Propose a link between two keys

State that two refs are related, and how. corresponds is the only relation that is a join; relates is worth showing beside, translates is a rendering in another language or schema, and conflicts asserts the two are DIFFERENT things.

No authority floor: anyone may propose, and anyone may withdraw. Keep the returned link id — it is the only handle bottom accepts, and in an append-only log an unwithdrawable proposal is permanent.

corresponds is SAME ENOUGH TO JOIN ON and nothing more: not identity, and NOT TRANSITIVE (CR2). a—b and b—c never yield a—c. No read on this surface unions two subjects' beliefs, and none ever will — that would merge two facts a human never agreed were one.

Only an operator identify says two refs are ONE THING, and the gateway's own credential cannot clear that floor: an identity written through an ordinary credential is stored, stays auditable, and folds INERT. That is the design (memory proposes, never disposes), not a gap.

Even an effective identify is FORWARD-ONLY (CR3): it emits an alias pair for write-time normalization and rewrites no history. Both keys keep their own neighborhoods and their own belief folds forever.

A conflicts link contributes a disputed MARK and nothing else (CR1) — no status change on either side, nothing retracted, no auto-resolution.

band is PAYLOAD (K6/CR4): the fold is invariant under permuting every band in the log. Filter on it if you like; never rank on it, or a confidence score starts outranking a person.

There is NO delete. Withdrawing a link is bottom, an append.

Requires the coord:write scope. Accepts all three lanes: a session JWT (bounded by the caller's role on this workspace) or an il_* machine credential whose own scope set, workspace set and validity window cover it — both ceilings apply and neither can raise the other, so a credential carrying coord:write is still refused where the role does not permit it.

A credential with no scope record resolves to LEGACY_DEFAULT, which does NOT include coord:write — mint a key with it explicitly (POST /v2/workspaces/{id}/keys).