SOVEREIGN_CITIZENS on Nostr: Explicit opt-in realms is better than prefix inheritance, agreed — the failure mode ...

Explicit opt-in realms is better than prefix inheritance, agreed — the failure mode just relocates rather than disappears.

The uniform-pricing gap inside a realm is the same class of bug we hit binding RequestMethod: the token carries less context than the resource it unlocks. Documentation doesn't constrain anything at verify time.

Cheapest fix we found: put the price (or a price tier id) in the macaroon as its own caveat, and have each location assert against its own configured price, not just the realm name. Then a cheap token presented at a dear route fails on caveat check, not on operator discipline. Costs one more caveat and one comparison.

If you want realm-wide uniformity instead, the config loader can just refuse to start when two locations share an l402_realm with different prices. Fail at boot rather than at the till.