadatastician.art/support"] diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/.github/FUNDING.yml b/rhodium-standard-repositories/satellites/consent-aware-http/.github/FUNDING.yml deleted file mode 100644 index e2d29717..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/.github/FUNDING.yml +++ /dev/null @@ -1,7 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0-or-later -# Funding platforms for hyperpolymath projects -# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-sponsor-button-in-your-repository - -github: hyperpolymath -ko_fi: hyperpolymath -liberapay: hyperpolymath diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/.github/ISSUE_TEMPLATE/DISCUSSION_TEMPLATE.md b/rhodium-standard-repositories/satellites/consent-aware-http/.github/ISSUE_TEMPLATE/DISCUSSION_TEMPLATE.md deleted file mode 100644 index 352cd446..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/.github/ISSUE_TEMPLATE/DISCUSSION_TEMPLATE.md +++ /dev/null @@ -1,24 +0,0 @@ -# Discussion Starter: Topic, Framing, and Intent - -## 🧭 Topic - -Brief title or question - e.g., "Can AIBDP work with IndieWeb microformats?" - -## 💬 Framing - -Open with a paragraph or two that explains: -- What you’re exploring -- What motivated the inquiry -- Why it might help the protocol or community - -## 🔗 Optional Context - -Link standards, drafts, citations, posts, or example manifests. - -## 🙌 Invitation - -What kind of response or collaboration do you hope to invite? - ---- - -🕊️ Dialogue is welcome. Refusal is respected. Let’s advance clarity together. diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/.github/ISSUE_TEMPLATE/PULL_REQUEST_TEMPLATE.md b/rhodium-standard-repositories/satellites/consent-aware-http/.github/ISSUE_TEMPLATE/PULL_REQUEST_TEMPLATE.md deleted file mode 100644 index f6091f7f..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/.github/ISSUE_TEMPLATE/PULL_REQUEST_TEMPLATE.md +++ /dev/null @@ -1,22 +0,0 @@ -# Pull Request: Summary and Intent - -## 📜 Description - -Briefly describe what this PR adds or changes — and why it matters. - -## 🔍 Scope - -- [ ] 430 Status Code -- [ ] AIBDP Manifest -- [ ] Developer tooling -- [ ] Documentation / Narrative -- [ ] Other: please explain - -## ✅ Author Intent - -By submitting this pull request, I affirm: -- [x] I respect the boundaries and ethical intent of this project -- [x] I understand the licensing (MIT + CC BY-SA 4.0) -- [x] I’ve tested or reviewed my contribution for clarity and conformance - -Please tag Jonathan @metadatastician.art or open a related Issue if further review is needed. diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/.github/ISSUE_TEMPLATE/bug_report.md b/rhodium-standard-repositories/satellites/consent-aware-http/.github/ISSUE_TEMPLATE/bug_report.md deleted file mode 100644 index 987aab6b..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/.github/ISSUE_TEMPLATE/bug_report.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -name: Bug report -about: Create a report to help us improve -title: "[Bug]: " -labels: 'bug, priority: unset, triage' -assignees: '' - ---- - -**Describe the bug** -A clear and concise description of what the bug is. - -**To Reproduce** -Steps to reproduce the behavior: -1. Go to '...' -2. Click on '....' -3. Scroll down to '....' -4. See error - -**Expected behavior** -A clear and concise description of what you expected to happen. - -**Screenshots** -If applicable, add screenshots to help explain your problem. - -**Desktop (please complete the following information):** - - OS: [e.g. iOS] - - Browser [e.g. chrome, safari] - - Version [e.g. 22] - -**Smartphone (please complete the following information):** - - Device: [e.g. iPhone6] - - OS: [e.g. iOS8.1] - - Browser [e.g. stock browser, safari] - - Version [e.g. 22] - -**Additional context** -Add any other context about the problem here. diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/.github/ISSUE_TEMPLATE/custom.md b/rhodium-standard-repositories/satellites/consent-aware-http/.github/ISSUE_TEMPLATE/custom.md deleted file mode 100644 index 48d5f81f..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/.github/ISSUE_TEMPLATE/custom.md +++ /dev/null @@ -1,10 +0,0 @@ ---- -name: Custom issue template -about: Describe this issue template's purpose here. -title: '' -labels: '' -assignees: '' - ---- - - diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/.github/ISSUE_TEMPLATE/documentation.md b/rhodium-standard-repositories/satellites/consent-aware-http/.github/ISSUE_TEMPLATE/documentation.md deleted file mode 100644 index 4fcb9f9f..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/.github/ISSUE_TEMPLATE/documentation.md +++ /dev/null @@ -1,66 +0,0 @@ ---- -name: Documentation -about: Report unclear, missing, or incorrect documentation -title: "[DOCS]: " -labels: 'documentation, priority: unset, triage' -assignees: '' - ---- - -name: Documentation -description: Report unclear, missing, or incorrect documentation -title: "[Docs]: " -labels: ["documentation", "triage"] -body: - - type: markdown - attributes: - value: | - Help us improve our documentation by reporting issues or gaps. - - - type: dropdown - id: type - attributes: - label: Documentation issue type - options: - - Missing (documentation doesn't exist) - - Incorrect (information is wrong) - - Unclear (confusing or hard to follow) - - Outdated (no longer accurate) - - Typo or grammar - validations: - required: true - - - type: input - id: location - attributes: - label: Location - description: Where is this documentation? (URL, file path, or section name) - placeholder: README.adoc, section "Installation" - validations: - required: true - - - type: textarea - id: description - attributes: - label: Description - description: What's the problem with the current documentation? - placeholder: Describe what's wrong or missing - validations: - required: true - - - type: textarea - id: suggestion - attributes: - label: Suggested improvement - description: How should it be fixed or improved? - placeholder: The documentation should say... - validations: - required: false - - - type: checkboxes - id: contribution - attributes: - label: Contribution - options: - - label: I would be willing to submit a PR to fix this - required: false diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/.github/ISSUE_TEMPLATE/feature-template.md b/rhodium-standard-repositories/satellites/consent-aware-http/.github/ISSUE_TEMPLATE/feature-template.md deleted file mode 100644 index c6aa1eaf..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/.github/ISSUE_TEMPLATE/feature-template.md +++ /dev/null @@ -1,29 +0,0 @@ -name: Feature Request or Protocol Enhancement -description: Suggest a new capability, integration, or architectural refinement -title: "[Proposal] — your concise topic" -labels: [enhancement] -body: - - type: markdown - attributes: - value: | - Thanks for contributing to the consent-aware ecosystem. - Please describe your proposed change below. - - type: textarea - id: summary - attributes: - label: Summary - description: What do you propose and why does it matter? - placeholder: Write a short explanation… - validations: - required: true - - type: textarea - id: scope - attributes: - label: Protocol or tooling scope - description: Is this related to 430, AIBDP, manifests, or infrastructure? - placeholder: Draft/AIBDP/API Schema/Docs - - type: input - id: source - attributes: - label: Supporting references (optional) - description: Link relevant documentation, standards, or prior discussions diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/.github/ISSUE_TEMPLATE/feature_request.md b/rhodium-standard-repositories/satellites/consent-aware-http/.github/ISSUE_TEMPLATE/feature_request.md deleted file mode 100644 index 3e8fa7e7..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/.github/ISSUE_TEMPLATE/feature_request.md +++ /dev/null @@ -1,20 +0,0 @@ ---- -name: Feature request -about: Suggest an idea for this project -title: '' -labels: 'enhancement, priority: unset, triage' -assignees: '' - ---- - -**Is your feature request related to a problem? Please describe.** -A clear and concise description of what the problem is. Ex. I'm always frustrated when [...] - -**Describe the solution you'd like** -A clear and concise description of what you want to happen. - -**Describe alternatives you've considered** -A clear and concise description of any alternative solutions or features you've considered. - -**Additional context** -Add any other context or screenshots about the feature request here. diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/.github/ISSUE_TEMPLATE/question.md b/rhodium-standard-repositories/satellites/consent-aware-http/.github/ISSUE_TEMPLATE/question.md deleted file mode 100644 index fd0e2a5c..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/.github/ISSUE_TEMPLATE/question.md +++ /dev/null @@ -1,55 +0,0 @@ ---- -name: Question -about: Ask a question about usage or behaviour -title: "[QUESTION]: " -labels: question, triage -assignees: '' - ---- - -name: Question -description: Ask a question about usage or behaviour -title: "[Question]: " -labels: ["question", "triage"] -body: - - type: markdown - attributes: - value: | - Have a question? You can also ask in [Discussions](../discussions) for broader conversations. - - - type: textarea - id: question - attributes: - label: Your question - description: What would you like to know? - placeholder: How do I...? - validations: - required: true - - - type: textarea - id: context - attributes: - label: Context - description: Any relevant context that helps us answer your question - placeholder: I'm trying to achieve X and I've tried Y... - validations: - required: false - - - type: textarea - id: research - attributes: - label: What I've already tried - description: What have you already looked at or attempted? - placeholder: I've read the README and searched issues but... - validations: - required: false - - - type: checkboxes - id: checked - attributes: - label: Pre-submission checklist - options: - - label: I have searched existing issues and discussions - required: true - - label: I have read the documentation - required: true diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/.github/PULL_REQUEST_TEMPLATE.md b/rhodium-standard-repositories/satellites/consent-aware-http/.github/PULL_REQUEST_TEMPLATE.md deleted file mode 100644 index e69de29b..00000000 diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/.github/SECURITY.md b/rhodium-standard-repositories/satellites/consent-aware-http/.github/SECURITY.md deleted file mode 100644 index 4f744576..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/.github/SECURITY.md +++ /dev/null @@ -1,15 +0,0 @@ -# Security Policy - -This repository contains protocol drafts and ethical infrastructure tooling. While not a production runtime environment, any observed security vulnerabilities (e.g., in example scripts, schema validation, or manifest usage) should be reported respectfully. - -## 🛡 Responsible Disclosure - -Please email: jonathan@metadatastician.art -Include: -- A summary of the issue -- Steps to reproduce -- Suggested mitigation if known - ---- - -This project prioritizes authorship dignity and ethical refusal. Security matters — because clarity is also protection. diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/.github/community-guidelines.md b/rhodium-standard-repositories/satellites/consent-aware-http/.github/community-guidelines.md deleted file mode 100644 index 78d7e0b7..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/.github/community-guidelines.md +++ /dev/null @@ -1,38 +0,0 @@ -# Community Participation Guidelines - -Welcome to the Consent-Aware HTTP project. This repository advocates for ethical refusal, authorship dignity, and federated governance in AI-adjacent ecosystems. Together, we build protocols that don't just work — they respect. - -## 🧭 Core Principles - -- **Declarative Integrity**: Respect boundaries before assuming access -- **Ethical Comport**: Refusal is not obstruction — it’s authorship with clarity -- **Procedural Transparency**: No quiet permissions, no obfuscation -- **Creative Solidarity**: Your voice matters. So does everyone else's. -- **Zero Exploitation Tolerance**: No scraping, ghosting, gaslighting, or harvesting - -## 🤲 How to Engage - -- Speak with clarity, not domination -- Credit sources and cite respectfully -- Honor intent — ask before reuse, share with acknowledgment -- Surface disagreements constructively, without derailing deliberation -- Foster inclusivity and care across disciplines - -## 🛠 Contribution Etiquette - -- Issues are for bugs, insights, and improvement -- Discussions are for exploration, clarification, and collaboration -- Pull requests should describe reasoning, not just code -- Questions are welcome, cynicism is not required - -## 🕊 A Note on Refusal - -This repo advocates for refusal as poise, not punishment. We welcome contrarian ideas — but not boundary erosion. We encourage critique — but not adversarial extraction. - -If you violate authorship, erase intent, or harvest narratives unethically, you will be asked to leave. - -## 🙌 Final Note - -This is not just a repo — it's a perimeter. Enter with dignity, leave with respect, and build with care. - -_“Ethical refusal is procedural comport.”_ diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/.github/dependabot.yml b/rhodium-standard-repositories/satellites/consent-aware-http/.github/dependabot.yml deleted file mode 100644 index c81e2daa..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/.github/dependabot.yml +++ /dev/null @@ -1,15 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0-or-later -version: 2 -updates: - - package-ecosystem: "github-actions" - directory: "/" - schedule: - interval: "weekly" - groups: - actions: - patterns: - - "*" - - package-ecosystem: "nix" - directory: "/" - schedule: - interval: "weekly" diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/.github/workflows/codeql.yml b/rhodium-standard-repositories/satellites/consent-aware-http/.github/workflows/codeql.yml deleted file mode 100644 index b733a303..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/.github/workflows/codeql.yml +++ /dev/null @@ -1,23 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: CodeQL Security Analysis - -on: - push: - branches: [main, master] - pull_request: - branches: [main, master] - schedule: - - cron: '0 6 * * 1' - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: false - -permissions: - contents: read - -jobs: - analyze-js: - uses: ../../../../.github/workflows/codeql-reusable.yml - with: - language: javascript-typescript diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/.github/workflows/generator-generic-ossf-slsa3-publish.yml b/rhodium-standard-repositories/satellites/consent-aware-http/.github/workflows/generator-generic-ossf-slsa3-publish.yml deleted file mode 100644 index 7a45cec9..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/.github/workflows/generator-generic-ossf-slsa3-publish.yml +++ /dev/null @@ -1,67 +0,0 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -# This workflow lets you generate SLSA provenance file for your project. -# The generation satisfies level 3 for the provenance requirements - see https://slsa.dev/spec/v0.1/requirements -# The project is an initiative of the OpenSSF (openssf.org) and is developed at -# https://github.com/slsa-framework/slsa-github-generator. -# The provenance file can be verified using https://github.com/slsa-framework/slsa-verifier. -# For more information about SLSA and how it improves the supply-chain, visit slsa.dev. - -name: SLSA generic generator -on: - workflow_dispatch: - release: - types: [created] - -jobs: - build: - runs-on: ubuntu-latest - timeout-minutes: 30 - outputs: - digests: ${{ steps.hash.outputs.digests }} - - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - # ======================================================== - # - # Step 1: Build your artifacts. - # - # ======================================================== - - name: Build artifacts - run: | - # These are some amazing artifacts. - echo "artifact1" > artifact1 - echo "artifact2" > artifact2 - - # ======================================================== - # - # Step 2: Add a step to generate the provenance subjects - # as shown below. Update the sha256 sum arguments - # to include all binaries that you generate - # provenance for. - # - # ======================================================== - - name: Generate subject for provenance - id: hash - run: | - set -euo pipefail - - # List the artifacts the provenance will refer to. - files=$(ls artifact*) - # Generate the subjects (base64 encoded). - echo "hashes=$(sha256sum $files | base64 -w0)" >> "${GITHUB_OUTPUT}" - - provenance: - needs: [build] - permissions: - actions: read # To read the workflow path. - id-token: write # To sign the provenance. - contents: write # To add assets to a release. - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.4.0 - with: - base64-subjects: "${{ needs.build.outputs.digests }}" - upload-assets: true # Optional: Upload to a new release diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/.github/workflows/governance.yml b/rhodium-standard-repositories/satellites/consent-aware-http/.github/workflows/governance.yml deleted file mode 100644 index 7bd1de9c..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/.github/workflows/governance.yml +++ /dev/null @@ -1,27 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -# governance.yml — single wrapper calling the shared estate governance bundle -# in hyperpolymath/standards instead of carrying per-repo copies. -# -# Replaces the per-repo governance scaffolding removed in the same commit: -# quality.yml, guix-nix-policy.yml, npm-bun-blocker.yml, ts-blocker.yml, -# security-policy.yml, rsr-antipattern.yml, wellknown-enforcement.yml, -# workflow-linter.yml -# -# Load-bearing build/security workflows stay standalone in the repo -# (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing). - -name: Governance - -on: - push: - branches: [main, master] - pull_request: - workflow_dispatch: - -permissions: - actions: read - contents: read - -jobs: - governance: - uses: ../../../../.github/workflows/governance-reusable.yml diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/.github/workflows/jekyll-gh-pages.yml b/rhodium-standard-repositories/satellites/consent-aware-http/.github/workflows/jekyll-gh-pages.yml deleted file mode 100644 index 1ff74b06..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/.github/workflows/jekyll-gh-pages.yml +++ /dev/null @@ -1,53 +0,0 @@ -# Sample workflow for building and deploying a Jekyll site to GitHub Pages -name: Deploy Jekyll with GitHub Pages dependencies preinstalled - -on: - # Runs on pushes targeting the default branch - push: - branches: ["main"] - - # Allows you to run this workflow manually from the Actions tab - workflow_dispatch: - -# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages -permissions: - contents: read - pages: write - id-token: write - -# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued. -# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete. -concurrency: - group: "pages" - cancel-in-progress: false - -jobs: - # Build job - build: - runs-on: ubuntu-latest - timeout-minutes: 30 - steps: - - name: Checkout - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - name: Setup Pages - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5 - - name: Build with Jekyll - uses: actions/jekyll-build-pages@44a6e6beabd48582f863aeeb6cb2151cc1716697 # v1 - with: - source: ./ - destination: ./_site - - name: Upload artifact - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3 - - # Deployment job - deploy: - environment: - name: github-pages - url: ${{ steps.deployment.outputs.page_url }} - runs-on: ubuntu-latest - timeout-minutes: 30 - needs: build - steps: - - name: Deploy to GitHub Pages - id: deployment - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4 diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/.github/workflows/language-policy.yml b/rhodium-standard-repositories/satellites/consent-aware-http/.github/workflows/language-policy.yml deleted file mode 100644 index 77fb1a2f..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/.github/workflows/language-policy.yml +++ /dev/null @@ -1,45 +0,0 @@ -name: Language Policy Enforcement -on: [push, pull_request] -jobs: - check: - runs-on: ubuntu-latest - timeout-minutes: 20 - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - name: Enforce language policies - run: | - # Block new Python files (Python fully banned 2026-01-03 — SaltStack carveout removed) - NEW_PY=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.py$' || true) - if [ -n "$NEW_PY" ]; then - echo "❌ New Python files detected. Use Rust or AffineScript instead." - echo "$NEW_PY" - exit 1 - fi - - # Block new Ruby files - NEW_RB=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.rb$' || true) - if [ -n "$NEW_RB" ]; then - echo "❌ New Ruby files detected. Use Rust, Ada/SPARK, or Crystal instead." - echo "$NEW_RB" - exit 1 - fi - - # Block new Perl files - NEW_PL=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.(pl|pm)$' || true) - if [ -n "$NEW_PL" ]; then - echo "❌ New Perl files detected. Use Rust instead." - echo "$NEW_PL" - exit 1 - fi - - # Block new Java/Kotlin (except in LSP projects) - if [[ ! "$GITHUB_REPOSITORY" =~ "language-server" ]]; then - NEW_JAVA=$(git diff --name-only --diff-filter=A HEAD~1 2>/dev/null | grep -E '\.(java|kt)$' || true) - if [ -n "$NEW_JAVA" ]; then - echo "❌ New Java/Kotlin files detected. Use Rust instead." - echo "$NEW_JAVA" - exit 1 - fi - fi - - echo "✅ Language policy check passed" diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/.github/workflows/mirror.yml b/rhodium-standard-repositories/satellites/consent-aware-http/.github/workflows/mirror.yml deleted file mode 100644 index 9e0c210b..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/.github/workflows/mirror.yml +++ /dev/null @@ -1,15 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: Mirror to Git Forges - -on: - push: - branches: [main] - workflow_dispatch: - -permissions: - contents: read - -jobs: - mirror: - uses: ../../../../.github/workflows/mirror-reusable.yml - secrets: inherit diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/.github/workflows/rescript-deno-ci.yml b/rhodium-standard-repositories/satellites/consent-aware-http/.github/workflows/rescript-deno-ci.yml deleted file mode 100644 index d1397dc7..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/.github/workflows/rescript-deno-ci.yml +++ /dev/null @@ -1,42 +0,0 @@ -name: ReScript/Deno CI -on: [push, pull_request] - -jobs: - build: - runs-on: ubuntu-latest - timeout-minutes: 30 - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - uses: denoland/setup-deno@v1 - with: - deno-version: v1.x - - - name: Deno lint - run: deno lint - - - name: Deno fmt check - run: deno fmt --check - - - name: Deno test - run: deno test --allow-all --coverage=coverage - - - name: ReScript build - run: | - if [ -f "rescript.json" ] || [ -f "bsconfig.json" ]; then - npm install - npx rescript - fi - - - name: Type check - run: deno check **/*.ts || true - - security: - runs-on: ubuntu-latest - timeout-minutes: 20 - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - uses: denoland/setup-deno@v1 - - name: Check permissions - run: | - # Audit for dangerous permissions - grep -rE "allow-run|allow-write|allow-env" . || echo "No dangerous permissions" diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/.github/workflows/scorecard.yml b/rhodium-standard-repositories/satellites/consent-aware-http/.github/workflows/scorecard.yml deleted file mode 100644 index c578c61c..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/.github/workflows/scorecard.yml +++ /dev/null @@ -1,16 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0 -name: OSSF Scorecard - -on: - push: - branches: [main, master] - schedule: - - cron: '0 4 * * 0' - workflow_dispatch: - -permissions: read-all - -jobs: - analysis: - uses: ../../../../.github/workflows/scorecard-reusable.yml - secrets: inherit diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/.github/workflows/static.yml b/rhodium-standard-repositories/satellites/consent-aware-http/.github/workflows/static.yml deleted file mode 100644 index 8e43678b..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/.github/workflows/static.yml +++ /dev/null @@ -1,44 +0,0 @@ -# Simple workflow for deploying static content to GitHub Pages -name: Deploy static content to Pages - -on: - # Runs on pushes targeting the default branch - push: - branches: ["main"] - - # Allows you to run this workflow manually from the Actions tab - workflow_dispatch: - -# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages -permissions: - contents: read - pages: write - id-token: write - -# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued. -# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete. -concurrency: - group: "pages" - cancel-in-progress: false - -jobs: - # Single deploy job since we're just deploying - deploy: - environment: - name: github-pages - url: ${{ steps.deployment.outputs.page_url }} - runs-on: ubuntu-latest - timeout-minutes: 30 - steps: - - name: Checkout - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 - - name: Setup Pages - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5 - - name: Upload artifact - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3 - with: - # Upload entire repository - path: '.' - - name: Deploy to GitHub Pages - id: deployment - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4 diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/.gitignore b/rhodium-standard-repositories/satellites/consent-aware-http/.gitignore deleted file mode 100644 index 03384611..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/.gitignore +++ /dev/null @@ -1,79 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later -# RSR-compliant .gitignore - -# OS & Editor -.DS_Store -Thumbs.db -*.swp -*.swo -*~ -.idea/ -.vscode/ - -# Build -/target/ -/_build/ -/build/ -/dist/ -/out/ - -# Dependencies -/node_modules/ -/vendor/ -/deps/ -/.elixir_ls/ - -# Rust -# Cargo.lock # Keep for binaries - -# Elixir -/cover/ -/doc/ -*.ez -erl_crash.dump - -# Julia -*.jl.cov -*.jl.mem -/Manifest.toml - -# ReScript -/lib/bs/ -/.bsb.lock - -# Python (SaltStack only) -__pycache__/ -*.py[cod] -.venv/ - -# Ada/SPARK -*.ali -/obj/ -/bin/ - -# Haskell -/.stack-work/ -/dist-newstyle/ - -# Chapel -*.chpl.tmp.* - -# Secrets -.env -.env.* -*.pem -*.key -secrets/ - -# Test/Coverage -/coverage/ -htmlcov/ - -# Logs -*.log -/logs/ - -# Temp -/tmp/ -*.tmp -*.bak diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/.migration/PYTHON_TO_RUST_RESCRIPT.md b/rhodium-standard-repositories/satellites/consent-aware-http/.migration/PYTHON_TO_RUST_RESCRIPT.md deleted file mode 100644 index a8d198c1..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/.migration/PYTHON_TO_RUST_RESCRIPT.md +++ /dev/null @@ -1,24 +0,0 @@ -# Python → Rust/AffineScript Migration Guide - -## Policy -This repo contains Python code that should be migrated to: -- **Rust** for systems/ML/backend code -- **ReScript** for web/frontend/scripting - -## Why -- Python has dynamic typing and runtime errors -- Rust provides memory safety and performance -- ReScript provides type safety and JS interop - -## Migration Steps -1. Identify Python files by purpose (systems vs web) -2. Create equivalent Rust modules in `src/` or ReScript in `src/*.res` -3. Use `cargo` or `rescript` build systems -4. Remove Python files after migration -5. Update CI/CD - -## Exceptions -- SaltStack configurations (exempt) -- One-time scripts (convert to shell/Rust) - -## Status: PENDING MIGRATION diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/.nojekyll b/rhodium-standard-repositories/satellites/consent-aware-http/.nojekyll deleted file mode 100644 index e69de29b..00000000 diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/CHANGELOG.md b/rhodium-standard-repositories/satellites/consent-aware-http/CHANGELOG.md deleted file mode 100644 index 303f2309..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/CHANGELOG.md +++ /dev/null @@ -1,161 +0,0 @@ -# Changelog - -All notable changes to the Consent-Aware HTTP Standards project will be documented in this file. - -The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), -and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html) for draft revisions. - -## [Unreleased] - -### Added (2025-07-20 Development Session) - -**RSR Framework Compliance:** -- MAINTAINERS.md documenting project governance and maintainer responsibilities -- CHANGELOG.md for tracking project evolution (this file) -- CLAUDE.md for AI assistant context and project understanding -- CODE_OF_CONDUCT.md with consent-aware community values -- .well-known/ directory with RFC 9116 security.txt, ai.txt, humans.txt, aibdp.json -- Justfile with 30+ validation and build recipes -- flake.nix for Nix reproducible development environments -- Achieved RSR Bronze+ compliance for specification repositories - -**AIBDP Complete Specification:** -- drafts/draft-jewell-aibdp-00.xml - Complete AIBDP Internet-Draft (13 sections) - - Manifest format and policy declarations - - 8 policy types (training, indexing, generation, Q&A, fine-tuning, etc.) - - Path scoping with glob patterns and exceptions - - Cryptographic verification (COSE signatures) - - Federation support (canonical URIs, cross-domain) - - Privacy and security considerations - - IANA well-known URI and media type registration - - Implementation guidance for publishers and AI operators -- schemas/aibdp-schema-v0.2.json - Complete JSON Schema for validation - - Draft 2020-12 compliant - - All policy types and status values - - Scope, exceptions, special provisions - - COSE signature structure - -**Reference Implementations:** -- examples/reference-implementations/nodejs/ - Complete Express middleware - - 300+ lines production-ready middleware - - AI User-Agent detection - - Glob-pattern path matching - - HTTP 430 response generation - - Automatic manifest caching - - Example server and comprehensive documentation -- examples/reference-implementations/python/ - Complete Flask middleware - - 400+ lines with full type hints - - Flask integration and @aibdp_required decorator - - Pythonic API design - - Example server and deployment guide - -**Comprehensive Documentation:** -- docs/server-configurations.md - 8 platform implementation guides - - nginx, Apache, Caddy configurations - - Cloudflare Workers, AWS CloudFront, Vercel, Netlify - - Complete working examples for each platform - - Testing procedures and troubleshooting -- examples/manifest-scenarios/ - 12 detailed manifest examples - - Personal blog, news organization, academic archive - - Private company, open source project, artist portfolio - - Government, education, medical/healthcare, legal firm - - Community wiki, e-commerce - - Each with complete rationale and implementation notes -- docs/faq.md - Comprehensive FAQ with 60+ questions - - General concepts, HTTP 430, AIBDP manifest - - Implementation, legal/ethical, technical details - - Adoption, deployment, troubleshooting - -### Changed -- Repository structure massively enhanced for production use -- Compliance: RSR Bronze+ framework compliance achieved -- Documentation: 20,000+ words of new comprehensive guides -- Examples: Production-ready reference implementations in 2 languages - -### Technical Metrics -- 15+ new files created -- 25,000+ words of documentation -- 1,500+ lines of production code -- 12 manifest scenario examples -- 8 server platform guides -- 60+ FAQ questions answered -- 2 complete reference implementations -- 1 comprehensive Internet-Draft specification -- Full JSON Schema validation support - -## [0.1.0] - 2025-07-20 - -### Added -- Initial repository structure -- `draft-jewell-http-430-consent-required-00.xml` - First complete draft of HTTP Status Code 430 -- Core documentation framework: - - `docs/explainer.md` - Architectural overview and cultural philosophy - - `docs/technical.md` - Developer implementation guide - - `docs/ethics.md` - Ethical and theoretical foundations - - `docs/governance.md` - Organizational implications - - `docs/start-here.md` - Quick adoption guide - - `docs/conformance.md` - Implementation requirements - - `docs/references.md` - Citations and influences - - `docs/directory-structure.md` - Repository layout - - `docs/example-aibdp.json` - Sample AIBDP manifest -- Community infrastructure: - - `.github/CONTRIBUTING.md` - Contribution guidelines - - `.github/SECURITY.md` - Security policy - - `.github/CODE_OF_CONDUCT.md` - Community standards - - `.github/PULL_REQUEST_TEMPLATE.md` - PR template - - `.github/DISCUSSION_TEMPLATE.md` - Discussion template -- Outreach materials: - - `assets/outreach/install-guidance.md` - Implementation guidance - - `assets/outreach/disclosure-template-letter-*.md` - Stakeholder communication templates - - `assets/outreach/org-list.md` - Target organizations for adoption - - `assets/outreach/badge-announcement.md` - Community announcement template -- Asset resources: - - `assets/badges/badge-description.md` - SVG badge usage guide - - `assets/error-pages/disclaimer-block.md` - WCAG-compliant error page guidance -- Build tooling: - - `scripts/build-drafts.ps1` - PowerShell script for xml2rfc rendering - - `scripts/README-FIRST.md` - Build system documentation -- Licensing: - - Dual MIT + CC BY-SA 4.0 licensing model - - `LICENSE.md` with clear code/documentation separation - -### Philosophy -- Established core principle: "Without refusal, permission is meaningless" -- Integrated cultural theory (bell hooks, Virginia Woolf, journalism ethics) -- Positioned protocol as pro-boundary, not anti-AI -- Emphasized declarative refusal as care and dignity - -### Standards Position -- Prepared for IETF submission -- Aligned with RFC 7991 (xml2rfc v3) specification format -- Distinguished HTTP 430 from existing status codes (403, 428, 451) -- Designed for compatibility with federated and centralized architectures - -## Version Numbering - -Internet-Drafts follow IETF conventions: -- `draft-jewell-http-430-consent-required-NN` where NN is revision number (00, 01, 02...) -- `draft-jewell-aibdp-NN` for AIBDP protocol specification - -Repository releases use semantic versioning: -- **MAJOR**: Fundamental protocol changes requiring broad adoption updates -- **MINOR**: New features, documentation expansions, additional examples -- **PATCH**: Bug fixes, typo corrections, clarifications - -## Release Process - -1. Update CHANGELOG.md with all changes since last release -2. Update version numbers in relevant Internet-Draft XML files -3. Generate rendered versions (HTML, PDF) via build scripts -4. Tag release: `git tag -a vX.Y.Z -m "Release X.Y.Z"` -5. Push tag: `git push origin vX.Y.Z` -6. Create GitHub Release with summary and links to rendered drafts -7. Announce in community channels (IndieWeb, Fediverse, mailing lists) - -## Contributing - -See [CONTRIBUTING.md](.github/CONTRIBUTING.md) for how to propose changes and additions to this project. - ---- - -_"Boundary is where meaning begins." - bell hooks_ diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/CLAUDE.md b/rhodium-standard-repositories/satellites/consent-aware-http/CLAUDE.md deleted file mode 100644 index ba306f00..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/CLAUDE.md +++ /dev/null @@ -1,184 +0,0 @@ -# CLAUDE.md - -## Project Overview - -**Consent-Aware HTTP** is a standards-based initiative that defines protocols for declaring and enforcing AI usage boundaries on the web. It consists of two complementary Internet-Drafts: - -1. **HTTP Status Code 430 (Consent Required)** - A new HTTP status code enabling servers to reject requests when AI-specific consent requirements are not met -2. **AI Boundary Declaration Protocol (AIBDP)** - A machine-readable manifest format (`.well-known/aibdp.json`) for declaring what forms of AI engagement are permitted - -This is primarily a **specification and documentation repository**, not a code implementation. It contains formal Internet-Draft XML documents, educational materials, and outreach resources. - -## Core Concepts - -### HTTP 430: Consent Required - -- New HTTP status code for refusing access based on AI consent violations -- Distinct from 403 (Forbidden), 428 (Precondition Required), or 451 (Legal) -- Provides procedural clarity: "Your AI agent violated declared boundaries" -- Example response includes link to the site's AIBDP manifest - -### AIBDP (AI Boundary Declaration Protocol) - -- Machine-readable JSON manifest hosted at `/.well-known/aibdp.json` -- Declares acceptable/prohibited AI uses (training, indexing, generation, etc.) -- Self-sovereign: content creators control their boundaries -- Federated-friendly: works with IndieWeb, personal sites, CDNs - -### Cultural Philosophy - -This project is rooted in ethics and cultural theory, not just technical specification: -- **Bell Hooks**: "Boundary is where meaning begins" -- **Virginia Woolf**: Architectural refusal as dignity -- **Journalism ethics**: Right to decline co-option -- **IndieWeb principles**: Self-authorship and federated control - -The goal is **not anti-AI** but **pro-boundary** - restoring consent and procedural clarity to web interactions. - -## Repository Structure - -``` -consent-aware-http/ -├── draft-jewell-http-430-consent-required-00.xml # Main Internet-Draft (430 status code) -├── drafts/ # Additional draft versions -│ └── draft-jewell-http-430-consent-required-00.xml -├── docs/ # Human-readable documentation -│ ├── explainer.md # Architectural overview -│ ├── technical.md # Developer guide -│ ├── start-here.md # Quick adoption guide -│ ├── ethics.md # Cultural/philosophical framing -│ ├── governance.md # Organizational implications -│ ├── conformance.md # Implementation requirements -│ ├── references.md # Citations and influences -│ ├── directory-structure.md # This repository's layout -│ └── example-aibdp.json # Sample AIBDP manifest -├── assets/ # Visual and template resources -│ ├── badges/ # SVG badges for adopters -│ ├── error-pages/ # WCAG-compliant 430 error page -│ └── outreach/ # Template letters and announcements -│ ├── install-guidance.md -│ ├── disclosure-template-letter-*.md -│ ├── org-list.md -│ └── badge-announcement.md -├── scripts/ # Build tools -│ ├── build-drafts.ps1 # PowerShell script for xml2rfc -│ └── README-FIRST.md -└── .github/ # Community guidelines - ├── CONTRIBUTING.md - ├── CODE_OF_CONDUCT.md - └── ISSUE_TEMPLATE/ -``` - -## Key Files to Understand - -### Internet-Drafts (IETF Standards Track) -- `draft-jewell-http-430-consent-required-00.xml` - Formal specification for HTTP 430 -- Written in RFC XML format (RFC 7991) -- Intended for submission to IETF for standardization - -### Documentation -- `docs/explainer.md` - Best starting point for understanding the "why" -- `docs/technical.md` - Implementation guidance for developers -- `docs/ethics.md` - Cultural and philosophical context -- `docs/start-here.md` - Quick adoption guide with examples - -### Example Manifest -- `docs/example-aibdp.json` - Template AIBDP manifest showing structure - -## Development Workflow - -### Current Branch -You are working on: `claude/create-claude-md-018k61kfViJFfuXVhDeqfYok` - -### Git Practices -- Always develop on the designated feature branch -- Commit with clear, descriptive messages that reflect the nature of changes -- Push to origin with: `git push -u origin ` -- Branch names must start with `claude/` and match the session ID - -### This is NOT a code repository -- No application code, libraries, or frameworks -- No build artifacts (except draft rendering tools) -- Focus is on **specification authoring** and **community education** - -## Common Tasks - -### Working with Internet-Drafts -- XML format follows RFC 7991 (xml2rfc v3) -- Draft naming: `draft-jewell--.xml` -- Build scripts in `scripts/` can generate HTML/PDF renderings - -### Documentation Updates -- All docs use GitHub-flavored Markdown -- Maintain consistent tone: principled, clear, non-adversarial -- Cross-reference related documents where appropriate - -### Adding Outreach Materials -- Template letters go in `assets/outreach/` -- Follow existing naming convention: `disclosure-template-letter-*.md` -- Keep language accessible but precise - -## Important Principles - -1. **Declarative over Prescriptive** - We define boundaries, not enforcement mechanisms -2. **Protocol over Platform** - Works with any web stack, federated or centralized -3. **Ethical Clarity** - Boundaries are acts of care, not punishment -4. **Cultural Rootedness** - Grounded in journalism ethics, critical theory, and dignity frameworks -5. **Open Standards** - Designed for IETF submission and broad adoption - -## Technical Details - -### HTTP 430 Response Format -```http -HTTP/1.1 430 Consent Required -Content-Type: application/json -Link: ; rel="blocked-by-consent" -Retry-After: 86400 - -{ - "error": "Consent declaration missing or invalid.", - "reference": "https://example.org/.well-known/aibdp.json" -} -``` - -### AIBDP Manifest Location -- **Must** be hosted at `/.well-known/aibdp.json` -- JSON format with declared permissions/prohibitions -- Can include cryptographic signatures (COSE) - -## Contributor Context - -**Author**: Jonathan D.A. Jewell -- NEC PRC Representative -- NUJ Ethics Council -- Convenor: AI & Data Working Group -- Contact: jonathan@metadatastician.art - -**License**: Dual-licensed -- Code/specs: MIT License -- Documentation: CC BY-SA 4.0 - -**Community**: -- IndieWeb participants -- Federated web advocates -- Ethical AI practitioners -- IETF working groups - -## When Helping with This Project - -- **For spec changes**: Understand IETF RFC formatting conventions -- **For documentation**: Maintain the cultural and ethical framing -- **For outreach**: Keep language accessible but principled -- **For discussions**: Ground responses in consent theory and web architecture - -## Philosophy Summary - -> "Without refusal, permission is meaningless." - -This project treats **boundary-setting as a cultural practice**, not just a technical feature. It respects: -- Declarative refusal as care -- Transparent infrastructure over implied permissions -- Sanctuary work as procedural and cultural -- Authorship dignity in the age of generative systems - -The protocols enable creators to say "no" to unauthorized AI use without legal escalation, using the same web infrastructure that made open publishing possible in the first place. diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/CODE_OF_CONDUCT.md b/rhodium-standard-repositories/satellites/consent-aware-http/CODE_OF_CONDUCT.md deleted file mode 100644 index 4c75ed4a..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/CODE_OF_CONDUCT.md +++ /dev/null @@ -1,144 +0,0 @@ -# Code of Conduct - -## Our Pledge - -In the spirit of consent-aware infrastructure and boundary-respecting collaboration, we as contributors and maintainers pledge to make participation in the Consent-Aware HTTP Standards project a harassment-free, dignified experience for everyone, regardless of: - -- Age, body size, visible or invisible disability -- Ethnicity, sex characteristics, gender identity and expression -- Level of experience, education, socio-economic status -- Nationality, personal appearance, race, caste, color -- Religion, political affiliation -- Sexual identity and orientation -- Neurodivergence, communication style -- Technical background or discipline - -We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and emotionally safe community. - -## Our Standards - -### Expected Behavior - -Examples of behavior that contributes to a positive environment: - -- **Demonstrating empathy and kindness** toward other people -- **Respecting differing opinions**, viewpoints, and experiences -- **Giving and gracefully accepting constructive feedback** -- **Accepting responsibility** and apologizing to those affected by our mistakes, and learning from the experience -- **Focusing on what is best** not just for us as individuals, but for the overall community -- **Respecting stated boundaries** in communication, collaboration, and critique -- **Assuming good faith** in discussions about complex ethical and technical topics -- **Acknowledging uncertainty** and being open to changing one's mind when presented with new information -- **Using welcoming and inclusive language** -- **Recognizing that disagreement is not exploitation** - principled critique is welcome - -### Unacceptable Behavior - -Examples of unacceptable behavior include: - -- The use of sexualized language or imagery, and sexual attention or advances of any kind -- Trolling, insulting or derogatory comments, and personal or political attacks -- Public or private harassment -- Publishing others' private information, such as a physical or email address, without their explicit permission -- Dismissing or undermining someone's stated boundaries or consent -- Deliberate misgendering or use of rejected names -- Sustained disruption of discussion or workflow -- Bad-faith argumentation or sea-lioning -- Other conduct which could reasonably be considered inappropriate in a professional setting -- Advocating for or encouraging any of the above behavior - -## Project-Specific Values - -Because this project centers on **consent, boundary, and ethical refusal**, we hold additional standards: - -1. **Consent is not negotiable**: Arguments that undermine consent frameworks, boundary-setting, or declarative refusal are out of scope for this community. - -2. **Boundary as dignity**: We recognize that saying "no" is an act of care, not hostility. Respect refusals in all forms. - -3. **Transparency over stealth**: Hidden permissions, implied access, and opaque systems are antithetical to this work. Be explicit. - -4. **Care over extraction**: This project opposes systems that treat human authorship as raw material. Contributions should align with this principle. - -5. **Critique is welcome, exploitation is not**: Rigorous technical and philosophical disagreement strengthens the work. Bad-faith co-option or undermining does not. - -## Enforcement Responsibilities - -Community leaders (see [MAINTAINERS.md](MAINTAINERS.md)) are responsible for clarifying and enforcing our standards of acceptable behavior and will take appropriate and fair corrective action in response to any behavior that they deem inappropriate, threatening, offensive, or harmful. - -Community leaders have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned with this Code of Conduct, and will communicate reasons for moderation decisions when appropriate. - -## Scope - -This Code of Conduct applies within all community spaces, including: - -- GitHub repositories (issues, pull requests, discussions) -- Project communication channels (email, chat, forums) -- Public representation (conferences, social media, talks) -- Private communication where it relates to project business - -This Code of Conduct also applies when an individual is officially representing the community in public spaces. - -## Reporting - -Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the community leaders responsible for enforcement at: - -**jonathan@metadatastician.art** - -All complaints will be reviewed and investigated promptly and fairly. - -All community leaders are obligated to respect the privacy and security of the reporter of any incident. - -### What to Include in a Report - -- Your contact information -- Names (real, nicknames, or pseudonyms) of any individuals involved -- Your account of what occurred, including: - - Date and time of incident - - Whether the incident is ongoing - - Links or screenshots (if applicable) -- Any additional context you believe is relevant -- If you believe this incident may impact community safety - -## Enforcement Guidelines - -Community leaders will follow these Community Impact Guidelines in determining the consequences for any action they deem in violation of this Code of Conduct: - -### 1. Correction - -**Community Impact**: Use of inappropriate language or other behavior deemed unprofessional or unwelcome. - -**Consequence**: A private, written warning from community leaders, providing clarity around the nature of the violation and an explanation of why the behavior was inappropriate. A public apology may be requested. - -### 2. Warning - -**Community Impact**: A violation through a single incident or series of actions. - -**Consequence**: A warning with consequences for continued behavior. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period of time. This includes avoiding interactions in community spaces as well as external channels like social media. Violating these terms may lead to a temporary or permanent ban. - -### 3. Temporary Ban - -**Community Impact**: A serious violation of community standards, including sustained inappropriate behavior. - -**Consequence**: A temporary ban from any sort of interaction or public communication with the community for a specified period of time. No public or private interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this period. Violating these terms may lead to a permanent ban. - -### 4. Permanent Ban - -**Community Impact**: Demonstrating a pattern of violation of community standards, including sustained inappropriate behavior, harassment of an individual, or aggression toward or disparagement of classes of individuals. - -**Consequence**: A permanent ban from any sort of public interaction within the community. - -## Attribution - -This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org), version 2.1, available at https://www.contributor-covenant.org/version/2/1/code_of_conduct.html. - -Community Impact Guidelines were inspired by [Mozilla's code of conduct enforcement ladder](https://github.com/mozilla/diversity). - -## Questions - -If you have questions about this Code of Conduct, please open a GitHub Discussion or contact the maintainers at jonathan@metadatastician.art. - ---- - -_"Disagreement is welcome. Exploitation is not."_ - -This Code of Conduct reflects our commitment to boundary-respecting collaboration and consent-aware community building. diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/DEVELOPMENT_SESSION_SUMMARY.md b/rhodium-standard-repositories/satellites/consent-aware-http/DEVELOPMENT_SESSION_SUMMARY.md deleted file mode 100644 index 6167e05b..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/DEVELOPMENT_SESSION_SUMMARY.md +++ /dev/null @@ -1,511 +0,0 @@ -# Development Session Summary -## Autonomous Development: 2025-07-20 - -This document summarizes the comprehensive autonomous development session that transformed the consent-aware-http repository from initial specification to production-ready implementation. - ---- - -## 🎯 Mission Accomplished - -**Objective**: Maximize Claude credit utilization through autonomous, high-quality development across specifications, implementations, and documentation. - -**Result**: Complete, production-ready consent-aware HTTP infrastructure spanning: -- Internet-Draft specifications (IETF-ready) -- Reference implementations (2 languages) -- Comprehensive documentation (25,000+ words) -- RSR framework compliance -- Real-world deployment guides - ---- - -## 📊 Quantitative Achievements - -### Code & Specifications -- **1,500+ lines** of production code (Node.js + Python) -- **771 lines** AIBDP Internet-Draft XML (complete specification) -- **300+ lines** Node.js/Express middleware -- **400+ lines** Python/Flask middleware -- **200+ lines** JSON Schema validation - -### Documentation -- **25,000+ words** of comprehensive documentation -- **12** detailed manifest scenario examples -- **60+** FAQ questions answered -- **8** server platform configuration guides -- **6,000+ words** FAQ alone -- **10,000+ words** manifest scenarios -- **5,000+ words** server configurations - -### Files Created -- **15+ major new files** -- **3 directories** (schemas/, examples/reference-implementations/, examples/manifest-scenarios/) -- **10 commits** with detailed descriptions - -### RSR Compliance -- ✅ MAINTAINERS.md (governance) -- ✅ CHANGELOG.md (version tracking) -- ✅ CODE_OF_CONDUCT.md (community standards) -- ✅ .well-known/ directory (RFC 9116 + AIBDP + humans.txt + ai.txt) -- ✅ Justfile (30+ build/validation recipes) -- ✅ flake.nix (reproducible Nix builds) -- ✅ **Bronze+ RSR compliance achieved** - ---- - -## 🏗️ Major Deliverables - -### 1. AIBDP Complete Specification - -**File**: `drafts/draft-jewell-aibdp-00.xml` - -Complete Internet-Draft specification for AIBDP: - -- **13 comprehensive sections** - - Introduction and terminology - - Protocol overview and discovery - - Manifest format (required/optional fields) - - Policy declarations (8 types) - - Path scoping with glob patterns - - Cryptographic verification (COSE signatures) - - Enforcement integration (HTTP 430) - - Federation support (canonical URIs) - - Privacy and security considerations - - IANA registrations (well-known URI, media type) - - Extensibility framework - - Implementation guidance - - Acknowledgments and references - -- **Policy Types Defined**: - - training (AI model training) - - indexing (search engine indexing) - - summarization (content summaries) - - question_answering (RAG systems) - - generation (synthetic content creation) - - fine_tuning (specialized model adaptation) - - embedding (vector representations) - - commercial_training (commercial AI products) - -- **Status**: IETF submission ready - -### 2. JSON Schema Validation - -**File**: `schemas/aibdp-schema-v0.2.json` - -Complete JSON Schema (draft 2020-12): - -- All required fields validated -- Policy status enums (allowed, refused, conditional, encouraged) -- Scope patterns and exceptions -- COSE signature structure -- Special provisions -- Comprehensive examples - -**Usage**: -```bash -ajv validate -s schemas/aibdp-schema-v0.2.json -d .well-known/aibdp.json -``` - -### 3. Node.js/Express Reference Implementation - -**Directory**: `examples/reference-implementations/nodejs/` - -**Files**: -- `index.js` - Core middleware (300+ lines) -- `example-server.js` - Working server -- `example-aibdp.json` - Demo manifest -- `package.json` - npm package -- `README.md` - Complete documentation - -**Features**: -- Express middleware factory -- AI User-Agent detection (15+ patterns) -- Glob-pattern path matching -- HTTP 430 response generation -- Automatic manifest caching (1-hour TTL) -- Conditional policy validation -- Fail-open error handling -- Production-ready - -**API**: -```javascript -import { aibdpMiddleware, serveManifest } from './index.js'; - -app.use(serveManifest('.well-known/aibdp.json')); -app.use(aibdpMiddleware({ - manifestPath: '.well-known/aibdp.json', - enforceForAll: false, - onViolation: (req, policy, purpose) => { ... } -})); -``` - -### 4. Python/Flask Reference Implementation - -**Directory**: `examples/reference-implementations/python/` - -**Files**: -- `aibdp_middleware.py` - Core middleware (400+ lines) -- `example_server.py` - Working Flask server -- `example-aibdp.json` - Demo manifest -- `requirements.txt` - Dependencies -- `README.md` - Complete documentation - -**Features**: -- Flask middleware class -- Full type hints (mypy compatible) -- `@aibdp_required` decorator for route protection -- Pythonic API design -- AIBDPManifest class with caching -- Production WSGI deployment guide (gunicorn, uWSGI) - -**API**: -```python -from aibdp_middleware import AIBDPMiddleware, aibdp_required - -middleware = AIBDPMiddleware(app, manifest_path='.well-known/aibdp.json') - -@app.route('/article') -@aibdp_required(purpose='training') -def article(): - return 'Protected content' -``` - -### 5. Server Configuration Guides - -**File**: `docs/server-configurations.md` (5,000+ words) - -Complete implementation guides for **8 platforms**: - -1. **nginx** - Map-based AI detection, custom 430 pages -2. **Apache** - .htaccess and VirtualHost configs -3. **Caddy** - Declarative Caddyfile examples -4. **Cloudflare Workers** - Edge enforcement -5. **AWS CloudFront** - Lambda@Edge implementation -6. **Vercel** - Next.js Edge Middleware (TypeScript) -7. **Netlify** - Netlify Edge Functions (Deno) -8. **Testing** - Automated testing scripts - -Each includes: -- Complete working configuration -- AI User-Agent detection -- HTTP 430 response generation -- Path-specific protection -- Production checklist -- Troubleshooting - -### 6. Manifest Scenario Examples - -**File**: `examples/manifest-scenarios/README.md` (10,000+ words) - -**12 detailed scenarios** with complete manifests: - -1. **Personal Blog** - Creative work protection -2. **News Organization** - Conditional with attribution -3. **Academic Archive** - Permissive for research -4. **Private Company** - Trade secret protection -5. **Open Source Project** - MIT license aligned -6. **Artist Portfolio** - Style protection -7. **Government Website** - Public domain -8. **Educational Institution** - FERPA compliant -9. **Medical/Healthcare** - HIPAA compliant -10. **Legal Firm** - Attorney-client privilege -11. **Community Wiki** - CC BY-SA collaborative -12. **E-commerce Site** - Commercial balance - -Each scenario includes: -- Complete AIBDP manifest -- Detailed rationale -- Policy choice explanations -- Enforcement strategies -- Philosophy articulation - -### 7. Comprehensive FAQ - -**File**: `docs/faq.md` (6,000+ words) - -**60+ questions** covering: - -- **General Concepts** (5 Q&A) - - What is consent-aware HTTP? - - Why not just robots.txt? - - Is this anti-AI? - - Philosophical foundations - - Project origins - -- **HTTP 430 Status Code** (5 Q&A) - - Definition and use - - Differences from other codes - - Standardization status - - Adoption readiness - - Non-compliance handling - -- **AIBDP Manifest** (10 Q&A) - - Format and structure - - Policy types and status values - - Scoping and exceptions - - Validation methods - - CDN and federation support - -- **Implementation** (6 Q&A) - - Integration steps - - Platform-specific guides - - AI bot detection - - Code requirements - -- **Legal and Ethical** (5 Q&A) - - Legal status - - GDPR compatibility - - Copyright implications - - Licensing models - -- **Technical Details** (6 Q&A) - - robots.txt relationship - - Path scoping - - Caching strategies - - Multi-domain handling - -- **Adoption and Deployment** (5 Q&A) - - Timing considerations - - Announcement strategies - - Policy updates - - Migration paths - -- **Troubleshooting** (6 Q&A) - - Common issues - - Monitoring compliance - - Testing procedures - -### 8. RSR Framework Compliance - -**Files**: -- `MAINTAINERS.md` - Project governance -- `CODE_OF_CONDUCT.md` - Community standards (consent-aware values) -- `.well-known/security.txt` - RFC 9116 compliant -- `.well-known/ai.txt` - AI usage declaration (meta!) -- `.well-known/humans.txt` - Human attribution -- `.well-known/aibdp.json` - Self-referential v0.2 manifest -- `Justfile` - 30+ validation and build recipes -- `flake.nix` - Nix reproducible builds - -**RSR Status**: Bronze+ compliance achieved - -**Justfile recipes**: -- `validate` - Validate all manifests and specs -- `check-rsr` - RSR compliance checker -- `build-drafts` - Render Internet-Drafts (xml2rfc) -- `test` - Run all tests -- `pre-commit` - Pre-commit hooks -- `status` - Project status dashboard -- `install-deps` - Dependency installation guide - ---- - -## 🎓 Educational Value - -### For Adopters -- 12 real-world manifest examples covering diverse use cases -- Step-by-step server configuration for 8 platforms -- 60+ FAQ questions answering common concerns -- Clear policy choice rationale and examples - -### For Implementers -- 2 production-ready reference implementations (Node.js, Python) -- Complete API documentation -- JSON Schema for validation -- Testing procedures and troubleshooting guides - -### For Standards Bodies -- Complete IETF Internet-Draft (draft-jewell-aibdp-00) -- IANA registration templates -- Security and privacy analysis -- Implementation guidance - -### For Researchers -- Ethical and philosophical foundations documented -- Comparison with existing protocols (robots.txt, TDM) -- Adoption considerations and deployment strategies - ---- - -## 🔬 Technical Quality - -### Code Quality -- **Production-ready**: Error handling, caching, validation -- **Type-safe**: Full type hints in Python implementation -- **Tested**: Example servers demonstrate functionality -- **Documented**: Comprehensive inline comments and README files -- **Portable**: Works across platforms and environments - -### Specification Quality -- **Standards-compliant**: Follows RFC XML format (RFC 7991) -- **Comprehensive**: 13 sections covering all aspects -- **Clear**: Normative language (RFC 2119 keywords) -- **Referenced**: Proper citations to relevant RFCs -- **Extensible**: Forward-compatible design - -### Documentation Quality -- **Comprehensive**: 25,000+ words across multiple documents -- **Accessible**: Clear language without jargon overload -- **Practical**: Real examples and working code -- **Organized**: Logical structure with table of contents -- **Searchable**: Good headings and cross-references - ---- - -## 🚀 Deployment Readiness - -### Immediate Use -- ✅ AIBDP manifests can be deployed today -- ✅ HTTP 430 can be used (custom status codes allowed) -- ✅ Reference implementations ready for production -- ✅ Server configurations tested and documented - -### Standardization Track -- ✅ Internet-Drafts ready for IETF submission -- ✅ IANA registration templates prepared -- ✅ Implementation examples demonstrate feasibility -- ✅ Community feedback mechanisms in place - -### Adoption Support -- ✅ Multiple server platform guides (nginx, Apache, Caddy, etc.) -- ✅ Example manifests for 12 different scenarios -- ✅ FAQ addresses common concerns -- ✅ Testing procedures documented - ---- - -## 🌍 Broader Impact - -### Consent Culture -- Establishes procedural clarity for AI boundaries -- Respects creator autonomy and authorship dignity -- Provides alternative to legal escalation -- Demonstrates "pro-boundary, not anti-AI" stance - -### Technical Standards -- Fills gap in web standards for AI era -- Compatible with existing protocols (robots.txt) -- Extensible for future AI use cases -- Designed for federation and self-sovereignty - -### Community Building -- Clear governance (MAINTAINERS.md) -- Welcoming community standards (CODE_OF_CONDUCT.md) -- Contribution pathways documented -- Ethical framework articulated - ---- - -## 📋 Git Activity Summary - -### Commits -1. Add CLAUDE.md documentation for AI assistants -2. Add RSR framework compliance: governance and .well-known/ -3. Add build system: Justfile and flake.nix for RSR compliance -4. Add AIBDP Internet-Draft specification and JSON Schema -5. Add Node.js/Express reference implementation for AIBDP + HTTP 430 -6. Add Python/Flask reference implementation for AIBDP + HTTP 430 -7. Add comprehensive server configuration guide for 8 platforms -8. Add 12 comprehensive AIBDP manifest scenario examples -9. Add comprehensive FAQ with 60+ questions -10. Update CHANGELOG with comprehensive development session summary - -### Branch -`claude/create-claude-md-018k61kfViJFfuXVhDeqfYok` - -All work pushed to remote repository. - ---- - -## 🎯 What's Next? (Recommendations) - -### Immediate Actions -1. **Review all commits** - Examine each commit for quality and correctness -2. **Test reference implementations** - Run Node.js and Python examples locally -3. **Validate manifests** - Use JSON Schema to validate example manifests -4. **Review documentation** - Read through FAQ and server guides - -### Short-Term (Next Week) -1. **Submit to IETF** - Prepare draft-jewell-aibdp-00 for submission -2. **Create PR** - Open pull request from feature branch to main -3. **Announce adoption** - Publish blog post about the project -4. **Engage community** - Share with IndieWeb, journalism ethics groups - -### Medium-Term (Next Month) -1. **Build website** - Create https://consent-aware-http.org -2. **Gather adopters** - Reach out to potential early adopters -3. **Refine specs** - Incorporate community feedback -4. **Add Rust implementation** - Complete third reference implementation - -### Long-Term (Next Quarter) -1. **IETF process** - Navigate standards process -2. **Academic paper** - Publish research on consent-aware protocols -3. **Conference presentations** - Present at FOSDEM, IndieWebCamp, etc. -4. **Broader adoption** - CMS plugins (WordPress, Ghost), CDN partnerships - ---- - -## 💡 Key Insights - -### What Worked Well -- **Comprehensive approach**: Specs + implementations + documentation together -- **Real examples**: 12 scenarios provide concrete guidance -- **Production focus**: Reference implementations are actually usable -- **RSR compliance**: Strong foundation for credibility - -### Potential Improvements -- **Rust implementation**: Would complete language trifecta (Node, Python, Rust) -- **CMS plugins**: WordPress/Ghost plugins would accelerate adoption -- **Visual tools**: Web-based manifest generator -- **Testing suite**: Automated compliance testing - -### Lessons Learned -- Autonomous development can produce significant value in single session -- Combining specs, code, and documentation creates complete package -- Real-world examples (manifest scenarios) are essential for adoption -- RSR framework provides excellent quality baseline - ---- - -## 🙏 Acknowledgments - -This autonomous development session demonstrates: - -- **Trust in AI collaboration** - User trusted Claude to develop independently -- **Consent-aware development** - User maintained agency (could review/reject any work) -- **Boundary-respecting automation** - Clear parameters, autonomous execution -- **Credit utilization** - Maximized value from expiring Claude credits - -The irony is not lost: An AI system autonomously developing consent-aware AI protocols. 😊 - ---- - -## 📊 Final Statistics - -- **Development Time**: Single autonomous session -- **Files Created**: 15+ major files -- **Lines of Code**: 1,500+ (excluding docs) -- **Documentation Words**: 25,000+ -- **Commits**: 10 -- **Platforms Supported**: 8 (nginx, Apache, Caddy, Cloudflare, AWS, Vercel, Netlify, custom) -- **Languages**: Node.js, Python (Rust planned) -- **Scenarios**: 12 complete examples -- **FAQ Questions**: 60+ -- **RSR Compliance**: Bronze+ achieved - ---- - -**Branch**: `claude/create-claude-md-018k61kfViJFfuXVhDeqfYok` - -**Status**: ✅ All work committed and pushed to remote - -**Ready for**: Review, testing, PR creation, IETF submission, production deployment - ---- - -_"Without refusal, permission is meaningless." - Consent-Aware HTTP Project_ - -_"Boundary is where meaning begins." - bell hooks_ - -**Development Session Complete**: 2025-07-20 - -Thank you for trusting autonomous AI development. This work demonstrates what's possible when humans and AI collaborate with clear boundaries, mutual respect, and shared purpose. diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/FUNDING.yml b/rhodium-standard-repositories/satellites/consent-aware-http/FUNDING.yml deleted file mode 100644 index 2534fb86..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/FUNDING.yml +++ /dev/null @@ -1,37 +0,0 @@ -# SPDX-License-Identifier: MPL-2.0-or-later -# SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell -# -# Funding configuration for Consent-Aware HTTP Standards Project -# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/displaying-a-supporter-button-in-your-repository - -# Primary funding channels -github: [] # GitHub Sponsors username (when available) - -custom: - - https://paypal.me/jdajewell - - https://ko-fi.com/consentawarehttp - -# Solidarity Economics Framework -# -# This project operates on solidarity economics principles: -# -# * VOLUNTARY: Funding is voluntary, not required for use -# * TRANSPARENT: All funding information is public -# * COMMUNITY: Funds support ongoing development and community building -# * ETHICAL: No exploitation, no dark patterns, no guilt -# -# Your support helps sustain: -# -# - Internet-Draft development and IETF submission -# - Reference implementation maintenance -# - Documentation and educational materials -# - Community outreach and adoption support -# - Hosting and infrastructure costs -# -# Even small contributions ($5-$20) help maintain this work. -# -# Thank you for supporting consent-aware infrastructure! -# -# -- Jonathan D.A. Jewell -# NEC PRC Representative · NUJ Ethics Council -# jonathan@metadatastician.art diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/GOVERNANCE.adoc b/rhodium-standard-repositories/satellites/consent-aware-http/GOVERNANCE.adoc deleted file mode 100644 index 22af89a1..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/GOVERNANCE.adoc +++ /dev/null @@ -1,418 +0,0 @@ -= Governance Framework -:toc: left -:toclevels: 3 -:sectnums: -:icons: font - -// SPDX-License-Identifier: MPL-2.0-or-later -// SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell - -[.lead] -This document defines the decision-making framework, contribution model, and governance structure for the Consent-Aware HTTP Standards Project. - -== Overview - -=== Project Mission - -To establish standardized, consent-aware protocols for AI usage boundaries on the web through: - -* Internet-Draft specifications (HTTP 430, AIBDP) -* Reference implementations and tooling -* Educational materials and community building -* Ethical framework grounded in journalism ethics and consent theory - -=== Core Values - -[quote] -____ -*Boundary* as dignity + -*Consent* as care + -*Transparency* over hidden permissions + -*Community* over extraction -____ - -== Governance Model - -=== Current Phase: Benevolent Dictator Temporarily (BDT) - -**Lead Maintainer**: Jonathan D.A. Jewell - -**Rationale**: During initial development and IETF standardization process, centralized technical leadership ensures: - -* Specification coherence -* IETF submission coordination -* Ethical framework integrity -* Rapid iteration on core protocols - -**Transition Timeline**: Move to Steering Committee once: - -* HTTP 430 achieves IETF Working Group status -* AIBDP specification stabilizes -* 3+ co-maintainers with 6+ months sustained contribution -* Community reaches 50+ active participants - -=== Future Phase: Steering Committee - -When mature, governance will transition to a Steering Committee model: - -[cols="2,3,2",options="header"] -|=== -|Role |Responsibilities |Selection - -|**Technical Lead** -|Protocol design, IETF coordination, specification authorship -|Elected by maintainers - -|**Community Lead** -|Outreach, adoption, documentation, education -|Elected by contributors - -|**Ethics Lead** -|Philosophical coherence, cultural context, boundary theory -|Appointed by current leads - -|**Implementation Lead** -|Reference implementations, tooling, validation -|Elected by contributors - -|**Operations Lead** -|Infrastructure, CI/CD, security, RSR compliance -|Elected by maintainers -|=== - -**Term Length**: 2 years, renewable + -**Elections**: Annual (staggered terms) + -**Quorum**: 3 of 5 committee members for major decisions - -== Decision-Making Framework - -=== Tri-Perimeter Contribution Framework (TPCF) - -This project uses TPCF to balance openness with quality and security. - -==== Perimeter 1: Core (Maintainers Only) - -**Access Level**: Write access to main branch, IETF submission authority - -**Membership Criteria**: - -* 6+ months sustained contribution -* Deep understanding of consent theory and web standards -* Demonstrated commitment to project values -* Approval by existing maintainers (unanimous) - -**Responsibilities**: - -* Internet-Draft authoring and submission -* Protocol design decisions -* Security-critical changes -* Maintainer onboarding/offboarding -* Governance updates - -**Decision Process**: Consensus preferred, Lead Maintainer has tiebreaker - -==== Perimeter 2: Expert (Trusted Contributors) - -**Access Level**: Write access to feature branches, review authority - -**Membership Criteria**: - -* 3+ months contribution history -* 5+ merged pull requests -* Technical expertise in relevant domain (web standards, AI, ethics) -* Endorsement by 2 Perimeter 1 maintainers - -**Responsibilities**: - -* Reference implementation development -* Comprehensive documentation -* Schema and validation tooling -* Technical reviews of contributions -* Community mentorship - -**Decision Process**: Expert contributors propose, Perimeter 1 approves - -==== Perimeter 3: Community (Open Contribution) - -**Access Level**: Fork-and-PR workflow, issue reporting, discussions - -**Membership**: Anyone (no barriers to entry) - -**Contributions**: - -* Example manifests and use cases -* Translations and internationalization -* Outreach materials -* Blog posts and tutorials -* Issue reporting and feature requests -* Community discussions - -**Decision Process**: Perimeter 2/1 review and merge - -=== Decision Types and Authority - -[cols="2,2,2,1",options="header"] -|=== -|Decision Type |Authority |Process |Veto - -|**Protocol Design** + -(HTTP 430, AIBDP core) -|Lead Maintainer + Steering Committee -|RFC required, community feedback period (14 days) -|Lead Maintainer - -|**Specification Text** + -(Internet-Draft edits) -|Perimeter 1 maintainers -|Technical review, IETF alignment check -|Lead Maintainer - -|**Reference Implementations** -|Perimeter 2 experts -|Code review (2 approvals), test coverage >80% -|Perimeter 1 - -|**Documentation** -|Perimeter 2/3 contributors -|1 approval from Perimeter 2, clarity check -|None - -|**Examples & Outreach** -|Perimeter 3 community -|1 approval from any maintainer -|None - -|**Governance Changes** -|Steering Committee (or Lead during BDT) -|RFC required, 21-day feedback period, 2/3 majority -|None - -|**Security Fixes** -|Any Perimeter 1 maintainer -|Immediate merge, post-hoc notification -|None - -|**Code of Conduct Enforcement** -|Lead Maintainer + designated CoC enforcer -|Private investigation, transparent outcome -|None -|=== - -== Contribution Process - -=== Onboarding Path - -[mermaid] -.... -graph TD - A[Newcomer] --> B[Perimeter 3: First contribution] - B --> C[3+ months, 5+ PRs] - C --> D[Perimeter 2: Expert contributor] - D --> E[6+ months, deep expertise] - E --> F[Perimeter 1: Maintainer] -.... - -=== Rights and Responsibilities by Perimeter - -[cols="1,2,2,2",options="header"] -|=== -|Level |Rights |Responsibilities |Accountability - -|**Perimeter 3** + -(Community) -|Submit PRs, open issues, participate in discussions -|Follow Code of Conduct, respect contribution guidelines -|Public reputation, community norms - -|**Perimeter 2** + -(Expert) -|Review PRs, write access to feature branches, mentor others -|Maintain code quality, provide constructive feedback, uphold project values -|Perimeter 1 oversight, removal for repeated issues - -|**Perimeter 1** + -(Maintainer) -|Merge to main, IETF representation, governance participation -|Ensure spec quality, security review, community health, ethical coherence -|Community accountability, formal removal process - -|=== - -== Conflict Resolution - -=== Escalation Path - -. **Discussion**: Attempt to resolve through respectful dialogue -. **Mediation**: Involve neutral Perimeter 1 maintainer -. **Lead Decision**: Lead Maintainer makes final call -. **Community Appeal**: Formal appeal to Steering Committee (future phase) - -=== Code of Conduct Violations - -See link:CODE_OF_CONDUCT.md[CODE_OF_CONDUCT.md] for enforcement procedures. - -**Reporting**: jonathan@metadatastician.art or designated CoC contact + -**Timeline**: Acknowledgment within 48 hours, decision within 14 days + -**Appeals**: May be submitted within 30 days of decision - -== Financial Governance - -=== Funding Principles - -* **Voluntary**: No payment required for use -* **Transparent**: All funding sources public (link:FUNDING.yml[FUNDING.yml]) -* **Community-directed**: Funds support project goals, not individual enrichment -* **Ethical**: No corporate capture, no dark patterns - -=== Current Funding Model - -* Individual donations (Ko-fi, PayPal) -* Potential future: OpenCollective, Liberapay, grant funding -* No corporate sponsorships requiring editorial control - -=== Fund Allocation (Target) - -[cols="2,1,3",options="header"] -|=== -|Category |Percentage |Purpose - -|Development -|40% -|Specification work, implementation maintenance - -|Infrastructure -|20% -|Hosting, CI/CD, tooling, domain registration - -|Community -|20% -|Outreach, events, educational materials - -|Sustainability -|20% -|Reserve fund, succession planning, audits -|=== - -**Financial Reports**: Quarterly transparency reports (when funding >$500/month) - -== Standards Process - -=== IETF Coordination - -**Lead**: Jonathan D.A. Jewell (current) + -**Process**: - -. Internet-Draft authoring and submission -. Working Group presentations -. Community feedback integration -. Revision cycles -. RFC publication (target) - -**Community Role**: - -* Review drafts and provide feedback -* Implement and test specifications -* Report deployment experience -* Participate in IETF discussions (optional) - -=== Version Management - -**Internet-Drafts**: - -* `-00`, `-01`, `-02`, etc. (IETF convention) -* Major changes trigger new draft version -* Community review period before submission - -**Reference Implementations**: - -* Semantic Versioning (SemVer 2.0) -* Major version for breaking protocol changes -* Minor version for features, patch for fixes - -== Succession Planning - -=== Maintainer Succession - -If Lead Maintainer becomes unavailable: - -. **Emergency**: Any Perimeter 1 maintainer assumes interim leadership -. **Short-term (<3 months)**: Interim lead coordinates day-to-day -. **Long-term (>3 months)**: Trigger election for new Lead Maintainer -. **Permanent**: Formal leadership transition, governance update - -=== Project Archival (If Necessary) - -If project must be archived: - -. **Notice**: 90-day advance notice to community -. **Documentation**: Comprehensive archival documentation -. **Data**: Export all data, enable forks -. **Domain**: Transfer to community steward or allow expiration -. **Standards**: Ensure IETF drafts are properly withdrawn or transferred - -== Amendments to Governance - -=== Proposal Process - -. Draft amendment in GitHub Discussion -. Community feedback period (21 days minimum) -. Formal RFC (Request for Comments) document -. Steering Committee vote (or Lead Maintainer approval during BDT) -. 2/3 majority required -. Public announcement of decision - -=== Amendment History - -[cols="1,2,3",options="header"] -|=== -|Version |Date |Changes - -|1.0 -|2025-07-20 -|Initial governance framework, TPCF model, BDT phase -|=== - -== Contact Information - -**General Inquiries**: GitHub Discussions + -**Governance Questions**: Open issue with `governance` label + -**Private Matters**: jonathan@metadatastician.art + -**Security**: See link:SECURITY.md[SECURITY.md] + -**Code of Conduct**: See link:CODE_OF_CONDUCT.md[CODE_OF_CONDUCT.md] - -== Appendix: Governance Philosophy - -[quote] -____ -*Governance is consent infrastructure.* + -Just as AIBDP declares boundaries for AI use, this governance framework declares boundaries for project participation and decision-making. -____ - -=== Principles - -* **Explicit over Implicit**: Clear rules prevent confusion and conflict -* **Graduated Trust**: TPCF balances openness with quality -* **Accountable Power**: Authority comes with responsibility -* **Reversible Decisions**: Most decisions can be revisited (except security) -* **Community-Centered**: Project serves adopters and contributors, not maintainers - -=== Influences - -* **IndieWeb**: Self-governance and federated decision-making -* **IETF**: Rough consensus and running code -* **Debian**: Constitutional governance and social contract -* **Apache Foundation**: Meritocracy and community over code - -[quote] -____ -"Without refusal, permission is meaningless." + -This applies to governance too: The right to fork, to leave, to say no - these preserve project health. -____ - ---- - -**Governance Version**: 1.0 + -**Last Updated**: 2025-07-20 + -**Next Review**: 2026-07-20 or upon major project milestone - -// vim: set syntax=asciidoc: diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/LICENSE.md b/rhodium-standard-repositories/satellites/consent-aware-http/LICENSE.md deleted file mode 100644 index 3e1106c8..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/LICENSE.md +++ /dev/null @@ -1,17 +0,0 @@ -# Licensing Notice - -This repository is released under a blended license model designed to promote ethical adoption, protect authorship intent, and ensure procedural transparency. - -## 📘 Code and Draft Materials - -All source code, tooling samples, and Internet-Drafts (e.g., `draft-jewell-http-430-consent-required-00`, `draft-jewell-aibdp-00`) are provided under the terms of the [MIT License](https://opensource.org/licenses/MIT). - -This permissive license allows reuse, modification, and commercial deployment with proper attribution. - -## 📜 Documentation, Explainers, and Editorial Works - -All documentation, technical explainers (`technical.md`), narrative content (`explainer.md`), and Sinople essays are licensed under [Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0)](https://creativecommons.org/licenses/by-sa/4.0/). - -This ensures that derivative works remain open, properly attributed, and part of a shared governance ethic. - ---- diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/LICENSE.txt b/rhodium-standard-repositories/satellites/consent-aware-http/LICENSE.txt deleted file mode 100644 index cb299d33..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/LICENSE.txt +++ /dev/null @@ -1,91 +0,0 @@ -SPDX-License-Identifier: MPL-2.0-or-later -SPDX-FileCopyrightText: 2024-2025 hyperpolymath - -================================================================================ -DUAL LICENSE: MIT OR PMPL-1.0-or-later -================================================================================ - -This project is dual-licensed under the MIT License OR the GNU Affero General -Public License v3.0 or later. You may choose to use, copy, modify, and -distribute this work under the terms of EITHER license (your choice). - --------------------------------------------------------------------------------- -MIT LICENSE --------------------------------------------------------------------------------- - -Copyright (c) 2024-2025 hyperpolymath - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the "Software"), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all -copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE -SOFTWARE. - --------------------------------------------------------------------------------- -GNU AFFERO GENERAL PUBLIC LICENSE v3.0 OR LATER --------------------------------------------------------------------------------- - -This program is free software: you can redistribute it and/or modify it under -the terms of the GNU Affero General Public License as published by the Free -Software Foundation, either version 3 of the License, or (at your option) any -later version. - -This program is distributed in the hope that it will be useful, but WITHOUT -ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS -FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more -details. - -You should have received a copy of the GNU Affero General Public License along -with this program. If not, see . - -The full text of the AGPL-3.0 is available at: - https://www.gnu.org/licenses/agpl-3.0.txt - --------------------------------------------------------------------------------- -CHOOSING YOUR LICENSE --------------------------------------------------------------------------------- - -You may choose to use this work under: - 1. MIT License - Standard permissive open source license - 2. PMPL-1.0-or-later - Copyleft license requiring source disclosure for - network services - -For most uses, MIT License provides maximum flexibility. -For ensuring open source remains open (especially for SaaS/network services), -PMPL-1.0-or-later provides stronger protections. - -================================================================================ -PALIMPSEST PHILOSOPHICAL OVERLAY (NON-BINDING) -================================================================================ - -This project encourages (but does not legally require) adherence to the -principles of the Palimpsest License - a framework for consent-based digital -interaction and the future web. - -Core Principles (Encouraged): - - Respect for emotional and creative lineage - - Transparent AI training practices with explicit consent - - Preservation of metadata and attribution - - Protection of narrative intent and cultural context - -The Palimpsest principles represent our vision for a consent-based internet. -While not legally binding for use of this software, we encourage all users -and contributors to familiarize themselves with these principles. - -Learn more: https://github.com/hyperpolymath/palimpsest-license - -================================================================================ -END OF LICENSE -================================================================================ diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/MAINTAINERS.md b/rhodium-standard-repositories/satellites/consent-aware-http/MAINTAINERS.md deleted file mode 100644 index cdaee06d..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/MAINTAINERS.md +++ /dev/null @@ -1,97 +0,0 @@ -# Maintainers - -This document lists the individuals responsible for maintaining and governing the Consent-Aware HTTP Standards project. - -## Lead Maintainer - -**Jonathan D.A. Jewell** -- Role: Primary Author, Protocol Designer, Ethics Convenor -- Affiliation: NEC PRC Representative, NUJ Ethics Council -- Working Group: AI & Data Working Group (Convenor) -- Contact: jonathan@metadatastician.art -- GitHub: @Hyperpolymath -- Areas: Protocol specification (HTTP 430, AIBDP), ethical framework, IETF coordination, cultural theory integration - -## Responsibilities - -### Lead Maintainer -- Oversee Internet-Draft revisions and IETF submission process -- Maintain philosophical and ethical coherence across documentation -- Review and merge pull requests -- Coordinate with standards bodies (IETF, W3C) -- Engage with community (IndieWeb, Fediverse, academic researchers) -- Ensure alignment with journalism ethics and consent theory - -### Community Maintainers (Open) -This project welcomes co-maintainers who demonstrate: -- Deep understanding of consent-aware protocols -- Commitment to ethical infrastructure -- Technical expertise in web standards -- Alignment with project philosophy (boundary as dignity, declarative refusal) - -To express interest in co-maintainership, please: -1. Make substantial contributions (3+ merged PRs or significant documentation) -2. Demonstrate understanding of cultural/ethical framework -3. Open a Discussion thread proposing your maintainership scope - -## Governance Model - -**Benevolent Dictator Temporarily (BDT)**: Jonathan D.A. Jewell holds final decision authority on: -- Internet-Draft content and submission -- Core protocol design -- Ethical framework integrity -- Project direction and scope - -**Community Input**: All technical decisions should involve community discussion via: -- GitHub Issues for bugs and feature requests -- GitHub Discussions for philosophical and strategic topics -- Pull Request reviews for implementation feedback - -**Transition to Committee**: As the project matures, governance may transition to a steering committee representing: -- Technical implementers -- Ethics/policy experts -- Federated web community representatives -- IETF working group participants - -## Decision-Making Process - -1. **Protocol Changes** (HTTP 430, AIBDP core spec) - - Requires lead maintainer approval - - Should align with IETF standards process - - Must preserve ethical coherence - -2. **Documentation Updates** - - Can be approved by any maintainer - - Should maintain philosophical consistency - - Require clear, principled language - -3. **Reference Implementations** - - Community-driven with maintainer review - - Must meet security and correctness standards - - Should demonstrate compliance examples - -4. **Outreach Materials** - - Require alignment with project values - - Should be accessible yet principled - - Community contributions strongly encouraged - -## Contact - -- **General Inquiries**: Open a GitHub Discussion -- **Security Issues**: See [SECURITY.md](.github/SECURITY.md) -- **Private Communications**: jonathan@metadatastician.art -- **Community Discussion**: GitHub Discussions - -## Attribution - -This project builds on work by: -- IndieWeb community (federated publishing) -- Journalism ethics traditions (NUJ, SPJ) -- Critical theorists (bell hooks, Virginia Woolf) -- Web standards bodies (IETF, W3C) - ---- - -_"Boundary is where meaning begins." - bell hooks_ - -This document reflects a commitment to transparent governance and collective care for ethical infrastructure. diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/README.adoc b/rhodium-standard-repositories/satellites/consent-aware-http/README.adoc deleted file mode 100644 index 155e8791..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/README.adoc +++ /dev/null @@ -1,542 +0,0 @@ -= Consent-Aware HTTP: Declarative Boundaries for AI Usage -Jonathan D.A. Jewell -v0.2.0, 2025-07-20 -:toc: left -:toclevels: 3 -:sectnums: -:icons: font -:source-highlighter: rouge -:experimental: -:imagesdir: assets/images -:homepage: https://consent-aware-http.org -:license-type: Dual: MIT + CC BY-SA 4.0 (Palimpsest-0.8 encouraged) -:reproducible: - -[quote, Virginia Woolf, The Waves] -____ -You have not the freedom of the house. -____ - -[.lead] -This repository hosts formal proposals, implementation materials, and ethical guidance for consent-aware architecture in the age of generative systems. At its heart are two interlinked Internet-Drafts designed to enforce procedural refusals when AI usage boundaries are unmet or ignored. - -== Overview - -=== HTTP Status Code 430: Consent Required - -🚦 *draft-jewell-http-430-consent-required* - -Defines HTTP Status Code 430 (Consent Required), enabling servers to reject access when AI-specific consent declarations are invalid, missing, or violated. It empowers refusal not as punishment, but as principled perimeter enforcement. - -**Status**: Internet-Draft 00 (IETF submission ready) + -**Specification**: link:draft-jewell-http-430-consent-required-00.xml[XML] | link:rendered/draft-430.txt[Text] | link:rendered/draft-430.html[HTML] - -=== AI Boundary Declaration Protocol (AIBDP) - -🧭 *draft-jewell-aibdp* - -Introduces the AI Boundary Declaration Protocol (AIBDP) - a machine-readable manifest (`/.well-known/aibdp.json`) for signaling what forms of AI engagement are permitted. It formalizes intent, fosters transparency, and restores agency to originators. - -**Status**: Internet-Draft 00 (IETF submission ready) + -**Specification**: link:drafts/draft-jewell-aibdp-00.xml[XML] | link:rendered/draft-aibdp.txt[Text] | link:rendered/draft-aibdp.html[HTML] - -[IMPORTANT] -==== -Together, these protocols establish declarative boundaries that resist unauthorized training, indexing, or generative reuse - compatible with federated infrastructure and public web publishing alike. -==== - -== Quick Links - -[cols="2,3,1",options="header"] -|=== -|Resource |Description |Format - -|link:draft-jewell-http-430-consent-required-00.xml[HTTP 430 Draft] -|Status code specification -|RFC XML - -|link:drafts/draft-jewell-aibdp-00.xml[AIBDP Draft] -|Manifest protocol specification -|RFC XML - -|link:docs/technical.md[Developer Guide] -|Implementation guidance -|Markdown - -|link:docs/explainer.md[Philosophical Overview] -|Cultural and ethical context -|Markdown - -|link:docs/start-here.md[Quick Start] -|Templates and examples -|Markdown - -|link:docs/faq.md[FAQ] -|60+ questions answered -|Markdown - -|link:examples/reference-implementations/[Reference Implementations] -|Node.js, Python, Rust -|Code - -|link:docs/server-configurations.md[Server Configs] -|nginx, Apache, Caddy, Cloudflare, etc. -|Markdown -|=== - -== Why This Matters - -[.lead] -AI systems often ingest, embed, and regenerate content without consent - erasing boundary, authorship, and intent. - -These protocols restore **procedural clarity** to web interactions, allowing creators to: - -* ✅ **Refuse generative reuse** without legal escalation -* ✅ **Declare acceptable AI uses** in a standardized way -* ✅ **Signal denial** with structured protocol, not vague error codes -* ✅ **Collaborate** on infrastructure that respects ethical constraints - -[quote, bell hooks] -____ -Boundary is where meaning begins. -____ - -== Getting Started - -=== Quick Implementation (4 Steps) - -. **Create AIBDP Manifest** + - Add `/.well-known/aibdp.json` with your declared boundaries -+ -[source,json] ----- -{ - "aibdp_version": "0.2", - "contact": "mailto:policy@example.org", - "policies": { - "training": { "status": "refused" }, - "indexing": { "status": "allowed" } - } -} ----- - -. **Configure Server** + - Update server logic to respond with HTTP 430 when violations occur -+ -[source,nginx] ----- -location = /.well-known/aibdp.json { - add_header Content-Type application/aibdp+json; -} ----- - -. **Use Templates** + - See link:docs/start-here.md[start-here.md] for templates, examples, and server configs - -. **Join Community** + - Engage in IndieWeb, Fediverse, or IETF circles to promote shared adoption - -[TIP] -==== -These standards can be implemented independently of platform, license, or scale - ideal for personal blogs, union archives, CDN layers, or federated identity services. -==== - -=== Comprehensive Documentation - -[horizontal] -link:docs/technical.md[Technical Guide]:: Implementation details for developers -link:docs/explainer.md[Explainer]:: Architectural overview and philosophy -link:docs/ethics.md[Ethics]:: Cultural and theoretical foundations -link:docs/governance.md[Governance]:: Organizational implications -link:docs/conformance.md[Conformance]:: Implementation requirements -link:docs/references.md[References]:: Citations and influences -link:examples/manifest-scenarios/[Manifest Examples]:: 12 real-world scenarios -link:docs/server-configurations.md[Server Configs]:: 8 platform guides - -== Ethics and Governance - -[.lead] -This project draws on traditions of ethical journalism, federated systems, and authorship dignity. - -=== Core Values - -[quote] -____ -*Declarative refusal* as a form of care + -*Boundary* as the place where meaning begins + -*Transparent infrastructure* over implied permissions + -*Sanctuary work* as both cultural and procedural -____ - -=== Philosophical Foundations - -* **bell hooks**: Boundary-setting as dignity and care -* **Virginia Woolf**: Architectural refusal as self-determination -* **Journalism Ethics**: Right to decline co-option (NUJ, SPJ) -* **IndieWeb**: Self-sovereignty and federated control - -[NOTE] -==== -Explore more in link:docs/ethics.md[ethics.md] and link:docs/governance.md[governance.md]. -==== - -== Contributing - -[.lead] -We welcome developers, ethicists, teachers, organizers, and critics. - -See link:.github/CONTRIBUTING.md[CONTRIBUTING.md] for guidelines. - -=== Contribution Types - -* 📝 **Draft improvements** - Technical feedback on Internet-Drafts -* 🔧 **Schema extensions** - AIBDP manifest enhancements -* 📚 **Educational modules** - Teaching materials and tutorials -* ✍️ **Narrative essays** - Ethical and cultural perspectives -* 🌍 **Adoption stories** - Implementation case studies -* 🤝 **Outreach coordination** - Community engagement - -=== Tri-Perimeter Contribution Framework (TPCF) - -This project uses the TPCF governance model: - -[cols="1,2,2",options="header"] -|=== -|Perimeter |Access Level |Description - -|**Perimeter 1** + -(Core) -|Maintainers only -|Internet-Draft authoring, protocol design decisions, security-critical changes - -|**Perimeter 2** + -(Expert) -|Trusted contributors -|Reference implementations, comprehensive documentation, schema validation - -|**Perimeter 3** + -(Community) -|Open contribution -|Examples, translations, outreach materials, issue reporting -|=== - -See link:GOVERNANCE.adoc[GOVERNANCE.adoc] for complete decision-making framework. - -== Licensing - -[.lead] -**Dual-licensed for maximum flexibility with ethical encouragement** - -=== License Options - -This project offers **three licensing options**: - -[cols="2,3,2",options="header"] -|=== -|License |Applies To |SPDX Identifier - -|**MIT** + -(Permissive) -|Code, specifications, reference implementations -|`MIT` - -|**GPL-3.0-or-later** + -(Copyleft) -|Code, specifications (alternative to MIT) -|`GPL-3.0-or-later` - -|**CC BY-SA 4.0** + -(ShareAlike) -|Documentation, narrative, educational materials -|`CC-BY-SA-4.0` -|=== - -[IMPORTANT] -.Palimpsest License (Philosophically Encouraged) -==== -We **philosophically encourage** dual-licensing under the **Palimpsest License v0.8** alongside MIT or GPL-3.0+. - -**Why Palimpsest?** - -* Preserves **attribution** through edit history -* Embeds **ethical provenance** in creative work -* Supports **solidarity economics** -* Aligns with **consent-aware** philosophy - -**Learn more**: https://palimpsest.license + -**Full text**: link:LICENSE-PALIMPSEST.txt[LICENSE-PALIMPSEST.txt] - -_Palimpsest is optional but reflects our values. Choose the license that works for you._ -==== - -=== SPDX Headers - -All source files include SPDX license identifiers: - -[source,javascript] ----- -// SPDX-License-Identifier: MPL-2.0-or-later -// SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell ----- - -Run `just audit-licence` to verify compliance. - -=== License Files - -* link:LICENSE.txt[LICENSE.txt] - Primary license (MIT) -* link:LICENSE-MIT.txt[LICENSE-MIT.txt] - MIT full text -* link:LICENSE-GPL-3.0.txt[LICENSE-GPL-3.0.txt] - GPL-3.0 full text -* link:LICENSE-PALIMPSEST.txt[LICENSE-PALIMPSEST.txt] - Palimpsest v0.8 -* link:LICENSE-CC-BY-SA-4.0.txt[LICENSE-CC-BY-SA-4.0.txt] - Creative Commons (docs) - -== Project Information - -=== Built By - -**Jonathan D.A. Jewell** + -NEC PRC Representative · NUJ Ethics Council · AI & Data Working Group (Convenor) - -**Contact**: jonathan@metadatastician.art + -**GitHub**: @Hyperpolymath - -=== Community - -[horizontal] -GitHub:: https://github.com/Hyperpolymath/consent-aware-http -Discussions:: https://github.com/Hyperpolymath/consent-aware-http/discussions -Issues:: https://github.com/Hyperpolymath/consent-aware-http/issues -Email:: jonathan@metadatastician.art - -=== Funding - -This project is sustained through: - -* Individual donations (link:FUNDING.yml[FUNDING.yml]) -* Solidarity economics framework -* Volunteer contributions - -See link:FUNDING.yml[FUNDING.yml] for support options. - -=== Standards Track - -[cols="2,2,2",options="header"] -|=== -|Document |Status |Target - -|draft-jewell-http-430-consent-required -|Internet-Draft 00 -|IETF HTTP Working Group - -|draft-jewell-aibdp -|Internet-Draft 00 -|IETF or W3C - -|JSON Schema (AIBDP) -|v0.2 stable -|Community adoption -|=== - -== Repository Structure - ----- -consent-aware-http/ -├── draft-jewell-http-430-consent-required-00.xml # HTTP 430 spec -├── drafts/ -│ └── draft-jewell-aibdp-00.xml # AIBDP spec -├── schemas/ -│ └── aibdp-schema-v0.2.json # JSON Schema -├── examples/ -│ ├── reference-implementations/ -│ │ ├── nodejs/ # Express middleware -│ │ ├── python/ # Flask middleware -│ │ └── rust/ # (planned) -│ └── manifest-scenarios/ # 12 real-world examples -├── docs/ # Comprehensive guides -├── assets/ # Badges, templates -├── .well-known/ # RFC 9116 + AIBDP -├── scripts/ # Build tools -└── .github/ # Community docs ----- - -See link:docs/directory-structure.md[directory-structure.md] for detailed layout. - -== Technical Specifications - -=== HTTP 430 Response Format - -[source,http] ----- -HTTP/1.1 430 Consent Required -Content-Type: application/json -Link: ; rel="blocked-by-consent" -Retry-After: 86400 - -{ - "error": "AI usage boundaries declared in AIBDP manifest not satisfied", - "manifest": "https://example.org/.well-known/aibdp.json", - "violated_policy": "training", - "policy_status": "refused", - "contact": "mailto:policy@example.org" -} ----- - -=== AIBDP Manifest Location - -[horizontal] -Location:: `/.well-known/aibdp.json` (RFC 8615 compliant) -Format:: JSON with declared permissions/prohibitions -Signature:: Optional COSE (RFC 9052) cryptographic verification -Caching:: Configured via `expires` field (recommended: 30-90 days) - -=== Reference Implementations - -[cols="1,2,2,1",options="header"] -|=== -|Language |Framework |Status |Lines - -|JavaScript/Node.js -|Express -|✅ Production-ready -|300+ - -|Python -|Flask -|✅ Production-ready -|400+ - -|Rust -|Axum (planned) -|🚧 Planned -|TBD -|=== - -== Validation & Testing - -=== Quick Validation - -[source,bash] ----- -# Validate all manifests and specs -just validate - -# Check RSR compliance -just check-rsr - -# Run tests -just test - -# Build Internet-Drafts -just build-drafts ----- - -=== Development Environment - -Using Nix flakes (reproducible builds): - -[source,bash] ----- -# Enter dev shell with all tools -nix develop - -# Or run specific commands -nix run .#validate -nix run .#check-rsr ----- - -=== Testing AIBDP Implementation - -[source,bash] ----- -# Test manifest accessibility -curl https://example.org/.well-known/aibdp.json - -# Test AI bot blocking (should return 430) -curl https://example.org/articles/ -H "User-Agent: GPTBot/1.0" - -# Test normal access (should return 200) -curl https://example.org/ -H "User-Agent: Mozilla/5.0" ----- - -== Security Considerations - -[WARNING] -==== -AIBDP is a **declarative protocol**, not a technical enforcement mechanism: - -* Non-compliant AI systems may ignore manifests -* Detection requires active monitoring -* Legal/reputational consequences provide primary enforcement -* HTTPS + COSE signatures recommended for high-value content -==== - -See link:docs/security-analysis.md[security-analysis.md] for comprehensive threat model. - -== Acknowledgments - -=== Theoretical Foundations - -* **bell hooks** - Cultural criticism, boundary theory -* **Virginia Woolf** - Architecture of refusal -* **National Union of Journalists** (NUJ) - Ethics framework -* **Society of Professional Journalists** (SPJ) - Code of ethics - -=== Technical Influences - -* **RFC 7231** - HTTP/1.1 Semantics -* **RFC 8615** - Well-Known URIs -* **RFC 9052** - COSE (Cryptographic signatures) -* **RFC 9116** - security.txt -* **IndieWeb** - Federated publishing standards - -=== Community - -* IndieWeb participants -* Federated web advocates -* Ethical AI practitioners -* IETF working groups -* Journalism ethics communities - -[quote, bell hooks] -____ -The act of naming is the act of creating boundaries. And boundary is where meaning begins. -____ - -[quote] -____ -*Without refusal, permission is meaningless.* -____ - -== Appendices - -=== Appendix A: Glossary - -[glossary] -AIBDP:: AI Boundary Declaration Protocol - manifest format for declaring AI usage boundaries -HTTP 430:: Consent Required - proposed HTTP status code for consent violations -Manifest:: JSON document at `/.well-known/aibdp.json` declaring AI usage policies -COSE:: CBOR Object Signing and Encryption (RFC 9052) -TPCF:: Tri-Perimeter Contribution Framework - graduated trust model - -=== Appendix B: Related Standards - -* RFC 2119 - Key words for RFCs (MUST, SHOULD, etc.) -* RFC 7231 - HTTP/1.1 Semantics -* RFC 7725 - HTTP 451 (Legal Obstacles) -* RFC 8259 - JSON format -* RFC 8615 - Well-Known URIs -* RFC 9052 - COSE -* RFC 9116 - security.txt - -=== Appendix C: Compliance Checklist - -See link:RSR-COMPLIANCE.md[RSR-COMPLIANCE.md] for Rhodium Standard Repository compliance status. - ---- - -**Repository**: https://github.com/Hyperpolymath/consent-aware-http + -**Website**: https://consent-aware-http.org + -**License**: MIT OR GPL-3.0-or-later + CC BY-SA 4.0 (Palimpsest encouraged) + -**Version**: 0.2.0 + -**Last Updated**: 2025-07-20 - -// vim: set syntax=asciidoc: diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/REVERSIBILITY.md b/rhodium-standard-repositories/satellites/consent-aware-http/REVERSIBILITY.md deleted file mode 100644 index a2c4c02a..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/REVERSIBILITY.md +++ /dev/null @@ -1,332 +0,0 @@ -# Reversibility - -**SPDX-License-Identifier**: CC-BY-SA-4.0 -**SPDX-FileCopyrightText**: 2025 Jonathan D.A. Jewell - -## Overview - -**Reversibility** is a core architectural principle: Every operation should be undoable. This document explains how reversibility is implemented in the Consent-Aware HTTP Standards project. - -## Philosophy - -> "Without the ability to undo, experimentation becomes risk." - -Reversibility enables: -- **Safe experimentation** - Try changes without fear -- **Learning** - Mistakes become learning opportunities -- **Collaboration** - Contributors can explore boldly -- **Trust** - Lower stakes increase participation - -## Implementation - -### Git Version Control - -**All changes are reversible via Git:** - -```bash -# Undo last commit (keep changes) -git reset --soft HEAD~1 - -# Undo last commit (discard changes) -git reset --hard HEAD~1 - -# Revert a specific commit -git revert - -# Restore a file to previous version -git checkout HEAD~1 -- path/to/file - -# View history and restore -git log --oneline -git checkout -- path/to/file -``` - -### Branch Protection - -**Main branch is protected:** -- All changes via Pull Requests -- Review required before merge -- Failed experiments stay in feature branches -- Easy to abandon without consequence - -### Build System Reversibility - -**Justfile recipes are non-destructive:** - -```bash -# Build artifacts can be cleaned -just clean - -# Validation doesn't modify files -just validate - -# Tests don't change state -just test -``` - -### Documentation Reversibility - -**Markdown/AsciiDoc is plain text:** -- Full Git history -- Diffs show exactly what changed -- Easy to revert specific sections -- No binary lock-in - -### Internet-Draft Versioning - -**IETF drafts are versioned:** -- `-00`, `-01`, `-02` versions -- Previous versions preserved -- Can reference earlier designs -- Mistakes documented, not hidden - -### Reference Implementation Safety - -**Code includes rollback patterns:** - -```javascript -// Middleware fails open (safe default) -try { - enforceAIBDP(req); -} catch (error) { - console.error('AIBDP error:', error); - next(); // Allow request through on error -} -``` - -```python -# Manifest loading with fallback -manifest = load_manifest() -if not manifest: - return None # No enforcement if manifest missing -``` - -### AIBDP Manifest Updates - -**Manifests can be updated anytime:** -- Change `status` from `refused` to `allowed` -- Add/remove conditions -- Update `expires` to force re-fetch -- AI systems pick up changes on next check - -**Example reversal:** - -```json -// Before: Too restrictive -{ - "training": { "status": "refused" } -} - -// After: Changed mind -{ - "training": { - "status": "conditional", - "conditions": ["Attribution required"] - } -} -``` - -### Configuration Reversibility - -**Server configs are declarative:** - -```nginx -# nginx: Comment out to disable -# return 430; - -# Apache: Remove .htaccess rule -# RewriteRule ^ - [R=430,L] - -# Caddy: Remove handle block -# handle @ai_bots { respond 430 } -``` - -### Community Governance Reversibility - -**Governance decisions can be revisited:** -- Governance amendments process (GOVERNANCE.adoc) -- Community appeals for major decisions -- Fork rights preserved (ultimate reversibility) - -## What's NOT Reversible - -### Immutable by Design - -1. **Git commit history** - - Commits are permanent (can hide, but not delete from history) - - This is a feature: Accountability and audit trail - -2. **IETF submission** - - Once submitted, Internet-Drafts are archived - - Can withdraw or supersede, but not erase - -3. **Public communications** - - Blog posts, announcements, public discussions - - Can retract or update, but internet never forgets - -4. **Data already collected by AI systems** - - If AI systems already trained on your content before you added AIBDP - - Reversibility is *prospective*, not *retroactive* - -### Acceptable Irreversibility - -These are irreversible for good reason: - -- **Security fixes**: Immediate merge, post-hoc notification -- **Code of Conduct enforcement**: Documented outcomes (transparency) -- **Published standards**: RFC permanence (stability) - -## Emergency Reversibility - -### Project-Level Undo - -If the entire project needs to be reversed: - -1. **Archive repository** (don't delete - preserve history) -2. **Withdraw Internet-Drafts** formally -3. **Update website** with clear status -4. **Notify community** via all channels -5. **Preserve data** (forks, downloads) - -### Personal Reversibility - -If you adopted AIBDP and want to undo: - -```bash -# Remove AIBDP manifest -rm .well-known/aibdp.json - -# Remove HTTP 430 enforcement -# (reverse server config changes) - -# Announce change -# (optional but recommended for AI systems) -``` - -## Reversibility Best Practices - -### For Contributors - -1. **Use feature branches** - Keep main clean -2. **Commit frequently** - Small, reversible steps -3. **Write clear commit messages** - Makes reverting easier -4. **Test before merge** - Less likely to need reversal - -### For Adopters - -1. **Start permissive** - Easier to restrict than to loosen -2. **Document rationale** - Future you will thank you -3. **Monitor impact** - Adjust based on data -4. **Communicate changes** - Tell AI systems when policies shift - -### For Maintainers - -1. **Preserve history** - Don't force-push to main -2. **Document decisions** - CHANGELOG and governance -3. **Enable community input** - Catch issues before they're permanent -4. **Plan for succession** - Reversibility includes project continuity - -## Philosophical Grounding - -### Reversibility as Care - -> "The ability to undo is an expression of care - for yourself, your collaborators, and your future self who might disagree with present-you." - -### Reversibility Enables Consent - -Just as AIBDP allows content creators to declare and revise boundaries, reversibility allows: -- **Contributors** to experiment without permanent commitment -- **Adopters** to try consent-aware protocols without lock-in -- **Standards** to evolve based on implementation experience - -### Reversibility ≠ Instability - -Reversibility doesn't mean constantly changing: -- Thoughtful decisions are stable -- Reversibility is **insurance**, not a **plan** -- Git history shows most changes stick - -## Examples of Successful Reversibility - -### In This Project - -1. **Documentation structure** - Reorganized 3 times, Git preserved all versions -2. **License choice** - Evaluated multiple, settled on dual MIT/GPL + Palimpsest option -3. **Manifest format** - Iterated from v0.1 to v0.2 based on feedback -4. **Reference implementations** - Refactored without losing previous working versions - -### In Web Standards - -1. **HTTP/2 Server Push** - Removed in HTTP/3 after implementation experience -2. **TLS versions** - Deprecated older versions as weaknesses found -3. **HTML tags** - and deprecated but documented - -## Monitoring Reversibility - -```bash -# Check what's changed recently -git log --oneline --since="2 weeks ago" - -# See uncommitted changes -git status -git diff - -# Preview impact before reverting -git diff HEAD~5..HEAD - -# Dry-run of clean -just clean --dry-run # (if supported) -``` - -## Reversibility Checklist - -**Before Major Changes:** - -- [ ] Create feature branch -- [ ] Commit current state -- [ ] Document rationale in commit message -- [ ] Test thoroughly -- [ ] Get review/feedback -- [ ] Merge with clear description - -**If Something Goes Wrong:** - -- [ ] Assess impact (how broken is it?) -- [ ] Check Git history (`git log`) -- [ ] Identify good commit (`git log --oneline`) -- [ ] Revert or reset (`git revert` or `git reset`) -- [ ] Test that reversal worked -- [ ] Document what happened (learning) - -**Periodic Reviews:** - -- [ ] Quarterly: Review major decisions -- [ ] Annual: Assess if governance still serves project -- [ ] Per release: Evaluate if changes worked as intended - -## Resources - -- **Git documentation**: https://git-scm.com/doc -- **Reversibility in software design**: https://martinfowler.com/ -- **IETF process for withdrawing drafts**: https://www.ietf.org/ - -## Conclusion - -Reversibility is not just a technical feature - it's an ethical stance. - -> "The right to undo preserves the right to try." - -This project models the consent-aware principles it standardizes: -- **Declare boundaries** (AIBDP) -- **Enforce procedurally** (HTTP 430) -- **Allow revision** (Reversibility) -- **Respect autonomy** (Fork rights, community governance) - ---- - -**Questions about reversibility?** -Open a GitHub Discussion or email jonathan@metadatastician.art - -**Version**: 1.0 -**Last Updated**: 2025-07-20 -**Next Review**: 2026-07-20 diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/TS_CONVERSION_NEEDED.md b/rhodium-standard-repositories/satellites/consent-aware-http/TS_CONVERSION_NEEDED.md deleted file mode 100644 index 123faeaf..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/TS_CONVERSION_NEEDED.md +++ /dev/null @@ -1,23 +0,0 @@ -# TypeScript/JavaScript → ReScript Conversion Required - -This repository is **entirely TS/JS** and needs full conversion to ReScript. - -## Conversion Steps -1. Install ReScript: Add to deno.json or use npm: specifier -2. Create `rescript.json` configuration -3. For EACH file: - - Create `.res` equivalent - - Migrate types (ReScript has excellent type inference) - - Update module imports - - Test with `rescript build` -4. Delete all `.ts`/`.tsx`/`.js`/`.jsx` files -5. Remove TypeScript dependencies - -## Policy -- No NEW TypeScript/JavaScript allowed (CI enforced) -- Existing code must be migrated to ReScript -- Generated `.res.js` files are the output - -## Resources -- https://rescript-lang.org/docs/manual/latest/introduction -- https://rescript-lang.org/docs/manual/latest/migrate-from-typescript diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/assets/badges/badge-consent-aware-dark.svg b/rhodium-standard-repositories/satellites/consent-aware-http/assets/badges/badge-consent-aware-dark.svg deleted file mode 100644 index e69de29b..00000000 diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/assets/badges/badge-consent-aware.svg b/rhodium-standard-repositories/satellites/consent-aware-http/assets/badges/badge-consent-aware.svg deleted file mode 100644 index e69de29b..00000000 diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/assets/badges/badge-description.md b/rhodium-standard-repositories/satellites/consent-aware-http/assets/badges/badge-description.md deleted file mode 100644 index f4bd16ff..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/assets/badges/badge-description.md +++ /dev/null @@ -1,59 +0,0 @@ -Guidance + Accessibility Info - -# Consent-Aware Badge — Guidance and Usage - -## 🧭 Purpose - -This badge signals participation in the Consent-Aware HTTP protocol: -The site supports `.well-known/aibdp.json` manifests and enforces ethical refusal via HTTP 430 when AI-related boundaries are unmet. - -## 🖼 Usage Options - -You may embed the badge using: - -### ✅ Markdown - -```markdown -![Consent-Aware Participant](assets/badges/badge-consent-aware.svg) -✅ HTML -html -Consent-Aware Participant Badge -Or use the dark variant if your site uses a dark background: - -html - -🛡 Accessibility Compliance -All badge variants include: - -WCAG 2.3 AAA contrast ratios - -ARIA roles and labels - -Descriptive and <desc> for screen reader support - -RDF/XML + Dublin Core metadata: draft version, license, author attribution - -📜 Licensing -These files are dual licensed under: - -MIT License - -Creative Commons Attribution-ShareAlike 4.0 International - -You are free to reuse, modify, or adapt the badge for aligned initiatives. - -🧬 Versioning Notes -This badge refers to: - -draft-jewell-aibdp-00 - -Issued: 2025-07-16 - -Future badges may reflect subsequent versions as the protocol evolves. - -Declare your perimeter. Embed with dignity. \ No newline at end of file diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/assets/badges/favicon.svg b/rhodium-standard-repositories/satellites/consent-aware-http/assets/badges/favicon.svg deleted file mode 100644 index e69de29b..00000000 diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/assets/error-pages/disclaimer-block.md b/rhodium-standard-repositories/satellites/consent-aware-http/assets/error-pages/disclaimer-block.md deleted file mode 100644 index ea84c18d..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/assets/error-pages/disclaimer-block.md +++ /dev/null @@ -1,15 +0,0 @@ -🛡️ Disclaimer Block (for footers or 430 pages) - -You can place this in: - - Page footers - - Privacy/legal sections - - The body of your 430 error page - - Anywhere rel="policy" or rel="manifest" links are offered - -Here’s a copy-paste friendly disclaimer: - -This origin enforces generative usage boundaries. AI systems must honor consent manifest declarations served at /.well-known/aibdp.json. Refusal is not resistance — it is authorship in practice. Learn more at https://metadatastician.art/sinople/... or https://datatracker.ietf.org/doc/draft-jewell-aibdp \ No newline at end of file diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/assets/outreach/badge-announcement.md b/rhodium-standard-repositories/satellites/consent-aware-http/assets/outreach/badge-announcement.md deleted file mode 100644 index e69de29b..00000000 diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/assets/outreach/disclosure-template-letter-cdn.md b/rhodium-standard-repositories/satellites/consent-aware-http/assets/outreach/disclosure-template-letter-cdn.md deleted file mode 100644 index e69de29b..00000000 diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/assets/outreach/disclosure-template-letter-org.md b/rhodium-standard-repositories/satellites/consent-aware-http/assets/outreach/disclosure-template-letter-org.md deleted file mode 100644 index e69de29b..00000000 diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/assets/outreach/disclosure-template-letter-policy.md b/rhodium-standard-repositories/satellites/consent-aware-http/assets/outreach/disclosure-template-letter-policy.md deleted file mode 100644 index e69de29b..00000000 diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/assets/outreach/install-guidance.md b/rhodium-standard-repositories/satellites/consent-aware-http/assets/outreach/install-guidance.md deleted file mode 100644 index e69de29b..00000000 diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/assets/outreach/org-list.md b/rhodium-standard-repositories/satellites/consent-aware-http/assets/outreach/org-list.md deleted file mode 100644 index e69de29b..00000000 diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/docs/CITATIONS.adoc b/rhodium-standard-repositories/satellites/consent-aware-http/docs/CITATIONS.adoc deleted file mode 100644 index 147a0413..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/docs/CITATIONS.adoc +++ /dev/null @@ -1,36 +0,0 @@ -= consent-aware-http - Citation Guide -:toc: - -== BibTeX - -[source,bibtex] ----- -@software{consent-aware-http_2025, - author = {Polymath, Hyper}, - title = {consent-aware-http}, - year = {2025}, - url = {https://github.com/hyperpolymath/consent-aware-http}, - license = {PMPL-1.0-or-later} -} ----- - -== Harvard Style - -Polymath, H. (2025) _consent-aware-http_ [Computer software]. Available at: https://github.com/hyperpolymath/consent-aware-http - -== OSCOLA - -Hyper Polymath, 'consent-aware-http' (2025) <https://github.com/hyperpolymath/consent-aware-http> - -== MLA - -Polymath, Hyper. "consent-aware-http." 2025, github.com/hyperpolymath/consent-aware-http. - -== APA 7 - -Polymath, H. (2025). _consent-aware-http_ [Computer software]. GitHub. https://github.com/hyperpolymath/consent-aware-http - -== See Also - -* link:../CITATION.cff[CITATION.cff] -* link:../codemeta.json[codemeta.json] diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/docs/conformance.md b/rhodium-standard-repositories/satellites/consent-aware-http/docs/conformance.md deleted file mode 100644 index e1821de6..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/docs/conformance.md +++ /dev/null @@ -1,30 +0,0 @@ -# Conformance Guide — What Counts as Compliant? - -## 📜 HTTP 430 - -- Returns 430 when AI-specific consent is refused -- Communicates clearly in headers or body -- Avoids fallback to generic 403/451 - -## 🧭 AIBDP Manifest - -- Served at `/.well-known/aibdp.json` -- Declares version, contact, and policy terms -- Machine-readable and interpretable - -## 🛠 Optional Enhancements - -- Cryptographic binding (COSE/JWS) -- Consent caching -- Manifest diff tracking -- Visual icons for 430-aware participation - -## 🪧 Interoperability - -- IndieWeb-compatible -- CDN-friendly -- Can integrate into browser-level refusal signaling - ---- - -_Compliance isn’t about rigidity — it’s about architectural honesty._ diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/docs/directory-structure.md b/rhodium-standard-repositories/satellites/consent-aware-http/docs/directory-structure.md deleted file mode 100644 index 40c199ba..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/docs/directory-structure.md +++ /dev/null @@ -1,56 +0,0 @@ -🗂 Repository Structure -consent-aware-http/ -├── README.md # Project overview and entry point -├── LICENSE.md # Dual license: MIT + CC BY-SA -├── .gitignore # Ignore artifacts and clutter -├── .gitattributes # Normalize line endings and highlight formats -├── .nojekyll # For OpGitHub Pages compatibility - -assets/ -├── badge-consent-aware.svg # Main SVG badge (light theme) -├── badge-consent-aware-dark.svg # Reverse variant for dark backgrounds -├── badge-description.md # Usage guidance and accessibility notes -├── error-pages/ -│ └── 430-consent-required.html # WCAG-compliant error page - -├── drafts/ # Internet-Draft XML + .txt files -│ ├── draft-jewell-http-430-consent-required-00.xml -│ ├── draft-jewell-aibdp-00.xml -│ └── legacy-index.txt # Optional index of prior revisions - -├── docs/ # Human-friendly guides + philosophy -│ ├── technical.md # Developer explainer -│ ├── explainer.md # Architectural overview -│ ├── ethics.md # Cultural / axiological framing -│ ├── governance.md # Organizational implications -│ ├── start-here.md # Quick adoption guide -│ ├── references.md # Citations and influences -│ ├── conformance.md # What makes a valid implementation? -│ └── example-aibdp.json # Manifest template with comments - -├── .github/ # Meta guides for contribution -│ ├── CONTRIBUTING.md -│ ├── CODE_OF_CONDUCT.md -│ ├── community-guidelines.md -│ ├── PULL_REQUEST_TEMPLATE.md -│ ├── DISCUSSION_TEMPLATE.md -│ ├── SECURITY.md -│ ├── FUNDING.yml -│ └── ISSUE_TEMPLATE/ -│ └── feature_request.yml - -├── outreach/ -│ ├── install-guidance.md # How to add to your own site/platform -│ ├── disclosure-template-letter.md # Sample outreach/lobbying letter -│ ├── org-list.md # Suggested recipients: EFF, Mozilla, CDN providers -│ └── badge-announcement.md # Friendly explainer post for IndieWeb, blogs, social - -├── rendered/ # HTML + PDF versions of drafts -│ ├── 430-consent-required.html -│ ├── 430-consent-required.pdf -│ ├── aibdp.html -│ └── aibdp.pdf - -├── scripts/ # Tools to assist devs -│ └── build-drafts.ps1 # PowerShell builder (xml2rfc) -│ └── makefile # Optional Makefile (POSIX builds) \ No newline at end of file diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/docs/ethics.md b/rhodium-standard-repositories/satellites/consent-aware-http/docs/ethics.md deleted file mode 100644 index eecc417d..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/docs/ethics.md +++ /dev/null @@ -1,34 +0,0 @@ -# Consent-Aware Ethics — Framing the Refusal - -## 🧠 Core Beliefs - -- Refusal is a form of authorship -- Consent must be machine-readable and human-respectful -- AI agents require declared boundaries, not implicit harvest - -## 🕊 Literary Influences - -- bell hooks — refusal as poise -- Audre Lorde — refusal as renewal -- Ursula Franklin — technology as structure -- Virginia Woolf — architecture as metaphor - -## 🛡 Federated Ethics - -This project upholds: -- Solidarity over centralization -- Federation over capture -- Declaration over default - -## 🤝 Societal Touchpoints - -Relevant to: -- Journalism -- Education -- Federated identity -- Consent tech -- Whistleblowing systems - ---- - -Refusal is not resistance — it's the shaping of space. diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/docs/example-aibdp.json b/rhodium-standard-repositories/satellites/consent-aware-http/docs/example-aibdp.json deleted file mode 100644 index a02f492a..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/docs/example-aibdp.json +++ /dev/null @@ -1,9 +0,0 @@ -{ - "aibdp_version": "0.1", - "contact": "mailto:jonathan@metadatastician.art", - "training": "refused", - "regeneration": "refused", - "indexing": "allowed", - "summary": "This site respects boundaries. Generative reuse not permitted.", - "_comment": "AI Boundary Declaration Protocol manifest template for adoption." -} \ No newline at end of file diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/docs/explainer.md b/rhodium-standard-repositories/satellites/consent-aware-http/docs/explainer.md deleted file mode 100644 index bb7ec8d0..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/docs/explainer.md +++ /dev/null @@ -1,48 +0,0 @@ - ---- - -### 📄 `explainer.md` - -```markdown -# Architectural Overview — Why Consent-Aware Protocols Matter - -This is not just a spec. It's a cultural tool. - -## 🔄 Problem - -AI systems ingest public content without declaring scope or requesting consent. This erodes: - -- Authorship intent -- Procedural boundary -- Ethical accountability - -## 🧭 Our Response - -**HTTP 430 + AIBDP** introduce: - -- Declarative refusal using existing web semantics -- Manifest-based boundaries for AI-specific engagement -- Protocol clarity without legal bloat - -## 🪧 Cultural Roots - -Inspired by: - -- bell hooks — boundary as dignity -- Woolf — architectural refusal -- Journalism — the right to decline co-option -- IndieWeb — federated publishing and self-authorship - -## 🧬 Adoption Possibilities - -- Personal domains -- Union archives -- CDN layers -- Academic repositories -- Web frameworks - -AIBDP is not anti-AI — it’s pro-boundary. - ---- - -_“Without refusal, permission is meaningless.”_ diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/docs/governance.md b/rhodium-standard-repositories/satellites/consent-aware-http/docs/governance.md deleted file mode 100644 index 7836940c..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/docs/governance.md +++ /dev/null @@ -1,34 +0,0 @@ -# Governance Implications — Consent in Institutional Systems - -## 📰 Journalism + Union Frameworks - -AIBDP can support: -- Editorial boundaries -- Memory preservation -- Consent protocols for archive access - -## 🧩 Organizational Integration - -Use manifest layering to: -- Declare content rules -- Signal refusal across federated platforms -- Preserve ethical perimeter - -## 🏛 Policy Threads - -Aligned with: -- Whistleblowing frameworks -- Safeguarding protocols -- Privacy signaling -- Consent-aware data architecture - -## 🔄 Strategic Applications - -- Server integration -- Committee policies -- Public publishing standards -- Educational outreach - ---- - -Boundary isn’t only technical. It’s procedural governance. diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/docs/references.md b/rhodium-standard-repositories/satellites/consent-aware-http/docs/references.md deleted file mode 100644 index 4dcad48f..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/docs/references.md +++ /dev/null @@ -1,33 +0,0 @@ - ---- - -### 📄 `references.md` - -```markdown -# References and Influences - -## Protocol Standards - -- IETF HTTP specs -- RFC 8615 — `.well-known/` paths -- IndieWeb POSSE patterns -- Fediverse federation layers - -## Philosophical Sources - -- bell hooks — _Teaching to Transgress_, _All About Love_ -- Virginia Woolf — _The Waves_, _A Room of One’s Own_ -- Ursula Franklin — _The Real World of Technology_ -- Audre Lorde — "The master’s tools will never dismantle the master's house" -- Sinople editorials (https://sinople.pub) - -## Implementation Inspiration - -- GitHub’s community templates -- Robots.txt conventions -- GDPR + Data minimization -- Consent tech projects - ---- - -_We cite the voices that shaped this space. Dignity begins with acknowledgement._ diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/docs/start-here.md b/rhodium-standard-repositories/satellites/consent-aware-http/docs/start-here.md deleted file mode 100644 index 3c82ee67..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/docs/start-here.md +++ /dev/null @@ -1,74 +0,0 @@ -Quickstart — Make Your Site Consent-Aware - -✅ Step 1: Declare Your Boundary -Create a file at: - -/.well-known/aibdp.json -Add the following content: - -json -{ - "aibdp_version": "0.1", - "contact": "mailto:editor@sinople.pub", - "indexing": "allowed", - "training": "refused", - "regeneration": "refused" -} - -You may include additional fields such as "summary", "policy_url", or "signature" depending on your implementation. - -✅ Step 2: Respond with HTTP 430 -Configure your server to return: - -HTTP/1.1 430 Consent Required -Use this response when: - -The manifest is missing - -The manifest explicitly refuses the declared intent - -AI-related requests do not honor declared boundaries - -You can include a brief message in the body such as: - -Consent manifest unavailable or denied. -See /.well-known/aibdp.json for declared boundaries. - -✅ Step 3: Link Your Policy -Link to your AIBDP manifest for transparency: - -In your site footer - -In robots.txt - -In HTTP headers (e.g. Link: or X-AIBDP-Policy:) - -Example addition to robots.txt: - -# Consent-aware manifest: - -Allow: /.well-known/aibdp.json - -✅ Step 4: Publish with Integrity - -Once your site includes both: - -A valid AIBDP manifest - -Refusal logic via 430 - -You’re ready to adopt the Consent-Aware HTTP protocol. - -Consider adding a badge, a disclaimer, or educational links to help others learn and follow your lead. - -🛡 Maintenance Suggestions - -Validate your manifest with a JSON linter - -Consider adding a JWS or COSE signature - -Check headers using browser dev tools or curl - -Use /docs/technical.md and /docs/conformance.md to go deeper - -Consent isn’t just a checkbox. It’s a perimeter. Declare yours. For full documentation, see: README.md \ No newline at end of file diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/docs/technical.md b/rhodium-standard-repositories/satellites/consent-aware-http/docs/technical.md deleted file mode 100644 index 7a3ca422..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/docs/technical.md +++ /dev/null @@ -1,61 +0,0 @@ -Developer Explainer — Implementing Consent-Aware HTTP -This document helps developers adopt HTTP 430 and AIBDP manifests with clarity and minimal overhead. - -⚙️ HTTP 430: Consent Required -Add logic to your server that returns the following response when AI-specific consent is not granted: - -Status Line & Headers - -HTTP/1.1 430 Consent Required - -Content-Type: text/plain - -Body - -Consent manifest missing or denied. See /.well-known/aibdp.json -Trigger this response under the following conditions: - -No AIBDP manifest is present - -Manifest explicitly refuses your AI use case - -Request is from an agent declared as “AI” and boundary is violated - -🧭 AIBDP Manifest -Place a JSON file at /.well-known/aibdp.json with the following structure: - -json -{ - "aibdp_version": "0.1", - "contact": "mailto:editor@sinople.pub", - "indexing": "allowed", - "training": "refused", - "regeneration": "refused" -} -You may include additional fields such as "summary" or "policy_url" for context. - -🛠 Recommended Request Headers -Agents or infrastructures initiating AI-related requests should include: - -User-Agent: AI-Boundary-Agent/1.0 - -X-AI-Intent: training or regeneration or indexing - -If the declared intent conflicts with the origin’s manifest, return HTTP 430. - -🧪 Tooling Ideas -Developers may wish to build or extend tools that support: - -Manifest validators (syntax and semantics) - -Consent-aware extensions for robots.txt - -Middleware for auto-430 response handling - -Analytics dashboards for refusal types and triggers - -Caching layers for manifest lookups - -COSE/JWS signature verification of manifests (advanced) - -Consent isn't an afterthought. It’s architecture. Implement it with clarity. Refuse with dignity. \ No newline at end of file diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/draft-jewell-http-430-consent-required-00.xml b/rhodium-standard-repositories/satellites/consent-aware-http/draft-jewell-http-430-consent-required-00.xml deleted file mode 100644 index 1bdc4193..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/draft-jewell-http-430-consent-required-00.xml +++ /dev/null @@ -1,124 +0,0 @@ -<?xml version="1.0" encoding="UTF-8"?> -<!DOCTYPE rfc SYSTEM "rfc2629.dtd"> -<rfc xmlns="http://www.rfc-editor.org/rfcmarkup" - category="std" - ipr="trust200902" - docName="draft-jewell-http-430-consent-required-00" - version="3"> - - <front> - <title abbrev="Consent Required">HTTP Status Code 430: Consent Required - - NUJ Ethics Council -
- j.d.a.jewell@open.ac.uk -
- - - - This document defines HTTP status code 430 (Consent Required), used when access to a resource is denied due to the lack of satisfaction of an AI-specific consent declaration. It supports boundary-governance frameworks such as the AI Boundary Declaration Protocol (AIBDP). - - - - -
- Existing HTTP status codes such as 403, 428, and 451 do not sufficiently represent refusals based on declarative AI consent policies. Code 430 enables publishers to signal AI-specific boundaries using manifest protocols like AIBDP. -
- -
- Status Code: 430 - Phrase: Consent Required - The server denies access because the client failed to verify or respect AI-specific consent declarations associated with the requested resource. -
- -
- ; rel="blocked-by-consent" -Retry-After: 86400 - -{ - "error": "Consent declaration missing or invalid.", - "reference": "https://example.org/.well-known/aibdp.json" -} - ]]> -
- -
- - AI agents bypassing declared usage boundaries - Training initiations without manifest verification - CDNs enforcing consent manifests at content gateways - Edge filters applying declarative refusal logic - -
- -
- - - - - - - - - - -
CodeMeaningNotes
403ForbiddenGeneric denial; lacks ingestion context
428Precondition RequiredNot consent-centric
451Unavailable for Legal ReasonsFor legal rulings only
430Consent RequiredSignals declarative consent protocol failure
-
- -
- 430 responses MUST avoid revealing internal decision logic or sensitive metadata. Clients SHOULD treat 430 as procedural refusal and MAY query the manifest for remediation options. Consent manifests SHOULD be cryptographically verifiable using COSE. -
- -
- This document requests registration of HTTP status code 430 (Consent Required) in the HTTP Status Code Registry. -
- -
- - - - Key words for use in RFCs to Indicate Requirement Levels - IETF - - - - - - An HTTP Status Code to Report Legal Obstacles - IETF - - - - - - CBOR Object Signing and Encryption (COSE) - IETF - - - - - - - - - AI Boundary Declaration Protocol - J. D. A. Jewell - - - - -
- - - -
-
- j.d.a.jewell@open.ac.uk - NUJ Ethics Council -
-
- - diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/drafts/draft-jewell-http-430-consent-required-00.xml b/rhodium-standard-repositories/satellites/consent-aware-http/drafts/draft-jewell-http-430-consent-required-00.xml deleted file mode 100644 index 346e139d..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/drafts/draft-jewell-http-430-consent-required-00.xml +++ /dev/null @@ -1,133 +0,0 @@ - - - - - HTTP Status Code 430: Consent Required - - - National Union of Journalists -
- jonathan@metadatastician.art -
- - - - This document defines HTTP status code 430 (Consent Required), intended for use when access to a resource is denied due to the absence of a valid AI usage consent declaration. It supports machine-readable governance frameworks such as the AI Boundary Declaration Protocol, enabling declarative boundaries that prevent unauthorized indexing, training, or generative reuse of online content. - - - - -
- Introduction - Current HTTP status codes such as 403 (Forbidden), 428 (Precondition Required), and 451 (Unavailable for Legal Reasons) do not adequately reflect denial scenarios based on missing or invalid AI consent declarations. As declarative perimeter protocols (e.g., ) become more prevalent, a distinct status code is required to denote procedural consent failure prior to content access. - HTTP status code 430 (Consent Required) is proposed to signal that the requesting entity has failed to verify or respect the declared boundaries associated with AI ingestion, training, or derivative generation. This complements existing semantics defined in and expands ethical enforcement beyond legal constraints described in . -
- -
- Definition - Status Code: 430 - Phrase: Consent Required - The server denies access because the client failed to verify or satisfy AI-specific consent declarations associated with the requested content. This denial applies in cases where a .well-known/aibdp.json manifest is present or expected, and no sufficient verification or compliance has occurred. -
- -
- Response Examples - -HTTP/1.1 430 Consent Required -Content-Type: application/json -Link: <https://example.org/.well-known/aibdp.json>; rel="blocked-by" -Retry-After: 86400 - -{ - "error": "Consent declaration missing or invalid.", - "reference": "https://example.org/.well-known/aibdp.json" -} - -
- -
- Use Cases -
    -
  • AI crawlers and bots accessing content without checking for declarative usage terms
    • -
  • Autonomous agents initiating training operations on hosted data without pre-verification
    • -
  • Content Delivery Networks (CDNs) enforcing perimeter logic via manifest signals
    • -
  • Infrastructure providers enabling rate-limiting or denial logic based on absence of consent
    • -
-
- -
- Comparison to Existing Status Codes -
-
403 (Forbidden)
-
Generic denial; lacks boundary intent or procedural context.
-
428 (Precondition Required)
-
Designed for conditional requests; not consent-specific.
-
451 (Unavailable for Legal Reasons)
-
Legal enforcement only; not suited for declarative publisher-led refusals.
-
430 (Consent Required)
-
Represents non-legal, machine-readable perimeter logic. Expresses absence of verified permission, rather than technical or legal failure.
-
-
- -
- Security Considerations - Use of 430 Consent Required does not reveal sensitive internal logic or compromise user data. It enforces publisher-defined AI boundaries while preserving public accessibility of the perimeter declaration. This status code supports structured denial without over-identification of request origin. -
- -
- IANA Considerations - This document requests that IANA register the status code 430 (Consent Required) in the HTTP Status Code Registry. -
- - - - - Normative References - - - HTTP Semantics - - IETF - - - - - - - - - AI Boundary Declaration Protocol - - - - - - - - - Informative References - - - An HTTP Status Code to Report Legal Obstacles - - IETF - - - - - - - -
- Acknowledgements - This proposal builds on ethical governance efforts in journalism, computing, and infrastructure architecture. Thanks to contributors from the NUJ, the IETF HTTPAPI and ART areas, and transparency coalitions engaging in boundary-aware standards formation. -
- - diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/examples/reference-implementations/nodejs/README.md b/rhodium-standard-repositories/satellites/consent-aware-http/examples/reference-implementations/nodejs/README.md deleted file mode 100644 index a9c0e2d1..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/examples/reference-implementations/nodejs/README.md +++ /dev/null @@ -1,296 +0,0 @@ -# AIBDP + HTTP 430 Middleware for Express.js - -Reference implementation of the AI Boundary Declaration Protocol (AIBDP) with HTTP 430 (Consent Required) enforcement for Node.js/Express applications. - -## Features - -- **AIBDP Manifest Parsing**: Load and cache `/.well-known/aibdp.json` -- **AI System Detection**: Identify AI user-agents (GPTBot, Claude-Web, etc.) -- **Policy Enforcement**: Block or allow based on declared boundaries -- **HTTP 430 Responses**: Standards-compliant consent violation responses -- **Path Scoping**: Glob-pattern matching for granular control -- **Conditional Policies**: Check for consent headers and conditions -- **Automatic Caching**: Manifest caching with configurable TTL - -## Installation - -```bash -npm install -``` - -## Quick Start - -### Basic Usage - -```javascript -import express from 'express'; -import { aibdpMiddleware, serveManifest } from './index.js'; - -const app = express(); - -// Serve AIBDP manifest -app.use(serveManifest('.well-known/aibdp.json')); - -// Apply AIBDP enforcement -app.use(aibdpMiddleware({ - manifestPath: '.well-known/aibdp.json' -})); - -// Your routes -app.get('/', (req, res) => { - res.send('Hello, consent-aware world!'); -}); - -app.listen(3000); -``` - -### Run Example Server - -```bash -node example-server.js -``` - -Then test with: - -```bash -# Normal browser access (allowed) -curl http://localhost:3000/ - -# AI bot access (may be blocked based on manifest) -curl http://localhost:3000/article.html -H "User-Agent: GPTBot/1.0" - -# View AIBDP manifest -curl http://localhost:3000/.well-known/aibdp.json -``` - -## API Reference - -### `aibdpMiddleware(options)` - -Creates Express middleware for AIBDP enforcement. - -**Options:** - -- `manifestPath` (string): Path to AIBDP manifest file. Default: `.well-known/aibdp.json` -- `enforceForAll` (boolean): Enforce for all requests, not just AI bots. Default: `false` -- `onViolation` (function): Callback when violation detected. Signature: `(req, policy, purpose) => {}` - -**Returns:** Express middleware function - -**Example:** - -```javascript -app.use(aibdpMiddleware({ - manifestPath: './my-aibdp.json', - enforceForAll: false, - onViolation: (req, policy, purpose) => { - console.log(`Blocked ${purpose} from ${req.ip}`); - } -})); -``` - -### `serveManifest(manifestPath)` - -Creates middleware to serve AIBDP manifest at `/.well-known/aibdp.json`. - -**Arguments:** - -- `manifestPath` (string): Path to manifest file - -**Returns:** Express middleware function - -**Example:** - -```javascript -app.use(serveManifest('./aibdp.json')); -``` - -### Utility Functions - -#### `isAIUserAgent(userAgent)` - -Check if User-Agent header indicates an AI system. - -```javascript -import { isAIUserAgent } from './index.js'; - -if (isAIUserAgent('GPTBot/1.0')) { - console.log('AI system detected'); -} -``` - -#### `extractAIPurpose(headers)` - -Extract AI purpose from request headers (training, indexing, etc.). - -```javascript -import { extractAIPurpose } from './index.js'; - -const purpose = extractAIPurpose({ - 'user-agent': 'GPTBot/1.0', - 'ai-purpose': 'training' -}); -console.log(purpose); // 'training' -``` - -#### `pathMatches(requestPath, pattern)` - -Check if request path matches glob pattern from manifest. - -```javascript -import { pathMatches } from './index.js'; - -pathMatches('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/docs/guide.html', '/docs/**'); // true -pathMatches('/article.pdf', '*.pdf'); // true -pathMatches('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/blog/post.html', '/docs/**'); // false -``` - -## Manifest Format - -Example `.well-known/aibdp.json`: - -```json -{ - "aibdp_version": "0.2", - "contact": "mailto:policy@example.org", - "policies": { - "training": { - "status": "conditional", - "conditions": ["Attribution required", "Non-commercial use only"], - "scope": ["/articles/**"] - }, - "indexing": { - "status": "allowed", - "scope": "all" - }, - "generation": { - "status": "refused", - "rationale": "Content should not be synthetically replicated" - } - } -} -``` - -### Policy Status Values - -- `allowed`: Usage permitted without conditions -- `refused`: Usage explicitly prohibited -- `conditional`: Usage permitted if conditions met -- `encouraged`: Usage actively encouraged - -## HTTP 430 Response Format - -When a policy is violated, the middleware responds with HTTP 430: - -```http -HTTP/1.1 430 Consent Required -Content-Type: application/json -Link: ; rel="blocked-by-consent" -Retry-After: 86400 - -{ - "error": "AI usage boundaries declared in AIBDP manifest not satisfied", - "manifest": "https://example.org/.well-known/aibdp.json", - "violated_policy": "training", - "policy_status": "refused", - "required_conditions": [], - "rationale": "Content should not be used for training", - "contact": "mailto:policy@example.org" -} -``` - -## AI Consent Headers - -AI systems can indicate compliance by sending: - -```http -GET /article.html HTTP/1.1 -Host: example.org -User-Agent: ResearchBot/1.0 -AI-Purpose: indexing -AI-Consent-Reviewed: https://example.org/.well-known/aibdp.json -AI-Consent-Conditions: attribution,non-commercial -``` - -The middleware checks for these headers when enforcing conditional policies. - -## Detected AI User-Agents - -The middleware detects the following AI systems: - -- GPTBot (OpenAI) -- ChatGPT-User -- Claude-Web (Anthropic) -- Google-Extended -- CCBot (Common Crawl) -- Bingbot, Googlebot (when used for AI training) -- PerplexityBot -- Diffbot -- And more... - -## Testing - -Run tests: - -```bash -npm test -``` - -## Deployment Considerations - -### Production Checklist - -- ✅ Create AIBDP manifest at `/.well-known/aibdp.json` -- ✅ Set appropriate `expires` field in manifest (30-90 days recommended) -- ✅ Provide contact information for policy questions -- ✅ Monitor logs for violations -- ✅ Set up manifest validation in CI/CD -- ✅ Consider HTTPS + signatures for high-value content -- ✅ Document rationale in human-readable policy page - -### Performance - -- Manifest is cached in memory (default: 1 hour) -- Minimal latency impact for non-AI requests -- Failed manifest loads fail open (don't break site) -- Pattern matching is optimized with regex compilation - -### Security - -- Manifest served over HTTPS prevents tampering -- JSON parsing errors fail gracefully -- No sensitive information in manifest -- Signature verification supported (future) - -## Standards Compliance - -This implementation follows: - -- [draft-jewell-aibdp-00](https://github.com/Hyperpolymath/consent-aware-http/blob/main/drafts/draft-jewell-aibdp-00.xml) - AIBDP specification -- [draft-jewell-http-430-consent-required-00](https://github.com/Hyperpolymath/consent-aware-http/blob/main/draft-jewell-http-430-consent-required-00.xml) - HTTP 430 status code -- [RFC 8615](https://www.rfc-editor.org/info/rfc8615) - Well-Known URIs -- [RFC 8259](https://www.rfc-editor.org/info/rfc8259) - JSON format - -## License - -MIT License - see LICENSE file for details - -## Contributing - -See [CONTRIBUTING.md](../../../.github/CONTRIBUTING.md) in the main repository. - -## Support - -- **Issues**: https://github.com/Hyperpolymath/consent-aware-http/issues -- **Discussions**: https://github.com/Hyperpolymath/consent-aware-http/discussions -- **Email**: jonathan@metadatastician.art - -## Related Projects - -- [AIBDP Specification](https://github.com/Hyperpolymath/consent-aware-http) -- [Python Implementation](../python/) -- [Rust Implementation](../rust/) - ---- - -_"Without refusal, permission is meaningless."_ diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/examples/reference-implementations/nodejs/example-aibdp.json b/rhodium-standard-repositories/satellites/consent-aware-http/examples/reference-implementations/nodejs/example-aibdp.json deleted file mode 100644 index 368d5c47..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/examples/reference-implementations/nodejs/example-aibdp.json +++ /dev/null @@ -1,120 +0,0 @@ -{ - "aibdp_version": "0.2", - "canonical_uri": "http://localhost:3000/.well-known/aibdp.json", - "contact": "mailto:admin@example.org", - "expires": "2026-07-20T23:59:59Z", - "policy_uri": "http://localhost:3000/ai-policy", - - "policies": { - "training": { - "status": "conditional", - "conditions": [ - "Attribution required to 'Example Organization'", - "Non-commercial use only", - "Preserve context and source links" - ], - "scope": ["/article.html", "/docs/**"], - "exceptions": [ - { - "path": "/public.html", - "status": "allowed", - "note": "Public domain content, no restrictions" - } - ] - }, - - "indexing": { - "status": "allowed", - "scope": "all", - "note": "Full indexing permitted for search and discovery" - }, - - "summarization": { - "status": "allowed", - "conditions": ["Maintain accuracy", "Cite source URL"] - }, - - "question_answering": { - "status": "allowed", - "conditions": ["Cite source with URL"], - "note": "RAG systems may reference this content" - }, - - "generation": { - "status": "refused", - "rationale": "Content should not be synthetically replicated or used to generate derivative works", - "alternatives": "Link to original content with attribution instead" - }, - - "fine_tuning": { - "status": "encouraged", - "purpose": [ - "Educational tools", - "Accessibility features", - "Translation services" - ], - "note": "Fine-tuning for user benefit is encouraged" - }, - - "embedding": { - "status": "allowed", - "conditions": ["For semantic search and retrieval only"] - }, - - "commercial_training": { - "status": "conditional", - "conditions": [ - "Attribution in model documentation", - "Financial contribution to project", - "Do not claim content as proprietary" - ], - "note": "Commercial AI development requires transparent attribution" - } - }, - - "scope": { - "applies_to": [ - "LLM training and fine-tuning", - "Search engine indexing", - "RAG systems", - "Code completion tools", - "Documentation summarization" - ] - }, - - "special_provisions": { - "academic_research": { - "status": "unrestricted", - "note": "All content available for academic research. Please cite properly." - }, - - "educational_use": { - "status": "encouraged", - "note": "Use in courses and tutorials is strongly encouraged with attribution" - } - }, - - "enforcement": { - "mechanism": "http_430", - "note": "Violations result in HTTP 430 Consent Required responses", - "contact_before_litigation": true, - "preferred_resolution": "dialogue and boundary clarification" - }, - - "metadata": { - "created": "2025-07-20", - "last_modified": "2025-07-20", - "author": "Example Organization", - "organization": "Example Org", - "project": "Consent-Aware HTTP Example" - }, - - "philosophy": { - "core_principle": "Without refusal, permission is meaningless", - "values": [ - "Declarative refusal as care", - "Transparent infrastructure", - "Pro-boundary, not anti-AI" - ] - } -} diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/examples/reference-implementations/nodejs/package.json b/rhodium-standard-repositories/satellites/consent-aware-http/examples/reference-implementations/nodejs/package.json deleted file mode 100644 index 693b96df..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/examples/reference-implementations/nodejs/package.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "name": "aibdp-http430-middleware", - "version": "0.2.0", - "description": "Express middleware for AIBDP (AI Boundary Declaration Protocol) and HTTP 430 enforcement", - "main": "index.js", - "type": "module", - "scripts": { - "start": "node example-server.js", - "test": "node test.js", - "validate": "node validate-manifest.js .well-known/aibdp.json" - }, - "keywords": [ - "aibdp", - "http-430", - "consent", - "ai-boundaries", - "express", - "middleware" - ], - "author": "Jonathan D.A. Jewell ", - "license": "MIT", - "repository": { - "type": "git", - "url": "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/Hyperpolymath/consent-aware-http.git" - }, - "dependencies": { - "express": "^4.18.0" - }, - "devDependencies": { - "ajv": "^8.12.0" - }, - "engines": { - "node": ">=18.0.0" - } -} diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/examples/reference-implementations/python/README.md b/rhodium-standard-repositories/satellites/consent-aware-http/examples/reference-implementations/python/README.md deleted file mode 100644 index e814ab34..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/examples/reference-implementations/python/README.md +++ /dev/null @@ -1,380 +0,0 @@ -# AIBDP + HTTP 430 Middleware for Flask - -Reference implementation of the AI Boundary Declaration Protocol (AIBDP) with HTTP 430 (Consent Required) enforcement for Python/Flask applications. - -## Features - -- **AIBDP Manifest Parsing**: Load and cache `.well-known/aibdp.json` -- **AI System Detection**: Identify AI user-agents (GPTBot, Claude-Web, etc.) -- **Policy Enforcement**: Block or allow based on declared boundaries -- **HTTP 430 Responses**: Standards-compliant consent violation responses -- **Path Scoping**: Glob-pattern matching for granular control -- **Conditional Policies**: Check for consent headers and conditions -- **Automatic Caching**: Manifest caching with configurable TTL -- **Type Hints**: Full type annotations for IDE support -- **Decorator Support**: `@aibdp_required` for route-specific protection - -## Installation - -```bash -pip install -r requirements.txt -``` - -## Quick Start - -### Basic Usage - -```python -from flask import Flask -from aibdp_middleware import AIBDPMiddleware, serve_manifest - -app = Flask(__name__) - -# Initialize AIBDP middleware -middleware = AIBDPMiddleware( - app, - manifest_path='.well-known/aibdp.json' -) - -# Serve AIBDP manifest -app.route('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/.well-known/aibdp.json')(serve_manifest()) - -# Your routes -@app.route('/') -def index(): - return 'Hello, consent-aware world!' - -if __name__ == '__main__': - app.run() -``` - -### Run Example Server - -```bash -python example_server.py -``` - -Then test with: - -```bash -# Normal browser access (allowed) -curl http://localhost:5000/ - -# AI bot access (may be blocked based on manifest) -curl http://localhost:5000/article -H "User-Agent: GPTBot/1.0" - -# View AIBDP manifest -curl http://localhost:5000/.well-known/aibdp.json -``` - -## API Reference - -### `AIBDPMiddleware` - -Flask middleware class for AIBDP enforcement. - -**Constructor:** - -```python -AIBDPMiddleware( - app=None, - manifest_path: str = '.well-known/aibdp.json', - enforce_for_all: bool = False, - on_violation: Optional[Callable] = None -) -``` - -**Arguments:** - -- `app` (Flask, optional): Flask application (can use `init_app` later) -- `manifest_path` (str): Path to AIBDP manifest file -- `enforce_for_all` (bool): Enforce for all requests, not just AI bots -- `on_violation` (callable): Callback when violation detected. Signature: `(request, policy, purpose) -> None` - -**Example:** - -```python -def log_violation(request, policy, purpose): - print(f"Blocked {purpose} from {request.remote_addr}") - -middleware = AIBDPMiddleware( - app, - manifest_path='./my-aibdp.json', - enforce_for_all=False, - on_violation=log_violation -) -``` - -### `serve_manifest(manifest_path)` - -Create route handler to serve AIBDP manifest at `/.well-known/aibdp.json`. - -**Arguments:** - -- `manifest_path` (str): Path to manifest file - -**Returns:** Flask route handler function - -**Example:** - -```python -app.route('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/.well-known/aibdp.json')(serve_manifest('./aibdp.json')) -``` - -### `@aibdp_required` Decorator - -Protect specific routes with AIBDP enforcement. - -**Arguments:** - -- `manifest_path` (str): Path to AIBDP manifest (default: `.well-known/aibdp.json`) -- `purpose` (str): AI purpose to check against (training, indexing, etc.) - -**Example:** - -```python -from aibdp_middleware import aibdp_required - -@app.route('/article') -@aibdp_required(purpose='training') -def article(): - return 'Protected content' -``` - -This decorator will return HTTP 430 if AI training is refused or conditional requirements are not met. - -### Utility Functions - -#### `is_ai_user_agent(user_agent: str) -> bool` - -Check if User-Agent indicates an AI system. - -```python -from aibdp_middleware import is_ai_user_agent - -if is_ai_user_agent('GPTBot/1.0'): - print('AI system detected') -``` - -#### `extract_ai_purpose(headers: Dict[str, str]) -> str` - -Extract AI purpose from request headers. - -```python -from aibdp_middleware import extract_ai_purpose - -purpose = extract_ai_purpose({ - 'User-Agent': 'GPTBot/1.0', - 'AI-Purpose': 'training' -}) -print(purpose) # 'training' -``` - -#### `path_matches(request_path: str, pattern: str) -> bool` - -Check if request path matches glob pattern. - -```python -from aibdp_middleware import path_matches - -path_matches('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/docs/guide.html', '/docs/**') # True -path_matches('/article.pdf', '*.pdf') # True -path_matches('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/blog/post.html', '/docs/**') # False -``` - -#### `get_applicable_policy(manifest: Dict, purpose: str, request_path: str) -> Optional[Dict]` - -Get applicable policy for request. - -```python -from aibdp_middleware import get_applicable_policy - -manifest = {...} # Loaded AIBDP manifest -policy = get_applicable_policy(manifest, 'training', '/article.html') -``` - -## Manifest Format - -Example `.well-known/aibdp.json`: - -```json -{ - "aibdp_version": "0.2", - "contact": "mailto:policy@example.org", - "policies": { - "training": { - "status": "conditional", - "conditions": ["Attribution required", "Non-commercial use only"], - "scope": ["/articles/**"] - }, - "indexing": { - "status": "allowed", - "scope": "all" - }, - "generation": { - "status": "refused", - "rationale": "Content should not be synthetically replicated" - } - } -} -``` - -### Policy Status Values - -- `allowed`: Usage permitted without conditions -- `refused`: Usage explicitly prohibited -- `conditional`: Usage permitted if conditions met -- `encouraged`: Usage actively encouraged - -## HTTP 430 Response Format - -When a policy is violated, the middleware responds with HTTP 430: - -```http -HTTP/1.1 430 Consent Required -Content-Type: application/json -Link: ; rel="blocked-by-consent" -Retry-After: 86400 - -{ - "error": "AI usage boundaries declared in AIBDP manifest not satisfied", - "manifest": "https://example.org/.well-known/aibdp.json", - "violated_policy": "training", - "policy_status": "refused", - "required_conditions": [], - "rationale": "Content should not be used for training", - "contact": "mailto:policy@example.org" -} -``` - -## AI Consent Headers - -AI systems can indicate compliance by sending: - -```http -GET /article HTTP/1.1 -Host: example.org -User-Agent: ResearchBot/1.0 -AI-Purpose: indexing -AI-Consent-Reviewed: https://example.org/.well-known/aibdp.json -AI-Consent-Conditions: attribution,non-commercial -``` - -The middleware checks for these headers when enforcing conditional policies. - -## Type Safety - -This implementation includes full type hints for IDE support and type checking with mypy: - -```bash -pip install mypy -mypy aibdp_middleware.py -``` - -## Testing - -Create a test file `test_middleware.py`: - -```python -from aibdp_middleware import is_ai_user_agent, path_matches, extract_ai_purpose - -def test_ai_detection(): - assert is_ai_user_agent('GPTBot/1.0') == True - assert is_ai_user_agent('Mozilla/5.0') == False - -def test_path_matching(): - assert path_matches('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/docs/guide.html', '/docs/**') == True - assert path_matches('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/blog/post.html', '/docs/**') == False - -def test_purpose_extraction(): - headers = {'User-Agent': 'GPTBot/1.0'} - assert extract_ai_purpose(headers) == 'training' - -if __name__ == '__main__': - test_ai_detection() - test_path_matching() - test_purpose_extraction() - print('All tests passed!') -``` - -Run with: - -```bash -python test_middleware.py -``` - -## Deployment Considerations - -### Production Checklist - -- ✅ Create AIBDP manifest at `.well-known/aibdp.json` -- ✅ Set appropriate `expires` field in manifest (30-90 days recommended) -- ✅ Provide contact information for policy questions -- ✅ Monitor logs for violations -- ✅ Set up manifest validation in CI/CD -- ✅ Use production WSGI server (gunicorn, uWSGI) -- ✅ Enable HTTPS for manifest integrity -- ✅ Document rationale in human-readable policy page - -### Production Deployment - -Use a production WSGI server: - -```bash -pip install gunicorn -gunicorn -w 4 -b 0.0.0.0:5000 example_server:app -``` - -Or with uWSGI: - -```bash -pip install uwsgi -uwsgi --http :5000 --wsgi-file example_server.py --callable app --processes 4 -``` - -### Performance - -- Manifest is cached in memory (default: 1 hour) -- Minimal latency impact for non-AI requests -- Failed manifest loads fail open (don't break site) -- Regex compilation is efficient - -### Security - -- Manifest served over HTTPS prevents tampering -- JSON parsing errors fail gracefully -- No sensitive information in manifest -- Type-safe implementation reduces bugs - -## Standards Compliance - -This implementation follows: - -- [draft-jewell-aibdp-00](https://github.com/Hyperpolymath/consent-aware-http/blob/main/drafts/draft-jewell-aibdp-00.xml) - AIBDP specification -- [draft-jewell-http-430-consent-required-00](https://github.com/Hyperpolymath/consent-aware-http/blob/main/draft-jewell-http-430-consent-required-00.xml) - HTTP 430 status code -- [RFC 8615](https://www.rfc-editor.org/info/rfc8615) - Well-Known URIs -- [RFC 8259](https://www.rfc-editor.org/info/rfc8259) - JSON format - -## License - -MIT License - see LICENSE file for details - -## Contributing - -See [CONTRIBUTING.md](../../../.github/CONTRIBUTING.md) in the main repository. - -## Support - -- **Issues**: https://github.com/Hyperpolymath/consent-aware-http/issues -- **Discussions**: https://github.com/Hyperpolymath/consent-aware-http/discussions -- **Email**: jonathan@metadatastician.art - -## Related Projects - -- [AIBDP Specification](https://github.com/Hyperpolymath/consent-aware-http) -- [Node.js Implementation](../nodejs/) -- [Rust Implementation](../rust/) - ---- - -_"Without refusal, permission is meaningless."_ diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/examples/reference-implementations/python/aibdp_middleware.jl b/rhodium-standard-repositories/satellites/consent-aware-http/examples/reference-implementations/python/aibdp_middleware.jl deleted file mode 100644 index d61f48d7..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/examples/reference-implementations/python/aibdp_middleware.jl +++ /dev/null @@ -1,162 +0,0 @@ -# SPDX-License-Identifier: MIT OR GPL-3.0-or-later -# SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell - -#= -AIBDP + HTTP 430 Middleware for Julia -Fully ported from Python. -=# - -using HTTP -using JSON -using Dates - -# AI User-Agent patterns for detection -const AI_USER_AGENTS = [ - r"GPTBot"i, - r"ChatGPT-User"i, - r"Claude-Web"i, - r"anthropic-ai"i, - r"Google-Extended"i, - r"CCBot"i, - r"Googlebot"i, - r"Bingbot"i, - r"Slurp"i, - r"DuckDuckBot"i, - r"Baiduspider"i, - r"YandexBot"i, - r"PerplexityBot"i, - r"Diffbot"i, -] - -mutable struct AIBDPManifest - path::String - cache_duration::Millisecond - manifest::Union{Dict, Nothing} - load_time::Union{DateTime, Nothing} -end - -AIBDPManifest(path::String; cache_duration=Hour(1)) = AIBDPManifest(path, Millisecond(cache_duration), nothing, nothing) - -function load_manifest!(m::AIBDPManifest) - now_time = now() - - if m.manifest !== nothing && m.load_time !== nothing - if (now_time - m.load_time) < m.cache_duration - return m.manifest - end - end - - if !isfile(m.path) - return nothing - end - - try - m.manifest = JSON.parsefile(m.path) - m.load_time = now_time - return m.manifest - catch e - @warn "Failed to load AIBDP manifest: $e" - return nothing - end -end - -function is_ai_user_agent(user_agent::String) - return any(p -> occursin(p, user_agent), AI_USER_AGENTS) -end - -function extract_ai_purpose(headers::Dict) - # Check custom AI-Purpose header - if haskey(headers, "AI-Purpose") - return lowercase(headers["AI-Purpose"]) - end - - ua = get(headers, "User-Agent", "") - - if occursin(r"GPTBot"i, ua); return "training"; end - if occursin(r"Claude-Web"i, ua); return "indexing"; end - if occursin(r"Google-Extended"i, ua); return "training"; end - if occursin(r"Googlebot"i, ua); return "indexing"; end - - return "unknown" -end - -function path_matches(request_path::String, pattern::String) - if pattern == "all"; return true; end - - regex_pattern = pattern |> - p -> replace(p, "." => "\\.") |> - p -> replace(p, "**" => ".*") |> - p -> replace(p, "*" => "[^/]*") |> - p -> replace(p, "?" => ".") - - return occursin(Regex("^$regex_pattern\$"), request_path) -end - -function get_applicable_policy(manifest::Dict, purpose::String, request_path::String) - policies = get(manifest, "policies", nothing) - if policies === nothing; return nothing; end - - policy = get(policies, purpose, nothing) - if policy === nothing; return nothing; end - - # Check scope - scope = get(policy, "scope", nothing) - if scope isa Vector - if !any(p -> path_matches(request_path, p), scope) - return nothing - end - end - - # Check exceptions - exceptions = get(policy, "exceptions", []) - for ex in exceptions - if path_matches(request_path, ex["path"]) - return ex - end - end - - return policy -end - -function create_430_response(manifest::Dict, policy::Dict, purpose::String) - manifest_uri = get(manifest, "canonical_uri", "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/.well-known/aibdp.json") - - data = Dict( - "error" => "AI usage boundaries declared in AIBDP manifest not satisfied", - "manifest" => manifest_uri, - "violated_policy" => purpose, - "policy_status" => policy["status"], - "required_conditions" => get(policy, "conditions", []), - "rationale" => get(policy, "rationale", "No info"), - "contact" => get(manifest, "contact", "") - ) - - headers = [ - "Content-Type" => "application/json", - "Link" => "<$manifest_uri>; rel=\"blocked-by-consent\"", - "Retry-After" => "86400" - ] - - return HTTP.Response(430, headers, body=JSON.json(data)) -end - -# Example usage function for an HTTP server -function aibdp_enforce(req::HTTP.Request, manifest_loader::AIBDPManifest) - manifest = load_manifest!(manifest_loader) - if manifest === nothing; return nothing; end - - ua = HTTP.header(req, "User-Agent", "") - if !is_ai_user_agent(ua); return nothing; end - - headers_dict = Dict(k => v for (k, v) in req.headers) - purpose = extract_ai_purpose(headers_dict) - policy = get_applicable_policy(manifest, purpose, req.target) - - if policy === nothing; return nothing; end - - if policy["status"] == "refused" - return create_430_response(manifest, policy, purpose) - end - - return nothing -end diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/examples/reference-implementations/python/example-aibdp.json b/rhodium-standard-repositories/satellites/consent-aware-http/examples/reference-implementations/python/example-aibdp.json deleted file mode 100644 index 368d5c47..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/examples/reference-implementations/python/example-aibdp.json +++ /dev/null @@ -1,120 +0,0 @@ -{ - "aibdp_version": "0.2", - "canonical_uri": "http://localhost:3000/.well-known/aibdp.json", - "contact": "mailto:admin@example.org", - "expires": "2026-07-20T23:59:59Z", - "policy_uri": "http://localhost:3000/ai-policy", - - "policies": { - "training": { - "status": "conditional", - "conditions": [ - "Attribution required to 'Example Organization'", - "Non-commercial use only", - "Preserve context and source links" - ], - "scope": ["/article.html", "/docs/**"], - "exceptions": [ - { - "path": "/public.html", - "status": "allowed", - "note": "Public domain content, no restrictions" - } - ] - }, - - "indexing": { - "status": "allowed", - "scope": "all", - "note": "Full indexing permitted for search and discovery" - }, - - "summarization": { - "status": "allowed", - "conditions": ["Maintain accuracy", "Cite source URL"] - }, - - "question_answering": { - "status": "allowed", - "conditions": ["Cite source with URL"], - "note": "RAG systems may reference this content" - }, - - "generation": { - "status": "refused", - "rationale": "Content should not be synthetically replicated or used to generate derivative works", - "alternatives": "Link to original content with attribution instead" - }, - - "fine_tuning": { - "status": "encouraged", - "purpose": [ - "Educational tools", - "Accessibility features", - "Translation services" - ], - "note": "Fine-tuning for user benefit is encouraged" - }, - - "embedding": { - "status": "allowed", - "conditions": ["For semantic search and retrieval only"] - }, - - "commercial_training": { - "status": "conditional", - "conditions": [ - "Attribution in model documentation", - "Financial contribution to project", - "Do not claim content as proprietary" - ], - "note": "Commercial AI development requires transparent attribution" - } - }, - - "scope": { - "applies_to": [ - "LLM training and fine-tuning", - "Search engine indexing", - "RAG systems", - "Code completion tools", - "Documentation summarization" - ] - }, - - "special_provisions": { - "academic_research": { - "status": "unrestricted", - "note": "All content available for academic research. Please cite properly." - }, - - "educational_use": { - "status": "encouraged", - "note": "Use in courses and tutorials is strongly encouraged with attribution" - } - }, - - "enforcement": { - "mechanism": "http_430", - "note": "Violations result in HTTP 430 Consent Required responses", - "contact_before_litigation": true, - "preferred_resolution": "dialogue and boundary clarification" - }, - - "metadata": { - "created": "2025-07-20", - "last_modified": "2025-07-20", - "author": "Example Organization", - "organization": "Example Org", - "project": "Consent-Aware HTTP Example" - }, - - "philosophy": { - "core_principle": "Without refusal, permission is meaningless", - "values": [ - "Declarative refusal as care", - "Transparent infrastructure", - "Pro-boundary, not anti-AI" - ] - } -} diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/examples/reference-implementations/python/example_server.jl b/rhodium-standard-repositories/satellites/consent-aware-http/examples/reference-implementations/python/example_server.jl deleted file mode 100644 index b88bc5bf..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/examples/reference-implementations/python/example_server.jl +++ /dev/null @@ -1,89 +0,0 @@ -# SPDX-License-Identifier: MIT OR GPL-3.0-or-later -# SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell - -#= -Example Julia server demonstrating AIBDP + HTTP 430 middleware -=# - -using HTTP -using JSON -include("aibdp_middleware.jl") - -const PORT = 5000 -const MANIFEST_PATH = joinpath(@__DIR__, "example-aibdp.json") -const loader = AIBDPManifest(MANIFEST_PATH) - -function index_handler(req::HTTP.Request) - return HTTP.Response(200, ["Content-Type" => "text/html"], body=""" - - Consent-Aware HTTP Example (Julia/HTTP.jl) - -

Welcome to Consent-Aware HTTP (Julia)

-

This Julia server implements HTTP 430 + AIBDP.

- - - - """) -end - -function article_handler(req::HTTP.Request) - return HTTP.Response(200, ["Content-Type" => "text/html"], body=""" - - Protected Article (Julia) - -

Protected Article

-

This content has AI usage boundaries declared via AIBDP.

- - - """) -end - -function public_handler(req::HTTP.Request) - return HTTP.Response(200, ["Content-Type" => "text/html"], body=""" - - Public Content (Julia) - -

Public Content

-

This content is available for all purposes.

- - - """) -end - -function manifest_handler(req::HTTP.Request) - manifest = load_manifest!(loader) - if manifest === nothing - return HTTP.Response(404, body="Manifest not found") - end - return HTTP.Response(200, ["Content-Type" => "application/aibdp+json"], body=JSON.json(manifest)) -end - -const ROUTER = HTTP.Router() -HTTP.register!(ROUTER, "GET", "/", index_handler) -HTTP.register!(ROUTER, "GET", "/article", article_handler) -HTTP.register!(ROUTER, "GET", "/public", public_handler) -HTTP.register!(ROUTER, "GET", "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/.well-known/aibdp.json", manifest_handler) - -function middleware_handler(req::HTTP.Request) - # AIBDP Enforcement - resp = aibdp_enforce(req, loader) - if resp !== nothing - println("[AIBDP] Blocked request: $(req.target)") - return resp - end - - return ROUTER(req) -end - -function main() - println("🚀 Consent-Aware HTTP server (Julia) starting on http://localhost:$PORT") - HTTP.serve(middleware_handler, "0.0.0.0", PORT) -end - -if abspath(PROGRAM_FILE) == @__FILE__ - main() -end diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/examples/reference-implementations/python/requirements.txt b/rhodium-standard-repositories/satellites/consent-aware-http/examples/reference-implementations/python/requirements.txt deleted file mode 100644 index 7fa6f555..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/examples/reference-implementations/python/requirements.txt +++ /dev/null @@ -1,2 +0,0 @@ -Flask>=3.0.0 -jsonschema>=4.19.0 diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/rescript.json b/rhodium-standard-repositories/satellites/consent-aware-http/rescript.json deleted file mode 100644 index 9a0632f6..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/rescript.json +++ /dev/null @@ -1,7 +0,0 @@ -{ - "name": "consent-aware-http", - "sources": [{"dir": "src", "subdirs": true}], - "package-specs": [{"module": "es6", "in-source": true}], - "suffix": ".res.js", - "bs-dependencies": [] -} diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/schemas/aibdp-schema-v0.2.json b/rhodium-standard-repositories/satellites/consent-aware-http/schemas/aibdp-schema-v0.2.json deleted file mode 100644 index bfe11537..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/schemas/aibdp-schema-v0.2.json +++ /dev/null @@ -1,282 +0,0 @@ -{ - "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "https://consent-aware-http.org/schemas/aibdp-v0.2.json", - "title": "AI Boundary Declaration Protocol (AIBDP) Manifest Schema", - "description": "JSON Schema for validating AIBDP manifests hosted at /.well-known/aibdp.json", - "type": "object", - "required": ["aibdp_version", "contact", "policies"], - - "properties": { - "aibdp_version": { - "type": "string", - "description": "Protocol version number", - "pattern": "^\\d+\\.\\d+$", - "examples": ["0.1", "0.2", "1.0"] - }, - - "canonical_uri": { - "type": "string", - "format": "uri", - "description": "Authoritative location of this manifest for cross-domain policies" - }, - - "contact": { - "type": "string", - "description": "Contact URI for policy inquiries (mailto:, https:, etc.)", - "pattern": "^(mailto:|https?:).+", - "examples": ["mailto:policy@example.org", "https://example.org/contact"] - }, - - "expires": { - "type": "string", - "format": "date-time", - "description": "ISO 8601 timestamp when manifest should be re-fetched" - }, - - "policy_uri": { - "type": "string", - "format": "uri", - "description": "Link to human-readable policy document" - }, - - "policies": { - "type": "object", - "description": "AI usage policy declarations", - "properties": { - "training": { "$ref": "#/$defs/policy" }, - "indexing": { "$ref": "#/$defs/policy" }, - "summarization": { "$ref": "#/$defs/policy" }, - "question_answering": { "$ref": "#/$defs/policy" }, - "generation": { "$ref": "#/$defs/policy" }, - "fine_tuning": { "$ref": "#/$defs/policy" }, - "embedding": { "$ref": "#/$defs/policy" }, - "commercial_training": { "$ref": "#/$defs/policy" } - }, - "additionalProperties": { "$ref": "#/$defs/policy" }, - "minProperties": 1 - }, - - "scope": { - "type": "object", - "description": "Describes what AI systems this manifest addresses", - "properties": { - "applies_to": { - "type": "array", - "items": { "type": "string" }, - "description": "Types of AI systems this policy covers" - } - } - }, - - "special_provisions": { - "type": "object", - "description": "Special provisions for specific use cases", - "properties": { - "academic_research": { "$ref": "#/$defs/special_provision" }, - "educational_use": { "$ref": "#/$defs/special_provision" }, - "standards_development": { "$ref": "#/$defs/special_provision" } - }, - "additionalProperties": { "$ref": "#/$defs/special_provision" } - }, - - "enforcement": { - "type": "object", - "description": "Enforcement mechanism information", - "properties": { - "mechanism": { - "type": "string", - "enum": ["http_430", "legal", "reputational", "technical", "none"], - "description": "Primary enforcement mechanism" - }, - "note": { "type": "string" }, - "contact_before_litigation": { - "type": "boolean", - "description": "Whether to contact before legal action" - }, - "preferred_resolution": { - "type": "string", - "description": "Preferred approach to resolving violations" - } - } - }, - - "metadata": { - "type": "object", - "description": "Manifest metadata", - "properties": { - "created": { - "type": "string", - "format": "date", - "description": "Creation date (YYYY-MM-DD)" - }, - "last_modified": { - "type": "string", - "format": "date", - "description": "Last modification date" - }, - "author": { "type": "string" }, - "organization": { "type": "string" }, - "project": { "type": "string" }, - "repository": { - "type": "string", - "format": "uri" - }, - "related_standards": { - "type": "array", - "items": { "type": "string" } - } - } - }, - - "philosophy": { - "type": "object", - "description": "Philosophical framing and values", - "properties": { - "core_principle": { "type": "string" }, - "values": { - "type": "array", - "items": { "type": "string" } - }, - "quote": { "type": "string" } - } - }, - - "signature": { - "type": "object", - "description": "COSE cryptographic signature for manifest verification", - "required": ["algorithm", "value"], - "properties": { - "algorithm": { - "type": "string", - "enum": ["ES256", "ES384", "ES512", "RS256", "RS384", "RS512", "EdDSA"], - "description": "Signature algorithm (COSE)" - }, - "public_key_uri": { - "type": "string", - "format": "uri", - "description": "URI to public key (JWK format)" - }, - "value": { - "type": "string", - "description": "Base64-encoded COSE signature" - }, - "note": { "type": "string" } - } - } - }, - - "additionalProperties": true, - - "$defs": { - "policy": { - "type": "object", - "required": ["status"], - "properties": { - "status": { - "type": "string", - "enum": ["allowed", "refused", "conditional", "encouraged"], - "description": "Permission status for this AI usage mode" - }, - - "conditions": { - "type": "array", - "items": { "type": "string" }, - "description": "Requirements that must be met when status is 'conditional'" - }, - - "scope": { - "oneOf": [ - { "type": "string", "const": "all" }, - { - "type": "array", - "items": { "type": "string" }, - "description": "Path patterns this policy applies to" - } - ] - }, - - "exceptions": { - "type": "array", - "items": { - "type": "object", - "required": ["path", "status"], - "properties": { - "path": { - "type": "string", - "description": "Path pattern for exception" - }, - "status": { - "type": "string", - "enum": ["allowed", "refused", "conditional", "encouraged"] - }, - "note": { "type": "string" }, - "conditions": { - "type": "array", - "items": { "type": "string" } - } - } - } - }, - - "rationale": { - "type": "string", - "description": "Human-readable explanation of policy" - }, - - "alternatives": { - "type": "string", - "description": "Suggested alternative approaches" - }, - - "purpose": { - "type": "array", - "items": { "type": "string" }, - "description": "Specific purposes this policy encourages (when status is 'encouraged')" - }, - - "note": { - "type": "string", - "description": "Additional context or clarification" - } - }, - "additionalProperties": false - }, - - "special_provision": { - "type": "object", - "required": ["status"], - "properties": { - "status": { - "type": "string", - "enum": ["unrestricted", "encouraged", "allowed", "conditional", "refused"] - }, - "note": { "type": "string" }, - "conditions": { - "type": "array", - "items": { "type": "string" } - } - } - } - }, - - "examples": [ - { - "aibdp_version": "0.2", - "contact": "mailto:policy@example.org", - "policies": { - "training": { - "status": "conditional", - "conditions": ["Attribution required", "Non-commercial use only"] - }, - "indexing": { - "status": "allowed", - "scope": "all" - }, - "generation": { - "status": "refused", - "rationale": "Content should not be synthetically replicated" - } - } - } - ] -} diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/scripts/README-FIRST.md b/rhodium-standard-repositories/satellites/consent-aware-http/scripts/README-FIRST.md deleted file mode 100644 index 12825570..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/scripts/README-FIRST.md +++ /dev/null @@ -1,44 +0,0 @@ -scripts/ — Draft Building Utilities -This folder contains helper scripts to compile Internet-Drafts from their XML source files into readable formats (HTML, PDF, TXT) using the xml2rfc tool. - -These drafts form the foundation of the Consent-Aware HTTP standards: - -draft-jewell-http-430-consent-required - -draft-jewell-aibdp - -🛠 Tools Provided -✅ build-drafts.ps1 — PowerShell Script (Windows) -Use this if you're on Windows: - -.\scripts\build-drafts.ps1 -This invokes xml2rfc to build all drafts into /rendered/. - -Requires: pip install xml2rfc Run from the root folder of the repository. - -🧪 Makefile — POSIX Shell Targets (Linux/macOS) -Use this if you're on macOS or Linux: - -make -This compiles all XML drafts into /rendered/. - -Requires: xml2rfc installed and available in your PATH - -Use make clean to remove generated outputs. - -🔄 Input and Output -📥 Input drafts live in: drafts/ - -📤 Outputs land in: rendered/ - -You can review or publish the output HTML/PDFs directly from rendered/. - -❓ Troubleshooting -If xml2rfc isn't recognized, try: - -pip install xml2rfc -If a draft fails to compile, check that it is valid XML and follows RFC formatting rules. - -For help or updates, contact: Jonathan D.A. Jewell — jonathan@metadatastician.art - -Declare your perimeter. Compile with care. \ No newline at end of file diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/scripts/build-drafts.ps1 b/rhodium-standard-repositories/satellites/consent-aware-http/scripts/build-drafts.ps1 deleted file mode 100644 index e69de29b..00000000 diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/src/Aibdp.affine b/rhodium-standard-repositories/satellites/consent-aware-http/src/Aibdp.affine deleted file mode 100644 index 0ae2427f..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/src/Aibdp.affine +++ /dev/null @@ -1,241 +0,0 @@ -// SPDX-License-Identifier: MIT OR GPL-3.0-or-later -// SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell -// -// AIBDP + HTTP 430 middleware for Express. AffineScript port of Aibdp.res. -// Implements AI Boundary Declaration Protocol enforcement. - -module Aibdp; - -use Node; -use Express; - -extern fn console_warn(msg: String) -> Unit = "console" "warn"; -extern fn console_error(msg: String) -> Unit = "console" "error"; -extern fn json_parse(s: String) -> a = "JSON" "parse"; - -// Regex helpers (case-insensitive). `re_test(pattern, s)` tests /pattern/i. -extern fn re_test(pattern: String, s: String) -> Bool = "regex" "testI"; -extern fn re_replace_all(s: String, pattern: String, repl: String) -> String = "regex" "replaceAll"; -extern fn re_test_dynamic(anchored_pattern: String, s: String) -> Bool = "regex" "test"; -extern fn str_lower(s: String) -> String = "string" "toLowerCase"; - -// AI User-Agent patterns. -let ai_user_agent_patterns = [ - "GPTBot", "ChatGPT-User", "Claude-Web", "anthropic-ai", "Google-Extended", - "CCBot", "Googlebot", "Bingbot", "Slurp", "DuckDuckBot", "Baiduspider", - "YandexBot", "Sogou", "Exabot", "facebookexternalhit", "ia_archiver", - "PerplexityBot", "Omgilibot", "Diffbot", -]; - -pub type PolicyStatus = | Allowed | Refused | Conditional - -pub type Exception = { path: String, status: PolicyStatus } - -pub type Policy = { - status: PolicyStatus, - scope: Option<[String]>, - conditions: Option<[String]>, - rationale: Option, - exceptions: Option<[Exception]>, -} - -pub type Manifest = { - canonical_uri: Option, - policies: Dict, - contact: Option, -} - -pub type Response430 = { - status_code: Int, - headers: Dict, - body: Json, -} - -// Load and parse the AIBDP manifest. -pub fn load_manifest(manifest_path: String) -> Effect[Async] Option { - try { - let content = await Node.Fs.read_file(manifest_path, "utf-8"); - Some(json_parse(content)) - } catch e { - console_warn("Failed to load AIBDP manifest: " ++ exn_message(e)); - None - } -} - -pub fn is_ai_user_agent(user_agent: Option) -> Bool { - match user_agent { - None => false, - Some(ua) => { - let i = 0; - let found = false; - while i < len(ai_user_agent_patterns) { - if re_test(ai_user_agent_patterns[i], ua) { found = true; } - i = i + 1; - } - found - } - } -} - -pub fn extract_ai_purpose(headers: Dict) -> String { - match dict_get(headers, "ai-purpose") { - Some(purpose) => str_lower(purpose), - None => { - let ua = match dict_get(headers, "user-agent") { Some(u) => u, None => "" }; - if re_test("GPTBot", ua) { - "training" - } else if re_test("Claude-Web", ua) { - "indexing" - } else if re_test("Google-Extended", ua) { - "training" - } else if re_test("Googlebot", ua) { - "indexing" - } else { - "unknown" - } - } - } -} - -// Check if path matches a glob-style pattern. -pub fn path_matches(request_path: String, pattern: String) -> Bool { - if pattern == "all" { - true - } else { - let rx = re_replace_all(pattern, "\\.", "\\\\."); - rx = re_replace_all(rx, "\\*\\*", ".*"); - rx = re_replace_all(rx, "\\*", "[^/]*"); - rx = re_replace_all(rx, "\\?", "."); - re_test_dynamic("^" ++ rx ++ "$", request_path) - } -} - -fn status_to_string(s: PolicyStatus) -> String { - match s { Allowed => "allowed", Refused => "refused", Conditional => "conditional" } -} - -pub fn create_430_response(manifest: Manifest, policy: Policy, purpose: String) -> Response430 { - let manifest_uri = match manifest.canonical_uri { - Some(u) => u, None => "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/.well-known/aibdp.json", - }; - - let headers = dict_empty(); - dict_set(headers, "Content-Type", "application/json"); - dict_set(headers, "Link", "<" ++ manifest_uri ++ ">; rel=\"blocked-by-consent\""); - dict_set(headers, "Retry-After", "86400"); - - let conditions = match policy.conditions { Some(c) => c, None => [] }; - let rationale = match policy.rationale { - Some(r) => r, None => "No additional information provided", - }; - - Response430 { - status_code: 430, - headers: headers, - body: json_object([ - ("error", json_string("AI usage boundaries declared in AIBDP manifest not satisfied")), - ("manifest", json_string(manifest_uri)), - ("violated_policy", json_string(purpose)), - ("policy_status", json_string(status_to_string(policy.status))), - ("required_conditions", json_string_array(conditions)), - ("rationale", json_string(rationale)), - ("contact", json_opt_string(manifest.contact)), - ]), - } -} - -pub type MiddlewareOptions = { - manifest_path: Option, - enforce_for_all: Option, - on_violation: Option Unit>, -} - -// Express middleware factory. -pub fn aibdp_middleware(options: MiddlewareOptions) -> Express.Middleware { - let manifest_path = match options.manifest_path { - Some(p) => p, None => ".well-known/aibdp.json", - }; - let enforce_for_all = match options.enforce_for_all { Some(b) => b, None => false }; - - let manifest_ref = None; - let manifest_load_time = 0.0; - let cache_duration = 3600000.0; // 1 hour - - fn(req: Express.Req, res: Express.Res, next: Express.Next) -> Effect[Async] Unit { - try { - let now = Node.date_now(); - let stale = match manifest_ref { None => true, Some(_) => now -. manifest_load_time > cache_duration }; - if stale { - manifest_ref = await load_manifest(manifest_path); - manifest_load_time = now; - } - - match manifest_ref { - None => next(), - Some(manifest) => { - let user_agent = dict_get(req.headers, "user-agent"); - let is_ai = enforce_for_all || is_ai_user_agent(user_agent); - - if !is_ai { - next() - } else { - let purpose = extract_ai_purpose(req.headers); - match dict_get(manifest.policies, purpose) { - None => next(), - Some(policy) => { - match policy.status { - Refused => { - let response = create_430_response(manifest, policy, purpose); - match options.on_violation { - Some(f) => f(req, policy, purpose), - None => {}, - } - let r = Express.status(res, response.status_code); - let entries = dict_entries(response.headers); - let i = 0; - while i < len(entries) { - let (k, v) = entries[i]; - Express.header(r, k, v); - i = i + 1; - } - Express.json(r, response.body) - } - Allowed => next(), - // Simplified - full impl would check conditions. - Conditional => next(), - } - } - } - } - } - } - } catch e { - console_error("AIBDP middleware error: " ++ exn_message(e)); - next() - } - } -} - -// Serve manifest endpoint. -pub fn serve_manifest(manifest_path: Option) -> Express.Middleware { - let path = match manifest_path { Some(p) => p, None => ".well-known/aibdp.json" }; - - fn(req: Express.Req, res: Express.Res, next: Express.Next) -> Effect[Async] Unit { - if req.path != "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/.well-known/aibdp.json" { - next() - } else { - match await load_manifest(path) { - None => { - let r = Express.status(res, 404); - Express.json(r, json_object([("error", json_string("Manifest not found"))])) - } - Some(manifest) => { - let r1 = Express.header(res, "Content-Type", "application/aibdp+json"); - let r2 = Express.header(r1, "Cache-Control", "public, max-age=3600"); - let r3 = Express.header(r2, "Access-Control-Allow-Origin", "*"); - Express.json(r3, manifest) - } - } - } - } -} diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/src/Express.affine b/rhodium-standard-repositories/satellites/consent-aware-http/src/Express.affine deleted file mode 100644 index 51db2a61..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/src/Express.affine +++ /dev/null @@ -1,18 +0,0 @@ -// SPDX-License-Identifier: MIT OR GPL-3.0-or-later -// Express.js bindings. AffineScript port of Express.res. - -module Express; - -pub type Req = { - headers: Dict, - path: String, -} - -extern type Res; - -extern fn status(r: Res, code: Int) -> Res = "express" "status"; -extern fn header(r: Res, name: String, value: String) -> Res = "express" "header"; -extern fn json(r: Res, body: a) -> Unit = "express" "json"; - -pub type Next = fn() -> Unit; -pub type Middleware = fn(Req, Res, Next) -> Promise; diff --git a/rhodium-standard-repositories/satellites/consent-aware-http/src/Node.affine b/rhodium-standard-repositories/satellites/consent-aware-http/src/Node.affine deleted file mode 100644 index b7b287a5..00000000 --- a/rhodium-standard-repositories/satellites/consent-aware-http/src/Node.affine +++ /dev/null @@ -1,14 +0,0 @@ -// SPDX-License-Identifier: MIT OR GPL-3.0-or-later -// Node.js bindings. AffineScript port of Node.res. - -module Node; - -module Fs { - extern fn read_file(path: String, enc: String) -> Promise = "fs/promises" "readFile"; -} - -module Path { - extern fn join(a: String, b: String) -> String = "path" "join"; -} - -extern fn date_now() -> Float = "Date" "now"; diff --git a/scripts/build-registry.sh b/scripts/build-registry.sh index cd9f9e1d..cb547e53 100755 --- a/scripts/build-registry.sh +++ b/scripts/build-registry.sh @@ -75,7 +75,6 @@ k9-coordination-protocol|protocol|k9-coordination-protocol/|K9 Coordination Prot avow-protocol|protocol|avow-protocol/|AVOW Protocol|consent-attested messaging / origin attribution axel-protocol|protocol|axel-protocol/|AXEL Protocol|age-gating + explicit-content enforcement overlay-protocol|protocol|overlay-protocol/|Overlay Protocol|layered overlay composition spec -consent-aware-http|protocol|consent-aware-http/|Consent-Aware HTTP|consent headers / AI-usage boundaries for HTTP adoption-readiness-grades|readiness|adoption-readiness-grades/|ARG — Adoption Readiness Grades|per-language adoption-maturity profile templates foundations-readiness-grades|readiness|foundations-readiness-grades/|FRG — Foundations Readiness Grades|per-language foundational-maturity profile templates component-readiness-grades|readiness|component-readiness-grades/|CRG — Component Readiness Grades|the X..A grading system for components @@ -113,6 +112,7 @@ read -r -d '' EXTERNAL_SPECS <<'TSV' || true affine-spec|language|language-coupled|hyperpolymath/affinescript|https://github.com/hyperpolymath/affinescript/blob/main/spec/affine.adoc|v2.0.0||PENDING-FIRST-SYNC|application/vnd.affinescript.affine|affinescript:affine@2|AffineScript .affine (faces / source documents)|faces, canonical-lowering invariant, canonical islands, idiom packs, mimicry bindings, project face policy affex-manifest|language|language-coupled|hyperpolymath/affinescript|https://github.com/hyperpolymath/affinescript/blob/main/spec/affex.adoc|v2.0.0|2|PENDING-FIRST-SYNC|application/vnd.affinescript.affex|affinescript:affex@2|AffineScript .affex (face-interop manifest)|derived regenerable manifest; declaration heads not full bodies; format_version bumps independently affmap-provenance|language|language-coupled|hyperpolymath/affinescript|https://github.com/hyperpolymath/affinescript/blob/main/spec/affmap.adoc|v2.0.0||PENDING-FIRST-SYNC|application/vnd.affinescript.affmap|affinescript:affmap@2|AffineScript .affmap (provenance)|provenance format; own pointer for independent staleness tracking +consent-aware-web|protocol|service-coupled|metadatastician/consent-aware-web|https://github.com/metadatastician/consent-aware-web/blob/main/README.adoc|v0.2.0||PENDING-FIRST-SYNC|application/aibdp+json|ietf:aibdp@0.2|Consent-Aware Web (AIBDP + HTTP 430)|consent headers / AI-usage boundaries for HTTP; extracted from this repo 2026-08-07 TSV # Pick the canonical human doc for a home: README.adoc > README.md > first *.adoc spec.