Implement the engine spine: claim, outbox, machine, API
Contracts first (T02–T04): approval claim schema with issuer, freshness,
and binding digest; local transactional outbox wire; load-bearing cadence
as heartbeat or reconciliation (layer.yaml declared).
Then the object (T06–T08): SQLite closed state machine, CAS supersession,
distinct-approver fail-closed, revocation without holder cooperation,
outbox insert in the same transaction. Tests fail the mutation when
emission fails, and revoke while the drain sink is down.
Introspection GET /v1/approvals/{id}/claim is a PIP fact, not a decision.
No public consume (T05 waits on GH-WP-0002-T06). Canon T-06 coverage for
wrong binding, expiry, revoke, and supersede.
FLEX-WP-0017 T03 is unblocked on this object; T05 remains blocked only on
consumption ordering.
Assistant: grok
Assistant-Session: 01a04ceb-2057-7e20-b0f9-c282964d5dd9
2026-08-29 12:52:49 +02:00
|
|
|
# Source-side emission cadence for load-bearing approval evidence.
|
|
|
|
|
# Statute §9.6; detection surface GH-WP-0002-T04.
|
|
|
|
|
schema_version: "0.1"
|
|
|
|
|
source: approval-engine
|
|
|
|
|
kind: load-bearing
|
|
|
|
|
form: heartbeat-or-reconciliation
|
|
|
|
|
rate_monitoring: forbidden
|
|
|
|
|
|
|
|
|
|
heartbeat:
|
|
|
|
|
class: heartbeat
|
|
|
|
|
interval: 24h
|
|
|
|
|
assertion: nothing-to-report
|
|
|
|
|
missing: finding
|
|
|
|
|
|
|
|
|
|
reconciliation:
|
|
|
|
|
compare:
|
|
|
|
|
local: committed outbox counts per class
|
|
|
|
|
remote: "audit-core event counts where source=approval-engine"
|
|
|
|
|
divergence: finding
|
|
|
|
|
undrained_local: lag-not-divergence
|
|
|
|
|
|
|
|
|
|
lag_bound:
|
|
|
|
|
outbox_depth: 100
|
|
|
|
|
outbox_age: 1h
|
|
|
|
|
exceed: finding
|
|
|
|
|
|
|
|
|
|
classes:
|
|
|
|
|
issuance:
|
|
|
|
|
action: approval.issuance
|
|
|
|
|
use:
|
|
|
|
|
action: approval.use
|
2026-09-01 23:45:48 +02:00
|
|
|
note: "Public CAS consumption under GH-DEC-2026-003."
|
Implement the engine spine: claim, outbox, machine, API
Contracts first (T02–T04): approval claim schema with issuer, freshness,
and binding digest; local transactional outbox wire; load-bearing cadence
as heartbeat or reconciliation (layer.yaml declared).
Then the object (T06–T08): SQLite closed state machine, CAS supersession,
distinct-approver fail-closed, revocation without holder cooperation,
outbox insert in the same transaction. Tests fail the mutation when
emission fails, and revoke while the drain sink is down.
Introspection GET /v1/approvals/{id}/claim is a PIP fact, not a decision.
No public consume (T05 waits on GH-WP-0002-T06). Canon T-06 coverage for
wrong binding, expiry, revoke, and supersede.
FLEX-WP-0017 T03 is unblocked on this object; T05 remains blocked only on
consumption ordering.
Assistant: grok
Assistant-Session: 01a04ceb-2057-7e20-b0f9-c282964d5dd9
2026-08-29 12:52:49 +02:00
|
|
|
supersession:
|
|
|
|
|
action: approval.supersession
|
|
|
|
|
revocation:
|
|
|
|
|
action: approval.revocation
|
|
|
|
|
heartbeat:
|
|
|
|
|
action: approval.heartbeat
|
