Summary

  • AFPUB-2026-GEN-002-DRAFT01 is displayed as Version 3.0 and remains Under Discussion. AFRINIC-37 found no rough consensus and returned it to RPD.
  • Staff sketches five automated signal families—WHOIS contacts, abuse-c, route objects, relevant RPKI coverage and reverse DNS—and six timestamped dashboard states.
  • The proposal defers the persistence clock and the rules for service withholding, revocation or member closure to a later staff procedure, while a broad Board exception covers strategic infrastructure and exceptional situations.
  • A dashboard can help members cure errors early, but an indicator must not become a self-proving sanction. Each step from data to remedy needs a separate public receipt.

Visibility can prevent punishment

The strongest case for the proposal is practical. Members can miss a policy change, leave an old contact in WHOIS, lose an abuse mailbox or create an inconsistency between route objects and current use. A private dashboard that exposes a problem before enforcement can reduce surprise and give staff a structured way to help.

The public assessment proposes a staged rollout: visibility first, then notices, staff review and only later enforcement after systems, procedures, staffing and communications are ready. It also gives six example states—Policy compliant, First notice sent, 2nd notice sent, Remediation in Progress, Escalated and Closed—with timestamps. This is the outline of a cure service, not merely a sanction engine.

That benign design should be preserved. The proposal is still a draft, and AFRINIC-37 recorded no rough consensus. No inspected source proves that an enforcement dashboard was deployed, that any member was sanctioned, or that any special measure was used.

Five signals are not five findings

The assessment identifies five candidates for automation: WHOIS contact accuracy, abuse-c validity, route-object consistency, relevant RPKI coverage and reverse-DNS requirements. Those indicators can be useful, but each depends on definitions, source systems, freshness and error handling that the draft does not publish.

A stale contact field is different from refusal to respond. Missing RPKI coverage may reflect whether the policy applies, not deliberate non-compliance. Route-object inconsistency can arise from timing or data held by another system. The assessment itself distinguishes objective indicators from qualitative judgments about need, utilisation and documentation.

The Detection-to-Remedy Ledger should therefore record the exact obligation, input provenance, query version, timestamp, result, confidence, member-visible evidence and correction path. An automated signal then moves to a named human reviewer. The reviewer must issue a finding with reasons rather than treating the dashboard colour as proof.

The six states hide the decisive transitions

The state names make a workflow visible but do not define its authority. Which notice starts the persistent-non-compliance clock? How many reminders are required and how are they delivered? What evidence proves cure? Who accepts that evidence? What causes Escalated to become service withholding, revocation or closure?

Draft01 says the persistent period and specific enforcement rules will be set by staff procedure. That defers the economically significant decisions. The procedure needs a version, approval body, effective date and change-control record. Every notice needs recipient snapshot, delivery proof, obligation, evidence and reasons. Every cure needs acceptance criteria and a closure receipt.

A broken RSA link cannot carry current authority

The proposal points to an AFRINIC agreements page and a 2018 RSA PDF. Both current URLs returned 404 during verification. A web archive preserves the exact ten-page 2018 AFRINIC PDF, which describes information requests, notice, cure, termination and an appeal to a parent registry. It is useful historical evidence.

It is not proof that the same text is the current binding RSA for every member. Contracts may differ by signature or amendment date. Before a dashboard becomes an enforcement channel, AFRINIC needs an authoritative public download location and a per-member record of the operative agreement and amendment chain. The staff legal view that contractual enforcement already belongs under the RSA is an institutional position, not a court holding, but it cannot be resolved by citing a dead link.

The critical-infrastructure exception is too broad to be invisible

Clause 6 would permit Board special measures after staff assessment for essential strategic infrastructure, natural disasters, political instability or other exceptional situations. A safety valve can protect connectivity and public welfare during a crisis. But none of the key terms, thresholds, conflicts, duration, reasons, review or rollback is defined.

The exception should not become a private list of favoured networks. Its ledger needs the trigger, evidence, staff assessor, Board vote, conflict disclosures, measure, duration, review date, public-safe reasons and exit. Confidential facts can remain protected while the existence and legal basis of the exception remain visible.

Join detection to remedy

Heng Lu’s doctrine separates the continuity of a verifiable registry from punishment by a private address book. It does not erase contractual duties or lawful remedies. It requires a constraint: indicator, human finding, notice, cure, escalation, sanction, exception and rollback must remain distinct.

A complete ledger would include proposal and procedure versions; the operative policy and RSA clause; five signal definitions; data provenance and retention; access logs; the member correction channel; human reviewer and reasons; notice and delivery; persistence clock; cure evidence; escalation approval; proportionality; sanction authority; appeal; exception reasons; pause; rollback; and verified terminal state.

Today that terminal state is Draft01, displayed Version 3.0, Under Discussion, no rough consensus, returned to RPD. There is no proof of DRAFT03, ratification, implementation, real sanction, special measure, illegality, misconduct or harm.