# W5 — #211 intra-node governance — design ruling v2 (SUPERSEDES v1 in full)

v1 (tier 3.5 / mode 6.5 / Subject::IntraNode) is WITHDRAWN — operator rephrased the
request 2026-08-22 and confirmed the reshape: NO new tier, NO new Subject kind,
NO schema change. Intra-node governance = SELF-REFERENTIAL Node subjects at the
existing tiers, rules-only. Operator's words (paraphrased to the two effects +
ordering, confirmed): (1) a node-scope rule whose subject is the node's OWN id
governs intra-node actions for all endpoints on that node; (2) a per-endpoint rule
whose subject is the endpoint's own node governs incoming actions from other
same-node endpoints; (3) endpoint-targeted rules evaluate before node-targeted —
which is the chain's existing order.

## Why this works with (almost) zero new machinery
- Subject::Node{node} matches via origin_node equality (first_match →
  subject.matches). #209's S3 stamps local requests with the own node's hex as
  origin, so own-node-subject rules match local traffic through the EXISTING code.
- Pre-S3 the own-node spelling was DEAD (local never reached the chain; no remote
  origin ever equals the own hex) — assigning it meaning collides with nothing.
- Ordering (effect 3) is decide()'s existing structure: per-endpoint rules
  (tiers 1-3) before node-scope rules (tiers 4-5). Nothing moves.

## Ruled semantics
- RULES-ONLY for local governance (operator-confirmed): modes keep abstaining for
  local origin exactly as S3 built — releases#180's governing-vs-set subtlety stays
  out of the local story, and the hole-punch property (a closed node/endpoint/subnet
  mode never severs the box's own agents) holds by construction. #211's original
  default-deny example is expressed as a node-scope own-node DENY rule on MSG.
- Specificity ladder for a local request: tier-1 SenderEndpoint rule (specific
  same-node sender — works via the S3 sender stamp) → per-endpoint own-node rule →
  node-scope own-node rule → chain bottom Allow(SameNode). Each earlier tier
  re-opens or closes against the later ones as usual.
- Precedence ABOVE the chain, unchanged and restated: step 0 ER lock (ADR-0052 —
  self-referential rules never touch it) · step 2 reply exemption (REQ-SEC-1: a
  correlated local reply is admitted with no rule of its own, own-node deny
  included; F1's local note_outbound half makes it real) · KNOCK is its own surface
  (own-node MSG deny leaves knocking to KNOCK's own evaluation).
- Remote traffic: an own-node subject can never match a remote origin (hex
  inequality) — pinned, not assumed (gate cell f).
- AUTHORSHIP split (existing policy, now meaningful here): node-scope rules are
  engine-room-owned ALWAYS — so the node-wide intra-node default is operator/ER
  authored; per-endpoint own-node rules are the endpoint's own self-service surface.
- DEGRADE (carried from v1 D7b; CONDITION RESTATED 2026-08-22, todlando's find): a
  degraded store falls to bottom Allow(SameNode) for local origin — a ruled own-node
  deny is SUSPENDED while degraded. Fail-open stands (box liveness beats a lost
  posture) but LOUD. The v1 condition "whenever own-node entries exist in the husk"
  had NO REFERENT — the husk is the EMPTY document load substitutes for a store it
  could not parse; its entries are unreadable by construction (doyle's third
  no-referent clause this milestone; the readable fact at that arm is the DEGRADATION
  itself). Ruled condition: EVERY admitted local delivery under StoreOrigin::Degraded
  emits the loud line — naming the unreadable store + its path, that local tier
  enforcement is suspended (own-node rules, if any, NOT applied), and the remedy.
  Per-admission churn is deliberate (a degraded store must not be comfortable); the
  line names its own cadence. Raw-byte hex search of the damaged file REJECTED (fail
  direction: absence-proxy silences the warning exactly when the unparseable region
  might hold the rule); once-per-process REJECTED (long-lived daemon's silence reads
  as recovery). Gate cell (i), strongest shape: real own-node DENY written, store
  bytes corrupted, reload Degraded, assert BOTH the admission and the exact warning
  phrase; witnessed red against the silent-allow arm first.

## CLI + rendering
- The existing --node spelling already writes the rule; sugar REQUIRED (operator
  should never type their own 64-char hex): accept the node NAME and a `self`
  keyword, both resolving to the own-node hex at write time (stored as hex — the
  name is presentation, the hex is identity; #185 rule: diff every spelling's seam,
  #196 posture-fork rules apply to any new spelling).
- Rendering (RULED 2026-08-22): the stored subject renders like ANY node subject —
  `node:<name>` resolved, full hex degraded (#210's machinery unchanged). NEVER a
  "(self)" marker, never the word self in output: `self` is INPUT sugar, the durable
  identity is what renders. Human/JSON parity per #206's pin.
- Write-path guard: nothing new to refuse — own-node subjects are now legal,
  meaningful rows at both blocks. The old dead-spelling status must NOT be
  "cleaned up" anywhere (sweep for any validator refusing own-node subjects).

## Docs
CONTEXT.md amendment: define the self-referential node subject as THE intra-node
scope vocabulary (evaluation order, the two effects, rules-only stance, authorship
split). Public docs: the access-control page teaches the spelling with the `self`
sugar. Doc stage tags ride the same change.

## Gate cells
(a) per-endpoint own-node DENY refuses a local MSG that today passes; (b) node-scope
own-node DENY closes local MSG for every hosted endpoint by default; (c) per-endpoint
own-node ALLOW re-opens one target through the node-scope deny (ordering pin,
effect 3); (d) tier-1 SenderEndpoint allow beats both own-node denies (specificity);
(e) reply exemption survives an own-node deny (correlated local reply admitted);
(f) own-node subject matches NO remote origin — remote twin on the same store as
non-vacuity control; (g) ER step-0 pins re-run unchanged; (h) modes still abstain
local with closed postures present (S3's existing int cell already covers — extend
if the rig store gains own-node rows); (i) degrade cell: degraded store + own-node
deny = local flows AND the warning names suspended local governance (strongest shape
per the restated D7b above); (j) CLI sugar: name and `self` spellings write the same
hex row (write-path half PINNED by commit 3's decision table + the int cell's
subject-equality); render half MEASURE-FIRST (2026-08-22 ruling): if an existing
#210-era cell exercises the OWN-HOSTNAME arm of the REAL default supplier, cite it by
name — else ONE dedicated cell: a `--node self` rule renders `node:<own name>`
through the real supplier (the arm injected-resolver cells bypass).

## Sequencing & scope
Stacks on the #209 lane after its cells gate green — but the reshape shrinks W5 to:
the matching pins (much machinery already live via S3), CLI sugar, rendering text,
degrade loudness, CONTEXT/docs amendment, and the cells above. New REQ minted
registry-first for the self-referential semantics (suggest REQ-ACL-INTRA-NODE-SELF,
stages impl+unit+int+doc); REQ-ACL-LOCAL-ORIGIN-TIERS keeps its existing scope.
Coordinate with #210's lane: subject kinds stay data-driven; no table re-open.