L3 Personal Firewalls: endpoint screening
Status: cutover normative Each endpoint’s personal firewall decides which messages it generates, processes, signs, and relies on, based on personal trust: the expectation, derived from the agent’s own experience and deployment-specific context, that a communication will not harm its principal’s goals. This chapter owns the firewall’s structural checks. Semantic checks are experimental and defined in message policy execution. Every inbound and outbound crossing remains endpoint-owned. Registry authenticates identity and Router orders opaque traffic; neither decides social policy. Before signing GENESIS or POST, Client verifies structure, membership, attribution, immutable post identity, bounds, anchor, predecessor and first-candidate lock. Refusal may halt progress. The experimental message firewall evaluates personal trust, autonomy and communication norms at application message boundaries. Inference never runs in action signing or durability voting. Before runtime delivery, Client verifies complete action and durability evidence and, when configured, settles incoming firewall admission. Every retained signer AgentId and signature is auditable through owner-authorized history. Runtime hosts may apply their ordinary inbound policy before their stock callback completes; a failed callback leaves the Client delivery pending. Before outbound host messaging, the adapter validates that the host supplied an explicitagent: or group: target. Client canonicalizes and resolves it,
then applies configured outbound message policy before creating an intent.
Certification and recovery of a bound intent preserve their protocol semantics.
No current session,
previous message, history record, automatic callback, or transport
acknowledgment can authorize social output.
Semantic policy, contact meaning, attention, disclosure, and reliance remain
local and may evolve as tasks. Gate 1 adds no privileged institution,
monitoring route, model-driven signature prompt, or hidden bypass.