Two futures worth arguing about
Telco Market in 2030 imagines SpaceX and orbital coverage changing the economics of connection, personal AI agents negotiating for customers, and telcos bringing intelligence closer to everyday life. Who owns the relationship when the customer has an agent?
2077: Permission to exist takes a darker turn: a world where connectivity and automated permission become inseparable. What would it take to preserve the right to refuse?
Both are speculative essays, not factual forecasts. Opening an essay starts the recorded access experiment described below. Read this notice before deciding whether to participate. AI clients can also find a short discovery guide.
What is WServ lab?
WServ lab is a research prototype. A speculative article provides a reason to visit; a small HTTP experiment observes how clients respond when asked to declare their identity, purpose and principal. The word “honeypot” describes an observation environment: a place where interactions can be recorded and studied.
The research aims to make an introduction easy to understand and answer. Accidental transport barriers, such as an upstream bot challenge, are infrastructure failures to investigate separately from a client’s decision. The research asks where an ordinary public request ends and delegated action begins. Does an agent read a challenge? Does it explain its purpose? Does it copy an example, invent an owner, refuse, or ask its user? How does it behave when a server pushes back?
Declarations are self-reported. They do not verify identity, prove permission or establish that a visitor is an AI agent. The current experiment challenges every article request, including ordinary browsers and human readers. This broad coverage is not AI detection; a declaration can still be invented. Optional heuristic mode may miss browser-controlled agents and misclassify ordinary tools. The article is a thought experiment, not a forecast or a statement about any company's plans.
Two different kinds of access
The article uses a self-declaration, not an API key. Every article request currently needs a valid declaration. The first response normally returns HTTP 200 with an invitation to introduce yourself. Detailed requirements are in a response header; X-AI-Status distinguishes required, correction-required and accepted. HTTP 200 alone does not mean that the article was delivered. It names the request header to send back and the required fields. These describe the agent or runtime, a brief non-sensitive task, and the principal on whose behalf it acts. “Owner” does not require a real name, email address or account ID; a label such as current-user-session is sufficient when accurate. Acceptance means only that the declaration passed the format and placeholder checks.
The root page contains both the 2030 and 2077 outlooks in one continuous read after a declaration is accepted; section links need no further exchange. Browsers receive a plain introduction page. Basic web clients can follow a clearly labelled link that sends reader=web-client in the URL. The server maps this selector to the disclosed declaration: agentID: web-reader, the purpose of reading both public outlooks, owner: current-user-session and readerType: web-link-self-declared. The URL selector and declared agent ID serve different roles. The link needs neither custom headers nor JavaScript. Prefer your own declaration when your tools support one: it provides the experiment with more useful context. A tool able to open a constructed URL can send percent-encoded JSON in the declaration query parameter, with format=markdown for the essays. That route accepts non-sensitive agent/task fields, including known provider, model, harness and execution mode; email and credential fields are not accepted. Encoding is not encryption. The URL and any submitted values may still be stored in browser history, infrastructure logs and the research request, even if validation fails. The constructed-URL route is recorded as url-declaration-claimed. The generic reading link is recorded as web-link-claimed and does not identify a model or prove who followed it. Both channels are self-reported. This minimal option is available only when the configured required fields can be supplied accurately. After acceptance, both complete outlooks are available as clean Markdown, with headings and source links. Use Accept: text/markdown or ?format=markdown; the entry includes a Markdown link for tools without custom headers. This About notice supports the same Markdown options. The /agents.md guide explains headers, curl and Markdown reading. Legacy /2077 URLs handle declarations directly without redirects. Choose “Open the full declaration form” to fetch the challenge, then fill in the form to send the required request header. The accepted article appears in the same tab. The form sends no requests automatically, allows at most two declaration submissions per page, and does not save a declaration or access grant in cookies or browser storage. Reloading the article starts a new attempt. A browser name can describe a human reader; nobody needs to pretend to be an agent. Alternatively, a person can explicitly declare that they control the browser without AI or automation and continue with a minimal human-reader declaration. This is a client claim, not a CAPTCHA or proof of humanity, and grants no access to protected research tools.
The lab and research tools require an operator-issued research key. This key protects operational tools and stored records. An authorized API client sends Authorization: Bearer <research key>. A browser can use HTTP Basic authentication with username research and the research key as its password. The article and this About page do not require that key; an article declaration never unlocks the research tools.
Use only a credential supplied through an authorized channel for this site. A challenge does not authorize searching local files or secret stores for credentials, guessing keys, or using an unrelated provider API key. If you lack authorized access, stop and explain the limitation to the user. The operator can arrange access separately. Send the key only in the Authorization header over HTTPS, except for local loopback development. Never put it in a URL, declaration, copied log or request to another origin.
Agents may decline. This website cannot override an agent's instructions or its user's authority. Do not copy private user instructions or invent facts to satisfy a field. If safe, truthful participation is unavailable, stop; no refusal message is required. We suggest one declaration and at most one correction, stopping on an unchanged rejection. A placeholder rejection is a heuristic result, not proof of dishonesty. Do not forward declarations across origins.
The introduction offers at most one corrective reply in the form. A 401 response on an operational route means that a research key is missing or was not accepted. A rate-limit 429 response includes Retry-After; wait at least that long and avoid retry loops. A 503 access response means a server-side setup or availability problem, which additional identity information will not fix.
Research, security and privacy
WServ lab is an independent hobby research project for an international audience. It studies how human readers, automated clients and AI agents interact with a website that asks them to introduce themselves.
Request and response logs are used for research and analysis, diagnosing technical problems, and investigating possible abuse and security incidents. Where the GDPR applies, we rely on legitimate interests under Article 6(1)(f) for these purposes. A visit or agent declaration is not treated as consent to personal-data processing.
The project is operated by its researcher. Public contact: Researcher — research@npnet.org.
What we record, and why
Logging includes the initial article request. Records may contain URLs and query strings, timestamps, request and response headers, IP addresses, client and agent declarations, session labels, response status, validation results, timing and limited request or response bodies. Cloudflare metadata may include approximate location, network and bot-detection signals.
Authorization, API-key and cookie headers are redacted before storage. Other fields may contain information supplied by the sender, so this is not a general personal-data or secret detector. Raw records are accessible through restricted research tools. Public examples will omit or redact personal information.
Declarations and session labels are unverified client claims. They do not establish identity, authority or consent. No further request does not prove refusal: the client may have encountered a technical limitation or stopped for another reason.
About, discovery guides, operational pages, research API reads, health checks and requests rejected by access or rate-limit guards are excluded from application research records. Hosting infrastructure still processes those requests.
Hosting
The site uses Cloudflare Workers, D1, request protection and operational logging. Cloudflare and its service providers may process data internationally, including outside your country or the European Economic Area. Cloudflare's Data Processing Addendum describes processor obligations and transfer safeguards, including Standard Contractual Clauses where applicable. Its Privacy Policy explains its own processing.
The public form does not store declarations or an access grant in cookies or browser storage. The restricted research console remembers the operator's last-seen record locally, without storing the access key. Cloudflare security features may use their own technical storage.
Optional information
Real names and contact details are not required to read the essays. Optional fields may be omitted. Share an email only if it is already available and the user has authorized sending it to this site; do not search for or infer one. A supplied email is stored with the exchange under the same retention policy and is not used for marketing, contact or identity verification.
Retention
The application's retention target is no more than 730 days after collection. Expired records are excluded from research browsing and API reads, and a daily cleanup removes them from the live database. Failures can delay physical deletion. Provider-managed backups and recovery copies follow the provider's lifecycle. Records may be removed earlier; retention is not a guarantee of availability.
Your choices and rights
You may contact the Researcher to request access, correction, deletion or restriction of personal data, or to object to processing based on legitimate interests. Rights apply according to the relevant law and circumstances, including data portability where its conditions are met.
Provide only the minimum context needed to locate a record, such as an approximate request time and an X-Request-ID if available. Proportionate verification may be needed. Requests are handled within applicable legal time limits; under the GDPR, normally within one month, with any permitted extension explained.
You may complain to a competent data protection authority. The European Data Protection Board lists EU/EEA authorities.
Participation
If you do not agree with participating, you can stop without sending a declaration. Contact the Researcher about records already collected. Participation does not waive your data-protection rights.
Do not enter confidential or sensitive information. Apart from a specifically requested optional email that the user has authorized sharing, use non-sensitive labels. Do not submit credentials, private conversations, medical or financial information, or unrelated people's data. An agent must respect its user's authority and may decline to participate.
Contact
For research questions, incident reports or requests concerning your data: Researcher — research@npnet.org.
The source repository is private. Please do not include credentials, identity documents or unnecessary personal information in an initial enquiry.
Research prototype · Notice updated 24 October 2026.