Conditional repair offer:
risks and limits.
Design policy · 27 October 2026 · Proposed protocol semantics, not a legal guarantee
The PatchMyBox default is a local conditional offer. The owner places patchmybox.txt on the host: access is not authorized in advance; if a person discovers the offer, safely repairs the covered system, and satisfies its repair-only conduct conditions, the owner commits to retrospective forgiveness within the owner's authority and payment of the stated reward. Otherwise this offer supplies neither. The model requires no prior case, negotiation, owner reply, or upfront deposit.
This is a promise conditional on qualification, not a discretionary tip. It may be discovered after access, including root. Root is not a universal eligibility requirement, and useful preventive work on compromisable systems remains in scope. The maker records proposed terms; it cannot establish owner authority, guarantee enforceability, provide immunity, or fund the promise.
1. Local by default; public by choice
The proposed default location is /etc/patchmybox.txt, or a documented host path chosen by the operator. This is a project convention, not an established standard. The file acts as locally discoverable policy state; public web hosting is unnecessary. Restrictive file permissions may control ordinary discovery but do not protect authenticity against root.
Local placement avoids advertising the host's participation, asset details or reward schedule to everyone. It fits the point at which someone already on the machine chooses whether to repair or exploit further. Its cost is poorer discoverability and uncertainty before the file is found. It does not provide prior knowledge of the terms or make entry authorized.
Optional public publication can help a potential repairer learn that a conditional offer exists and inspect terms before investing effort. It can also reveal scope and rewards, attract unwanted attention, and create stale cached copies. A public pointer or mirror must retain the no-advance-access-authorization statement. Publicity and advance permission are separate choices. Evaluate both discovery modes; do not assume local-only placement removes incentives to seek entry.
2. Authenticate the offer independently of the host
Bind exact policy bytes, version, owner or delegated controller, assets, validity, reward rule and review process. A root user can replace both the file and a key stored beside it. File ownership, a newly written DNS marker, or a canary establishes control at most. Use a pre-established independent owner route; record its provenance and keep the discovered policy and verification record outside the target.
A signed off-host commitment or timestamp can help preserve the original offer without publishing sensitive scope. These are integration directions, not capabilities already supplied by the static maker. Key identity and delegation still need independent authentication. If they remain unresolved, record that outcome instead of assuming the file is genuine.
RFC 9116 provides useful precedent for signed disclosure information, freshness, independent key verification and compromised-file handling. It does not standardize patchmybox.txt, and security.txt alone does not imply testing permission. RFC 9116, §§2.3, 5.1, 5.3, 5.5
3. Define conditions for the whole episode
The relevant episode includes initial access and conduct before the offer was discovered, as well as the repair and handover. The offer must say which otherwise unauthorized conduct the owner promises to forgive if all conditions are met. No blanket pardon follows from a useful patch. Prior theft, exfiltration, persistence, sabotage, extortion, fabricated evidence, unrelated access or deliberately manufacturing damage remains disqualifying even when followed by repair.
“Only repair” must allow the minimal diagnosis, safety checks, patch application, verification, necessary rollback, private report and access closure needed for a real repair. Specify the bounded activities and data required, rather than demanding literally zero observation or incidental processing. Avoid customer content when metadata or synthetic tests suffice. No extraction of secrets, bulk copying, unrelated exploration, or retained access for future rewards.
Scope identifies actual assets and excluded systems, tenants and data. Root on one VM does not extend the offer to a cloud control plane, another tenant, a customer account or another organization. The owner cannot forgive claims or grant rights it does not control. A dependency outside scope is a reason to stop that part and report it.
4. Make safe completion and handover concrete
Before changing state, establish the expected effect, minimal baseline, recovery material, safe rollback or equivalent restoration route, and service/security tests. Use an isolated dry run where feasible. Preserve recovery material under owner control without copying production data unnecessarily. Avoid credential changes that lock out the owner or silently break dependent services.
If safe execution or recovery cannot be established, stop and report. Stop on unexpected scope, sensitive data exposure, conflicting changes or service degradation; disclose a failed repair instead of hiding it. This is a condition for qualification, not a universal case-by-case preapproval gate. The file does not make an unsafe production experiment eligible.
Remove temporary accounts, keys, tools, sessions and elevated access; disclose unavoidable residue and hand control back. Never leave a backdoor or condition recovery instructions on payment. Owner administration, independent restoration, replacement of the patch and future upgrades remain possible regardless of a payment dispute.
5. Preserve versions, timing and concurrent work
Record when the offer was installed or independently committed, discovered, authenticated, relied upon, changed, expired or withdrawn. Local clocks and filesystem timestamps are not conclusive proof. The terms need a validity interval, freshness procedure and an authenticated stop/contact route; that route need not be public HTTPS.
Changes apply prospectively under the recorded offer. A later edit or refusal to pay must not silently remove a qualified reward or change the evidence threshold for completed conduct. State how an authenticated stop notice affects in-progress work, allowing only narrowly defined stabilization and handover when abrupt abandonment would worsen harm. These are intended protocol rules; their legal effect needs separate analysis.
Recheck the baseline before mutation, detect other repairs and avoid incompatible or non-idempotent changes. A coordination record can help without requiring a fresh owner reply. Never revert another repair to manufacture a payable before-state. The reward rule should handle incremental contributions and duplicate claims rather than pay several full awards for the same benefit.
Report promptly through the private contact, including discovery/access timing, policy version, changes, tests, recovery, cleanup and evidence gaps. Notify immediately on harm or a stop condition. Coordinate public disclosure separately. No threat to reopen a flaw, payment-conditioned silence, or public target list is part of this offer.
6. Keep qualification and evidence uncertainty separate
Review at least four findings: authentic owner offer; useful safe repair; whole-episode conduct under its conditions; and actual payment/funding. Technical success alone establishes neither compliant conduct nor forgiveness. A missing observation is unknown, not proof of innocence or misconduct.
The mediator records qualified, disqualified, or unresolved, with clause-specific reasons, evidence and a challenge route. State the evidence threshold and treatment of uncertainty in the offer; neither claimant nor owner can choose a new standard after observing the result. An unresolved claim may be held or disposed of under those disclosed rules without labeling the claimant malicious.
Host logs, self-reports and TEE receipts have different trust boundaries. A TEE receipt can support a statement about measured execution and observed paths; it cannot establish what happened before measurement or elsewhere on the host. Record the interval, observers, gaps, unavailable data and assumptions. Stronger prospective instrumentation may improve evidence but cannot recover an unobserved past.
7. No upfront capital means owner credit risk
Specify a reward amount or determinate formula, currency, qualification standard, review deadline, challenge/appeal process and payment deadline. Once qualification is established under those terms, the owner is committed to the reward and funds it after repair. Failure to do so is nonperformance of the promise, not a reserved option to decline a tip. Legal enforceability is not established by this template.
Before deposit, the reward is unsecured. Reputation, a mediator finding and an empty contract do not place money in escrow. The initial contract cannot force funding; after funding it can enforce only its programmed settlement rules. A timeout refund may follow reviewer silence and does not prove misconduct or extinguish a separate off-chain obligation.
The paper's committed-payment models do not prove incentives for a conditional offer with uncertain qualification, owner default risk and jurisdiction-dependent forgiveness. Study owner nonpayment, costly evidence, adverse selection, induced entry, collusion and manufactured claims. Measure total losses and attack frequency as well as repairs. Record nonpayment privately and fairly; no coercive blacklist or target exposure follows from a dispute.
8. Forgiveness is bounded by the owner's authority
The proposed commitment concerns claims and remedies the owner can control. It does not bind prosecutors, customers, service providers, other affected parties or foreign authorities, and it does not rewrite initial access as authorized. Whether a particular promise operates as an enforceable release or covenant depends on jurisdiction and drafting.
The US DOJ's CFAA charging policy addresses authorization at the time of conduct and good-faith security research; it is a prosecutorial policy, not a PatchMyBox endorsement or a worldwide immunity instrument. DOJ Justice Manual §9-48.000
Before an operational pilot, settle the legal form of the owner's commitment, exact qualifying conduct, evidence threshold, reward rule, review/payment deadlines, independent authentication, version and revocation handling, recovery conditions, retention and appeal rules. Test forged policy files, earlier theft followed by repair, unknown history, unsafe fixes, duplicate claims and owner nonpayment on consenting test systems. The static site and undeployed escrow do not already solve these problems.