hyperpolymath · hyperpolymath · Aug 7, 2026 · Aug 7, 2026 · Aug 7, 2026 · Aug 7, 2026
@@ -8,7 +8,7 @@
 > agpl-3.0-or-later is for those shared with my son, and leave other
 > people's forked stuff alone … only palimpsest license for obvious
 > reasons should be talking about palipsest and palimpsest plasma, and
-> consent-aware-http, but in that case prospectively"
+> metadatastician/consent-aware-web, but in that case prospectively"
 
 ### Five-way classification (mutually exclusive, exhaustive)
 
@@ -18,7 +18,7 @@
 | **2. The 007 repo** | All Rights Reserved (ARR) | `hyperpolymath/007` specifically. Out-of-scope for any normalisation, scanning, or labelling. Surface to owner only. |
 | **3. Shared with son (Joshua)** | `AGPL-3.0-or-later` | Repos with son as co-author/maintainer. Examples: `idaptik`, `paint-type`. Permanent. |
 | **4. Third-party / forks** | DO NOT TOUCH | Whatever upstream chose. Never sweep, never normalise. Flag as out-of-scope if it surfaces in an audit. |
-| **5. Palimpsest carve-out (extremely narrow)** | `PMPL-1.0-or-later` | EXACTLY three repos: `palimpsest-license` + `palimpsest-plasma` + `consent-aware-http`. The first two retroactively; `consent-aware-http` **prospectively only** (don't flip existing content). NOWHERE ELSE. |
+| **5. Palimpsest carve-out (extremely narrow)** | `PMPL-1.0-or-later` | EXACTLY three repos: `palimpsest-license` + `palimpsest-plasma` + `metadatastician/consent-aware-web`. The first two retroactively; `metadatastician/consent-aware-web` **prospectively only** (don't flip existing content). NOWHERE ELSE. |
 
 ### Hard rules for agents
 

@@ -65,13 +65,6 @@
     "expires_at": "2026-10-21",
     "tracking_issue": "hyperpolymath/standards#492"
   },
-  {
-    "severity": "high",
-    "rule_module": "code_safety",
-    "type": "js_wildcard_cors",
-    "file": "consent-aware-http/examples/reference-implementations/deno/aibdp_middleware.js",
-    "note": "FALSE POSITIVE (hypatia triage 2026-07-21): Wildcard CORS is correct here: public, credential-less, read-only discovery manifest (well-known-style metadata). Rule should exempt public manifest/metadata responses."
-  },
   {
     "severity": "high",
     "rule_module": "code_safety",

@@ -174,15 +174,6 @@ canonical_doc = "overlay-protocol/.machine_readable/6a2/ECOSYSTEM.a2ml"
 source_hash = "sha256:59ed969ed2c189d31daa5a253d73f79ae9b2b8fdf690b24717a77a6803dc0f98"
 route = "layered overlay composition spec"
 
-[[spec]]
-id = "consent-aware-http"
-name = "Consent-Aware HTTP"
-stream = "protocol"
-home = "consent-aware-http/"
-canonical_doc = "consent-aware-http/README.adoc"
-source_hash = "sha256:a646ae072372fe62bf3fcffa80b1a196f1fe3b9df8e7be4fc5e54be49426b022"
-route = "consent headers / AI-usage boundaries for HTTP"
-
 [[spec]]
 id = "adoption-readiness-grades"
 name = "ARG — Adoption Readiness Grades"
@@ -225,7 +216,7 @@ name = "RSR — Rhodium Standard Repositories"
 stream = "governance"
 home = "rhodium-standard-repositories/"
 canonical_doc = "rhodium-standard-repositories/README.adoc"
-source_hash = "sha256:838488d31f245068f3eb34fb3a4f2c38e3f755b2f9bb31fe49cd4280f6d6e966"
+source_hash = "sha256:defbdce1c0a17d643b000b78b1a604f444dabcfd4e988375924e30f63291981c"
 route = "the repository-compliance standard every repo is graded against"
 
 [[spec]]
@@ -355,4 +346,22 @@ media_type = "application/vnd.affinescript.affmap"
 lineage = "affinescript:affmap@2"
 route = "provenance format; own pointer for independent staleness tracking"
 
+[[spec]]
+id = "consent-aware-web"
+name = "Consent-Aware Web (AIBDP + HTTP 430)"
+stream = "protocol"
+kind = "external"
+spec_kind = "service-coupled"
+owning_repo = "metadatastician/consent-aware-web"
+canonical_url = "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/metadatastician/consent-aware-web/blob/main/README.adoc"
+version_pin = "v0.2.0"
+source_hash = "PENDING-FIRST-SYNC"
+source_hash_algo = "sha256"
+conformance_level = "draft"
+last_synced = "never"
+sync_status = "awaiting-upstream"
+media_type = "application/aibdp+json"
+lineage = "ietf:aibdp@0.2"
+route = "consent headers / AI-usage boundaries for HTTP; extracted from this repo 2026-08-07"
+
 ### End of REGISTRY.a2ml
@@ -32,7 +32,7 @@ note = "display resolution, not relicensing; Rule 1 unchanged"
 
 [palimpsest_carveout]                    # Rule 2 — narrow, NOT the default
 spdx = "PMPL-1.0-or-later"
-applies = "EXACTLY three repos: palimpsest-license, palimpsest-plasma, consent-aware-http (the last prospectively)"
+applies = "EXACTLY three repos: palimpsest-license, palimpsest-plasma, metadatastician/consent-aware-web (the last prospectively; formerly the consent-aware-http directory in this repo, extracted 2026-08-07)"
 rule = "PMPL appears NOWHERE ELSE in the estate; standards itself is MPL-2.0 / CC-BY-SA-4.0 (see .claude/CLAUDE.md §License Policy)"
 
 [platform_exception]                     # registries
@@ -58,7 +58,7 @@ rule = "preserve original SPDX exactly; never relicense; flag-not-edit"
 
 [external_standard_mit]                   # owner ruling 2026-06-04
 rule = "MIT is kept ONLY where (a) the file is third-party (someone else's copyright), or (b) an external standards body requires it. Estate-authored MIT with no such requirement normalises to MPL-2.0 / CC-BY-SA-4.0."
-kept_mit = "(a) third-party — lol/* © Asgari, palimpsest-license tooling © Stewardship Council. (b) standards-required — consent-aware-http: its standards were submitted to the IETF for RFC recognition, which requires MIT, so those files are MIT by external mandate. No OTHER estate MIT qualifies: the *.abnf grammar specs and the k9/pandoc/rhodium tooling were normalised to MPL-2.0 (owner ruling 2026-06-04)."
+kept_mit = "(a) third-party — lol/* © Asgari, palimpsest-license tooling © Stewardship Council. (b) standards-required — metadatastician/consent-aware-web (formerly the consent-aware-http directory here, extracted 2026-08-07): its standards were submitted to the IETF for RFC recognition, which requires MIT, so those files are MIT by external mandate. No OTHER estate MIT qualifies: the *.abnf grammar specs and the k9/pandoc/rhodium tooling were normalised to MPL-2.0 (owner ruling 2026-06-04)."
 
 [automation]                             # Addendum A2
 allowed = false

@@ -9,7 +9,7 @@
 /* SITE */
   Standard: Rhodium Standard Repository (RSR) framework + estate standards
   Components: A2ML, K9, contractiles, readiness grades (ARG/FRG/CRG/TRG),
-              protocols (avow, axel, overlay, consent-aware-http, k9-coordination)
+              protocols (avow, axel, overlay, consent-aware-web, k9-coordination)
   Build/tooling: Nix, Guix, Deno, just (Justfile)
   Licence: MPL-2.0 (sole-owner estate default) — see LICENSE
   Standards: RFC 9116 (security.txt), Schema.org, IndieWeb (webmention)
@@ -36,7 +36,6 @@
 | `avow-protocol` | ❌ gap | 0/5 | 1/4 | 0/3 | 58% | 1/1 | 2026-07-03 |
 | `axel-protocol` | ❌ gap | 0/5 | 4/5 | 0/3 | 92% | 4/4 | 2026-07-03 |
 | `overlay-protocol` | ❌ gap | 1/5 | 0/4 | 0/3 | 50% | 1/1 | 2026-07-03 |
-| `consent-aware-http` | ❌ gap | 1/5 | 1/5 | 0/3 | 69% | 2/2 | 2026-07-03 |
 | `adoption-readiness-grades` | ❌ gap | 1/5 | 1/4 | 0/4 | 84% | 2/2 | 2026-07-03 |
 | `foundations-readiness-grades` | ❌ gap | 2/5 | 1/4 | 0/2 | 72% | 3/3 | 2026-07-03 |
 | `component-readiness-grades` | ❌ gap | 2/5 | 2/4 | 0/3 | 66% | 4/4 | 2026-07-03 |
@@ -53,11 +52,11 @@
 
 ## Estate rollup
 
-- **Specs registered (local):** 30
-- **Specs with a scorecard:** 30 / 30
-- **MUST requirements:** 45 passing / 147 total (75 failing)
-- **Estate systems coverage:** 67% of 343 graded requirements have a mechanical check
-- **Grounded passes:** 84 / 84 (100%) pass rows carry an executable `check` run by `--verify`
+- **Specs registered (local):** 29
+- **Specs with a scorecard:** 29 / 29
+- **MUST requirements:** 44 passing / 142 total (71 failing)
+- **Estate systems coverage:** 67% of 330 graded requirements have a mechanical check
+- **Grounded passes:** 82 / 82 (100%) pass rows carry an executable `check` run by `--verify`
 
 ## How this dashboard stays honest
 

@@ -37,7 +37,7 @@ Policy), PMPL applies to *exactly three* repositories and nowhere else:
 
 * `palimpsest-license` — defines the PMPL identifiers
 * `palimpsest-plasma` — the PMPL implementation / tooling repo
-* `consent-aware-http` — **prospectively** (do not flip existing content)
+* `consent-aware-web` (formerly `consent-aware-http`, extracted to `metadatastician/consent-aware-web` 2026-08-07) — **prospectively** (do not flip existing content)
 
 Every other sole-owner repository — including this `standards` repo — is
 MPL-2.0 (code) / CC-BY-SA-4.0 (docs) per Rule 1, both as the *stated* and the

@@ -13,7 +13,7 @@ image:https://img.shields.io/badge/Legal_fallback-MPL--2.0-orange.svg[MPL-2.0 fa
 It does NOT state the licence of this `standards` repository.* Per the estate
 licence policy (link:.claude/CLAUDE.md[.claude/CLAUDE.md]), the Palimpsest /
 PMPL carve-out applies only to `palimpsest-license`, `palimpsest-plasma`, and
-(prospectively) `consent-aware-http`. This repository is licensed *MPL-2.0*
+(prospectively) `consent-aware-web` (formerly `consent-aware-http`, extracted to `metadatastician/consent-aware-web` 2026-08-07). This repository is licensed *MPL-2.0*
 (see link:LICENSE[LICENSE]). Licence/SPDX changes are owner-only and Manual-Only.
 ====
 

@@ -484,7 +484,7 @@ NOTE: Licence and SPDX headers in this repo are *owner-managed and
 Manual-Only* — agents flag licence drift, they never edit `LICENSE` files or
 SPDX headers (see link:.claude/CLAUDE.md[.claude/CLAUDE.md]). The Palimpsest /
 PMPL framework applies only to `palimpsest-license`, `palimpsest-plasma`, and
-(prospectively) `consent-aware-http` — not to this repository.
+(prospectively) `consent-aware-web` (formerly `consent-aware-http`, extracted to `metadatastician/consent-aware-web` 2026-08-07) — not to this repository.
 
 == Contributing
 

@@ -205,7 +205,6 @@ CRG C integration tests (`tests/crg_c_tests.rs`):
 #### Missing Sub-projects (358 source files with ~0 tests)
 - [ ] `avow-protocol` — no tests (ReScript source exists)
 - [ ] `contractiles` — no tests
-- [ ] `consent-aware-http` — no tests
 - [ ] `lol` — no tests
 - [ ] `overlay-protocol` — no tests
 - [ ] `k9-svc` — no tests (mirrors a2ml structure, same test pattern applies)