# Knomee review runtime Reconciled 15 October 2026. The [Base protocol](https://kno-foundation-dao.web.app/specs/) owns protocol economics and contracts. This document owns the web integration contract. ## Input and interpretation A review requires text, one emoji, or both. Original text and exact reaction are preserved. [Signed reactions](SIGNED_REVIEW_REACTIONS.md) defines bundle v3, draft/approval/request v4, assistant input v4 and public projection v2. Emoji-only reviews have deterministic meaning and make no AI call. Text reviews retain source spans and can mix positive and negative statements. ## Sessions and agreements Firebase authentication persists and renews silently while valid. Ordinary review submission does not impose an age-based sign-in prompt. Revocation, disabled accounts and missing authentication stop protected actions. Operation grants have their own expiry and exact scope; session persistence does not extend them. [Account review agreements](ACCOUNT_REVIEW_AGREEMENTS.md) persists accepted terms for the account. Review Terms and its acceptance control appear only until that account has accepted. Simple mode keeps spending controls and publication details behind the small Spending options icon; Advanced retains its explicit budgets. GoodTakes discovery reads `readNativeRecentReviews` with the pinned current generation. It groups the existing public projection by title key, orders by exact finalized block number, and links to the latest transaction. Only explicitly published records enter this feed. Block hashes and finalized cutoff are rechecked before a short20-second cache. No private drafts, jobs or account journals are read. Unavailable evidence and exceeded scan bounds return503. Bounds are200 subject documents,200 reviews per subject and2,000 total scanned reviews. It never presents a partial scan as latest activity. An indexed replacement is required before these development bounds are exceeded. Historical generations stay outside discovery. ## Simple submission The shared SDK saves an immutable intent before navigation. The owner sees a pending card on the target page immediately. The durable worker interprets, prepares, authorizes, publishes content, sends the transaction, waits for finality and updates the public index. Status changes preserve the same intent identity. Repeated clicks and continuation reconcile the original operation. An uncertain authorization or send is inspected rather than blindly repeated. A private pending card never counts as a confirmed public take. The reader deduplicates the confirmed record against its pending counterpart. Expired Simple Mode authorizations can renew within the same intent and operation only after independent finalized reads prove the old authorization can no longer execute and that the operation is unconsumed. A retained signature is not erased. Renewal preserves the exact approved expression, allocations, owner, subject, deployment, fee ceiling and own same-subject lineage. Current nonce and rank may advance for other intervening activity. Any publication reservation, transaction record or independent sender fence stops automatic renewal. An expired job grant requires one Continue action using the existing valid session. See the [signed-renewal boundary and checks](SIGNED_UNPUBLISHED_RENEWAL.md). ## Advanced controls Simple mode exposes the maximum VIBE spend as an editable decimal amount. Balance snapshots are labeled as available or last verified; retained values are display only and never authorize spending. Invalid, zero or known-over-balance amounts do not start submission. Six decimal places preserve atom-level accounting. Advanced mode exposes semantic meaning, direction, quantities, budget ceilings and optional QUALIA. Simple mode keeps these mechanics out of the ordinary flow. Account validity, exact signed bytes, spending ceilings and fee ceilings apply equally to both modes. Targets require no activation. Both claim kinds remain represented regardless of funding. A disabled or zero QUALIA budget preserves source-linked descriptions with no QUALIA spending; it does not discard them, relabel them as praise or prove them true. Advanced mode may fund eligible claims in one lane or both. Factual-only prose must not gain an invented VIBE endorsement merely to pass submission. Supporting two capacities is a product requirement, not a requirement to spend both on each review. ## Publication and recovery Original emoji and prose are bound by the bundle hash authorized by the existing contract. Public indexes select current formats. Older immutable records are not converted, resent or assigned invented reactions. Use [authorization recovery](REVIEW_AUTHORIZATION_RECOVERY.md) and [the live recovery record](SIMPLE_REVIEW_LIVE_RECOVERY_2026-10-11.md) for diagnosis. Historical receipts retain the generation they actually observed. ## Runtime boundaries Firebase owns account and durable job state; content-addressed publication and chain receipts establish public evidence. AI suggestions never establish truth or spend independently. [Gemini operations](ASSISTED_REVIEW_GEMINI_V1.md) keeps the pinned provider, budget limits and no-paid-fallback boundary explicit. [Current hosting](CURRENT_WEBSITE_CUTOVER.md) describes delivery. Browser or synthetic checks are bounded evidence, not an authenticated participant receipt. ## October 9 feedback reviewed on October 14 - Missing amount control: reproducible in Simple Mode, which hid the budget in Advanced. SDK0.2.25 restores it, with exact validation and balance context. - Provider label: both web shells used the first linked credential. They now display the current token's sign-in provider, including same-account changes. This does not link accounts, grant capacity or prove Apple OAuth succeeds. - Wallet access: connection is implemented, but the current review transport accepts custodial accounts only. The composer now says so rather than silently presenting a connected wallet as a supported publication method. - Balance loading: reuse of same-account finalized reads shipped after the report. Unknown balances remain unknown. Simple mode now exposes refresh and labels a retained snapshot instead of treating it as fresh spending authority. - Emoji versus polarity: the October12 signed-reaction design is current. Mixed praise and criticism remain separate statements. No AI-selected 0–100 rating or sentiment-selected decay is authorized by this feedback repair. - Duplicate reviews and retraction: the protocol deliberately preserves earlier commitments. Later same-subject judgments forfeit earlier upside and retain downside. There is no withdrawal, refund or deletion of a published review. - Decay display: published amounts are original commitments. The public reader now labels this and does not pretend to compute live weight or expired status. A historical/decayed split requires a generation-bound, complete live-weight projection, a selected archive threshold and top-up handling first. No timer or old V6 constant may silently define that state. Remaining identity work belongs to the Base roadmap. Apple provider configuration read returned HTTP403 under the available operator credentials; no configuration was changed. A successful provider login and deliberate credential linking still need their own end-to-end acceptance. Do not infer one human from one social login. Verification: root/VIBE/consumer TypeScript and scoped product lint passed (the existing composer hook warning remains). Four isolated browser paths covered positive/negative takes and retained balances during refresh, exact six-decimal editing, invalid/over-balance rejection and one durable intent. The first harness run failed before rendering because a newer author-profile import needed browser environment substitution; the repaired harness retains that failure boundary. The existing sign-in visual harness could not reconnect its previously running CDP browser. No operator browser or login was changed. Ordinary unit suites were deferred. Broad agent-doc lint retains216 unrelated errors and one warning. The live public balance page verified500 VIBE/1000 QUALIA at a shared finalized block,22.8seconds cold and4.9seconds refresh, without authentication or writes.