coulomb/informed-decision
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Amend GOAL DoD-3 to the correlation triple; record the approval-engine exchange

Browse source 
Makes true what was already told to approval-engine: DoD-3 read
"reconstructable from a view_hash", which assumed the hash could ride into the
approval entry. It cannot — POST /entries discards its request body by design so
that record holds no caller-supplied data. Adopted their arrangement rather than
asking for a field, and recorded the consequence honestly: an auditor holding
only the approval object cannot reach the presentation without this surface's
record or audit-core.

Two invariants added to GOAL: approved is never rendered as permission to act,
and entitlement to view is access-engine's — a 200 from approval-engine is not
permission to see the approval.

T02 notes record that approval-engine found two real defects in the T03/T04
drafts, that their open questions A and B are now with key-cape because both
change an implemented registration, and that R3 remains open with an offer to
withdraw it if approval-engine considers it settled by its claim contract.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3W1dQG7GFFM9d94jFx7iR

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1565372@bnt-lap001
Assistant-Session: 16bb2f25-b34c-49ef-8e94-5fec3567a568
This commit is contained in:
tegwick 2026-09-09 14:22:06 +02:00
parent 08b190928f
commit f36e2b789a
1 changed files with 7 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
GOAL.md
View file

@ -82,6 +82,13 @@ These hold for Stage 1 and for every stage after it.
calls its mutations and reads its introspection claim. It never caches
validity, never infers consumption, and never holds approval current-state.
`GH-DEC-2026-003` ordering is honoured: decision, then consume, then act.
- **`approved` is never rendered as permission to act.** It is a state of an
object. Presenting it as "you may now do the thing" is a policy decision point
in the browser.
- **Entitlement to view is `access-engine`'s.** A `200` from `approval-engine`
is not permission to see the approval; that engine never answers "may this
actor do X". This surface obtains a decision before rendering and never
substitutes local judgment for it.
- **Identity is imported.** Every principal on this surface is authenticated by
`key-cape`. No local credential, no self-issued assurance level. Human
principals carry `principal_type: human` and are refused `approval:consume` by