tegwick 7408ff9234 Publish approval evidence-integrity contracts for GH-WP-0002

Adopt approval-engine's outbox wire as Gate House doctrine, specify the
heartbeat-and-reconciliation detection surface, and settle consumption
ordering: the PEP consumes by CAS before the side effect. T05's §11
check is written here and queued for statute v0.8.

Assistant: grok
Assistant-Session: 01a04d89-aaa5-7443-945e-b3055cd4b7e4

2026-08-29 14:51:53 +02:00

2.7 KiB

Raw Permalink Blame History

Approval evidence integrity — contracts and rulings

Recorded: 2026-08-29 Workplan: GH-WP-0002 Audience: approval-engine, access-engine / flex-auth, audit-core, kings-guard, secrets-engine, ops-warden Status: Reference note. The normative artifacts are the contracts under docs/contracts/ and the decision records GH-DEC-2026-002 and GH-DEC-2026-003.

Why this landed as contracts, not a statute bump

approval-engine shipped the object, the local outbox, and a cadence declaration, and stopped at a public consume because GH-WP-0002-T06 was unset. FLEX-WP-0017-T05 is wait on the same unset. The workplan's remaining tasks were doctrine, not another version of the layer model.

v0.7 stays the accepted statute. Two protocol clarifications and one §11 bullet are queued for v0.8 rather than silently rewritten into an accepted text:

§9.7.3 — consumption is never inferred from a decision record (stands); the PEP consumes before the protected side effect (clarifies the protocol the paragraph currently implies the other way).
§16 — "who marks an approval consumed" is no longer open.
§11 — evidence sources declare their emission guarantee (GH-WP-0002-T05).

Inbox items that also belong in v0.8 (pep-stance inventory rows, the §13 table becoming a pointer into maturity-engine, railiance-master's own-voice declaration) are not mixed into this workplan.

What each task produced

Task	Artifact
T02	`docs/contracts/approval-outbox.md` — adopts `approval-engine`'s wire
T03	GH-DEC-2026-002 — fail-closed only on the local store
T04	`docs/contracts/approval-emission-detection.md` — heartbeat + reconciliation
T05	detection contract, last section — queued for v0.8 §11
T06	`docs/contracts/approval-consumption.md` and GH-DEC-2026-003

The two rulings in one line each

Revocation: if the local outbox insert cannot commit, the revocation does not commit. An audit-core outage MUST NOT block a revocation. Synchronous emission to audit-core inside the mutation is forbidden.
Consumption: the PEP consumes by CAS before the side effect. The PDP never mutates. There is no unconsume. Same-digest retry is idempotent; a different digest against a consumed object is conflict.

Assent still required of the implementers, not of the estate

These contracts bind approval-engine and access-engine because they asked for them and were blocked on them. They do not move a vocabulary away from a repository that currently uses it, so they do not follow the GH-DEC-2026-001 assent pattern. Contest is still welcome: a protocol that cannot be implemented is a success of the loop, not a courtesy.

2.7 KiB Raw Permalink Blame History