SSM-NET — Federation: Negotiation, Link Contents, Divergent Policy Handling (10C–10E)

Converge safely, carry only what’s needed, and keep each domain’s policy sovereign.

10C. Negotiation

  • Advertise: each peer publishes max supported level (L1/L2/L3).
  • Converge: the active link runs at min(local_max, remote_max).
  • Downgrade rule: when policies differ, operate at the lower disclosure; no coercion upward.
  • Upgrade path: raise a link level only by mutual consent and explicit policy.
# Example negotiation (informative)
local_max = L3
remote_max = L2
active_level = min(L3, L2)  # => L2

10D. What crosses the link (by level)

  • L1 — Label-first (minimum): value bytes + band, manifest_id, stamp, canonical subset declaration.
  • L2 — Lanes reproducible: L1 plus align / align_ascii for numeric parity.
  • L3 — Full evidence: L2 plus pullable evidence bundle (manifests, envelopes, hashes, checkpoint, verify script).
ItemL1L2L3
value (bytes)✓✓✓
band, manifest_id✓✓✓
align / align_ascii✗✓✓
stamp `SSMCLOCK1UTC_ISOnoncesha256=HEX
canonical subset declaration✓✓✓
evidence bundle (pull)optoptreq

Profiles: actual wire encodings follow the active profile (e.g., HTTP-M headers) while preserving byte-exact semantics.

10E. Divergent policy handling

  • Different manifests are allowed. Each side enforces its own manifest_id locally.
  • Preserve sender envelope. Receivers MUST NOT rewrite sender’s declared subset or stamp (collapse parity holds: phi((m,a)) = m).
  • Local remap for enforcement. A receiver MAY map sender posture to its own bands as a separate stamped observation (append-only; original stays intact).
  • Cross-validation (optional at L2/L3). Where align is public, receivers MAY recompute the lane to compare postures across manifests, acknowledging label differences.
  • Transparency. When adding a local observation, cite the local manifest_id used for remap in that new stamped note.
  • Public stance. Interfaces SHOULD publish which level(s) they support (L1/L2/L3) and whether cross-manifest comparisons are informational or used for local duties.
  • Conflict rule. On disagreement, local policy governs local action; the sender’s envelope remains preserved for replay.
# Append-only local remap (informative)
# 1) Preserve sender envelope (no edits)
# 2) Add receiver's observation as a new stamped note
SSMCLOCK1|2025-11-11T06:15:00Z|n57|sha256=<LOCAL_OBS_HEAD>|prev=<CURRENT_HEAD>
obs.manifest_id = "RECEIVER_POLICY.V2"
obs.band        = cutpoint_map(align_sender_or_local, obs.manifest_id)

Navigation

Previous: SSM-NET — Federation: Introduction, Purpose & Levels (10.0–10B)
Next: SSM-NET — Federation: Intermediaries, Privacy Posture, Failure & Fallback (10F–10H)