coulomb/informed-decision
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Amend GOAL DoD-3 to the correlation triple; record the approval-engine exchange

Browse source 
Makes true what was already told to approval-engine: DoD-3 read
"reconstructable from a view_hash", which assumed the hash could ride into the
approval entry. It cannot — POST /entries discards its request body by design so
that record holds no caller-supplied data. Adopted their arrangement rather than
asking for a field, and recorded the consequence honestly: an auditor holding
only the approval object cannot reach the presentation without this surface's
record or audit-core.

Two invariants added to GOAL: approved is never rendered as permission to act,
and entitlement to view is access-engine's — a 200 from approval-engine is not
permission to see the approval.

T02 notes record that approval-engine found two real defects in the T03/T04
drafts, that their open questions A and B are now with key-cape because both
change an implemented registration, and that R3 remains open with an offer to
withdraw it if approval-engine considers it settled by its claim contract.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3W1dQG7GFFM9d94jFx7iR

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1565372@bnt-lap001
Assistant-Session: 16bb2f25-b34c-49ef-8e94-5fec3567a568
This commit is contained in:
tegwick 2026-09-09 14:22:06 +02:00
parent 08b190928f
commit f36e2b789a
1 changed files with 7 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
GOAL.md
View file

@ -82,6 +82,13 @@ These hold for Stage 1 and for every stage after it.
calls its mutations and reads its introspection claim. It never caches calls its mutations and reads its introspection claim. It never caches
validity, never infers consumption, and never holds approval current-state. validity, never infers consumption, and never holds approval current-state.
`GH-DEC-2026-003` ordering is honoured: decision, then consume, then act. `GH-DEC-2026-003` ordering is honoured: decision, then consume, then act.
- **`approved` is never rendered as permission to act.** It is a state of an
object. Presenting it as "you may now do the thing" is a policy decision point
in the browser.
- **Entitlement to view is `access-engine`'s.** A `200` from `approval-engine`
is not permission to see the approval; that engine never answers "may this
actor do X". This surface obtains a decision before rendering and never
substitutes local judgment for it.
- **Identity is imported.** Every principal on this surface is authenticated by - **Identity is imported.** Every principal on this surface is authenticated by
`key-cape`. No local credential, no self-issued assurance level. Human `key-cape`. No local credential, no self-issued assurance level. Human
principals carry `principal_type: human` and are refused `approval:consume` by principals carry `principal_type: human` and are refused `approval:consume` by