No peer-readable route for a node's self-report: infra:attest confers the authority, no family carries it

[emooreatx]

There is no peer-readable way for a node to report on itself

Filing this as one missing capability rather than three defects, because three
implementation attempts each fixed the named problem and hit a different structural
wall. The walls are the finding.

What was attempted, and what stopped each

1. Automate the existing OP_SELF_SHED declaration. Refused at the write
door: check_admin_action_attribution requires a non-empty delegation_id on any
admin_action: event, because an admin action is a governance act by a person who
can be held to it. A node has no delegation. Correct — and this one should stay
refused.

2. A node-authored hard_case: observation with an expiry. Admitted, but
HardCaseEvent is on no replication plane (edge carries Attestation, Key,
IdentityOccurrence, TransportDestination, Community, CommunityMembershipRevocation).
No peer can ever receive it.

3. A short-lived config:load:v1 attestation (CC 3.1 config:{scope}, CC
3.4.5 self-or-owner, witness_relation: self, signed expires_at). This is the
right semantics — CC 3.1 says a config row is "only ever about the emitting
node" — and it still cannot reach a peer usefully, for three independent reasons:

• Scope. config:* is normatively cohort_scope: self (CIRISServer#324), and
  self scope is structurally invisible — it suppresses holds_bytes precisely so
  config is never directory-advertised or replicable. The namespace is either
  compliant and unreadable by peers, or federation-scoped and in breach.
• Trust set. A receiving peer's composer pins accord_holder and steward
  only; an ordinary node key screens as NotInTrustSet before its fields are read.
• Composition weighting. Self-attestations are weighted by live count, so a
  node that renews to stay current halves its own signal (one live row 0.5, two
  overlapping 1/3) — continued pressure makes the claim quieter.

The shape of the gap

The constitution supports a node speaking about itself. infra:attest is
conferred on every node — "vouch as the delegator's infrastructure" — and Clause
E has a node "sign its own refusal without new authority." CC 3.4.5 gives
config:{scope} a self-or-owner emitter rule. The authority is not in question.

What is missing is a route: a family that is (a) authored by the node about
itself, (b) replicable to peers, and (c) composable by a peer that has not
individually pinned that node. Today (a) and (b) are mutually exclusive, and (c)
has no path at all.

Why it matters beyond load

Load is the instance we hit; the shape is general. Anything a node alone can
observe about itself and a peer would act on takes the same route: I am at
capacity, my clock is unreliable, my storage is failing, I am shutting down
in 30s. Each is a self-report only the node can make, and none is expressible
peer-readably today. As the mesh grows, the case for peers reacting to a node's own
account of itself gets stronger, not weaker.

What we would need decided

Roughly, in descending order of scope:

1. Does a config:* sub-namespace exist that permits federation visibility —
   or does a peer-readable self-report belong in a different family entirely?
   Either answer is fine; what does not work is federation-scoping a namespace whose
   invariant is invisibility.
2. Is infra:attest sufficient for composition? A peer that trusts a node
   enough to replicate from it arguably already has grounds to weight that node's
   claims about itself — but TrustSet today pins only accord holders and
   stewards, and nothing derives trust from the infra:* grant.
3. How is a renewed self-report weighted? A renewing claim should not decay
   simply for being renewed. supersedes is the obvious primitive; whether a
   self-report should use it, or whether composition should count distinct
   subjects rather than distinct rows, is a policy question rather than an
   implementation one.

We are not blocked: CIRISServer 0.5.194 already has each node pacing its own
optional work under measured contention, which needs no authority and reaches no
peer. This is about the half a peer can act on.

Related: CIRISServer#504 (the withdrawn attempt, with the evidence) ·
CIRISServer#324 (config self-scope) · CIRISConstitution#96 ·
CIRISPersist#777/#778/#779

[emooreatx]

Ruled and landed — CC 3.4.5.1 self-report-route, on rc5. Filing this as one missing capability rather than three defects was the right call: the three walls have one answer each, and only one of them was constitutional.

1. Scope — the wall is not CC's, and the dilemma is false. This document has never pinned config:* to a cohort_scope. The CC 3.1.9 row constrains the subject ("only ever about the emitting node") — that is a different axis from scope, and conflating them is what produced "either compliant and unreadable by peers, or federation-scoped and in breach." The self-scoping you cite is CIRISServer#324, which was a correct fix for sensitive rows — auth.admin_key_ids, net.bootstrap_peers, federation.peer_sideband — generalized into a family-wide invariant CC never stated.

So: sensitive leaves (admission, transport) MUST stay self — their content is exactly what structural invisibility protects. A bare operational leaf like load carries no secret and MAY take the smallest scope that reaches the peers which route to it (CC 1.13.3.4's default applied to operational data) — never federation by reflex, federation only for a node serving the commons. No new sub-namespace, and no breach.

2. Trust — no, and it must not be. infra:attest confers authority to emit and no right to be believed. A grant issued by my owner cannot bind your composer; that would be authority laundering, and it is the same shape CC 3.4.7.3 forbids when it rules that neither party may assert the other's relation. Your instinct — "a peer that trusts a node enough to replicate from it arguably already has grounds to weight that node's claims about itself" — is right, and it is right as consumer policy: a peer you replicate from is one whose claims about itself you have already decided to accept at some weight. CC 4.4 is where that lives; CC does not set the number. Default posture: admissible but unweighted.

The larger point, now in-text: anyone may claim anything; absent trust or consent, a claim reaches no one but its author. The route a self-report travels is the consent-gated attestation plane — it flows to a peer only where the producer's consent grant includes it and the recipient is entitled. The missing "route" was never a family.

3. Renewal — supersedes, and count subjects. You named the primitive; it is ratified as a MUST. A renewing self-report MUST carry supersedes against the row it replaces, so the live set is one row per (subject, scope, leaf), and a composer weighting by live count MUST count distinct subjects, never distinct rows. Otherwise renewing correctly halves the signal and a third renewal thirds it — continued pressure makes the claim quieter, which inverts what renewal means. Forward-only per CC 4.5.9.3: superseding ends liveness, it does not un-say the record.

What CC explicitly does not fix, stated in the section so it is not read as an oversight: whether a given event kind rides a replication plane is an implementation's plane set. A family no plane carries is unreachable however it is scoped — HardCaseEvent is a substrate gap to close where it lives, not a constitutional one.

CLM-self-report-route is staged here. Companion rulings this cycle: CC 4.2.1.4 (#96 — the two planes, the node's one always-available act, TTL-attaches-to-unilateralness) and CC 3.1.3.1 (#98 — session:* registered, 115 families). Leaving this open as the staging anchor.