Trust and standing

Kunuleco separates three questions that platforms usually blur: who are you (identity), can you be here (presence), and what may you do here (capability and standing).

Capabilities, not lists

Access in Kunuleco comes from holding an unforgeable token, not from appearing on a permission list. You grant an identity specific capabilities (read, write, …) on a capsule, and revoke them later:

grant notes Mira#472913 read,write
revoke notes Mira#472913
list grants notes

Because a capability names the thing it opens, delegation is natural and revocation is clean. And because presence is not capability, someone can stand in your room without being able to open anything in it.

Standing: trust within a space

Standing is your trust level within a particular space. It rises from visitor to steward, and each tier unlocks deeper zones and more authority:

Tier	Can…
Visitor	Read the Public zone. Implicit; not a member
Newcomer	Read and write in the Public zone: the first member tier
Familiar	Enter and participate in the Common zone
Trusted	Moderate Common (remove content, remove people)
Steward	Enter the Private zone, govern the space, and grant standing to others

Check yours with standing. A Steward grants a tier with standing <user> <tier>.

Getting in: thresholds, knocks, vouches

Entry to a gated Hall flows through a knock queue: newcomers knock, the Steward reviews with knocks and uses accept / reject, and members who are already Familiar or better can vouch for someone, and two vouches admit them without the Steward needing to act. The Hall's threshold (open, knock, members_only) decides how much ceremony is involved; invite_only is reserved and behaves like knock until invite codes land. See Your first Hall.

Names you choose: petnames

A petname is your own private alias for someone. Once you have met them, it is pinned to their key, not their display name. An alias you have already set cannot be quietly re-pointed at someone else, because re-pointing requires you to clear it yourself first. Your petnames and contacts live in your private peer registry and survive restarts.

Blocking

block <identity> marks a peer as blocked on your node and drops any session you have open with them. unblock <identity> lifts it. It is a decision your node makes about what it accepts. It does not reach into anyone else's node or erase what they already have.

Membership is intentional

Two more mechanisms keep trust meaningful:

• Sponsorship. Once a node has members, creating a new account requires an existing member's authorization. Nodes grow on purpose, not by drift.
• Meeting in person. The meet flow (a kunul1… seed plus QR) connects two nodes face to face over the local network, verified against the key inside the seed. What you scanned is who you get.