# Semantic contract

The logical model does not depend on Python, JSON, SQLite or the native file layout. Version 0.1.0 selects a bounded binding, not universal execution semantics. Both independent research studies and their S1 amendments informed this D2 selection. Descriptive-only definitions, host-minted request IDs and the precise implementation are Codex choices revised after the frozen R1 audits; a new frozen R2 audit is required before release.

## Identity and lifecycle

ActionDefinition identity is `definitionId` within a Dimension's governed namespace. Each `version` is an immutable semantic revision with a full-content digest. Renaming changes the revision, not the stable object. The same ID/version with changed content is rejected. A version has a half-open validity interval. Retirement is a monotonic host-governance overlay recorded by control sequence; it never edits the retained definition body and cannot silently reactivate. A new revision can be added. A definition has a steward and a declared master; fixture admission is a host decision, not validation of their real-world standing.

Descriptive-only definitions pin an external parameter-contract document and identify their target, preconditions and intended external effect in text. The document is not fetched or interpreted. Such definitions can be cataloged as company knowledge but cannot enter the reference executor. Executable definitions use the closed labels contract, synthetic resource type, fixed precondition/effect identifiers and local adapter. Free text never changes that operation.

ActionRequest identity is a host-minted `requestId`. It has exactly one immutable intent and one submission event. The retained key slot is `(store/Dimension, authenticated actor, exact retry key)`; the stored key hash excludes no actor information. The store supplies Dimension isolation. Intent includes the dimension, exact definition pin, resource and expected revision, ordered labels, actor/principal, purpose, audience, deadline and optional compensation receipt. It contains no request ID, decision, receipt or current rights. Server-minted IDs therefore remain recoverable when the first response is lost.

The semantic state is reconstructed from events: pending → committed, cancelled, expired or rejected-precondition. Only pending can acquire a terminal state. A current-policy denial leaves it pending. Expiry is materialized on a dispatch/cancel try at `now >= expiresAt`; passive lookup can still return pending after the deadline and must not be read as permission to execute. Committed requests never become expired. Native object state remains `active`: native existence and execution state are different concepts. Key retirement is an orthogonal retained-key marker permitted only after a terminal state.

Every admitted dispatch and retained replay with at least one current applicable right retains a delivery and a current-policy try, including terminal replay. A caller with no current applicable rights cannot grow the event log; administrative control sequence still advances for a completed read/refusal transaction. A malformed body, unauthorized new submission, conflicting key or retired key is not admitted as a delivery event. Transport telemetry outside this boundary is external. Therefore delivery count, try count and effect count differ. Cancellation and observation have their own tries without fabricated transport-delivery events. Each effect has one receipt Event; at most one effect belongs to a request.

## Authority and confidentiality

The host's fixture policy is a list of closed direct-representation/self rules. Each records actor, principal, mode, issuer, issuer-standing evidence and external basis. The basis is a host-owned reference snapshot; this package does not create a second mandate registry or claim exact conformance to a WM-XCT-001 record schema. Source WriteGrant, source precedence, stewardship duties, function/capability descriptions and obligation claims never become execution permission.

For one rule, both principalScope and delegateScope must independently contain the exact Dimension, full definition pin, resource, purpose, audience, current time and requested operation. A permission split across different rules is not combined into one valid intersection. No wildcards, role inference, chains, implicit audience, or use counters exist. The immutable request does not freeze policy: each try retains the then-current policy revision, matched rule digests, definition availability and decision. The host supplies verified policies and issuer evidence; the code checks their declared exact scopes, not their external truth.

Current read permission is independent of execute. A caller without current read receives exactly `{"status":"withheld"}` for successful execution, denial, malformed input, absent key, conflict, retired key and supported internal error paths. The guarantee covers response shape/content, not constant-time behavior, transport status, host logs or system outages. A conflict requires read permission for both the old intent and proposed context before returning `key-conflict`. A current read grant can inspect a receipt after execute is revoked. A readable denied dispatch reports current-execution-denied together with retained requestState, requestId, intentDigest and any prior receipt. Pending denial is therefore distinguishable from a committed result whose replay is now denied. Successful dispatch replay still requires current execute rights and definition availability; lookup remains independently governed. A retired-key lookup/dispatch returns the retained result with status key-retired without a new try. Observe on a retired key is withheld.

The API only retrieves a key in the authenticated actor's namespace. Cross-actor administration and organizational reporting require separately authorized projections. Reads of exported native files bypass this API and therefore require host-controlled access. Observation requires both read and observe. It records the authenticated actor's claim, never turns it into authoritative effect truth.

## Effects, cancellation and correction

Request admission, policy selection, definition availability, cancellation, key binding, resource revision, effect and receipt share `BEGIN IMMEDIATE` serialization in one SQLite database. Resource updates are append-only revisions. Expected revision is checked before a first effect; a replay checks the retained intent/key first and cannot reapply after intervening work. Injected failures before effect and between effect and receipt roll back the whole transaction. A simulated response loss occurs after commit and is resolved using the same key. No test simulates storage hardware failure.

Cancellation and execution contend for the same lock and can produce only one terminal outcome. Cancel does not undo a committed effect. Compensation is a new intent/key/request referencing a retained receipt. It requires the same actor, principal, purpose, audience, Dimension, definition and resource; the original before-labels; and the current revision equal to the original after-revision. An intervening update rejects compensation, even when labels happen to look equal. Retiring or expiring the exact definition also blocks same-pin compensation, even if that effect once succeeded. Cross-version or emergency compensation is not implemented. The narrow same-actor compensation rule can be widened only by an explicitly versioned and reviewed host contract.

An observation correction references one earlier observation by the same observer on the same request. A predecessor can have only one direct correction, producing a linear correction chain. Another independent observation can coexist. Corrections never replace receipts, delete predecessors, cancel requests or modify labels. Claims `caller-unknown`, `caller-observed-success` and `caller-observed-failure` describe observer knowledge, not executor states.

## Byte contract and bounded representation

The normative intent/definition/rule digest is SHA-256 of the reference Python encoding: sorted object keys by Unicode code point, compact separators, unescaped non-ASCII UTF-8, no BOM, no whitespace, ordered arrays retained, no Unicode normalization. It is explicitly **not RFC 8785 JCS**. Raw-file hashes are separate. Duplicate JSON keys, floating-point literals, NaN/infinities, invalid UTF-8 and unpaired surrogates are rejected; integers must be real Python ints within ±(2^53−1), never bools.

An individual input is at most 128 KiB, depth 24, 128 object members, 256 array entries and 4096 characters per string before tighter schema constraints. IDs use the bounded ASCII grammar; labels allow Unicode, duplicates and order, at most 32 labels of 200 characters. Empty labels and an empty list are valid opaque synthetic values; this is not a company taxonomy validator. Host times are integer UTC epoch seconds in [2000-01-01, 2100-01-01]; windows are half-open. No leap-second or subsecond semantics is implied. Snapshot collections and authoritative tables are each limited to 10,000 rows. Every transaction checks every table before commit. Overflow rolls back the whole operation, including admission, evidence, effect and control-sequence increment. Caller endpoints withhold that failure; trusted administration raises Refused. No automatic deletion, new key, new database or rollover occurs. Definitions/resources/requests/events cannot grow past their limit. Policy revisions 0 through 9,998 occupy at most 9,999 rows; the final row, revision 9,999, is reserved for an empty global-revocation policy. Once full, no further policy revision is possible; the host must preserve history and halt this fixture or arrange a separately reviewed migration. Reads remain available under current policy when only another table is full. The explicit capacity is a reference boundary, not an enterprise-scale storage design.

## Native evidence and history

Native objects carry `enterpriseActionDefinition` and `enterpriseActionRequest` facets. A request facet contains only immutable identity, intent and admission; semantic state is derived from native Event profiles. Definition versions form a native object-revision chain. Resource snapshots are synthetic fixture object revisions. Event subjects resolve to actual request/definition/resource object IDs or actual prior Event IDs, never a retry hash masquerading as an object.

Seven event profiles: Submission, Delivery, Try, Receipt, Disposition, Observation and KeyRetirement. Event issuer is the trusted host; request actor/principal and observation observer remain separately explicit. `recordedAt` and `occurredAt` coincide for the local synthetic engine; receipt occurrence is the atomic local commit evidence, not an external system's clock. Export time is separate.

The privileged snapshot retains every definition, policy revision, resource revision, request and event. Global control sequence orders policy changes, definition retirement, resource creation and tries, even at the same host second. Lookup and snapshot also allocate a sequence and advance the nondecreasing host clock; they are serialized transactions, not read-only filesystem operations. The history validator checks selected policy was current at that control sequence, recomputes exact-scope decisions, replays lifecycle and effects, checks compensation/correction and compares final snapshots. Each event-bearing control sequence must contain one complete operation with a single request, time and issuer: submission when new, delivery plus execute try, and every required outcome; or cancel/observe try and its required outcome; or key retirement. Missing tails are refused even when derived snapshots were rewritten. Administrative mutations cannot share that sequence with an event operation. This still cannot authenticate the source or prove that an internally coherent cut is the latest.

Native exports are idempotent evidence, not a second execution master. `snapshot.json`, deterministic native files and an exact-file manifest are produced at one cut; manifest is written last. Interruption before the manifest leaves an invalid incomplete export. A between-files interruption can resume with the retained identical snapshot and directory. A torn file or changed cut requires a fresh directory; conflicting old evidence is preserved. This is not a power-loss recovery claim. Record filenames use the SHA-256 of each full case-sensitive logical ID, avoiding Windows colon/alternate-stream and case-folding names while keeping the logical ID in the payload. Extra files, subdirectories or symlinks are refused. Existing different bytes are refused. This does not claim atomicity across native files. `verify_export` checks exact closure/digests and semantic regeneration; a hostile party recomputing a complete fake archive can still forge a coherent story unless a trusted external expected root is supplied by the host.

## Dependencies and adoption

The instance graph links requests to definitions/resources and prior receipts. The specification graph has conceptual comparisons to WM-XCT-001/002/029, EFA and K1/K2, with no unverified mandatory inheritance. The delivery graph includes Python sources, standalone companion, sibling schema and reference runtime; jsonschema is an external pinned dependency. A publisher can deliver the companion without importing the full parent universes. Optional descriptive K2 alignment is never exactMatch.

Native installation uses a separately labeled new synthetic Dimension fixture and explicit companion validation. WM-XCT-040 0.1.1 currently rejects an empty runtime path map, while the pinned native runtime schema and creator/validator accept it. The test helper uses that native route, exact five-file installation and a lock explicitly marked status candidate with simulationOnly true; it does not modify the published composer or claim its composition acceptance. Empty runtime `paths` is intentional: this package introduces object facets and Event payloads, not generic fact paths. An outer native pass cannot prove their semantics. Actual production publication and HTTP verification remain separate release gates. Generic automatic composition support for object/Event-only packages is an outstanding platform issue.

## Endpoint and supporting-evidence qualifications

Admitting a new request requires an existing synthetic-executable definition and an allowed declared purpose. Admission may occur while that definition is retired, outside its validity interval or while execute is denied; it produces pending intent, not an executable promise. A later try recomputes availability. An expired pending request is materialized as expired on a dispatch by a caller with at least one current applicable right, even when execute is denied; this creates no effect. Cancel needs cancel authority to create its terminal disposition. Denied cancel retains a try only for a current reader; denied observe retains no event. These endpoint differences are deliberate and do not imply ambient permission.

The retry hash is an unsalted digest of actor and key and is NOT a secrecy mechanism for a weak key. Host-generated unpredictable retry keys and controlled export access are external duties. Host event issuer, authenticated actor, represented principal, definition steward and policy issuer are different roles. The fixture trusts that the host verified issuer-standing and basis references; it does not require all declared policy issuers to equal the event recorder.

Native ActionDefinition state active records existence, not current availability. Native request state active is not execution state. Full policy revisions, definition retirement and the cut metadata are mandatory companion evidence. Each installation stores snapshot.json, manifest.json and exact projected record files under data/action-exports/cut-<controlSequence>/ inside the Dimension, and validates from stored readback together with native records. No native facet becomes a second execution master. Startup, matrix and AI-service fixtures exercise self versus direct representation in separate namespaces; they do not implement complete organizational or AI governance semantics.

Creation exclusively reserves a new database path. If initialization fails, a partial file may remain; do not automatically reuse, erase or reopen it as valid. The operator must preserve diagnostic evidence and deliberately select a fresh path after resolving the failure. No migration from unpublished R1 stores or exports is supported; start new synthetic fixtures while keeping R1 evidence unchanged. Archive validation is privileged and assumes host resource isolation; it is not a public arbitrary-file upload service.