The round returned findings from access-engine, approval-engine,
ops-warden and net-kingdom. v0.8 stayed proposed throughout, so these
are corrections to an uncut standard rather than amendments to an
accepted one. §15 items 12-20 list them; §14 records what the round
did and did not cover.
The load-bearing one is §6.4 obligation 1. The obligation said a PEP
must hold "a decision from access-engine", and obligation 2 supplied a
digest test emphatic that it was mechanical rather than a matter of
judgement. That test establishes which request a decision is for and
nothing about who issued it, and it cannot: every input to it is either
sent by the caller or published. Fail-closed protects against a
decision point that is absent, not against one that lies. Obligation 5
was then written over a pair of artifacts whose authenticity only one
half of could be validated, since §9.4 requires the approval object to
have authenticated entries and nothing required it of the decision.
The obligation now requires attribution, states that the digest
comparison does not discharge it, and carries a declared §13 gap with
access-engine as owner rather than a mechanism the standard does not
get to choose.
Obligation 3 gains three things: the drift test promoted SHOULD to MUST
(the strongest obligation in the section had the weakest verification,
in a paragraph arguing that drift is worse than no publication), a
prohibition on totality satisfied by a catch-all, and the requirement
that an absent scope be distinguishable in the record from an unknown
one. The last closes the §16 question opened at the cut: absent fails
closed too, for the stronger reason, and the distinction is in the
record rather than in the stance.
ops-warden asked for a dated transitional unknown: fail_open converting
on coverage. Declined, with its reasons in §6.4: a sanctioned
transitional fail_open is indistinguishable at runtime from the stance
the rule forbids, and would make the rule optional at the only moment
it costs anything. Its second preference is adopted instead — §13.1
records a dated classification-coverage figure beside each stance, so a
strict consumer and an unclassified one stop reading alike. Its measured
figures are in the register, and ops-mason's unpublished map is now
marked as the plainer violation of the same obligation it always was.
§6.4 announced four obligations and listed five. §17 called ownership
of three artifacts unsettled while settling one of them in the same
sentence. §14's tally could not be checked because item 2b's numbering
left a reader unable to tell whether it was a change or a sub-clause.
§19's hole was explained where nobody looks. All four found by
approval-engine.
21 tests pass.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012viPor8WJNCbV64ipwewrm
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1754332@bnt-lap001
Assistant-Session: 9c8ac536-ff5e-46a3-8ab1-a548bde25fc0
tegwick
64394e99b9