One row, no doctrine change. key-cape has no adapter populating the
directory user tenant, so a client registration supplies a human
principal's tenant. gate-house ruled that admissible as a declared
bounded gap rather than as the answer, on the ground that its
distinguishing case fails closed: where registration and directory
disagree, issuance is refused rather than resolved either way.
Registered here because condition 3 of that ruling requires it — a
transitional shape not held in a register becomes the permanent answer
by nobody minding it. Intended owner is left unnamed per 13's own rule
that an intended owner is a proposal to a repository rather than an
assignment onto it.
The standard stays proposed and this changes no normative text.
21 tests pass.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012viPor8WJNCbV64ipwewrm
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1754332@bnt-lap001
Assistant-Session: 9c8ac536-ff5e-46a3-8ab1-a548bde25fc0
The round returned findings from access-engine, approval-engine,
ops-warden and net-kingdom. v0.8 stayed proposed throughout, so these
are corrections to an uncut standard rather than amendments to an
accepted one. §15 items 12-20 list them; §14 records what the round
did and did not cover.
The load-bearing one is §6.4 obligation 1. The obligation said a PEP
must hold "a decision from access-engine", and obligation 2 supplied a
digest test emphatic that it was mechanical rather than a matter of
judgement. That test establishes which request a decision is for and
nothing about who issued it, and it cannot: every input to it is either
sent by the caller or published. Fail-closed protects against a
decision point that is absent, not against one that lies. Obligation 5
was then written over a pair of artifacts whose authenticity only one
half of could be validated, since §9.4 requires the approval object to
have authenticated entries and nothing required it of the decision.
The obligation now requires attribution, states that the digest
comparison does not discharge it, and carries a declared §13 gap with
access-engine as owner rather than a mechanism the standard does not
get to choose.
Obligation 3 gains three things: the drift test promoted SHOULD to MUST
(the strongest obligation in the section had the weakest verification,
in a paragraph arguing that drift is worse than no publication), a
prohibition on totality satisfied by a catch-all, and the requirement
that an absent scope be distinguishable in the record from an unknown
one. The last closes the §16 question opened at the cut: absent fails
closed too, for the stronger reason, and the distinction is in the
record rather than in the stance.
ops-warden asked for a dated transitional unknown: fail_open converting
on coverage. Declined, with its reasons in §6.4: a sanctioned
transitional fail_open is indistinguishable at runtime from the stance
the rule forbids, and would make the rule optional at the only moment
it costs anything. Its second preference is adopted instead — §13.1
records a dated classification-coverage figure beside each stance, so a
strict consumer and an unclassified one stop reading alike. Its measured
figures are in the register, and ops-mason's unpublished map is now
marked as the plainer violation of the same obligation it always was.
§6.4 announced four obligations and listed five. §17 called ownership
of three artifacts unsettled while settling one of them in the same
sentence. §14's tally could not be checked because item 2b's numbering
left a reader unable to tell whether it was a change or a sub-clause.
§19's hole was explained where nobody looks. All four found by
approval-engine.
21 tests pass.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012viPor8WJNCbV64ipwewrm
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1754332@bnt-lap001
Assistant-Session: 9c8ac536-ff5e-46a3-8ab1-a548bde25fc0
gate-house circulated v0.8 with two questions for this repository as owner of
the NetKingdom emission-cadence security profile: whether §17's ownership
paragraph reads in our own voice, and whether §11's new conformance item
follows the profile or diverges from it.
§17 is confirmed as written. It assigns the generic EmissionCadenceDeclaration
contract to info-tech-canon and to net-kingdom the MUST/SHOULD split, the
rare-class rate-monitoring prohibition, and the heartbeat-plus-reconciliation
obligation — which is emission-cadence-security-profile_v0.1.md §3, conjunction
included. No change.
§11 diverged in both directions and is corrected. Requiring a detection surface
of "heartbeat or reconciliation" of every load-bearing source withholds from a
volume class the expected-rate form the profile permits, and accepts for a rare
class either control alone where the profile — and the checker in
tools/emission-cadence-profile — require both. A rare class covered by a
heartbeat alone has no reconciliation to catch divergence, and one covered by
reconciliation alone produces no claim that can go missing, which is the whole
reason §9.6 rejects rate monitoring there. The item also contradicted its own
following paragraph, which admits rate monitoring except where the class is
rare.
The check now defers the form to the governing profile rather than restating a
split that is §17's to assign, carries the volume/rare distinction explicitly,
and states that classification is the source's published inventory and never the
checker's to infer from a name, payload, or observed rate — otherwise omission
detection is circular.
Change log item 6 and §14 record the review. The standard stays proposed;
publication and the acceptance flip wait on the close of the circulation round.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ek3zTdfMa35bPVDjVUyhxx
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 868701@bnt-lap001
Assistant-Session: b2e101b6-f501-40dc-9ee5-438cac36e21a
secrets-engine found, and access-engine and approval-engine reported
independently within hours, that GH-DEC-2026-008 as written was
unimplementable. Where a claim travels inside the hashed request — the
dual-control pattern it was written for — embedding the claim changes the
digest of the request carrying it, so a digest recorded at issue can
never equal the final one. It is a hash cycle. A fail-closed consumer
obeying the rule would have denied destroy permanently.
The comparison is now against the digest the PDP publishes for the
request with the approval evidence excluded (flex-auth's
binding.approval_binding_digest, verified present in its schema and
tests). The exclusion rule is the PDP's to publish and a consumer MUST
NOT guess it: a digest computed under an assumed rule fails open toward
accepting a claim bound to a different request — the same failure
direction as an invented vocabulary mapping, by another road.
§6.4 obligation 5 gains the general property access-engine flagged as a
near miss rather than a request: an evidence-bearing input may be
excluded from a correspondence digest but never from the replay identity.
Two requests differing only in which approval was presented decide
differently, so collapsing them lets an allow obtained with a valid claim
be replayed against a request carrying none — a fail-open hole reached by
a refactor that looks like simplification.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtJBr77gMFLrN93iEevqQJ
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 425128@bnt-lap001
Assistant-Session: f5944d8b-dac4-4e1a-87eb-8b3d8f314a63
Authored by gate-house under GH-WP-0003-T06; published here. v0.7 stays
accepted and unedited until v0.8 is accepted in its place.
Eleven changes across §6.4, §8, §9.5, §9.7.3, §11, §12, §13.1, §16 and
§17, each carrying the decision record that already governs its
implementers. Three correct a rule that was unsafe or unfalsifiable as
written — consume ordering, the volatility boundary, and a permissive
unknown. Three close gaps between rules already made. One corrects an
ownership paragraph that a later decision made false, and §11/§12 gain
the general form of that failure after six instances in one week.
Ten of the eleven were requested by another repository, seven by a
repository arguing against its own interest. §14 is therefore rewritten:
this version is circulated for review rather than accepted on the owner's
decision as v0.7 was, because it imposes costs on named repositories —
ops-warden acquires a non-conformant stance cell, approval-engine an
issue-time obligation — and a cost imposed without a review round is what
§12 exists to catch late.
Section numbering is unchanged; the estate cites it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WtJBr77gMFLrN93iEevqQJ
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 425128@bnt-lap001
Assistant-Session: f5944d8b-dac4-4e1a-87eb-8b3d8f314a63
