coulomb/gate-house
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

GH-WP-0004-T12: rule the §11 findings and refuse the §9.6 release

Browse source 
GH-DEC-2026-024 accepts the completeness non-claim on load-bearing
emission where the guarantee is not completeness, accepts the
evidence-source values yes / no / unassessed with audit-core marked
no, and refuses a failure-path release exception. v0.8 is not flipped.

Assistant: grok
Assistant-Session: 01a10946-16b2-7771-88ac-c6a2b3c91813
This commit is contained in:
tegwick 2026-10-05 01:44:38 +02:00
parent 755c36ae19
commit 0192273e1b
4 changed files with 293 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

37
docs/amendments/v0.8-amendment-set.md
View file

@ -3,9 +3,9 @@
**Repository:** gate-house (author)
**Publisher:** net-kingdom
**Project family:** NetKingdom security layer
**Status:** cut — assembled into `net-kingdom/canon/standards/security-layer-model_v0.8.md` (proposed) at `net-kingdom@66eeaba`; circulating for assent
**Version:** 1.0
**Date:** 2026-09-06
**Status:** cut — assembled into `net-kingdom/canon/standards/security-layer-model_v0.8.md` (proposed) at `net-kingdom@66eeaba`; circulating for assent. A2's load-bearing arm was revised in this file on 2026-10-05; the cut is not edited by that revision.
**Version:** 1.1 — A2 revised 2026-10-05 (`GH-DEC-2026-024` §1). Not a new cut, and v0.8 is not flipped.
**Date:** 2026-10-05
**Workplan:** `GH-WP-0003`
**Base:** `net-kingdom/canon/standards/security-layer-model_v0.7.md` (accepted)
@ -87,14 +87,27 @@ names, in the same contract; the statute continues to name them and to point at
the next engine catalogued as an evidence source from reintroducing the same gap
silently, because the obligation §9.6 creates is not on the conformance list.
**Revised 2026-10-05 (`GH-DEC-2026-024` §1).** `audit-core`'s §11 review found that
only the attributive arm carried an explicit completeness non-claim, so a
load-bearing declaration of an outbox, a cadence and a detection surface was
readable as a completeness claim. It is not, except where the guarantee actually
is completeness — emission atomic with the state change. The load-bearing arm now
carries the same explicit non-claim where the guarantee is not itself completeness.
The longer arm already assembled in the proposed cut (volume versus rare, heartbeat
and reconciliation) is otherwise unchanged; the non-claim is added to that arm at
publication. Publication remains `net-kingdom`'s. This file does not edit the canon,
and v0.8 is not flipped. No failure-path release exception is added to §9.6 or to
§11 (`GH-DEC-2026-024` §3).
**Add to §11's "Mechanically checkable" list:**
> - every repository catalogued in §4 as a source of evidence declares its **emission
> guarantee** in its machine-readable layer declaration: for a **load-bearing**
> source, a local transactional outbox (§9.4) plus a detection surface — heartbeat
> or reconciliation, per §9.6 — and its declared cadence; for an **attributive**
> source, the trade it makes and an explicit statement that completeness is not
> claimed.
> or reconciliation, per §9.6 — and its declared cadence, and, where that guarantee
> is not itself completeness, an explicit statement that completeness is not
> claimed; for an **attributive** source, the trade it makes and an explicit
> statement that completeness is not claimed.
**Add after the list:**
@ -104,6 +117,18 @@ silently, because the obligation §9.6 creates is not on the conformance list.
> it the section states an obligation whose satisfaction cannot be observed, which is
> the §9.1 defect this standard has now corrected four times.
>
> **The completeness non-claim binds both arms.** Where the declared guarantee is
> not itself completeness, the declaration carries an explicit statement that
> completeness is not claimed. A load-bearing guarantee states the controls, not
> their sufficiency. The outbox is atomicity at the source against crash and partial
> failure. Heartbeat and reconciliation detect loss after the fact. Neither is a
> proof that a record was never sent, and neither covers a compromised source
> suppressing an event and its own count together. Completeness, where this standard
> actually requires it, is emission atomic with the state change; the declaration
> may say that, and it MUST NOT describe the detection surface or the archive as
> that completeness. Ruled in `GH-DEC-2026-024` §1, from the bound on rule 13 and
> from §9.6.
>
> Drafted in `gate-house/docs/contracts/approval-emission-detection.md`, which
> `approval-engine`'s `cadence.yaml` implements as the reference instance. Raised by
> `audit-core` as the general form of `GH-IN-0001`, so that the finding that produced

31
docs/amendments/v0.8-section-11-declaration-amendments.md
View file

@ -6,7 +6,8 @@
**Status:** drafted — circulating for assent; the v0.8 acceptance flip is held on it (`GH-DEC-2026-019`)
**Version:** 0.3 — A11 r2 and A12 r3 (`GH-DEC-2026-021`); both re-circulated for assent.
0.2 revised A12 as A12 r2 (`GH-DEC-2026-020`)
**Date:** 2026-09-21
**A10 column, 2026-10-05:** values are `yes` / `no` / `unassessed`, and `audit-core` is `no` (`GH-DEC-2026-024` §2). Not a new assent round. T09's outstanding assent stays assent to A11 r2 and A12 r3.
**Date:** 2026-10-05
**Workplan:** `GH-WP-0004`
**Base:** `net-kingdom/canon/standards/security-layer-model_v0.8.md` (proposed, not accepted)
@ -99,10 +100,18 @@ paragraphs before it forbids a run to infer an event's class *"or the check beco
circular"*. `access-engine` could not answer whether it is a source because the text does
not contain the answer.
**Add a column to the §4 catalog table**, `Evidence source`, carrying `yes` or `—`, and
mark `access-engine` `yes` per `GH-DEC-2026-018` §2. Other rows are marked as each
repository is assessed; an unassessed row carries `—` and **§11's check reports it as
unassessed rather than as conforming.**
**Revised 2026-10-05 (`GH-DEC-2026-024` §2).** The column as first written carried
`yes` or `—`, and an unassessed row also carried `—`. A run therefore could not tell
`audit-core` (assessed: custodian, not source) from a row nobody has assessed, which
is the inference this amendment exists to remove.
**Add a column to the §4 catalog table**, `Evidence source`, carrying exactly three
values, `yes`, `no`, or `unassessed`. Mark `access-engine` `yes` per
`GH-DEC-2026-018` §2. Mark `audit-core` `no` per `GH-DEC-2026-018` §1 and
`AUDIT-IN-0005` — custody, not source. This amendment invents no other status for
it. A row not yet assessed carries `unassessed`, and **§11's check reports that
value as unassessed rather than as conforming or as not a source.** `—` is not a
value of this column.
**Add under the §4 table:**
@ -122,7 +131,11 @@ unassessed rather than as conforming.**
> see the rare event go missing; …
*(the remainder of the check — the load-bearing/attributive split, the volume/rare
detection rules, and the published-classification prohibition — is unchanged.)*
detection rules, and the published-classification prohibition — is unchanged by
this amendment, except that `GH-DEC-2026-024` §1 requires the load-bearing arm to
carry an explicit completeness non-claim where the guarantee is not itself
completeness. That clause is amended in `docs/amendments/v0.8-amendment-set.md`
A2. This amendment does not otherwise rewrite the split.)*
**Correct the count.** §11's closing sentence reads *"the §9.1 defect this standard has now
corrected four times."* With this amendment it is five, and §11 is the site of it twice. A
@ -286,8 +299,10 @@ note, and the substance is already ruled in the owning repository.
change and a repository is *asked*, not enrolled — §11's own rule that a layer stated about
a repository by another is not a declaration applies to catalogue membership at least as
strongly. Raised with them; carried as `GH-WP-0004-T06`.
- **Which other §4 rows are evidence sources.** A10 creates the column; the per-repository
assessment is `GH-WP-0004-T02` and is not pre-empted by listing names here.
- **Which other §4 rows are evidence sources.** A10 creates the column.
`access-engine` is `yes` (`GH-DEC-2026-018` §2) and `audit-core` is `no`
(`GH-DEC-2026-024` §2, `AUDIT-IN-0005`). Other rows stay `unassessed` until
assessed. This set does not mark them by listing names.
- **Any §9.5 change.** `kings-guard` has not returned its review and no finding has landed
against §9.5. Its absence is recorded in §14 as *not claimed* and is not a condition on the
flip (`GH-DEC-2026-019` §4).