coulomb/gate-house
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Publish approval evidence-integrity contracts for GH-WP-0002

Browse source 
Adopt approval-engine's outbox wire as Gate House doctrine, specify the
heartbeat-and-reconciliation detection surface, and settle consumption
ordering: the PEP consumes by CAS before the side effect. T05's §11
check is written here and queued for statute v0.8.

Assistant: grok
Assistant-Session: 01a04d89-aaa5-7443-945e-b3055cd4b7e4
This commit is contained in:
tegwick 2026-08-29 14:51:53 +02:00
parent 2ae611d2ad
commit 7408ff9234
5 changed files with 441 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

30
workplans/GH-WP-0002-approval-evidence-integrity.md
View file

@ -45,8 +45,8 @@ state_hub_task_id: "73a8feb0-02bd-5191-bdfd-82bcc42c6756"
Specify the transactional-outbox contract for `approval-engine`: same
transaction as the object mutation, queue local to the engine, at-least-once
into the outbox since `audit-core` dedupes on event id and a replay does not
fork the chain. Boundary and locality are in `approval-engine/INTENT.md` and
§9.4; the wire contract is not yet written.
fork the chain. Done — `docs/contracts/approval-outbox.md` adopts
`approval-engine`'s wire (`docs/outbox-contract.md`) as Gate House doctrine.
```task
id: GH-WP-0002-T03
@ -56,10 +56,10 @@ state_hub_task_id: "1fc8fd3c-7af4-50e7-a07c-f45016f8b1f3"
```
Decide the revocation failure mode explicitly: fail closed, or proceed with a
detectable gap. Both are defensible; undecided is not, and an implementation
accident is the worst outcome. Note v0.5's local-outbox rule narrows this
considerably — fail-closed now triggers only when the engine's own store is
down — but the ruling is still owed.
detectable gap. Done — GH-DEC-2026-002. Fail-closed only when
`approval-engine`'s own store cannot insert the outbox row. An `audit-core`
outage MUST NOT block a revocation. Synchronous emission inside the mutation
is forbidden. Proceed-with-gap is rejected for load-bearing approval evidence.
```task
id: GH-WP-0002-T04
@ -70,8 +70,11 @@ state_hub_task_id: "3d62dbf9-786e-58c1-bd87-fb43658ca865"
Give the gap a detection surface: outbox depth and age, or reconciliation of
`approval-engine` object counts against `audit-core` event counts per class.
Today nothing would surface a silent loss. Relate to §9.6's silence-as-signal
rule, which `kings-guard` offered to implement at its own layer.
Done — `docs/contracts/approval-emission-detection.md`. Form is heartbeat plus
reconciliation, not rate monitoring; lag bounds on outbox depth and age.
`approval-engine/cadence.yaml` is the reference source declaration.
`kings-guard` remains the observer; until it reports watching in production,
the declaration is still required.
```task
id: GH-WP-0002-T05
@ -82,6 +85,11 @@ state_hub_task_id: "2a2a73ea-2778-59d2-94ef-7a70a22bb169"
Add a §11 conformance check so the next engine catalogued as an evidence source
declares its emission guarantee rather than reintroducing this silently.
Done as doctrine — the check is the last section of
`docs/contracts/approval-emission-detection.md`. Queued for statute v0.8 §11
rather than patched into accepted v0.7. Load-bearing sources declare a local
outbox plus heartbeat-or-reconciliation; attributive non-atomic sources declare
the trade and do not claim completeness.
```task
id: GH-WP-0002-T06
@ -93,5 +101,7 @@ state_hub_task_id: "250cb9b3-713d-5607-ad1b-225e339693bf"
Settle the consumption ordering contract between `approval-engine` and
`access-engine` — who signals consumed, at what point relative to the decision,
and the handling of an allow never consumed, a double consumption by racing
callers, and consumption after a failed action. Raised by `flex-auth`; required
before `FLEX-WP-0017` T05. Recorded unresolved in `approval-engine/INTENT.md`.
callers, and consumption after a failed action. Done — GH-DEC-2026-003 and
`docs/contracts/approval-consumption.md`. The PEP consumes by CAS before the
side effect; the PDP never mutates; there is no unconsume. Unblocks
`APPROVAL-WP-0001-T05` and `FLEX-WP-0017-T05`.