# Admission and human presence

**In plain language:** owning a mailbox key proves control of that key. It does not prove that the operator is human, welcome, or entitled to storage. Cursors therefore separates identity proof from admission. The first remote service is invite-only: an offline root signs a short-lived grant naming one mailbox, one curve, exact rights, and small quotas.

The cockpit shows this boundary as **Self / Body → Admission Root → Mailbox Object → SQLite Journal**. Every component remains visibly unconfigured until deployment evidence exists.

## What works in the code now

The disabled Cloudflare Worker accepts a `POST` to:

```text
/api/v1/mailboxes/:id/enroll
```

The request has two independent proofs:

1. a five-minute request envelope signed by the mailbox key, proving control of the addressed mailbox;
2. an admission grant signed by the configured root public key, proving that the mailbox was invited.

The grant binds:

- issuer and subject mailbox fingerprints;
- curve address;
- not-before and expiry times, with a 30-day hard ceiling;
- exact `settings`, `envelopes`, `signaling`, `socket`, or `progenitor-events` rights;
- envelope count, stored bytes, concurrent sockets, signals per minute, and retention.

Changing any field invalidates the Ed25519 signature. Possessing a valid grant still does not confer cursor execution authority; that remains in the separate capability graph.

## “Human” is not a cryptographic type

No CAPTCHA, proof of work, passkey, payment, email, or social login can prove that no bot or AI helped a person. A web challenge can only add evidence and cost. The defensible first policy is:

- no anonymous enrollment;
- root-issued invitations for known people;
- device-local signing keys;
- tiny default quotas;
- explicit renewals and revocation work;
- rate limits before parsing expensive input;
- optional Turnstile or resource challenges as abuse signals, never identity roots;
- no IP address or user-agent copied into the progenitor mailbox.

This raises the cost of fake joins without advertising an impossible guarantee.

## Progenitor notification

On a mailbox's first successful enrollment, the Worker records one minimal `mailbox-admitted` event in the configured progenitor mailbox object. Only an admitted progenitor key with the `progenitor-events` right can read that event.

The event says which mailbox joined, when, and that it arrived through the opt-in Cloudflare service. It deliberately does not collect network fingerprints. A later client may turn the event into an end-to-end encrypted mailbox ping.

## Root and publisher custody

The admission root private key must never be committed, uploaded to Cloudflare, placed in a cursor record, or derived only from a phrase held in memory. A practical ceremony uses an offline key with tested encrypted backups and a written recovery threshold.

Automation receives only a separately signed, short-lived delegate whose rights are narrower than the root: for example, issue at most ten preview admissions for seven days with fixed quotas. Losing a runner then cannot mint a new root or publish an unlimited network.

## Activation sequence

1. Generate and back up the offline root outside this repository.
2. Put only its raw Ed25519 **public** key in `CURSORS_ROOT_PUBLIC_KEY`.
3. Choose and admit a progenitor mailbox; configure only its public mailbox ID.
4. Deploy a preview Worker while `CURSORS_REMOTE_MODE=disabled` and test `/health`.
5. Issue one tiny test grant and enable `explicit-opt-in` only in the preview environment.
6. Exercise expiry, replay, quota, renewal, WebSocket, and isolation failures.
7. Add platform rate limits and optional challenge evidence before a wider invitation set.

See [Cursor identity](cursor-identity.md), [Cloudflare service](cloudflare-service.md), and [Security](security.md).