Batch rights checks and policy revalidation

Live source eligibility and trust boundary

LIVE: Secure Preflight and Gateway accept eligible public HTTPS URLs through a signed, public-network-only relay. The four origins in reviewed coverage are independently reviewed sources, not the dynamic eligibility limit. Stock x402 remains reviewed-origins-only. Robots, access restrictions, per-origin quotas and UNKNOWN outcomes still apply.

Rights Gateway: select the paid operation

LIVE Base USDC pricing: Secure Preflight 0.02 fresh / 0.05 deep per prepared settled report; Ingestion Gate 0.04 + 0.02 per distinct URL fresh or 0.06 + 0.04 per URL deep (1–4 eligible public HTTPS URLs); Revalidation 0.03 fresh / 0.06 deep. Stock x402 stays fresh-only 0.02 and reviewed-only. No new subscription, prepaid, API-key billing or invoicing plan is active.

A Secure Preflight may offer a disclosed paid UNKNOWN or no-declaration diagnostic after meaningful public-source observation. An outage with no usable source observation, invalid URL or exhausted safety budget is not billable Preflight. Gateway pricing covers a bounded observation attempt after verified authorization. UNKNOWN never authorizes content use.

SUPPORTED SECURE MODE: tested official TypeScript/Node x402 2.25.0 and Python x402 2.22.0 with the AcqPath SIWX adapter on /v1/rights/preflight; unchanged signer and random nonce, recommended when payer-signed request binding is required. SUPPORTED STOCK WIRE MODE: the same official stock clients without SIWX, custom nonce, signer or buyer hook on /v1/rights/preflight/x402, fresh only, 0.02 USDC. Stock binds one request atomically at first valid use; it does not sign the POST body in advance. Zero-config compatibility outside this fixed stock endpoint, stock SIWX-only hooks, Payments MCP and generic paid proxies are not supported by this integration.

Machine contract and intended use

POST /v1/rights/ingestion-gate takes resources, purpose, tier, freshness_seconds and max_total_micro. A single URL uses a one-element resources array. ai-input covers model input or summarization; ai-index covers indexing for RAG; ai-train covers training; search covers search. Choose the actual use. Crawl is not a paid RSL purpose or a robots access grant. Canonical URL duplicates count once; at most four entries are accepted.

POST /v1/rights/revalidate takes the same scope with one resource and previous: the signed checkpoint from a delivered gateway resource item. It always reobserves conditionally (freshness_seconds: 0). Resource, purpose, user class, geography and tier must match. A new revalidation is a separately authorized purchase, never a retry of an earlier purchase.

{
  "resources": [
    "https://rslstandard.org/"
  ],
  "purpose": "ai-input",
  "tier": "fresh",
  "freshness_seconds": 300,
  "max_total_micro": "60000"
}

Signed evidence and conservative interpretation

The verified report includes operation ID, SKU, deterministic evaluator profile, observation/evaluation timestamps, cache age, provenance, source hashes, normalized RSL 1.0 signals, conflicts, policy fingerprints, observed license references and signed checkpoints. Legal clearance is always false. IETF AIPREF drafts are not evaluated.

PERMITTED_BY_OBSERVED_DECLARATION is an observation, not legal permission. LICENSE_REQUIRED does not acquire a license. CONFLICT and UNKNOWN remain explicit. Revalidation returns UNCHANGED, CHANGED, DECLARATION_ADDED, DECLARATION_REMOVED, LICENSE_PATH_CHANGED, CONFLICT_CHANGED, SOURCE_UNAVAILABLE or UNKNOWN. Incomplete current or prior evidence never proves removal. A raw policy declaration change can change the fingerprint even when the normalized verdict is unchanged.

Work, freshness and recovery bounds

Secure Ingestion Gate accepts up to four eligible public HTTPS URLs per operation. Fresh allows at most four metadata fetches per resource; deep allows eight; concurrent resource work is capped at two. Dynamic origins use separate limits and a global Railway relay cap, and throughput at 100,000 URLs/month is not certified. No private-network access or unauthorized source bypass.

Cache reuse exposes the original observation timestamp and age. Revalidation uses conditional requests and 304 when supported. Each item is bounded at 12,000 bytes and the gateway report at 52,000 bytes. A failed or oversized source produces UNKNOWN. A durable interrupted execution fails closed without automatic recomputation or settlement.

Use the supplied TS/Python adapter and its private ACL-protected state directory. Files are not application-level encrypted. Keep original operation ID, normalized input and directory on retry. Never log signed artifacts, checkpoint state or private request context. The adapter verifies report, receipt and delivery binding; HTTP 200 alone is insufficient. Preserve pending state across rollback; an older server version may not understand new gateway journal records.