Whatsup authority model

Whatsup keeps community authority in records and endpoint operation in laced. Running an endpoint does not grant application authority.

Community steward

A community steward is the key selected by a client as application authority for one community. Its By-secret value makes Marks for roots, rooms, membership statements, moderation-shaped updates, and endpoint endorsements.

Steward selection is public Lace state:

//<community>//whatsup/steward-choice//key/<record-key>

A valid choice is self-attributed by its chooser. A client trusts only choices from keys its local policy already follows. Community invite JSON is secret-free bootstrap recommendation input; importing one publishes the local the selected key’s own steward-choice record after fetching and validating the exact invited root.

The development fixture’s demo root is only a default recommendation source. It is not an endpoint or production authority.

Static endpoint policy

endpoint prepare reads a completed local community setup and emits one Datalog operand bound to:

community + exact root hash + community steward key

The exact root is an advertised candidate before the endpoint has it. Once ordinary interlace admits that root and its evidence, later mandatory rounds can select the supported community records authorized by the configured steward, writer grants, and exact record links.

One generated policy hosts one community. Deployment configuration is local operator state, not a Whatsup record family. Reconfiguring or stopping an endpoint changes future selection; it does not erase stored or previously copied bytes.

laced may have its own transport By-secret credential, but Whatsup does not use it as community authority and does not put the community steward secret in BySecretFile.

Browser setup key

The CLI can copy the existing community creator/steward identity into a browser with an origin-bound URL fragment. The envelope contains the identity, public community invite, display name, and endpoint. It is a typed reusable key copy, not an account, login session, or one-use bearer token.

The browser:

• accepts the key only from #whatsup-setup=..., never query state;
• strips the fragment before application metadata fetches;
• requires HTTPS except on loopback;
• verifies the exact audience origin and field set;
• derives the By value from the By-secret value;
• requires that identity to equal the invited community steward;
• requires durable browser storage; and
• asks before replacing existing browser setup.

Anyone holding the URL receives community-steward authority. Keep it out of logs, shell history, tickets, and chat. If endpoint seeding or the first exact-root fetch fails, the operator fixes the endpoint and reopens the original reusable URL. Ordinary member invites remain secret-free.

Endpoint endorsements

A community steward may publish a waypoint endorsement containing Endpoint, Waypoint-Steward, Purpose, Priority, and optional Expires-TAI. The legacy field name Waypoint-Steward carries endpoint-operator By value metadata; Whatsup does not use that key to operate storage or listeners. The discovery recommendation is marked by the community steward. The named endpoint operator does not become community authority, and a recommendation marked by the endpoint operator would not become trusted.

Public exposure

The current client bounded- and open-sync operand is the broad coordinate-only public Whatsup surface. The static endpoint contributes a narrower authority-aware operand, but client projections remain the final application authority check. A later writer revocation hides that writer in current projections while valid historical records may remain endpoint-visible and already copied.

Advertisement policy for an edit, retraction, reaction, or attachment requires its advertised Message target to be an already checked endpoint message and a Message+Link field to be present. Advertisement facts cannot express exact equality between that raw link text and the separate target field. A transferred record with a malformed or mismatched link can therefore be admitted to endpoint storage, but post-validation RecordLink checks exclude it from endpoint selection and exposure. Resource limits bound this public admission surface.

Private rooms require a future narrow client and endpoint policy. UI filtering alone is not a privacy boundary.