Without an authority there is no identity: the service's contract (code/schemas/service.ncl) refuses any bind beyond the loopback, and whoever reaches the loopback is the level's operator, who may write revisions alone (gate.rs, people.rs `may_write`). adr-003 records the consequence: on an offline level only the loopback's operator is anyone. A project that signs out of band — as this one does, with minisign and an offline level — therefore has no way to let anyone read its SOWs from the service: every page is one operator's.
Reading needs no identity. Every stage, validity and signature the service shows is recomputed from the level's files and ontoref's registry on each request (order-never-validity); a signature verifies offline against the level's key. What made the loopback necessary is the operator's write, not the reading.
Measured 2026-10-08 on code/.governance (29 SOWs): each page costs one reading of ontoref's registry, `ontoref form registry-sow --level`, about 5.7 s; the rest of a page is milliseconds. `Registries` (code/crates/specdossier-core/src/registry.rs) reads each level once per request and keeps nothing after it: «a validity ontoref computes is never shown from an earlier one».
The principal chose, 2026-10-08: a read-only mode of specdossierd (rather than only a static rendering of the level); the latency accepted as the service's; a cache of the registry optional and possible.
A SERVICE DECLARED READONLY IS A READER. `readonly = true` in service.ncl makes the router mount the reads and nothing else: the levels, their SOWs, each SOW's reading and view, and an index at `/` listing each level's SOWs where they stand, each linking to its view. No login, no session, no round, no remark, no revision, no intent, no landing: those routes do not exist on a reader, so no request can reach them.
A READER KNOWS NO ONE AND WRITES NOTHING. Its configuration declares no authority, no mirror and no channel; the contract refuses one that does. It holds no table of people and asks no one who they are (identity-is-the-authoritys).
A READER MAY ANSWER BEYOND THE LOOPBACK. Without an authority, the contract accepts a bind beyond the loopback only for a reader. Who reaches it is the network's to decide — a private network, a VPN, a proxy with its own access — not the service's: whoever reaches it reads every SOW of the levels it declares.
A READER MAY HOLD ONTOREF'S REGISTRY READING, IF DECLARED. `registry_ttl` (seconds, optional; absent or 0 means none) lets a reader answer from a registry reading of the same level, for the same day, made less than that long ago, provided no file of the level changed since (a fingerprint of the level's files: names, sizes, modification times). Every page answered from a held reading says when that reading was made. A service that is not a reader holds nothing between requests, as before: an act never relies on a reading older than its request.
WHAT THIS DOES NOT DECIDE: the dossiers of a project (they live outside the level, and the service never reads the project, adr-003); access control, which is the network's; a faster registry, which is ontoref's.
AMENDED 2026-10-08 BY adr-018: a reader may declare an authority, for identity only — login, logout, the person and their marks; it still mounts no act.
A service declared readonly mounts only reads — no login, session, round, remark, revision, intent or landing route — declares no authority, mirror or channel, and is the only service the contract lets answer beyond the loopback without an authority
Only a reader holds ontoref's registry reading between requests, only when registry_ttl is declared, never past that bound nor past a change in the level's files, and every page answered from it says when the reading was made
Only a static rendering of the level (`just viewer`)
Rejected: Kept as a tool, but a snapshot for one day: stages derived for a date go stale until it is rendered again, and nothing is recomputed on request.
Require an authority for any bind beyond the loopback
Rejected: Leaves a project that signs out of band with no shared reading; identity is needed for acts, not to read files that verify offline.
Refuse writes at the gate when readonly, keeping the routes
Rejected: A gate is code that can be wrong; a route that is not mounted cannot be reached.
Cache the registry in every service
Rejected: An act must not rest on a reading older than its request; only a reader, which takes no act, may hold one.