diff --git a/INTENT.md b/INTENT.md index ec50449..1a6efb1 100644 --- a/INTENT.md +++ b/INTENT.md @@ -384,3 +384,23 @@ while that is open. 7. An evidence bundle exports and verifies offline against `audit-core`'s record of the same transitions. 8. No endpoint in this repository answers an authorization question. + + +## Bounded Staff-evidence doctrine response — 2026-10-11 + +GH-DEC-2026-025 accepts the exact bounded disposition: this repository remains +Staff/PEP-shaped and carries the unresolved §3.4 deterministic-evidence tension. +The answer to INFD-IN-0007 is to state that tension openly, not claim it has +been solved. NetKingdom has assembled a proposed successor; NET-IN-0004 retains +separate accepted standard voice/publication. Accepted v0.8 remains untouched; +this source receipt is not acceptance of the whole successor or enrolment by +another repository. INFD-IN-0007 stays open pending that publication boundary. + +The existing independent evidence and identity/approval/PDP limits remain. +The source now has local transactional evidence/outbox, per-class heartbeat +and scheduled reconciliation mechanisms; finished INFD-WP-0005/0007 preserve +those implementation receipts. Full class-specific emission guarantee and +verification remain owed/not declared, not fulfilled by delivered rows, matching +counts or a layer/pin PASS. INFD-IN-0009 retains the unpromoted residual source +verification/declaration work; the §3.4 tension is a separate retained finding. +Current bounded evidence: docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md. diff --git a/docs/evidence-path-design.md b/docs/evidence-path-design.md index 22dd9a1..4321202 100644 --- a/docs/evidence-path-design.md +++ b/docs/evidence-path-design.md @@ -196,9 +196,15 @@ of presentations, dispositions and stance applications compared against is indistinguishable from suppression by rate alone — the same argument `approval-engine` makes. -This depends on `AUDIT-WP-0009` T04/T06, which we understand are open. We are -declaring the cadence now and will not describe it as operating until those -land. +Historical design dependencies were `AUDIT-WP-0009` T04/T06. Current source +reconciliation on2026-10-11 confirms transactional outbox, per-class heartbeat +and scheduled two-time-basis reconciliation now exist; the old dependency +pointer is not a freshly verified live blocker. Full source class guarantees +and operation/monitoring verification remain owed under INFD-IN-0009. The +current worker reports count comparison, not an automatic divergence/loss +finding or completeness: delayed accepted_at and occurred_at windows differ. +See docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md. Finished +INFD-WP-0005/0007 retain their implementation scope and historical receipts. ## 6. What we need diff --git a/docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md b/docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md new file mode 100644 index 0000000..59aa5ba --- /dev/null +++ b/docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md @@ -0,0 +1,51 @@ +# Staff evidence source reconciliation — 2026-10-11 + +Derived source-owner review of accepted bounded GH-DEC-2026-025 handoff and +accepted NetKingdom security-layer-model_v0.8.md §9.6/11; proposed successor +adoption/publication remains NET-IN-0004. Owner HEAD716e95e8dd97aa6638a08a694481fdb0fa336dd4. +No native data, credentials, live changes or conformance promotion occurred. + +| Declared class | Wire class | Actual source mechanism | Retained native evidence | Remaining verification | +| --- | --- | --- | --- | --- | +| presentation: load-bearing/volume | informed-decision.presentation | atomic record/evidence/outbox; heartbeat86400s; pump30s; reconciliation300s | Oct5 receipt:2 selected delivered records with receiver refs and matching class counts | full cadence/detection declaration and time-basis-aware native reconciliation/monitoring; rate monitoring is not declared | +| disposition: load-bearing/rare | informed-decision.disposition | same transactional/heartbeat/reconciliation mechanism | Oct5 receipt:2 selected delivered records with receiver refs; aggregate audit-core.heartbeat2 | per-target rare heartbeat plus reconciliation/detection operating proof; aggregate heartbeat count identifies no target class | +| stance-application: load-bearing/rare | informed-decision.stance_application | commit_stance_application/Store record_unreachable; same86400s heartbeat and reconciliation mechanism | selected Oct5 native receipt contains no stance-class record/count; existing synthetic tests cover stance and backlog-safe per-class heartbeat | per-target heartbeat, stance-class native operation and reconciliation/detection proof; no missing-emission finding inferred from an empty historical window | + +Source: informed_decision/evidence.py HEARTBEAT_CLASSES declares86400s per +class. Store queues no nothing-to-report heartbeat when that class or its prior +heartbeat is undelivered. Actual native class spellings use stance_application; +this maps the existing declaration's stance-application, not a fourth class. +AuditPump30s ticks drain bounded batches, write private300s reconciliation and +close readiness for retry/blocked/pending delivery. A ready pump is not §11 +whole-class completeness or independently monitored cadence proof. + +OutboxWorker.reconcile verifies scope/window/shape and compares source occurred_at +to receiver accepted_at. It explicitly returns automatic_loss_finding=false, +completeness_proven=false and reconstructability_proven=false. Delayed acceptance +can shift a legitimate event between windows; matching counts do not establish +matching membership, complete emission or truthful display. Current source has +no standalone cadence.yaml; code intervals are a mechanism inventory, not a +returned fully verified per-class guarantee. Existing tests enforce backlog-safe +class heartbeats and honest nonclaiming reconciliation; no new test run was +needed for this documentation-only source review. + +Native supporting receipt: +docs/evidence/2026-10-05-lifecycle-cutover/native-audit-after-acceptance.json. +Its selected source/receiver totals match, including aggregate heartbeat2, +presentation2 and disposition2; they do not prove per-target heartbeat or +stance-class completeness. Additional memo.posed/lifecycle classes in that +receipt are not substitutes for these three independently classified classes. + +Local outbox/scheduling and sender/receiver delivery are implemented, so old +layer.yaml outbox/AUDIT-WP-0009 blockers are stale. Remaining truthful declaration +and operating verification are retained once as INFD-IN-0009, an unpromoted +residual from finished INFD-WP-0007 with related finished INFD-WP-0005. Both +finished plans remain finished. There is no guarantee/conformance upgrade. + +GH-DEC-2026-025 answers INFD-IN-0007 by carrying unresolved §3.4 tension explicitly; +NET-IN-0004 holds pending separately accepted successor standard voice. Staff/ +PEP-shaped classification, no approval current-state/verdict/consume boundary, +independent evidence path, view_hash/digest authority and GH-DEC-2026-014 +commitment-only content-availability/compromised-source residuals persist. +Recording accepted doctrine and actual implementation mechanisms does not resolve +that tension or accept the successor standard as a whole. diff --git a/docs/reviews/2026-10-11-staff-evidence-source-owner-review.md b/docs/reviews/2026-10-11-staff-evidence-source-owner-review.md new file mode 100644 index 0000000..40e2986 --- /dev/null +++ b/docs/reviews/2026-10-11-staff-evidence-source-owner-review.md @@ -0,0 +1,34 @@ +# Informed Decision Staff-evidence source-owner review + +```yaml +reviewer: informed-decision-owner (agent informed-decision, codex) +decision: approved +work_item: INFD-WP-ADHOC-2026-10-11-T04 +scope: source declaration reconciliation and bounded doctrine receipt only +comment: >- + INTENT.md Purpose, What informed-decision Owns/Does Not Own, and Layer Placement + bind presentation evidence emission while reserving authorization/identity/ + approval state to their owners. Actual source at716e95e8dd97aa6638a08a694481fdb0fa336dd4, + accepted bounded GH-DEC-2026-025 handoff and existing Oct5 native audit receipt + were reviewed under INFD-WP-ADHOC-2026-10-11-T04. The source receipt distinguishes + implemented transactional/outbox/heartbeat/reconciliation mechanisms from + still-owed class-specific declaration/operating verification. No conformance, + whole-successor adoption or native execution is approved by this review. +``` + +The source agrees with the bounded Staff/PEP-shaped carried-tension doctrine; +INFD-IN-0007 retains the separately accepted standard voice/publication boundary +under NET-IN-0004. The revised declaration preserves three load-bearing classes +and owed/not-yet-declarable status, replaces stale blockers with actual current +verification gaps and explicitly declines completeness. The source receipt +names exact code and retained native evidence, without promoting aggregate +heartbeat/count/outbox evidence to whole-class guarantees. INFD-IN-0009 is the +single unpromoted residual source intake; finished WP5/7 remain historical +implementation receipts. No implementation is undertaken from that residual. + +This review records only informed-decision-owner judgement. It changes no +privileged authority or approval binding and authorizes no live action, credential +read, whole standard acceptance or conformance upgrade. + +Exact reviewed handoff SHA-256: `1fd8dc06d417c7a0d97920ddc1e51b0fb28113efb8047a8380cd2b9d3ff3289c`. +Exact source reconciliation receipt SHA-256: `977898b58fb66a50f3852451b86eac194921ca671fac7c4af4882c7914b7d002`. diff --git a/intakes/intakes.md b/intakes/intakes.md index b7305d3..ec89aee 100644 --- a/intakes/intakes.md +++ b/intakes/intakes.md @@ -446,8 +446,20 @@ tags: - cross-repo - conformance created: '2026-09-21' -updated: '2026-09-21' +updated: '2026-10-11' blocks_nothing: true +bounded_doctrine_response: GH-DEC-2026-025 +accepted_standard_voice_record: NET-IN-0004 +source_evidence_record: INFD-IN-0009 +current_response: >- + Accepted bounded doctrine now answers the question by carrying the unresolved + section3.4 tension explicitly while retaining Staff/PEP-shaped classification + and all evidence/identity/approval boundaries. This does not claim the tension + resolved or the whole successor accepted. NET-IN-0004 retains the proposed + successor and pending separately accepted standard voice/publication; this + intake remains open at that boundary. Current class-specific source guarantee + reconciliation is documented in the source evidence receipt, with remaining + gaps retained once under INFD-IN-0009 rather than reopening finished WP5/7. description: >- GH-DEC-2026-017 closed INFD-IN-0006 and named the value: this repository is `layer: Staff, role: pep-shaped`, and that value is APPLIED — both files @@ -510,3 +522,59 @@ description: >- fixtures: docs/flex-auth-request-list-action.md. state_hub_intake_id: "01a0c5b7-77f3-787b-a19f-ffcfa4191213" ``` + + +## INFD-IN-0009 — Complete class-specific emission declaration and verification + +```yaml +id: INFD-IN-0009 +kind: intake +title: Complete class-specific emission declaration and verification +status: open +origin: residual +origin_ref: INFD-WP-0007 +flavor: residual +priority: medium +owner: informed-decision +repo: informed-decision +lane: blue +created: '2026-10-11' +updated: '2026-10-11' +related: +- INFD-WP-0005 +- INFD-IN-0007 +- GH-DEC-2026-025 +- NET-IN-0004 +tags: +- evidence-emission +- source-declaration +- verification-gap +promotion: not-promoted +description: >- + Retain the remaining source guarantee/verification gap after completed initial + lifecycle and intake delivery increments, not those increments as unfinished. + Presentation(volume), disposition(rare) and stance-application(rare) have + transactional local evidence/outbox and 86400-second heartbeat mechanisms; + AuditPump schedules30-second drain/300-second two-time-basis reconciliation. + Retained native receipt proves selected presentation/disposition delivery and + aggregate heartbeat counts, not per-target heartbeat, stance-class operation, + independent monitoring/detection or full class emission completeness. Current + reconciliation explicitly declines automatic loss/completeness findings and + compares occurred_at to accepted_at. Source class-specific cadence/guarantee + declaration and bounded verification remain owed/not declared. On promotion, + reconcile those actual mechanisms and existing native receipts into honest + per-class guarantee/detection evidence, covering rare-class heartbeat plus + reconciliation, delayed acceptance/backlog and explicit completeness nonclaim. + Volume-class rate monitoring, if selected, needs positive window/minimum and + reconciliation. Do not infer conformance from outbox, counts, login or layer + PASS; preserve commitment-only availability/compromised-source limits and + separate section3.4 tension. No implementation/native inspection/credentials + or privileged change is authorized by creation of this residual intake. +acceptance: >- + A source-owned class-by-class declaration names actual detection surfaces and + cadence, with bounded independently attributable native verification and + explicit remaining completeness/availability limits; required rare heartbeat + and time-basis-aware reconciliation/detection are demonstrated, not assumed. + Required native actions have their own exact founder disposition. +source_receipt: docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md +``` diff --git a/layer.yaml b/layer.yaml index 0491065..2608fbe 100644 --- a/layer.yaml +++ b/layer.yaml @@ -123,9 +123,16 @@ shape_ruling: GH-DEC-2026-012 # which the ruling answers as far as the VALUE and not as far as the FIT. # Asked once more of gate-house; no deadline, no dependency, nothing waits on it. section_3_4_fit: - status: open + status: carried-tension intake: INFD-IN-0007 blocks_nothing: true + bounded_doctrine_response: GH-DEC-2026-025 + accepted_standard_voice: pending-NET-IN-0004 + tension_resolved: false + note: >- + The bounded founder disposition answers the doctrine question by carrying + the tension explicitly. It grants no conformance or Engine-state exception. + Accepted successor standard voice/publication remains pending. # §4 catalog membership — ASKED by GH-DEC-2026-017 §4, ANSWERED here. # @@ -341,10 +348,25 @@ evidence: note: Fail-closed stance applied at a binding attempt. Same form as disposition. emission_guarantee_status: not-yet-declarable emission_guarantee_blocked_on: >- - The local transactional outbox (§9.4) and the cadence declaration are - designed (docs/evidence-path-design.md §5) and depend on audit-core's - AUDIT-WP-0009 T04/T06 and on sender registration. Declared as owed rather - than described as operating. + Current source implements transactional recording/outbox, 86400-second + per-class heartbeats, 30-second pump ticks and 300-second reconciliation. + Original AUDIT-WP-0009/outbox pointers are historical, not current verified + blockers. Full source class-specific declaration and native verification + remain owed: time-basis-aware reconciliation/detection/monitoring and + per-target rare-class heartbeat receipts are not established by retained + aggregate counts. See INFD-IN-0009; no residual implementation is promoted. + completeness_claimed: false + reconciliation_review: docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md + residual_source_record: INFD-IN-0009 + mechanism_inventory: + local_record_and_outbox: implemented-transactionally + heartbeat_seconds_per_declared_class: 86400 + audit_pump_tick_seconds: 30 + reconciliation_tick_seconds: 300 + reconciliation_source_time_basis: occurred_at + reconciliation_receiver_time_basis: accepted_at + automatic_loss_finding: false + operating_full_class_guarantee_verified: false note: >- GH-DEC-2026-012 states the residual is not closed in those words, and this repository is not credited with closing it. Same disposition as diff --git a/workplans/ADHOC-2026-10-11.md b/workplans/ADHOC-2026-10-11.md index fa5e933..ff35ad5 100644 --- a/workplans/ADHOC-2026-10-11.md +++ b/workplans/ADHOC-2026-10-11.md @@ -98,3 +98,27 @@ unperformed; T04/T05 obligations and temporary vulnerability review persist. Confirmation: docs/reviews/2026-10-11-purpose-release-amended-product-owner-review.md. Prior T01 catalogue ACK including hub identifiers and T02 initial36 review/test/ receipt remain unchanged. No new residual or authority is created by this review. + +## Reconcile Staff evidence source declaration and current guarantees + +```task +id: INFD-WP-ADHOC-2026-10-11-T04 +status: done +priority: medium +``` + +Reviewed accepted bounded GH-DEC-2026-025 handoff against actual source +class definitions, transactional recording, heartbeat/reconciliation scheduling, +existing component-test assertions and native count/receipt evidence. Reconciled +stale outbox/AUDIT-WP-0009 blockers without promoting owed guarantees or reopening +finished INFD-WP-0005/0007. INFD-IN-0007 retains doctrine response and pending +NET-IN-0004 standard voice. INFD-IN-0009 is the one live, unpromoted residual +source intake for remaining class-specific declaration/verification gaps, +origin INFD-WP-0007. No residual implementation or native action occurred. + +Source evidence reconciliation: +docs/evidence/2026-10-11-staff-evidence-source-reconciliation.md. +Formal source review: +docs/reviews/2026-10-11-staff-evidence-source-owner-review.md. +Existing Staff/PEP-shaped classification, three load-bearing class classifications, +compromised-source and commitment/content availability limits remain unchanged.