tegwick
5c33d17330
Two rulings landed and both corrected something. GH-DEC-2026-013 accepted our binding-versus-awareness argument, wrote it into the record as its §6, and did not change the outcome — it sharpened the defect. Two different facts share one field named tenant: the act-scope, a property of the act that our binding slice commits, and the principal's membership, a property of the person that approval-engine exact-matches. Gate House's correction stands: a binding slice that must commit the scope being entered should commit that scope, not borrow a membership claim to stand in for it. Our schema already does — binding.target IS the act-scope and is inside view_hash — so no field was added, only a statement (PR-08) and a provenance record (PR-09), since key-cape emits tenant as a bare string. key-cape had already implemented registration-bound tenancy on 2026-09-09, correct under both candidate rulings, so the fail-closed-at-first-use risk that made us withhold the client strings was already retired. IN-0002 closed. The one remaining input to T07 is the deployed origin. GH-DEC-2026-014 granted commitment-only evidence and bounded it. It satisfies non-alteration and NOT reconstructability, and must not be described otherwise anywhere. It also corrected our wording of the gap: we wrote that it leaves us able to erase the content, which understates it. Commitment-only moves integrity out of our control and leaves availability entirely inside it — the party that can withhold the content is the party the evidence is about. Limit 3's condition reduced, not removed. The grant carries a condition we did not propose and would not have thought of: the path must assert that committed content exists and where custody sits, so non-production is a finding attributable to the custodian rather than an unremarkable blank. A commitment with no assertion that something is being committed to is indistinguishable from a commitment to nothing. Booked as PR-53, and marked not-a-reversal-candidate. Recorded the meta-rule Gate House named, now in its third setting here: unknown versus absent in the stance map, directory-asserted versus registration-supplied in the tenant claim, erased versus never held in the evidence path. Wherever a system reaches one appearance by two routes, the record must say which route. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V3W1dQG7GFFM9d94jFx7iR Assistant: claude-code Assistant-Model: opus Assistant-Process: 1565372@bnt-lap001 Assistant-Session: 16bb2f25-b34c-49ef-8e94-5fec3567a568
128 lines
6.1 KiB
Markdown
128 lines
6.1 KiB
Markdown
# SCOPE
|
|
|
|
> Implemented-and-first-cut boundary for agents and contributors. Aspirational
|
|
> direction belongs in `INTENT.md`; the current stage belongs in `GOAL.md`;
|
|
> current work and gates belong in `workplans/`.
|
|
|
|
## Status — 2026-09-09
|
|
|
|
**Specification and declaration are complete; no service is deployed.**
|
|
|
|
What exists and is tested: the layer and stance declarations (`layer.yaml`,
|
|
`pep-stance.yaml`, `informed_decision/stance.py`), the governed canonicalizer
|
|
and schema, and the four specs under `docs/specs/`. 46 tests pass.
|
|
|
|
What does not exist: any HTTP surface, any storage, any UI, any deployment. The
|
|
walking skeleton is `INFD-WP-0001-T08` and is gated on an external decision
|
|
(§"Open" below).
|
|
|
|
## One-liner
|
|
|
|
informed-decision is the presentation and binding surface for decisions: it
|
|
renders a Decision Memo to the human who holds the mandate, records what was
|
|
shown, and binds their identity to the act — and owns the browser-facing
|
|
approver UI that `approval-engine` deliberately does not contain.
|
|
|
|
## Layer
|
|
|
|
**PEP-shaped**, ruled by `GH-DEC-2026-012`. Not an Engine. Companion §5 owed,
|
|
statute §6.4 in full. Declared in `layer.yaml` in this repository's own voice.
|
|
|
|
It emits one PIP-like fact — *what was presented* — as a claim, under three
|
|
limits that are the substance of the permission rather than caveats on it:
|
|
|
|
1. the claim carries presentation and nothing else, and must never carry,
|
|
restate, summarise or imply a decision or verdict;
|
|
2. the claim must never be an input to the decision it presents for;
|
|
3. the evidence copy reaches `audit-core` **independently** of this repository.
|
|
|
|
Limit 2 is load-bearing: the argument that a renderer attesting its own
|
|
rendering is not self-dealing was accepted *because* that limit holds.
|
|
|
|
## Core Idea
|
|
|
|
A decision surface is not a workflow engine and not a decision point. This
|
|
repository owns the Decision Memo object, the presentation record, the
|
|
canonicalization producing `view_hash` / `awareness_hash`, the disposition
|
|
vocabulary, and the evidence bundle export. It does not evaluate whether an act
|
|
is permitted, does not hold approval current-state, and does not archive the
|
|
trail.
|
|
|
|
## In Scope — first cut (Stage 1)
|
|
|
|
**Built and tested:**
|
|
|
|
- Canonicalization of the binding and awareness documents, with the three
|
|
published vectors reproducing byte for byte and all four isolation properties
|
|
pinned (`tests/test_canonicalize.py`).
|
|
- The Decision Memo schema and worked examples, governed under `schemas/`.
|
|
- The unreachable-engine stance map, built to v0.8 obligation 3, with
|
|
published-equals-shipped asserted by test (`tests/test_layer_conformance.py`).
|
|
|
|
**Specified, not built:**
|
|
|
|
- The presentation record: what was rendered, to whom, when, in which locale and
|
|
UI release.
|
|
- Required-highlight acknowledgment as a precondition of binding.
|
|
- The disposition vocabulary and its legality tables. Only `accept` reaches
|
|
`approval-engine`; `return`, `discuss`, `escalate` and the rest are
|
|
memo-level.
|
|
- The browser-facing OIDC client: authorization-code + S256 PKCE against
|
|
`key-cape`, scopes `[openid, approval:read, approval:approve]`.
|
|
- An L3 approver surface calling `approval-engine`'s approval-entry mutation.
|
|
- The evidence bundle as an offline-verifiable export.
|
|
|
|
## Out of Scope
|
|
|
|
- Authorization decisions — `access-engine`, always and only (statute §6).
|
|
- The approval object, its state machine, validity and consumption —
|
|
`approval-engine`. Never cached, never inferred, never `approval:consume`.
|
|
- Approval doctrine — `gate-house`.
|
|
- Identity and authentication — `key-cape`. Imported, never invented. The
|
|
`assurance` shape is `key-cape`'s and is cited, not restated.
|
|
- The evidence archive — `audit-core`.
|
|
- Credentials materialized after a decision — `secrets-engine`.
|
|
- Notification transport, ticketing, general workflow.
|
|
- **An approvals inbox.** Foreclosed upstream as well as here:
|
|
`approval-engine` exposes get-by-id only and will not add a list.
|
|
- L4/L5, QES, QTSP, qualified archival retention.
|
|
- The mandate graph — so a Stage 1 `escalate` is an assertion, not a verified
|
|
claim.
|
|
|
|
## What this repository does not claim
|
|
|
|
Stated here because a scope file that only lists capabilities overstates them.
|
|
|
|
- **The decision path is not validated.** `GH-DEC-2026-010` requires a decision
|
|
be attributable to `access-engine`; no consumer can satisfy that today because
|
|
the envelope is unsigned (`FLEX-WP-0024`). This surface records
|
|
`decision_attributable: false` and must not describe validation as complete.
|
|
- **The residual is open.** A compromised surface can present X and attest Y.
|
|
`GH-DEC-2026-012` states it is not closed and does not credit this repository
|
|
with closing it.
|
|
- **`view_hash` is not inside the approval entry.** `POST /entries` discards its
|
|
body by design. Correlation is `(approval_id, subject, approved_at)`, so an
|
|
auditor holding only the approval object cannot reach the presentation.
|
|
- **Commitment-only evidence is not reconstructability.** `GH-DEC-2026-014`
|
|
granted it for Stage 1 and bounded it: it satisfies non-alteration, and moves
|
|
integrity out of our control while leaving *availability* entirely inside it.
|
|
The party that can withhold the content is the party the evidence is about.
|
|
Narrowed by the required existence assertion; not closed.
|
|
- **The registration-bound tenant is a declared bounded gap**, not the terminal
|
|
state. `GH-DEC-2026-013` ruled directory-sourced terminal and admitted
|
|
`key-cape`'s shape because its distinguishing case fails closed. Build to it
|
|
as transitional.
|
|
- **Nothing is deployed**, so nothing is observed in production and nothing is
|
|
contained automatically.
|
|
|
|
## Open
|
|
|
|
- **The deployed origin** — the one remaining input to `T07`. `client_id` and
|
|
the callback URI must name a real origin, since redirects match exactly.
|
|
- **`audit-core` registration and cadence** — the payload is ruled
|
|
(commitment-only, with the existence assertion); the sender registration and
|
|
whether reconciliation-plus-heartbeat suits a mixed-volume source are still
|
|
`audit-core`'s to answer. Required before `T08` ships.
|
|
|
|
*Closed 2026-09-10:* the human token tenant (`GH-DEC-2026-013`, `key-cape`
|
|
`329e48f`) and the evidence payload question (`GH-DEC-2026-014`).
|