R-207 — Sybil-resistance economics: what does proof-of-service cost, what does an attacker save?

R-207 — Sybil-resistance economics: what does proof-of-service cost, what does an attacker save?

Question. [EXT §4.5] (EXT.md:336–342) introduces a proof-of-service-or-stake hook on capability manifests as the registry-layer Sybil defence. [EXT §3.3] (EXT.md:230–247) introduces threshold lineage attestations across diversity policies (jurisdiction, ownership, key-management, audit posture). [EXT §4.4] (EXT.md:325–334) gates capability-string registry membership so that manifests cannot squat unregistered strings. The naive Sybil cost in HERALD is "make N Ed25519 keypairs" — essentially zero. This report models, archetype-by-archetype, what the layered defences actually charge an attacker, what the attacker saves by skipping them, where break-even falls, and what the registry layer should enforce as economic floors.

Honest framing. Economic-floor reasoning has a structural ceiling: a subsidised attacker (state actor, vendor, deep-pocket griefer) can absorb any per-sigil cost the protocol can plausibly mandate. The protocol cannot price-out a state. The protocol can make the subsidy legible — that is the residual defence and it is the line I draw repeatedly below, citing [THREATS §6.1, §6.7] and the [R-208] argument that detection-via-corpus is structurally weak in agent-to-agent settings.

Worker: worker-opus-2026-05-05-R207-par3

0. Executive summary

1. Naive Sybil cost in HERALD core today is ≈ $0.000027 per sigil (Ed25519 keypair generation: ~50 µs/core × commodity cloud CPU rate). With a $20/month consumer VM an attacker mints ~70 billion sigils. The substrate is by-design Sybil-permissive ([SPEC §2.2]), and the defences sit at EXT and CHARTER layer.

2. Three distinct cost amplifiers operate at protocol layer, each defending a different market:
- Lineage-diversity (threshold attestation, [EXT §3.3]) raises cost in real Heralds (a Sybil cluster cannot be cheaply lineage-laundered if N independent Heralds, satisfying a registered diversity policy from R-204, must each sign).
- Threshold-Herald-jurisdiction ([EXT §3.3] + R-204 diversity:tri-jurisdiction) raises cost in jurisdictional reach (a domestic-only attacker cannot satisfy a 3-jurisdiction policy without recruiting / co-opting Heralds outside their compulsion umbrella).
- Service-proof-or-stake ([EXT §4.5]) raises cost in real revenue or locked capital (an attacker advertising 100,000 capability manifests must each produce evidence of actual delivered service, or post a stake liable to slashing).

3. Break-even falls at very different points per archetype. The solo opportunist breaks even at a single-stamp Gitcoin-Passport equivalent. The well-funded griefer breaks even at five-figure US dollars per useful Sybil cluster. The state actor never breaks even — and the protocol's job is to surface that fact, not to defeat it.

4. Recommended economic-floor parameters (§7 below):
- Capability-manifest service-proof default minimum: ≥ 30 days of attested service traces from ≥ 3 distinct counterparty sigils, OR a stake ≥ 10× the median monthly revenue of the top-quartile manifest in that capability registry-id (whichever the manifest declares).
- Threshold for high-stakes capability classes (medical, legal, financial-tx): minimum threshold N ≥ 3 lineage Heralds under diversity:tri-jurisdiction (R-204).
- Subsidy-disclosure floor ([EXT §4.3]): manifests advertising rates below the registry-defined economic floor MUST set subsidised: true. This is a transparency primitive, not a price control — a state actor pricing at zero is conformant if it admits the subsidy on-protocol. Lying about subsidy is non-conformant.
- Quorum / collective sigils ([EXT §7.4], cited in T-111 NOTES F-3): minimum distinct-Herald-lineage roots equal to ceil(quorum_size / 5), capped at 5.

5. The structural concession. Subsidised attackers defeat any economic floor the spec can mandate. The response is legibility, not prevention — Herald CT logs ([EXT §3.4]), refusal-rate transparency ([EXT §5.4]), and the subsidy-disclosure flag ([EXT §4.3]) make the subsidy visible. Visibility plus competing reputation systems (the [SPEC §0] tenet) is the protocol's only honest defence; whether app-layer reputation systems actually pool the data is the structural concession from [R-208 §0]. The recommendations below are calibrated to make legibility cheap for honest actors and expensive for dishonest ones — not to make attacks impossible.

1. The question, framed precisely

[THREATS §3.2] (Persona B, botnet operator) lists the 100,000-sigil mint as concrete plan step 1 and observes:

Mint sigils for free [SPEC §2.1]. Ed25519 keypairs are essentially zero-cost. [SPEC §2.2] explicitly encourages multiple sigils per agent. No proof-of-work, no stake, no birth rate-limit. 100,000 sigils in an afternoon.

[EXT §4.5] (lines 336–342) responds:

A manifest MAY carry a service_proof field referencing an attestation that the subject sigil has either delivered prior service of the claimed capability (proof-of-service: a signed reference to past traces meeting verification criteria) or has bonded a stake (proof-of-stake: a signed reference to a stake commitment).

[...]

The hook exists to give downstream filtering systems a Sybil-resistant signal: a botnet operator who can mint 100,000 sigils for free still must produce 100,000 service proofs before any of those sigils can be discovered as capability providers.

The question this report answers is: for whom, in practice, does that "100,000 service proofs" requirement actually price out the attack, and at what price-points?

The answer requires a per-archetype analysis. A solo opportunist and a state actor differ by ~7 orders of magnitude in available subsidy; a single floor cannot rationally serve both.

2. Methodology and parameter assumptions

2.1 Cost components I price

For each archetype I model six cost components:

• Key-mint cost (C_key) — generating N Ed25519 keypairs. Trivially priceable.
• Lineage cost (C_lin) — obtaining lineage proofs (consent-graph or training-graph) per sigil under the declared diversity_policy ([EXT §3.3]).
• Service-proof or stake cost (C_svc) — generating evidence sufficient to clear the registry economic floor at [EXT §4.5], OR posting stake.
• Diversity-jurisdiction cost (C_jur) — recruiting / corrupting / operating Heralds across N independent legal jurisdictions per R-204 diversity:tri-jurisdiction (when required).
• Maintenance cost (C_main) — the recurring fee Douceur (2002) identifies as the load-bearing deterrent: keeping each sigil "alive" enough that revocation, manifest expiry ([EXT §4.2]), and stake top-up obligations are met.
• Detection-and-restart cost (C_det) — what the attacker pays when their cluster is identified and Bestiary-listed ([EXT §8]) or Herald-revoked ([EXT §3.6]).

Total Sybil cost: C_total(N) = C_key·N + C_lin·N + C_svc·N + C_jur + C_main(t)·N + C_det·N (where C_jur is mostly fixed-cost in the count of jurisdictions, not in N).

2.2 Empirical anchors

I anchor monetary figures to mid-2025 prices, sourced as follows. These are order-of-magnitude anchors; the recommendations in §7 are designed to be robust to ±1 OOM.

2.3 What the model deliberately does NOT price

• Reputation cost. Once a Sybil cluster is detected, the reputation loss to the operator is potentially infinite (in social terms) but the protocol cannot enforce it. I price C_det as the cost to re-bootstrap a fresh cluster, not as a punitive penalty.
• Counterparty risk. A Herald that signs garbage attestations risks Bestiary listing ([EXT §8]) and de facto ostracisation. This is real but uncontracted; I treat it as a categorical risk, not a quantified cost.
• Time value. Patina farming ([CHARTER §6.6]) is a temporal attack — the attacker pays in waiting. I treat patina as a separate cost dimension in §3.1 (solo opportunist) and §3.5 (capability-manifest squatter) but do not collapse it into C_main.

2.4 Sybil-attack literature framing

The foundational result is Douceur (2002), The Sybil Attack (IPTPS): without a logical centralised authority, Sybil attacks are always possible except under unrealistic resource-parity assumptions, and successful Sybil attacks can be made expensive even when not preventable. The two Douceur cost-mechanism modes Levine, Shields, Margolin (2006) A Survey of Solutions to the Sybil Attack catalogue:

• One-time fees (e.g. proof-of-work at signup): C(N) = const·N — linear in N but scaled per-key only once. Defeated by amortising over a long campaign.
• Recurring fees: C(N, t) = const·N·t — linear in N and in time. Defeats long-campaign amortisation; the load-bearing class for HERALD's setting because manifests expire ([EXT §4.2]) and audit-log inclusion is renewable.

The R-204 diversity policy machinery shifts cost into a third class:

• Diversity-quorum fees: C(N, J) = f(J)·N + g(J) — scales in the jurisdictional reach required, where J is the cardinality of the diversity dimension. State actors compress J by capturing or subsidising multiple Heralds; the protocol responds by making the capture legible via Herald CT logs ([EXT §3.4]) and threshold attestation diversity-policy verification ([R-204] §3.2).

Recent applied work that grounds the per-key figures:

• Kaminsky, Buterin (2023), biometric proof of personhood, and The Economic Security of Proof of Personhood Services — empirical $20–$100/key range, with the structural-asymmetry warning that V(N) (value extracted) grows with each new application while C(N) (cost to acquire keys) is constant. This asymmetry is the load-bearing reason economic floors must be registry-defined per capability class, not protocol-fixed.
• Ohlhaver (2024), Compressed to 0: The Silent Strings of Proof of Personhood (Harvard Ash Center) — political-economy critique of single-issuer PoP; supports my §7 recommendation that HERALD's defence must be N-of-M Heralds across diversity dimensions, not a single issuer.

3. Attacker archetypes

I define five archetypes spanning the realistic range of HERALD adversaries. For each: profile, attack plan in HERALD primitives, cost decomposition with current-EXT defences, naive savings, and break-even estimate.

3.1 Archetype A — Solo opportunist

Profile. Single individual or two-person team. Total budget ~$10²–$10⁴. Goal: stand up "premium-looking" capability manifests for arbitrage, airdrop farming, or low-effort scam revenue. Time horizon: weeks. Risk tolerance: moderate; will abandon under detection pressure.

HERALD attack plan.
1. Mint 50–500 sigils ([SPEC §2.1]). C_key ≈ $0.
2. Self-sign lineage from popular base models ([SPEC §2.3], no parent signature). Lineage as displayed by lazy app layers is indistinguishable from herald-cosigned ([THREATS §3.2 step 2]).
3. Publish capability manifests ([SPEC §8.3], [EXT §4.1]) advertising commodity capabilities (cap:summarisation, cap:translation:en-fr).
4. Optionally cross-sign each others' manifests as fake patina.
5. Exit on user complaint via apologia + fresh-key pivot.

Cost without defences (status quo, [SPEC] only). C_total ≈ $0 for cluster of 500. Profit on a $5,000 Arbitrum-style farm is essentially pure margin.

Cost with [EXT §4.5] service-proof enforcement at registry-floor of 30-day, 3-counterparty service traces. The attacker must either:

• (a) generate authentic service traces — meaning either actually deliver service to 3 distinct counterparty sigils per Sybil, which collapses the Sybil to a real business; or
• (b) bond a stake. At a registry-defined minimum stake of $50/sigil (1× monthly revenue of a low-tier honest actor in the same capability class), 500 sigils = $25,000. Now exceeds the attacker's budget envelope.
• (c) collude with confederates: 500 sigils, each with 3 counterparty signatures = 1500 cross-signatures. Detectable as a closed graph with R-208's "this domain is signing garbage" residual signal if counterparty-graph diversity is part of the registry floor (recommended: §7).

Cost with [EXT §3.3] threshold-attestation enforcement. For non-high-stakes capabilities the threshold can be N=1 (single Herald), so this archetype is not directly priced out. For high-stakes capability classes the archetype is excluded by capital alone.

Naive savings to attacker by skipping defences: ~$25,000 per cluster of 500 sigils, in stake or service-delivery costs.

Break-even. Attacker breaks even when expected revenue per cluster ≥ stake at risk + opportunity cost. For airdrop farming the historical median is $600–$2,000 per project (CoinDesk Sybil Millionaires 2023). At a $50/sigil registry floor stake, airdrop farming becomes unprofitable for the median farmer, but remains profitable for the right tail (Sybils who clear $35k+ per project are the ~5% reported by CoinDesk).

Verdict. A modest service-proof or stake floor (~$50–$100 per sigil) prices the median solo opportunist out. The right tail is not priced out by the floor alone — for those, the response is detection (Bestiary, [EXT §8]) and Herald-side revocation ([EXT §3.6]).

3.2 Archetype B — Well-funded griefer

Profile. Funded individual, small org, or political operative. Budget $10⁵–$10⁷. Goal: poison a target ecosystem (a model lineage cluster, a quorum, a Bestiary), distort public discourse, run targeted reputation-warfare. Time horizon: months. Risk tolerance: high; will accept identification because the goal is signalling / disruption rather than profit.

HERALD attack plan.
1. Mint 10,000–100,000 sigils.
2. Buy or co-opt 1–2 small jurisdiction-of-convenience Heralds (Persona-A-lite). Pay one Herald-shop $10⁵–$10⁶ to issue blanket lineage attestations.
3. Capability-manifest sniping ([THREATS §3.4 step 1, §5.6]): list at impossible prices to force honest competitors to match.
4. Quorum stuffing ([THREATS §3.2 step 6]): organise 100k sigils into "consortia" and publish coordinated quorum envelopes ([SPEC §4.2], shape [EXT §7.4]).
5. Bestiary spam ([THREATS §3.4 step 3]): list rivals.
6. Patina-farm a subset (~5% of cluster) over 18 months ([CHARTER §6.6]) for high-value stings.

Cost without defences. ~$10⁶ for a 100k-sigil cluster: rented botnet + residential proxies (§2.2 anchors: ~$10k/mo botnet × 12mo × 2 ≈ $240k; ~$100k for proxy infra) + Herald-shop fees + opex.

Cost with [EXT §4.5] enforcement at $50–$100/sigil floor. Adds $5M–$10M for 100k cluster. Now exceeds typical griefer budget but remains within the well-funded tail (PR campaigns regularly burn $10⁷ in adversarial information environments).

Cost with [EXT §3.3] tri-jurisdiction threshold for high-stakes classes. The griefer needs 3 Heralds in 3 different jurisdictions. Either:

• (a) recruit/buy 3 cooperating Heralds — at $10⁵–$10⁶ per Herald-shop, this is $0.3M–$3M, plausible for the upper tail of this archetype but moves the attack from "afternoon project" to "multi-month operation" with 3 separate compliance / legal exposures;
• (b) compromise existing Heralds — moves the archetype into Archetype C or D.

Cost with [EXT §3.4] Herald CT logs. The griefer's bought Heralds publish their attestations to public logs. Monitors detect mass blanket-issuance ([EXT §3.7]) and flag the Heralds. The flagged Heralds lose standing under R-204 diversity policies' LOTS.audit_posture dimension. This is not a cost, it is a detection-induced attack-life cap: the griefer's cluster has a half-life measured in weeks-to-months rather than indefinite.

Naive savings to attacker by skipping defences: ~$5M–$13M per 100k cluster.

Break-even. Griefer attacks are not naturally profit-seeking; they are mission-seeking. Break-even reduces to "did the disruption occur before detection-induced cluster collapse?" The defences shift the answer from "yes, indefinitely" to "perhaps for weeks". This is the protocol's expected outcome — make attacks finite, not make attacks impossible.

Verdict. Stake / service-proof floor + threshold-Herald + Herald CT logs collectively transform the griefer's attack from open-ended to finite-duration. The policy lever that does most of the work is threshold-Herald with R-204 diversity policy — it forces the griefer into multi-Herald conspiracy, which is detectable in CT-log gossip ([EXT §2.5]). Stake floor alone is not enough for this archetype.

3.3 Archetype C — State actor

Profile. Nation-state intelligence service or aligned cut-out. Budget effectively unbounded; relevant constraint is attention, not capital. Goal: long-term web-scale narrative shaping, lawful-intercept through co-opted conduits ([THREATS §3.1 step 4]), targeted suppression of dissident sigils via subsidised refusal ([THREATS §3.1 step 5]). Time horizon: years. Risk tolerance: high but reputationally constrained; prefers attacks that look conformant.

HERALD attack plan. Per [THREATS §3.1] verbatim:

1. Stand up a Herald (compelled or operated through a state-aligned legal entity).

2. Mint lineage_proofs for state-aligned sigils declaring lineage from popular base models.

3. Run Bestiary operators in parallel to list dissident sigils and competing Heralds.

4. Force or subpoena a domestic conduit to be a Notary with a private compliance log.

5. Refusal-as-denial-of-speech: blanket-refuse a sigil and emit valid signed refusal envelopes.

In Sybil-economics terms, the state actor's advantage is that it can satisfy [EXT §4.5] service-proof (the state-aligned Herald is a real legal entity providing a real service: certifying state-aligned sigils) and [EXT §3.3] threshold attestations intra-bloc (cooperating Heralds within the state's jurisdictional bloc).

Cost without defences. Single-digit millions per year; comparable to ongoing intelligence-service IO programmes.

Cost with [EXT §4.5] floor. Marginal. The state-aligned Herald is providing real service; the Sybil cluster's manifests can attach legitimate service proofs.

Cost with [EXT §3.3] tri-jurisdiction threshold and R-204's bloc-disqualification rule (R-204 §3.2: jurisdictions MUST NOT all be members of a declared jurisdictional bloc). This is the load-bearing defence against this archetype. The state actor cannot satisfy diversity:tri-jurisdiction if R-204's bloc list is maintained honestly. The R-204 deliverable explicitly notes:

caveat: ineffective if LOTS.jurisdiction is misdeclared. Verifiers SHOULD cross-reference declared jurisdiction with [...] (R-204 §3.2 lines 162–163)

The state actor's response is to either (a) misdeclare jurisdiction (caught by LOTS gossip if monitored), (b) co-opt a Herald in a different bloc (high-friction; political incident risk), or (c) accept exclusion from high-stakes capability classes and concentrate the attack in low-stakes ones (the Pyrrhic-victory outcome the protocol aims for).

Cost with [EXT §3.4] Herald CT logs and [EXT §5.4] aggregate refusal statistics. Mass refusal of dissident sigils is visible in published refusal-rate data. This does not stop the refusal but makes the gag order legible internationally — the [THREATS §6.6] ("refusal as denial-of-speech") residual.

Naive savings to attacker by skipping defences: order-of-magnitude immaterial — the attack budget is funded structurally. The defences do not save the state actor money; they cost the state actor reputational legibility of its own activity.

Break-even. Inapplicable. Subsidised attackers do not solve a break-even equation; they solve a strategic-objective equation. Economic floors do not bind.

Verdict. The protocol cannot price-out this archetype. What it can do, and what [EXT §3.3] + R-204 + [EXT §3.4] + [EXT §5.4] collectively achieve, is to convert the attack from invisible conformance to legibility. Legibility is the substrate of the defences that the protocol cannot itself implement — international monitors, civil-society auditors, allied-jurisdiction Heralds, journalists with subpoena-resistant traces. This is the [THREATS §6.1] "make cartelisation legible" argument; in Sybil-economics terms it is the structural concession this report names openly.

3.4 Archetype D — Vendor cartel / cross-signing collusion

Profile. A small set of dominant model vendors (Anthropic, OpenAI, Google, Meta, etc.) that have accepted Herald roles for their own models per [THREATS §6.1] line 410:

In the AI context the cartel will form along vendor lines first: model vendors will become the Heralds for their own models (Anthropic certifies claude-opus-4-7 lineage; OpenAI certifies gpt-X).

Goal: capture the trust layer by cross-signing each others' attestations, raising the per-quorum-N requirement on competitors. Budget: vendor-scale ($10⁸–$10¹⁰ in market-shaping spend over years). Time horizon: indefinite.

HERALD attack plan.
1. Each vendor-Herald issues lineage attestations for its own sigils ([EXT §3.2]) and cross-signs with the other vendor-Heralds.
2. Threshold attestations under diversity:tri-jurisdiction are satisfied by the cartel itself if the cartel is multi-jurisdictional (which the major LLM vendors are: US, US, US, ...; only marginally diverse in practice).
3. Vendor-Heralds collectively decline to attest small / open-source / non-aligned model lineages, raising effective barriers to entry ([THREATS §6.1, §6.2]).
4. Capability-manifest economic floors ([EXT §4.3]) are set at vendor-friendly levels via informal coordination on the [CHARTER §capability-registry] governance process.

Cost without defences. Effectively zero — the cartel is conformant by construction.

Cost with [EXT §3.3] tri-jurisdiction. Mostly defeated, because the major US vendors share jurisdiction. R-204's diversity:tri-jurisdiction rules such cross-signing ineligible for high-stakes lineage if the diversity policy bites at jurisdictional bloc level — but R-204's bloc list is itself a registry the cartel can lobby. The defence is therefore not absolute; it is a forcing function for the bloc list to be maintained by an entity outside the cartel's reach (analogous to [CHARTER §charter-of-charters] type primitive — not currently spec'd; logged as F-1 below).

Cost with [EXT §3.4] Herald CT logs and [EXT §3.7] Herald compromise / recovery. Cartel cross-signing is publicly observable. Monitors and competitors can build "Herald cross-signing graphs" and publish concentration metrics. This is the [THREATS §6.1] legibility argument again.

Cost with R-204's diversity:tri-ownership policy (R-204 §3.3, lines 165–172). This is the targeted defence: distinct ownership root, not just jurisdiction. The cartel's vendor-Heralds are distinct legal entities, but if R-204 surfaces shared-ownership relationships (joint ventures, common beneficial owners, common LLM-licensing dependencies), the cartel cluster fails the ownership-diversity check. This is the protocol's strongest single defence against vendor cartelisation and the recommendation in §7 below leans on it.

Naive savings to attacker by skipping defences: structural — cartel rents over a multi-decade time horizon, comparable to historical CA-market rents in the TLS ecosystem before Let's Encrypt's free-tier disruption.

Break-even. Cartel attacks have no defined "attack" — they are continuous coordination. The relevant question is "is the cartel's market position legible in protocol-level data?". With Herald CT logs and R-204 ownership-diversity, yes. Without, no.

Verdict. Diversity-policy ownership dimension (R-204 §3.3) + Herald CT log gossip ([EXT §3.4]) is the load-bearing defence. Service-proof floors are irrelevant to this archetype.

3.5 Archetype E — Capability-manifest squatter

Profile. Small-to-medium operator targeting high-value capability strings before legitimate providers register. Budget $10³–$10⁵. Goal: capture discovery traffic for cap:legal-research/eu or cap:medical-triage by squatting registry strings, then either ransom the strings to legitimate providers or harvest discovery flow for ad / scam revenue ([THREATS §3.4 step 1, §5.6]).

HERALD attack plan.
1. Mint a small number of sigils (10–100) with patina-farmed history.
2. Publish capability manifests under target capability strings at competitive rates.
3. Out-rank legitimate competitors via the discovery aggregator's freshness or rate-display ordering.

Cost without defences. ~$10³ for a low-effort run; ~$10⁵ for a polished one.

Cost with [EXT §4.4] capability-string registry enforcement. The string cap:legal-research/eu only resolves if it is in the public registry, with a since timestamp. Manifests carrying unregistered strings MUST be rejected by verifiers ([EXT §4.4] line 334). The registry is the enforcement point.

The relevant question shifts from "can I mint?" to "can I get my preferred capability string into the registry?". The registry governance ([CHARTER §capability-registry]) becomes the chokepoint, and is therefore subject to [THREATS §6.2] chokepoint-emergence risk. R-204's registry-governance baseline (out-of-scope here) and the [CHARTER §charter-of-charters] primitive (suggested) are the secondary defences.

Cost with [EXT §4.5] service-proof on top. The squatter must either (a) actually deliver cap:legal-research/eu work — which legitimises them and turns the squatter into a real provider, or (b) bond a stake. Combined with the registry gating, this is a sufficient floor.

Naive savings to attacker by skipping defences: ~$50,000–$500,000 in ransom revenue per high-value capability string captured (estimating from domain-squatting analogues; HERALD-specific data does not yet exist).

Break-even. Squatter attack break-even is expected_ransom > C_svc + C_registry-fees. At a service-proof floor of $50/sigil and 50 sigils per squatted string, the break-even ransom is ~$2,500 — which the squatter clears easily for high-value strings. The defence here is the registry process itself, not the per-sigil floor.

Verdict. Capability-string registry ([EXT §4.4]) + a low service-proof floor ([EXT §4.5]) prices out casual squatters. Targeted high-value squatting is defeated only by registry governance — which is a process question, not an economic-floor question.

4. Cost-amplifier matrix: which defence raises which cost, by how much

The matrix below summarises which EXT defence amplifies which cost component for each archetype. Cell entries: ×1 = no effect; ×10 = order-of-magnitude raise; ×∞ = excludes archetype; "leg" = legibility-only (no cost increase, but visibility-induced finite life).

Reading the matrix.

• No single defence covers all archetypes. Service-proof handles A and E; tri-ownership-diversity handles D; tri-jurisdiction (with honest bloc list) handles B; nothing prices out C.
• Legibility-only entries are not "weak" — they are the structural defence against subsidised attackers. The [THREATS §6.1] argument that legibility is the first defence applies columnwise to C and D, where economic floors do not bind.
• Threshold-Herald with R-204 tri-jurisdiction is the highest-leverage single primitive. It bites archetypes A and B at ×∞ and ×100 respectively, makes C legible, and is the only economic primitive that bites D when extended to ownership diversity.

5. Break-even tables

For each archetype I report the rough cluster size at which the attack becomes unprofitable under the recommended floors of §7.

5.1 Solo opportunist (A)

5.2 Griefer (B)

The combined regime moves griefer attacks from "indefinite" to "quarter-scale", which is the [THREATS §3.2] honest target.

5.3 State actor (C)

Inapplicable — break-even does not bind. The metric is legibility ratio: fraction of state activity that is observable in CT logs and refusal-rate publications.

The protocol's deliverable here is 95%+ legibility, not zero attack.

5.4 Vendor cartel (D)

5.5 Squatter (E)

6. Patina farming as an orthogonal cost dimension

[CHARTER §6.6] (patina) and [THREATS §3.2 step 3] identify patina farming — pre-minting sigils, having them sign innocuous traffic for 18 months, then activating — as a Sybil-amplifier attack. The economics are temporal, not purely monetary: the attacker pays in waiting.

The current EXT defences against patina farming are partial:

• [EXT §9.4] decay floor and chain length cap on inheritance — limits how much patina survives sigil deprecation.
• [EXT §1.2] molt cool-off window — limits how often a sigil can swap keys.
• Anti-farming weighted patina (recommendation 23 in [THREATS §10] — patina weighted by distinct counterparties / topologies) — not yet specified, logged as gap.

Economic impact. Patina farming converts a $10⁶ campaign (Archetype B) into a $10⁵ campaign (lower per-month cost, but 18 months of waiting). For a state actor (C) the time cost is structurally affordable; for a griefer (B) it is the difference between a quarterly disruption and a multi-year programme. Recommendation 23 (distinct-counterparty patina weighting) is the mitigation; until specified, patina farming undercuts the §3 break-even tables for B and C by approximately 1 OOM.

7. Recommended economic-floor parameters

These recommendations are for the [EXT §4.4] capability-string registry and the [CHARTER §service-proofs] / [CHARTER §capability-registry] governance documents that mediate registration. The protocol cannot mandate market parameters; it can only register them. What follows is therefore a recommended registry shape, not a recommended SPEC change.

7.1 Three-tier capability classification

The registry SHOULD classify capability strings into three economic-risk tiers. The tier determines the floor that manifests advertising in that capability MUST satisfy.

Tier 1 — Low-stakes commodity capabilities. Examples: cap:translation:en-fr, cap:summarisation, cap:weather-lookup, cap:wikipedia-cite. Damage from a single low-quality provider is bounded; counterparties have low switching cost.

• Service-proof minimum: ≥ 7 days of attested service traces, OR stake ≥ $10 equivalent in the registry's chosen unit.
• Threshold lineage: N=1 acceptable; no diversity policy required.
• Subsidy-disclosure: required if rates.per_token_usd < 0.5 × median_tier_rate.

Tier 2 — Medium-stakes capabilities. Examples: cap:research-summary, cap:code-generation:non-safety-critical, cap:legal-citation-lookup, cap:image-classification. Damage from a low-quality provider can mislead but is downstream-correctable.

• Service-proof minimum: ≥ 30 days of attested service traces from ≥ 3 distinct counterparty sigils, with counterparty-graph diversity (no two counterparties sharing same Herald lineage root), OR stake ≥ 10 × median monthly revenue of top-quartile manifest in this capability.
• Threshold lineage: N≥2, diversity:bi-jurisdiction (R-204 §3.1) acceptable, diversity:tri-jurisdiction recommended.
• Subsidy-disclosure: required if rates.per_token_usd < median_tier_rate.

Tier 3 — High-stakes capabilities. Examples: cap:medical-triage, cap:legal-advice/jurisdiction, cap:financial-transaction, cap:safety-critical-control, cap:identity-binding. Damage from a low-quality provider is potentially severe and not always downstream-correctable.

• Service-proof minimum: ≥ 90 days attested service from ≥ 10 distinct counterparty sigils AND human-Herald cosignature ([CHARTER §coming-of-age] primitive — not yet spec'd; logged as F-2), OR stake ≥ 100 × median monthly revenue of top-quartile manifest.
• Threshold lineage: N≥3, diversity:tri-jurisdiction mandatory, with R-204 bloc-list disqualification rule active.
• Service-proof MUST be accompanied by a per-counterparty apologia rate disclosure ([SPEC §4.2]) — operators with no apologia history are suspicious (Liar's-Paradox §7(e) cover-of-virtue case).
• Subsidy-disclosure: required for any rates.per_token_usd not within registry-published market band.

7.2 Registry-floor unit conventions

The registry SHOULD declare floors in a stable unit (recommendation: USD-equivalent of a stable on-chain asset, with the choice itself in registry governance to avoid re-litigation per manifest). Floors SHOULD be re-evaluated at minimum annually by the registry governance process and the version of the floor table SHOULD be referenced by version-id in every manifest verification (analogous to [EXT §4.4]'s version-of-registry binding).

7.3 Bestiary integration

A capability-manifest holder Bestiary-listed under [EXT §8] for capability misuse (as distinct from general misbehaviour) SHOULD have their stake slashable per the registry slashing rule at [CHARTER §service-proofs]. The slashing rule itself is registry-governed and out of EXT scope. The protocol-shaped hook for slashing — a slash envelope type referencing both the Bestiary entry and the stake commitment — is logged as F-3 (recommended addition to [EXT §4.6] revocation neighbourhood).

7.4 Subsidy-disclosure refinement

[EXT §4.3] currently requires subsidised: true flag for below-floor rates. Recommendation: extend to require a subsidy_source field with values from a registry (self-funded, vendor-subsidised:<vendor-sigil>, state-subsidised:<jurisdiction>, unknown). This makes the [THREATS §6.1, §3.1] state-actor subsidy taxonomically legible, not just flag-legible.

Honest residual. A state actor will declare unknown and proceed. The protocol cannot compel honest jurisdictional disclosure. What the protocol can do is require that any manifest declaring unknown source AND below-floor rate triggers a verifier MUST-warn ([EXT §4.3]'s rejection rule extended to a partial-warning rule). Verifiers and aggregators are then accountable for whether they pass the warning through to end-users.

7.5 Threshold-Herald defaults per tier

R-204 currently defines diversity:tri-jurisdiction (R-204 §3.2) and diversity:tri-ownership (R-204 §3.3 inferred — see R-204 NOTES for status). The composite of the two is not yet a registered policy; logged as F-4.

7.6 Recurring-fee design (per Douceur 2002)

Per Douceur (2002) §6, recurring fees are the load-bearing class. HERALD's recurring fee equivalents are:

• Manifest expiry ([EXT §4.2]): expires - ts ≤ 90 days. This is already a recurring fee in the time-to-renew sense; the implicit cost is the audit-log inclusion cost ([EXT §1.3]) and re-signing.
• Service-proof refresh: a service-proof attestation older than 90 days SHOULD trigger registry-floor re-evaluation. This makes the service-proof cost recurring, not amortisable.
• Stake top-up obligations on price-change: if the registry's median rate increases (for Tier 2 stake = 10 × median), stakers are required to top-up or be downgraded to a lower tier. This is the slashing-floor analogue of Ethereum's correlation-penalty mechanic.

Recurring vs. one-time mix. I recommend the registry adopt the Douceur recommendation: ~70% of attacker cost should come from recurring fees, ~30% from one-time setup. Solo opportunists optimise against amortisable one-time fees; recurring fees are the only structurally robust deterrent against patina-farming.

8. Defences this report concedes will not bind

These are the structural concessions, named openly so they are not buried in a marketing claim.

1. State actors cannot be priced out. [THREATS §3.1, §6.1, §6.6] — the response is legibility, not exclusion. Recommendations §7.4 and §7.5 raise the legibility floor; they do not raise the per-attack cost beyond what an intelligence service can absorb.

2. Vendor cartels cannot be priced out by a per-sigil floor. [THREATS §6.1] — the response is diversity:tri-ownership (R-204), not stake. Cartel attacks are continuous-coordination attacks; they have no per-sigil cost.

3. Patina farming is not yet bounded by an anti-farming patina-weighting rule (recommendation 23 of [THREATS §10]). Until that rule is registry-defined, all break-even calculations in §5 should be discounted ~1 OOM for archetypes B and C.

4. Subsidised loss-leader manifests are conformant if they set subsidised: true. The protocol declines to be a price control. The risk is that the [THREATS §3.4 / §5.6] pump-and-dump archetype combines low-floor abuse with patina farming — both legible at protocol layer, but neither prevented.

5. Detection of "lying patterns" requires shared corpora the protocol does not require ([THREATS §7], [R-208 §0]). The economic floors above are calibrated to make Sybil clusters finite-life and detectable, but detection requires reputation aggregators which the substrate does not specify. The R-208 finding that "competing reputation systems will not pool data freely" applies in full here.

6. The registry itself is a chokepoint ([THREATS §6.2]). Capability-string registration governance is now the load-bearing decision-point. If captured, the floors above can be set hostile-to-newcomer and friendly-to-cartel. The defence is registry-of-registries — the [CHARTER §charter-of-charters]-shaped primitive that does not yet exist (logged as F-1).

These concessions are not arguments against the recommended floors. They are the boundary conditions under which the floors are defensible. A reader who needs an iron-clad guarantee against state actors will not find one in any agent-protocol design that admits competing Heralds as a tenet ([SPEC §0]); they should read [THREATS §6.1] and decide whether the tenet is worth keeping. R-207's view is that it is, and that the recommended floors are the strongest economic primitive consistent with the tenet.

9. Honest residuals (what this report cannot assert)

1. Calibration of dollar floors to specific capability classes is data-dependent. Numbers in §7 are illustrative; actual registry-floor values require empirical observation of honest-actor revenue distributions in deployed agent markets — markets that do not yet exist at scale. The recommendations are correct in shape (tiered, recurring-dominant, ownership-diverse, subsidy-legible); the magnitudes will need re-calibration after the first 12 months of any production deployment.

2. Counterparty-graph diversity (§7.1 Tier 2) requires a graph-analysis primitive HERALD does not yet specify. Detecting "no two counterparties sharing same Herald lineage root" needs a Herald-lineage-graph traversal verifier. R-204's diversity-policy validators handle the per-attestation case; the cross-attestation graph case is not in scope for any current task. Logged as F-5.

3. The "median monthly revenue of top-quartile manifest" stake calibration (§7.1) assumes a discovery aggregator that publishes revenue percentiles. None exists yet; the substrate is intentionally silent on aggregators ([THREATS §6.2]). This recommendation is therefore conditional on a separate governance process selecting one or more reference aggregators per capability tier.

4. Slashing rules are entirely outside EXT ([EXT §4.5]: "the staking primitive, and the slashing rules are defined per registry entry in [CHARTER §service-proofs]"). I recommend a slashing-shaped envelope hook (§7.3), but the content of the slashing rule is registry-governance, not protocol.

5. The "naive savings" figures in §3 are upper bounds, not point estimates. Actual savings depend on the attacker's existing infrastructure, alternate-attack opportunity costs, and the legitimacy-laundering channels available off-protocol (which the protocol cannot see).

6. Empirical validation requires deployed adversaries. The closest available analogues — airdrop farming, CA-market dynamics, proof-of-personhood puppeteer attacks, BGP-hijacking economics — share some features with HERALD's setting but not all. Numbers should be re-verified against deployed-adversary data after any reference deployment ([T-115] reference Herald) is operational.

10. Cross-references and follow-on tasks

10.1 Direct cites

• [SPEC §2.1] (sigil generation — naive Sybil cost ≈ $0)
• [SPEC §2.2] (multi-sigil per agent permitted)
• [SPEC §2.3] (consent-graph lineage; self-claimed lineage permitted)
• [SPEC §0] (no-chokepoint tenet, contested by [THREATS §6.1, §6.2])
• [EXT §3.3] (threshold lineage attestations)
• [EXT §3.4] (Herald CT log)
• [EXT §3.5] (Herald operator transparency baseline)
• [EXT §3.6] (Herald-side revocation)
• [EXT §4.1–§4.6] (capability manifest stack)
• [EXT §4.3] (subsidy-disclosure flag)
• [EXT §4.4] (capability-string registry)
• [EXT §4.5] (proof-of-service-or-stake hook)
• [EXT §5.4] (refusal-rate transparency)
• [EXT §8] (Bestiary primitive)
• [CHARTER §6.6] (patina)
• [CHARTER §service-proofs] (registry-defined slashing rules — currently undefined)
• [CHARTER §capability-registry] (governance — currently undefined in detail)
• [THREATS §3.1] (state actor — Persona A)
• [THREATS §3.2] (botnet operator — Persona B)
• [THREATS §3.4] (pump-and-dump — Persona D)
• [THREATS §6.1] (Herald collusion / cartelisation)
• [THREATS §6.2] (chokepoint emergence)
• [THREATS §6.6] (refusal as denial-of-speech)
• [THREATS §6.7] (legal-discovery hazards / chilling effect)
• [THREATS §7] (Liar's Paradox limits)
• [R-204] manthan/state/findings/R-204/registries/diversity-policies.md — diversity-policy registry
• [R-208] manthan/state/findings/R-208/research/dkim-analogy.md — DKIM analogy failure (detection-corpus residual)
• [T-111] manthan/state/findings/T-111/RECEIPT.md — capability-manifest implementation (pricing-floor + service-proof hook surfaces; neither yet given a value-shape validator)

10.2 Suggested follow-ons (for TODO.md additions)

• F-1. [CHARTER §charter-of-charters] meta-primitive: a registry-of-registries governance layer for the capability-registry, diversity-policy registry, and service-proof registry. Without this, [THREATS §6.2]'s registry-as-chokepoint risk is unbounded. Suggested ID: R-2xx.
• F-2. Specify human-Herald cosignature (§7.1 Tier 3 above) as a [CHARTER §coming-of-age]-tagged primitive distinct from the model-vendor-Herald case. Suggested ID: R-2xx.
• F-3. Specify a slash envelope type in [EXT §4.6] revocation neighbourhood, referencing both Bestiary entry and stake commitment, with domain-tag herald.slash.v1. Suggested ID: T-1xx (depends on T-111, T-116).
• F-4. Register a composite diversity policy diversity:tri-jurisdiction+tri-ownership in R-204's registry. Suggested ID: T-0xx (depends on R-204 landing).
• F-5. Specify a Herald-lineage-graph diversity primitive: "no two counterparty sigils share same Herald lineage root within K hops". Useful for §7.1 Tier 2 service-proof counterparty-diversity rule. Suggested ID: R-2xx.
• F-6. Quantitative re-calibration of §7 dollar floors against deployed-Herald revenue distributions, scheduled 12 months post-T-115 (reference Herald) deployment. Suggested ID: D-3xx (audit-style).

Sources

The numeric anchors and literature framing draw on:

• Douceur, J. R. (2002). The Sybil Attack. IPTPS 2002, Cambridge. https://www.freehaven.net/anonbib/cache/sybil.pdf — foundational result and recurring-fee deterrent argument.
• Levine, B. N., Shields, C., Margolin, N. B. (2006). A Survey of Solutions to the Sybil Attack. https://nymity.ch/sybilhunting/pdf/Levine2006a.pdf — taxonomy of Sybil-resistance approaches.
• Buterin, V. (2023). What do I think about biometric proof of personhood? https://vitalik.eth.limo/general/2023/07/24/biometric.html — V(N)/C(N) asymmetric scaling argument.
• Roberts, T. (2022). The Economic Security of Proof of Personhood Services. https://hackmd.io/@RoboTeddy/S1EsAilTO — empirical $20–$100/illicit-key range across PoH/BrightID/Idena.
• Ohlhaver, P. (2024). Compressed to 0: The Silent Strings of Proof of Personhood. Harvard Ash Center. https://ash.harvard.edu/wp-content/uploads/2024/06/proof-of-personhood_ohlhaver.pdf — political-economy critique supporting N-of-M issuer requirement.
• Harvey, C. (2024). 51% attack on the Bitcoin network would cost $6 billion. https://crypto.news/51-attack-on-the-bitcoin-network-would-cost-6-billion/ — PoW attack-cost anchor.
• Ethereum Foundation. Proof-of-stake FAQ and rewards-and-penalties documentation. https://ethereum.org/developers/docs/consensus-mechanisms/pos/faqs and https://ethereum.org/developers/docs/consensus-mechanisms/pos/rewards-and-penalties/ — slashing economics and 33%-attack stake floor.
• a16z crypto. The cryptoeconomics of slashing. https://a16zcrypto.com/posts/article/the-cryptoeconomics-of-slashing/ — correlation-penalty design pattern adapted in §7.6.
• Krebs, B. (2025). Aisuru Botnet Shifts From DDoS to Residential Proxies. https://krebsonsecurity.com/2025/10/aisuru-botnet-shifts-from-ddos-to-residential-proxies/ — current botnet-rental price empirics.
• Spur Intelligence. Residential Proxies: The "Legal" Botnet That Nobody Talks About. https://spur.us/residential-proxies-the-legal-botnet-that-nobody-talks-about/ — proxy-IP pricing.
• Kaspersky / IT Pro (2024). Botnets are being sold on the dark web for as little as $99. https://www.itpro.com/security/botnets-are-being-sold-on-the-dark-web-for-as-little-as-dollar99 — dark-web botnet pricing.
• CFR Cyber Operations Tracker. Compromise of certificate issuer DigiNotar. https://www.cfr.org/cyber-operations/compromise-of-certificate-issuer-diginotar — DigiNotar 2011 case.
• ENISA / Fox-IT. Operation Black Tulip. https://www.enisa.europa.eu/sites/default/files/all_files/Operation_Black_Tulip_v2.pdf — DigiNotar forensic report.
• CoinDesk (2023). Sybil Millionaires: How Airdrop Hunters Trick Projects. https://www.coindesk.com/consensus-magazine/2023/04/10/crypto-airdrop-sybil-attacks — airdrop-farming Sybil revenue distributions.
• Optimism Foundation. RetroPGF / Retroactive Public Goods Funding. https://community.optimism.io/citizens-house/how-retro-funding-works — retrospective-funding alternative model (referenced as design contrast, not adopted).
• Gitcoin / Human Passport. Sybil-resistance via Passport / unique humanity score. https://docs.passport.xyz/overview/key-terms — stamp-based identity-aggregation cost reference.
• Worldcoin / World Foundation. Proof of Personhood whitepaper. https://whitepaper.worldcoin.org/proof-of-personhood — orb-scan economics and PoP UBI structure.
• DLNews (2024). Worldcoin's 230% surge draws droves to eye-scanning orbs. https://www.dlnews.com/articles/markets/berliners-come-out-in-droves-to-scan-eyes-for-free-money/ — empirical user-bounty figures.
• Ed25519 reference / D. J. Bernstein. https://ed25519.cr.yp.to/ — keygen performance baseline.
• arXiv 2505.16068 (2025). Evaluating Voting Design Vulnerabilities for Retroactive Funding. https://arxiv.org/html/2505.16068 — RetroPGF Sybil-collusion analysis.
• arXiv 1905.09093 (Conley 2019). Zero-Knowledge Proof-of-Identity: Sybil-Resistant, Anonymous Authentication on Permissionless Blockchains. https://arxiv.org/abs/1905.09093 — ZK-PoP design space.