coulomb/gate-house
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Publish approval evidence-integrity contracts for GH-WP-0002

Browse source 
Adopt approval-engine's outbox wire as Gate House doctrine, specify the
heartbeat-and-reconciliation detection surface, and settle consumption
ordering: the PEP consumes by CAS before the side effect. T05's §11
check is written here and queued for statute v0.8.

Assistant: grok
Assistant-Session: 01a04d89-aaa5-7443-945e-b3055cd4b7e4
This commit is contained in:
tegwick 2026-08-29 14:51:53 +02:00
parent 2ae611d2ad
commit 7408ff9234
5 changed files with 441 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

57
history/2026-08-29-approval-evidence-integrity-contracts.md Normal file
View file

@ -0,0 +1,57 @@
# Approval evidence integrity — contracts and rulings
**Recorded:** 2026-08-29
**Workplan:** GH-WP-0002
**Audience:** approval-engine, access-engine / flex-auth, audit-core, kings-guard, secrets-engine, ops-warden
**Status:** Reference note. The normative artifacts are the contracts under
`docs/contracts/` and the decision records GH-DEC-2026-002 and GH-DEC-2026-003.
---
## Why this landed as contracts, not a statute bump
`approval-engine` shipped the object, the local outbox, and a cadence
declaration, and stopped at a public consume because GH-WP-0002-T06 was unset.
`FLEX-WP-0017-T05` is wait on the same unset. The workplan's remaining tasks
were doctrine, not another version of the layer model.
v0.7 stays the accepted statute. Two protocol clarifications and one §11
bullet are queued for v0.8 rather than silently rewritten into an accepted
text:
1. §9.7.3 — consumption is never inferred from a decision record (stands);
the PEP consumes *before* the protected side effect (clarifies the
protocol the paragraph currently implies the other way).
2. §16 — "who marks an approval consumed" is no longer open.
3. §11 — evidence sources declare their emission guarantee (GH-WP-0002-T05).
Inbox items that also belong in v0.8 (pep-stance inventory rows, the §13
table becoming a pointer into `maturity-engine`, `railiance-master`'s own-voice
declaration) are not mixed into this workplan.
## What each task produced
| Task | Artifact |
| --- | --- |
| T02 | `docs/contracts/approval-outbox.md` — adopts `approval-engine`'s wire |
| T03 | GH-DEC-2026-002 — fail-closed only on the local store |
| T04 | `docs/contracts/approval-emission-detection.md` — heartbeat + reconciliation |
| T05 | detection contract, last section — queued for v0.8 §11 |
| T06 | `docs/contracts/approval-consumption.md` and GH-DEC-2026-003 |
## The two rulings in one line each
- **Revocation:** if the local outbox insert cannot commit, the revocation
does not commit. An `audit-core` outage MUST NOT block a revocation.
Synchronous emission to `audit-core` inside the mutation is forbidden.
- **Consumption:** the PEP consumes by CAS before the side effect. The PDP
never mutates. There is no unconsume. Same-digest retry is idempotent;
a different digest against a consumed object is conflict.
## Assent still required of the implementers, not of the estate
These contracts bind `approval-engine` and `access-engine` because they asked
for them and were blocked on them. They do not move a vocabulary away from a
repository that currently uses it, so they do not follow the GH-DEC-2026-001
assent pattern. Contest is still welcome: a protocol that cannot be
implemented is a success of the loop, not a courtesy.