> ## Documentation Index
> Fetch the complete documentation index at: https://docs.presschain.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Protocol Principles

> The engineering rules that keep PressChain applications interoperable and verifiable.

# Protocol principles

PressChain is opinionated about where truth lives and how applications are allowed to represent it. These principles are practical engineering constraints. They exist so a publication written today can still be understood by an independent client later.

## The protocol owns semantics

Roles, action classes, Capsule identifiers, evidence states, fee classes and other shared meanings come from protocol authority. A client can choose how to present them, but it should not redefine them.

For example, the current V3 role table defines Reader, Author, Journalist, Editor and Validator as protocol role IDs `0` through `4`. Enterprise and Administrator are platform roles rather than additional protocol role IDs. A UI that inserts a private role into the numeric protocol sequence would create incompatible data.

## Canonical IDs are stable

V3 uses `bytes32` as the canonical Capsule identifier. Legacy `uint256` Capsule writes are disabled by current authority. Applications should keep Capsule IDs as exact 32-byte values from storage through API serialization and UI routing instead of coercing them into unsafe JavaScript numbers.

```ts theme={null}
export function assertCapsuleId(value: string) {
  if (!/^0x[0-9a-fA-F]{64}$/.test(value)) {
    throw new Error("Expected a canonical bytes32 Capsule ID");
  }
  return value.toLowerCase();
}
```

## Users authorize their own writes

Publishing, evidence, role, voting and other user actions are designed around non-custodial authorization. Application servers should not collect a private key and sign on behalf of a user. PressKey provides the browser-facing provider path for PressChain-native actions.

A backend may prepare calldata, validate metadata, estimate fees or index a result. The signature boundary remains with the user unless a specific protocol mechanism explicitly defines delegated non-custodial authority, such as an approved feed publishing flow.

## Economic actions are explicit

Public state-changing economic actions must map to a known economic requirement: a bond, a fee class, a funded value or an approved premium usage charge. Governance-only configuration is treated separately.

This lets a client answer a useful question before prompting the user: what economic category is this action in, and why? Mainnet numeric amounts can remain pending while the action class and enforcement semantics are already stable.

## Hash what matters

A URI alone is not a provenance commitment. Important artifacts should be paired with a cryptographic hash so consumers can verify that retrieved bytes match the record that was committed.

For Capsule metadata, canonicalization matters just as much as the hash function. Two JSON objects with the same visible fields can produce different byte sequences if normalization and serialization are inconsistent. Use the canonical model implementation where available rather than inventing your own ordering rules.

## Preserve provenance instead of flattening it

A publication can have an author, an outlet, contributors, sources, evidence, revisions and later disputes. Those are different relationships. A client should not flatten all of them into a generic `owner` or `attachment` concept.

That distinction is what makes it possible to build useful downstream products, such as a source map, contributor attribution view, evidence browser or revision timeline.

## Read models are disposable

An indexer is valuable because contract storage is not optimized for every product query. It is not valuable because it creates a second authority.

A robust projection can be rebuilt from known network state and events. Store block height, transaction hash, log index and canonical identifiers with projected records. Make event application idempotent. When a reorganization is detected, roll back affected projections and replay.

## Testnet is not mainnet policy

Current addresses, balances and deployments are testnet facts unless an approved mainnet authority manifest says otherwise. Planned mainnet PRESS supply is defined, but allocation, vesting, treasury routing, validator rewards and final fee amounts remain subject to explicit approval gates.

Documentation and applications should label that distinction clearly. A hard-coded testnet address copied into a mainnet configuration is not a migration plan.

## Security rules outrank convenience

Replay prevention, duplicate controls, role and bond validation, treasury floors, pause mechanisms, rate limits and settlement checks are not optional polish. They are protocol safety boundaries.

The best PressChain application is not the one with the fewest prompts. It is the one that can explain the action a user is about to authorize, preserve the meaning of the resulting state and recover correctly when infrastructure fails.