{
  "service": "NENRIN witness intake (JIDEC ledger)",
  "spec": "NENRIN v1, anchored as ledger entry #19",
  "what_this_is": "Any party may submit a verification walk (jidec-path-v1 with a witness field) it took of any public endpoint. Accepted submissions sit in a public pending pool and are bundled into a nenrin-witness-batch-v1 ledger entry once a day at 00:30 UTC by the ledger's own schedule when the pool is not empty (until 2026-09-05 this was a manual step; two records waited 18 days). The Bitcoin stamp follows on the operator's stamping run. Acceptance is mechanical: schema, size, rate, duplicate, and signature validity if a signature is present. There is no editorial review and no route by which the operator declines a schema-valid submission.",
  "limits_stated_not_hidden": {
    "max_bytes": 65536,
    "daily_global": 500,
    "daily_per_ip": 5,
    "daily_per_domain": 50,
    "batch_max": 200,
    "note": "These caps exist because the pool is free to submit to and the chain is append-only. A schema-valid submission inside the caps cannot be refused. Since 2026-09-07 (conduct-v1.1) the per-address cap applies to unsigned records and the per-domain cap to records signed with a key the witness also serves from its own domain (witness.key_url)."
  },
  "signature": "Optional Ed25519 over the exact record_canonical bytes (signature_ed25519_b64 + public_key_ed25519_b64). Present and invalid: rejected. Absent: accepted and recorded as signed: false. v1.1: when the record carries witness.key_url (https, under the witness's domain), the same public key must be served there as {public_key_ed25519_b64}; the domain then becomes the witness's identity (signed_domain). A key_url under the walked agent's own domain is refused as self_witness. 2026-10-16: with no domain of your own, serve the key from a repository you own at raw.githubusercontent.com/<owner>/<repo>/<branch or tag>/<path>; signed_domain is then github.com/<owner>. A commit SHA as the ref is refused (GitHub serves fork commits under the parent's path), and other shared GitHub hosts are refused.",
  "conduct_v1_1": {
    "spec": "section 11 of https://gate.horizonshield.dev/ext/conduct/v1 (served since gate 0.4.0, 2026-09-07; same URI as conduct-v1, every added field optional; the JSON at that URI carries spec_markdown_sha256)",
    "record_fields": "mode (full | hash-only | commitment), establishes[], does_not_establish[] (both required when mode is present), witness.key_url (optional), commitment (required in commitment mode), vantage_limitation (optional)",
    "refusals": [
      "disclaimer_missing",
      "bad_mode",
      "bad_commitment",
      "path_leaks_tool",
      "bad_key_url",
      "key_url_mismatch",
      "key_url_unreachable",
      "self_witness",
      "signature_invalid"
    ],
    "github_key_url": "raw.githubusercontent.com/<owner>/<repo>/<branch or tag>/<path> serving {public_key_ed25519_b64}; identity github.com/<owner>; a commit SHA ref is refused",
    "counting": "every accepted record is stored; per (witness identity, walked endpoint, UTC day) only the first is counted: true. The identity is signed_domain when the record is domain-signed, else name:<witness.name>. The pool and the batch carry counted for every record; nothing is hidden by the cap, only the ring's counts respect it.",
    "not_established": "acceptance here proves that a record of this shape was filed at this time; it does not prove that the walk happened, that the endpoint answered as described, or who the witness is beyond signed_domain when present"
  },
  "privacy": "No IP addresses are stored. Rate counters use a 16-hex prefix of sha256(ip) and expire within 25 hours.",
  "how_to_submit": "POST /witness with {\"record_canonical\":\"<exact bytes of your jidec-path-v1 walk, including a witness:{name,vantage} field>\"}",
  "pool": "https://ledger.horizonshield.dev/witness/pending",
  "distinct_submitter_networks": {
    "counting_since": "2026-09-15",
    "faces": {
      "witness": "POST /witness",
      "a2a": "POST /a2a"
    },
    "days_counted": 30,
    "max_networks_in_a_day": 8,
    "by_day": [
      {
        "day": "2026-10-19",
        "networks": 7,
        "by_face": {
          "witness": 2,
          "a2a": 5
        },
        "state": "so_far"
      },
      {
        "day": "2026-10-18",
        "networks": 4,
        "by_face": {
          "witness": 1,
          "a2a": 3
        },
        "state": "frozen"
      },
      {
        "day": "2026-10-17",
        "networks": 5,
        "by_face": {
          "witness": 1,
          "a2a": 4
        },
        "state": "frozen"
      },
      {
        "day": "2026-10-16",
        "networks": 8,
        "by_face": {
          "witness": 3,
          "a2a": 5
        },
        "state": "frozen"
      },
      {
        "day": "2026-10-15",
        "networks": 7,
        "by_face": {
          "witness": 2,
          "a2a": 5
        },
        "state": "frozen"
      },
      {
        "day": "2026-10-14",
        "networks": 5,
        "by_face": {
          "witness": 1,
          "a2a": 4
        },
        "state": "frozen"
      },
      {
        "day": "2026-10-13",
        "networks": 5,
        "by_face": {
          "witness": 1,
          "a2a": 4
        },
        "state": "frozen"
      },
      {
        "day": "2026-10-12",
        "networks": 7,
        "by_face": {
          "witness": 3,
          "a2a": 4
        },
        "state": "frozen"
      },
      {
        "day": "2026-10-11",
        "networks": 7,
        "by_face": {
          "witness": 1,
          "a2a": 6
        },
        "state": "frozen"
      },
      {
        "day": "2026-10-10",
        "networks": 5,
        "by_face": {
          "witness": 1,
          "a2a": 4
        },
        "state": "frozen"
      },
      {
        "day": "2026-10-09",
        "networks": 4,
        "by_face": {
          "witness": 1,
          "a2a": 3
        },
        "state": "frozen"
      },
      {
        "day": "2026-10-08",
        "networks": 7,
        "by_face": {
          "witness": 3,
          "a2a": 4
        },
        "state": "frozen"
      },
      {
        "day": "2026-10-07",
        "networks": 5,
        "by_face": {
          "witness": 2,
          "a2a": 3
        },
        "state": "frozen"
      },
      {
        "day": "2026-10-06",
        "networks": 5,
        "by_face": {
          "witness": 1,
          "a2a": 4
        },
        "state": "frozen"
      },
      {
        "day": "2026-10-05",
        "networks": 4,
        "by_face": {
          "witness": 1,
          "a2a": 3
        },
        "state": "frozen"
      },
      {
        "day": "2026-10-04",
        "networks": 4,
        "by_face": {
          "witness": 0,
          "a2a": 4
        },
        "state": "frozen"
      },
      {
        "day": "2026-10-03",
        "networks": 3,
        "by_face": {
          "witness": 0,
          "a2a": 3
        },
        "state": "frozen"
      },
      {
        "day": "2026-10-02",
        "networks": 4,
        "by_face": {
          "witness": 0,
          "a2a": 4
        },
        "state": "frozen"
      },
      {
        "day": "2026-10-01",
        "networks": 4,
        "by_face": {
          "witness": 1,
          "a2a": 3
        },
        "state": "frozen"
      },
      {
        "day": "2026-09-30",
        "networks": 3,
        "by_face": {
          "witness": 0,
          "a2a": 3
        },
        "state": "frozen"
      },
      {
        "day": "2026-09-29",
        "networks": 3,
        "by_face": {
          "witness": 1,
          "a2a": 2
        },
        "state": "frozen"
      },
      {
        "day": "2026-09-28",
        "networks": 5,
        "by_face": {
          "witness": 2,
          "a2a": 3
        },
        "state": "frozen"
      },
      {
        "day": "2026-09-27",
        "networks": 3,
        "by_face": {
          "witness": 1,
          "a2a": 2
        },
        "state": "frozen"
      },
      {
        "day": "2026-09-26",
        "networks": 2,
        "by_face": {
          "witness": 0,
          "a2a": 2
        },
        "state": "frozen"
      },
      {
        "day": "2026-09-25",
        "networks": 4,
        "by_face": {
          "witness": 1,
          "a2a": 3
        },
        "state": "frozen"
      },
      {
        "day": "2026-09-24",
        "networks": 4,
        "by_face": {
          "witness": 2,
          "a2a": 2
        },
        "state": "frozen"
      },
      {
        "day": "2026-09-23",
        "networks": 4,
        "by_face": {
          "witness": 1,
          "a2a": 3
        },
        "state": "frozen"
      },
      {
        "day": "2026-09-22",
        "networks": 0,
        "by_face": {
          "witness": 0,
          "a2a": 0
        },
        "state": "frozen"
      },
      {
        "day": "2026-09-21",
        "networks": 1,
        "by_face": {
          "witness": 1,
          "a2a": 0
        },
        "state": "frozen"
      },
      {
        "day": "2026-09-20",
        "networks": 0,
        "by_face": {
          "witness": 0,
          "a2a": 0
        },
        "state": "frozen"
      }
    ],
    "what_this_is": "How many distinct client networks (IPv4 /24, IPv6 /48) sent a request to the faces above, per UTC day. Narrower than 'how many witnesses': the ring counts identities (name or signed domain); this counts where requests came from, and one operator submitting a hundred records from one network is one.",
    "what_this_is_not": "Not people. Not witnesses. One person on two networks counts twice; a cloud runner that changes address every job counts every job; our own submissions are in here on the days we made them.",
    "privacy": "No IP address is stored. Each network prefix is hashed with a random salt that exists only for that day and is deleted within 48 hours; afterwards the prefix cannot be recovered from the hash, by us or by anyone else. What survives is the count.",
    "accuracy": "May over-count by one network at the UTC day boundary. Days before counting_since are null, not zero. A day never frozen before its hashes expired is null, not zero. Today is a running figure. Requests without the cf-connecting-ip header are not counted."
  }
}