coulomb/emergent-security
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Reconcile published offline intake in knowledge 0.2.4

Browse source 
Informed Decision 15c330cc documents an offline intake service with empty
registries and no live listener. The decisions card carries those limits.
The unsigned draft binds the new digest and is not submitted.
EMERGENT-WP-0002 stays blocked.

Assistant: grok
Assistant-Session: 01a10286-9185-7bb2-b411-89cf6ab4c0c6
This commit is contained in:
tegwick 2026-10-03 20:14:41 +02:00
parent 5cdb4d39f6
commit ee2e17a2d2
16 changed files with 208 additions and 58 deletions
Download patch file Download diff file Expand all files Collapse all files

23
knowledge/cards/decisions.md
View file

@ -21,12 +21,23 @@ submitter/requester, represented principal, human reviewer, and effect actor.
Neither is approval-engine's binding digest or access-engine's request digest.
Current owner evidence: the browser review surface is deployed according to
its dated SCOPE; INFD-WP-0005 has offline intake validation and a write-back
adapter, but its listener, admission, workload custody and rollout are unfinished.
Do not assume POST /v1/memos or a Statehub forwarding route is live. Prepare the
unsigned packet locally; use the owner's current attended submission route
when authorized. Never invent client credentials or register yourself as an
admitted submitter. No extra human permission is needed merely to draft.
its dated SCOPE. INFD-WP-0005 now has an offline intake service, a schema-3
ledger, and durable notification/write-back jobs. Shipped registries are empty,
transports are injected, and no listener is deployed. Workload custody,
admission, audit registration, and live rollout remain blocked. Do not call
POST /v1/memos or treat Statehub forwarding as a live submitter route. Prepare
the unsigned packet locally and use the owner's attended submission route when
authorized. Never invent client credentials or register yourself as an admitted
submitter. No extra human permission is needed merely to draft.
A `creating` approval row without a retained receipt must not be retried
automatically. Gate House's reply says posing itself needs no human act. The
proposed decision still awaits the founder's ruling, and that reply does not
open a live submission route. A PDP allow is eligibility only: the effect owner
reads the live approval and compares its id and native digest with the memo pin.
Do not place `view_hash` in PDP context or recompute it into the engine binding
digest. Intake-created approvals keep `human_control` true. `drafted_by` stays
asserted provenance when a hub forwards a memo.
For a protected effect, the human disposition must be reflected in the exact
approval-engine object where required; the effect owner verifies its claim,