emergent-security/docs/operational-contracts.md

# Operational seams

These are mappings to owner contracts, not replacement APIs. The knowledge CLI
performs no live operation. Names below are request vocabulary, not authenticated
facts; owners must bind security-relevant fields before a protected effect.

| Need | Entry / owner | Required context and evidence | Result and failure route |
| --- | --- | --- | --- |
| Local edit/test | Repository instructions and task delegation | Explicit task, resolved non-tenant/tenant scope, relevant envelope, tests | Proceed inside actual delegation; uncertainty to delegator. |
| Find credential route | `warden route find "<need>"`, ops-warden | Need, target, actor, tenant, purpose | Catalog/runbook pointer; absence to routing/construction owner. No credential retrieved. |
| Request authority | access-engine `POST /v1/check` | Its CheckRequest and verified claims; exact subject/action/resource/context | DecisionEnvelope; verify authentic source, binding and lifetime under PEP contract. Outage follows published PEP stance. |
| Approval fact | approval-engine claim and consume endpoints | Exact action/target/actor/purpose, validity and supersession | Authenticated claim; consume-before-effect where required; never infer from Statehub prose. |
| Human question | informed-decision | One unsigned memo, exact requested act, packet hashes, distinct drafting/submitter/reviewer identities | Authenticated human disposition and presentation evidence. Offline intake exists and is not a live listener or submitter route (INFD-WP-0005). No answer is not approval. |
| Guided procedure | runbook-tutorials engine; pack in procedure owner repo | Pack digest, run ID, resolved scope, actual external approval/PDP prerequisites, check/effect evidence | Local progress and evidence; auto-confirm, waivers and seals do not authorize effects. Execution/index remain RBT-WP-0006. |
| Credential lifecycle | secrets-engine owner catalog | Current decision and approval contracts, stage/targets, evidence | Scoped lifecycle/delivery path over custody backend; missing prerequisite refuses effect. |
| Identity/user facts | key-cape / user-engine | Authenticated principal, actor, runtime identity; scoped membership | Claims, not authorization; unresolved binding to owner/delegator. |
| Tenant facts | tenant-engine owner APIs | Tenant identifier, lifecycle, role, plan, guardrail source and freshness | PIP facts; outside platform envelope to platform. |
| Zone membership | zone-engine offline conformance tools | Explicit declaration, manifest/profile and source lineage | Reference membership evidence only; no live zone authorization endpoint. |
| Construction | ops-mason approved construction plan | Exact covered effects, structure-only accepted exception, target/digest | Bounded build under owner gate; a new effect class needs a new disposition. |
| Deployment | Owning Railiance repo and current runbook | Exact environment, provenance, human production decision, rollback/evidence | Owner-mediated deployment; no built-in route in this package. |
| Root | Human root steward | Bounded recovery case, failed lower-scope paths, expiry and independent evidence | ROOT_AUTHORIZATION_REQUIRED; never agent activation. |
| Posture | kings-guard | Source events plus completeness limitations | Posture/proposal only; no automatic containment. |
| Adversarial finding | whitehat-security → risk-nexus → defect owner | Approved engagement for live probes, evidence scope and limitations | Finding/disclosure/repair records; fixtures do not prove production. |

## Field mapping

| Emergent reference | Existing estate meaning / mapping limit |
| --- | --- |
| `request_id` | Correlation with an exact owner request; not proof of authorization or replay validity. |
| `principal` | Must distinguish gate-house authority-context principal, actor, and runtime identity; do not flatten them into the model/provider name. |
| `scope.tenant`, `environment` | Authoritative tenant/resource claims, not caller guesses or paths. |
| `scope.level` | L0–L4 decision scope; no automatic mapping to SecurityCanon authority modes. |
| `temperature` | Local change cost/guarantees; not a security-zone ID or runtime environment. |
| delegation / risk envelope | Reviewed owner policy and bounded facts; no generic runtime representation is declared here. |
| reference `AUTONOMOUS` | Reference test outcome only; not an estate DecisionEnvelope. |
| evidence / obligations | Owner-defined claim and effect requirements; free-form explanation cannot substitute for verification. |
| decision lifetime | Access Engine's `lifetime.not_before` / `expires_at`; exact source and replay verification remain PEP duties. |
| replay identity | Consumer uses `binding.submitted_request_digest`; enriched `request_digest` is an internal audit identity. |
| approvals | approval-engine's approval claim plus consume protocol, distinct from the PDP envelope. The composed ActionAuthorization draft is deferred. |
| negative memory | Reference escalation condition; any operational integration needs a reviewed owner claim/policy mapping. No prompt memory becomes policy. |

Authoritative starting points: gate-house `docs/contracts/authority-context.md`,
access-engine `docs/decision-record-contract.md` and
`docs/canonical-request-digest.md`, approval-engine `docs/approval-claim.md` and
`docs/approval-consumption.md`, secrets-engine `docs/ops-warden-routing-contract.md`.
Revision-pinned references and digests are in `knowledge/sources.yaml`.

Known documentation contradictions remain findings. Access Engine's decision
contract has old unsigned-channel prose alongside a newer signature field.
Do not infer deployed signature enforcement from either paragraph; verify the
owner's current decision/signature evidence before consuming live decisions.

Detailed decision/procedure flow, evidence links and current owner dependencies:
[Decision and runbook integration](decision-runbook-integration.md).