tegwick
4e103f62a0
approval-engine met the condition. Verified here rather than taken on report: their docs/approval-claim.md carries "Presentation exclusion — GH-DEC-2026-015 §4" in normative language, and I ran tests/test_claim_contract.py::test_presentation_changes_cannot_change_the_approved_act myself — 1 passed. That test pins the digest input set from BOTH sides, and the narrowing half is what makes it real: without it a digest over four fields, or over a constant, would pass the widening half perfectly. view_hash now carries binding.digest and the act-scope is no longer independently canonicalized here, so the act has exactly one canonicalization computed by the layer that owns it. approval_binding_digest is validated for shape and refused without its approval id — it is carried, never computed. The three published vectors are unchanged: they do not carry the new key, so pick omits it. Asserted, not assumed. The cycle condition did not disappear, its protection moved — from refusing nesting to approval-engine's normative exclusion. layer.yaml carries it as cycle_condition with a test, so a future widening meets a rule rather than silence. One thing not assumed. Both gate-house and approval-engine said our binding slice canonicalizes principal and target, two of their five fields. target plainly is act material and is now dropped. But their principal is the party ON WHOSE BEHALF the approval was issued, while ours is the person being BOUND — the approver. Different roles, and dropping ours would remove who was shown this from view_hash and gut the promise. Kept it, declared principal_role_overlap open in layer.yaml, tested that changing the approver still moves view_hash, and raised it rather than silently resolving it either way. L0/L2 are unaffected: with no approval there is no digest to defer to, and test_act_scope_still_binds_when_there_is_no_carried_digest pins that. 100 tests pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V3W1dQG7GFFM9d94jFx7iR Assistant: claude-code Assistant-Model: opus Assistant-Process: 1565372@bnt-lap001 Assistant-Session: 16bb2f25-b34c-49ef-8e94-5fec3567a568 |
||
|---|---|---|
| docs | ||
| history/20260909-initial-exploration | ||
| informed_decision | ||
| intakes | ||
| schemas | ||
| tests | ||
| workplans | ||
| .custodian-brief.md | ||
| .gitignore | ||
| .repo-classification.yaml | ||
| AGENTS.md | ||
| GOAL.md | ||
| INTENT.md | ||
| layer.yaml | ||
| Makefile | ||
| pep-stance.yaml | ||
| pyproject.toml | ||
| README.md | ||
| SCOPE.md | ||
| WORK-RECORDS.md | ||
informed-decision
User interface for executive decisions, modelled as a sign-and-return book — the German Umlaufmappe / Zeichnungsbuch, made cryptographic.
A Decision Memo carries a question, the context needed to answer it, the requested act, and a binding between identity, what was shown, and what was bound. The promise is not "the file was signed" but "this person, in this role, was shown this view, and bound this act."
One object model from a ten-second login (L0) to a multi-party instrument (L5).
Where to start
| File | What it is |
|---|---|
INTENT.md |
Why this repository exists and what it must never become |
GOAL.md |
The current stage, its invariants, and its definition of done |
workplans/ |
Current work |
history/20260909-initial-exploration/ |
Founding exploration — schema, state transitions, canonicalization, vectors |
Stage 1
Own the browser-facing approver UI that approval-engine deliberately does
not contain, and answer in writing who owns it. approval-engine is a
bearer-token resource server with no browser client; key-cape
(KEY-WP-0013-T02) is waiting on a client_id and callback URI that no
component has claimed. This repository claims them.
See GOAL.md.
Boundaries
This repository renders questions and records answers. It does not decide
(access-engine), does not own the approval object (approval-engine), does
not author approval doctrine (gate-house), does not authenticate anyone
(key-cape), and does not archive the trail (audit-core).