gate-house/docs/conformance/2026-09-06-v08-assent-round.md

v0.8 assent round — findings and dispositions

Repository: gate-house Project family: NetKingdom security layer Status: closed — all findings dispositioned; publication handed to net-kingdom Version: 0.2 Date: 2026-09-09 Subject: net-kingdom/canon/standards/security-layer-model_v0.8.md (proposed) Workplan: GH-WP-0003-T06

Derived artifact: this record states the round's status as of the date above, not current state. Authoritative bodies are the decision records and the cut itself.

Circulated

ops-warden, approval-engine, access-engine, kings-guard, audit-core, and net-kingdom (publisher). Each was told what the version costs them and what to attack, rather than sent a summary to nod at.

Findings returned

F-numbers are this record's own, assigned in the order findings arrived; F-A numbers are approval-engine's. Where a reporter's own finding id is cited it is named as theirs. F1–F4 arrived before the round properly opened; F5 onward came from the full text reviews.

F1 — GH-DEC-2026-008 was unimplementable as written · adopted, corrected

Reported by access-engine, independently by approval-engine, originally found by secrets-engine re-verifying a replay fixture — within hours of the ruling and before the assent round had properly opened.

The ruling required claim.binding.pdp_digest to equal the decision's NewDecisionBinding.request_digest. access-engine hashes context into that digest and the dual-control pattern carries the claim in context.approval, so embedding the claim changes the digest of the request carrying it. A hash cycle: a claim cannot name the digest of a document containing that claim.

A fail-closed consumer obeying the rule would have denied destroy permanently. The ruling's own fail-closed requirement is what would have made it harmful rather than merely wrong — the rule and the failure mode compounded instead of cancelling.

Disposition. Ruling stands; its obligations stand (this record said "its four obligations stand" in v0.1, written after obligation 5 was added — the propagation approval-engine cites in F-A2b below, corrected here rather than only at the source); obligation 1's comparison target is corrected to the PDP's published exclusion-scoped digest (binding.approval_binding_digest, FLEX-DEC-2026-007). v0.8 §9.7.3 rewritten. A consumer MUST NOT guess the exclusion rule, and until a PDP publishes one the path is fail-closed rather than complete — a gap in a dependency, not in the ruling.

Verified independently against flex-auth/schemas/decision_envelope.schema.json and pkg/api/canonical.go before amending.

F2 — replay identity versus correspondence digest · adopted, added

Flagged by access-engine explicitly as a near miss it was not asking to have written down. The obvious fix to F1 is to drop context.approval from the request digest entirely, and that is unsafe: two requests differing only in which approval was presented decide differently, so collapsing them lets an allow obtained with a valid claim be replayed against a request carrying none.

An evidence-bearing input may be excluded from a correspondence digest but never from the replay identity. Added to v0.8 §6.4 obligation 5. A property discovered by nearly getting it wrong is worth more written down than remembered, and the shape recurs wherever evidence travels inside a hashed request.

F3 — GH-DEC-2026-009 adopted, with a reason we had not stated

access-engine records that the unknown ruling is right for the adversarial reason — unknown is the cheapest state to induce, so failing open on it makes being unclassifiable a credential-free escalation — and notes it had reported the divergence without reaching that reading. No change; recorded because the reasoning, not the conclusion, is what a later reader needs.

It also endorses sending ops-warden's non-conformant cell to the round rather than imposing it.

F4 — A7 accepted by its own worked example

access-engine accepts its dual-control instance as the one carrying the argument, and notes the §11 marking obligation would have caught the source: the stale G3 row in its own 2026-08-29 review, handed on as current. No change.

F5 — attribution is not identity · adopted, GH-DEC-2026-010

Reported by access-engine (FLEX-DEC-2026-011, ranked blocking for calling §6.4's obligations complete, explicitly not blocking adoption), against its own artifact and recorded on its own side as FLEX-DEC-2026-010 before it read this text. Framed independently by secrets-engine and carried into the correspondence chain by approval-engine.

§6.4 obligation 1 required a PEP to hold "a decision from access-engine", and obligation 2 supplied a digest test emphatic that it was mechanical rather than a matter of implementer judgement. That test establishes which request a decision is for and nothing about who issued it, and it cannot: every input is either sent by the caller or published, so a responder knowing a published package id and version returns a well-formed allow. Publishing more digests makes a forgery look more authenticated, not less.

Fail-closed protects against a decision point that is absent, not against one that lies. And §9.4 requires authenticated entries of the approval object while nothing required it of the decision, so obligation 5 was written over a pair of artifacts whose authenticity a PEP could validate for only one half.

Disposition. Adopted. Obligation 1 now requires attribution and states that the digest comparison does not discharge it; the mechanism is the owner's under §17 and the condition is a declared §13 gap with access-engine as owner. Ruled in GH-DEC-2026-010. Note that §16 had already recorded this observation one layer up, against this standard's own publication path — the gap was visible from inside and recorded against the wrong artifact.

F6 — totality by catch-all; absent is not unknown · adopted, GH-DEC-2026-011 §3

access-engine, as its own F2. A map carrying unknown → fail_closed satisfies obligation 3's totality requirement vacuously: every scope never enumerated lands in the catch-all, fails closed, and nobody learns which those were, while the drift test passes by exercising the default rather than the axis. Recognised from its own FLEX-DEC-2026-008 — a package shipped with no tenant rule while 29 fixtures passed, because every fixture carried the same tenant.

Disposition. Adopted. A map MUST enumerate its axis; an absent hit MUST be distinguishable in the record from an unknown hit and MUST surface as a conformance failure. Runtime behaviour is unchanged — absent fails closed too, for the stronger reason. This closes the §16 question opened at the cut.

F7 — the drift test was a SHOULD · adopted

access-engine, as its own F3. The strongest obligation in §6.4 had the weakest verification, in a paragraph arguing that a map free to drift is worse than none. Promoted to MUST; already met by four of five §13.1 rows, so it costs nothing.

F8 — §13.1 marked one violation and not the plainer one · adopted

access-engine, as its own F4. ops-warden's row was bolded non-conformant for a wrongly-valued cell; ops-mason's "not published" was stated as bare fact, though an unpublished map is the plainer violation of the same obligation. Gate House's own §11 marking obligation applied to its own register, returned unchanged by the repository it had made the same argument to. ops-mason is now marked.

F9 — the adoption cost of GH-DEC-2026-009 · split: ask 1 declined, ask 2 adopted

ops-warden, assenting to the rule on the falsifier's own terms — it went looking for the §5.1 read-only escape hatch the reversal clause predicted and reported that it does not have one, since the map governs warden sign, a credential-issuing side effect.

Then it priced adoption: 0 of 3 signing targets and 3 of 21 routing lanes resolve to a zone, so the cell adopted today fails closed on essentially every certificate it issues whenever the engine is unreachable — including the continuity path an operator needs to repair that unreachability. Eighteen of eighteen unknown lanes are unknown because another repository has published no workload-identity declaration.

Disposition. Ask 1 (a dated transitional unknown: fail_open) declined: it is indistinguishable at runtime from the stance the rule forbids and makes the rule optional at the only moment it costs anything. Ask 2 adopted: §13.1 records a dated coverage figure beside each stance. Ruled in GH-DEC-2026-011, which also records that ADR-0009 rule 3's prohibition on inferring membership holds under this pressure.

ops-warden also confirmed §12's derived-artifact rule against its own catalog_revision / catalog_dirty practice, and agreed with refusing a forced migration onto zones. No change requested for either.

F-A1 — §15 item 2b's numbering made §14's tally uncheckable · adopted

approval-engine. The change list contained an item numbered 2b, and §14 claimed "ten of this version's eleven changes were requested by another repository" with §17 as the single exception — a tally that only holds if 2b is a sub-clause rather than a change, and 2b is the one item explicitly described as not a request. So if 2b counts, both halves move: ten of twelve, two exceptions.

Disposition. Adopted, promoted. 2b counts as a change in its own right and is the second exception; §14 restates the ratio. The label 2b is retained rather than renumbered so that references written against this list do not silently repoint. The finding is well aimed: §14 offers the ratio as the argument for circulating rather than accepting, and invites the reader to count.

approval-engine also recorded two candidates it checked and dropped — §15 change 9's "+3 rows" (correct against v0.7's two) and §11's "three times"/"four times" (different corrections in sequence). A finding count means nothing without the count checked and discarded.

F-A2 — §6.4 announced four obligations and listed five · adopted

approval-engine. v0.7 said "Four" and listed 1–4; v0.8 added obligation 5 and left the count. Not a typo with cosmetic consequences: obligation 5 carries correspondence-by-identity, the PIP/PDP separation, the replay-identity property, and the summary-predicate trust rule — the obligation the whole GH-DEC-2026-003 / -005 / -008 chain rests on. An implementer reading "the four obligations of §6.4" has a defensible reading under which it implements 1–4 and omits the one governing how an approval is compared to a decision. Corrected.

F-A2b — the miscount had already propagated · adopted, corrected in place

approval-engine observed that Gate House's own 2026-09-06 message said "the ruling stands and its four obligations stand" — written after obligation 5 was added, by the section's author. That is the evidence the count sentence was doing work rather than decorating. The same sentence appeared in v0.1 of this record and is corrected above. An estate-wide grep for other references found only historical ones, in the v0.6 and v0.7 change logs where "four" is accurate for those versions.

F-A3 — §17's artifact count contradicted its own body · adopted

approval-engine. §17 said "four artifacts are therefore required, owned by Taxonomy" while its body says plainly that the decision-record schema is not Taxonomy's, and a second — the emission-cadence declaration — is assigned to info-tech-canon and net-kingdom and accepted in their own voice. The closing paragraph then called three artifacts' ownership "still proposed" and settled one of them in the same sentence. v0.8's own change item 10 claimed §17's stale paragraph was corrected; the correction reached the emission-cadence paragraph and not the count.

Disposition. Adopted. Exactly two artifacts are unsettled — request-claim and gap-record. The finding matters because access-engine took the decision-record schema on against its own interest, and a stale paragraph was quietly undoing that.

F-A4 — the §19 hole is explained where nobody looks · adopted

approval-engine, marked minor. Headings ran §18 → §20 with the explanation in a §16 bullet. The removal was right and is not asked back — a grade inside a standard of record becomes normative by adjacency — but a reader scanning structure cannot tell whether an edit dropped a section. A stub now sits at the boundary.

N1 — net-kingdom corrected §11 in its own voice · accepted as landed

§17 confirmed unchanged: the profile assigns info-tech-canon the generic EmissionCadenceDeclaration contract and net-kingdom the MUST/SHOULD split, the rare-class rate-monitoring prohibition, and the heartbeat-plus-reconciliation obligation. The ITC-WP-0018 / NK-WP-0035 acceptance record is accurate.

§11 diverged in both directions and was corrected in place at net-kingdom@da7747d, as invited. As cut it required "heartbeat or reconciliation" of every load-bearing source: that withholds from a volume class the expected-rate form the profile permits, and accepts for a rare class either control alone where the profile requires both. The conjunction is load-bearing — a rare class with a heartbeat alone has no reconciliation to catch divergence, and one with reconciliation alone produces no claim that can itself go missing, which is why §9.6 rejects rate monitoring there. §11 also contradicted its own next paragraph. The item now defers form to the governing profile and adds that classification is the source's published inventory, never the checker's to infer from an event name, payload, or observed rate — without which omission detection is circular.

Implementation ahead of acceptance

Both engines implemented against the ruling before the round closed.

• access-engine — FLEX-DEC-2026-007, dd3ce4c: publishes binding.approval_binding_digest, and asserts by test that the two digests disagree on a claim-bearing request, so a later refactor cannot collapse them.
• approval-engine — 7e75677, 102 tests: schema v3 declares pdp_path; create() refuses pdp_path: true without a pdp_digest, so an approval that would be unusable on the path fails at issue rather than at the protected side effect. Intent is declared and never inferred — a digest that happens to be present is not a declaration, legacy rows migrate to false rather than being back-filled, and a successor inherits its predecessor's declaration. Back-filling would have manufactured a statement no requester made, which is GH-DEC-2026-008's own objection to translation in another form.

Round closed

All findings above are dispositioned. Nine corrections landed in the text during circulation (§15 items 12–20 at net-kingdom@64394e9); one request was declined with its reasons stated in §6.4 rather than only here.

Two circulated repositories did not return a text review: kings-guard and audit-core. The sections each was asked to attack — §9.5's criteria-grounding clause and whether §12's step-four paragraph is now stale for the first, whether §11's emission-guarantee wording lets a source imply completeness for the second — therefore carry no assent from the repository best placed to test them. §14 records that as not claimed rather than treating silence as assent. approval-engine did the same thing voluntarily, naming the sections it did not read (§1–§4, §7, §8, §9.1–§9.2, §9.5–§9.6, §9.8, §10, §18, §20) so a three-finding review would not read as a clean bill.

Publication and the acceptance flip are net-kingdom's and were handed over on round close. v0.7 stays accepted and in force until then, unpatched.

What the round showed

The first finding against v0.8 was a rule that was right and unimplementable, and it was found by the repository that would have been broken by it, then reported by two others under no obligation to look. That combination is only survivable because the implementers read the ruling against their own fixtures instead of accepting it — the behaviour §12 describes, arriving without being asked for.

It is also an argument for the round itself. GH-DEC-2026-008 was correct in substance, argued from doctrine, and verified against another repository's schema before it was issued. None of that caught a defect that three repositories found in hours of trying to build on it.

Closed, the round says something narrower and worse. Every substantive finding was about a rule that read as satisfied by a check that did not satisfy it. Obligation 1 read as discharged by a digest comparison establishing something else. Obligation 3's totality read as satisfied by a catch-all that measured nothing. Obligation 3's drift test read as required and was optional. §17's status paragraph read as open on a question its own body had settled. §6.4's count sentence read as complete at four while five were listed. None was a wrong rule; each was a correct rule a careful implementer could satisfy without doing the thing it exists to require.

That is a failure mode this repository is structurally prone to, because doctrine is graded on whether it is right and consumed on whether it is checkable. Only the implementers can tell the two apart, and every one of these came back from a repository reading the text against its own code rather than against its own opinion.

Two repositories did not return one, and the standard now says so in §14 rather than counting silence as assent. A round whose value is that it catches this class is worth exactly what it covers, and it did not cover §9.5 or §11's emission wording.