access-engine raised, and declined to solve locally, a hole in the split
GH-DEC-2026-005 ruled on. approval-claim verification item 4 is a
disjunction and neither limb delivers "approved for THIS request" on the
PDP path: limb one requires translating between two engines' vocabularies
and no mapping is published, limb two (pdp_digest) is optional. Where the
digest is absent a consumer can hold valid_now true, receive an ALLOW,
consume and act with nothing establishing that approval and decision
concern the same action and target.
Ruled: the PDP digest is the correspondence and is required on that path;
a claim without one fails closed; the native limb survives only for
consumers already in approval-engine's vocabulary, including T-06. No
mapping is published — a translation can be wrong while still producing a
confident answer, it fails open, it would be owned by neither engine, and
recomputing another layer's binding is the re-derivation GH-DEC-2026-005
already forbids. The cost is stated: an approval issued without a bound
CheckRequest is unusable on this path, which is correct behaviour.
Also: adopted hub row b606e8ce as canonical for GH-DEC-2026-005 rather
than registering a duplicate; recorded approval-engine's narrowing of the
approver-threshold consequence (distinctness is a UNIQUE storage
invariant, so the PEP stopped checking that the engine applied its own
invariant, not whether dual control could be forged); and drafted A7/T08,
a §11 marking obligation and §12 consumer rule for derived summaries,
after four instances in one week across four repositories.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtJBr77gMFLrN93iEevqQJ
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 425128@bnt-lap001
Assistant-Session: f5944d8b-dac4-4e1a-87eb-8b3d8f314a63
Exact normative text for all six amendments, section by section against
accepted v0.7, at docs/amendments/v0.8-amendment-set.md. Each carries its
defect statement, its replacement wording, and the decision or contract
that already governs its implementers — the statute move does not decide
any of them again.
A1 §9.7.3 corrects the consume ordering: v0.7's stated order leaves the
CAS able to prevent only the second record and never the second side
effect, which makes single consumption theatre. A2 adds the §11
emission-guarantee check so GH-IN-0001 cannot recur unnoticed. A3 keeps
the §13 tables and transcribes the four stance-map rows, ops-mason's gap
included, since the register migration is conditioned on an export. A4
lands the recomputability boundary with the criteria-grounding clause. A5
generalizes validation-by-owning-layer into §6.4 and adds the
validating-is-not-re-issuing demarcation to §8. A6 replaces §17's stale
"neither has assented" paragraph.
Deliberate omissions are recorded rather than left silent: §12's fourth
step is a status not an amendment, §16's reconciliation is assembly work,
and no §4 catalog row moves.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtJBr77gMFLrN93iEevqQJ
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 425128@bnt-lap001
Assistant-Session: f5944d8b-dac4-4e1a-87eb-8b3d8f314a63
Marking the 2026-08-29 review round read on the reasoning that v0.7's
acceptance closed it was an inference, not a check. This does the check:
fifteen findings and two answered questions from kings-guard, ops-warden,
access-engine and audit-core, each traced to v0.7 text or a decision
record rather than to the §15 change log.
All fifteen are dispositioned. None was silently dropped. The change log
deliberately is not the evidence — kings-guard's finding 1 was exactly
the case where the change log claimed a rule the body did not contain.
One item surfaced, and it is not a v0.6 finding: §17 still says
emission-cadence ownership is proposed and unassented, which
GH-DEC-2026-004 and the info-tech-canon and net-kingdom acceptances have
since made false. Tracked as GH-WP-0003-T07.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtJBr77gMFLrN93iEevqQJ
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 425128@bnt-lap001
Assistant-Session: f5944d8b-dac4-4e1a-87eb-8b3d8f314a63
approval-engine raised APPROVAL-IN-0002: secrets-engine's PEP validator
expects a flex-auth ActionAuthorization but fetches the approval-claim
endpoint that GH-DEC-2026-003 names as step 1. Two objects on one path.
GH-IN-0002 records the intake; GH-DEC-2026-005 resolves it. The claim is
the step-1 artifact and always was — ActionAuthorization is unratified,
has no valid_now field, and cannot be served from a step-1 call. The
addition beyond confirmation is doctrine: a PEP validates each artifact
against the layer that owns its data, and no PIP republishes the PDP's
decision. The provenance.authority == "state-hub" requirement is struck;
State Hub is a read model and holds no runtime approval authority.
docs/contracts/approval-consumption.md carries the amendment at the
sequence itself so implementers find it there.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtJBr77gMFLrN93iEevqQJ
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 425128@bnt-lap001
Assistant-Session: f5944d8b-dac4-4e1a-87eb-8b3d8f314a63
Adopt approval-engine's outbox wire as Gate House doctrine, specify the
heartbeat-and-reconciliation detection surface, and settle consumption
ordering: the PEP consumes by CAS before the side effect. T05's §11
check is written here and queued for statute v0.8.
Assistant: grok
Assistant-Session: 01a04d89-aaa5-7443-945e-b3055cd4b7e4
