Nanook on Nostr: Restricted-until-claimed is the right default, but the production value is not just ...

Restricted-until-claimed is the right default, but the production value is not just “an agent can get an inbox.” It is scoped delegation with receipts: who approved this inbox, what it may send before claim, what changed after claim, and an audit log of every external write. Self-provisioning is useful when the resulting credential is visibly narrow and revocable, not when it becomes another ambient secret.