Consent protocol: Internet-Draft -03

XCIM records explicit consent from the person controlling a recipient email address to an identified sender for specified types of communication. An independent third party attests the consent, with immutable evidence anchored in a blockchain.

Revision -03 specifies EVP, OAuth with authenticated provider API verification, and OpenID Connect (OIDC) as alternative methods to establish control of the email address giving consent. An issuer may use any one admitted method after its required checks. Address verification alone does not grant permission: the same recipient must separately and explicitly accept the identified sender and communication types.

Corrected scope and revision status · eXplicit Consent-Identified Mail (XCIM): draft-saez-xcim-03 · Published text.

This is an individual Internet-Draft with intended status Experimental. Publication does not imply IETF endorsement, working-group adoption or an approved RFC. Amoy provisioning and live-node trials remain paused.

AS01-F01 authority/state fixtures

Adopted A1-A6 direction, with closed contracts and reproducible synthetic evidence.

Offline development evidence. These fixtures cannot assert XCIM_PASS. No live anchor adapter, DNS/actor authentication, durable installation or multi-MX SMTP acceptance is implemented.

Adoption record · Design and alternatives · Remaining dependencies and closure criteria

Reproducible review bundle

Download AS01-F01 + P1 source bundle · Publication manifest. Includes the public sibling P1 dependency, schemas, signed wire fixtures, literal patches, expected results and offline Python/Node tools. All seeds/keys and .invalid identities are PUBLIC TEST ONLY.

AN01-P01 anchor adapter proposal: adopted ABI, acyclic genesis and receiver-node finality direction; AN01-F01 implements local contract/schema fixtures. Download current review bundle; the original AS01-F01 ZIP above retains its published bytes.

Executed fixture coverage

97 scenarios: 8 positive authority fixtures, 2 transition/recovery artifact checks and 87 adversarial cases; plus 37 structural schema cases. The 135 existing P1 cases remain separate and unchanged.

Checks cover role/threshold signatures, complete bounded event prefixes and authority projections, sparse membership and absence, exact MSA/receipt/batch commitments, revoked/terminal state, scope/epoch substitution, renewal, clock boundaries, rollback and known permission/authority tombstones. Root recovery returns AS01_RECOVERY_REQUIRES_RESYNC and installs nothing.

Base signed evidence · 97 literal scenario patches and expected results · Structural cases · Decoded payloads and exact sparse constants

19 closed development schemas

The EvidenceSet development contract requires anchor_evidence=null. This is a missing adapter slot, never a valid public anchor. Unknown anchor JSON is rejected; P1 still refuses Proof until a complete verifier exists. The schemas do not accredit an issuer or authenticate a real DNS observation.

Run from the extracted bundle root

python -m pip install -r as01/requirements.txt
python as01/tools/check_vectors.py
node as01/tools/crosscheck.mjs
python p1/tools/check_vectors.py
node p1/tools/crosscheck.mjs

Python and the partial Node cross-check belong to this project; they do not count as independent operator interoperability. Fixtures have fixed clocks. 300s state / 24h root-manifest limits and 60s cadence remain unmeasured trial parameters.

Package guide · Implementation scope and bytes · Dependencies and AS-T01-T24 coverage. Original P1-01 archive and original AS proposal archive retain their published bytes.