open-standards/wai/extensions/unidirectional-delivery.md

# WAI Extension: Unidirectional Delivery

> Status: Draft. Covers bearers with **no return path** — terrestrial broadcast,
> satellite, and multicast object carriage — where the sink receives and can
> never answer. Generalised from deployed national early-warning systems, which
> are the only place these seams are currently exercised at scale.
> WAI defines no bearer here and none of this requires one.
> Keywords **MUST**, **MUST NOT**, **SHOULD**, **MAY** are RFC 2119/8174.

## 1. What breaks without a return path

Three assumptions in the tree quietly presume the sink can talk back:

- [`jwp-receipts`](jwp-receipts.md) assumes relay-chain linkage throughout, and
  a chain implies hops that report.
- Targeting presumes the source can learn something about the sink.
- Pre-emption — an object that must displace what is playing — has no signer
  class, because nothing in WAI has needed to assert authority over a sink
  before.

None of these is repaired by defining a bearer. Each is a seam that can be
specified transport-independently, and each is specified below at the strength it
actually holds — which in one case is considerably weaker than it looks.

## 2. Sink-evaluated predicates

A **predicate capability** carries, in the object, a condition the **sink**
evaluates against locally-held state the source never learns. The canonical
deployed instance is geographic: an object is relevant to a region, the receiver
holds its own location, and the source is told nothing.

The determinism contract is *predicate-equivalence*, in the shape
[`state-feeds`](state-feeds.md) §3 uses: two conforming sinks holding the same
local state **MUST** reach the same verdict on the same predicate.

- A predicate **MUST** be a total function of the object and the sink's declared
  state class. A predicate that can consult anything else is not evaluable
  twice.
- A predicate **MUST NOT** be able to cause a request. The moment evaluation
  emits a signal, the privacy property is gone and this is ordinary targeting.

**The specifiable property is determinism and auditability, not enforcement.**
Every sink on the bearer receives every byte, and a sink can lie about its own
state. Nothing here prevents that and nothing here should claim to. The real
claim is narrow and worth having: **the source learns nothing** — which is the
dual of source-side targeting, where the source learns everything and the sink is
told nothing.

## 3. Authority and pre-emption

Pre-emption is the highest-authority instruction a media object can carry: it
displaces what a person chose to watch. WAI has no signer class for it, so today
an object either has no such field or has one anyone may set.

- An object asserting pre-emption **MUST** carry a priority field **and** be
  signed by a key the sink holds in a **trust anchor** for that assertion.
- The trust anchor **MUST** be sink-held and provisioned out of band. A trust
  anchor delivered over the bearer it authorises is not a trust anchor.
- A sink **MUST NOT** act on pre-emption from an unanchored key, and **MUST NOT**
  treat a valid signature alone as authority — signature validity establishes who
  signed, never that they were entitled to.
- Authority **MUST NOT** be inferred from position in the delivery chain. The
  entity that transmits is not thereby entitled to interrupt.

## 4. Detached receipts

A unidirectional bearer cannot carry a receipt back, so `jwp-receipts`'
relay-chain model does not apply. The deliverable is an honest profile, not a
proof:

- A publisher **MAY** emit receipts for objects sent over a unidirectional
  bearer, and those receipts attest **what was transmitted**, not what was
  received and not what was rendered.
- Such a receipt **MUST** declare the bearer as unidirectional, so a relying
  party cannot mistake transmission for delivery.
- A sink **MAY** retain object commitments and reconcile them out of band later.
  A reconciliation **MUST** be reported as a `claim` of class
  `binding-recovery`-style provenance, never folded into the publisher's chain
  as though it had been a hop.

**No receipt can prove rendering over a bearer with no return path.** This
section does not attempt it. What it prevents is the quieter error: a receipt
that says "delivered" because the transmitter transmitted, on a link that cannot
tell it whether anyone was listening.

## 5. Framing

These seams are exercised today in national early-warning deployments, which is
where a sink evaluating a condition the source never learns has had to be made to
work at scale. The mechanisms are worth having for that reason and not only that
one: a container that can only describe two-way delivery cannot describe
broadcast, and broadcast is not a legacy case.