# Approval evidence integrity — contracts and rulings

**Recorded:** 2026-08-29
**Workplan:** GH-WP-0002
**Audience:** approval-engine, access-engine / flex-auth, audit-core, kings-guard, secrets-engine, ops-warden
**Status:** Reference note. The normative artifacts are the contracts under
`docs/contracts/` and the decision records GH-DEC-2026-002 and GH-DEC-2026-003.

---

## Why this landed as contracts, not a statute bump

`approval-engine` shipped the object, the local outbox, and a cadence
declaration, and stopped at a public consume because GH-WP-0002-T06 was unset.
`FLEX-WP-0017-T05` is wait on the same unset. The workplan's remaining tasks
were doctrine, not another version of the layer model.

v0.7 stays the accepted statute. Two protocol clarifications and one §11
bullet are queued for v0.8 rather than silently rewritten into an accepted
text:

1. §9.7.3 — consumption is never inferred from a decision record (stands);
   the PEP consumes *before* the protected side effect (clarifies the
   protocol the paragraph currently implies the other way).
2. §16 — "who marks an approval consumed" is no longer open.
3. §11 — evidence sources declare their emission guarantee (GH-WP-0002-T05).

Inbox items that also belong in v0.8 (pep-stance inventory rows, the §13
table becoming a pointer into `maturity-engine`, `railiance-master`'s own-voice
declaration) are not mixed into this workplan.

## What each task produced

| Task | Artifact |
| --- | --- |
| T02 | `docs/contracts/approval-outbox.md` — adopts `approval-engine`'s wire |
| T03 | GH-DEC-2026-002 — fail-closed only on the local store |
| T04 | `docs/contracts/approval-emission-detection.md` — heartbeat + reconciliation |
| T05 | detection contract, last section — queued for v0.8 §11 |
| T06 | `docs/contracts/approval-consumption.md` and GH-DEC-2026-003 |

## The two rulings in one line each

- **Revocation:** if the local outbox insert cannot commit, the revocation
  does not commit. An `audit-core` outage MUST NOT block a revocation.
  Synchronous emission to `audit-core` inside the mutation is forbidden.
- **Consumption:** the PEP consumes by CAS before the side effect. The PDP
  never mutates. There is no unconsume. Same-digest retry is idempotent;
  a different digest against a consumed object is conflict.

## Assent still required of the implementers, not of the estate

These contracts bind `approval-engine` and `access-engine` because they asked
for them and were blocked on them. They do not move a vocabulary away from a
repository that currently uses it, so they do not follow the GH-DEC-2026-001
assent pattern. Contest is still welcome: a protocol that cannot be
implemented is a success of the loop, not a courtesy.