Consent protocol: Internet-Draft -03

XCIM records explicit consent from the person controlling a recipient email address to an identified sender for specified types of communication. An independent third party attests the consent, with immutable evidence anchored in a blockchain.

Revision -03 specifies EVP, OAuth with authenticated provider API verification, and OpenID Connect (OIDC) as alternative methods to establish control of the email address giving consent. An issuer may use any one admitted method after its required checks. Address verification alone does not grant permission: the same recipient must separately and explicitly accept the identified sender and communication types.

Corrected scope and revision status · eXplicit Consent-Identified Mail (XCIM): draft-saez-xcim-03 · Published text.

This is an individual Internet-Draft with intended status Experimental. Publication does not imply IETF endorsement, working-group adoption or an approved RFC. Amoy provisioning and live-node trials remain paused.

P1-01 development artifacts

Recipient, permission and message binding for direct email.

Development review, not a production verifier. D01–D03 are adopted project design decisions. IETF publication: draft-saez-xcim-01 (individual Internet-Draft). These checks cannot assert XCIM_PASS.

The issuer signs a Recipient Binding Attestation (RBA). An application-controlled Message Signer Authorization (MSA) scopes the delegate key. That key signs a Message Presentation (MP) committing to the attestation, authorization and message content; DKIM is applied afterward.

Reproducible source bundle

Download original P1-01 ZIP (preserved) · Preserved AS01-F01 + P1 review bundle · Historical AS proposal bundle · Publication manifest.

All keys and addresses are public, synthetic TEST ONLY material. The ZIP includes its baseline fixture/schema, dependency pins and standalone Python/Node checks. No private issuer or real DNS/RPC is required for these fixture checks.

Seven development schemas

These are separate from the 33 published WD-02-E1 schemas. Their xcim.invalid identifiers are offline development IDs; proposed media types are not IANA registration claims.

Header grammar and test vectors

Positive binding checks return P1_BINDING_FIXTURE_OK with can_assert_xcim_pass=false. FRAME_OK tests framing only; a fixture Proof is not authenticated publication evidence. Python and Node checks are maintained by this project and do not count as independent operator interoperability.

Run locally after extraction

python -m pip install -r requirements.txt
python tools/check_vectors.py
node tools/crosscheck.mjs

Pending dependencies

Authenticated issuer/app/domain authority, revocable MSA/key state, fresh permission/publication/anchor proofs, distributed SMTP replay and external security/privacy review remain required. The offline checker refuses to treat an attached Proof as authority while its verifier is pending.

AS-01 direction is adopted for G04-G06. AS01-F01 supplies 19 schemas and executable offline fixtures; live anchoring, DNS, durable installation and SMTP/MX integration remain pending.

Detailed dependency register (source) · Byte and semantic contracts (source) · Package guide (source). Source notes are currently in Spanish; schemas, grammar and tooling use English identifiers and diagnostics.