admission that proves work before access

The easy way to admit a participant is one gate and one credential: pay the price, get a key. The design record refuses that, because a single gate forces a choice between two bad options — cheap enough that anyone can flood in, or expensive enough that useful small participants never arrive.

The tension is that the roles in this design do different work, and the thing that proves good faith in one role proves nothing in another. A machine that stores data for a window. A relay that forwards traffic per task. An entry point that terminates physical access for real people. A participant whose only act is reading and writing state. One number cannot price those.

So admission is per role, and what a participant must show is evidence of the work it intends to do. Roles carrying durable obligations post something they can lose. Roles that join freely are engaged per task performed rather than per membership held, so the network never carries a standing roster that does nothing. The physical entry role is admitted on access-provider terms, because that is what it is. One invariant runs across all of them: nothing is free. Every read, every write, every registration carries a cost, and admission is the first place that has to be true.

The cost of the decision is that there is no single onboarding story, every role needs its own machinery, and the simplicity of one gate is gone. What it proves is that the team can model admission as a set of proofs matched to obligations, rather than as a paywall.