coulomb/gate-house
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Complete GH-WP-0001-T05 doctrine blueprint recut

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a05e30-2884-71b0-98d7-7edd16ae737b
This commit is contained in:
tegwick 2026-09-01 20:32:13 +02:00
parent 3b927287d0
commit a4066aadb5
6 changed files with 577 additions and 2446 deletions
Download patch file Download diff file Expand all files Collapse all files

39
CLAUDE.md
View file

@ -51,12 +51,12 @@ estate's layering rule:
use cases `UC-01`…`UC-05`, success criteria. This is the "why".
3. **`decisions/decisions.md`** — decision records. GH-DEC-2026-001 ratifies the layer
model, the re-cut, and the access-engine reframing. Binding.
4. **`ArchitectureBlueprint.md`** — **predates the re-cut and is only partly valid.** Its
component architecture (§10–11), policy evaluation order (§13), API surface (§26), and
storage model (§25) describe an engine and are withdrawn; ADR-003 and milestones M0, M3,
M4 have lapsed. Its domain model (§6), authority context (§7), operating modes (§14–15),
change dynamics (§20), MCP integration (§19), and security test program (§34) survive.
Do not cite it without checking a section against INTENT first.
4. **`ArchitectureBlueprint.md`** — the current doctrine architecture: responsibility
boundaries, domain model, authority context, operating modes, posture and credential
contracts, MCP doctrine, change dynamics, audit, invariants, and conformance. The
withdrawn v0.1 authority-plane design is mapped in
`history/2026-09-01-authority-plane-blueprint-retirement.md` and remains available at
Git object `75ce372:ArchitectureBlueprint.md` for historical review only.
5. **`README.md`** — public-facing summary. A derivative, not a source of truth.
When these conflict: the decision record wins over everything, then the Canon, then INTENT,
@ -75,7 +75,7 @@ repositories implement them. A document or proposal that violates one is wrong:
- **Principal, actor, and runtime identity stay distinct** and are never collapsed into one
field. Delegation attenuates and never widens.
- **Posture may only restrict.** King's Guard (or any adaptive input) can reduce authority or
demand step-up; it can never manufacture privilege. See Blueprint §16.2 for the explicitly
demand step-up; it can never manufacture privilege. See Blueprint §8 for the explicitly
forbidden pattern.
- **Evaluation is monotonic toward restriction.** No stage after the authority ceiling may
expand beyond it. (Evaluation itself is access-engine's; Gate House states the property.)
@ -115,8 +115,9 @@ the file, commit, then sync. `SCOPE.md` is derived from `INTENT.md` — keep the
## Conventions
- **Stable identifiers.** Invariants (`INV-nn`, `A-nn`), tests (`T-nn`), use cases (`UC-nn`),
ADRs (`ADR-nnn`), and milestones (`M0`–`M8`) are referenced across documents. Reuse the
existing id when writing about a concept; append rather than renumber.
and ADRs (`ADR-nnn`) are referenced across documents. Reuse the existing id when writing
about a concept; append rather than renumber. The v0.1 milestones (`M0`–`M8`) are
historical and must not be revived as Gate House implementation milestones.
- **Canon prose is normative** — preserve MUST/SHOULD/MAY exactly when editing it.
- **Domain vocabulary is fixed** by INTENT's Domain Vocabulary: principal, actor, runtime
identity, mandate, delegation, authority ceiling, operating mode, posture, change dynamics
@ -132,12 +133,12 @@ the file, commit, then sync. `SCOPE.md` is derived from `INTENT.md` — keep the
## Where new work goes
- `README.md`, `INTENT.md`, and `ArchitectureBlueprint.md` live at the repo root, matching the
Blueprint's own reference layout (§32). External standards Gate House conforms to — the
Canon — live in `spec/`.
- ADRs → `docs/adr/`, from the Blueprint §40 backlog. ADR-003 (policy engine selection) has
lapsed with the re-cut; ADR-001, ADR-002, ADR-006, ADR-009, ADR-010, ADR-013, ADR-014
remain meaningful as contract and doctrine.
- `README.md`, `INTENT.md`, and `ArchitectureBlueprint.md` live at the repo root. External
standards Gate House conforms to — the Canon — live in `spec/`.
- ADRs → `docs/adr/`, with disposition recorded in Blueprint §17. ADR-003
(policy engine selection) has lapsed with the re-cut; ADR-001, ADR-002,
ADR-006, ADR-009, ADR-010, ADR-013, ADR-014 remain meaningful as contract and
doctrine.
- Decision records → `decisions/decisions.md`, via `rmgr decision create|resolve`. Never
hand-write the YAML block; the tool mints identifiers and commits.
- History and reference notes → `history/YYYY-MM-DD-<slug>.md`, matching the convention in
@ -147,10 +148,10 @@ the file, commit, then sync. `SCOPE.md` is derived from `INTENT.md` — keep the
2026-08-29 after seven versions; four repositories assented and each returned findings
that changed it. Its working form is `net-kingdom/SECURITY-COMPANION.md` — read that
first. For how to get something done in the estate, ask ops-warden, not this repo.
- **No implementation layout.** Blueprint §32's reference tree (`api/`, `policy/`, `grants/`,
`deploy/`, …) described the withdrawn engine and does not apply. If work here starts
producing services, schemas that resolve, or anything evaluated at request time, stop —
that belongs to an engine.
- **No implementation layout.** The v0.1 Blueprint's reference tree (`api/`,
`policy/`, `grants/`, `deploy/`, …) described the withdrawn engine and does
not apply. If work here starts producing services, schemas that resolve, or
anything evaluated at request time, stop — that belongs to an engine.
- Assurance tests `T-01`…`T-10` are **specifications** authored here and executed by
whitehat-security. Writing the specification is Gate House's job; running the attack and
judging whether the control held is not.