{ "vercy": "1.0-draft", "metaModel": { "id": "enterprise-action-requests", "registryId": "vr.profile.enterprise-action-requests", "name": "Enterprise Action Requests", "version": "0.1.0", "kind": "companion-contract", "logicalKind": "action-definition-and-request-contract" }, "canonicalUrl": "https://ver.cy/models/enterprise-action-requests/versions/0.1.0/spec.json", "model": { "purpose": "Describe governed actions, preserve immutable intent and validate a bounded local execution history without deriving permission from descriptions.", "scope": "# Semantic contract\n\nThe logical model does not depend on Python, JSON, SQLite or the native file layout. Version 0.1.0 selects a bounded binding, not universal execution semantics. Both independent research studies and their S1 amendments informed this D2 selection. Descriptive-only definitions, host-minted request IDs and the precise implementation are Codex choices revised after the frozen R1 and R2 audits. Audit-round evidence records the review state at its capture; final release disposition is separate in review.json.\n\n## Identity and lifecycle\n\nActionDefinition identity is `definitionId` within a Dimension's governed namespace. Each `version` is an immutable semantic revision with a full-content digest. Renaming changes the revision, not the stable object. The same ID/version with changed content is rejected. A version has a half-open validity interval. Retirement is a monotonic host-governance overlay recorded by control sequence; it never edits the retained definition body and cannot silently reactivate. A new revision can be added. A definition has a steward and a declared master; fixture admission is a host decision, not validation of their real-world standing.\n\nDescriptive-only definitions pin an external parameter-contract document and identify their target, preconditions and intended external effect in text. The document is not fetched or interpreted. Such definitions can be cataloged as company knowledge but cannot enter the reference executor. Executable definitions use the closed labels contract, synthetic resource type, fixed precondition/effect identifiers and local adapter. Free text never changes that operation.\n\nActionRequest identity is a host-minted `requestId`. It has exactly one immutable intent and one submission event. The retained key slot is `(store/Dimension, authenticated actor, exact retry key)`; the stored key hash excludes no actor information. The store supplies Dimension isolation. Intent includes the dimension, exact definition pin, resource and expected revision, ordered labels, actor/principal, purpose, audience, deadline and optional compensation receipt. It contains no request ID, decision, receipt or current rights. Server-minted IDs therefore remain recoverable when the first response is lost.\n\nThe semantic state is reconstructed from events: pending → committed, cancelled, expired or rejected-precondition. Only pending can acquire a terminal state. A current-policy denial leaves it pending. Expiry is materialized on a dispatch/cancel try at `now >= expiresAt`; passive lookup can still return pending after the deadline and must not be read as permission to execute. Committed requests never become expired. Native object state remains `active`: native existence and execution state are different concepts. Key retirement is an orthogonal retained-key marker permitted only after a terminal state.\n\nEvery admitted dispatch and retained replay with at least one current applicable right retains a delivery and a current-policy try, including terminal replay. A caller with no current applicable rights cannot grow the event log; administrative control sequence still advances for a completed read/refusal transaction. A malformed body, unauthorized new submission, conflicting key or retired key is not admitted as a delivery event. Transport telemetry outside this boundary is external. Therefore delivery count, try count and effect count differ. Cancellation and observation have their own tries without fabricated transport-delivery events. Each effect has one receipt Event; at most one effect belongs to a request. Caller receipt and observation responses are projections, not complete Event records: they omit global sequence and controlSequence. Full counters remain only in privileged snapshot/native evidence. A response projection must not be passed off as a schema-valid native Event.\n\n## Authority and confidentiality\n\nThe host's fixture policy is a list of closed direct-representation/self rules. Each records actor, principal, mode, issuer, issuer-standing evidence and external basis. The basis is a host-owned reference snapshot; this package does not create a second mandate registry or claim exact conformance to a WM-XCT-001 record schema. Source WriteGrant, source precedence, stewardship duties, function/capability descriptions and obligation claims never become execution permission.\n\nFor one rule, both principalScope and delegateScope must independently contain the exact Dimension, full definition pin, resource, purpose, audience, current time and requested operation. A permission split across different rules is not combined into one valid intersection. No wildcards, role inference, chains, implicit audience, or use counters exist. The immutable request does not freeze policy: each try retains the then-current policy revision, matched rule digests, definition availability and decision. The host supplies verified policies and issuer evidence; the code checks their declared exact scopes, not their external truth.\n\nCurrent read permission is independent of execute. A caller without current read receives exactly `{\"status\":\"withheld\"}` for successful execution, denial, malformed input, absent key, conflict, retired key and supported internal error paths. The guarantee covers response shape/content, not constant-time behavior, transport status, host logs or system outages. A conflict requires read permission for both the old intent and proposed context before returning `key-conflict`. A current read grant can inspect a receipt after execute is revoked. A readable denied dispatch reports current-execution-denied together with retained requestState, requestId, intentDigest and any prior receipt. Pending denial is therefore distinguishable from a committed result whose replay is now denied. Successful dispatch replay still requires current execute rights and definition availability; lookup remains independently governed. A retired-key lookup/dispatch returns the retained result with status key-retired without a new try. Observe on a retired key is withheld.\n\nThe API only retrieves a key in the authenticated actor's namespace. Cross-actor administration and organizational reporting require separately authorized projections. Reads of exported native files bypass this API and therefore require host-controlled access. Observation requires both read and observe. It records the authenticated actor's claim, never turns it into authoritative effect truth.\n\n## Effects, cancellation and correction\n\nRequest admission, policy selection, definition availability, cancellation, key binding, resource revision, effect and receipt share `BEGIN IMMEDIATE` serialization in one SQLite database. Resource updates are append-only revisions. Expected revision is checked before a first effect; a replay checks the retained intent/key first and cannot reapply after intervening work. Injected failures before effect and between effect and receipt roll back the whole transaction. A simulated response loss occurs after commit and is resolved using the same key. No test simulates storage hardware failure.\n\nCancellation and execution contend for the same lock and can produce only one terminal outcome. Cancel does not undo a committed effect. Compensation is a new intent/key/request referencing a retained receipt. It requires the same actor, principal, purpose, audience, Dimension, definition and resource; the original before-labels; and the current revision equal to the original after-revision. An intervening update rejects compensation, even when labels happen to look equal. Retiring or expiring the exact definition also blocks same-pin compensation, even if that effect once succeeded. Cross-version or emergency compensation is not implemented. The narrow same-actor compensation rule can be widened only by an explicitly versioned and reviewed host contract.\n\nAn observation correction references one earlier observation by the same observer on the same request. A predecessor can have only one direct correction, producing a linear correction chain. Another independent observation by that same actor can coexist. A different observer identity cannot access this actor-scoped key through the supplied API. Corrections never replace receipts, delete predecessors, cancel requests or modify labels. Claims `caller-unknown`, `caller-observed-success` and `caller-observed-failure` describe observer knowledge, not executor states.\n\n## Byte contract and bounded representation\n\nThe normative intent/definition/rule digest is SHA-256 of the reference Python encoding: sorted object keys by Unicode code point, compact separators, unescaped non-ASCII UTF-8, no BOM, no whitespace, ordered arrays retained, no Unicode normalization. It is explicitly **not RFC 8785 JCS**. Raw-file hashes are separate. Duplicate JSON keys, floating-point literals, NaN/infinities, invalid UTF-8 and unpaired surrogates are rejected; integers must be real Python ints within ±(2^53−1), never bools.\n\nAn individual input is at most 128 KiB, depth 24, 128 object members, 256 array entries and 4096 characters per string before tighter schema constraints. IDs use the bounded ASCII grammar; labels allow Unicode, duplicates and order, at most 32 labels of 200 characters. Empty labels and an empty list are valid opaque synthetic values; this is not a company taxonomy validator. Host times are integer UTC epoch seconds in [2000-01-01, 2100-01-01]; windows are half-open. No leap-second or subsecond semantics is implied. Snapshot collections and authoritative tables are each limited to 10,000 rows. Every transaction checks every table before commit. Overflow rolls back the whole operation, including admission, evidence, effect and control-sequence increment. Caller endpoints withhold that failure; trusted administration raises Refused. No automatic deletion, new key, new database or rollover occurs. Definitions/resources/requests/events cannot grow past their limit. Policy revisions 0 through 9,998 occupy at most 9,999 rows; the final row, revision 9,999, is reserved for an empty global-revocation policy. Once full, no further policy revision is possible; the host must preserve history and halt this fixture or arrange a separately reviewed migration. Reads remain available under current policy when only another table is full. The explicit capacity is a reference boundary, not an enterprise-scale storage design.\n\n## Native evidence and history\n\nNative objects carry `enterpriseActionDefinition` and `enterpriseActionRequest` facets. A request facet contains only immutable identity, intent and admission; semantic state is derived from native Event profiles. Definition versions form a native object-revision chain. Resource snapshots are synthetic fixture object revisions. Event subjects resolve to actual request/definition/resource object IDs or actual prior Event IDs, never a retry hash masquerading as an object.\n\nSeven event profiles: Submission, Delivery, Try, Receipt, Disposition, Observation and KeyRetirement. Event issuer is the trusted host; request actor/principal and observation observer remain separately explicit. `recordedAt` and `occurredAt` coincide for the local synthetic engine; receipt occurrence is the atomic local commit evidence, not an external system's clock. Export time is separate.\n\nThe privileged snapshot retains every definition, policy revision, resource revision, request and event. Global control sequence orders policy changes, definition retirement, resource creation and tries, even at the same host second. Lookup and snapshot also allocate a sequence and advance the nondecreasing host clock; they are serialized transactions, not read-only filesystem operations. The history validator checks selected policy was current at that control sequence, recomputes exact-scope decisions, replays lifecycle and effects, checks compensation/correction and compares final snapshots. Each event-bearing control sequence must contain one complete operation with a single request, time and issuer: submission when new, delivery plus execute try, and every required outcome; or cancel/observe try and its required outcome; or key retirement. Missing tails are refused even when derived snapshots were rewritten. Administrative mutations cannot share that sequence with an event operation. This still cannot authenticate the source or prove that an internally coherent cut is the latest.\n\nNative exports are idempotent evidence, not a second execution master. `snapshot.json`, deterministic native files and an exact-file manifest are produced at one cut; manifest is written last. Interruption before the manifest leaves an invalid incomplete export. A between-files interruption can resume with the retained identical snapshot and directory. A torn file or changed cut requires a fresh directory; conflicting old evidence is preserved. This is not a power-loss recovery claim. Record filenames use the SHA-256 of each full case-sensitive logical ID, avoiding Windows colon/alternate-stream and case-folding names while keeping the logical ID in the payload. Extra files, subdirectories or symlinks are refused. Existing different bytes are refused. This does not claim atomicity across native files. `verify_export` checks exact closure/digests and semantic regeneration; a hostile party recomputing a complete fake archive can still forge a coherent story unless a trusted external expected root is supplied by the host.\n\n## Dependencies and adoption\n\nThe instance graph links requests to definitions/resources and prior receipts. The specification graph has conceptual comparisons to WM-XCT-001/002/029, EFA and K1/K2, with no unverified mandatory inheritance. The delivery graph includes Python sources, standalone companion, sibling schema and reference runtime; jsonschema is an external pinned dependency. A publisher can deliver the companion without importing the full parent universes. Optional descriptive K2 alignment is never exactMatch.\n\nNative installation uses a separately labeled new synthetic Dimension fixture and explicit companion validation. WM-XCT-040 0.1.1 currently rejects an empty runtime path map, while the pinned native runtime schema and creator/validator accept it. The test helper uses that native route, exact nine-file installation and a lock explicitly marked status candidate with simulationOnly true; it does not modify the published composer or claim its composition acceptance. Empty runtime `paths` is intentional: this package introduces object facets and Event payloads, not generic fact paths. An outer native pass cannot prove their semantics. Actual production publication and HTTP verification remain separate release gates. Generic automatic composition support for object/Event-only packages is an outstanding platform issue.\n\n## Endpoint and supporting-evidence qualifications\n\nAdmitting a new request requires an existing synthetic-executable definition and an allowed declared purpose. Admission may occur while that definition is retired, outside its validity interval or while execute is denied; it produces pending intent, not an executable promise. A later try recomputes availability. An expired pending request is materialized as expired on a dispatch by a caller with at least one current applicable right, even when execute is denied; this creates no effect. Cancel needs cancel authority to create its terminal disposition. Denied cancel retains a try only for a current reader; denied observe retains no event. These endpoint differences are deliberate and do not imply ambient permission.\n\nThe retry hash is an unsalted digest of actor and key and is NOT a secrecy mechanism for a weak key. Host-generated unpredictable retry keys and controlled export access are external duties. Host event issuer, authenticated actor, represented principal, definition steward and policy issuer are different roles. The fixture trusts that the host verified issuer-standing and basis references; it does not require all declared policy issuers to equal the event recorder.\n\nNative ActionDefinition state active records existence, not current availability. Native request state active is not execution state. Full policy revisions, definition retirement and the cut metadata are mandatory companion evidence. Each installation stores snapshot.json, manifest.json and exact projected record files under data/action-exports/cut-/ inside the Dimension, and validates from stored readback together with native records. No native facet becomes a second execution master. Startup, matrix and AI-service fixtures exercise self versus direct representation in separate namespaces; they do not implement complete organizational or AI governance semantics.\n\nCreation exclusively reserves a new database path. If initialization fails, a partial file may remain; do not automatically reuse, erase or reopen it as valid. The operator must preserve diagnostic evidence and deliberately select a fresh path after resolving the failure. No migration from unpublished R1 stores or exports is supported; start new synthetic fixtures while keeping R1 evidence unchanged. Archive validation is privileged and assumes host resource isolation; it is not a public arbitrary-file upload service.\n\n## Finite lifetime and host admission control\n\nThe 10,000-row **global event** limit generally binds before requests/resources. With no later operations, each pending submission uses three Events (at most 3,333 requests) and each first commit uses four (at most 2,500 commits). Replays, observations, cancellations and retirement consume more. A current read-only caller's dispatch replay writes a delivery and denied try; an authorized observer can also grow history. The zero-rights protection does not prevent a single-right caller from exhausting this shared fixture. **The trusted host must rate-limit/admission-limit all event-producing calls across actors, reserve capacity for its needs and stop before exhaustion. No quotas, rollover, fairness or production availability guarantee are implemented.** Plain lookup retains no Event rows. Never delete evidence or create a new key/store to evade the bound. The final empty policy row permits global revocation but does not reserve event space.\n\nThe boundary tests directly seed valid 10,000-row histories with SQL, validate them, then exercise public operations and atomic rollback. They do not claim 10,000 public admissions, load testing or enterprise-scale performance. Current-policy selection uses binary search on ordered control sequences, and native projection uses a request-ID lookup map; no workload latency or combined-boundary throughput is asserted.\n\n## Exact evidence bytes and installation package\n\nManifest and snapshot files must equal their documented file_bytes encoding, not merely parse to an equal JSON value. Native record bytes are also exact. Integer cut counters cannot be floats or booleans. The archive hash identifies one byte representation; a trusted external expected root is still required for origin/latest claims. Internal intent encoding remains Python json.dumps with ensure_ascii=False, sorted code-point keys and compact separators: quotes and backslashes are escaped, backspace/formfeed/newline/carriage-return/tab use short escapes, other U+0000–U+001F use lowercase \\u00xx, and U+2028/U+2029 are raw UTF-8. Unicode is never normalized. Simultaneous schema and whole-wire limits apply: the nominal maximum of 128 rules is not a promise that any such array fits within 128 KiB.\n\nNew synthetic installations include the spec, AGENTS, runtime map, schema and companion plus README, model-spec, adoption-limits and requirements.txt. Readback verifies all nine files. Their jsonschema dependency remains an externally installed pinned dependency, not a bundled package. Candidate/simulationOnly fixture locks do not become published locks merely because tests pass. This acceptance covers one evidence cut per new Dimension; incremental multi-cut native installation and migration are not implemented. The source new-store initializer can leave a partial file on failure as already documented.\n" }, "structure": { "bundles": [ { "id": "AR-B1", "name": "Definition", "description": "Definition of company action requests.", "layers": [ { "id": "AR-B1-L1", "name": "Operation semantics", "description": "Questions and evidence for operation semantics.", "findings": [ { "id": "AR-F01", "name": "Operation boundary", "description": "Exact immutable ActionDefinition and parameter contract", "questions": [ { "id": "AR-Q01", "text": "Which versioned operation is described?", "kind": "host-guidance", "answer_data": [ "ActionDefinition.definitionId, version and full-content sha256", "Resolve the exact pin and describe name, targetType, precondition and effectBoundary." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "ActionDefinition.definitionId, version and full-content sha256", "derivation": "Resolve the exact pin and describe name, targetType, precondition and effectBoundary.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A01", "permittedActionId": "AR-ACT01" } }, { "id": "AR-Q02", "text": "Is it descriptive-only or executable in this binding?", "kind": "host-guidance", "answer_data": [ "ActionDefinition.mode, adapter and parameterContract", "Return descriptive-only or synthetic-executable; descriptive-only has no invocation path." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "ActionDefinition.mode, adapter and parameterContract", "derivation": "Return descriptive-only or synthetic-executable; descriptive-only has no invocation path.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A01", "permittedActionId": "AR-ACT01" } } ], "artifacts": [ { "id": "AR-A01", "name": "Exact immutable ActionDefinition and parameter contract", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT01", "description": "Keep description separate from permission; do not invoke descriptive-only definitions. Requires the applicable host authority." } ] }, { "id": "AR-F03", "name": "Neighbor alignment", "description": "Pinned comparison and explicit relation", "questions": [ { "id": "AR-Q05", "text": "Does K2 actClass overlap this operation?", "kind": "host-guidance", "answer_data": [ "legacyCrosswalk Pin and verified K2 comparison", "State overlap/narrower/broader/unverified; a name match is not exactMatch." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "legacyCrosswalk Pin and verified K2 comparison", "derivation": "State overlap/narrower/broader/unverified; a name match is not exactMatch.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A03", "permittedActionId": "AR-ACT03" } }, { "id": "AR-Q06", "text": "Does a capability or obligation authorize it?", "kind": "host-guidance", "answer_data": [ "Current complete host rule and conceptual capability/obligation references", "Report that a capability or duty alone provides no execution permission." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Current complete host rule and conceptual capability/obligation references", "derivation": "Report that a capability or duty alone provides no execution permission.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A03", "permittedActionId": "AR-ACT03" } } ], "artifacts": [ { "id": "AR-A03", "name": "Pinned comparison and explicit relation", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT03", "description": "Keep optional crosswalk descriptive; never infer permission from a neighbor model. Requires the applicable host authority." } ] } ] }, { "id": "AR-B1-L2", "name": "Definition governance", "description": "Questions and evidence for definition governance.", "findings": [ { "id": "AR-F02", "name": "Revision and stewardship", "description": "Stable definition ID, revision chain, steward, master and validity", "questions": [ { "id": "AR-Q03", "text": "Who governs this definition?", "kind": "host-guidance", "answer_data": [ "ActionDefinition.stewardId, masterId and host-verified governance evidence", "Identify semantic steward and authoritative source; unknown standing stays unknown." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "ActionDefinition.stewardId, masterId and host-verified governance evidence", "derivation": "Identify semantic steward and authoritative source; unknown standing stays unknown.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A02", "permittedActionId": "AR-ACT02" } }, { "id": "AR-Q04", "text": "What changed across revisions or retirement?", "kind": "host-guidance", "answer_data": [ "Retained definition versions, recorded_at, control_sequence and retired_sequence", "Compare exact version bytes and monotonic retirement; do not infer a revision from a renamed label." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Retained definition versions, recorded_at, control_sequence and retired_sequence", "derivation": "Compare exact version bytes and monotonic retirement; do not infer a revision from a renamed label.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A02", "permittedActionId": "AR-ACT02" } } ], "artifacts": [ { "id": "AR-A02", "name": "Stable definition ID, revision chain, steward, master and validity", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT02", "description": "Add a new revision for changed meaning; never replace the same ID/version. Requires the applicable host authority." } ] } ] } ] }, { "id": "AR-B2", "name": "Request", "description": "Request of company action requests.", "layers": [ { "id": "AR-B2-L1", "name": "Intent and identity", "description": "Questions and evidence for intent and identity.", "findings": [ { "id": "AR-F04", "name": "Intent boundary", "description": "Closed immutable intent and exact definition pin", "questions": [ { "id": "AR-Q07", "text": "What exact effect is being requested?", "kind": "host-guidance", "answer_data": [ "Intent.definition, resourceId, expectedRevision and ordered parameters.labels", "Describe exactly the requested replacement and any compensation reference." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Intent.definition, resourceId, expectedRevision and ordered parameters.labels", "derivation": "Describe exactly the requested replacement and any compensation reference.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A04", "permittedActionId": "AR-ACT04" } }, { "id": "AR-Q08", "text": "What is the smallest valid request?", "kind": "host-guidance", "answer_data": [ "All required Intent fields in action.schema.json plus authenticated host actor", "List missing required context; no defaults for principal, audience, revision or authority." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "All required Intent fields in action.schema.json plus authenticated host actor", "derivation": "List missing required context; no defaults for principal, audience, revision or authority.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A04", "permittedActionId": "AR-ACT04" } } ], "artifacts": [ { "id": "AR-A04", "name": "Closed immutable intent and exact definition pin", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT04", "description": "Ask for missing actor, principal, resource revision, purpose or audience; do not fill them by guessing. Requires the applicable host authority." } ] }, { "id": "AR-F05", "name": "Retry identity", "description": "Retained actor-scoped key hash and intent bytes", "questions": [ { "id": "AR-Q09", "text": "How can a caller recover a lost response?", "kind": "host-guidance", "answer_data": [ "Original exact intent, actor-scoped key, trusted continuity evidence and readable retained receipt", "Use authorized lookup or identical retry; do not mint a replacement key on uncertainty." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Original exact intent, actor-scoped key, trusted continuity evidence and readable retained receipt", "derivation": "Use authorized lookup or identical retry; do not mint a replacement key on uncertainty.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A05", "permittedActionId": "AR-ACT05" } }, { "id": "AR-Q10", "text": "Does a changed body reuse the old key?", "kind": "host-guidance", "answer_data": [ "Retained canonical intent bytes and new proposed canonical bytes in the same key slot", "Equal bytes permit replay; changed bytes conflict, disclosed only with both read contexts." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Retained canonical intent bytes and new proposed canonical bytes in the same key slot", "derivation": "Equal bytes permit replay; changed bytes conflict, disclosed only with both read contexts.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A05", "permittedActionId": "AR-ACT05" } } ], "artifacts": [ { "id": "AR-A05", "name": "Retained actor-scoped key hash and intent bytes", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT05", "description": "Retry the same intent and key only after continuity is established. Requires the applicable host authority." } ] }, { "id": "AR-F06", "name": "Host identity", "description": "Host-minted request ID and submission event", "questions": [ { "id": "AR-Q11", "text": "Which Dimension owns this request?", "kind": "host-guidance", "answer_data": [ "Intent.dimensionId and authoritative store meta.dimension", "Require exact namespace equality; report the owning Dimension, not a request ID." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Intent.dimensionId and authoritative store meta.dimension", "derivation": "Require exact namespace equality; report the owning Dimension, not a request ID.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A06", "permittedActionId": "AR-ACT06" } }, { "id": "AR-Q12", "text": "Who mints its ID?", "kind": "host-guidance", "answer_data": [ "ActionRequest.requestId and causal SubmissionEvent", "Identify the fixture host as ID minter and show admission linkage; client intent excludes requestId." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "ActionRequest.requestId and causal SubmissionEvent", "derivation": "Identify the fixture host as ID minter and show admission linkage; client intent excludes requestId.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A06", "permittedActionId": "AR-ACT06" } } ], "artifacts": [ { "id": "AR-A06", "name": "Host-minted request ID and submission event", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT06", "description": "Keep server ID outside client intent digest; bind it once at admission. Requires the applicable host authority." } ] } ] } ] }, { "id": "AR-B3", "name": "Authority", "description": "Authority of company action requests.", "layers": [ { "id": "AR-B3-L1", "name": "Authority basis and scope", "description": "Questions and evidence for authority basis and scope.", "findings": [ { "id": "AR-F07", "name": "External authority basis", "description": "Host rule, issuer-standing Pin and external basis Pin", "questions": [ { "id": "AR-Q13", "text": "Who can act for whom?", "kind": "host-guidance", "answer_data": [ "Rule.actorId, principalId, mode, basis and both exact scopes", "Describe self or direct representation and the declared basis; no transitive delegation inference." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Rule.actorId, principalId, mode, basis and both exact scopes", "derivation": "Describe self or direct representation and the declared basis; no transitive delegation inference.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A07", "permittedActionId": "AR-ACT07" } }, { "id": "AR-Q14", "text": "Who verified the issuer has standing?", "kind": "host-guidance", "answer_data": [ "Rule.issuerId, issuerStanding Pin and external host verification evidence", "Name verifier/evidence if supplied; reference shape or hash alone cannot verify standing." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Rule.issuerId, issuerStanding Pin and external host verification evidence", "derivation": "Name verifier/evidence if supplied; reference shape or hash alone cannot verify standing.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A07", "permittedActionId": "AR-ACT07" } } ], "artifacts": [ { "id": "AR-A07", "name": "Host rule, issuer-standing Pin and external basis Pin", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT07", "description": "Require host verification; do not construct a second mandate master. Requires the applicable host authority." } ] }, { "id": "AR-F08", "name": "Scope intersection", "description": "One complete matching pair of scopes", "questions": [ { "id": "AR-Q15", "text": "Are both principal and actor allowed?", "kind": "host-guidance", "answer_data": [ "One Rule with complete principalScope and delegateScope at host time", "Evaluate both scope predicates in that same rule; never combine partial rules." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "One Rule with complete principalScope and delegateScope at host time", "derivation": "Evaluate both scope predicates in that same rule; never combine partial rules.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A08", "permittedActionId": "AR-ACT08" } }, { "id": "AR-Q16", "text": "Are action, resource, purpose and audience exact?", "kind": "host-guidance", "answer_data": [ "Intent context and each scope dimensionId, full definition, resourceId, purpose, audience, actions and interval", "Return exact matches/mismatches by axis; no wildcard or implicit audience." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Intent context and each scope dimensionId, full definition, resourceId, purpose, audience, actions and interval", "derivation": "Return exact matches/mismatches by axis; no wildcard or implicit audience.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A08", "permittedActionId": "AR-ACT08" } } ], "artifacts": [ { "id": "AR-A08", "name": "One complete matching pair of scopes", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT08", "description": "Intersect both scopes within the same rule; do not combine partial grants. Requires the applicable host authority." } ] } ] }, { "id": "AR-B3-L2", "name": "Current decisions and disclosure", "description": "Questions and evidence for current decisions and disclosure.", "findings": [ { "id": "AR-F09", "name": "Fresh decision", "description": "Policy revision, control sequence, decision and rule digests", "questions": [ { "id": "AR-Q17", "text": "Which policy applied at this try?", "kind": "host-guidance", "answer_data": [ "TryEvent.decision.policyRevision, matchedRuleDigests and controlSequence plus retained policies", "Identify the latest policy at that sequence and recompute the match set." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "TryEvent.decision.policyRevision, matchedRuleDigests and controlSequence plus retained policies", "derivation": "Identify the latest policy at that sequence and recompute the match set.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A09", "permittedActionId": "AR-ACT09" } }, { "id": "AR-Q18", "text": "Was the definition still available?", "kind": "host-guidance", "answer_data": [ "Definition validFrom/validUntil and retirement overlay at TryEvent controlSequence", "Evaluate half-open time and retirement; native active state is not availability." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Definition validFrom/validUntil and retirement overlay at TryEvent controlSequence", "derivation": "Evaluate half-open time and retirement; native active state is not availability.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A09", "permittedActionId": "AR-ACT09" } } ], "artifacts": [ { "id": "AR-A09", "name": "Policy revision, control sequence, decision and rule digests", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT09", "description": "Check current inputs under the effect transaction. Requires the applicable host authority." } ] }, { "id": "AR-F10", "name": "Disclosure", "description": "Current read decision independent of execute", "questions": [ { "id": "AR-Q19", "text": "Can this caller see the outcome now?", "kind": "host-guidance", "answer_data": [ "Current authenticated actor, intent context and matching read scopes at now", "Evaluate read independently of execute; old permission does not imply current disclosure." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Current authenticated actor, intent context and matching read scopes at now", "derivation": "Evaluate read independently of execute; old permission does not imply current disclosure.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A10", "permittedActionId": "AR-ACT10" } }, { "id": "AR-Q20", "text": "Could an error reveal hidden existence?", "kind": "host-guidance", "answer_data": [ "Actual endpoint response and current read decision for any original/new conflict contexts", "Without read return only withheld; do not infer hidden existence from that result." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Actual endpoint response and current read decision for any original/new conflict contexts", "derivation": "Without read return only withheld; do not infer hidden existence from that result.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A10", "permittedActionId": "AR-ACT10" } } ], "artifacts": [ { "id": "AR-A10", "name": "Current read decision independent of execute", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT10", "description": "Return the uniform withheld response when read is denied. Requires the applicable host authority." } ] } ] } ] }, { "id": "AR-B4", "name": "Execution", "description": "Execution of company action requests.", "layers": [ { "id": "AR-B4-L1", "name": "Admission and local effect", "description": "Questions and evidence for admission and local effect.", "findings": [ { "id": "AR-F11", "name": "Submission versus proposal", "description": "Submission, delivery and try event identities", "questions": [ { "id": "AR-Q21", "text": "Has intent been admitted or merely proposed?", "kind": "host-guidance", "answer_data": [ "One SubmissionEvent, immutable request and admission policy", "Distinguish host admission from a proposal in another domain; absence in an incomplete export is unknown." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "One SubmissionEvent, immutable request and admission policy", "derivation": "Distinguish host admission from a proposal in another domain; absence in an incomplete export is unknown.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A11", "permittedActionId": "AR-ACT11" } }, { "id": "AR-Q22", "text": "Did a delivery actually lead to a try?", "kind": "host-guidance", "answer_data": [ "Complete operation group at a controlSequence with DeliveryEvent and execute TryEvent", "Require delivery followed by its same-request try; a delivery alone is incomplete evidence." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Complete operation group at a controlSequence with DeliveryEvent and execute TryEvent", "derivation": "Require delivery followed by its same-request try; a delivery alone is incomplete evidence.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A11", "permittedActionId": "AR-ACT11" } } ], "artifacts": [ { "id": "AR-A11", "name": "Submission, delivery and try event identities", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT11", "description": "Require explicit submit permission; preserve proposal origin without executing it. Requires the applicable host authority." } ] }, { "id": "AR-F12", "name": "Atomic effect", "description": "Before/after revisions and one local transaction", "questions": [ { "id": "AR-Q23", "text": "What changed in the resource?", "kind": "host-guidance", "answer_data": [ "ReceiptEvent before/afterRevision and before/afterLabels with resource revision history", "Report the precise local effect; order and duplicate labels are retained." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "ReceiptEvent before/afterRevision and before/afterLabels with resource revision history", "derivation": "Report the precise local effect; order and duplicate labels are retained.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A12", "permittedActionId": "AR-ACT12" } }, { "id": "AR-Q24", "text": "Are the key, effect and receipt committed together?", "kind": "host-guidance", "answer_data": [ "Request, key slot, effect revision and receipt within one committed SQLite transaction", "Check atomic local history and rollback evidence; no inference about remote systems or power failure." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Request, key slot, effect revision and receipt within one committed SQLite transaction", "derivation": "Check atomic local history and rollback evidence; no inference about remote systems or power failure.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A12", "permittedActionId": "AR-ACT12" } } ], "artifacts": [ { "id": "AR-A12", "name": "Before/after revisions and one local transaction", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT12", "description": "Use only the bounded local adapter; external side effects need another contract. Requires the applicable host authority." } ] }, { "id": "AR-F13", "name": "Replay", "description": "Retained receipt and immutable digest", "questions": [ { "id": "AR-Q25", "text": "Has this request already produced an effect?", "kind": "host-guidance", "answer_data": [ "Request terminal history and retained receiptId/ReceiptEvent", "Return whether a local effect committed; caller observation is a separate claim." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Request terminal history and retained receiptId/ReceiptEvent", "derivation": "Return whether a local effect committed; caller observation is a separate claim.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A13", "permittedActionId": "AR-ACT13" } }, { "id": "AR-Q26", "text": "Did the resource change in the meantime?", "kind": "host-guidance", "answer_data": [ "Current resource revision compared with original receipt.afterRevision", "Report intervening work while preserving the old receipt; a replay never reapplies its effect." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Current resource revision compared with original receipt.afterRevision", "derivation": "Report intervening work while preserving the old receipt; a replay never reapplies its effect.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A13", "permittedActionId": "AR-ACT13" } } ], "artifacts": [ { "id": "AR-A13", "name": "Retained receipt and immutable digest", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT13", "description": "Return permitted retained evidence; never reapply an old effect. Requires the applicable host authority." } ] } ] }, { "id": "AR-B4-L2", "name": "Terminal and compensating operations", "description": "Questions and evidence for terminal and compensating operations.", "findings": [ { "id": "AR-F14", "name": "Deadline", "description": "Half-open request deadline and terminal history", "questions": [ { "id": "AR-Q27", "text": "Can a first effect still occur?", "kind": "host-guidance", "answer_data": [ "Pending state, now, Intent.expiresAt, availability, scope and revision guard", "A first effect requires now below deadline plus all other guards; deadline alone is not permission." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Pending state, now, Intent.expiresAt, availability, scope and revision guard", "derivation": "A first effect requires now below deadline plus all other guards; deadline alone is not permission.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A14", "permittedActionId": "AR-ACT14" } }, { "id": "AR-Q28", "text": "Is an old committed receipt being mistaken for expiry?", "kind": "host-guidance", "answer_data": [ "Replayed terminal state and original receipt occurrence", "A committed request remains committed after the deadline; only pending can expire." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Replayed terminal state and original receipt occurrence", "derivation": "A committed request remains committed after the deadline; only pending can expire.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A14", "permittedActionId": "AR-ACT14" } } ], "artifacts": [ { "id": "AR-A14", "name": "Half-open request deadline and terminal history", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT14", "description": "Expire only pending requests; preserve committed state. Requires the applicable host authority." } ] }, { "id": "AR-F15", "name": "Cancellation", "description": "Current cancel decision and serialized disposition", "questions": [ { "id": "AR-Q29", "text": "Can a pending request be cancelled?", "kind": "host-guidance", "answer_data": [ "Current cancel scopes, retained-key status, pending state and request deadline", "Explain whether authorized cancellation can transition pending; committed state cannot be undone." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Current cancel scopes, retained-key status, pending state and request deadline", "derivation": "Explain whether authorized cancellation can transition pending; committed state cannot be undone.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A15", "permittedActionId": "AR-ACT15" } }, { "id": "AR-Q30", "text": "Which terminal operation won the race?", "kind": "host-guidance", "answer_data": [ "Serialized TryEvent/DispositionEvent/ReceiptEvent control sequence", "Identify the single terminal winner from complete history; timing guesses do not resolve a race." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Serialized TryEvent/DispositionEvent/ReceiptEvent control sequence", "derivation": "Identify the single terminal winner from complete history; timing guesses do not resolve a race.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A15", "permittedActionId": "AR-ACT15" } } ], "artifacts": [ { "id": "AR-A15", "name": "Current cancel decision and serialized disposition", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT15", "description": "Cancel pending intent only; do not claim undo after commit. Requires the applicable host authority." } ] }, { "id": "AR-F16", "name": "Compensation", "description": "Original receipt, exact old labels and current revision", "questions": [ { "id": "AR-Q31", "text": "Which effect is to be compensated?", "kind": "host-guidance", "answer_data": [ "New intent.compensatesReceiptId and retained original receipt with original request context", "Require a new key/request and exact original before-labels plus the same narrow context." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "New intent.compensatesReceiptId and retained original receipt with original request context", "derivation": "Require a new key/request and exact original before-labels plus the same narrow context.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A16", "permittedActionId": "AR-ACT16" } }, { "id": "AR-Q32", "text": "Has intervening work changed its revision?", "kind": "host-guidance", "answer_data": [ "Current resource revision, original afterRevision and definition availability", "Refuse stale revision or retired definition; matching current labels do not substitute for revision." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Current resource revision, original afterRevision and definition availability", "derivation": "Refuse stale revision or retired definition; matching current labels do not substitute for revision.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A16", "permittedActionId": "AR-ACT16" } } ], "artifacts": [ { "id": "AR-A16", "name": "Original receipt, exact old labels and current revision", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT16", "description": "Create a new request and key; refuse stale or context-mismatched compensation. Requires the applicable host authority." } ] } ] } ] }, { "id": "AR-B5", "name": "Evidence", "description": "Evidence of company action requests.", "layers": [ { "id": "AR-B5-L1", "name": "Observer knowledge and correction", "description": "Questions and evidence for observer knowledge and correction.", "findings": [ { "id": "AR-F17", "name": "Observer knowledge", "description": "Observation event and identified observer", "questions": [ { "id": "AR-Q33", "text": "What does the caller know about the result?", "kind": "host-guidance", "answer_data": [ "ObservationEvent observerId, claim, reason and time", "Report caller knowledge as asserted, never as authoritative effect truth." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "ObservationEvent observerId, claim, reason and time", "derivation": "Report caller knowledge as asserted, never as authoritative effect truth.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A17", "permittedActionId": "AR-ACT17" } }, { "id": "AR-Q34", "text": "Is uncertainty local to the observer?", "kind": "host-guidance", "answer_data": [ "Observation claim alongside independent retained receipt history", "Keep caller-unknown local to the observer; do not convert it into executor failure." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Observation claim alongside independent retained receipt history", "derivation": "Keep caller-unknown local to the observer; do not convert it into executor failure.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A17", "permittedActionId": "AR-ACT17" } } ], "artifacts": [ { "id": "AR-A17", "name": "Observation event and identified observer", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT17", "description": "Record knowledge separately from authoritative effect state. Requires the applicable host authority." } ] }, { "id": "AR-F18", "name": "Correction", "description": "Linear correction edge and reason", "questions": [ { "id": "AR-Q35", "text": "Which observation is corrected?", "kind": "host-guidance", "answer_data": [ "ObservationEvent.correctsEventId, same request and observer", "Resolve exactly one predecessor and identify the changed knowledge claim." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "ObservationEvent.correctsEventId, same request and observer", "derivation": "Resolve exactly one predecessor and identify the changed knowledge claim.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A18", "permittedActionId": "AR-ACT18" } }, { "id": "AR-Q36", "text": "Does the predecessor still exist unchanged?", "kind": "host-guidance", "answer_data": [ "Retained predecessor bytes and correction edges", "Verify predecessor is unchanged and has at most one immediate correction; do not erase it." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Retained predecessor bytes and correction edges", "derivation": "Verify predecessor is unchanged and has at most one immediate correction; do not erase it.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A18", "permittedActionId": "AR-ACT18" } } ], "artifacts": [ { "id": "AR-A18", "name": "Linear correction edge and reason", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT18", "description": "Append a correction; never edit a receipt or erase the original. Requires the applicable host authority." } ] } ] }, { "id": "AR-B5-L2", "name": "Master history and continuity", "description": "Questions and evidence for master history and continuity.", "findings": [ { "id": "AR-F19", "name": "Mastership", "description": "One SQLite master and labeled native evidence", "questions": [ { "id": "AR-Q37", "text": "Which store is authoritative for execution?", "kind": "host-guidance", "answer_data": [ "Trusted host-selected executor store identity, epoch and continuity evidence", "Identify one execution master; a matching epoch alone cannot prove the newest store." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Trusted host-selected executor store identity, epoch and continuity evidence", "derivation": "Identify one execution master; a matching epoch alone cannot prove the newest store.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A19", "permittedActionId": "AR-ACT19" } }, { "id": "AR-Q38", "text": "Is a native export being treated as a second master?", "kind": "host-guidance", "answer_data": [ "Native binding declaration, snapshot cut and manifest assurance", "Classify native export as evidence projection with no execution or overwrite authority." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Native binding declaration, snapshot cut and manifest assurance", "derivation": "Classify native export as evidence projection with no execution or overwrite authority.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A19", "permittedActionId": "AR-ACT19" } } ], "artifacts": [ { "id": "AR-A19", "name": "One SQLite master and labeled native evidence", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT19", "description": "Keep export read-only with explicit capture time and sequence. Requires the applicable host authority." } ] }, { "id": "AR-F20", "name": "History validation", "description": "Replay report and externally expected manifest root", "questions": [ { "id": "AR-Q39", "text": "Do the records form a coherent history?", "kind": "host-guidance", "answer_data": [ "Complete bounded snapshot and validate_snapshot report including operation completion", "Assess internal consistency: current-at-sequence policies, lifecycle, effect, correction and resource history." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Complete bounded snapshot and validate_snapshot report including operation completion", "derivation": "Assess internal consistency: current-at-sequence policies, lifecycle, effect, correction and resource history.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A20", "permittedActionId": "AR-ACT20" } }, { "id": "AR-Q40", "text": "Does this prove authenticity or the latest cut?", "kind": "host-guidance", "answer_data": [ "Externally trusted source identity and expected latest-history anchor, if available", "Internal validity does not prove authenticity or latest state; missing external anchor is insufficient context." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Externally trusted source identity and expected latest-history anchor, if available", "derivation": "Internal validity does not prove authenticity or latest state; missing external anchor is insufficient context.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A20", "permittedActionId": "AR-ACT20" } } ], "artifacts": [ { "id": "AR-A20", "name": "Replay report and externally expected manifest root", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT20", "description": "Separate internal consistency from authenticated current admission. Requires the applicable host authority." } ] }, { "id": "AR-F21", "name": "Export recovery", "description": "Exact manifest, snapshot and deterministic native files", "questions": [ { "id": "AR-Q41", "text": "Was every file captured at one cut?", "kind": "host-guidance", "answer_data": [ "Manifest controlSequence/eventSequence/exportedAt, snapshot and exact projected files", "Verify all retained files belong to the same cut; unexpected files or directories invalidate closure." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Manifest controlSequence/eventSequence/exportedAt, snapshot and exact projected files", "derivation": "Verify all retained files belong to the same cut; unexpected files or directories invalidate closure.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A21", "permittedActionId": "AR-ACT21" } }, { "id": "AR-Q42", "text": "Can an interrupted export be resumed safely?", "kind": "host-guidance", "answer_data": [ "Original retained cut and current directory bytes plus interruption type", "Resume only identical intact partial files; a torn file or changed cut requires a fresh directory." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Original retained cut and current directory bytes plus interruption type", "derivation": "Resume only identical intact partial files; a torn file or changed cut requires a fresh directory.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A21", "permittedActionId": "AR-ACT21" } } ], "artifacts": [ { "id": "AR-A21", "name": "Exact manifest, snapshot and deterministic native files", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT21", "description": "Resume identical bytes; a changed cut needs a new directory. Requires the applicable host authority." } ] }, { "id": "AR-F22", "name": "Retention", "description": "Terminal-only key retirement event and retained key slot", "questions": [ { "id": "AR-Q43", "text": "Can this key be reused after retirement?", "kind": "host-guidance", "answer_data": [ "Terminal state, KeyRetirementEvent and retained actor/key slot", "Retirement forbids reuse and emits no new effect; it is not deletion." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Terminal state, KeyRetirementEvent and retained actor/key slot", "derivation": "Retirement forbids reuse and emits no new effect; it is not deletion.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A22", "permittedActionId": "AR-ACT22" } }, { "id": "AR-Q44", "text": "Which evidence is retained?", "kind": "host-guidance", "answer_data": [ "Retained immutable request, complete history, original receipt and policy snapshots", "State full retention explicitly; legal erasure or minimization is outside this fixture." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Retained immutable request, complete history, original receipt and policy snapshots", "derivation": "State full retention explicitly; legal erasure or minimization is outside this fixture.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A22", "permittedActionId": "AR-ACT22" } } ], "artifacts": [ { "id": "AR-A22", "name": "Terminal-only key retirement event and retained key slot", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT22", "description": "Keep nonreuse evidence; this fixture has no erasure mechanism. Requires the applicable host authority." } ] }, { "id": "AR-F23", "name": "Restore continuity", "description": "Recovery decision and external continuity root", "questions": [ { "id": "AR-Q45", "text": "Could this be a coherent old database?", "kind": "host-guidance", "answer_data": [ "Recovery history and external continuity evidence, not merely epoch/hash equality", "Recognize that a coherent older database can pass internal checks and replay." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Recovery history and external continuity evidence, not merely epoch/hash equality", "derivation": "Recognize that a coherent older database can pass internal checks and replay.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A23", "permittedActionId": "AR-ACT23" } }, { "id": "AR-Q46", "text": "What external anchor establishes the latest state?", "kind": "host-guidance", "answer_data": [ "Host-trusted external latest-history root and reconciliation decision", "Name the actual root if supplied; otherwise halt dispatch after uncertain restore and request it." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Host-trusted external latest-history root and reconciliation decision", "derivation": "Name the actual root if supplied; otherwise halt dispatch after uncertain restore and request it.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A23", "permittedActionId": "AR-ACT23" } } ], "artifacts": [ { "id": "AR-A23", "name": "Recovery decision and external continuity root", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT23", "description": "Stop and reconcile before dispatch after uncertain restoration. Requires the applicable host authority." } ] } ] }, { "id": "AR-B5-L3", "name": "Representation and adoption", "description": "Questions and evidence for representation and adoption.", "findings": [ { "id": "AR-F24", "name": "Byte identity", "description": "Explicit Python encoding and raw artifact SHA", "questions": [ { "id": "AR-Q47", "text": "Which canonical bytes define equality?", "kind": "host-guidance", "answer_data": [ "Exact encoded definition/intent/rule bytes and SHA-256 under documented Python rules", "Separate semantic-content digest from raw-file hash; this contract is not RFC 8785 JCS." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Exact encoded definition/intent/rule bytes and SHA-256 under documented Python rules", "derivation": "Separate semantic-content digest from raw-file hash; this contract is not RFC 8785 JCS.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A24", "permittedActionId": "AR-ACT24" } }, { "id": "AR-Q48", "text": "Are ordering or Unicode silently normalized?", "kind": "host-guidance", "answer_data": [ "Original ordered arrays and Unicode code points compared with encoded output", "Retain ordering, duplicates and distinct Unicode forms; reject floats, duplicate keys and surrogates." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Original ordered arrays and Unicode code points compared with encoded output", "derivation": "Retain ordering, duplicates and distinct Unicode forms; reject floats, duplicate keys and surrogates.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A24", "permittedActionId": "AR-ACT24" } } ], "artifacts": [ { "id": "AR-A24", "name": "Explicit Python encoding and raw artifact SHA", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT24", "description": "Reject duplicates/floats/surrogates; never label this encoding JCS. Requires the applicable host authority." } ] }, { "id": "AR-F25", "name": "Native binding", "description": "Three synthetic installation reports and exact file readback", "questions": [ { "id": "AR-Q49", "text": "Do stored native records match the semantic snapshot?", "kind": "host-guidance", "answer_data": [ "Stored companion snapshot/manifest inside Dimension and complete stored native record set", "Reconstruct projections and compare every stored record with the cut; native state is not availability." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Stored companion snapshot/manifest inside Dimension and complete stored native record set", "derivation": "Reconstruct projections and compare every stored record with the cut; native state is not availability.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A25", "permittedActionId": "AR-ACT25" } }, { "id": "AR-Q50", "text": "Did the companion validator run after outer checks?", "kind": "host-guidance", "answer_data": [ "Actual native outer report plus installed companion nested/readback report", "Require both checks and their exact asset hashes; an outer pass cannot validate nested semantics." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Actual native outer report plus installed companion nested/readback report", "derivation": "Require both checks and their exact asset hashes; an outer pass cannot validate nested semantics.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A25", "permittedActionId": "AR-ACT25" } } ], "artifacts": [ { "id": "AR-A25", "name": "Three synthetic installation reports and exact file readback", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT25", "description": "Validate nested facets/history explicitly; outer envelopes alone are insufficient. Requires the applicable host authority." } ] }, { "id": "AR-F26", "name": "Adoption boundary", "description": "Descriptive minimum profile, synthetic execution profile and limits", "questions": [ { "id": "AR-Q51", "text": "Which use cases are useful today?", "kind": "host-guidance", "answer_data": [ "Selected descriptive or synthetic execution profile and required governance/evidence", "Choose descriptive definition adoption or the bounded local reference; do not imply generic execution." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Selected descriptive or synthetic execution profile and required governance/evidence", "derivation": "Choose descriptive definition adoption or the bounded local reference; do not imply generic execution.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A26", "permittedActionId": "AR-ACT26" } }, { "id": "AR-Q52", "text": "Which production responsibilities remain external?", "kind": "host-guidance", "answer_data": [ "Documented external duties: authentication, standing, disclosure, continuity, retention and scale", "Identify which duties the adopting host implements and which remain unknown or deferred." ], "answer_contract": { "status": [ "answered", "insufficient-context" ], "requiredEvidence": "Documented external duties: authentication, standing, disclosure, continuity, retention and scale", "derivation": "Identify which duties the adopting host implements and which remain unknown or deferred.", "ifMissing": "Return insufficient-context and name the missing authorized evidence; do not guess or disclose hidden state.", "artifactId": "AR-A26", "permittedActionId": "AR-ACT26" } } ], "artifacts": [ { "id": "AR-A26", "name": "Descriptive minimum profile, synthetic execution profile and limits", "description": "Required retained or host-supplied evidence; missing facts remain insufficient context." } ], "actions": [ { "id": "AR-ACT26", "description": "Adopt the smallest useful profile; do not claim distributed execution readiness. Requires the applicable host authority." } ] } ] } ] } ] }, "composition": { "runtimeImports": [], "semanticReferences": [ { "id": "WM-XCT-002", "version": "0.3.0-research.1", "url": "https://ver.cy/models/wm-xct-002-access-contract-consent/spec.yaml", "digest": "sha256:9085d977567f3e1fc0b9bb27c6a7c517139f5972a1b95bf4a2bedccdb10bf2db", "relation": "Disclosure contract comparison; does not supply effect authorization" }, { "id": "WM-XCT-029", "version": "0.3.0-research.1", "url": "https://ver.cy/models/wm-xct-029-obligation-commitment/spec.yaml", "digest": "sha256:33b9845b2b334949d5538c1c859dbb41c23872577ae6d3502cd48267f17a8e2a", "relation": "Duty/performance comparison; does not dispatch or transfer liability" }, { "id": "WM-XCT-001", "version": "0.3.1-enterprise.1", "url": "https://ver.cy/models/wm-xct-001-ownership-stewardship/spec.yaml", "digest": "sha256:fa942556a3f460729db2e94b24d1efd4d33ee2e5fb0b1deed3ce040756acf474", "relation": "Selected control/mandate comparison; not an executable imported mandate schema" } ], "delivery": "Two object types and seven native Event profiles with a bounded fixture. No mandatory runtime inheritance from the compared research parents. Native toolchain pinned separately." }, "statistics": { "bundles": 5, "layers": 10, "findings": 26, "questions": 52, "artifacts": 26 }, "wholeObjectFacets": { "ActionDefinition": { "identity-class": { "status": "required", "reason": "Stable definition ID plus immutable version; native revision chain." }, "direct-properties": { "status": "required", "reason": "Parameter contract, mode, target, guards, effect boundary, validity, steward/master." }, "recognition-observation": { "status": "required", "reason": "Recognition uses exact retained bytes and admitted reference, not a name match." }, "capabilities-behaviour-actions": { "status": "required", "reason": "Definition can be revised or retired by the host; it does not authorize execution." }, "context-evidence": { "status": "required", "reason": "Host governance, optional legacy Pin and external parameter evidence." } }, "ActionRequest": { "identity-class": { "status": "required", "reason": "Host-minted request ID; exactly one intent and submission; separate actor-scoped retry slot." }, "direct-properties": { "status": "required", "reason": "Exact intent, ordered labels, definition pin, actor/principal, target revision, deadline." }, "recognition-observation": { "status": "required", "reason": "Recognized by retained ID/key/digest plus exact bytes; observer claims remain separate." }, "capabilities-behaviour-actions": { "status": "required", "reason": "Pending can commit/cancel/expire/reject under guards; native object state is separate." }, "context-evidence": { "status": "required", "reason": "One owning Dimension, current policy evidence and submission provenance." } }, "SubmissionEvent": { "identity-class": { "status": "required", "reason": "Immutable event ID and global event/control sequence." }, "direct-properties": { "status": "required", "reason": "Request ID, intent digest, admission time and host issuer." }, "recognition-observation": { "status": "required", "reason": "Admission is an occurrence asserted by the fixture host, not an observer success claim." }, "capabilities-behaviour-actions": { "status": "required", "reason": "Append once after current submit permission; cannot itself prove execution." }, "context-evidence": { "status": "required", "reason": "Exact request object, current admission policy and definition revision." } }, "DeliveryEvent": { "identity-class": { "status": "required", "reason": "Immutable event ID for an admitted dispatch or exact retained replay." }, "direct-properties": { "status": "required", "reason": "Request ID, unchanged digest, host capture time and sequence." }, "recognition-observation": { "status": "required", "reason": "Records a delivery reaching this boundary; excludes malformed/unauthorized telemetry." }, "capabilities-behaviour-actions": { "status": "required", "reason": "Can precede a try; does not entail a committed effect." }, "context-evidence": { "status": "required", "reason": "Host capture source, request and definition IDs." } }, "TryEvent": { "identity-class": { "status": "required", "reason": "Immutable event ID per evaluated execute/cancel/observe operation." }, "direct-properties": { "status": "required", "reason": "Action, current policy revision, match digests, definition availability, decision." }, "recognition-observation": { "status": "required", "reason": "A recorded decision is neither a verified external mandate nor a result receipt." }, "capabilities-behaviour-actions": { "status": "required", "reason": "Only allowed guarded tries can produce their respective downstream records." }, "context-evidence": { "status": "required", "reason": "Host issuer, global control sequence and closed verified-by-host policy snapshots." } }, "ReceiptEvent": { "identity-class": { "status": "required", "reason": "Immutable event ID; at most one effect receipt per request." }, "direct-properties": { "status": "required", "reason": "Before/after labels and revisions, exact definition, try and compensation links." }, "recognition-observation": { "status": "required", "reason": "Authoritative local transaction evidence; caller observations do not overwrite it." }, "capabilities-behaviour-actions": { "status": "required", "reason": "Can be referenced by a new guarded compensation request; never mutated or cancelled." }, "context-evidence": { "status": "required", "reason": "One local effect boundary, request, resource, successful try and optional prior receipt." } }, "DispositionEvent": { "identity-class": { "status": "required", "reason": "Immutable event ID for the single terminal transition of pending intent." }, "direct-properties": { "status": "required", "reason": "From pending to cancelled/expired/rejected-precondition, reason and try." }, "recognition-observation": { "status": "required", "reason": "Read as host-recorded lifecycle evidence, not proof of remote effects." }, "capabilities-behaviour-actions": { "status": "required", "reason": "Applies exactly once; cannot rewrite committed or other terminal states." }, "context-evidence": { "status": "required", "reason": "Current guard evidence, request and causal try." } }, "ObservationEvent": { "identity-class": { "status": "required", "reason": "Immutable event ID, observer and optional earlier observation edge." }, "direct-properties": { "status": "required", "reason": "Caller knowledge claim, reason, capture time and correction link." }, "recognition-observation": { "status": "required", "reason": "The claim is explicitly subjective knowledge; unknown is not executor uncertainty." }, "capabilities-behaviour-actions": { "status": "required", "reason": "Append an observation or linear correction with read+observe; never undo effects." }, "context-evidence": { "status": "required", "reason": "Same observer/request predecessor, current try and host capture provenance." } }, "KeyRetirementEvent": { "identity-class": { "status": "required", "reason": "Immutable event ID on a terminal request with retained key." }, "direct-properties": { "status": "required", "reason": "Retained marker, time and host issuer." }, "recognition-observation": { "status": "required", "reason": "A tombstone-like nonreuse marker, not evidence of erasure." }, "capabilities-behaviour-actions": { "status": "required", "reason": "Prevents subsequent dispatch through this key while retaining original evidence." }, "context-evidence": { "status": "required", "reason": "Trusted retention administrator, terminal history and persistent key slot." } } }, "factMastership": [ { "fact": "ActionDefinition", "semanticOwner": "Definition steward", "authoritativeSystem": "Verified definition governance mirrored in the fixture", "writer": "Host-verified administration", "readerPurpose": "Current exact read scope for request operations; host projection required for administrative exports", "validTime": "Definition validity interval; host admission and retirement ordered independently.", "provenance": "Host governance, optional legacy Pin and external parameter evidence.", "conflict": "Same ID/version with changed bytes is rejected; changed meaning requires a new immutable version.", "retention": "Full retained history in this reference; external legal retention and erasure are deferred" }, { "fact": "ActionRequest", "semanticOwner": "Requesting principal", "authoritativeSystem": "One authoritative SQLite fixture; native records are exported evidence", "writer": "Authenticated actor admitted by host", "readerPurpose": "Current exact read scope for request operations; host projection required for administrative exports", "validTime": "Admission time plus an exclusive deadline for first effect; terminal effect does not expire.", "provenance": "One owning Dimension, current policy evidence and submission provenance.", "conflict": "Same actor/key with changed intent conflicts; derived state is replayed, not overwritten.", "retention": "Full retained history in this reference; external legal retention and erasure are deferred" }, { "fact": "SubmissionEvent", "semanticOwner": "Host execution/lifecycle authority", "authoritativeSystem": "One authoritative SQLite fixture; native records are exported evidence", "writer": "Serialized fixture host", "readerPurpose": "Current exact read scope for request operations; host projection required for administrative exports", "validTime": "Local occurrence/capture time and serialized control sequence; export time is independent.", "provenance": "Exact request object, current admission policy and definition revision.", "conflict": "Immutable event ID and global event order; overwrite, duplicate or incomplete operation rejected.", "retention": "Full retained history in this reference; external legal retention and erasure are deferred" }, { "fact": "DeliveryEvent", "semanticOwner": "Host execution/lifecycle authority", "authoritativeSystem": "One authoritative SQLite fixture; native records are exported evidence", "writer": "Serialized fixture host", "readerPurpose": "Current exact read scope for request operations; host projection required for administrative exports", "validTime": "Local occurrence/capture time and serialized control sequence; export time is independent.", "provenance": "Host capture source, request and definition IDs.", "conflict": "Immutable event ID and global event order; overwrite, duplicate or incomplete operation rejected.", "retention": "Full retained history in this reference; external legal retention and erasure are deferred" }, { "fact": "TryEvent", "semanticOwner": "Host execution/lifecycle authority", "authoritativeSystem": "One authoritative SQLite fixture; native records are exported evidence", "writer": "Serialized fixture host", "readerPurpose": "Current exact read scope for request operations; host projection required for administrative exports", "validTime": "Local occurrence/capture time and serialized control sequence; export time is independent.", "provenance": "Host issuer, global control sequence and closed verified-by-host policy snapshots.", "conflict": "Immutable event ID and global event order; overwrite, duplicate or incomplete operation rejected.", "retention": "Full retained history in this reference; external legal retention and erasure are deferred" }, { "fact": "ReceiptEvent", "semanticOwner": "Host execution/lifecycle authority", "authoritativeSystem": "One authoritative SQLite fixture; native records are exported evidence", "writer": "Serialized fixture host", "readerPurpose": "Current exact read scope for request operations; host projection required for administrative exports", "validTime": "Local occurrence/capture time and serialized control sequence; export time is independent.", "provenance": "One local effect boundary, request, resource, successful try and optional prior receipt.", "conflict": "Immutable event ID and global event order; overwrite, duplicate or incomplete operation rejected.", "retention": "Full retained history in this reference; external legal retention and erasure are deferred" }, { "fact": "DispositionEvent", "semanticOwner": "Host execution/lifecycle authority", "authoritativeSystem": "One authoritative SQLite fixture; native records are exported evidence", "writer": "Serialized fixture host", "readerPurpose": "Current exact read scope for request operations; host projection required for administrative exports", "validTime": "Local occurrence/capture time and serialized control sequence; export time is independent.", "provenance": "Current guard evidence, request and causal try.", "conflict": "Immutable event ID and global event order; overwrite, duplicate or incomplete operation rejected.", "retention": "Full retained history in this reference; external legal retention and erasure are deferred" }, { "fact": "ObservationEvent", "semanticOwner": "Identified observer", "authoritativeSystem": "One authoritative SQLite fixture; native records are exported evidence", "writer": "Authenticated actor admitted by host", "readerPurpose": "Current exact read scope for request operations; host projection required for administrative exports", "validTime": "Observer claim captured at host time; no independently verified observation occurrence time.", "provenance": "Same observer/request predecessor, current try and host capture provenance.", "conflict": "Append same-observer correction; never replace earlier claim or receipt.", "retention": "Full retained history in this reference; external legal retention and erasure are deferred" }, { "fact": "KeyRetirementEvent", "semanticOwner": "Host execution/lifecycle authority", "authoritativeSystem": "One authoritative SQLite fixture; native records are exported evidence", "writer": "Host-verified administration", "readerPurpose": "Current exact read scope for request operations; host projection required for administrative exports", "validTime": "Local occurrence/capture time and serialized control sequence; export time is independent.", "provenance": "Trusted retention administrator, terminal history and persistent key slot.", "conflict": "Immutable event ID and global event order; overwrite, duplicate or incomplete operation rejected.", "retention": "Full retained history in this reference; external legal retention and erasure are deferred" }, { "fact": "PolicySnapshot", "semanticOwner": "Trusted host authority administration; full external standing verification remains external", "authoritativeSystem": "One authoritative SQLite host fixture; mandatory snapshot exported inside Dimension", "writer": "Trusted host administration only", "readerPurpose": "Privileged export/projection under separately verified host access", "validTime": "Host control sequence ordered with execution; definition validity interval remains separate", "provenance": "Complete retained snapshot plus host verification evidence", "conflict": "Append a newer policy revision; preserve all prior evidence, including the final revocation reserve.", "retention": "Full retained history; no erasure mechanism" }, { "fact": "DefinitionRetirement", "semanticOwner": "Trusted host definition governance, separate from immutable definition meaning", "authoritativeSystem": "One authoritative SQLite host fixture; mandatory snapshot exported inside Dimension", "writer": "Trusted host administration only", "readerPurpose": "Privileged export/projection under separately verified host access", "validTime": "Host control sequence ordered with execution; definition validity interval remains separate", "provenance": "Complete retained snapshot plus host verification evidence", "conflict": "Monotonic retirement overlay at control sequence; no silent reactivation or rewrite.", "retention": "Full retained history; no erasure mechanism" } ], "catalogue": { "alternateNames": [ "EM-XCT-07", "ActionDefinition", "ActionRequest", "Action authority and delegation" ], "domain": [ "Enterprise", "Action and authority" ], "tags": [ "action", "request", "authority", "delegation", "idempotency", "receipt", "compensation" ], "adoption": "Start with a descriptive ActionDefinition and steward. Executable use is limited to the synthetic adapter and requires explicit current host authority and disclosure.", "limits": "Synthetic local reference with finite lifetime. Host authentication, standing verification, rate/admission limits, disclosure, archive isolation and continuity are external duties. No distributed effects, legal mandate verifier, delegation chains, production restoration or generic composer acceptance." }, "wholeObjectSupportingValues": { "DefinitionRef": { "identity-class": { "status": "required", "reason": "Exact definition ID/version/content hash value; no new object identity." }, "direct-properties": { "status": "required", "reason": "Three closed fields identify retained immutable definition bytes." }, "recognition-observation": { "status": "required", "reason": "Resolve and hash-check the referenced retained definition, never a label match." }, "capabilities-behaviour-actions": { "status": "required", "reason": "Reference only; cannot revise, authorize or dispatch." }, "context-evidence": { "status": "required", "reason": "Carries the intended definition pin inside intent and scopes." } }, "EvidencePin": { "identity-class": { "status": "required", "reason": "Exact uri/revision/hash tuple; no independently modeled evidence object here." }, "direct-properties": { "status": "required", "reason": "Opaque URI, revision and externally declared raw evidence digest." }, "recognition-observation": { "status": "required", "reason": "Host verifies the underlying evidence; syntax is not trust." }, "capabilities-behaviour-actions": { "status": "required", "reason": "No fetching, execution, or authority construction." }, "context-evidence": { "status": "required", "reason": "Issuer-standing, basis, parameter-contract or optional crosswalk context." } }, "Intent": { "identity-class": { "status": "required", "reason": "Immutable content owned by one ActionRequest; digest is not a separate subject." }, "direct-properties": { "status": "required", "reason": "Closed effect parameters, principal/actor, context, deadline and compensation link." }, "recognition-observation": { "status": "required", "reason": "Exact canonical bytes plus digest distinguish retries from conflicts." }, "capabilities-behaviour-actions": { "status": "required", "reason": "Cannot execute itself; new intent requires deliberate admission under a new key." }, "context-evidence": { "status": "required", "reason": "Definition/resource pins and authenticated host context are mandatory." } }, "AuthorityRuleAndScopes": { "identity-class": { "status": "required", "reason": "Host-owned value within an immutable policy revision, recognized by digest." }, "direct-properties": { "status": "required", "reason": "Principal/actor/mode, issuer and basis plus both exact closed scope values." }, "recognition-observation": { "status": "required", "reason": "Host attests external standing; validator compares both scopes in the same rule." }, "capabilities-behaviour-actions": { "status": "required", "reason": "May authorize named operations only after current time/context evaluation." }, "context-evidence": { "status": "required", "reason": "Policy revision, issuer-standing and basis Pins; no new mandate master." } }, "PolicySnapshot": { "identity-class": { "status": "required", "reason": "Host revision number in one executor epoch/Dimension." }, "direct-properties": { "status": "required", "reason": "Ordered rule array, recorded time and control sequence, including empty revocation." }, "recognition-observation": { "status": "required", "reason": "Historical try must reference the current policy at its control sequence." }, "capabilities-behaviour-actions": { "status": "required", "reason": "Trusted host can append a newer revision subject to bounded retention." }, "context-evidence": { "status": "required", "reason": "Complete retained predecessor policy history; external standing remains host duty." } }, "Decision": { "identity-class": { "status": "required", "reason": "Derived value owned by exactly one TryEvent." }, "direct-properties": { "status": "required", "reason": "Action, policy revision, matching rule digests, availability and boolean outcome." }, "recognition-observation": { "status": "required", "reason": "Recomputed from current-at-try policy and definition overlay." }, "capabilities-behaviour-actions": { "status": "required", "reason": "Evidence of evaluation only; a complete guarded operation produces an effect." }, "context-evidence": { "status": "required", "reason": "Same request, host time and global control sequence as its try." } }, "ActionRequestSnapshot": { "identity-class": { "status": "required", "reason": "Derived capture of an existing request, never a second request." }, "direct-properties": { "status": "required", "reason": "Immutable intent/admission plus derived state, receipt ID and retirement marker." }, "recognition-observation": { "status": "required", "reason": "Reconstructed from a complete submission and event history." }, "capabilities-behaviour-actions": { "status": "required", "reason": "No caller edits; replay and comparison detect inconsistencies." }, "context-evidence": { "status": "required", "reason": "Owning cut/epoch and retained event IDs." } }, "SyntheticResourceRevision": { "identity-class": { "status": "required", "reason": "Fixture object ID plus monotonically increasing local revision." }, "direct-properties": { "status": "required", "reason": "Ordered labels, host recorded_at and control_sequence." }, "recognition-observation": { "status": "required", "reason": "Revision zero is host creation; every later revision has one receipt." }, "capabilities-behaviour-actions": { "status": "required", "reason": "Only the closed synthetic replacement creates a new revision." }, "context-evidence": { "status": "required", "reason": "One local store and receipt guard; no claim about a real enterprise asset." } }, "ExecutorSnapshot": { "identity-class": { "status": "required", "reason": "One privileged capture identified by Dimension, epoch and control cut." }, "direct-properties": { "status": "required", "reason": "Meta plus bounded definitions, policies, resources, requests and events." }, "recognition-observation": { "status": "required", "reason": "Complete replay checks internal consistency, not authenticity or newest state." }, "capabilities-behaviour-actions": { "status": "required", "reason": "Export/validate only; never an automatic dispatch-resume token." }, "context-evidence": { "status": "required", "reason": "Host-controlled source and external latest-history reconciliation when needed." } }, "ExportManifest": { "identity-class": { "status": "required", "reason": "Exact evidence cut and complete file mapping; not a subject model." }, "direct-properties": { "status": "required", "reason": "Dimension/epoch/sequences/time, filenames/hashes and assurance." }, "recognition-observation": { "status": "required", "reason": "Exact file closure and deterministic regeneration from snapshot." }, "capabilities-behaviour-actions": { "status": "required", "reason": "Validate and transport evidence only; no policy or execution authority." }, "context-evidence": { "status": "required", "reason": "Mandatory sibling snapshot and record set; external trust root is separate." } }, "SyntheticOrderedLabelResourceObject": { "identity-class": { "status": "required", "reason": "Fixture object ID with immutable captured revisions, never a new enterprise metamodel." }, "direct-properties": { "status": "required", "reason": "Native syntheticLabels facet carries exact ordered labels and local revision." }, "recognition-observation": { "status": "required", "reason": "Recognized from revision-zero host creation plus complete receipt-derived history." }, "capabilities-behaviour-actions": { "status": "required", "reason": "Only the closed synthetic replacement can append a revision; no arbitrary action." }, "context-evidence": { "status": "required", "reason": "Host creation/effect control sequence and one authoritative fixture; not a real organization asset." } }, "CallerEventProjection": { "identity-class": { "status": "required", "reason": "Projection of one existing receipt or observation Event ID, not a new occurrence." }, "direct-properties": { "status": "required", "reason": "Event context/payload excluding global sequence and controlSequence." }, "recognition-observation": { "status": "required", "reason": "Authorized caller learns only its retained event content; complete schema validation requires privileged original." }, "capabilities-behaviour-actions": { "status": "required", "reason": "Read/observe response only; cannot itself authorize execution or become a native master record." }, "context-evidence": { "status": "required", "reason": "Current exact read scope and actor-scoped request key; host isolates privileged full evidence." } } } }