tegwick
7408ff9234
Adopt approval-engine's outbox wire as Gate House doctrine, specify the heartbeat-and-reconciliation detection surface, and settle consumption ordering: the PEP consumes by CAS before the side effect. T05's §11 check is written here and queued for statute v0.8. Assistant: grok Assistant-Session: 01a04d89-aaa5-7443-945e-b3055cd4b7e4
57 lines
2.7 KiB
Markdown
57 lines
2.7 KiB
Markdown
# Approval evidence integrity — contracts and rulings
|
|
|
|
**Recorded:** 2026-08-29
|
|
**Workplan:** GH-WP-0002
|
|
**Audience:** approval-engine, access-engine / flex-auth, audit-core, kings-guard, secrets-engine, ops-warden
|
|
**Status:** Reference note. The normative artifacts are the contracts under
|
|
`docs/contracts/` and the decision records GH-DEC-2026-002 and GH-DEC-2026-003.
|
|
|
|
---
|
|
|
|
## Why this landed as contracts, not a statute bump
|
|
|
|
`approval-engine` shipped the object, the local outbox, and a cadence
|
|
declaration, and stopped at a public consume because GH-WP-0002-T06 was unset.
|
|
`FLEX-WP-0017-T05` is wait on the same unset. The workplan's remaining tasks
|
|
were doctrine, not another version of the layer model.
|
|
|
|
v0.7 stays the accepted statute. Two protocol clarifications and one §11
|
|
bullet are queued for v0.8 rather than silently rewritten into an accepted
|
|
text:
|
|
|
|
1. §9.7.3 — consumption is never inferred from a decision record (stands);
|
|
the PEP consumes *before* the protected side effect (clarifies the
|
|
protocol the paragraph currently implies the other way).
|
|
2. §16 — "who marks an approval consumed" is no longer open.
|
|
3. §11 — evidence sources declare their emission guarantee (GH-WP-0002-T05).
|
|
|
|
Inbox items that also belong in v0.8 (pep-stance inventory rows, the §13
|
|
table becoming a pointer into `maturity-engine`, `railiance-master`'s own-voice
|
|
declaration) are not mixed into this workplan.
|
|
|
|
## What each task produced
|
|
|
|
| Task | Artifact |
|
|
| --- | --- |
|
|
| T02 | `docs/contracts/approval-outbox.md` — adopts `approval-engine`'s wire |
|
|
| T03 | GH-DEC-2026-002 — fail-closed only on the local store |
|
|
| T04 | `docs/contracts/approval-emission-detection.md` — heartbeat + reconciliation |
|
|
| T05 | detection contract, last section — queued for v0.8 §11 |
|
|
| T06 | `docs/contracts/approval-consumption.md` and GH-DEC-2026-003 |
|
|
|
|
## The two rulings in one line each
|
|
|
|
- **Revocation:** if the local outbox insert cannot commit, the revocation
|
|
does not commit. An `audit-core` outage MUST NOT block a revocation.
|
|
Synchronous emission to `audit-core` inside the mutation is forbidden.
|
|
- **Consumption:** the PEP consumes by CAS before the side effect. The PDP
|
|
never mutates. There is no unconsume. Same-digest retry is idempotent;
|
|
a different digest against a consumed object is conflict.
|
|
|
|
## Assent still required of the implementers, not of the estate
|
|
|
|
These contracts bind `approval-engine` and `access-engine` because they asked
|
|
for them and were blocked on them. They do not move a vocabulary away from a
|
|
repository that currently uses it, so they do not follow the GH-DEC-2026-001
|
|
assent pattern. Contest is still welcome: a protocol that cannot be
|
|
implemented is a success of the loop, not a courtesy.
|