coulomb/maturity-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
maturity-engine/docs/claim-contract.md
tegwick 4cde4e489a Stand up the Engine/PIP surface for MAT-WP-0001 
Declare layer.yaml, add a Python engine over a local SQLite store,
and cover deterministic assessment, the §13 gap register, stance-map
inventory, claim guardrails, and the gate-house review path with tests.

Assistant: grok
Assistant-Session: 01a04ceb-150e-7e80-a542-ec8b1372e164
2026-08-29 12:54:37 +02:00

1.9 KiB
Raw Permalink Blame History

Maturity level claim contract

maturity-engine is a PIP. A computed level leaves this engine only as a request claim (or as a versioned policy rule authored elsewhere). It is not an authorization decision.

Statute: security-layer-model v0.7 §6.2, §9.5.

Claim shape

{
  "kind": "maturity-level",
  "issuer": "maturity-engine",
  "subject": "ops-warden",
  "model_id": "asm",
  "model_version": "0.3",
  "level": 1,
  "level_id": "ASM-1",
  "assessed_at": "2026-08-29T12:00:00Z",
  "assessment_id": "<uuid5 of canonical inputs>",
  "freshness_rule": "assessment evaluated_at plus limiting evidence valid_until",
  "digest": "<sha-256 of the claim without this field>"
}

access-engine consumes this object as an input claim. Reconstructability is from the decision record that names the claim digest, not from a registry row.

Forbidden

  • Compiling a level into registry content. Until access-engine decision provenance carries a registry-snapshot digest, a level that reached a decision through the registry is not reconstructable. The engine raises GuardrailError on compile_into_registry.
  • A consumer branching on a fetched level (if level >= 3: allow). That is a second decision point. The engine raises GuardrailError on gate_on_level.
  • Any authorize / decide / may surface on this engine.

Evidence bound

Assessment records are load-bearing once consumed as claims: emission is queued in this engine's local SQLite outbox in the same transaction as the state change. No synchronous audit-core call sits inside that transaction.

The archive proves records were not altered or truncated after arrival. It does not prove an event never sent. Absence of a record is not evidence of non-occurrence.

Rare load-bearing classes use a heartbeat (maturity-engine heartbeat via Engine.heartbeat), not a rate.

Gap-register mutations are attributive unless a control's soundness depends on their presence.