From f36e2b789a440408c561ec688c71b64dba8a7aaf Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 9 Sep 2026 14:22:06 +0200 Subject: [PATCH] Amend GOAL DoD-3 to the correlation triple; record the approval-engine exchange MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Makes true what was already told to approval-engine: DoD-3 read "reconstructable from a view_hash", which assumed the hash could ride into the approval entry. It cannot — POST /entries discards its request body by design so that record holds no caller-supplied data. Adopted their arrangement rather than asking for a field, and recorded the consequence honestly: an auditor holding only the approval object cannot reach the presentation without this surface's record or audit-core. Two invariants added to GOAL: approved is never rendered as permission to act, and entitlement to view is access-engine's — a 200 from approval-engine is not permission to see the approval. T02 notes record that approval-engine found two real defects in the T03/T04 drafts, that their open questions A and B are now with key-cape because both change an implemented registration, and that R3 remains open with an offer to withdraw it if approval-engine considers it settled by its claim contract. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01V3W1dQG7GFFM9d94jFx7iR Assistant: claude-code Assistant-Model: opus Assistant-Process: 1565372@bnt-lap001 Assistant-Session: 16bb2f25-b34c-49ef-8e94-5fec3567a568 --- GOAL.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/GOAL.md b/GOAL.md index c03bd22..35612ad 100644 --- a/GOAL.md +++ b/GOAL.md @@ -82,6 +82,13 @@ These hold for Stage 1 and for every stage after it. calls its mutations and reads its introspection claim. It never caches validity, never infers consumption, and never holds approval current-state. `GH-DEC-2026-003` ordering is honoured: decision, then consume, then act. +- **`approved` is never rendered as permission to act.** It is a state of an + object. Presenting it as "you may now do the thing" is a policy decision point + in the browser. +- **Entitlement to view is `access-engine`'s.** A `200` from `approval-engine` + is not permission to see the approval; that engine never answers "may this + actor do X". This surface obtains a decision before rendering and never + substitutes local judgment for it. - **Identity is imported.** Every principal on this surface is authenticated by `key-cape`. No local credential, no self-issued assurance level. Human principals carry `principal_type: human` and are refused `approval:consume` by