Feature 13
Hosted steward tier
Optional paid upgrade for stewards who want higher availability — not a paywalled identity product.
Partial M8 code in repo; HOSTED_STEWARD_ENABLED gates production routes
About this feature
Why it matters
The free reference tier caps automatic resolver polling (400 GET/day/device) so the public operator stays honest infrastructure. Stewards who choose hosted get server-mediated live-proof delivery, higher caps, and published SLAs — without scan analytics or purchased trust labels.
Design decisions
Client signs steward_account_link_v1 → POST …/steward/session → hc_steward_session; entitlements probe raises poll caps; SSE live_proof.pending with sw-live-proof.mjs + tab polling fallback. Billing checkout returns ?hc_account_id=acc_… to link account on device. Rollout: hosted:rollout:step1–step6 · verify npm run verify:hosted-g0.
Safety · privacy · security
Free tier unchanged when the flag is off — strangers create, scan, and revoke without accounts. Merch and commerce never grant steward.hosted. Metering counts infrastructure events, not who scanned. OS notifications remain live proof only.
Limits
Production gated: G0 signed (Governance + Ops, 2026-05-27); Legal (G7) pending. Enable HOSTED_STEWARD_ENABLED only after secrets + regression per docs/HOSTED_TIER_G0_READINESS.md. Durable Object push fan-out (E4e) deferred.
Future directions
Federation-ready entitlements per operator_id; org plans; native webhook relay reserved in push RFC.