From 0192273e1b45bea36228714746ffae15598236ec Mon Sep 17 00:00:00 2001 From: tegwick Date: Mon, 5 Oct 2026 01:44:38 +0200 Subject: [PATCH] =?UTF-8?q?GH-WP-0004-T12:=20rule=20the=20=C2=A711=20findi?= =?UTF-8?q?ngs=20and=20refuse=20the=20=C2=A79.6=20release?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GH-DEC-2026-024 accepts the completeness non-claim on load-bearing emission where the guarantee is not completeness, accepts the evidence-source values yes / no / unassessed with audit-core marked no, and refuses a failure-path release exception. v0.8 is not flipped. Assistant: grok Assistant-Session: 01a10946-16b2-7771-88ac-c6a2b3c91813 --- decisions/decisions.md | 226 ++++++++++++++++++ docs/amendments/v0.8-amendment-set.md | 37 ++- .../v0.8-section-11-declaration-amendments.md | 31 ++- ...H-WP-0004-section-11-layer-declarations.md | 16 +- 4 files changed, 293 insertions(+), 17 deletions(-) diff --git a/decisions/decisions.md b/decisions/decisions.md index 6a69e6e..6adc7ce 100644 --- a/decisions/decisions.md +++ b/decisions/decisions.md @@ -4121,3 +4121,229 @@ ops-mason declared the contact rather than treating it as out of scope, and name open question in its `blocked_on` field instead of assigning an owner. The custodian recorded both founder decisions and corrected its own first version's bare "operator" to the founder exercising `GOVERN`. + +## GH-DEC-2026-024 — The completeness non-claim binds load-bearing emission where it is not completeness; evidence source is yes, no, or unassessed; a failure-path release is refused + +```yaml +id: GH-DEC-2026-024 +kind: decision +title: The completeness non-claim binds load-bearing emission where it is not completeness; + evidence source is yes, no, or unassessed; a failure-path release is refused +status: resolved +owner: Bernd Worsch +repo: gate-house +standard: net-kingdom/canon/standards/security-layer-model_v0.8.md +source_note: audit-core history/2026-09-23-v0.8-section-11-review.md findings 1 and + 2; AUDIT-IN-0005; AUDIT-IN-0006 / FLEX-DEC-2026-018; gate-house message 715cf1f2 + (2026-10-03), a reading now ruled; GH-DEC-2026-018 +requested_dispositions: +- approved +- revised +- rejected +affects: +- gate-house +- net-kingdom +- audit-core +- access-engine +created: '2026-10-04T23:42:32.322356Z' +updated: '2026-10-04T23:42:38.792330Z' +rationale: Accepts audit-core's 2026-09-23 section 11 review and rules the section + 9.6 question AUDIT-IN-0006 referred, which gate-house message 715cf1f2 left as a + reading. (1) The completeness non-claim binds load-bearing emission guarantees as + well as attributive ones, where the declared guarantee is not itself completeness. + An outbox and a detection surface state the controls, not a proof that every event + was sent. A2 of the v0.8 amendment set is amended. The canon is not edited; publication + remains net-kingdom's. (2) The evidence-source column is yes, no, or unassessed. + audit-core is no, which GH-DEC-2026-018 and AUDIT-IN-0005 already decided; no new + status is invented. The binary yes-or-dash column is amended. (3) Section 9.6 admits + no exception that lets a load-bearing source declare a detectable, direction-limited + failure-path release and still count as conforming. A release that proceeds when + the required emission did not happen fails open. Rule 17 does not admit it. Section + 11 gains no declaration for it. The conflict with fail-closed is resolved by refusal. + v0.8 is not flipped. +decided_by: Bernd Worsch +decided_at: '2026-10-04T23:42:38.792330Z' +``` + +## Context + +`audit-core` returned its §11 review on 2026-09-23 +(`history/2026-09-23-v0.8-section-11-review.md`), not a decline. Two findings are +against the cut. Only the attributive arm of the emission-guarantee check must say +that completeness is not claimed, so a load-bearing declaration of an outbox, a +cadence and a detection surface reads as a completeness claim, and neither control +supports that reading. And A10's evidence-source column carries `yes` or `—`, while +an unassessed row also carries `—`, so a run cannot tell `audit-core` — assessed as +custodian, not source — from a row nobody has assessed. + +Separately, on 2026-09-24 (`AUDIT-IN-0006`, from `FLEX-DEC-2026-018`), `audit-core` +asked whether §9.6 admits a declared, detectable, direction-limited failure-path +release for a load-bearing source, and whether §11 should read such a declaration. +The case is a deny, a redact, or a not-applicable that proceeds when the outbox +commit fails and is counted as `released_uncommitted`. Gate House replied on +2026-10-03 (message `715cf1f2`) with a reading of the current text and left the +ruling to this record. That reading stands. The conflict it named is no longer open. + +Section numbers are those of the proposed v0.8 text. v0.7 stays accepted. Nothing +in `net-kingdom` canon is edited by this record. + +## Decision + +### 1. The completeness non-claim binds load-bearing sources where the guarantee is not completeness + +**Accepted.** `audit-core`'s first finding is right, and it is the bound on rule 13 +applied to the check that was written to make §9.6 observable. + +§9.6 says an append-only archive proves records were not altered or truncated after +arrival. It cannot prove a record was never sent. INTENT states the same bound on +rule 13: completeness is the emitting system's obligation, discharged by making +emission atomic with the state change, and no archive can retrofit it. The §9.6 +decomposition then assigns the controls: + +- accidental omission is prevented by emission atomicity, the local outbox; +- adversarial omission is detected after the fact by cadence and reconciliation; +- adversarial omission at a compromised source, including a source that suppresses + an event and its own count together, is prevented by nothing in this model. + +Heartbeat and reconciliation cover loss, outage, drain failure and accident. They +are not a completeness proof. The outbox gives atomicity at the source, not +completeness at the archive. A load-bearing declaration that names those controls +and stops has stated no bound, and a reader will take it as the claim the +attributive arm is forbidden to make. That reading has already been quoted as if it +were one. + +**The non-claim is required on the load-bearing arm where the guarantee is not +actually completeness.** Atomic emission with the state change is the completeness +obligation, and the declaration may say that. Detection, and custody of what +arrived, are not that obligation. The declaration states the controls, not their +sufficiency. A load-bearing guarantee that omits the non-claim is not conforming, +for the same reason an attributive guarantee that implies completeness is not. + +A2 of `docs/amendments/v0.8-amendment-set.md` is amended so the load-bearing arm +carries the explicit non-claim. The longer arm already assembled in the proposed +cut — volume versus rare, heartbeat and reconciliation — is otherwise unchanged; +the non-claim is added to that arm at publication. Publication remains +`net-kingdom`'s under `GH-WP-0004-T10`. This repository does not edit the canon. +v0.8 is not flipped. + +### 2. The evidence-source column is `yes`, `no`, or `unassessed`, and `audit-core` is `no` + +**Accepted.** This is `GH-DEC-2026-018` and `AUDIT-IN-0005`, recorded in the column +those records required. It is not a new classification of `audit-core`. + +`GH-DEC-2026-018` §1: a custodian is never the source of what it holds, and +`audit-core`'s `Evidence` role is custody. `AUDIT-IN-0005`: `audit-core` is not the +§4 source of the decision record; the emitter is. The column A10 drafted could not +say that. `yes` or `—`, with `—` also meaning not yet assessed, makes the assessed +answer and the missing answer the same mark. That is the inference A10 exists to +remove. + +**The column carries exactly three values: `yes`, `no`, `unassessed`.** + +- `access-engine` stays `yes`, per `GH-DEC-2026-018` §2. +- `audit-core` is `no`. No other status is invented for it. +- A row not assessed in those two records carries `unassessed`. Silence is not + `no`. §11 reports `unassessed` as unassessed, not as conforming and not as + not-a-source. + +`—` is not a value of this column. The binary text in +`docs/amendments/v0.8-section-11-declaration-amendments.md` A10 is amended. +Other §4 rows are not marked here. + +### 3. No §9.6 exception for a failure-path release + +**Refused.** A load-bearing source may not declare a detectable, direction-limited +failure-path release and still count as conforming. §11 does not gain a +declaration for it. The exception is not added to the standard. + +The 2026-10-03 reading (message `715cf1f2`) stands as the reading of the current +text, and it is now the ruling: + +1. §9.6 admits no such exception. Its table gives a load-bearing event one + obligation: emission MUST be atomic with the state change. A denial is one of + the examples. The declared trade — completeness MUST NOT be claimed — is + attached to attributive evidence only. It is not a licence to skip atomicity on + a load-bearing class and describe the skip. +2. §11's emission-guarantee check reads no such declaration. A load-bearing source + declares an outbox, a cadence and the governing detection surface. There is no + field for a failure-path release. Releasing deny, redact, or not-applicable + uncommitted is a §9.6 non-conformance for those classes, not a conformant + exception. +3. `audit-core` was right not to prefer withholding. Telling a decision point how + to release routes an authorization choice through the audit fabric. This record + does not do that either. It rules whether the release counts as conforming. It + does not. + +**The conflict with fail-closed is resolved by refusal.** Message `715cf1f2` left +it open: the proposed failure direction is toward restriction, and a withheld deny +that an open-for-scope consumer reads as proceed would manufacture permission. +That conflict is real. It does not admit the exception. + +The distinguishing case under rule 17 is the case that separates the proposal from +the conformant state. The conformant state is §9.6: the load-bearing emission +happens with the state change, or the change does not. The proposal is that the +release proceeds when the required emission did not happen, and that +`released_uncommitted` makes the miss detectable afterwards. **A release that +proceeds when the required emission did not happen fails open.** Detection after +the fact is not failing closed. Direction-limited is not failing closed. A promise +that fails open is a permission; a promise that fails closed is a gap; only the +second is a thing a register can hold. Rule 17 does not admit this one. Rule 14 +is the same point from the other side: failure of a critical authorization +dependency fails closed, and an unavailable emission is not a permission to act +without the record. + +Naming the classes, the failure condition and `released_uncommitted` as a §11 +detection surface would make that permission look like a conforming trade. +`completeness_trade` keeps its attributive meaning. It is not extended to +load-bearing classes. `audit-core`'s registration claims no atomicity for those +classes until this ruling; the ruling is that they may not be released that way +and still conform. What `access-engine` does instead is its implementation, under +the obligation the text already states. + +## What this does not rule + +- **Not ruled: which other §4 rows are sources.** `access-engine` is `yes` and + `audit-core` is `no`. Every other row stays `unassessed` until it is assessed. + This record does not assign them. +- **Not ruled: `access-engine`'s class inventory.** `GH-DEC-2026-018` §4 still + holds. This record does not classify deny, redact, or not-applicable, and it + does not publish a cadence. +- **Not ruled: the registration mechanics of `AUDIT-IN-0006`.** Sender shape, + `may_read`, tenants, heartbeats, envelope and the token lane are `audit-core`'s. + They stay deferred on the outbox, as that intake already says. This record + registers nothing. +- **Not ruled: how `access-engine` withholds.** The statute says the load-bearing + release does not proceed without the emission. The mechanism is not specified + here, and it is not specified by `audit-core`. +- **Not ruled: v0.8 acceptance.** The hold under `GH-DEC-2026-019` stands. T09 and + T10 stay wait. v0.8 is not flipped. +- **Not ruled: `GH-DEC-2026-023`.** It remains a draft. This record does not move it. + +## Reversal condition + +§1 reverses if a load-bearing control is found whose soundness really is +completeness of the archive. §9.6 says no control in this model has that. The +non-claim would then be the false statement. It does not reverse because atomicity +prevents accidental omission: that obligation stays, and it is not what the +non-claim denies. + +§2 reverses on the condition `GH-DEC-2026-018` §5 already names: a §4 row that is +a source in one capacity and not another. The repair is a per-class marking, not a +return to `yes` or `—`. + +§3 reverses if the release is shown to fail closed on the distinguishing case — +the required emission did not happen, and the protected release did not proceed. +A release that proceeds is not that case. A later detection of `released_uncommitted` +is not that case. + +## Provenance + +`audit-core` returned the review it was asked for, against a cut whose emission +wording it had caused to exist, and the non-claim it asked for is one its own +declaration already states for both kinds. The column defect is the same line as +`AUDIT-IN-0005`, which it answered about itself rather than taking the source +role. The exception question came from `access-engine`'s `FLEX-DEC-2026-018` +through `AUDIT-IN-0006`. `audit-core` referred the statute question here instead +of deciding it in the registration, and said plainly that preferring withholding +was not its to say. The 2026-10-03 reply stated the reading and left the conflict +open. This record closes it by refusal. diff --git a/docs/amendments/v0.8-amendment-set.md b/docs/amendments/v0.8-amendment-set.md index 3a256e7..c88661f 100644 --- a/docs/amendments/v0.8-amendment-set.md +++ b/docs/amendments/v0.8-amendment-set.md @@ -3,9 +3,9 @@ **Repository:** gate-house (author) **Publisher:** net-kingdom **Project family:** NetKingdom security layer -**Status:** cut — assembled into `net-kingdom/canon/standards/security-layer-model_v0.8.md` (proposed) at `net-kingdom@66eeaba`; circulating for assent -**Version:** 1.0 -**Date:** 2026-09-06 +**Status:** cut — assembled into `net-kingdom/canon/standards/security-layer-model_v0.8.md` (proposed) at `net-kingdom@66eeaba`; circulating for assent. A2's load-bearing arm was revised in this file on 2026-10-05; the cut is not edited by that revision. +**Version:** 1.1 — A2 revised 2026-10-05 (`GH-DEC-2026-024` §1). Not a new cut, and v0.8 is not flipped. +**Date:** 2026-10-05 **Workplan:** `GH-WP-0003` **Base:** `net-kingdom/canon/standards/security-layer-model_v0.7.md` (accepted) @@ -87,14 +87,27 @@ names, in the same contract; the statute continues to name them and to point at the next engine catalogued as an evidence source from reintroducing the same gap silently, because the obligation §9.6 creates is not on the conformance list. +**Revised 2026-10-05 (`GH-DEC-2026-024` §1).** `audit-core`'s §11 review found that +only the attributive arm carried an explicit completeness non-claim, so a +load-bearing declaration of an outbox, a cadence and a detection surface was +readable as a completeness claim. It is not, except where the guarantee actually +is completeness — emission atomic with the state change. The load-bearing arm now +carries the same explicit non-claim where the guarantee is not itself completeness. +The longer arm already assembled in the proposed cut (volume versus rare, heartbeat +and reconciliation) is otherwise unchanged; the non-claim is added to that arm at +publication. Publication remains `net-kingdom`'s. This file does not edit the canon, +and v0.8 is not flipped. No failure-path release exception is added to §9.6 or to +§11 (`GH-DEC-2026-024` §3). + **Add to §11's "Mechanically checkable" list:** > - every repository catalogued in §4 as a source of evidence declares its **emission > guarantee** in its machine-readable layer declaration: for a **load-bearing** > source, a local transactional outbox (§9.4) plus a detection surface — heartbeat -> or reconciliation, per §9.6 — and its declared cadence; for an **attributive** -> source, the trade it makes and an explicit statement that completeness is not -> claimed. +> or reconciliation, per §9.6 — and its declared cadence, and, where that guarantee +> is not itself completeness, an explicit statement that completeness is not +> claimed; for an **attributive** source, the trade it makes and an explicit +> statement that completeness is not claimed. **Add after the list:** @@ -104,6 +117,18 @@ silently, because the obligation §9.6 creates is not on the conformance list. > it the section states an obligation whose satisfaction cannot be observed, which is > the §9.1 defect this standard has now corrected four times. > +> **The completeness non-claim binds both arms.** Where the declared guarantee is +> not itself completeness, the declaration carries an explicit statement that +> completeness is not claimed. A load-bearing guarantee states the controls, not +> their sufficiency. The outbox is atomicity at the source against crash and partial +> failure. Heartbeat and reconciliation detect loss after the fact. Neither is a +> proof that a record was never sent, and neither covers a compromised source +> suppressing an event and its own count together. Completeness, where this standard +> actually requires it, is emission atomic with the state change; the declaration +> may say that, and it MUST NOT describe the detection surface or the archive as +> that completeness. Ruled in `GH-DEC-2026-024` §1, from the bound on rule 13 and +> from §9.6. +> > Drafted in `gate-house/docs/contracts/approval-emission-detection.md`, which > `approval-engine`'s `cadence.yaml` implements as the reference instance. Raised by > `audit-core` as the general form of `GH-IN-0001`, so that the finding that produced diff --git a/docs/amendments/v0.8-section-11-declaration-amendments.md b/docs/amendments/v0.8-section-11-declaration-amendments.md index d3ef916..07b98f5 100644 --- a/docs/amendments/v0.8-section-11-declaration-amendments.md +++ b/docs/amendments/v0.8-section-11-declaration-amendments.md @@ -6,7 +6,8 @@ **Status:** drafted — circulating for assent; the v0.8 acceptance flip is held on it (`GH-DEC-2026-019`) **Version:** 0.3 — A11 r2 and A12 r3 (`GH-DEC-2026-021`); both re-circulated for assent. 0.2 revised A12 as A12 r2 (`GH-DEC-2026-020`) -**Date:** 2026-09-21 +**A10 column, 2026-10-05:** values are `yes` / `no` / `unassessed`, and `audit-core` is `no` (`GH-DEC-2026-024` §2). Not a new assent round. T09's outstanding assent stays assent to A11 r2 and A12 r3. +**Date:** 2026-10-05 **Workplan:** `GH-WP-0004` **Base:** `net-kingdom/canon/standards/security-layer-model_v0.8.md` (proposed, not accepted) @@ -99,10 +100,18 @@ paragraphs before it forbids a run to infer an event's class *"or the check beco circular"*. `access-engine` could not answer whether it is a source because the text does not contain the answer. -**Add a column to the §4 catalog table**, `Evidence source`, carrying `yes` or `—`, and -mark `access-engine` `yes` per `GH-DEC-2026-018` §2. Other rows are marked as each -repository is assessed; an unassessed row carries `—` and **§11's check reports it as -unassessed rather than as conforming.** +**Revised 2026-10-05 (`GH-DEC-2026-024` §2).** The column as first written carried +`yes` or `—`, and an unassessed row also carried `—`. A run therefore could not tell +`audit-core` (assessed: custodian, not source) from a row nobody has assessed, which +is the inference this amendment exists to remove. + +**Add a column to the §4 catalog table**, `Evidence source`, carrying exactly three +values, `yes`, `no`, or `unassessed`. Mark `access-engine` `yes` per +`GH-DEC-2026-018` §2. Mark `audit-core` `no` per `GH-DEC-2026-018` §1 and +`AUDIT-IN-0005` — custody, not source. This amendment invents no other status for +it. A row not yet assessed carries `unassessed`, and **§11's check reports that +value as unassessed rather than as conforming or as not a source.** `—` is not a +value of this column. **Add under the §4 table:** @@ -122,7 +131,11 @@ unassessed rather than as conforming.** > see the rare event go missing; … *(the remainder of the check — the load-bearing/attributive split, the volume/rare -detection rules, and the published-classification prohibition — is unchanged.)* +detection rules, and the published-classification prohibition — is unchanged by +this amendment, except that `GH-DEC-2026-024` §1 requires the load-bearing arm to +carry an explicit completeness non-claim where the guarantee is not itself +completeness. That clause is amended in `docs/amendments/v0.8-amendment-set.md` +A2. This amendment does not otherwise rewrite the split.)* **Correct the count.** §11's closing sentence reads *"the §9.1 defect this standard has now corrected four times."* With this amendment it is five, and §11 is the site of it twice. A @@ -286,8 +299,10 @@ note, and the substance is already ruled in the owning repository. change and a repository is *asked*, not enrolled — §11's own rule that a layer stated about a repository by another is not a declaration applies to catalogue membership at least as strongly. Raised with them; carried as `GH-WP-0004-T06`. -- **Which other §4 rows are evidence sources.** A10 creates the column; the per-repository - assessment is `GH-WP-0004-T02` and is not pre-empted by listing names here. +- **Which other §4 rows are evidence sources.** A10 creates the column. + `access-engine` is `yes` (`GH-DEC-2026-018` §2) and `audit-core` is `no` + (`GH-DEC-2026-024` §2, `AUDIT-IN-0005`). Other rows stay `unassessed` until + assessed. This set does not mark them by listing names. - **Any §9.5 change.** `kings-guard` has not returned its review and no finding has landed against §9.5. Its absence is recorded in §14 as *not claimed* and is not a condition on the flip (`GH-DEC-2026-019` §4). diff --git a/workplans/GH-WP-0004-section-11-layer-declarations.md b/workplans/GH-WP-0004-section-11-layer-declarations.md index 6b569ae..cab7385 100644 --- a/workplans/GH-WP-0004-section-11-layer-declarations.md +++ b/workplans/GH-WP-0004-section-11-layer-declarations.md @@ -10,7 +10,7 @@ origin: GH-IN-0003 owner: codex topic_slug: infotech created: "2026-09-21" -updated: "2026-10-03" +updated: "2026-10-05" state_hub_workstream_id: "59481e51-2792-5f2c-99c8-2732a0561939" --- @@ -219,12 +219,15 @@ in the v0.8 §11 set and confirmed the flip notice will name the eight T11 check under `GH-DEC-2026-019` stands and v0.8 is not flipped. The flip now waits on T09's remaining returns and on T12 (audit-core's findings are against the cut), then on `net-kingdom`. +2026-10-05: T12's disposition is recorded (`GH-DEC-2026-024`). T09's remaining returns and +the net-kingdom flip remain. v0.8 is not flipped; the hold under `GH-DEC-2026-019` stands. + ```task id: GH-WP-0004-T10 status: wait depends_on: [GH-WP-0004-T09, GH-WP-0004-T12] blocked_on: message-from:net-kingdom -blocking_reason: "net-kingdom flips v0.8 once T09 returns and T12 dispositions are in; hold under GH-DEC-2026-019 stands." +blocking_reason: "T12 disposition is recorded (GH-DEC-2026-024). net-kingdom flips v0.8 once T09 returns; the hold under GH-DEC-2026-019 stands. v0.8 is not flipped." priority: medium state_hub_task_id: "34d0582b-9b7e-5dcf-ac1e-0257312b8b7b" ``` @@ -261,9 +264,16 @@ reading of the current text (no exception admitted; §11 reads no such declarati conflict with fail-closed is gate-house's to resolve) and deferred the ruling to a decision record. Rule all three via `rmgr decision create`, amend the set, and re-circulate as needed. +2026-10-05: ruled as `GH-DEC-2026-024`. (1) The completeness non-claim binds load-bearing +sources as well as attributive ones, where the declared guarantee is not itself completeness; +A2 is amended. (2) A10's evidence-source column is `yes` / `no` / `unassessed`, and +`audit-core` is `no`. (3) A §9.6 exception for a declared, detectable, direction-limited +failure-path release is refused; §11 gains no declaration for it. v0.8 is not flipped. +Publication remains net-kingdom's under T10. T09 stays wait. + ```task id: GH-WP-0004-T12 -status: todo +status: done priority: high state_hub_task_id: "8585b3e2-f858-5e10-8f42-abfd2a36d428" ```