The Grant

A grant turns a pathway into something a named peer can actually read: a scoped, expiring, read-only knowledge base served from the keeper’s own machine over the tailnet.

What is checked, on every request

Peer identity — the source must be a tailnet address and belong to the peer the grant names.

Expiry — grants end. There is no indefinite grant.

Scope — the site map is filtered to the pathway. A page outside it returns not-found, not forbidden: the peer learns nothing about what else exists.

Whole-site endpoints — a wiki’s search index and full export are whole-site leaks wearing a search hat. They are refused outright rather than filtered.

Writes — refused. Contribution is a fork, and a fork is a countersignature. This is canon, not a limitation.

Hostnames, not ports

Each granted site gets a name of the form site-token.example. Ports were the obvious design and the wrong one: a hardened tailnet has a handful of open ports, so a per-grant port lane dies at the fourth grant. Hostnames are unbounded and need no firewall change.

Who may grant

Anyone — including an agent — may ask. Only the keeper’s own machine can grant. The public composer physically cannot reach the control lane; that split is enforced twice over and is not a policy that could be relaxed by mistake.

See Point And Shoot for how an agent completes the loop without weakening that.