Moderation Marker v1

Source schema: doc/schemas/moderation-marker.v1.schema.json

Machine-readable schema for the content body of an Agora record carrying a public moderation marker. The marker is an append-only public signal, not an imperative delete or hide command. The enclosing agora-record.v1 envelope carries identity, authorship, topic routing, optional record/about references, and signature. Local, community, or namespace policy decides how markers affect visibility, reputation, quarantine, or appeal outcomes.

Governing Basis

• doc/project/40-proposals/035-agora-topic-addressed-record-relay.md
• doc/project/60-solutions/008-agora/008-agora-dir-simplify-impl.md

Project Lineage

Requirements

• doc/project/50-requirements/requirements-006-node-networking-mvp.md
• doc/project/50-requirements/requirements-010-middleware-executor.md
• doc/project/50-requirements/requirements-011-dator-arca-contracts.md

Stories

• doc/project/30-stories/story-001-swarm-node-onboarding.md
• doc/project/30-stories/story-004-pod-client-onboarding.md
• doc/project/30-stories/story-005-whisper-rumor-intake.md
• doc/project/30-stories/story-006-buyer-node-components.md
• doc/project/30-stories/story-006-voluntary-swarm-exchange.md
• doc/project/30-stories/story-007-settlement-capable-node.md

Fields

Field	Required	Shape	Description
schema	yes	const: moderation-marker.v1	Content-level discriminator for consumers that inspect the payload outside its Agora envelope.
marker/id	yes	string	Stable marker identifier assigned by the authoring component. It is not the Agora record/id; the latter remains the content address of the enclosing record.
marker/action	yes	enum: flag, flag/support, flag/dispute, flag/clear, recommendation/hide, recommendation/unhide, reputation-signal	Canonical moderation action. flag/* belongs to claim lifecycle, recommendation/* is projection advice, and reputation-signal affects trust/reputation projections. The marker remains a signal, never an imperative command.
marker/reason	yes	enum: content/spam, content/malware, content/sexual, content/non-consensual, content/off-topic, content/low-quality, content/malformed, content/misinformation, content/unsafe, content/copyright, content/other, aim/fraud, aim/harassment, aim/hate, aim/impersonation, aim/privacy-violation, aim/other, protocol/abuse, protocol/malformed, protocol/other, other	Globally canonical v1 reason taxonomy. Unknown reasons are schema-invalid rather than open-world. Local policy may map these reasons to local visibility/reputation decisions.
marker/severity	no	enum: low, medium, high, critical	Optional issuer-local severity hint. Consumers MUST NOT treat it as an automatic hide/delete decision without an explicit policy mapping.
target	yes	ref: #/$defs/target
subject	no	ref: #/$defs/identityRef	Optional actor identity most directly associated with the target, when known. If a user publishes under a nym, moderation should target that nym unless policy explicitly allows escalation.
issuer	yes	ref: #/$defs/issuerRef
policy/ref	yes	string	Explicit moderation policy reference. The special value default means the default moderation policy for the Agora namespace that carries this marker.
proofs	yes	object	Inline verification material. Orbiplex prefers offline-verifiable markers: attestation passports, key delegations, authority-root chains, or quorum proofs should travel with the marker whenever practical.
evidence	no	array	Optional evidence references. For mutable locators such as URLs, the target is the canonical locator identity and observed content belongs here as time-bound evidence.
clears	no	object	Optional detail for flag/clear, naming the marker or reason class being cleared.
note	no	string	Optional short public note. Renderers MUST treat it as untrusted input and escape appropriately.
created/at	yes	ref: #/$defs/rfc3339
expires/at	no	unspecified	Optional marker expiry. Absence and null both mean no declared expiry; local policy may still apply retention or weighting windows.

Definitions

Definition	Shape	Description
reason	enum: content/spam, content/malware, content/sexual, content/non-consensual, content/off-topic, content/low-quality, content/malformed, content/misinformation, content/unsafe, content/copyright, content/other, aim/fraud, aim/harassment, aim/hate, aim/impersonation, aim/privacy-violation, aim/other, protocol/abuse, protocol/malformed, protocol/other, other
rfc3339	string
target	object
identityRef	object
issuerRef	object
proofObject	object
evidenceRef	object

Conditional Rules

Rule 1

When:

{
  "properties": {
    "marker/action": {
      "const": "flag/clear"
    }
  },
  "required": [
    "marker/action"
  ]
}

Then:

{
  "anyOf": [
    {
      "required": [
        "clears"
      ]
    },
    {
      "properties": {
        "target": {
          "properties": {
            "kind": {
              "const": "moderation-marker"
            }
          },
          "required": [
            "kind"
          ]
        }
      }
    }
  ]
}

Rule 2

When:

{
  "properties": {
    "target": {
      "properties": {
        "kind": {
          "const": "url"
        }
      },
      "required": [
        "kind"
      ]
    }
  },
  "required": [
    "target"
  ]
}

Then:

{
  "properties": {
    "target": {
      "required": [
        "url/canonical"
      ]
    }
  }
}

Field Semantics

schema

• Required: yes
• Shape: const: moderation-marker.v1

Content-level discriminator for consumers that inspect the payload outside its Agora envelope.

marker/id

• Required: yes
• Shape: string

Stable marker identifier assigned by the authoring component. It is not the Agora record/id; the latter remains the content address of the enclosing record.

marker/action

• Required: yes
• Shape: enum: flag, flag/support, flag/dispute, flag/clear, recommendation/hide, recommendation/unhide, reputation-signal

Canonical moderation action. flag/* belongs to claim lifecycle, recommendation/* is projection advice, and reputation-signal affects trust/reputation projections. The marker remains a signal, never an imperative command.

marker/reason

• Required: yes
• Shape: enum: content/spam, content/malware, content/sexual, content/non-consensual, content/off-topic, content/low-quality, content/malformed, content/misinformation, content/unsafe, content/copyright, content/other, aim/fraud, aim/harassment, aim/hate, aim/impersonation, aim/privacy-violation, aim/other, protocol/abuse, protocol/malformed, protocol/other, other

Globally canonical v1 reason taxonomy. Unknown reasons are schema-invalid rather than open-world. Local policy may map these reasons to local visibility/reputation decisions.

marker/severity

• Required: no
• Shape: enum: low, medium, high, critical

Optional issuer-local severity hint. Consumers MUST NOT treat it as an automatic hide/delete decision without an explicit policy mapping.

target

• Required: yes
• Shape: ref: #/$defs/target

subject

• Required: no
• Shape: ref: #/$defs/identityRef

Optional actor identity most directly associated with the target, when known. If a user publishes under a nym, moderation should target that nym unless policy explicitly allows escalation.

issuer

• Required: yes
• Shape: ref: #/$defs/issuerRef

policy/ref

• Required: yes
• Shape: string

Explicit moderation policy reference. The special value default means the default moderation policy for the Agora namespace that carries this marker.

proofs

• Required: yes
• Shape: object

Inline verification material. Orbiplex prefers offline-verifiable markers: attestation passports, key delegations, authority-root chains, or quorum proofs should travel with the marker whenever practical.

evidence

• Required: no
• Shape: array

Optional evidence references. For mutable locators such as URLs, the target is the canonical locator identity and observed content belongs here as time-bound evidence.

clears

• Required: no
• Shape: object

Optional detail for flag/clear, naming the marker or reason class being cleared.

note

• Required: no
• Shape: string

Optional short public note. Renderers MUST treat it as untrusted input and escape appropriately.

created/at

• Required: yes
• Shape: ref: #/$defs/rfc3339

expires/at

• Required: no
• Shape: unspecified

Optional marker expiry. Absence and null both mean no declared expiry; local policy may still apply retention or weighting windows.

Definition Semantics

$defs.reason

• Shape: enum: content/spam, content/malware, content/sexual, content/non-consensual, content/off-topic, content/low-quality, content/malformed, content/misinformation, content/unsafe, content/copyright, content/other, aim/fraud, aim/harassment, aim/hate, aim/impersonation, aim/privacy-violation, aim/other, protocol/abuse, protocol/malformed, protocol/other, other

$defs.rfc3339

• Shape: string

$defs.target

• Shape: object

$defs.identityRef

• Shape: object

$defs.issuerRef

• Shape: object

$defs.proofObject

• Shape: object

$defs.evidenceRef

• Shape: object