{ "vercy": "1.0-draft", "metaModel": { "id": "enterprise-action-requests", "registryId": "vr.profile.enterprise-action-requests", "name": "Enterprise Action Requests", "version": "0.1.0", "kind": "companion-contract", "logicalKind": "action-definition-and-request-contract" }, "canonicalUrl": "https://ver.cy/models/enterprise-action-requests/versions/0.1.0/spec.json", "model": { "purpose": "Describe governed actions, preserve immutable intent and validate a bounded local execution history without deriving permission from descriptions.", "scope": "# Semantic contract\n\nThe logical model does not depend on Python, JSON, SQLite or the native file layout. Version 0.1.0 selects a bounded binding, not universal execution semantics. Both independent research studies and their S1 amendments informed this D2 selection. Descriptive-only definitions, host-minted request IDs and the precise implementation are Codex choices awaiting separate frozen audits.\n\n## Identity and lifecycle\n\nActionDefinition identity is `definitionId` within a Dimension's governed namespace. Each `version` is an immutable semantic revision with a full-content digest. Renaming changes the revision, not the stable object. The same ID/version with changed content is rejected. A version has a half-open validity interval. Retirement is a monotonic host-governance overlay recorded by control sequence; it never edits the retained definition body and cannot silently reactivate. A new revision can be added. A definition has a steward and a declared master; fixture admission is a host decision, not validation of their real-world standing.\n\nDescriptive-only definitions pin an external parameter-contract document and identify their target, preconditions and intended external effect in text. The document is not fetched or interpreted. Such definitions can be cataloged as company knowledge but cannot enter the reference executor. Executable definitions use the closed labels contract, synthetic resource type, fixed precondition/effect identifiers and local adapter. Free text never changes that operation.\n\nActionRequest identity is a host-minted `requestId`. It has exactly one immutable intent and one submission event. The retained key slot is `(store/Dimension, authenticated actor, exact retry key)`; the stored key hash excludes no actor information. The store supplies Dimension isolation. Intent includes the dimension, exact definition pin, resource and expected revision, ordered labels, actor/principal, purpose, audience, deadline and optional compensation receipt. It contains no request ID, decision, receipt or current rights. Server-minted IDs therefore remain recoverable when the first response is lost.\n\nThe semantic state is reconstructed from events: pending → committed, cancelled, expired or rejected-precondition. Only pending can acquire a terminal state. A current-policy denial leaves it pending. Expiry is materialized on a dispatch/cancel try at `now >= expiresAt`; passive lookup can still return pending after the deadline and must not be read as permission to execute. Committed requests never become expired. Native object state remains `active`: native existence and execution state are different concepts. Key retirement is an orthogonal retained-key marker permitted only after a terminal state.\n\nEvery valid admitted/repeated dispatch retains a delivery and a current-policy try, including terminal replay. A malformed body, unauthorized new submission, conflicting key or retired key is not admitted as a delivery event. Transport telemetry outside this boundary is external. Therefore delivery count, try count and effect count differ. Cancellation and observation have their own tries without fabricated transport-delivery events. Each effect has one receipt Event; at most one effect belongs to a request.\n\n## Authority and confidentiality\n\nThe host's fixture policy is a list of closed direct-representation/self rules. Each records actor, principal, mode, issuer, issuer-standing evidence and external basis. The basis is a host-owned reference snapshot; this package does not create a second mandate registry or claim exact conformance to a WM-XCT-001 record schema. Source WriteGrant, source precedence, stewardship duties, function/capability descriptions and obligation claims never become execution permission.\n\nFor one rule, both principalScope and delegateScope must independently contain the exact Dimension, full definition pin, resource, purpose, audience, current time and requested operation. A permission split across different rules is not combined into one valid intersection. No wildcards, role inference, chains, implicit audience, or use counters exist. The immutable request does not freeze policy: each try retains the then-current policy revision, matched rule digests, definition availability and decision. The host supplies verified policies and issuer evidence; the code checks their declared exact scopes, not their external truth.\n\nCurrent read permission is independent of execute. A caller without current read receives exactly `{\"status\":\"withheld\"}` for successful execution, denial, malformed input, absent key, conflict, retired key and supported internal error paths. The guarantee covers response shape/content, not constant-time behavior, transport status, host logs or system outages. A conflict requires read permission for both the old intent and proposed context before returning `key-conflict`. A current read grant can inspect a receipt after execute is revoked. The dispatch replay endpoint requires current execute rights and definition availability before reporting a successful terminal replay; lookup remains independently governed.\n\nThe API only retrieves a key in the authenticated actor's namespace. Cross-actor administration and organizational reporting require separately authorized projections. Reads of exported native files bypass this API and therefore require host-controlled access. Observation requires both read and observe. It records the authenticated actor's claim, never turns it into authoritative effect truth.\n\n## Effects, cancellation and correction\n\nRequest admission, policy selection, definition availability, cancellation, key binding, resource revision, effect and receipt share `BEGIN IMMEDIATE` serialization in one SQLite database. Resource updates are append-only revisions. Expected revision is checked before a first effect; a replay checks the retained intent/key first and cannot reapply after intervening work. Injected failures before effect and between effect and receipt roll back the whole transaction. A simulated response loss occurs after commit and is resolved using the same key. No test simulates storage hardware failure.\n\nCancellation and execution contend for the same lock and can produce only one terminal outcome. Cancel does not undo a committed effect. Compensation is a new intent/key/request referencing a retained receipt. It requires the same actor, principal, purpose, audience, Dimension, definition and resource; the original before-labels; and the current revision equal to the original after-revision. An intervening update rejects compensation, even when labels happen to look equal. The narrow same-actor compensation rule can be widened only by an explicitly versioned and reviewed host contract.\n\nAn observation correction references one earlier observation by the same observer on the same request. A predecessor can have only one direct correction, producing a linear correction chain. Another independent observation can coexist. Corrections never replace receipts, delete predecessors, cancel requests or modify labels. Claims `caller-unknown`, `caller-observed-success` and `caller-observed-failure` describe observer knowledge, not executor states.\n\n## Byte contract and bounded representation\n\nThe normative intent/definition/rule digest is SHA-256 of the reference Python encoding: sorted object keys by Unicode code point, compact separators, unescaped non-ASCII UTF-8, no BOM, no whitespace, ordered arrays retained, no Unicode normalization. It is explicitly **not RFC 8785 JCS**. Raw-file hashes are separate. Duplicate JSON keys, floating-point literals, NaN/infinities, invalid UTF-8 and unpaired surrogates are rejected; integers must be real Python ints within ±(2^53−1), never bools.\n\nAn individual input is at most 128 KiB, depth 24, 128 object members, 256 array entries and 4096 characters per string before tighter schema constraints. IDs use the bounded ASCII grammar; labels allow Unicode, duplicates and order, at most 32 labels of 200 characters. Host times are integer UTC epoch seconds in [2000-01-01, 2100-01-01]; windows are half-open. No leap-second or subsecond semantics is implied. Snapshot collections are separately bounded at 10,000 rows each and their row bodies are individually validated.\n\n## Native evidence and history\n\nNative objects carry `enterpriseActionDefinition` and `enterpriseActionRequest` facets. A request facet contains only immutable identity, intent and admission; semantic state is derived from native Event profiles. Definition versions form a native object-revision chain. Resource snapshots are synthetic fixture object revisions. Event subjects resolve to actual request/definition/resource object IDs or actual prior Event IDs, never a retry hash masquerading as an object.\n\nSeven event profiles: Submission, Delivery, Try, Receipt, Disposition, Observation and KeyRetirement. Event issuer is the trusted host; request actor/principal and observation observer remain separately explicit. `recordedAt` and `occurredAt` coincide for the local synthetic engine; receipt occurrence is the atomic local commit evidence, not an external system's clock. Export time is separate.\n\nThe privileged snapshot retains every definition, policy revision, resource revision, request and event. Global control sequence orders policy changes/retirement with tries, even at the same host second. The history validator checks selected policy was current at that control sequence, recomputes exact-scope decisions, replays lifecycle and effects, checks compensation/correction and compares final snapshots. It still cannot authenticate the source or prove that an internally coherent cut is the latest.\n\nNative exports are idempotent evidence, not a second execution master. `snapshot.json`, deterministic native files and an exact-file manifest are produced at one cut; manifest is written last. Interruption before the manifest leaves an invalid incomplete export. Resume with the retained identical snapshot and directory; a changed cut needs a different directory. Existing different bytes are refused. This does not claim atomicity across native files. `verify_export` checks exact closure/digests and semantic regeneration; a hostile party recomputing a complete fake archive can still forge a coherent story unless a trusted external expected root is supplied by the host.\n\n## Dependencies and adoption\n\nThe instance graph links requests to definitions/resources and prior receipts. The specification graph has conceptual comparisons to WM-XCT-001/002/029, EFA and K1/K2, with no unverified mandatory inheritance. The delivery graph includes Python sources, standalone companion, sibling schema and reference runtime; jsonschema is an external pinned dependency. A publisher can deliver the companion without importing the full parent universes. Optional descriptive K2 alignment is never exactMatch.\n\nNative installation uses a separately labeled new synthetic Dimension fixture and explicit companion validation. WM-XCT-040 0.1.1 currently rejects an empty runtime path map, while the pinned native runtime schema and creator/validator accept it. The test helper uses that native route, exact five-file installation and a simulated candidate lock; it does not modify the published composer or claim its composition acceptance. Empty runtime `paths` is intentional: this package introduces object facets and Event payloads, not generic fact paths. An outer native pass cannot prove their semantics. Actual production publication and HTTP verification remain separate release gates. Generic automatic composition support for object/Event-only packages is an outstanding platform issue.\n" }, "structure": { "bundles": [ { "id": "AR-B1", "name": "Definition", "description": "Definition of company action requests.", "layers": [ { "id": "AR-B1-L1", "name": "Meaning and governance", "description": "Questions and evidence for meaning and governance.", "findings": [ { "id": "AR-F01", "name": "Operation boundary", "description": "Exact immutable ActionDefinition and parameter contract", "questions": [ { "id": "AR-Q01", "text": "Which versioned operation is described?", "kind": "host-guidance", "answer_data": [ "Exact immutable ActionDefinition and parameter contract", "Keep description separate from permission; do not invoke descriptive-only definitions." ] }, { "id": "AR-Q02", "text": "Is it descriptive-only or executable in this binding?", "kind": "host-guidance", "answer_data": [ "Exact immutable ActionDefinition and parameter contract", "Keep description separate from permission; do not invoke descriptive-only definitions." ] } ], "artifacts": [ { "id": "AR-A01", "name": "Exact immutable ActionDefinition and parameter contract", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT01", "description": "Keep description separate from permission; do not invoke descriptive-only definitions. Requires the applicable host authority." } ] }, { "id": "AR-F02", "name": "Revision and stewardship", "description": "Stable definition ID, revision chain, steward, master and validity", "questions": [ { "id": "AR-Q03", "text": "Who governs this definition?", "kind": "host-guidance", "answer_data": [ "Stable definition ID, revision chain, steward, master and validity", "Add a new revision for changed meaning; never replace the same ID/version." ] }, { "id": "AR-Q04", "text": "What changed across revisions or retirement?", "kind": "host-guidance", "answer_data": [ "Stable definition ID, revision chain, steward, master and validity", "Add a new revision for changed meaning; never replace the same ID/version." ] } ], "artifacts": [ { "id": "AR-A02", "name": "Stable definition ID, revision chain, steward, master and validity", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT02", "description": "Add a new revision for changed meaning; never replace the same ID/version. Requires the applicable host authority." } ] }, { "id": "AR-F03", "name": "Neighbor alignment", "description": "Pinned comparison and explicit relation", "questions": [ { "id": "AR-Q05", "text": "Does K2 actClass overlap this operation?", "kind": "host-guidance", "answer_data": [ "Pinned comparison and explicit relation", "Keep optional crosswalk descriptive; never infer permission from a neighbor model." ] }, { "id": "AR-Q06", "text": "Does a capability or obligation authorize it?", "kind": "host-guidance", "answer_data": [ "Pinned comparison and explicit relation", "Keep optional crosswalk descriptive; never infer permission from a neighbor model." ] } ], "artifacts": [ { "id": "AR-A03", "name": "Pinned comparison and explicit relation", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT03", "description": "Keep optional crosswalk descriptive; never infer permission from a neighbor model. Requires the applicable host authority." } ] } ] } ] }, { "id": "AR-B2", "name": "Request", "description": "Request of company action requests.", "layers": [ { "id": "AR-B2-L1", "name": "Intent and identity", "description": "Questions and evidence for intent and identity.", "findings": [ { "id": "AR-F04", "name": "Intent boundary", "description": "Closed immutable intent and exact definition pin", "questions": [ { "id": "AR-Q07", "text": "What exact effect is being requested?", "kind": "host-guidance", "answer_data": [ "Closed immutable intent and exact definition pin", "Ask for missing actor, principal, resource revision, purpose or audience; do not fill them by guessing." ] }, { "id": "AR-Q08", "text": "What is the smallest valid request?", "kind": "host-guidance", "answer_data": [ "Closed immutable intent and exact definition pin", "Ask for missing actor, principal, resource revision, purpose or audience; do not fill them by guessing." ] } ], "artifacts": [ { "id": "AR-A04", "name": "Closed immutable intent and exact definition pin", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT04", "description": "Ask for missing actor, principal, resource revision, purpose or audience; do not fill them by guessing. Requires the applicable host authority." } ] }, { "id": "AR-F05", "name": "Retry identity", "description": "Retained actor-scoped key hash and intent bytes", "questions": [ { "id": "AR-Q09", "text": "How can a caller recover a lost response?", "kind": "host-guidance", "answer_data": [ "Retained actor-scoped key hash and intent bytes", "Retry the same intent and key only after continuity is established." ] }, { "id": "AR-Q10", "text": "Does a changed body reuse the old key?", "kind": "host-guidance", "answer_data": [ "Retained actor-scoped key hash and intent bytes", "Retry the same intent and key only after continuity is established." ] } ], "artifacts": [ { "id": "AR-A05", "name": "Retained actor-scoped key hash and intent bytes", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT05", "description": "Retry the same intent and key only after continuity is established. Requires the applicable host authority." } ] }, { "id": "AR-F06", "name": "Host identity", "description": "Host-minted request ID and submission event", "questions": [ { "id": "AR-Q11", "text": "Which Dimension owns this request?", "kind": "host-guidance", "answer_data": [ "Host-minted request ID and submission event", "Keep server ID outside client intent digest; bind it once at admission." ] }, { "id": "AR-Q12", "text": "Who mints its ID?", "kind": "host-guidance", "answer_data": [ "Host-minted request ID and submission event", "Keep server ID outside client intent digest; bind it once at admission." ] } ], "artifacts": [ { "id": "AR-A06", "name": "Host-minted request ID and submission event", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT06", "description": "Keep server ID outside client intent digest; bind it once at admission. Requires the applicable host authority." } ] } ] } ] }, { "id": "AR-B3", "name": "Authority", "description": "Authority of company action requests.", "layers": [ { "id": "AR-B3-L1", "name": "Standing and scope", "description": "Questions and evidence for standing and scope.", "findings": [ { "id": "AR-F07", "name": "External authority basis", "description": "Host rule, issuer-standing Pin and external basis Pin", "questions": [ { "id": "AR-Q13", "text": "Who can act for whom?", "kind": "host-guidance", "answer_data": [ "Host rule, issuer-standing Pin and external basis Pin", "Require host verification; do not construct a second mandate master." ] }, { "id": "AR-Q14", "text": "Who verified the issuer has standing?", "kind": "host-guidance", "answer_data": [ "Host rule, issuer-standing Pin and external basis Pin", "Require host verification; do not construct a second mandate master." ] } ], "artifacts": [ { "id": "AR-A07", "name": "Host rule, issuer-standing Pin and external basis Pin", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT07", "description": "Require host verification; do not construct a second mandate master. Requires the applicable host authority." } ] }, { "id": "AR-F08", "name": "Scope intersection", "description": "One complete matching pair of scopes", "questions": [ { "id": "AR-Q15", "text": "Are both principal and actor allowed?", "kind": "host-guidance", "answer_data": [ "One complete matching pair of scopes", "Intersect both scopes within the same rule; do not combine partial grants." ] }, { "id": "AR-Q16", "text": "Are action, resource, purpose and audience exact?", "kind": "host-guidance", "answer_data": [ "One complete matching pair of scopes", "Intersect both scopes within the same rule; do not combine partial grants." ] } ], "artifacts": [ { "id": "AR-A08", "name": "One complete matching pair of scopes", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT08", "description": "Intersect both scopes within the same rule; do not combine partial grants. Requires the applicable host authority." } ] }, { "id": "AR-F09", "name": "Fresh decision", "description": "Policy revision, control sequence, decision and rule digests", "questions": [ { "id": "AR-Q17", "text": "Which policy applied at this try?", "kind": "host-guidance", "answer_data": [ "Policy revision, control sequence, decision and rule digests", "Check current inputs under the effect transaction." ] }, { "id": "AR-Q18", "text": "Was the definition still available?", "kind": "host-guidance", "answer_data": [ "Policy revision, control sequence, decision and rule digests", "Check current inputs under the effect transaction." ] } ], "artifacts": [ { "id": "AR-A09", "name": "Policy revision, control sequence, decision and rule digests", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT09", "description": "Check current inputs under the effect transaction. Requires the applicable host authority." } ] }, { "id": "AR-F10", "name": "Disclosure", "description": "Current read decision independent of execute", "questions": [ { "id": "AR-Q19", "text": "Can this caller see the outcome now?", "kind": "host-guidance", "answer_data": [ "Current read decision independent of execute", "Return the uniform withheld response when read is denied." ] }, { "id": "AR-Q20", "text": "Could an error reveal hidden existence?", "kind": "host-guidance", "answer_data": [ "Current read decision independent of execute", "Return the uniform withheld response when read is denied." ] } ], "artifacts": [ { "id": "AR-A10", "name": "Current read decision independent of execute", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT10", "description": "Return the uniform withheld response when read is denied. Requires the applicable host authority." } ] } ] } ] }, { "id": "AR-B4", "name": "Execution", "description": "Execution of company action requests.", "layers": [ { "id": "AR-B4-L1", "name": "Lifecycle and effects", "description": "Questions and evidence for lifecycle and effects.", "findings": [ { "id": "AR-F11", "name": "Submission versus proposal", "description": "Submission, delivery and try event identities", "questions": [ { "id": "AR-Q21", "text": "Has intent been admitted or merely proposed?", "kind": "host-guidance", "answer_data": [ "Submission, delivery and try event identities", "Require explicit submit permission; preserve proposal origin without executing it." ] }, { "id": "AR-Q22", "text": "Did a delivery actually lead to a try?", "kind": "host-guidance", "answer_data": [ "Submission, delivery and try event identities", "Require explicit submit permission; preserve proposal origin without executing it." ] } ], "artifacts": [ { "id": "AR-A11", "name": "Submission, delivery and try event identities", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT11", "description": "Require explicit submit permission; preserve proposal origin without executing it. Requires the applicable host authority." } ] }, { "id": "AR-F12", "name": "Atomic effect", "description": "Before/after revisions and one local transaction", "questions": [ { "id": "AR-Q23", "text": "What changed in the resource?", "kind": "host-guidance", "answer_data": [ "Before/after revisions and one local transaction", "Use only the bounded local adapter; external side effects need another contract." ] }, { "id": "AR-Q24", "text": "Are the key, effect and receipt committed together?", "kind": "host-guidance", "answer_data": [ "Before/after revisions and one local transaction", "Use only the bounded local adapter; external side effects need another contract." ] } ], "artifacts": [ { "id": "AR-A12", "name": "Before/after revisions and one local transaction", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT12", "description": "Use only the bounded local adapter; external side effects need another contract. Requires the applicable host authority." } ] }, { "id": "AR-F13", "name": "Replay", "description": "Retained receipt and immutable digest", "questions": [ { "id": "AR-Q25", "text": "Has this request already produced an effect?", "kind": "host-guidance", "answer_data": [ "Retained receipt and immutable digest", "Return permitted retained evidence; never reapply an old effect." ] }, { "id": "AR-Q26", "text": "Did the resource change in the meantime?", "kind": "host-guidance", "answer_data": [ "Retained receipt and immutable digest", "Return permitted retained evidence; never reapply an old effect." ] } ], "artifacts": [ { "id": "AR-A13", "name": "Retained receipt and immutable digest", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT13", "description": "Return permitted retained evidence; never reapply an old effect. Requires the applicable host authority." } ] }, { "id": "AR-F14", "name": "Deadline", "description": "Half-open request deadline and terminal history", "questions": [ { "id": "AR-Q27", "text": "Can a first effect still occur?", "kind": "host-guidance", "answer_data": [ "Half-open request deadline and terminal history", "Expire only pending requests; preserve committed state." ] }, { "id": "AR-Q28", "text": "Is an old committed receipt being mistaken for expiry?", "kind": "host-guidance", "answer_data": [ "Half-open request deadline and terminal history", "Expire only pending requests; preserve committed state." ] } ], "artifacts": [ { "id": "AR-A14", "name": "Half-open request deadline and terminal history", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT14", "description": "Expire only pending requests; preserve committed state. Requires the applicable host authority." } ] }, { "id": "AR-F15", "name": "Cancellation", "description": "Current cancel decision and serialized disposition", "questions": [ { "id": "AR-Q29", "text": "Can a pending request be cancelled?", "kind": "host-guidance", "answer_data": [ "Current cancel decision and serialized disposition", "Cancel pending intent only; do not claim undo after commit." ] }, { "id": "AR-Q30", "text": "Which terminal operation won the race?", "kind": "host-guidance", "answer_data": [ "Current cancel decision and serialized disposition", "Cancel pending intent only; do not claim undo after commit." ] } ], "artifacts": [ { "id": "AR-A15", "name": "Current cancel decision and serialized disposition", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT15", "description": "Cancel pending intent only; do not claim undo after commit. Requires the applicable host authority." } ] }, { "id": "AR-F16", "name": "Compensation", "description": "Original receipt, exact old labels and current revision", "questions": [ { "id": "AR-Q31", "text": "Which effect is to be compensated?", "kind": "host-guidance", "answer_data": [ "Original receipt, exact old labels and current revision", "Create a new request and key; refuse stale or context-mismatched compensation." ] }, { "id": "AR-Q32", "text": "Has intervening work changed its revision?", "kind": "host-guidance", "answer_data": [ "Original receipt, exact old labels and current revision", "Create a new request and key; refuse stale or context-mismatched compensation." ] } ], "artifacts": [ { "id": "AR-A16", "name": "Original receipt, exact old labels and current revision", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT16", "description": "Create a new request and key; refuse stale or context-mismatched compensation. Requires the applicable host authority." } ] } ] } ] }, { "id": "AR-B5", "name": "Evidence", "description": "Evidence of company action requests.", "layers": [ { "id": "AR-B5-L1", "name": "History and adoption", "description": "Questions and evidence for history and adoption.", "findings": [ { "id": "AR-F17", "name": "Observer knowledge", "description": "Observation event and identified observer", "questions": [ { "id": "AR-Q33", "text": "What does the caller know about the result?", "kind": "host-guidance", "answer_data": [ "Observation event and identified observer", "Record knowledge separately from authoritative effect state." ] }, { "id": "AR-Q34", "text": "Is uncertainty local to the observer?", "kind": "host-guidance", "answer_data": [ "Observation event and identified observer", "Record knowledge separately from authoritative effect state." ] } ], "artifacts": [ { "id": "AR-A17", "name": "Observation event and identified observer", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT17", "description": "Record knowledge separately from authoritative effect state. Requires the applicable host authority." } ] }, { "id": "AR-F18", "name": "Correction", "description": "Linear correction edge and reason", "questions": [ { "id": "AR-Q35", "text": "Which observation is corrected?", "kind": "host-guidance", "answer_data": [ "Linear correction edge and reason", "Append a correction; never edit a receipt or erase the original." ] }, { "id": "AR-Q36", "text": "Does the predecessor still exist unchanged?", "kind": "host-guidance", "answer_data": [ "Linear correction edge and reason", "Append a correction; never edit a receipt or erase the original." ] } ], "artifacts": [ { "id": "AR-A18", "name": "Linear correction edge and reason", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT18", "description": "Append a correction; never edit a receipt or erase the original. Requires the applicable host authority." } ] }, { "id": "AR-F19", "name": "Mastership", "description": "One SQLite master and labeled native evidence", "questions": [ { "id": "AR-Q37", "text": "Which store is authoritative for execution?", "kind": "host-guidance", "answer_data": [ "One SQLite master and labeled native evidence", "Keep export read-only with explicit capture time and sequence." ] }, { "id": "AR-Q38", "text": "Is a native export being treated as a second master?", "kind": "host-guidance", "answer_data": [ "One SQLite master and labeled native evidence", "Keep export read-only with explicit capture time and sequence." ] } ], "artifacts": [ { "id": "AR-A19", "name": "One SQLite master and labeled native evidence", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT19", "description": "Keep export read-only with explicit capture time and sequence. Requires the applicable host authority." } ] }, { "id": "AR-F20", "name": "History validation", "description": "Replay report and externally expected manifest root", "questions": [ { "id": "AR-Q39", "text": "Do the records form a coherent history?", "kind": "host-guidance", "answer_data": [ "Replay report and externally expected manifest root", "Separate internal consistency from authenticated current admission." ] }, { "id": "AR-Q40", "text": "Does this prove authenticity or the latest cut?", "kind": "host-guidance", "answer_data": [ "Replay report and externally expected manifest root", "Separate internal consistency from authenticated current admission." ] } ], "artifacts": [ { "id": "AR-A20", "name": "Replay report and externally expected manifest root", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT20", "description": "Separate internal consistency from authenticated current admission. Requires the applicable host authority." } ] }, { "id": "AR-F21", "name": "Export recovery", "description": "Exact manifest, snapshot and deterministic native files", "questions": [ { "id": "AR-Q41", "text": "Was every file captured at one cut?", "kind": "host-guidance", "answer_data": [ "Exact manifest, snapshot and deterministic native files", "Resume identical bytes; a changed cut needs a new directory." ] }, { "id": "AR-Q42", "text": "Can an interrupted export be resumed safely?", "kind": "host-guidance", "answer_data": [ "Exact manifest, snapshot and deterministic native files", "Resume identical bytes; a changed cut needs a new directory." ] } ], "artifacts": [ { "id": "AR-A21", "name": "Exact manifest, snapshot and deterministic native files", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT21", "description": "Resume identical bytes; a changed cut needs a new directory. Requires the applicable host authority." } ] }, { "id": "AR-F22", "name": "Retention", "description": "Terminal-only key retirement event and retained key slot", "questions": [ { "id": "AR-Q43", "text": "Can this key be reused after retirement?", "kind": "host-guidance", "answer_data": [ "Terminal-only key retirement event and retained key slot", "Keep nonreuse evidence; this fixture has no erasure mechanism." ] }, { "id": "AR-Q44", "text": "Which evidence is retained?", "kind": "host-guidance", "answer_data": [ "Terminal-only key retirement event and retained key slot", "Keep nonreuse evidence; this fixture has no erasure mechanism." ] } ], "artifacts": [ { "id": "AR-A22", "name": "Terminal-only key retirement event and retained key slot", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT22", "description": "Keep nonreuse evidence; this fixture has no erasure mechanism. Requires the applicable host authority." } ] }, { "id": "AR-F23", "name": "Restore continuity", "description": "Recovery decision and external continuity root", "questions": [ { "id": "AR-Q45", "text": "Could this be a coherent old database?", "kind": "host-guidance", "answer_data": [ "Recovery decision and external continuity root", "Stop and reconcile before dispatch after uncertain restoration." ] }, { "id": "AR-Q46", "text": "What external anchor establishes the latest state?", "kind": "host-guidance", "answer_data": [ "Recovery decision and external continuity root", "Stop and reconcile before dispatch after uncertain restoration." ] } ], "artifacts": [ { "id": "AR-A23", "name": "Recovery decision and external continuity root", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT23", "description": "Stop and reconcile before dispatch after uncertain restoration. Requires the applicable host authority." } ] }, { "id": "AR-F24", "name": "Byte identity", "description": "Explicit Python encoding and raw artifact SHA", "questions": [ { "id": "AR-Q47", "text": "Which canonical bytes define equality?", "kind": "host-guidance", "answer_data": [ "Explicit Python encoding and raw artifact SHA", "Reject duplicates/floats/surrogates; never label this encoding JCS." ] }, { "id": "AR-Q48", "text": "Are ordering or Unicode silently normalized?", "kind": "host-guidance", "answer_data": [ "Explicit Python encoding and raw artifact SHA", "Reject duplicates/floats/surrogates; never label this encoding JCS." ] } ], "artifacts": [ { "id": "AR-A24", "name": "Explicit Python encoding and raw artifact SHA", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT24", "description": "Reject duplicates/floats/surrogates; never label this encoding JCS. Requires the applicable host authority." } ] }, { "id": "AR-F25", "name": "Native binding", "description": "Three synthetic installation reports and exact file readback", "questions": [ { "id": "AR-Q49", "text": "Do stored native records match the semantic snapshot?", "kind": "host-guidance", "answer_data": [ "Three synthetic installation reports and exact file readback", "Validate nested facets/history explicitly; outer envelopes alone are insufficient." ] }, { "id": "AR-Q50", "text": "Did the companion validator run after outer checks?", "kind": "host-guidance", "answer_data": [ "Three synthetic installation reports and exact file readback", "Validate nested facets/history explicitly; outer envelopes alone are insufficient." ] } ], "artifacts": [ { "id": "AR-A25", "name": "Three synthetic installation reports and exact file readback", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT25", "description": "Validate nested facets/history explicitly; outer envelopes alone are insufficient. Requires the applicable host authority." } ] }, { "id": "AR-F26", "name": "Adoption boundary", "description": "Descriptive minimum profile, synthetic execution profile and limits", "questions": [ { "id": "AR-Q51", "text": "Which use cases are useful today?", "kind": "host-guidance", "answer_data": [ "Descriptive minimum profile, synthetic execution profile and limits", "Adopt the smallest useful profile; do not claim distributed execution readiness." ] }, { "id": "AR-Q52", "text": "Which production responsibilities remain external?", "kind": "host-guidance", "answer_data": [ "Descriptive minimum profile, synthetic execution profile and limits", "Adopt the smallest useful profile; do not claim distributed execution readiness." ] } ], "artifacts": [ { "id": "AR-A26", "name": "Descriptive minimum profile, synthetic execution profile and limits", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT26", "description": "Adopt the smallest useful profile; do not claim distributed execution readiness. Requires the applicable host authority." } ] } ] } ] } ] }, "composition": { "runtimeImports": [], "semanticReferences": [ { "id": "WM-XCT-002", "version": "0.3.0-research.1", "url": "https://ver.cy/models/wm-xct-002-access-contract-consent/spec.yaml", "digest": "sha256:9085d977567f3e1fc0b9bb27c6a7c517139f5972a1b95bf4a2bedccdb10bf2db", "relation": "Disclosure contract comparison; does not supply effect authorization" }, { "id": "WM-XCT-029", "version": "0.3.0-research.1", "url": "https://ver.cy/models/wm-xct-029-obligation-commitment/spec.yaml", "digest": "sha256:33b9845b2b334949d5538c1c859dbb41c23872577ae6d3502cd48267f17a8e2a", "relation": "Duty/performance comparison; does not dispatch or transfer liability" }, { "id": "WM-XCT-001", "version": "0.3.1-enterprise.1", "url": "https://ver.cy/models/wm-xct-001-ownership-stewardship/spec.yaml", "digest": "sha256:fa942556a3f460729db2e94b24d1efd4d33ee2e5fb0b1deed3ce040756acf474", "relation": "Selected control/mandate comparison; not an executable imported mandate schema" } ], "delivery": "Two object types and seven native Event profiles with a bounded fixture. No mandatory runtime inheritance from the compared research parents. Native toolchain pinned separately." }, "statistics": { "bundles": 5, "layers": 5, "findings": 26, "questions": 52, "artifacts": 26 }, "wholeObjectFacets": { "ActionDefinition": { "identity-class": { "status": "required", "reason": "Stable definition ID plus immutable version; native revision chain." }, "direct-properties": { "status": "required", "reason": "Parameter contract, mode, target, guards, effect boundary, validity, steward/master." }, "recognition-observation": { "status": "required", "reason": "Recognition uses exact retained bytes and admitted reference, not a name match." }, "capabilities-behaviour-actions": { "status": "required", "reason": "Definition can be revised or retired by the host; it does not authorize execution." }, "context-evidence": { "status": "required", "reason": "Host governance, optional legacy Pin and external parameter evidence." } }, "ActionRequest": { "identity-class": { "status": "required", "reason": "Host-minted request ID; exactly one intent and submission; separate actor-scoped retry slot." }, "direct-properties": { "status": "required", "reason": "Exact intent, ordered labels, definition pin, actor/principal, target revision, deadline." }, "recognition-observation": { "status": "required", "reason": "Recognized by retained ID/key/digest plus exact bytes; observer claims remain separate." }, "capabilities-behaviour-actions": { "status": "required", "reason": "Pending can commit/cancel/expire/reject under guards; native object state is separate." }, "context-evidence": { "status": "required", "reason": "One owning Dimension, current policy evidence and submission provenance." } }, "SubmissionEvent": { "identity-class": { "status": "required", "reason": "Immutable event ID and global event/control sequence." }, "direct-properties": { "status": "required", "reason": "Request ID, intent digest, admission time and host issuer." }, "recognition-observation": { "status": "required", "reason": "Admission is an occurrence asserted by the fixture host, not an observer success claim." }, "capabilities-behaviour-actions": { "status": "required", "reason": "Append once after current submit permission; cannot itself prove execution." }, "context-evidence": { "status": "required", "reason": "Exact request object, current admission policy and definition revision." } }, "DeliveryEvent": { "identity-class": { "status": "required", "reason": "Immutable event ID for an admitted dispatch or exact retained replay." }, "direct-properties": { "status": "required", "reason": "Request ID, unchanged digest, host capture time and sequence." }, "recognition-observation": { "status": "required", "reason": "Records a delivery reaching this boundary; excludes malformed/unauthorized telemetry." }, "capabilities-behaviour-actions": { "status": "required", "reason": "Can precede a try; does not entail a committed effect." }, "context-evidence": { "status": "required", "reason": "Host capture source, request and definition IDs." } }, "TryEvent": { "identity-class": { "status": "required", "reason": "Immutable event ID per evaluated execute/cancel/observe operation." }, "direct-properties": { "status": "required", "reason": "Action, current policy revision, match digests, definition availability, decision." }, "recognition-observation": { "status": "required", "reason": "A recorded decision is neither a verified external mandate nor a result receipt." }, "capabilities-behaviour-actions": { "status": "required", "reason": "Only allowed guarded tries can produce their respective downstream records." }, "context-evidence": { "status": "required", "reason": "Host issuer, global control sequence and closed verified-by-host policy snapshots." } }, "ReceiptEvent": { "identity-class": { "status": "required", "reason": "Immutable event ID; at most one effect receipt per request." }, "direct-properties": { "status": "required", "reason": "Before/after labels and revisions, exact definition, try and compensation links." }, "recognition-observation": { "status": "required", "reason": "Authoritative local transaction evidence; caller observations do not overwrite it." }, "capabilities-behaviour-actions": { "status": "required", "reason": "Can be referenced by a new guarded compensation request; never mutated or cancelled." }, "context-evidence": { "status": "required", "reason": "One local effect boundary, request, resource, successful try and optional prior receipt." } }, "DispositionEvent": { "identity-class": { "status": "required", "reason": "Immutable event ID for the single terminal transition of pending intent." }, "direct-properties": { "status": "required", "reason": "From pending to cancelled/expired/rejected-precondition, reason and try." }, "recognition-observation": { "status": "required", "reason": "Read as host-recorded lifecycle evidence, not proof of remote effects." }, "capabilities-behaviour-actions": { "status": "required", "reason": "Applies exactly once; cannot rewrite committed or other terminal states." }, "context-evidence": { "status": "required", "reason": "Current guard evidence, request and causal try." } }, "ObservationEvent": { "identity-class": { "status": "required", "reason": "Immutable event ID, observer and optional earlier observation edge." }, "direct-properties": { "status": "required", "reason": "Caller knowledge claim, reason, capture time and correction link." }, "recognition-observation": { "status": "required", "reason": "The claim is explicitly subjective knowledge; unknown is not executor uncertainty." }, "capabilities-behaviour-actions": { "status": "required", "reason": "Append an observation or linear correction with read+observe; never undo effects." }, "context-evidence": { "status": "required", "reason": "Same observer/request predecessor, current try and host capture provenance." } }, "KeyRetirementEvent": { "identity-class": { "status": "required", "reason": "Immutable event ID on a terminal request with retained key." }, "direct-properties": { "status": "required", "reason": "Retained marker, time and host issuer." }, "recognition-observation": { "status": "required", "reason": "A tombstone-like nonreuse marker, not evidence of erasure." }, "capabilities-behaviour-actions": { "status": "required", "reason": "Prevents subsequent dispatch through this key while retaining original evidence." }, "context-evidence": { "status": "required", "reason": "Trusted retention administrator, terminal history and persistent key slot." } } }, "factMastership": [ { "fact": "ActionDefinition", "semanticOwner": "Definition steward", "authoritativeSystem": "Verified definition governance mirrored in the fixture", "writer": "Host-verified administration", "readerPurpose": "Current exact read scope for request operations; host projection required for administrative exports", "validTime": "Definition/scope half-open interval", "provenance": "Host governance, optional legacy Pin and external parameter evidence.", "conflict": "Changed same identity rejected; new definition revision or observation correction must retain predecessor", "retention": "Full retained history in this reference; external legal retention and erasure are deferred" }, { "fact": "ActionRequest", "semanticOwner": "Requesting principal", "authoritativeSystem": "One authoritative SQLite fixture; native records are exported evidence", "writer": "Authenticated actor admitted by host", "readerPurpose": "Current exact read scope for request operations; host projection required for administrative exports", "validTime": "Immutable local occurrence and separate recorded/export time", "provenance": "One owning Dimension, current policy evidence and submission provenance.", "conflict": "Changed same identity rejected; new definition revision or observation correction must retain predecessor", "retention": "Full retained history in this reference; external legal retention and erasure are deferred" }, { "fact": "SubmissionEvent", "semanticOwner": "Host execution/lifecycle authority", "authoritativeSystem": "One authoritative SQLite fixture; native records are exported evidence", "writer": "Serialized fixture host", "readerPurpose": "Current exact read scope for request operations; host projection required for administrative exports", "validTime": "Immutable local occurrence and separate recorded/export time", "provenance": "Exact request object, current admission policy and definition revision.", "conflict": "Changed same identity rejected; new definition revision or observation correction must retain predecessor", "retention": "Full retained history in this reference; external legal retention and erasure are deferred" }, { "fact": "DeliveryEvent", "semanticOwner": "Host execution/lifecycle authority", "authoritativeSystem": "One authoritative SQLite fixture; native records are exported evidence", "writer": "Serialized fixture host", "readerPurpose": "Current exact read scope for request operations; host projection required for administrative exports", "validTime": "Immutable local occurrence and separate recorded/export time", "provenance": "Host capture source, request and definition IDs.", "conflict": "Changed same identity rejected; new definition revision or observation correction must retain predecessor", "retention": "Full retained history in this reference; external legal retention and erasure are deferred" }, { "fact": "TryEvent", "semanticOwner": "Host execution/lifecycle authority", "authoritativeSystem": "One authoritative SQLite fixture; native records are exported evidence", "writer": "Serialized fixture host", "readerPurpose": "Current exact read scope for request operations; host projection required for administrative exports", "validTime": "Immutable local occurrence and separate recorded/export time", "provenance": "Host issuer, global control sequence and closed verified-by-host policy snapshots.", "conflict": "Changed same identity rejected; new definition revision or observation correction must retain predecessor", "retention": "Full retained history in this reference; external legal retention and erasure are deferred" }, { "fact": "ReceiptEvent", "semanticOwner": "Host execution/lifecycle authority", "authoritativeSystem": "One authoritative SQLite fixture; native records are exported evidence", "writer": "Serialized fixture host", "readerPurpose": "Current exact read scope for request operations; host projection required for administrative exports", "validTime": "Immutable local occurrence and separate recorded/export time", "provenance": "One local effect boundary, request, resource, successful try and optional prior receipt.", "conflict": "Changed same identity rejected; new definition revision or observation correction must retain predecessor", "retention": "Full retained history in this reference; external legal retention and erasure are deferred" }, { "fact": "DispositionEvent", "semanticOwner": "Host execution/lifecycle authority", "authoritativeSystem": "One authoritative SQLite fixture; native records are exported evidence", "writer": "Serialized fixture host", "readerPurpose": "Current exact read scope for request operations; host projection required for administrative exports", "validTime": "Immutable local occurrence and separate recorded/export time", "provenance": "Current guard evidence, request and causal try.", "conflict": "Changed same identity rejected; new definition revision or observation correction must retain predecessor", "retention": "Full retained history in this reference; external legal retention and erasure are deferred" }, { "fact": "ObservationEvent", "semanticOwner": "Identified observer", "authoritativeSystem": "One authoritative SQLite fixture; native records are exported evidence", "writer": "Authenticated actor admitted by host", "readerPurpose": "Current exact read scope for request operations; host projection required for administrative exports", "validTime": "Immutable local occurrence and separate recorded/export time", "provenance": "Same observer/request predecessor, current try and host capture provenance.", "conflict": "Changed same identity rejected; new definition revision or observation correction must retain predecessor", "retention": "Full retained history in this reference; external legal retention and erasure are deferred" }, { "fact": "KeyRetirementEvent", "semanticOwner": "Host execution/lifecycle authority", "authoritativeSystem": "One authoritative SQLite fixture; native records are exported evidence", "writer": "Host-verified administration", "readerPurpose": "Current exact read scope for request operations; host projection required for administrative exports", "validTime": "Immutable local occurrence and separate recorded/export time", "provenance": "Trusted retention administrator, terminal history and persistent key slot.", "conflict": "Changed same identity rejected; new definition revision or observation correction must retain predecessor", "retention": "Full retained history in this reference; external legal retention and erasure are deferred" } ], "catalogue": { "alternateNames": [ "EM-XCT-07", "ActionDefinition", "ActionRequest", "Action authority and delegation" ], "domain": [ "Enterprise", "Action and authority" ], "tags": [ "action", "request", "authority", "delegation", "idempotency", "receipt", "compensation" ], "adoption": "Start with a descriptive ActionDefinition and steward. Executable use is limited to the synthetic adapter and requires explicit current host authority and disclosure.", "limits": "No distributed effects, identity provider, legal mandate verifier, delegation chains or production restoration service. Candidate implementation audits pending." } }