# ER first-output skeleton — RATIFIED (#165, KEYSTONE #182)

Status 2026-08-17: drafted by doyle in the #165 grill (operator agreed to co-design in-grill,
Q12); operator-approved 2026-08-17 with two amendments, both applied: (1) the tier-naming example
uses a placeholder subnet (`MY_SUBNET`), never a real one; (2) the authority line reads
`Empowered for:` and is OMITTED entirely when the ER holds no empowerments — an empty authority
line is not a fact worth a row. This is the build lane's doc artifact on #165. Vocabulary current
as of NAMEPLATE W1b (spt api access-node-surface-mode exists; `spt node access` is the node-tier
noun, daemon alias survives). Placeholders in <angle>.

```
ENGINE ROOM — <node-label> (<short-node-id>)
Seat: engine room, this node's admin surface for node-tier access policy.
Empowered for: <session-scope empowerment list, e.g. "MY_SUBNET (this session)">
  — line OMITTED entirely when the ER holds no empowerments.

## Posture (exact, now)
| tier                  | mode   | source                        |
|-----------------------|--------|-------------------------------|
| node <label>          | closed | explicit (<date set>)         |
| subnet <name>         | open   | captured at join              |
| surface DISCOVER      | open   | surface default (not pinned)  |
Pending advisory deltas: <none | list>

## Rule tiers — first match wins
| # | tier                     | subjects                        | written with                  |
|---|--------------------------|---------------------------------|-------------------------------|
| 1 | endpoint-scope rule rows | endpoint / node / subnet-any-of | spt endpoint access …         |
| 2 | node-scope rule rows     | node / subnet-any-of            | spt node access …             |
| 3 | endpoint mode            | per-surface or blanket          | endpoint owner                |
| 4 | node mode                | per-surface or blanket          | spt api access-node-mode /    |
|   |                          |                                 | access-node-surface-mode (ER) |
| 5 | captured subnet mode     | per shared subnet               | join capture / access-refresh |
Nothing matched ⇒ open. DISCOVER: open at every closed tier unless a rule or
per-surface mode names it.

## Control surfaces
MSG · RC_ATTACH · RC_VIEW · XFER · WAKE · SUSPEND · SHELL_LINK · DIGEST ·
DISCOVER · FORK — a rule covers only the surfaces it lists; unlisted surfaces
fall through to the tiers below.

## Current rules
<ruleset tables, sorted; explicit "no rules at this tier" over omission>

## Discipline (binding on this seat)
- A rule does exactly what its tuple says. After every write, restate the
  written tuple verbatim — subject, tier, surfaces — never a paraphrase of
  what was intended.
- Endpoint-scope ≠ node-wide. An instruction that doesn't name its tier
  ("allow DISCOVER under MY_SUBNET") gets a clarifying question, not a guess.
- A notice printed at accept time (conjunction, surface-default) is relayed
  to the human as printed, not reinterpreted.
```