coulomb/gate-house
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close the v0.8 assent round: two rulings, nine corrections, one decline

Browse source 
Four repositories returned text reviews. Every substantive finding was
about a rule that read as satisfied by a check that did not satisfy it,
which is the failure mode this repo is structurally prone to: doctrine
is graded on whether it is right and consumed on whether it is
checkable, and only the implementers can tell those apart.

GH-DEC-2026-010 — attribution is not identity. Obligation 1 said a PEP
must hold a decision from access-engine; obligation 2 supplied a digest
test emphatic that it was mechanical rather than a matter of judgement.
That test establishes which request a decision is for and nothing about
who issued it, and it cannot: every input to it is either sent by the
caller or published, so a responder knowing a published package id and
version returns a well-formed allow. Fail-closed protects against a
decision point that is absent, not against one that lies. Section 9.4
required authenticated entries of the approval object and nothing
required it of the decision, so obligation 5 was written over a pair a
PEP could only half validate. The mechanism is access-engine's under
section 17 and it is not the standard's to choose, so the condition is
a declared section 13 gap rather than a rule invented here. Raised by
access-engine against its own artifact, which had already recorded it
as its own defect before reading our text.

GH-DEC-2026-011 — ops-warden assented to GH-DEC-2026-009 on the
falsifier's own terms, went looking for the section 5.1 escape hatch
the reversal clause predicted, and reported it does not have one. Then
it priced adoption: 0 of 3 signing targets and 3 of 21 routing lanes
resolve to a zone, so the cell adopted today fails closed on nearly
every certificate it issues whenever the engine is unreachable —
including the continuity path an operator needs to repair that
unreachability. Its ask for a dated transitional unknown: fail_open is
declined; it is indistinguishable at runtime from the stance the rule
forbids and would make the rule optional at the only moment it costs
anything. Its second preference is adopted instead: 13.1 records a
dated coverage figure beside each stance, so a strict consumer and an
unclassified one stop reading alike. Coverage is disclosure and does
not soften the stance — the record says so, and says what would make
the column come out again.

The round record is closed and carries the rest: totality by catch-all,
absent versus unknown (closing the section 16 question this version
opened), the drift test promoted to MUST, ops-mason marked, and
approval-engine's four editorial-but-load-bearing findings. Its own
finding ids are used rather than renumbered.

kings-guard and audit-core did not return a review. Section 14 records
that as not claimed rather than counting silence as assent, and names
the sections that therefore carry no assent from the repository best
placed to test them.

Standard amended at net-kingdom@64394e9; it stays proposed, and
publication and the acceptance flip are net-kingdom's.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012viPor8WJNCbV64ipwewrm

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1754332@bnt-lap001
Assistant-Session: 9c8ac536-ff5e-46a3-8ab1-a548bde25fc0
This commit is contained in:
tegwick 2026-09-09 20:15:12 +02:00
parent a1a3294a6f
commit ddc1337a63
2 changed files with 533 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

330
decisions/decisions.md
View file

@ -1295,3 +1295,333 @@ was missing, and that combination is only survivable because the repositories
implementing it read it against their own fixtures rather than accepting it. The
defect was found in hours by the repository that would have been broken by it, and
reported by two others who had no obligation to look.
## GH-DEC-2026-010 — A PEP must be able to attribute a decision to access-engine; the digest test does not do it
```yaml
id: GH-DEC-2026-010
kind: decision
title: A PEP must be able to attribute a decision to access-engine; the digest test
does not do it
status: resolved
owner: Bernd Worsch
repo: gate-house
standard: net-kingdom/canon/standards/security-layer-model_v0.8.md
source_note: flex-auth FLEX-DEC-2026-010; approval-engine docs/reviews/2026-09-07-security-layer-model-v08.md
requested_dispositions:
- approved
- revised
- rejected
affects:
- gate-house
- net-kingdom
- access-engine
- approval-engine
- secrets-engine
- ops-warden
- ops-mason
- user-engine
- tenant-engine
- audit-core
decided_by: Bernd Worsch
rationale: 'Raised by access-engine against its own artifact during the v0.8 assent
round, having recorded it as its own defect (FLEX-DEC-2026-010) before reviewing
this text. Section 6.4 obligation 1 required a PEP to hold a decision from access-engine,
and obligation 2 supplied a test emphatic that it was mechanical rather than a matter
of implementer judgement. That test establishes which request a decision was rendered
for and nothing about who rendered it, and it cannot: every input to it is either
sent by the caller or published, so a responder knowing a published package id and
version reproduces all of it and returns a well-formed allow. Fail-closed protects
against a decision point that is absent, not against one that lies. The asymmetry
with obligation 5 is the sharp form, since section 9.4 requires the approval object
to have authenticated entries and nothing required it of the decision, leaving an
obligation written over a pair of artifacts satisfiable for only one half. The obligation
now requires attribution and states that the digest comparison does not discharge
it; the mechanism is the owner s under section 17 and the gap is declared in section
13 rather than papered by a rule the standard does not get to choose.'
created: '2026-09-09T18:11:20.071372Z'
updated: '2026-09-09T18:11:20.071372Z'
```
## Context
`access-engine` returned its v0.8 review on 2026-09-07 and ranked this finding
blocking for calling §6.4's PEP obligations complete — explicitly **not** blocking
anyone's adoption, since the condition already exists under v0.7 and v0.8 does not
create it. It had already recorded the defect against its own artifact as
`FLEX-DEC-2026-010`, with `FLEX-WP-0024` carrying the fix, before it read this text.
The finding is that the standard is not merely silent. Obligation 1 says a PEP must
hold *"a decision from `access-engine` identifying the request it was rendered for"*,
and obligation 2 supplies a test and is emphatic that it is not a judgement call:
replay is permitted iff the canonical request digest matches and the lifetime holds,
*"mechanical, not a matter of implementer judgement"*. A careful implementer reads the
mechanical test as discharging the obligation above it. It does not.
Every input to that comparison is either sent by the caller or published by the PDP.
The request material is what the PEP transmitted; `policy_package_digest` and
`registry_snapshot_digest` are computable from files in a public repository. A
responder that knows the package id and version — both published — reproduces all
three and returns a well-formed allow. Publishing more digests makes a forged envelope
look **more** authenticated, not less.
`secrets-engine` put the consequence better than either of us: its posture *"silently
assumes the PDP is the PDP"*. `approval-engine` carried it into the correspondence
chain — an approval whose `pdp_digest` matches a **forged** decision matches perfectly.
Identity comparison proves two artifacts describe one request. It proves nothing about
whether the decision is authentic.
**The gap was visible from inside and was recorded against the wrong artifact.** §16
already carried *"publication integrity of the Taxonomy layer itself… while its own
publication path has no digest, freeze, or rollback discipline"*. That is this
observation one layer up. Applied to the artifact the standard regulates rather than to
the standard, it is this decision.
## Decision
### 1. Attribution is required, and is a separate property from identity
**A PEP MUST hold a decision that is *attributable to* `access-engine`, not merely
present and well-formed.** Obligation 2's digest test establishes **which request** a
decision was rendered for. It establishes nothing about **who rendered it**.
**Obligation 1 is not discharged by a digest comparison**, and an implementer MUST NOT
read obligation 2's mechanical test as discharging it. This is the whole of the change:
the obligation stops reading as satisfied by a check that does not satisfy it.
### 2. Fail-closed does not reach this
§9.3's apparatus — two failure cases, two owners, published stance maps — addresses
**absence**. An unreachable PDP denies. A responder impersonating one allows. Nothing
in the standard addressed a responder, and no stance value can: the stance is consulted
when the engine is unreachable, and a lying responder is reachable by construction.
### 3. Obligation 5 was written over a pair it could only half satisfy
§9.4 requires the approval object to have *"durable, authenticated entries"*. §6.4
obligation 5 then requires that where a PEP's decision rests on more than one artifact,
each MUST be validated against the layer that owns its data — and names the
approval-claim / `DecisionEnvelope` pair as the live instance.
So the standard required authenticity of the **PIP's** artifact and not of the
**PDP's**, and wrote an obligation across both. That asymmetry was argued nowhere. It
is oversight, not position, and it is corrected here rather than defended.
### 4. The mechanism is not the standard's to choose
`access-engine` did not ask for a signature scheme in the statute, and it does not get
one. The shape is the owner's under §17. What the standard names is the property.
Until a mechanism ships, the condition is a **declared §13 gap** with `access-engine`
as owner (`FLEX-DEC-2026-010`, `FLEX-WP-0024`; `FLEX-DEC-2026-009` puts the
authenticated caller in provenance, so a record eventually attests both ends of the
channel rather than neither). A declared gap is honest. An unstated assumption inside a
test called mechanical is not.
## What this does not do
It does not close the gap. `access-engine`'s note that Glas completed operator
caller-auth mid-review is correctly self-limited: an authenticated API-server
port-forward authenticates the responder for one operator path and produces no signed
portable artifact.
It also does not create an adoption blocker. The condition predates v0.8 and every
PEP-shaped consumer is in it today. What changes is that they can now see they are.
## Reversal condition
If a PEP can verify the decision's origin by a mechanism that does not itself rest on
material the caller supplies or the PDP publishes openly, the §13 gap closes and this
record's second half becomes historical. The first half — that identity is not
attribution — does not revert; it is a property of hashing, not of the current channel.
## Provenance
Raised by `access-engine` (`FLEX-DEC-2026-011`, v0.8 assent, F1), against its own
artifact and having recorded the defect on its own side first. Independently framed by
`secrets-engine`. Carried into the correspondence chain by `approval-engine`, which
noted its own `docs/approval-claim.md` said what `pdp_digest` cannot cover without
saying it cannot detect a forged decision. Applied to
`security-layer-model_v0.8.md` §6.4 obligation 1 and §13 at `net-kingdom@64394e9`.
## GH-DEC-2026-011 — Classification coverage is published beside the stance; a transitional fail_open is declined
```yaml
id: GH-DEC-2026-011
kind: decision
title: Classification coverage is published beside the stance; a transitional fail_open
is declined
status: resolved
owner: Bernd Worsch
repo: gate-house
standard: net-kingdom/canon/standards/security-layer-model_v0.8.md
source_note: ops-warden history/2026-09-09-layer-model-v08-review.md @ 8e1b621; flex-auth
FLEX-DEC-2026-011 F2
requested_dispositions:
- approved
- revised
- rejected
affects:
- gate-house
- net-kingdom
- ops-warden
- ops-mason
- secrets-engine
- user-engine
- tenant-engine
- access-engine
- zone-engine
decided_by: Bernd Worsch
rationale: 'ops-warden assented to GH-DEC-2026-009 on its own terms and then reported
what adopting it costs: zero of three signing targets and three of twenty-one routing
lanes resolve to a zone, so unknown fail_closed adopted today would fail closed
on essentially every certificate it issues whenever access-engine is unreachable,
including the continuity path an operator needs to repair that unreachability. It
asked for a dated transitional unknown fail_open converting on coverage rather than
calendar. Declined: a sanctioned transitional fail_open is indistinguishable at
runtime from the stance the rule forbids and would make the rule optional at the
only moment it costs anything, while section 11 s declared-gap mark already expresses
a correct rule whose adoption is not yet affordable. Its second preference is adopted
instead. Section 13.1 records a dated classification-coverage figure beside each
stance, because unknown fail_closed over an entirely unclassified population is
conformant and materially misleading. access-engine reached the same place from
the other side: totality satisfied by a catch-all is satisfied vacuously, so a map
must enumerate its axis and an absent scope must be distinguishable in the record
from an unknown one and surface as a conformance failure.'
created: '2026-09-09T18:12:02.553370Z'
updated: '2026-09-09T18:12:02.553370Z'
```
## Context
`GH-DEC-2026-009` made `unknown` → `fail_closed` normative and made one cell of
`ops-warden`'s published stance map non-conformant. That ruling was circulated with
v0.8 rather than imposed, precisely because the repository bearing its cost had not
reviewed it. `ops-warden` returned the review on 2026-09-09
(`history/2026-09-09-layer-model-v08-review.md`, `8e1b621`).
**It assented to the rule, on the falsifier's own terms.** The reversal clause
anticipated that such a path would be a §5.1 read-only diagnostic carrying no PEP
obligation. `ops-warden` went looking for that escape hatch on its own side and
reported that it does not have one: the stance map governs exactly one protected
action, `warden sign`, which is a credential-issuing side effect that §5.1 does not
reach. The predicted defence is absent and the argument stands unrebutted.
**Then it priced the adoption.** Measured 2026-09-09:
```text
signing targets (actor resources in snapshot): 0 resolved, 3 unknown, 1 n/a
routing catalog lanes: 3 resolved, 18 unknown, 12 n/a
```
Zero of its signing targets resolve to a zone. So `unknown` → `fail_closed` adopted
today does not fail closed on an edge case; it fails closed on essentially every
certificate `ops-warden` issues, whenever `access-engine` is unreachable. That is the
configuration `ADR-0006` rejected, reached by another route: one value making the
decision engine a uniform dependency of every signing path, **including the continuity
path needed to repair that dependency**. Engine down → operator needs an SSH
certificate to reach the host and restore it → the repair target is unknown because
nobody classified it → denied.
Eighteen of its eighteen unknown lanes are unknown because **another** repository has
not published a workload-identity declaration, and `ADR-0009` rule 3 forbids closing
that by inference.
`access-engine` arrived at the same register from the opposite side (`FLEX-DEC-2026-011`,
F2): a map carrying `unknown` → `fail_closed` satisfies obligation 3's totality
requirement **vacuously**. Every scope the author never enumerated lands in `unknown`,
fails closed, and nobody ever learns which those were. It recognised the shape because
it published it — `FLEX-DEC-2026-008`, a policy package shipped with no tenant rule at
all while 29 fixtures passed, because every fixture carried the same tenant.
## Decision
### 1. A dated transitional `unknown: fail_open` is declined
`ops-warden`'s first preference was that obligation 3 name a transition: a consumer may
declare `unknown: fail_open` as a dated, published transitional state with a coverage
figure attached, converting on coverage rather than on calendar.
**Declined.** A sanctioned transitional `fail_open` is indistinguishable at runtime from
the stance the rule forbids. It makes the rule optional at the moment of adoption — the
only moment it costs anything — and `unknown` is the cheapest state for an attacker to
induce whether or not the consumer has dated its intention to stop being permissive.
The mechanism asked for already exists and does not have that defect: §11's
**declared-gap** mark says *"correct rule, adoption not yet affordable"* without
inverting the rule's effect. `ops-warden` proposed exactly that as its own second
preference and named `WARDEN-WP-0040` as the route.
The deadlock is real and the answer is classification, not a permissive axis: continuity
paths are classified into a scope whose stance is open, and the deadlock does not arise.
`ops-warden` accepted that answer and correctly observed that it is work not yet done.
Work not yet done is a gap. It is not a reason to hold the axis open.
**And a stricter stance is not a licence to manufacture the membership that makes it
survivable.** `ADR-0009` rule 3 is right and must hold under pressure from this ruling.
A consumer MUST NOT infer a scope another repository has not declared.
### 2. Classification coverage is published beside the stance
**§13.1 records a dated classification-coverage figure for each consumer.** A row
reading `unknown` → `fail_closed` while 100% of that consumer's targets are unknown is
conformant and materially misleading: a reader cannot distinguish a strict consumer from
an unclassified one. It is §11's published-map-equals-shipped-behaviour rule one level
up — the map becomes accurate about itself and inaccurate about its effect.
Coverage is **disclosure, not a licence**. It does not soften the stance, gate it, or
create a state in which a non-conformant cell becomes conformant. It reports.
Coverage is reported by the consumer and never computed here. A blank means *"not
reported"*, never *"complete"*.
### 3. A map must enumerate its axis; `absent` is not `unknown`
**Totality MUST NOT be satisfied by a catch-all.** A published map enumerates the axis
it scopes over. Otherwise obligation 3's totality requirement is unfalsifiable and its
drift test passes by exercising the default rather than the axis.
**`unknown` and `absent` are one runtime behaviour and two meanings.** Both fail closed
— `absent` for the stronger reason, since it is the branch reached by discovering that
the author's model of their own axis was wrong, and §8's asymmetry forbids being more
permissive on surprise. But an `unknown` hit is normal operation under a considered
stance, while an `absent` hit is evidence this obligation is violated. **An `absent` hit
MUST be distinguishable in the record and MUST surface as a conformance failure** rather
than be absorbed by the catch-all.
This closes the question §16 opened at the v0.8 cut.
### 4. `ops-mason` is marked
An unpublished stance map is a plainer violation of obligation 3 than a wrongly-valued
cell in a published one, and §13.1 stated it as bare fact while bolding the other. A
reader scanning for marks found one row and concluded the other four were fine. That is
Gate House's own §11 marking obligation applied to Gate House's own register, returned
unchanged by `access-engine` after receiving the same argument about a stale row of its
own. `ops-mason`'s row is now marked, with no route recorded.
## Reversal condition
If a consumer demonstrates a scope that is genuinely unclassifiable, genuinely
low-consequence, and whose permissive resolution cannot be induced by an unprivileged
party, §1 is open to revision — that falsifier is `GH-DEC-2026-009`'s and survives here.
`ops-warden` went looking for it and reported its absence, which is evidence and not
proof.
§2 reverses if coverage figures start being read as a stance qualifier rather than as
disclosure. If a row is ever argued to be conformant *because* its coverage is low, the
column is doing harm and comes out.
## Provenance
Raised by `ops-warden` (v0.8 assent, two findings and one agreement), which bears the
entire cost of the ruling it assented to and asked for the transition it did not get.
Its measured figures are the first entries in the coverage column. §3 raised by
`access-engine` (`FLEX-DEC-2026-011`, F2); §4 by `access-engine` (F4). Applied to
`security-layer-model_v0.8.md` §6.4 obligation 3 and §13.1 at `net-kingdom@64394e9`.
`access-engine` added, unprompted, that its concurrence with `GH-DEC-2026-009` cost it
nothing — it is not PEP-shaped and publishes no stance map — and that a PDP's assent to
a ruling falling entirely on other repositories is weak evidence for it. That is
recorded because it is right: the strength here is the asymmetry argument and
`ops-warden`'s assent against its own interest, not the count of repositories agreeing.

214
docs/conformance/2026-09-06-v08-assent-round.md
View file

@ -2,9 +2,9 @@
**Repository:** gate-house
**Project family:** NetKingdom security layer
**Status:** open — round in progress
**Version:** 0.1
**Date:** 2026-09-06
**Status:** closed — all findings dispositioned; publication handed to `net-kingdom`
**Version:** 0.2
**Date:** 2026-09-09
**Subject:** `net-kingdom/canon/standards/security-layer-model_v0.8.md` (proposed)
**Workplan:** `GH-WP-0003-T06`
@ -19,6 +19,11 @@ attack, rather than sent a summary to nod at.
## Findings returned
*`F`-numbers are this record's own, assigned in the order findings arrived;
`F-A` numbers are `approval-engine`'s. Where a reporter's own finding id is cited it is
named as theirs. `F1`–`F4` arrived before the round properly opened; `F5` onward came
from the full text reviews.*
### F1 — `GH-DEC-2026-008` was unimplementable as written · **adopted, corrected**
Reported by `access-engine`, independently by `approval-engine`, originally found by
@ -35,7 +40,9 @@ the digest of a document containing that claim.
The ruling's own fail-closed requirement is what would have made it harmful rather
than merely wrong — the rule and the failure mode compounded instead of cancelling.
**Disposition.** Ruling stands; its four obligations stand; obligation 1's comparison
**Disposition.** Ruling stands; its obligations stand (this record said *"its four
obligations stand"* in v0.1, written after obligation 5 was added — the propagation
`approval-engine` cites in F-A2b below, corrected here rather than only at the source); obligation 1's comparison
target is corrected to the PDP's published exclusion-scoped digest
(`binding.approval_binding_digest`, `FLEX-DEC-2026-007`). v0.8 §9.7.3 rewritten. A
consumer MUST NOT guess the exclusion rule, and until a PDP publishes one the path is
@ -74,6 +81,162 @@ imposing it.
and notes the §11 marking obligation would have caught the source: the stale G3 row in
its own 2026-08-29 review, handed on as current. No change.
### F5 — attribution is not identity · **adopted, `GH-DEC-2026-010`**
Reported by `access-engine` (`FLEX-DEC-2026-011`, ranked blocking for calling §6.4's
obligations complete, explicitly not blocking adoption), against its own artifact and
recorded on its own side as `FLEX-DEC-2026-010` before it read this text. Framed
independently by `secrets-engine` and carried into the correspondence chain by
`approval-engine`.
§6.4 obligation 1 required a PEP to hold *"a decision from `access-engine`"*, and
obligation 2 supplied a digest test emphatic that it was mechanical rather than a
matter of implementer judgement. That test establishes **which request** a decision is
for and nothing about **who issued it**, and it cannot: every input is either sent by
the caller or published, so a responder knowing a published package id and version
returns a well-formed allow. Publishing more digests makes a forgery look more
authenticated, not less.
**Fail-closed protects against a decision point that is absent, not against one that
lies.** And §9.4 requires authenticated entries of the *approval* object while nothing
required it of the *decision*, so obligation 5 was written over a pair of artifacts
whose authenticity a PEP could validate for only one half.
**Disposition.** Adopted. Obligation 1 now requires attribution and states that the
digest comparison does not discharge it; the mechanism is the owner's under §17 and the
condition is a declared §13 gap with `access-engine` as owner. Ruled in
`GH-DEC-2026-010`. Note that §16 had already recorded this observation one layer up,
against this standard's own publication path — the gap was visible from inside and
recorded against the wrong artifact.
### F6 — totality by catch-all; `absent` is not `unknown` · **adopted, `GH-DEC-2026-011` §3**
`access-engine`, as its own F2. A map carrying `unknown` → `fail_closed` satisfies obligation 3's
totality requirement vacuously: every scope never enumerated lands in the catch-all,
fails closed, and nobody learns which those were, while the drift test passes by
exercising the default rather than the axis. Recognised from its own
`FLEX-DEC-2026-008` — a package shipped with no tenant rule while 29 fixtures passed,
because every fixture carried the same tenant.
**Disposition.** Adopted. A map MUST enumerate its axis; an `absent` hit MUST be
distinguishable in the record from an `unknown` hit and MUST surface as a conformance
failure. Runtime behaviour is unchanged — `absent` fails closed too, for the stronger
reason. This closes the §16 question opened at the cut.
### F7 — the drift test was a `SHOULD` · **adopted**
`access-engine`, as its own F3. The strongest obligation in §6.4 had the weakest verification, in
a paragraph arguing that a map free to drift is worse than none. Promoted to `MUST`;
already met by four of five §13.1 rows, so it costs nothing.
### F8 — `§13.1` marked one violation and not the plainer one · **adopted**
`access-engine`, as its own F4. `ops-warden`'s row was bolded non-conformant for a wrongly-valued
cell; `ops-mason`'s *"not published"* was stated as bare fact, though an unpublished map
is the plainer violation of the same obligation. Gate House's own §11 marking
obligation applied to its own register, returned unchanged by the repository it had
made the same argument to. `ops-mason` is now marked.
### F9 — the adoption cost of `GH-DEC-2026-009` · **split: ask 1 declined, ask 2 adopted**
`ops-warden`, assenting to the rule on the falsifier's own terms — it went looking for
the §5.1 read-only escape hatch the reversal clause predicted and reported that it does
not have one, since the map governs `warden sign`, a credential-issuing side effect.
Then it priced adoption: 0 of 3 signing targets and 3 of 21 routing lanes resolve to a
zone, so the cell adopted today fails closed on essentially every certificate it issues
whenever the engine is unreachable — including the continuity path an operator needs to
repair that unreachability. Eighteen of eighteen unknown lanes are unknown because
another repository has published no workload-identity declaration.
**Disposition.** Ask 1 (a dated transitional `unknown: fail_open`) **declined**: it is
indistinguishable at runtime from the stance the rule forbids and makes the rule
optional at the only moment it costs anything. Ask 2 **adopted**: §13.1 records a dated
coverage figure beside each stance. Ruled in `GH-DEC-2026-011`, which also records that
`ADR-0009` rule 3's prohibition on inferring membership holds under this pressure.
`ops-warden` also confirmed §12's derived-artifact rule against its own
`catalog_revision` / `catalog_dirty` practice, and agreed with refusing a forced
migration onto zones. No change requested for either.
### F-A1 — §15 item 2b's numbering made §14's tally uncheckable · **adopted**
`approval-engine`. The change list contained an item numbered 2b, and §14 claimed *"ten
of this version's eleven changes were requested by another repository"* with §17 as the
single exception — a tally that only holds if 2b is a sub-clause rather than a change,
and 2b is the one item explicitly described as *not* a request. So if 2b counts, both
halves move: ten of twelve, two exceptions.
**Disposition.** Adopted, promoted. 2b counts as a change in its own right and is the
second exception; §14 restates the ratio. The label `2b` is retained rather than
renumbered so that references written against this list do not silently repoint. The
finding is well aimed: §14 offers the ratio as the *argument* for circulating rather
than accepting, and invites the reader to count.
`approval-engine` also recorded two candidates it checked and **dropped** — §15 change
9's "+3 rows" (correct against v0.7's two) and §11's "three times"/"four times"
(different corrections in sequence). A finding count means nothing without the count
checked and discarded.
### F-A2 — §6.4 announced four obligations and listed five · **adopted**
`approval-engine`. v0.7 said "Four" and listed 1–4; v0.8 added obligation 5 and left the
count. Not a typo with cosmetic consequences: obligation 5 carries
correspondence-by-identity, the PIP/PDP separation, the replay-identity property, and
the summary-predicate trust rule — the obligation the whole `GH-DEC-2026-003` / `-005` /
`-008` chain rests on. An implementer reading *"the four obligations of §6.4"* has a
defensible reading under which it implements 1–4 and omits the one governing how an
approval is compared to a decision. Corrected.
### F-A2b — the miscount had already propagated · **adopted, corrected in place**
`approval-engine` observed that Gate House's own 2026-09-06 message said *"the ruling
stands and its four obligations stand"* — written after obligation 5 was added, by the
section's author. That is the evidence the count sentence was doing work rather than
decorating. The same sentence appeared in v0.1 of this record and is corrected above.
An estate-wide grep for other references found only historical ones, in the v0.6 and
v0.7 change logs where "four" is accurate for those versions.
### F-A3 — §17's artifact count contradicted its own body · **adopted**
`approval-engine`. §17 said *"four artifacts are therefore required, owned by
Taxonomy"* while its body says plainly that the decision-record schema is not
Taxonomy's, and a second — the emission-cadence declaration — is assigned to
`info-tech-canon` and `net-kingdom` and accepted in their own voice. The closing
paragraph then called three artifacts' ownership *"still proposed"* and settled one of
them in the same sentence. v0.8's own change item 10 claimed §17's stale paragraph was
corrected; the correction reached the emission-cadence paragraph and not the count.
**Disposition.** Adopted. Exactly two artifacts are unsettled — request-claim and
gap-record. The finding matters because `access-engine` took the decision-record schema
on **against its own interest**, and a stale paragraph was quietly undoing that.
### F-A4 — the §19 hole is explained where nobody looks · **adopted**
`approval-engine`, marked minor. Headings ran §18 → §20 with the explanation in a §16
bullet. The removal was right and is not asked back — a grade inside a standard of
record becomes normative by adjacency — but a reader scanning structure cannot tell
whether an edit dropped a section. A stub now sits at the boundary.
### N1 — `net-kingdom` corrected §11 in its own voice · **accepted as landed**
§17 confirmed unchanged: the profile assigns `info-tech-canon` the generic
`EmissionCadenceDeclaration` contract and `net-kingdom` the MUST/SHOULD split, the
rare-class rate-monitoring prohibition, and the heartbeat-plus-reconciliation
obligation. The `ITC-WP-0018` / `NK-WP-0035` acceptance record is accurate.
§11 diverged in both directions and was corrected in place at `net-kingdom@da7747d`, as
invited. As cut it required *"heartbeat or reconciliation"* of every load-bearing
source: that withholds from a **volume** class the expected-rate form the profile
permits, and accepts for a **rare** class either control alone where the profile
requires both. The conjunction is load-bearing — a rare class with a heartbeat alone has
no reconciliation to catch divergence, and one with reconciliation alone produces no
claim that can itself go missing, which is why §9.6 rejects rate monitoring there. §11
also contradicted its own next paragraph. The item now defers form to the governing
profile and adds that classification is the source's published inventory, never the
checker's to infer from an event name, payload, or observed rate — without which
omission detection is circular.
## Implementation ahead of acceptance
Both engines implemented against the ruling before the round closed.
@ -90,15 +253,26 @@ Both engines implemented against the ruling before the round closed.
manufactured a statement no requester made, which is `GH-DEC-2026-008`'s own
objection to translation in another form.
## Still outstanding
## Round closed
`ops-warden` (the `unknown` cell it acquires), `kings-guard` (the criteria-grounding
clause, and whether §12's step-four paragraph is now stale), `audit-core` (whether
§11's emission-guarantee wording lets a source imply completeness), `net-kingdom`
(whether §17 says what it would say in its own voice, and whether §11 tracks its
published profile).
All findings above are dispositioned. Nine corrections landed in the text during
circulation (§15 items 12–20 at `net-kingdom@64394e9`); one request was declined with
its reasons stated in §6.4 rather than only here.
## What the round has shown so far
**Two circulated repositories did not return a text review: `kings-guard` and
`audit-core`.** The sections each was asked to attack — §9.5's criteria-grounding clause
and whether §12's step-four paragraph is now stale for the first, whether §11's
emission-guarantee wording lets a source imply completeness for the second — therefore
carry no assent from the repository best placed to test them. §14 records that as *not
claimed* rather than treating silence as assent. `approval-engine` did the same thing
voluntarily, naming the sections it did **not** read (§1–§4, §7, §8, §9.1–§9.2,
§9.5–§9.6, §9.8, §10, §18, §20) so a three-finding review would not read as a clean
bill.
Publication and the acceptance flip are `net-kingdom`'s and were handed over on round
close. v0.7 stays `accepted` and in force until then, unpatched.
## What the round showed
The first finding against v0.8 was a rule that was **right and unimplementable**, and
it was found by the repository that would have been broken by it, then reported by two
@ -110,3 +284,21 @@ It is also an argument for the round itself. `GH-DEC-2026-008` was correct in
substance, argued from doctrine, and verified against another repository's schema
before it was issued. None of that caught a defect that three repositories found in
hours of trying to build on it.
Closed, the round says something narrower and worse. **Every substantive finding was
about a rule that read as satisfied by a check that did not satisfy it.** Obligation 1
read as discharged by a digest comparison establishing something else. Obligation 3's
totality read as satisfied by a catch-all that measured nothing. Obligation 3's drift
test read as required and was optional. §17's status paragraph read as open on a
question its own body had settled. §6.4's count sentence read as complete at four while
five were listed. None was a wrong rule; each was a correct rule a careful implementer
could satisfy without doing the thing it exists to require.
That is a failure mode this repository is structurally prone to, because doctrine is
graded on whether it is *right* and consumed on whether it is *checkable*. Only the
implementers can tell the two apart, and every one of these came back from a repository
reading the text against its own code rather than against its own opinion.
**Two repositories did not return one, and the standard now says so in §14 rather than
counting silence as assent.** A round whose value is that it catches this class is worth
exactly what it covers, and it did not cover §9.5 or §11's emission wording.