Admission policy

Publication admission

Sciscape accepts baseline publications under the approved SCI baseline license. SCI protocol §2.1 baseline limits apply; no smaller per-publication limits are imposed. Submitters do not need an authenticated identity.

Each new descriptor undergoes complete bundle checks (SCI protocol §6.4), using that descriptor’s routes and the requested publication ID. Account hints are verified under §6.6; verified associations already known for the signing key are reused.

Searchable catalog

Catalog admission requires a current verified domain association where account.id equals its registrable domain: one label above the public suffix. Only the ICANN section of the Public Suffix List is used; the PRIVATE section is ignored. Redirects during claim retrieval are rejected.

• Without a qualifying association, verified locations are registered for ID lookup and reader access, but the publication does not enter the searchable catalog. The response has status locations_recorded and reason no_qualifying_association. Resubmit after establishing a qualifying association.
• A revoked signing key permits location registration but prevents new catalog admission (SCI protocol §5.3). The response has status locations_recorded and reason revoked_key.

Admission-time association evidence is retained; later claim expiry does not remove catalog entries. accepted_at is set once from the service clock at first catalog admission.

Moderation

Operators may block a publication, key, account, domain pattern, source, source host, or requester. A pattern such as *.example.org matches every subdomain depth, excluding example.org itself.

Blocked publication pages return HTTP 410; source lookup returns no descriptors. Blocked publications are excluded from catalog views, search, citation counts, rankings, totals, and sitemaps. Revocation lookup is not suppressed.

Associations are based on retained verified history. Unsigned hints never create associations or signer blocks. Blocks remain distinct from key revocation: claim expiry, removal, or revocation never clears a block.

Quotas

• Publication submissions: 1 per client IP per second, enforced before verification.
• Reports: 1 per client IP per 10 seconds.
• Verification: 1 concurrent verifier per publication, with a 180-second lock. A busy verifier returns HTTP 429.
• Maximum request body: 1048576 bytes.
• Catalog responses: at most 1,000 rows, with keyset pagination.

Client IPs come from Cloudflare’s CF-Connecting-IP header. Caller-supplied forwarding headers are ignored.

Sources

Descriptors must use HTTPS. Private, loopback, link-local, and metadata-service destinations are refused, including after redirects and DNS rebinding. Service credentials are never sent to external hosts.

Operators may block exact descriptor URLs and source hosts, including wildcard host patterns. Sources known to serve missing or invalid content are omitted from lookup; source loss does not remove catalog entries.

Mirror-failure reports schedule a server recheck. A report alone never disables a location.

Timestamps and trust

Timestamp acquisition runs as a durable job after catalog admission (SCI protocol §6.5). Failures never block or reverse admission.

• Authority: FreeTSA, with a minimum request interval of 1,000 ms. See its usage policy.
• Trust anchor: FreeTSA CA certificate.
• Every retained proof passes SCI protocol §6.8 under this trust policy.
• At most 4 proofs are retained per signature.
• Retries use exponential backoff from 30 seconds, capped at 6 hours, up to 20 attempts.

https://sciscape.io/api/submit/timestamp accepts proofs for admitted publications only.

What Sciscape stores

For every registered publication: ID, signer key, descriptors, check times, policy version, and status. For catalog entries, Sciscape also stores the manifest, signature, sci.json, admission claims, and timestamp proofs.

Sciscape does not store publication bundles, README copies, or other publication files.