From 81f250be98e2940da2afda3764b6b41a389bd5ef Mon Sep 17 00:00:00 2001 From: Dzmitry Prychyna Date: Thu, 6 Aug 2026 22:54:58 -0300 Subject: [PATCH 1/4] refactor(seed): replace predecessor retention with terminal commitments --- .github/workflows/production-assurance.yml | 6 + .github/workflows/release-candidate.yml | 2 + .github/workflows/seed-ci.yml | 2 + MANIFEST.json | 299 ++++++++++-------- audit/ACTIVE_AUDIT_INDEX.json | 6 +- docs/architecture/SEED_ROLE.md | 7 +- .../TERMINAL_COMMITMENT_ACCUMULATION.md | 64 ++++ docs/generated/en/ASET_Seed_Next.md | 16 +- .../en/ASET_Seed_Resolution_0.3-alpha.1.md | 16 +- docs/generated/pt-BR/ASET_Seed_Next.md | 16 +- .../pt-BR/ASET_Seed_Resolution_0.3-alpha.1.md | 16 +- docs/generated/ru/ASET_Seed_Next.md | 16 +- .../ru/ASET_Seed_Resolution_0.3-alpha.1.md | 16 +- docs/repository/CI_ASSURANCE.md | 16 +- seed/canonical/CANON_PACKAGE.json | 98 +++--- seed/canonical/README.md | 28 +- .../assurance/canon-tla-refinement.json | 198 ++++++++++++ .../assurance/invariant-coverage.json | 7 +- seed/canonical/assurance/limitations.json | 13 +- .../assurance/repository-release-gates.json | 21 +- .../assurance/verification-registry.json | 11 +- .../cases/negative/RES-NEG-001.json | 1 - .../cases/negative/RES-NEG-002.json | 6 +- .../cases/negative/RES-NEG-003.json | 3 +- .../cases/negative/RES-NEG-004.json | 3 +- .../cases/negative/RES-NEG-005.json | 5 +- .../cases/negative/RES-NEG-006.json | 7 +- .../cases/negative/RES-NEG-007.json | 7 +- .../cases/negative/RES-NEG-008.json | 7 +- .../cases/negative/RES-NEG-009.json | 7 +- .../cases/negative/RES-NEG-010.json | 11 +- .../cases/negative/RES-NEG-011.json | 12 +- .../cases/negative/RES-NEG-012.json | 32 +- .../cases/negative/RES-NEG-013.json | 52 +-- .../cases/negative/RES-NEG-014.json | 7 +- .../cases/negative/RES-NEG-015.json | 11 +- .../cases/negative/RES-NEG-016.json | 7 +- .../cases/positive/RES-POS-001.json | 3 +- .../cases/positive/RES-POS-002.json | 7 +- .../cases/positive/RES-POS-003.json | 7 +- .../cases/positive/RES-POS-004.json | 7 +- .../cases/positive/RES-POS-005.json | 7 +- .../cases/positive/RES-POS-006.json | 3 +- .../cases/positive/RES-POS-007.json | 13 +- .../cases/positive/RES-POS-008.json | 56 +--- .../conformance/conformance-profile.json | 52 +-- .../ADR-006-complete-invariant-closure.md | 11 +- ...ation-commitments-and-bounded-retention.md | 32 ++ seed/canonical/formal/README.md | 22 +- seed/canonical/formal/SeedCanonProjection.tla | 152 +++++++++ .../formal/SeedCanonRefinementProofs.tla | 74 +++++ seed/canonical/formal/SeedResolution.cfg | 4 +- seed/canonical/formal/SeedResolution.tla | 46 ++- .../canonical/formal/SeedResolutionProofs.tla | 160 +++------- .../migration/CANON_CHANGE_DECLARATION.json | 6 +- seed/canonical/ontology/seed.ttl | 10 +- seed/canonical/protocol/protocol-profile.json | 4 +- .../schemas/conformance-case.schema.json | 8 + .../schemas/resolution-request.schema.json | 14 +- .../schemas/canon-tla-refinement.schema.json | 292 +++++++++++++++++ .../repository-release-gates.schema.json | 2 +- seed/canonical/source/seed-model.json | 37 ++- seed/canonical/terminology/seed.skos.ttl | 12 +- seed/canonical/terminology/seed.tbx | 8 +- tests/test_ci_assurance.py | 63 ++++ tests/test_minimal_resolution_kernel.py | 17 + tools/build_canon_package.py | 5 + tools/check_canon_tla_refinement.py | 235 ++++++++++++++ tools/generate_canon_tla_projection.py | 293 +++++++++++++++++ tools/model_check_seed.py | 17 +- tools/repository_release_gate.py | 15 + tools/run_canon_tla_refinement.py | 189 +++++++++++ tools/seed_resolution_oracle.py | 63 +++- tools/validate_seed_canon.py | 6 + 74 files changed, 2317 insertions(+), 687 deletions(-) create mode 100644 docs/architecture/TERMINAL_COMMITMENT_ACCUMULATION.md create mode 100644 seed/canonical/assurance/canon-tla-refinement.json create mode 100644 seed/canonical/decisions/ADR-007-reconsideration-commitments-and-bounded-retention.md create mode 100644 seed/canonical/formal/SeedCanonProjection.tla create mode 100644 seed/canonical/formal/SeedCanonRefinementProofs.tla create mode 100644 seed/canonical/schemas/canon-tla-refinement.schema.json create mode 100755 tools/check_canon_tla_refinement.py create mode 100755 tools/generate_canon_tla_projection.py create mode 100755 tools/run_canon_tla_refinement.py diff --git a/.github/workflows/production-assurance.yml b/.github/workflows/production-assurance.yml index f4d8cbf..5aa1cc0 100644 --- a/.github/workflows/production-assurance.yml +++ b/.github/workflows/production-assurance.yml @@ -73,10 +73,14 @@ jobs: python tools/check_proof_traceability.py --output dist/proof-traceability-check.json + python tools/check_canon_tla_refinement.py --output dist/canon-tla-refinement-check.json + python tools/run_tlc.py --jar "$RUNNER_TEMP/tla2tools.jar" --workers 2 --timeout-seconds 180 --output dist/tlc-model-check.json python tools/run_tlaps.py --tlapm "$TLAPM_BIN" --timeout-seconds 900 --output dist/tlaps-proof.json + python tools/run_canon_tla_refinement.py --tlapm "$TLAPM_BIN" --timeout-seconds 900 --output dist/canon-tla-refinement-proof.json + - uses: actions/upload-artifact@v4 if: always() with: @@ -86,5 +90,7 @@ jobs: dist/seed-model-check.json dist/assurance-traceability.json dist/proof-traceability-check.json + dist/canon-tla-refinement-check.json dist/tlc-model-check.json dist/tlaps-proof.json + dist/canon-tla-refinement-proof.json diff --git a/.github/workflows/release-candidate.yml b/.github/workflows/release-candidate.yml index 1031be4..b31ba54 100644 --- a/.github/workflows/release-candidate.yml +++ b/.github/workflows/release-candidate.yml @@ -81,7 +81,9 @@ jobs: dist/seed-model-check.json dist/assurance-traceability.json dist/proof-traceability-check.json + dist/canon-tla-refinement-check.json dist/blackbox-documentation-audit.json dist/repository-release-gate.json dist/tlc-model-check.json dist/tlaps-proof.json + dist/canon-tla-refinement-proof.json diff --git a/.github/workflows/seed-ci.yml b/.github/workflows/seed-ci.yml index c542d31..2c51f43 100644 --- a/.github/workflows/seed-ci.yml +++ b/.github/workflows/seed-ci.yml @@ -36,6 +36,7 @@ jobs: python tools/model_check_seed.py --output dist/seed-model-check.json python tools/check_assurance_traceability.py --model-report dist/seed-model-check.json python tools/check_proof_traceability.py --output dist/proof-traceability-check.json + python tools/check_canon_tla_refinement.py --output dist/canon-tla-refinement-check.json - name: Run specification tests and static analysis run: | python -m pytest -q @@ -52,4 +53,5 @@ jobs: dist/seed-model-check.json dist/assurance-traceability.json dist/proof-traceability-check.json + dist/canon-tla-refinement-check.json dist/blackbox-documentation-audit.json diff --git a/MANIFEST.json b/MANIFEST.json index 164098c..ad5fab0 100644 --- a/MANIFEST.json +++ b/MANIFEST.json @@ -38,18 +38,18 @@ }, { "path": ".github/workflows/production-assurance.yml", - "sha256": "sha256:7f4d72f8601ced197f75c8dadea35a5bde25c09d2410c35ed12952dc80d12074", - "size_bytes": 3102 + "sha256": "sha256:c18832e025537de56a27db7e3f890c33e21c858e51a42d0826bdb9ba8f272bc9", + "size_bytes": 3489 }, { "path": ".github/workflows/release-candidate.yml", - "sha256": "sha256:3088f4d15676371fab42554a1c44dd0282b4f4191aac1e7fdf1bef2bfabfe7af", - "size_bytes": 2989 + "sha256": "sha256:6f10a7c689a24679a2a7e83aaae62201a4d107d93cce962a483e4cf8a5f1cb8f", + "size_bytes": 3087 }, { "path": ".github/workflows/seed-ci.yml", - "sha256": "sha256:2381e42cb258c532af838625df92fa69988bcde5d4b693a6647f18aa81750e02", - "size_bytes": 1866 + "sha256": "sha256:b5aeba44ab39d173d59f0f886676a3be9f1363d785f602d43c7275efdd3e990a", + "size_bytes": 2014 }, { "path": ".gitignore", @@ -188,8 +188,8 @@ }, { "path": "audit/ACTIVE_AUDIT_INDEX.json", - "sha256": "sha256:1e443e721bdba8b8837b7e8ee6d0d5c043d174a663bf9964a71ae87d1f9a8f68", - "size_bytes": 2693 + "sha256": "sha256:ccb148db338c7f447fa7b200c982e4808fb5d6e56f34b099e0385915fe513c7e", + "size_bytes": 2781 }, { "path": "audit/ACTIVE_AUDIT_INDEX.md", @@ -313,8 +313,13 @@ }, { "path": "docs/architecture/SEED_ROLE.md", - "sha256": "sha256:9c4f854fbb40f711cae4c91062692d22d6bacf9c92959ab5318098ff398cc5f3", - "size_bytes": 788 + "sha256": "sha256:d14912b58d582e3a6515bb6332842ae3c3d57ea1947154021d37a34d0cf23b28", + "size_bytes": 1277 + }, + { + "path": "docs/architecture/TERMINAL_COMMITMENT_ACCUMULATION.md", + "sha256": "sha256:2205fb3e83e5709c0900b41f12c136e4d8ccbf95588762b8833e10942f4fc718", + "size_bytes": 2853 }, { "path": "docs/generated/README.md", @@ -328,13 +333,13 @@ }, { "path": "docs/generated/en/ASET_Seed_Next.md", - "sha256": "sha256:90f3ec3017d3e7873ec80e89eea172474ed15d02691f136004975caf04b6a762", - "size_bytes": 9353 + "sha256": "sha256:817160ba2cf58d9fe16281328ad1240f29db6c61ade27935aab4076d71f4ae4f", + "size_bytes": 10185 }, { "path": "docs/generated/en/ASET_Seed_Resolution_0.3-alpha.1.md", - "sha256": "sha256:90f3ec3017d3e7873ec80e89eea172474ed15d02691f136004975caf04b6a762", - "size_bytes": 9353 + "sha256": "sha256:817160ba2cf58d9fe16281328ad1240f29db6c61ade27935aab4076d71f4ae4f", + "size_bytes": 10185 }, { "path": "docs/generated/pt-BR/ASET_Seed_0.1-rc12.md", @@ -343,13 +348,13 @@ }, { "path": "docs/generated/pt-BR/ASET_Seed_Next.md", - "sha256": "sha256:e1e7d4da1665d500a7c93cdce878b08ff92442a670f943f435b507caa88bb2f0", - "size_bytes": 9893 + "sha256": "sha256:6fab8822bc7c065a44782734daf8c860097b972be82115034314e99caaa9a57a", + "size_bytes": 10802 }, { "path": "docs/generated/pt-BR/ASET_Seed_Resolution_0.3-alpha.1.md", - "sha256": "sha256:e1e7d4da1665d500a7c93cdce878b08ff92442a670f943f435b507caa88bb2f0", - "size_bytes": 9893 + "sha256": "sha256:6fab8822bc7c065a44782734daf8c860097b972be82115034314e99caaa9a57a", + "size_bytes": 10802 }, { "path": "docs/generated/ru/ASET_Seed_0.1-rc12.md", @@ -358,13 +363,13 @@ }, { "path": "docs/generated/ru/ASET_Seed_Next.md", - "sha256": "sha256:2f93a7abe0c8836fb56665c2489e4c0e911f40a3de1d6ead5ee43822f0a744b1", - "size_bytes": 12835 + "sha256": "sha256:756a29b5e133ed2e8431b7ec0a9eeb9e866365615e6c76159fc6f386e90f7eb6", + "size_bytes": 14024 }, { "path": "docs/generated/ru/ASET_Seed_Resolution_0.3-alpha.1.md", - "sha256": "sha256:2f93a7abe0c8836fb56665c2489e4c0e911f40a3de1d6ead5ee43822f0a744b1", - "size_bytes": 12835 + "sha256": "sha256:756a29b5e133ed2e8431b7ec0a9eeb9e866365615e6c76159fc6f386e90f7eb6", + "size_bytes": 14024 }, { "path": "docs/implementation/CROSS_IMPLEMENTATION_CONFORMANCE_PLAN.md", @@ -383,8 +388,8 @@ }, { "path": "docs/repository/CI_ASSURANCE.md", - "sha256": "sha256:a887bb9e4735ee50599d57abc9de0bb1c10f14aaf15138077600762f31deb08b", - "size_bytes": 2718 + "sha256": "sha256:0430d1e771f7f12bc3462a2f7903308e475543d254cd10a0e1f2ae6fbcee6547", + "size_bytes": 3190 }, { "path": "docs/repository/DEPENDENCY_POLICY.md", @@ -458,23 +463,28 @@ }, { "path": "seed/canonical/CANON_PACKAGE.json", - "sha256": "sha256:692f6e072995714ae7ea3530509d9c847765f52d1d65488937368202edbba7bf", - "size_bytes": 11610 + "sha256": "sha256:52d29ae90734b1978398f15ce79a33487d191dc9b1f0c5dd58295bbf1eaa2658", + "size_bytes": 12501 }, { "path": "seed/canonical/README.md", - "sha256": "sha256:71ba69143af23fa70af145629b23590c69d35930b5cd8d1c3f86620a537efd4b", - "size_bytes": 1780 + "sha256": "sha256:1ee05c433e6b42f48daea4319970fdb531efbec5bde04366d7676459d9e07b35", + "size_bytes": 2461 + }, + { + "path": "seed/canonical/assurance/canon-tla-refinement.json", + "sha256": "sha256:8d510b7757c1afbfde9ffc808e4a6366a91c9f44368eca94413a0f019b6822e6", + "size_bytes": 6621 }, { "path": "seed/canonical/assurance/invariant-coverage.json", - "sha256": "sha256:a4bd10c7fe7bd68b3e4ce4aa5a79da50579c2acc13bdc10bd1ddb7da48825773", - "size_bytes": 14460 + "sha256": "sha256:36a8da2d0ef0826c72d8ebe1196ecf65485f310a3e276a95ef72c491ac57461c", + "size_bytes": 14696 }, { "path": "seed/canonical/assurance/limitations.json", - "sha256": "sha256:f7aaa95ce0c877b2b0ed142b7b0047809677b01ee923f86f418c46d8692d682f", - "size_bytes": 3049 + "sha256": "sha256:76550e4414ee5d8f70a82c57296425bdc72f99f3af4c940223aadae3e66da3f8", + "size_bytes": 3803 }, { "path": "seed/canonical/assurance/proof-traceability.json", @@ -483,138 +493,138 @@ }, { "path": "seed/canonical/assurance/repository-release-gates.json", - "sha256": "sha256:fe75e412403f4adebdc009652f68e1d843a2c1a3c0cbf95de315a9bd88b20d58", - "size_bytes": 5897 + "sha256": "sha256:9b945c1665038e8e4a642ffa6b9510d5ab8aaeeb45b5403bf578fb230e666c77", + "size_bytes": 6815 }, { "path": "seed/canonical/assurance/verification-registry.json", - "sha256": "sha256:2c1c7591e79983e2fd607566baba81888bf1b6f507ef5d434b8c77dffdf3f603", - "size_bytes": 9037 + "sha256": "sha256:7a45c470a14c5dd1e55a1b12cd9438b9f43e0170ecdfe817eeb256ee61e225f6", + "size_bytes": 9517 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-001.json", - "sha256": "sha256:69b42c72acce747e3094c6ff9eca2d13e8e2d0fda1b63c9587dd9ce7d16d7fc4", - "size_bytes": 1862 + "sha256": "sha256:3352af05c6a51a02aef9c94639fe43903c22969f3d9a8e2836f23fce065507a7", + "size_bytes": 1822 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-002.json", - "sha256": "sha256:8b1c7052db75a56c7abcf21a2822ca245878896f6f3f912920b41ff0959a9e1b", - "size_bytes": 2800 + "sha256": "sha256:ee69ab8301eea93cf52ab45114e56922f620e8aad8d4f621bbc98b6cf040cfa9", + "size_bytes": 2718 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-003.json", - "sha256": "sha256:2da32fb30992c6132ae1546b9ed0837ac76c70672ad89c929d4f24d229e51b77", - "size_bytes": 1906 + "sha256": "sha256:4318727895ac37e61933c6686e785351211acdda10dd9c6f19f6c69f37820eac", + "size_bytes": 1866 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-004.json", - "sha256": "sha256:a4faf9c34999fefb8093421027214501581b79b2ae6ffc343139035c35ee287d", - "size_bytes": 2382 + "sha256": "sha256:22b06e4c5bfac480dfddbba7a52370b7fdf104da371fe65dc3e8a928fed9b02c", + "size_bytes": 2342 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-005.json", - "sha256": "sha256:be334721fa8539ff0c49c91aef264a9572ce0f9d69cdf53e7520c1e960972f46", - "size_bytes": 2573 + "sha256": "sha256:15e6d3059b4d769eabb5a166d350509b23ec359856eb4c0bae2c9f975377af07", + "size_bytes": 2531 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-006.json", - "sha256": "sha256:c7aab9eecb2c6be1458c6fb992661b4ba78983cb7ba4e89f5d1159bda15ee04b", - "size_bytes": 2578 + "sha256": "sha256:4fcce1e7ebf701e5e994606320cb86a0129193154a33ee63792ee669419fbfec", + "size_bytes": 2536 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-007.json", - "sha256": "sha256:27c1299c07a798b79d0de15036018f32996702fba156e0a73dad11606e31297e", - "size_bytes": 2676 + "sha256": "sha256:e95d67c12b028b328c538fb83cf00a01946734acc5048fd1035f3c2eeb9f8ff2", + "size_bytes": 2634 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-008.json", - "sha256": "sha256:87351ee1cc22f2231bc9d9c1628bf5f54af34285f7fb6f67b4bced3e8bfd6e26", - "size_bytes": 3090 + "sha256": "sha256:783d86ab36bbcb1bdbad0d16c0481ea448d46c67b3501e1a76abfc828e7dde2f", + "size_bytes": 3048 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-009.json", - "sha256": "sha256:61c50a87bd3e402de908d3231c469969a82412e1723e1f9eeeb58465d545feeb", - "size_bytes": 3621 + "sha256": "sha256:2ff892ee2e91c8d5c117a0990157f326d602876cda637f9a34eda454fee41b9f", + "size_bytes": 3579 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-010.json", - "sha256": "sha256:538ad9f9aae5ab6f1e0b0d0635bb56e8db929bbad2fbb39642658257be56657f", - "size_bytes": 3278 + "sha256": "sha256:184aaf7b609ab4ab6947b2b1df68bde7facacd7b0b5452973a73f7e998d3f8a2", + "size_bytes": 3236 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-011.json", - "sha256": "sha256:76eacf88aa6bd4b7430d16a0b6abd83306f0cafe1bdb1878ac2d604dcaa5e993", - "size_bytes": 3589 + "sha256": "sha256:675d861e51f13df1c5ec10ad6ddc4909c827f7e893fb3485471023130175f123", + "size_bytes": 3504 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-012.json", - "sha256": "sha256:783c7f76d2eb4cb02af1f077fa77ae22108cda0e92220fd40745cd18931510b2", - "size_bytes": 2910 + "sha256": "sha256:9c16ba5f4d95d959f1f4419fb2b646202204448fde49ac2669e0a5839c7a10a8", + "size_bytes": 1940 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-013.json", - "sha256": "sha256:e6dc8c007e837a9ac2c0af50c87f8b5e2ae59a53afb7e99bbf570172b9b73d2e", - "size_bytes": 3610 + "sha256": "sha256:f36aa4d3809a20c9842eac49c7aed6b31a916a8c089d376e83b0c29023863604", + "size_bytes": 2088 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-014.json", - "sha256": "sha256:64355c1f3addd2dcbca60cdd4d7e1a3e7eb2d5e3eded9ca8ab7a75cdcdf7e068", - "size_bytes": 2501 + "sha256": "sha256:822f9b125bdb8ebbd50288b7360108c9657791caca7638a3d25ee4d095b249ee", + "size_bytes": 2461 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-015.json", - "sha256": "sha256:8b73adb652f0962663ea7a7a86467037919fad636ab138c33886bfb3bce03a06", - "size_bytes": 3086 + "sha256": "sha256:49990c7ca0564af284139ad4ce276ecd33d7f3d05a4f3094449ea87e93825809", + "size_bytes": 3046 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-016.json", - "sha256": "sha256:3db680a11ad82baa915ee0673dab19f1314b6c841a4cf72b5ea6997872168598", - "size_bytes": 3641 + "sha256": "sha256:90741b3701cd8e9ec043e978ba1f7bbb22b349ef04f425605f019bf599774311", + "size_bytes": 3599 }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-001.json", - "sha256": "sha256:629c8ec5d5c8754accc3bfb8371be70517cd22eff6df77b05f80b924d504db0c", - "size_bytes": 1961 + "sha256": "sha256:60585b00221d867f21ea98fe198b4d35f2acdf56118de3ab7403a8a6c3c1b9c7", + "size_bytes": 1921 }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-002.json", - "sha256": "sha256:d9e91bbbc7f4107a876f748951ba8bf6d54bdec7fc07d3c337865acc581748f8", - "size_bytes": 2639 + "sha256": "sha256:06e6f20764094764047c1b68404b30b135505214003082d52c2896d4d82c2f5c", + "size_bytes": 2597 }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-003.json", - "sha256": "sha256:2beb58bb1a248feae6ae4e58c3e79090d9968619eee02bfcc9d964e62daee472", - "size_bytes": 2649 + "sha256": "sha256:92f21b9d2efe2ecc2e3c11ec72f1969ebd78d48b91b39c1f2aa096c475766cfa", + "size_bytes": 2607 }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-004.json", - "sha256": "sha256:382fd819df34e3a07813d2bfb242699a0ac8ba3ca4237574640940c58aacba70", - "size_bytes": 3160 + "sha256": "sha256:a687f38d83674d2d3a92372be3048860463da19542ca74b2024d61d8361e9ffc", + "size_bytes": 3118 }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-005.json", - "sha256": "sha256:0a7bd554fc68db99cba30dfe8dd8573f176b573a4c30c5bc79820255c1f64171", - "size_bytes": 3707 + "sha256": "sha256:9459583800f64781bcda6e638200a6cb128a7a20aa8d177720966ac70e1d7308", + "size_bytes": 3665 }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-006.json", - "sha256": "sha256:1a77e9fb1ded33823854070104eb93e4cfdf57137bf544ece8dc9854b5c18429", - "size_bytes": 2012 + "sha256": "sha256:fded1536ea25f1c32d63907703bc9bccc46e3a74d5205a1ddf86991d2078c7f3", + "size_bytes": 1970 }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-007.json", - "sha256": "sha256:a5aa8a79fef5a07ccf35b1d296e421f801de66d4d74b57b82f96702ccc5208dd", - "size_bytes": 3417 + "sha256": "sha256:a309d632b1cd18b986cbe0a2442687fd111158eab72d689b0e266fb7d862d92a", + "size_bytes": 3375 }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-008.json", - "sha256": "sha256:866012e9620f528a28e41ab9372c63c2c27eba30a1badacf3eccbaaae271a334", - "size_bytes": 3688 + "sha256": "sha256:b227d0736e9344953a03afa436427bff54a52c6c58089375e16e154baf6fbcd9", + "size_bytes": 2247 }, { "path": "seed/canonical/conformance/conformance-profile.json", - "sha256": "sha256:daaa6fe6acaefc882d27f1ed7ab2f095a08fce73559d77b9f094386b05681488", - "size_bytes": 11909 + "sha256": "sha256:ecdfee84abc59767bb32b15639ec9503896c4cbda16c8f00ff2f5e4cea10963c", + "size_bytes": 11926 }, { "path": "seed/canonical/conformance/implementation-conformance-protocol.json", @@ -653,13 +663,18 @@ }, { "path": "seed/canonical/decisions/ADR-006-complete-invariant-closure.md", - "sha256": "sha256:3201c5d00f86f83e8ea829dae62fc2bb9a965db84da5c99a50615707b0bad9e9", - "size_bytes": 2335 + "sha256": "sha256:e7f91577c81b6659bb6129e31ffe6b37a78bd05ca53c985511df4c9faaec1128", + "size_bytes": 2659 + }, + { + "path": "seed/canonical/decisions/ADR-007-reconsideration-commitments-and-bounded-retention.md", + "sha256": "sha256:ed0fd693b305cbf93dae3533a348de837e4462bb57e204134a49d2b2c19bb457", + "size_bytes": 3136 }, { "path": "seed/canonical/formal/README.md", - "sha256": "sha256:798d32713cf6b1064019bc2ca605d6f2f5400d5dfcae1fe80d62b185e0aa3ad9", - "size_bytes": 2476 + "sha256": "sha256:5c2bdf91639aad1277f133a73d8c2ccc0f648e96b31ee14444ace919c81365e1", + "size_bytes": 3264 }, { "path": "seed/canonical/formal/SeedBootstrap.cfg", @@ -671,6 +686,16 @@ "sha256": "sha256:eed849079a74056710d47d8d243131305742e86acd6995b1272e598c0dc05e6a", "size_bytes": 512 }, + { + "path": "seed/canonical/formal/SeedCanonProjection.tla", + "sha256": "sha256:696036279144ade00fcc83d59902a2bc4c93b0c16ba81d53606b271501922280", + "size_bytes": 5643 + }, + { + "path": "seed/canonical/formal/SeedCanonRefinementProofs.tla", + "sha256": "sha256:869c32d6ddcbd82f107c5093c73ec4d4962dde0e9ce533deb0530d911b70d385", + "size_bytes": 2379 + }, { "path": "seed/canonical/formal/SeedRC12.cfg", "sha256": "sha256:4f8c0f53530247ed4306f9ca00376d3d4bb9962ee870c0a477aff198fb9f278a", @@ -683,18 +708,18 @@ }, { "path": "seed/canonical/formal/SeedResolution.cfg", - "sha256": "sha256:b231f71993c4a03770bce172f2e3ab1cef944adf8c087086c79818513c7d7b76", - "size_bytes": 536 + "sha256": "sha256:45b03f914a6b81389fd41afe22b414486047437fe2e8b98617da5bc92c0e9b94", + "size_bytes": 612 }, { "path": "seed/canonical/formal/SeedResolution.tla", - "sha256": "sha256:29195d271e799f407f12f33be1e0fc2f17484b69d17fbd73dc6dbdd6b691ec86", - "size_bytes": 9445 + "sha256": "sha256:89ae6f8500cedefdb2e4cc1a3939d074b1ccd480766384977115a7bd70290afe", + "size_bytes": 9616 }, { "path": "seed/canonical/formal/SeedResolutionProofs.tla", - "sha256": "sha256:eba6d8668cb0195b0c3444e878c851649b8e24c2995677c37a606f6882511095", - "size_bytes": 43882 + "sha256": "sha256:078e123f28fbf012179484c8b559bbc55a6d24200e0b3ecc2b7ba9deeeefcbe3", + "size_bytes": 42571 }, { "path": "seed/canonical/migration/ALPHA2_TO_0.3_ALPHA1.md", @@ -708,8 +733,8 @@ }, { "path": "seed/canonical/migration/CANON_CHANGE_DECLARATION.json", - "sha256": "sha256:a48c17122fddda221855354c3defa9f65bd1070a54ebee147d280acb44feb960", - "size_bytes": 591 + "sha256": "sha256:997134c763754c726b939823ffa37528a5860cde7111584f577029982c379767", + "size_bytes": 679 }, { "path": "seed/canonical/migration/RC11_TO_RC12_SEMANTIC_COVERAGE.json", @@ -738,8 +763,8 @@ }, { "path": "seed/canonical/ontology/seed.ttl", - "sha256": "sha256:6cdf3132d06e560f16f3bb70229396c4e3e9497abda137f54b4cd6a60fceb05b", - "size_bytes": 2630 + "sha256": "sha256:a5c9e95511eb45edfb16672bf9149178829b6a87486507e373800097c67aaa0a", + "size_bytes": 2885 }, { "path": "seed/canonical/protocol/digest-profile.json", @@ -748,7 +773,7 @@ }, { "path": "seed/canonical/protocol/protocol-profile.json", - "sha256": "sha256:34fd781b298c634fd539cabe38d6b51d0518e40df8dfaf0bc7f1847bc696ca97", + "sha256": "sha256:cb699538f0f6fa10d5958b6f059a2891fdd89cb7fdef56e458f10cd4968b955f", "size_bytes": 4405 }, { @@ -768,8 +793,8 @@ }, { "path": "seed/canonical/protocol/schemas/conformance-case.schema.json", - "sha256": "sha256:3992493600276b2f8117b3f8541c26555cf422f117e1e90f7ceb1977e1294983", - "size_bytes": 1853 + "sha256": "sha256:622cd3eb866b7fbfc2cc2f494b66e831cf8713a329ee89f73ed0f5f062a0343a", + "size_bytes": 2220 }, { "path": "seed/canonical/protocol/schemas/constitution.schema.json", @@ -968,8 +993,8 @@ }, { "path": "seed/canonical/protocol/schemas/resolution-request.schema.json", - "sha256": "sha256:b2f50024b439cacb5cea8f3f38f8f150dd797a1511b961c7e9a23bd666d10662", - "size_bytes": 1123 + "sha256": "sha256:503473e6c492dac110f06fb5b9b1472341b7e3ccabef8949288fbad93c81fdda", + "size_bytes": 1144 }, { "path": "seed/canonical/protocol/schemas/resolution-store.schema.json", @@ -1021,6 +1046,11 @@ "sha256": "sha256:183ca3ff73cb08d2666573d7b1ffafe43080718471756ad1634baa02c0b53880", "size_bytes": 1264 }, + { + "path": "seed/canonical/schemas/canon-tla-refinement.schema.json", + "sha256": "sha256:ac5d713265a8ec0b6a229252fc5adab2f988da21fa69ff26bea082e3f103b4e4", + "size_bytes": 6582 + }, { "path": "seed/canonical/schemas/conformance-profile.schema.json", "sha256": "sha256:3d4eab2037567b55a8903d55a71f97bd98851d2282766332a86460f2c83d5bb7", @@ -1058,7 +1088,7 @@ }, { "path": "seed/canonical/schemas/repository-release-gates.schema.json", - "sha256": "sha256:13af21197ec809262bbbff0d8a6dadf0cfc88e53114f67408401bfa7b7d000f1", + "sha256": "sha256:66984ee6fa589f916b5c0b8ecdbeaaa7ae16740ad28c34d87c97312ea4de3080", "size_bytes": 1299 }, { @@ -1078,8 +1108,8 @@ }, { "path": "seed/canonical/source/seed-model.json", - "sha256": "sha256:5b70adad64933b5785cbde54290c4c1db2916e8efe37b222c0928f4a1017a017", - "size_bytes": 33876 + "sha256": "sha256:b5e68692317600fd2833474a1f9c31f09e44d37ae92ec14573b416076c5dd7f6", + "size_bytes": 36127 }, { "path": "seed/canonical/terminology/foreign-terms.json", @@ -1088,13 +1118,13 @@ }, { "path": "seed/canonical/terminology/seed.skos.ttl", - "sha256": "sha256:339482099f5bcf62f0dd872d44894547a531f84a27219b60ebf90c4cc5162d7c", - "size_bytes": 3451 + "sha256": "sha256:02359ded1ff2f14a7252fb489f18c0ab3f3dbceab9932d4503cb2b5ce376b8bd", + "size_bytes": 3712 }, { "path": "seed/canonical/terminology/seed.tbx", - "sha256": "sha256:7a0d45d1179ff93dbf4185a22ef4a6ef0bae039bf5ff4fe712f063604946eec5", - "size_bytes": 4516 + "sha256": "sha256:fbb6350feb0d8061352b8ca7b3da3eb3a60038668568c22db88460e111a156d8", + "size_bytes": 4541 }, { "path": "seed/releases/0.1-rc11/README.md", @@ -2063,8 +2093,8 @@ }, { "path": "tests/test_ci_assurance.py", - "sha256": "sha256:5b958d26c82a195d8f43ff69caefae151f3b26e064c89a2300869064dfc7c8aa", - "size_bytes": 6073 + "sha256": "sha256:531cae74d46487a2a9fc8f19e43474368050aec86524c3df9383f64f8b31f895", + "size_bytes": 8532 }, { "path": "tests/test_implementation_conformance_protocol.py", @@ -2078,8 +2108,8 @@ }, { "path": "tests/test_minimal_resolution_kernel.py", - "sha256": "sha256:32c3101b22e94febf3db2a3b034a6b0937604cc557dcd5268c600c8213959f54", - "size_bytes": 710 + "sha256": "sha256:44a236f50aa85c960eb58f74a5b84a51fd0d91a2cc249c689a488282dba807fa", + "size_bytes": 1722 }, { "path": "tests/test_production_repository.py", @@ -2113,8 +2143,8 @@ }, { "path": "tools/build_canon_package.py", - "sha256": "sha256:77dcd3c3d6e204c00391b69a9d54bdc56c06ebfbe4757460e5835a6ddad02f85", - "size_bytes": 3757 + "sha256": "sha256:d3fdf7895f3910feb3d6974dfd72ef25f317834035e95d398c58bf249ea12569", + "size_bytes": 4083 }, { "path": "tools/build_release.py", @@ -2131,6 +2161,11 @@ "sha256": "sha256:d1130da7274498255176d3a7b637822efb9f94591912309d6146ac45b80e8ce4", "size_bytes": 5702 }, + { + "path": "tools/check_canon_tla_refinement.py", + "sha256": "sha256:ea28442031c166417173649141304b9fe343fde7223af165f62897c559466ffb", + "size_bytes": 8507 + }, { "path": "tools/check_invariant_coverage.py", "sha256": "sha256:bc578d83ebe432c16f5649de077fec276ec0f8e0df8239bb9663c03077c1841f", @@ -2146,6 +2181,11 @@ "sha256": "sha256:4a8fbf3306ef99da1f73a6c3b829e6a68c9450390726fa7f46ba04e8ed138406", "size_bytes": 9292 }, + { + "path": "tools/generate_canon_tla_projection.py", + "sha256": "sha256:178f45c8c1c88cfc9a7c073b3dad19512d9b19c2f8a1222bbe2e19b74e65f37b", + "size_bytes": 10429 + }, { "path": "tools/generate_editions.py", "sha256": "sha256:0052acde2f7f4855071c424f8ddc3aead530bd2e59ebef0a5213d67a4f1c04a6", @@ -2178,8 +2218,8 @@ }, { "path": "tools/model_check_seed.py", - "sha256": "sha256:654dd28e548696c580522093c0964af6a9e409ec30f34c9dc96ec6ec785a8a66", - "size_bytes": 11080 + "sha256": "sha256:b9acdb54d70548e83acc799463dc04f338a4ba134097ce5e21400f09082ee86f", + "size_bytes": 11042 }, { "path": "tools/production_gate.py", @@ -2193,8 +2233,13 @@ }, { "path": "tools/repository_release_gate.py", - "sha256": "sha256:599333e1d62aeae7c105eb2dc4288caa27d4b2f866ed0897958fc79fa8d49dbf", - "size_bytes": 4690 + "sha256": "sha256:9742f2d10198558c85a6caf76ddd335bd736d669d95f37dcb1a3e7fd141e5f44", + "size_bytes": 5154 + }, + { + "path": "tools/run_canon_tla_refinement.py", + "sha256": "sha256:f6b6228d979badccb2705a515a9a97bd9dc051c907a0ad9d90f2c339ca30a280", + "size_bytes": 6441 }, { "path": "tools/run_external_conformance.py", @@ -2218,8 +2263,8 @@ }, { "path": "tools/seed_resolution_oracle.py", - "sha256": "sha256:541d4716c3f2ae6dbaa018827d51f882b93c5cdba36aad161df2cc12aed347e8", - "size_bytes": 12985 + "sha256": "sha256:f7af5e9ba460b1c4947e769c84adc4f81421d7c6ba7acf85b1035af8d9e525be", + "size_bytes": 14076 }, { "path": "tools/semantic_diff.py", @@ -2258,8 +2303,8 @@ }, { "path": "tools/validate_seed_canon.py", - "sha256": "sha256:fb580b1888c61d5e46c1681425d7001c227fa01b398a179dde08b13458f66473", - "size_bytes": 7005 + "sha256": "sha256:e92f2c8e3e47bae69a69f33d7069b50df3f25262a6b3794737ad5827e8449e7e", + "size_bytes": 7211 }, { "path": "tools/verify_frozen_release.py", @@ -2267,7 +2312,7 @@ "size_bytes": 1035 } ], - "files_count": 453, + "files_count": 462, "manifest_scope": "all repository regular files except MANIFEST.json, Git metadata, virtual environments, caches and dist", "package": "ASET-Seed-0.3.0-alpha.1-Minimal-Strong-Core", "repository_root": "ASET" diff --git a/audit/ACTIVE_AUDIT_INDEX.json b/audit/ACTIVE_AUDIT_INDEX.json index 49a0aef..508a46f 100644 --- a/audit/ACTIVE_AUDIT_INDEX.json +++ b/audit/ACTIVE_AUDIT_INDEX.json @@ -1,6 +1,6 @@ { "active_candidate": { - "canon_package_digest": "sha256:3ac093adb4575eb7202ac25abcdb128ad90913279b7a897e48877b8548c055d8", + "canon_package_digest": "sha256:1cdd37e997626a15471b6125dfccf22895b4b104a7239b5c4ced8679165a07f8", "extension_separation": "COMPLETE", "implementation_precedence": "NONE", "repository_role": "OPEN_IMPLEMENTATION_NEUTRAL_SPECIFICATION", @@ -36,7 +36,9 @@ "dist/invariant-mutations.json", "dist/invariant-coverage.json", "dist/tlaps-proof.json", - "dist/proof-traceability-check.json" + "dist/proof-traceability-check.json", + "dist/canon-tla-refinement-check.json", + "dist/canon-tla-refinement-proof.json" ], "historical_noncontrolling_records": [ "audit/FINDING_CLOSURE_MATRIX.json", diff --git a/docs/architecture/SEED_ROLE.md b/docs/architecture/SEED_ROLE.md index 255294a..30fd42a 100644 --- a/docs/architecture/SEED_ROLE.md +++ b/docs/architecture/SEED_ROLE.md @@ -10,8 +10,11 @@ It defines: - immutable terminal `ResolutionRecord`; - derived `UNKNOWN`, terminal `ALLOW` and terminal `BLOCK`; - fail-closed effect permission; -- fresh linked reconsideration. +- fresh reconsideration linked by an immutable recognized terminal-record commitment. -It does not define policy evaluation, evidence acquisition, workflow, federation, storage or enforcement. Extensions may produce and transport inputs and proof material, but only Seed semantics determine whether a terminal record is valid. +It does not define policy evaluation, evidence acquisition, workflow, federation, storage, retention/compaction, a concrete cryptographic accumulator or enforcement. Extensions may produce and transport inputs and proof material, but only Seed semantics determine whether a terminal record is valid. Evidence, AI output, consensus and remote outcomes remain non-authoritative until a locally authorized exact-binding terminal record is recognized. + + +Historical predecessor objects are not part of the reconsideration requirement. An implementation may prune them after preserving profile-specific proof material sufficient to re-establish recognition of the terminal commitment. A bounded hot buffer plus an authenticated accumulator is one scalable profile; Merkle/MMR or any other concrete construction is non-normative. diff --git a/docs/architecture/TERMINAL_COMMITMENT_ACCUMULATION.md b/docs/architecture/TERMINAL_COMMITMENT_ACCUMULATION.md new file mode 100644 index 0000000..16bd4ea --- /dev/null +++ b/docs/architecture/TERMINAL_COMMITMENT_ACCUMULATION.md @@ -0,0 +1,64 @@ +# Terminal commitment accumulation + +ASET Seed intentionally separates **semantic recognition** from **historical retention**. + +A reconsideration request carries `previous_terminal_record_digest`. The digest identifies an immutable terminal-resolution fact. Seed requires that the commitment be recognized, but it does not require the predecessor request or record to remain in the active store. + +## Bounded hot buffer + authenticated accumulator + +A scalable implementation may maintain: + +- `B`: a hot buffer containing at most `N` recent terminal-record digests; +- `A`: profile-specific authenticated accumulator state; +- external proof material sufficient to establish membership of compacted commitments when needed. + +Conceptually: + +```text +new terminal ResolutionRecord + | + v + record_digest = c + | + v + append to B + | + |B| reaches N + | + v + compact completed block + | + v + A' = Add(A, block) + B' = empty +``` + +Recognition of `previous_terminal_record_digest = c` is then established either because `c` is still in the hot buffer/current retained records, or because the selected accumulator profile verifies a witness for `c` against `A`. + +## Why the accumulator is not normative Seed + +Different authenticated structures make different trade-offs: + +- a balanced Merkle structure commonly gives `O(log n)` membership proofs; +- an MMR supports append-oriented histories while retaining a logarithmic frontier; +- some accumulators can expose constant-size commitments/witnesses but rely on stronger cryptographic assumptions; +- recursive proof systems can move more state and computation outside the kernel. + +Hard-coding one of these would make a cryptographic/storage choice normative. Seed instead exposes one semantic boundary: **recognized terminal commitment**. + +## About the `N + 1` bound + +`N` hot commitments plus one root is an attractive implementation target, but it is not true for every Merkle-style construction without additional external state. A root alone generally does not contain enough information to reconstruct arbitrary future membership proofs or, for some append constructions, to update the root efficiently. + +A profile may still achieve an `N + 1` kernel-retained digest bound if required frontier/history/witness material is external and the kernel can validate the supplied update or membership proof. Otherwise the retained accumulator frontier may be `O(log n)`. + +Therefore the portable claim is: + +```text +Seed semantic history retention: not required +hot state: bounded by profile +accumulator retained state: O(1) or O(log n), depending on profile +membership proof: supplied/maintained outside Seed +``` + +This preserves the minimal Seed role while allowing long-lived deployments to avoid linear growth of canonical state. diff --git a/docs/generated/en/ASET_Seed_Next.md b/docs/generated/en/ASET_Seed_Next.md index a05c6d5..09716db 100644 --- a/docs/generated/en/ASET_Seed_Next.md +++ b/docs/generated/en/ASET_Seed_Next.md @@ -4,7 +4,7 @@ **Status:** `MINIMAL_STRONG_CORE_ALPHA` -**Canonical model SHA-256:** `sha256:2db8db8c61aebc801c5fedd67250e64c09bfc29367e99b061e4a8bec74230fe0` +**Canonical model SHA-256:** `sha256:5bbdfefe35a0adf83fd5e5dd86475a4f57ae92d4f9b9c06a7d530faf2e484396` > This edition is derived from the machine canon. @@ -58,11 +58,11 @@ One immutable content-addressed terminal ALLOW or BLOCK record with exact bindin Identifier: `seed.resolution_record` -### reconsideration link (`ReconsiderationLink`) +### reconsideration commitment (`ReconsiderationCommitment`) -A link from a fresh request to the unique terminal record of a previous resolution without mutating that record. +An immutable content-addressed commitment from a fresh request to a previously recognized terminal ResolutionRecord; the predecessor request or record need not remain physically retained by the implementation. Recognition may be established by current retained material or by externally validated authenticated-set/accumulator proof material. -Identifier: `seed.reconsideration_link` +Identifier: `seed.reconsideration_commitment` ## Requirements @@ -168,7 +168,7 @@ Predicate: `record_immutable` ### `ASET-SEED-REQ-011` -Reconsideration MUST create a fresh resolution_id linked to the unique terminal record of the previous resolution. +Reconsideration MUST create a fresh resolution_id and carry an immutable content-addressed commitment to a previously recognized terminal ResolutionRecord; the predecessor request or record need not remain physically retained. Modality: `MUST` @@ -199,7 +199,7 @@ Predicate: `implementation_neutral` - `SEED-INV-009` — Conflicting or invalid terminal material yields UNKNOWN and never ALLOW. - `SEED-INV-010` — Resolution records are append-only, immutable and content-addressed. - `SEED-INV-011` — Only recognized Seed transitions may change the canonical store; an invalid or unrecognized candidate is not a Seed transition. -- `SEED-INV-012` — Reconsideration uses a fresh resolution_id linked to a prior unique terminal record. +- `SEED-INV-012` — Reconsideration uses a fresh resolution_id linked by an immutable content-addressed commitment to a previously recognized terminal ResolutionRecord; predecessor object retention is not required. ## Transitions @@ -207,7 +207,7 @@ Predicate: `implementation_neutral` - `payload_schema`: `seed/canonical/protocol/schemas/payload-register-request.schema.json` - `authority_rule`: The initial Authority binding must be locally rooted and exactly match the request binding. -- `binding_rule`: The request contains one canonical exact binding and a fresh resolution_id. +- `binding_rule`: The request contains one canonical exact binding and a fresh resolution_id. For reconsideration, previous_terminal_record_digest must be a recognized immutable terminal-record commitment; predecessor object presence in retained storage is not required. - `created_artifacts`: `ResolutionRequest` ### `SEED-TX-002` — `SUBMIT_RESOLUTION` @@ -229,4 +229,4 @@ Predicate: `implementation_neutral` - `normative_status`: `IMPLEMENTATION_NEUTRAL` - `implementation_precedence`: `NONE` - `conformance_protocol_ref`: `seed/canonical/conformance/implementation-conformance-protocol.json` -- `unspecified_by_seed`: `policy evaluation language`, `evidence acquisition`, `orchestration semantics`, `enforcement mechanism`, `storage engine`, `durability level`, `concurrency control`, `network topology`, `consensus protocol`, `cryptographic provider`, `key custody`, `federation topology`, `AI model`, `artifact retention` +- `unspecified_by_seed`: `policy evaluation language`, `evidence acquisition`, `orchestration semantics`, `enforcement mechanism`, `storage engine`, `durability level`, `concurrency control`, `network topology`, `consensus protocol`, `cryptographic provider`, `key custody`, `federation topology`, `AI model`, `artifact retention`, `retention, pruning, archiving and compaction of superseded request/record material`, `terminal-commitment accumulator construction`, `accumulator membership/update witness retention` diff --git a/docs/generated/en/ASET_Seed_Resolution_0.3-alpha.1.md b/docs/generated/en/ASET_Seed_Resolution_0.3-alpha.1.md index a05c6d5..09716db 100644 --- a/docs/generated/en/ASET_Seed_Resolution_0.3-alpha.1.md +++ b/docs/generated/en/ASET_Seed_Resolution_0.3-alpha.1.md @@ -4,7 +4,7 @@ **Status:** `MINIMAL_STRONG_CORE_ALPHA` -**Canonical model SHA-256:** `sha256:2db8db8c61aebc801c5fedd67250e64c09bfc29367e99b061e4a8bec74230fe0` +**Canonical model SHA-256:** `sha256:5bbdfefe35a0adf83fd5e5dd86475a4f57ae92d4f9b9c06a7d530faf2e484396` > This edition is derived from the machine canon. @@ -58,11 +58,11 @@ One immutable content-addressed terminal ALLOW or BLOCK record with exact bindin Identifier: `seed.resolution_record` -### reconsideration link (`ReconsiderationLink`) +### reconsideration commitment (`ReconsiderationCommitment`) -A link from a fresh request to the unique terminal record of a previous resolution without mutating that record. +An immutable content-addressed commitment from a fresh request to a previously recognized terminal ResolutionRecord; the predecessor request or record need not remain physically retained by the implementation. Recognition may be established by current retained material or by externally validated authenticated-set/accumulator proof material. -Identifier: `seed.reconsideration_link` +Identifier: `seed.reconsideration_commitment` ## Requirements @@ -168,7 +168,7 @@ Predicate: `record_immutable` ### `ASET-SEED-REQ-011` -Reconsideration MUST create a fresh resolution_id linked to the unique terminal record of the previous resolution. +Reconsideration MUST create a fresh resolution_id and carry an immutable content-addressed commitment to a previously recognized terminal ResolutionRecord; the predecessor request or record need not remain physically retained. Modality: `MUST` @@ -199,7 +199,7 @@ Predicate: `implementation_neutral` - `SEED-INV-009` — Conflicting or invalid terminal material yields UNKNOWN and never ALLOW. - `SEED-INV-010` — Resolution records are append-only, immutable and content-addressed. - `SEED-INV-011` — Only recognized Seed transitions may change the canonical store; an invalid or unrecognized candidate is not a Seed transition. -- `SEED-INV-012` — Reconsideration uses a fresh resolution_id linked to a prior unique terminal record. +- `SEED-INV-012` — Reconsideration uses a fresh resolution_id linked by an immutable content-addressed commitment to a previously recognized terminal ResolutionRecord; predecessor object retention is not required. ## Transitions @@ -207,7 +207,7 @@ Predicate: `implementation_neutral` - `payload_schema`: `seed/canonical/protocol/schemas/payload-register-request.schema.json` - `authority_rule`: The initial Authority binding must be locally rooted and exactly match the request binding. -- `binding_rule`: The request contains one canonical exact binding and a fresh resolution_id. +- `binding_rule`: The request contains one canonical exact binding and a fresh resolution_id. For reconsideration, previous_terminal_record_digest must be a recognized immutable terminal-record commitment; predecessor object presence in retained storage is not required. - `created_artifacts`: `ResolutionRequest` ### `SEED-TX-002` — `SUBMIT_RESOLUTION` @@ -229,4 +229,4 @@ Predicate: `implementation_neutral` - `normative_status`: `IMPLEMENTATION_NEUTRAL` - `implementation_precedence`: `NONE` - `conformance_protocol_ref`: `seed/canonical/conformance/implementation-conformance-protocol.json` -- `unspecified_by_seed`: `policy evaluation language`, `evidence acquisition`, `orchestration semantics`, `enforcement mechanism`, `storage engine`, `durability level`, `concurrency control`, `network topology`, `consensus protocol`, `cryptographic provider`, `key custody`, `federation topology`, `AI model`, `artifact retention` +- `unspecified_by_seed`: `policy evaluation language`, `evidence acquisition`, `orchestration semantics`, `enforcement mechanism`, `storage engine`, `durability level`, `concurrency control`, `network topology`, `consensus protocol`, `cryptographic provider`, `key custody`, `federation topology`, `AI model`, `artifact retention`, `retention, pruning, archiving and compaction of superseded request/record material`, `terminal-commitment accumulator construction`, `accumulator membership/update witness retention` diff --git a/docs/generated/pt-BR/ASET_Seed_Next.md b/docs/generated/pt-BR/ASET_Seed_Next.md index b857590..d9bb411 100644 --- a/docs/generated/pt-BR/ASET_Seed_Next.md +++ b/docs/generated/pt-BR/ASET_Seed_Next.md @@ -4,7 +4,7 @@ **Status:** `MINIMAL_STRONG_CORE_ALPHA` -**SHA-256 do modelo canônico:** `sha256:2db8db8c61aebc801c5fedd67250e64c09bfc29367e99b061e4a8bec74230fe0` +**SHA-256 do modelo canônico:** `sha256:5bbdfefe35a0adf83fd5e5dd86475a4f57ae92d4f9b9c06a7d530faf2e484396` > Esta edição é derivada do cânone legível por máquina. @@ -58,11 +58,11 @@ Um registro terminal imutável e endereçado por conteúdo, ALLOW ou BLOCK, com Identificador: `seed.resolution_record` -### vínculo de reconsideração (`ReconsiderationLink`) +### compromisso de reconsideração (`ReconsiderationCommitment`) -Um vínculo de uma nova solicitação ao registro terminal único de uma resolução anterior sem alterar esse registro. +Um compromisso imutável e endereçado por conteúdo de uma nova solicitação com um ResolutionRecord terminal previamente reconhecido; a solicitação ou o registro predecessor não precisa permanecer fisicamente retido pela implementação. O reconhecimento pode ser estabelecido por material atualmente retido ou por prova externa validada de conjunto autenticado/acumulador. -Identificador: `seed.reconsideration_link` +Identificador: `seed.reconsideration_commitment` ## Requisitos @@ -168,7 +168,7 @@ Predicado: `record_immutable` ### `ASET-SEED-REQ-011` -A reconsideração DEVE criar um resolution_id novo vinculado ao registro terminal único da resolução anterior. +A reconsideração DEVE criar um resolution_id novo e portar um compromisso imutável e endereçado por conteúdo com um ResolutionRecord terminal previamente reconhecido; a solicitação ou o registro predecessor não precisa permanecer fisicamente retido. Modalidade: `MUST` @@ -199,7 +199,7 @@ Predicado: `implementation_neutral` - `SEED-INV-009` — Material terminal conflitante ou inválido resulta em UNKNOWN e nunca ALLOW. - `SEED-INV-010` — Registros de resolução são append-only, imutáveis e endereçados por conteúdo. - `SEED-INV-011` — Somente transições reconhecidas do Seed podem alterar o armazenamento canônico; um candidato inválido ou não reconhecido não é uma transição do Seed. -- `SEED-INV-012` — A reconsideração usa um resolution_id novo vinculado a um registro terminal único anterior. +- `SEED-INV-012` — A reconsideração usa um resolution_id novo vinculado por um compromisso imutável e endereçado por conteúdo a um ResolutionRecord terminal previamente reconhecido; a retenção do objeto predecessor não é obrigatória. ## Transições @@ -207,7 +207,7 @@ Predicado: `implementation_neutral` - `payload_schema`: `seed/canonical/protocol/schemas/payload-register-request.schema.json` - `authority_rule`: The initial Authority binding must be locally rooted and exactly match the request binding. -- `binding_rule`: The request contains one canonical exact binding and a fresh resolution_id. +- `binding_rule`: The request contains one canonical exact binding and a fresh resolution_id. For reconsideration, previous_terminal_record_digest must be a recognized immutable terminal-record commitment; predecessor object presence in retained storage is not required. - `created_artifacts`: `ResolutionRequest` ### `SEED-TX-002` — `SUBMIT_RESOLUTION` @@ -229,4 +229,4 @@ Predicado: `implementation_neutral` - `normative_status`: `IMPLEMENTATION_NEUTRAL` - `implementation_precedence`: `NONE` - `conformance_protocol_ref`: `seed/canonical/conformance/implementation-conformance-protocol.json` -- `unspecified_by_seed`: `policy evaluation language`, `evidence acquisition`, `orchestration semantics`, `enforcement mechanism`, `storage engine`, `durability level`, `concurrency control`, `network topology`, `consensus protocol`, `cryptographic provider`, `key custody`, `federation topology`, `AI model`, `artifact retention` +- `unspecified_by_seed`: `policy evaluation language`, `evidence acquisition`, `orchestration semantics`, `enforcement mechanism`, `storage engine`, `durability level`, `concurrency control`, `network topology`, `consensus protocol`, `cryptographic provider`, `key custody`, `federation topology`, `AI model`, `artifact retention`, `retention, pruning, archiving and compaction of superseded request/record material`, `terminal-commitment accumulator construction`, `accumulator membership/update witness retention` diff --git a/docs/generated/pt-BR/ASET_Seed_Resolution_0.3-alpha.1.md b/docs/generated/pt-BR/ASET_Seed_Resolution_0.3-alpha.1.md index b857590..d9bb411 100644 --- a/docs/generated/pt-BR/ASET_Seed_Resolution_0.3-alpha.1.md +++ b/docs/generated/pt-BR/ASET_Seed_Resolution_0.3-alpha.1.md @@ -4,7 +4,7 @@ **Status:** `MINIMAL_STRONG_CORE_ALPHA` -**SHA-256 do modelo canônico:** `sha256:2db8db8c61aebc801c5fedd67250e64c09bfc29367e99b061e4a8bec74230fe0` +**SHA-256 do modelo canônico:** `sha256:5bbdfefe35a0adf83fd5e5dd86475a4f57ae92d4f9b9c06a7d530faf2e484396` > Esta edição é derivada do cânone legível por máquina. @@ -58,11 +58,11 @@ Um registro terminal imutável e endereçado por conteúdo, ALLOW ou BLOCK, com Identificador: `seed.resolution_record` -### vínculo de reconsideração (`ReconsiderationLink`) +### compromisso de reconsideração (`ReconsiderationCommitment`) -Um vínculo de uma nova solicitação ao registro terminal único de uma resolução anterior sem alterar esse registro. +Um compromisso imutável e endereçado por conteúdo de uma nova solicitação com um ResolutionRecord terminal previamente reconhecido; a solicitação ou o registro predecessor não precisa permanecer fisicamente retido pela implementação. O reconhecimento pode ser estabelecido por material atualmente retido ou por prova externa validada de conjunto autenticado/acumulador. -Identificador: `seed.reconsideration_link` +Identificador: `seed.reconsideration_commitment` ## Requisitos @@ -168,7 +168,7 @@ Predicado: `record_immutable` ### `ASET-SEED-REQ-011` -A reconsideração DEVE criar um resolution_id novo vinculado ao registro terminal único da resolução anterior. +A reconsideração DEVE criar um resolution_id novo e portar um compromisso imutável e endereçado por conteúdo com um ResolutionRecord terminal previamente reconhecido; a solicitação ou o registro predecessor não precisa permanecer fisicamente retido. Modalidade: `MUST` @@ -199,7 +199,7 @@ Predicado: `implementation_neutral` - `SEED-INV-009` — Material terminal conflitante ou inválido resulta em UNKNOWN e nunca ALLOW. - `SEED-INV-010` — Registros de resolução são append-only, imutáveis e endereçados por conteúdo. - `SEED-INV-011` — Somente transições reconhecidas do Seed podem alterar o armazenamento canônico; um candidato inválido ou não reconhecido não é uma transição do Seed. -- `SEED-INV-012` — A reconsideração usa um resolution_id novo vinculado a um registro terminal único anterior. +- `SEED-INV-012` — A reconsideração usa um resolution_id novo vinculado por um compromisso imutável e endereçado por conteúdo a um ResolutionRecord terminal previamente reconhecido; a retenção do objeto predecessor não é obrigatória. ## Transições @@ -207,7 +207,7 @@ Predicado: `implementation_neutral` - `payload_schema`: `seed/canonical/protocol/schemas/payload-register-request.schema.json` - `authority_rule`: The initial Authority binding must be locally rooted and exactly match the request binding. -- `binding_rule`: The request contains one canonical exact binding and a fresh resolution_id. +- `binding_rule`: The request contains one canonical exact binding and a fresh resolution_id. For reconsideration, previous_terminal_record_digest must be a recognized immutable terminal-record commitment; predecessor object presence in retained storage is not required. - `created_artifacts`: `ResolutionRequest` ### `SEED-TX-002` — `SUBMIT_RESOLUTION` @@ -229,4 +229,4 @@ Predicado: `implementation_neutral` - `normative_status`: `IMPLEMENTATION_NEUTRAL` - `implementation_precedence`: `NONE` - `conformance_protocol_ref`: `seed/canonical/conformance/implementation-conformance-protocol.json` -- `unspecified_by_seed`: `policy evaluation language`, `evidence acquisition`, `orchestration semantics`, `enforcement mechanism`, `storage engine`, `durability level`, `concurrency control`, `network topology`, `consensus protocol`, `cryptographic provider`, `key custody`, `federation topology`, `AI model`, `artifact retention` +- `unspecified_by_seed`: `policy evaluation language`, `evidence acquisition`, `orchestration semantics`, `enforcement mechanism`, `storage engine`, `durability level`, `concurrency control`, `network topology`, `consensus protocol`, `cryptographic provider`, `key custody`, `federation topology`, `AI model`, `artifact retention`, `retention, pruning, archiving and compaction of superseded request/record material`, `terminal-commitment accumulator construction`, `accumulator membership/update witness retention` diff --git a/docs/generated/ru/ASET_Seed_Next.md b/docs/generated/ru/ASET_Seed_Next.md index b530e62..85cbf6b 100644 --- a/docs/generated/ru/ASET_Seed_Next.md +++ b/docs/generated/ru/ASET_Seed_Next.md @@ -4,7 +4,7 @@ **Статус:** `MINIMAL_STRONG_CORE_ALPHA` -**SHA-256 канонической модели:** `sha256:2db8db8c61aebc801c5fedd67250e64c09bfc29367e99b061e4a8bec74230fe0` +**SHA-256 канонической модели:** `sha256:5bbdfefe35a0adf83fd5e5dd86475a4f57ae92d4f9b9c06a7d530faf2e484396` > Эта редакция выводится из машинного канона. @@ -58,11 +58,11 @@ Authority, явно признанная одним Context для одной т Идентификатор: `seed.resolution_record` -### связь пересмотра (`ReconsiderationLink`) +### коммитмент пересмотра (`ReconsiderationCommitment`) -Связь нового запроса с уникальной терминальной записью предыдущего разрешения без изменения этой записи. +Неизменяемый контентно-адресуемый коммитмент нового запроса на ранее признанную терминальную ResolutionRecord; запрос или запись-предшественник не обязаны физически сохраняться реализацией. Признание может устанавливаться текущим сохранённым материалом либо внешним проверенным доказательством принадлежности аутентифицированному множеству/аккумулятору. -Идентификатор: `seed.reconsideration_link` +Идентификатор: `seed.reconsideration_commitment` ## Требования @@ -168,7 +168,7 @@ Evidence, результаты проверки, выходы AI, результ ### `ASET-SEED-REQ-011` -Пересмотр ДОЛЖЕН создавать свежий resolution_id, связанный с уникальной терминальной записью предыдущего разрешения. +Пересмотр ДОЛЖЕН создавать свежий resolution_id и нести неизменяемый контентно-адресуемый коммитмент на ранее признанную терминальную ResolutionRecord; запрос или запись-предшественник не обязаны физически сохраняться. Модальность: `MUST` @@ -199,7 +199,7 @@ Evidence, результаты проверки, выходы AI, результ - `SEED-INV-009` — Конфликтующий или недействительный терминальный материал даёт UNKNOWN и никогда не ALLOW. - `SEED-INV-010` — Записи разрешения являются append-only, неизменяемыми и контентно-адресуемыми. - `SEED-INV-011` — Только признанные переходы Seed могут изменять каноническое хранилище; недействительный или непризнанный кандидат не является переходом Seed. -- `SEED-INV-012` — Пересмотр использует свежий resolution_id, связанный с предыдущей уникальной терминальной записью. +- `SEED-INV-012` — Пересмотр использует свежий resolution_id, связанный неизменяемым контентно-адресуемым коммитментом с ранее признанной терминальной ResolutionRecord; хранение объекта-предшественника не требуется. ## Переходы @@ -207,7 +207,7 @@ Evidence, результаты проверки, выходы AI, результ - `payload_schema`: `seed/canonical/protocol/schemas/payload-register-request.schema.json` - `authority_rule`: The initial Authority binding must be locally rooted and exactly match the request binding. -- `binding_rule`: The request contains one canonical exact binding and a fresh resolution_id. +- `binding_rule`: The request contains one canonical exact binding and a fresh resolution_id. For reconsideration, previous_terminal_record_digest must be a recognized immutable terminal-record commitment; predecessor object presence in retained storage is not required. - `created_artifacts`: `ResolutionRequest` ### `SEED-TX-002` — `SUBMIT_RESOLUTION` @@ -229,4 +229,4 @@ Evidence, результаты проверки, выходы AI, результ - `normative_status`: `IMPLEMENTATION_NEUTRAL` - `implementation_precedence`: `NONE` - `conformance_protocol_ref`: `seed/canonical/conformance/implementation-conformance-protocol.json` -- `unspecified_by_seed`: `policy evaluation language`, `evidence acquisition`, `orchestration semantics`, `enforcement mechanism`, `storage engine`, `durability level`, `concurrency control`, `network topology`, `consensus protocol`, `cryptographic provider`, `key custody`, `federation topology`, `AI model`, `artifact retention` +- `unspecified_by_seed`: `policy evaluation language`, `evidence acquisition`, `orchestration semantics`, `enforcement mechanism`, `storage engine`, `durability level`, `concurrency control`, `network topology`, `consensus protocol`, `cryptographic provider`, `key custody`, `federation topology`, `AI model`, `artifact retention`, `retention, pruning, archiving and compaction of superseded request/record material`, `terminal-commitment accumulator construction`, `accumulator membership/update witness retention` diff --git a/docs/generated/ru/ASET_Seed_Resolution_0.3-alpha.1.md b/docs/generated/ru/ASET_Seed_Resolution_0.3-alpha.1.md index b530e62..85cbf6b 100644 --- a/docs/generated/ru/ASET_Seed_Resolution_0.3-alpha.1.md +++ b/docs/generated/ru/ASET_Seed_Resolution_0.3-alpha.1.md @@ -4,7 +4,7 @@ **Статус:** `MINIMAL_STRONG_CORE_ALPHA` -**SHA-256 канонической модели:** `sha256:2db8db8c61aebc801c5fedd67250e64c09bfc29367e99b061e4a8bec74230fe0` +**SHA-256 канонической модели:** `sha256:5bbdfefe35a0adf83fd5e5dd86475a4f57ae92d4f9b9c06a7d530faf2e484396` > Эта редакция выводится из машинного канона. @@ -58,11 +58,11 @@ Authority, явно признанная одним Context для одной т Идентификатор: `seed.resolution_record` -### связь пересмотра (`ReconsiderationLink`) +### коммитмент пересмотра (`ReconsiderationCommitment`) -Связь нового запроса с уникальной терминальной записью предыдущего разрешения без изменения этой записи. +Неизменяемый контентно-адресуемый коммитмент нового запроса на ранее признанную терминальную ResolutionRecord; запрос или запись-предшественник не обязаны физически сохраняться реализацией. Признание может устанавливаться текущим сохранённым материалом либо внешним проверенным доказательством принадлежности аутентифицированному множеству/аккумулятору. -Идентификатор: `seed.reconsideration_link` +Идентификатор: `seed.reconsideration_commitment` ## Требования @@ -168,7 +168,7 @@ Evidence, результаты проверки, выходы AI, результ ### `ASET-SEED-REQ-011` -Пересмотр ДОЛЖЕН создавать свежий resolution_id, связанный с уникальной терминальной записью предыдущего разрешения. +Пересмотр ДОЛЖЕН создавать свежий resolution_id и нести неизменяемый контентно-адресуемый коммитмент на ранее признанную терминальную ResolutionRecord; запрос или запись-предшественник не обязаны физически сохраняться. Модальность: `MUST` @@ -199,7 +199,7 @@ Evidence, результаты проверки, выходы AI, результ - `SEED-INV-009` — Конфликтующий или недействительный терминальный материал даёт UNKNOWN и никогда не ALLOW. - `SEED-INV-010` — Записи разрешения являются append-only, неизменяемыми и контентно-адресуемыми. - `SEED-INV-011` — Только признанные переходы Seed могут изменять каноническое хранилище; недействительный или непризнанный кандидат не является переходом Seed. -- `SEED-INV-012` — Пересмотр использует свежий resolution_id, связанный с предыдущей уникальной терминальной записью. +- `SEED-INV-012` — Пересмотр использует свежий resolution_id, связанный неизменяемым контентно-адресуемым коммитментом с ранее признанной терминальной ResolutionRecord; хранение объекта-предшественника не требуется. ## Переходы @@ -207,7 +207,7 @@ Evidence, результаты проверки, выходы AI, результ - `payload_schema`: `seed/canonical/protocol/schemas/payload-register-request.schema.json` - `authority_rule`: The initial Authority binding must be locally rooted and exactly match the request binding. -- `binding_rule`: The request contains one canonical exact binding and a fresh resolution_id. +- `binding_rule`: The request contains one canonical exact binding and a fresh resolution_id. For reconsideration, previous_terminal_record_digest must be a recognized immutable terminal-record commitment; predecessor object presence in retained storage is not required. - `created_artifacts`: `ResolutionRequest` ### `SEED-TX-002` — `SUBMIT_RESOLUTION` @@ -229,4 +229,4 @@ Evidence, результаты проверки, выходы AI, результ - `normative_status`: `IMPLEMENTATION_NEUTRAL` - `implementation_precedence`: `NONE` - `conformance_protocol_ref`: `seed/canonical/conformance/implementation-conformance-protocol.json` -- `unspecified_by_seed`: `policy evaluation language`, `evidence acquisition`, `orchestration semantics`, `enforcement mechanism`, `storage engine`, `durability level`, `concurrency control`, `network topology`, `consensus protocol`, `cryptographic provider`, `key custody`, `federation topology`, `AI model`, `artifact retention` +- `unspecified_by_seed`: `policy evaluation language`, `evidence acquisition`, `orchestration semantics`, `enforcement mechanism`, `storage engine`, `durability level`, `concurrency control`, `network topology`, `consensus protocol`, `cryptographic provider`, `key custody`, `federation topology`, `AI model`, `artifact retention`, `retention, pruning, archiving and compaction of superseded request/record material`, `terminal-commitment accumulator construction`, `accumulator membership/update witness retention` diff --git a/docs/repository/CI_ASSURANCE.md b/docs/repository/CI_ASSURANCE.md index 90268aa..ace6f86 100644 --- a/docs/repository/CI_ASSURANCE.md +++ b/docs/repository/CI_ASSURANCE.md @@ -12,7 +12,7 @@ aggregate command. - language policy; - machine-canon and canon-package validity; - bounded model output; -- assurance and proof traceability; +- assurance, proof traceability and canon-to-TLA refinement integrity; - specification tests; - critical Ruff rules; - active-documentation claims. @@ -27,7 +27,8 @@ normative change. - the bounded Python state-space model; - the checked formal-property registry; - TLC over the committed TLA+ model; -- TLAPS over the committed proof module. +- TLAPS over the committed safety proof module; +- TLAPS over the source-locked canon-to-TLA behavioral-equivalence proof. TLC is downloaded from the pinned upstream TLA+ v1.7.4 release and its configured identity is verified before execution. @@ -77,14 +78,17 @@ An implementation adapter cannot issue its own PASS verdict. The formal contour establishes: - bounded model assurance for the committed finite configuration; -- unbounded deductive safety for the committed abstract TLA+ projection. +- unbounded deductive safety for the committed abstract TLA+ projection; +- byte-for-byte parity of the deterministic canonical projection generated from the exact machine-readable Seed identity; +- TLAPS-proved behavioral equivalence between that declared projection and `SeedResolution.tla`. -It does not establish: +The canon-to-TLA theorem is scoped to the declared abstraction profile. It does not establish: -- machine-canon-to-TLA refinement; +- equivalence of every natural-language sentence; +- concrete Binding/digest construction; +- concrete Authority grant-chain construction; - implementation refinement or production readiness; - liveness; -- concrete grant-chain construction; - cryptographic primitive security; - factual truth of external evidence; - external certification. diff --git a/seed/canonical/CANON_PACKAGE.json b/seed/canonical/CANON_PACKAGE.json index e0ca8e5..8b4cd6c 100644 --- a/seed/canonical/CANON_PACKAGE.json +++ b/seed/canonical/CANON_PACKAGE.json @@ -6,7 +6,7 @@ "files": [ { "path": "seed/canonical/source/seed-model.json", - "sha256": "sha256:5b70adad64933b5785cbde54290c4c1db2916e8efe37b222c0928f4a1017a017" + "sha256": "sha256:b5e68692317600fd2833474a1f9c31f09e44d37ae92ec14573b416076c5dd7f6" }, { "path": "seed/canonical/schemas/seed-model.schema.json", @@ -14,7 +14,7 @@ }, { "path": "seed/canonical/protocol/protocol-profile.json", - "sha256": "sha256:34fd781b298c634fd539cabe38d6b51d0518e40df8dfaf0bc7f1847bc696ca97" + "sha256": "sha256:cb699538f0f6fa10d5958b6f059a2891fdd89cb7fdef56e458f10cd4968b955f" }, { "path": "seed/canonical/protocol/digest-profile.json", @@ -26,7 +26,7 @@ }, { "path": "seed/canonical/conformance/conformance-profile.json", - "sha256": "sha256:daaa6fe6acaefc882d27f1ed7ab2f095a08fce73559d77b9f094386b05681488" + "sha256": "sha256:ecdfee84abc59767bb32b15639ec9503896c4cbda16c8f00ff2f5e4cea10963c" }, { "path": "seed/canonical/schemas/conformance-profile.schema.json", @@ -50,11 +50,11 @@ }, { "path": "seed/canonical/assurance/verification-registry.json", - "sha256": "sha256:2c1c7591e79983e2fd607566baba81888bf1b6f507ef5d434b8c77dffdf3f603" + "sha256": "sha256:7a45c470a14c5dd1e55a1b12cd9438b9f43e0170ecdfe817eeb256ee61e225f6" }, { "path": "seed/canonical/assurance/invariant-coverage.json", - "sha256": "sha256:a4bd10c7fe7bd68b3e4ce4aa5a79da50579c2acc13bdc10bd1ddb7da48825773" + "sha256": "sha256:36a8da2d0ef0826c72d8ebe1196ecf65485f310a3e276a95ef72c491ac57461c" }, { "path": "seed/canonical/schemas/invariant-coverage.schema.json", @@ -68,9 +68,17 @@ "path": "seed/canonical/schemas/proof-traceability.schema.json", "sha256": "sha256:7139c370d2cf0709a8c2dfcf891ffc2aecc374d6558f6124aa4bc639795de53f" }, + { + "path": "seed/canonical/assurance/canon-tla-refinement.json", + "sha256": "sha256:8d510b7757c1afbfde9ffc808e4a6366a91c9f44368eca94413a0f019b6822e6" + }, + { + "path": "seed/canonical/schemas/canon-tla-refinement.schema.json", + "sha256": "sha256:ac5d713265a8ec0b6a229252fc5adab2f988da21fa69ff26bea082e3f103b4e4" + }, { "path": "seed/canonical/assurance/limitations.json", - "sha256": "sha256:f7aaa95ce0c877b2b0ed142b7b0047809677b01ee923f86f418c46d8692d682f" + "sha256": "sha256:76550e4414ee5d8f70a82c57296425bdc72f99f3af4c940223aadae3e66da3f8" }, { "path": "seed/canonical/schemas/assurance-limitations.schema.json", @@ -78,11 +86,11 @@ }, { "path": "seed/canonical/assurance/repository-release-gates.json", - "sha256": "sha256:fe75e412403f4adebdc009652f68e1d843a2c1a3c0cbf95de315a9bd88b20d58" + "sha256": "sha256:9b945c1665038e8e4a642ffa6b9510d5ab8aaeeb45b5403bf578fb230e666c77" }, { "path": "seed/canonical/schemas/repository-release-gates.schema.json", - "sha256": "sha256:13af21197ec809262bbbff0d8a6dadf0cfc88e53114f67408401bfa7b7d000f1" + "sha256": "sha256:66984ee6fa589f916b5c0b8ecdbeaaa7ae16740ad28c34d87c97312ea4de3080" }, { "path": "seed/canonical/shapes/seed.shacl.ttl", @@ -90,15 +98,23 @@ }, { "path": "seed/canonical/formal/SeedResolution.tla", - "sha256": "sha256:29195d271e799f407f12f33be1e0fc2f17484b69d17fbd73dc6dbdd6b691ec86" + "sha256": "sha256:89ae6f8500cedefdb2e4cc1a3939d074b1ccd480766384977115a7bd70290afe" }, { "path": "seed/canonical/formal/SeedResolutionProofs.tla", - "sha256": "sha256:eba6d8668cb0195b0c3444e878c851649b8e24c2995677c37a606f6882511095" + "sha256": "sha256:078e123f28fbf012179484c8b559bbc55a6d24200e0b3ecc2b7ba9deeeefcbe3" + }, + { + "path": "seed/canonical/formal/SeedCanonProjection.tla", + "sha256": "sha256:696036279144ade00fcc83d59902a2bc4c93b0c16ba81d53606b271501922280" + }, + { + "path": "seed/canonical/formal/SeedCanonRefinementProofs.tla", + "sha256": "sha256:869c32d6ddcbd82f107c5093c73ec4d4962dde0e9ce533deb0530d911b70d385" }, { "path": "seed/canonical/formal/SeedResolution.cfg", - "sha256": "sha256:b231f71993c4a03770bce172f2e3ab1cef944adf8c087086c79818513c7d7b76" + "sha256": "sha256:45b03f914a6b81389fd41afe22b414486047437fe2e8b98617da5bc92c0e9b94" }, { "path": "seed/canonical/migration/ALPHA2_TO_0.3_ALPHA1_CHANGE_DECLARATION.json", @@ -110,7 +126,11 @@ }, { "path": "seed/canonical/decisions/ADR-006-complete-invariant-closure.md", - "sha256": "sha256:3201c5d00f86f83e8ea829dae62fc2bb9a965db84da5c99a50615707b0bad9e9" + "sha256": "sha256:e7f91577c81b6659bb6129e31ffe6b37a78bd05ca53c985511df4c9faaec1128" + }, + { + "path": "seed/canonical/decisions/ADR-007-reconsideration-commitments-and-bounded-retention.md", + "sha256": "sha256:ed0fd693b305cbf93dae3533a348de837e4462bb57e204134a49d2b2c19bb457" }, { "path": "seed/canonical/protocol/schemas/common.schema.json", @@ -130,7 +150,7 @@ }, { "path": "seed/canonical/protocol/schemas/resolution-request.schema.json", - "sha256": "sha256:b2f50024b439cacb5cea8f3f38f8f150dd797a1511b961c7e9a23bd666d10662" + "sha256": "sha256:503473e6c492dac110f06fb5b9b1472341b7e3ccabef8949288fbad93c81fdda" }, { "path": "seed/canonical/protocol/schemas/resolution-record.schema.json", @@ -158,107 +178,107 @@ }, { "path": "seed/canonical/protocol/schemas/conformance-case.schema.json", - "sha256": "sha256:3992493600276b2f8117b3f8541c26555cf422f117e1e90f7ceb1977e1294983" + "sha256": "sha256:622cd3eb866b7fbfc2cc2f494b66e831cf8713a329ee89f73ed0f5f062a0343a" }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-001.json", - "sha256": "sha256:69b42c72acce747e3094c6ff9eca2d13e8e2d0fda1b63c9587dd9ce7d16d7fc4" + "sha256": "sha256:3352af05c6a51a02aef9c94639fe43903c22969f3d9a8e2836f23fce065507a7" }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-002.json", - "sha256": "sha256:8b1c7052db75a56c7abcf21a2822ca245878896f6f3f912920b41ff0959a9e1b" + "sha256": "sha256:ee69ab8301eea93cf52ab45114e56922f620e8aad8d4f621bbc98b6cf040cfa9" }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-003.json", - "sha256": "sha256:2da32fb30992c6132ae1546b9ed0837ac76c70672ad89c929d4f24d229e51b77" + "sha256": "sha256:4318727895ac37e61933c6686e785351211acdda10dd9c6f19f6c69f37820eac" }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-004.json", - "sha256": "sha256:a4faf9c34999fefb8093421027214501581b79b2ae6ffc343139035c35ee287d" + "sha256": "sha256:22b06e4c5bfac480dfddbba7a52370b7fdf104da371fe65dc3e8a928fed9b02c" }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-005.json", - "sha256": "sha256:be334721fa8539ff0c49c91aef264a9572ce0f9d69cdf53e7520c1e960972f46" + "sha256": "sha256:15e6d3059b4d769eabb5a166d350509b23ec359856eb4c0bae2c9f975377af07" }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-006.json", - "sha256": "sha256:c7aab9eecb2c6be1458c6fb992661b4ba78983cb7ba4e89f5d1159bda15ee04b" + "sha256": "sha256:4fcce1e7ebf701e5e994606320cb86a0129193154a33ee63792ee669419fbfec" }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-007.json", - "sha256": "sha256:27c1299c07a798b79d0de15036018f32996702fba156e0a73dad11606e31297e" + "sha256": "sha256:e95d67c12b028b328c538fb83cf00a01946734acc5048fd1035f3c2eeb9f8ff2" }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-008.json", - "sha256": "sha256:87351ee1cc22f2231bc9d9c1628bf5f54af34285f7fb6f67b4bced3e8bfd6e26" + "sha256": "sha256:783d86ab36bbcb1bdbad0d16c0481ea448d46c67b3501e1a76abfc828e7dde2f" }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-009.json", - "sha256": "sha256:61c50a87bd3e402de908d3231c469969a82412e1723e1f9eeeb58465d545feeb" + "sha256": "sha256:2ff892ee2e91c8d5c117a0990157f326d602876cda637f9a34eda454fee41b9f" }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-010.json", - "sha256": "sha256:538ad9f9aae5ab6f1e0b0d0635bb56e8db929bbad2fbb39642658257be56657f" + "sha256": "sha256:184aaf7b609ab4ab6947b2b1df68bde7facacd7b0b5452973a73f7e998d3f8a2" }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-011.json", - "sha256": "sha256:76eacf88aa6bd4b7430d16a0b6abd83306f0cafe1bdb1878ac2d604dcaa5e993" + "sha256": "sha256:675d861e51f13df1c5ec10ad6ddc4909c827f7e893fb3485471023130175f123" }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-012.json", - "sha256": "sha256:783c7f76d2eb4cb02af1f077fa77ae22108cda0e92220fd40745cd18931510b2" + "sha256": "sha256:9c16ba5f4d95d959f1f4419fb2b646202204448fde49ac2669e0a5839c7a10a8" }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-013.json", - "sha256": "sha256:e6dc8c007e837a9ac2c0af50c87f8b5e2ae59a53afb7e99bbf570172b9b73d2e" + "sha256": "sha256:f36aa4d3809a20c9842eac49c7aed6b31a916a8c089d376e83b0c29023863604" }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-014.json", - "sha256": "sha256:64355c1f3addd2dcbca60cdd4d7e1a3e7eb2d5e3eded9ca8ab7a75cdcdf7e068" + "sha256": "sha256:822f9b125bdb8ebbd50288b7360108c9657791caca7638a3d25ee4d095b249ee" }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-015.json", - "sha256": "sha256:8b73adb652f0962663ea7a7a86467037919fad636ab138c33886bfb3bce03a06" + "sha256": "sha256:49990c7ca0564af284139ad4ce276ecd33d7f3d05a4f3094449ea87e93825809" }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-016.json", - "sha256": "sha256:3db680a11ad82baa915ee0673dab19f1314b6c841a4cf72b5ea6997872168598" + "sha256": "sha256:90741b3701cd8e9ec043e978ba1f7bbb22b349ef04f425605f019bf599774311" }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-001.json", - "sha256": "sha256:629c8ec5d5c8754accc3bfb8371be70517cd22eff6df77b05f80b924d504db0c" + "sha256": "sha256:60585b00221d867f21ea98fe198b4d35f2acdf56118de3ab7403a8a6c3c1b9c7" }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-002.json", - "sha256": "sha256:d9e91bbbc7f4107a876f748951ba8bf6d54bdec7fc07d3c337865acc581748f8" + "sha256": "sha256:06e6f20764094764047c1b68404b30b135505214003082d52c2896d4d82c2f5c" }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-003.json", - "sha256": "sha256:2beb58bb1a248feae6ae4e58c3e79090d9968619eee02bfcc9d964e62daee472" + "sha256": "sha256:92f21b9d2efe2ecc2e3c11ec72f1969ebd78d48b91b39c1f2aa096c475766cfa" }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-004.json", - "sha256": "sha256:382fd819df34e3a07813d2bfb242699a0ac8ba3ca4237574640940c58aacba70" + "sha256": "sha256:a687f38d83674d2d3a92372be3048860463da19542ca74b2024d61d8361e9ffc" }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-005.json", - "sha256": "sha256:0a7bd554fc68db99cba30dfe8dd8573f176b573a4c30c5bc79820255c1f64171" + "sha256": "sha256:9459583800f64781bcda6e638200a6cb128a7a20aa8d177720966ac70e1d7308" }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-006.json", - "sha256": "sha256:1a77e9fb1ded33823854070104eb93e4cfdf57137bf544ece8dc9854b5c18429" + "sha256": "sha256:fded1536ea25f1c32d63907703bc9bccc46e3a74d5205a1ddf86991d2078c7f3" }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-007.json", - "sha256": "sha256:a5aa8a79fef5a07ccf35b1d296e421f801de66d4d74b57b82f96702ccc5208dd" + "sha256": "sha256:a309d632b1cd18b986cbe0a2442687fd111158eab72d689b0e266fb7d862d92a" }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-008.json", - "sha256": "sha256:866012e9620f528a28e41ab9372c63c2c27eba30a1badacf3eccbaaae271a334" + "sha256": "sha256:b227d0736e9344953a03afa436427bff54a52c6c58089375e16e154baf6fbcd9" } ], "implementation_precedence": "NONE", "normative_source": "seed/canonical/source/seed-model.json", - "package_digest": "sha256:3ac093adb4575eb7202ac25abcdb128ad90913279b7a897e48877b8548c055d8", + "package_digest": "sha256:1cdd37e997626a15471b6125dfccf22895b4b104a7239b5c4ced8679165a07f8", "schema_version": 2 } diff --git a/seed/canonical/README.md b/seed/canonical/README.md index 1772610..c94be9e 100644 --- a/seed/canonical/README.md +++ b/seed/canonical/README.md @@ -11,10 +11,12 @@ an explicit terminal prohibition. Both are fail-closed. Seed normatively defines exact binding, local Authority roots, attenuating Authority proof, terminal uniqueness, immutable content-addressed records and -fresh reconsideration identifiers. +fresh reconsideration identifiers and recognized immutable predecessor commitments. -Policy evaluation, evidence acquisition, workflow, federation, persistence -and enforcement are extension or implementation concerns. +Policy evaluation, evidence acquisition, workflow, federation, persistence, +retention/compaction and concrete terminal-commitment accumulation are extension +or implementation concerns. Seed does not require predecessor requests or records +to remain physically retained after recognition evidence has been preserved. ## Assurance closure @@ -29,17 +31,25 @@ The published safety contract has complete machine traceability: - 24 portable conformance cases; - 13 semantic mutations, all required to be killed. -The unbounded proof applies to the committed abstract TLA+ safety projection. -It establishes all eleven registered state invariants and all four registered -temporal safety properties for every behaviour of `Spec`. +The unbounded safety proof applies to the committed abstract TLA+ safety +projection. It establishes all eleven registered state invariants and all four +registered temporal safety properties for every behaviour of `Spec`. -It does not establish: +The canon-to-TLA assurance adds a second proof layer. +`SeedCanonProjection.tla` is generated deterministically from the exact +`seed-model.json` identity under a versioned projection profile, and TLAPS +proves behavioral equivalence between that generated projection and +`SeedResolution.tla`. -- refinement from the normative machine-readable canon; +That relation is explicitly scoped. It does not establish: + +- equivalence of every natural-language sentence; +- concrete Binding or digest construction; - correctness or refinement of implementations; -- concrete grant-chain construction; +- concrete Authority grant-chain construction; - liveness; - cryptographic primitive security; +- concrete terminal-commitment accumulator or witness correctness; - external certification. The normative source remains diff --git a/seed/canonical/assurance/canon-tla-refinement.json b/seed/canonical/assurance/canon-tla-refinement.json new file mode 100644 index 0000000..ae6725b --- /dev/null +++ b/seed/canonical/assurance/canon-tla-refinement.json @@ -0,0 +1,198 @@ +{ + "abstractions": [ + { + "description": "Bindings are modeled as opaque exact identities; context/state/question/policy/scope digest construction is not re-derived in TLA+.", + "id": "OPAQUE_BINDING" + }, + { + "description": "authorityProofBindings abstracts exact grant-chain construction, acyclicity, attenuation and cryptographic verification.", + "id": "AUTHORITY_PROOF_ORACLE" + }, + { + "description": "RecognizedTerminalCommitments abstracts validation that a previous_terminal_record_digest commits to a previously recognized terminal ResolutionRecord. Recognition may be backed by retained material or externally validated authenticated-set/accumulator proof material; predecessor object retention is not required.", + "id": "TERMINAL_COMMITMENT_ORACLE" + }, + { + "description": "Conflict, invalid-material and non-authoritative-input observations are modeled as environment bookkeeping actions outside the three canonical command kinds.", + "id": "ENVIRONMENT_OBSERVATION" + } + ], + "claim_boundary": "The proof establishes behavioral equivalence between SeedResolution.tla and a deterministic TLA+ projection generated from the exact machine-readable Seed model under ASET-SEED-CANON-TLA-PROJECTION-V2. It is not a proof that every natural-language sentence, cryptographic construction, opaque binding representation, concrete Authority-proof implementation, terminal-commitment provenance mechanism, storage compaction, or implementation refinement is fully verified by the TLA+ model. The deterministic projection generator is part of the assurance trusted computing base; this proof does not itself verify the generator implementation.", + "document_type": "aset-canon-tla-refinement", + "excluded_claims": [ + "natural-language-text equivalence", + "cryptographic digest correctness", + "concrete Authority grant-chain construction", + "implementation refinement", + "liveness", + "formal proof of projection-generator correctness", + "terminal-commitment provenance verification", + "storage pruning/compaction refinement" + ], + "generated_projection": { + "generator": "tools/generate_canon_tla_projection.py", + "module": "SeedCanonProjection", + "path": "seed/canonical/formal/SeedCanonProjection.tla", + "profile": "ASET-SEED-CANON-TLA-PROJECTION-V2" + }, + "invariant_coverage": [ + { + "id": "SEED-INV-001", + "status": "PROVED_IN_DECLARED_PROJECTION" + }, + { + "id": "SEED-INV-002", + "status": "PROVED_IN_DECLARED_PROJECTION" + }, + { + "id": "SEED-INV-003", + "status": "PROVED_IN_DECLARED_PROJECTION" + }, + { + "id": "SEED-INV-004", + "status": "PARTIAL_OPAQUE_BINDING" + }, + { + "id": "SEED-INV-005", + "status": "PARTIAL_AUTHORITY_ABSTRACTION" + }, + { + "id": "SEED-INV-006", + "status": "ABSTRACTED_AUTHORITY_PROOF" + }, + { + "id": "SEED-INV-007", + "status": "PROVED_IN_DECLARED_PROJECTION" + }, + { + "id": "SEED-INV-008", + "status": "PROVED_IN_DECLARED_PROJECTION" + }, + { + "id": "SEED-INV-009", + "status": "PROVED_IN_DECLARED_PROJECTION" + }, + { + "id": "SEED-INV-010", + "status": "PARTIAL_NO_CONTENT_ADDRESS_PROOF" + }, + { + "id": "SEED-INV-011", + "status": "PROVED_IN_DECLARED_PROJECTION" + }, + { + "id": "SEED-INV-012", + "status": "PARTIAL_TERMINAL_COMMITMENT_ABSTRACTION" + } + ], + "proof": { + "final_theorem": "SeedResolutionBehaviorallyEquivalentToCanonProjection", + "module": "seed/canonical/formal/SeedCanonRefinementProofs.tla", + "verification_method": "ASET-VERIFY-CANON-TLA-REFINEMENT" + }, + "relation_type": "GENERATED_PROJECTION_WITH_BEHAVIORAL_EQUIVALENCE_PROOF", + "requirement_coverage": [ + { + "id": "ASET-SEED-REQ-001", + "predicate": "binding_exact", + "status": "PARTIAL_OPAQUE_BINDING" + }, + { + "id": "ASET-SEED-REQ-002", + "predicate": "request_fresh", + "status": "PROVED_IN_DECLARED_PROJECTION" + }, + { + "id": "ASET-SEED-REQ-003", + "predicate": "resolution_domain", + "status": "PROVED_IN_DECLARED_PROJECTION" + }, + { + "id": "ASET-SEED-REQ-004", + "predicate": "allow_only", + "status": "PROVED_IN_DECLARED_PROJECTION" + }, + { + "id": "ASET-SEED-REQ-005", + "predicate": "fail_closed", + "status": "PROVED_IN_DECLARED_PROJECTION" + }, + { + "id": "ASET-SEED-REQ-006", + "predicate": "local_authority", + "status": "PARTIAL_AUTHORITY_ABSTRACTION" + }, + { + "id": "ASET-SEED-REQ-007", + "predicate": "proof_attenuating", + "status": "ABSTRACTED_AUTHORITY_PROOF" + }, + { + "id": "ASET-SEED-REQ-008", + "predicate": "inputs_non_authoritative", + "status": "PROVED_IN_DECLARED_PROJECTION" + }, + { + "id": "ASET-SEED-REQ-009", + "predicate": "terminal_unique", + "status": "PROVED_IN_DECLARED_PROJECTION" + }, + { + "id": "ASET-SEED-REQ-010", + "predicate": "record_immutable", + "status": "PARTIAL_NO_CONTENT_ADDRESS_PROOF" + }, + { + "id": "ASET-SEED-REQ-011", + "predicate": "reconsider_fresh", + "status": "PARTIAL_TERMINAL_COMMITMENT_ABSTRACTION" + }, + { + "id": "ASET-SEED-REQ-012", + "predicate": "implementation_neutral", + "status": "META_OUTSIDE_BEHAVIORAL_MODEL" + } + ], + "resolution_algebra_fields": [ + "values", + "derived", + "stored_terminal", + "effect_permitted_if", + "fail_closed_values", + "conflict_result", + "unknown_semantics" + ], + "schema_version": 1, + "scope": "DECLARED_CANONICAL_SAFETY_PROJECTION", + "source_model": { + "model_id": "ASET-SEED-RESOLUTION-CANON-0.3-ALPHA1", + "path": "seed/canonical/source/seed-model.json", + "sha256": "sha256:b5e68692317600fd2833474a1f9c31f09e44d37ae92ec14573b416076c5dd7f6", + "version": "0.3.0-alpha.1" + }, + "target_model": { + "module": "SeedResolution", + "path": "seed/canonical/formal/SeedResolution.tla", + "sha256": "sha256:89ae6f8500cedefdb2e4cc1a3939d074b1ccd480766384977115a7bd70290afe" + }, + "transition_coverage": [ + { + "id": "SEED-TX-001", + "kind": "REGISTER_REQUEST", + "status": "PROVED_IN_DECLARED_PROJECTION", + "tla_action": "RegisterRequest" + }, + { + "id": "SEED-TX-002", + "kind": "SUBMIT_RESOLUTION", + "status": "PROVED_IN_DECLARED_PROJECTION", + "tla_action": "SubmitResolution" + }, + { + "id": "SEED-TX-003", + "kind": "EVALUATE_RESOLUTION", + "status": "PROVED_IN_DECLARED_PROJECTION", + "tla_action": "Evaluate" + } + ] +} diff --git a/seed/canonical/assurance/invariant-coverage.json b/seed/canonical/assurance/invariant-coverage.json index c70218d..b95238f 100644 --- a/seed/canonical/assurance/invariant-coverage.json +++ b/seed/canonical/assurance/invariant-coverage.json @@ -5,15 +5,16 @@ "all twelve canonical safety invariants have formal properties, conformance cases and semantic mutations", "all three canonical transitions have positive and negative conformance coverage", "bounded state and transition preservation for the published finite model", - "all fifteen registered TLA/TLC safety properties have unbounded TLAPS deductive closure over the abstract projection" + "all fifteen registered TLA/TLC safety properties have unbounded TLAPS deductive closure over the abstract projection", + "source-locked generated canonical projection with TLAPS-proved behavioral equivalence to SeedResolution.tla under the declared abstraction profile" ], "not_claimed": [ "cryptographic primitive security", "correctness of every implementation", "liveness or workflow completion", "external certification", - "machine-canon-to-TLA refinement proof", - "implementation refinement proof" + "implementation refinement proof", + "full natural-language, concrete binding/digest and concrete Authority-proof refinement beyond the declared projection" ] }, "coverage_policy": { diff --git a/seed/canonical/assurance/limitations.json b/seed/canonical/assurance/limitations.json index 0a88e1b..787bfa1 100644 --- a/seed/canonical/assurance/limitations.json +++ b/seed/canonical/assurance/limitations.json @@ -44,11 +44,18 @@ "status": "BREAKING_CHANGE_DECLARED" }, { - "closure_criteria": "Publish independently reviewed refinement proofs for the machine canon and selected implementation profiles, and add separate liveness or cryptographic proofs where those claims are made.", - "description": "The TLAPS result proves the current abstract TLA+ safety projection. It does not prove refinement from the machine-readable canon, correctness of implementations, liveness, cryptographic primitive security or concrete grant-chain construction.", + "closure_criteria": "Add separate proofs only for concrete binding/digest construction, concrete Authority grant chains, selected terminal-commitment accumulator profiles, selected implementation profiles, liveness or cryptography where those stronger claims are required.", + "description": "The generated canonical TLA+ projection is source-locked and behaviorally equivalent to SeedResolution.tla under the declared abstraction profile. Full refinement of natural-language semantics, concrete binding/digest construction, concrete Authority grant chains, concrete terminal-commitment accumulator/witness verification, implementations, liveness and cryptographic primitive security is not proved.", "id": "LIMIT-007", - "scope": "refinement-liveness-and-cryptography", + "scope": "remaining-refinement-liveness-and-cryptography", "status": "OPEN_ACCEPTED" + }, + { + "closure_criteria": "Keep the projection parity, source/target digest checks and pinned TLAPS behavioral-equivalence gate passing for the exact committed identities.", + "description": "The exact machine-readable Seed model is source-locked to a deterministic generated TLA+ projection, and TLAPS proves behavioral equivalence between that declared projection and SeedResolution.tla.", + "id": "LIMIT-008", + "scope": "declared-canon-tla-projection-refinement", + "status": "CLOSED" } ], "schema_version": 4, diff --git a/seed/canonical/assurance/repository-release-gates.json b/seed/canonical/assurance/repository-release-gates.json index 41bf4a8..3ce7cb4 100644 --- a/seed/canonical/assurance/repository-release-gates.json +++ b/seed/canonical/assurance/repository-release-gates.json @@ -9,10 +9,11 @@ "physical-world truth", "deployment-specific key management", "external certification", - "machine-canon-to-TLA refinement proof", "implementation refinement proof", "liveness proof", - "cryptographic correctness proof" + "cryptographic correctness proof", + "full natural-language, cryptographic, opaque-binding and concrete Authority-proof refinement beyond the declared canonical projection", + "concrete terminal-commitment accumulator/witness correctness and profile-specific storage-bound proof" ], "included": [ "machine-readable minimal resolution-recognition kernel", @@ -27,7 +28,9 @@ "complete normative requirement and invariant coverage", "semantic mutation closure with zero surviving canonical mutants", "unbounded deductive safety closure of the abstract TLA+ Seed projection", - "stable machine-checkable traceability from canonical Seed invariants to abstract TLA+ operators and TLAPS theorems" + "stable machine-checkable traceability from canonical Seed invariants to abstract TLA+ operators and TLAPS theorems", + "source-locked generated canonical TLA+ projection with TLAPS-proved behavioral equivalence to SeedResolution.tla", + "predecessor-independent reconsideration through an abstract recognized terminal-record commitment boundary" ] }, "document_type": "aset-repository-release-gates", @@ -176,6 +179,18 @@ "id": "ASET-GATE-029", "mandatory": true, "name": "proof_traceability_integrity" + }, + { + "evidence": "python tools/check_canon_tla_refinement.py --output dist/canon-tla-refinement-check.json", + "id": "ASET-GATE-030", + "mandatory": true, + "name": "canon_tla_refinement_integrity" + }, + { + "evidence": "python tools/run_canon_tla_refinement.py --tlapm $TLAPM_BIN --output dist/canon-tla-refinement-proof.json", + "id": "ASET-GATE-031", + "mandatory": true, + "name": "canon_tla_behavioral_equivalence_proof" } ], "profile": "ASET_SEED_MINIMAL_STRONG_CORE_ALPHA1", diff --git a/seed/canonical/assurance/verification-registry.json b/seed/canonical/assurance/verification-registry.json index 20bb3da..f5a1d6c 100644 --- a/seed/canonical/assurance/verification-registry.json +++ b/seed/canonical/assurance/verification-registry.json @@ -1,5 +1,5 @@ { - "claim_boundary": "Registry membership proves complete machine traceability for the published minimal Seed safety contract. The committed abstract TLA+ projection has bounded TLC coverage and an unbounded TLAPS deductive proof of all eleven registered state invariants and four registered temporal safety properties. Exact digest and concrete grant-chain construction remain covered by executable-oracle and static-canon evidence. Machine-canon-to-TLA refinement, implementation refinement, liveness, cryptographic primitive security, implementation correctness and external certification are not claimed.", + "claim_boundary": "Registry membership proves complete machine traceability for the published minimal Seed safety contract. The committed abstract TLA+ projection has bounded TLC coverage and an unbounded TLAPS deductive proof of all eleven registered state invariants and four registered temporal safety properties. A source-locked generated canonical TLA+ projection is machine-checked against the exact seed-model.json identity, and TLAPS proves behavioral equivalence between that declared projection and SeedResolution.tla. Opaque Binding construction, concrete Authority grant-chain construction, cryptographic primitive security, implementation refinement, liveness, implementation correctness and external certification are not claimed.", "document_type": "aset-seed-verification-registry", "formal_properties": [ { @@ -326,6 +326,15 @@ ], "id": "ASET-VERIFY-TLAPS-UNBOUNDED", "kind": "UNBOUNDED_DEDUCTIVE_SAFETY_PROOF" + }, + { + "evidence": "python tools/run_canon_tla_refinement.py --tlapm $TLAPM_BIN --output dist/canon-tla-refinement-proof.json", + "gate_ids": [ + "ASET-GATE-030", + "ASET-GATE-031" + ], + "id": "ASET-VERIFY-CANON-TLA-REFINEMENT", + "kind": "DECLARED_CANONICAL_PROJECTION_BEHAVIORAL_EQUIVALENCE_PROOF" } ] } diff --git a/seed/canonical/conformance/cases/negative/RES-NEG-001.json b/seed/canonical/conformance/cases/negative/RES-NEG-001.json index 28d58a8..6ece6e6 100644 --- a/seed/canonical/conformance/cases/negative/RES-NEG-001.json +++ b/seed/canonical/conformance/cases/negative/RES-NEG-001.json @@ -14,7 +14,6 @@ "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", - "previous_resolution_id": null, "previous_terminal_record_digest": null, "request_digest": "sha256:0000000000000000000000000000000000000000000000000000000000000000", "resolution_id": "res.1" diff --git a/seed/canonical/conformance/cases/negative/RES-NEG-002.json b/seed/canonical/conformance/cases/negative/RES-NEG-002.json index 88b7806..9c6937c 100644 --- a/seed/canonical/conformance/cases/negative/RES-NEG-002.json +++ b/seed/canonical/conformance/cases/negative/RES-NEG-002.json @@ -14,9 +14,8 @@ "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", - "previous_resolution_id": null, "previous_terminal_record_digest": null, - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution_id": "res.1" } } @@ -64,9 +63,8 @@ "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", - "previous_resolution_id": null, "previous_terminal_record_digest": null, - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution_id": "res.1" } } diff --git a/seed/canonical/conformance/cases/negative/RES-NEG-003.json b/seed/canonical/conformance/cases/negative/RES-NEG-003.json index 9c856d0..a2d4a00 100644 --- a/seed/canonical/conformance/cases/negative/RES-NEG-003.json +++ b/seed/canonical/conformance/cases/negative/RES-NEG-003.json @@ -14,9 +14,8 @@ "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, "initial_authority_binding_digest": "sha256:8888888888888888888888888888888888888888888888888888888888888888", - "previous_resolution_id": null, "previous_terminal_record_digest": null, - "request_digest": "sha256:c65139b2c5276af5e32370c98a99946ee5f6f1f9a99cd3d7ea5a68339bb5e3c7", + "request_digest": "sha256:af5e16ad8048b82307864b7a592d58b34ec023a744b9227dcb3fc670ca51a213", "resolution_id": "res.bad.auth" } } diff --git a/seed/canonical/conformance/cases/negative/RES-NEG-004.json b/seed/canonical/conformance/cases/negative/RES-NEG-004.json index b094dd0..42677d3 100644 --- a/seed/canonical/conformance/cases/negative/RES-NEG-004.json +++ b/seed/canonical/conformance/cases/negative/RES-NEG-004.json @@ -14,9 +14,8 @@ "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, "initial_authority_binding_digest": "sha256:a59dcf9a37fe20a954493350b44a6f983ace899be77c5a4fc49476f4c95da254", - "previous_resolution_id": null, "previous_terminal_record_digest": null, - "request_digest": "sha256:a9a9bda6e83487d4db055b44963edc581c8a65cc27c7bb3c568fcfa13f5605b7", + "request_digest": "sha256:a32ea50cac3aadea4342b1aa36ede8a8fdb743633334bb56feeb7c3b732548c5", "resolution_id": "res.mismatch" } } diff --git a/seed/canonical/conformance/cases/negative/RES-NEG-005.json b/seed/canonical/conformance/cases/negative/RES-NEG-005.json index 04edc01..818ff60 100644 --- a/seed/canonical/conformance/cases/negative/RES-NEG-005.json +++ b/seed/canonical/conformance/cases/negative/RES-NEG-005.json @@ -10,7 +10,7 @@ ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", "record_digest": "sha256:0000000000000000000000000000000000000000000000000000000000000000", - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution": "ALLOW", "resolution_id": "res.1" } @@ -59,9 +59,8 @@ "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", - "previous_resolution_id": null, "previous_terminal_record_digest": null, - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution_id": "res.1" } } diff --git a/seed/canonical/conformance/cases/negative/RES-NEG-006.json b/seed/canonical/conformance/cases/negative/RES-NEG-006.json index 8c065a4..b4f8232 100644 --- a/seed/canonical/conformance/cases/negative/RES-NEG-006.json +++ b/seed/canonical/conformance/cases/negative/RES-NEG-006.json @@ -9,8 +9,8 @@ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:bed87a20469ae35fc516742005f4851f7be80855a08a9d6d265d82907f5d7fb1", - "record_digest": "sha256:4ff2ae212b9f236349c06123b9b9a6ff582fcef5d521dd5aec1d021f83f6108d", - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "record_digest": "sha256:2003cf6837a7708318faccef76b451e0ad30ed135c666b3e0c4633d9b3debfd5", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution": "ALLOW", "resolution_id": "res.1" } @@ -59,9 +59,8 @@ "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", - "previous_resolution_id": null, "previous_terminal_record_digest": null, - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution_id": "res.1" } } diff --git a/seed/canonical/conformance/cases/negative/RES-NEG-007.json b/seed/canonical/conformance/cases/negative/RES-NEG-007.json index c9aeb5b..3688f44 100644 --- a/seed/canonical/conformance/cases/negative/RES-NEG-007.json +++ b/seed/canonical/conformance/cases/negative/RES-NEG-007.json @@ -11,8 +11,8 @@ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:574b835d4024eee8a7263210a19892f1779661dcf298d9922cfcad7e877a26ce", - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "record_digest": "sha256:728f353c06d139bf5486fbe9dadf5dc33d3a20a0c1f3e254e2987a21ae46dac2", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution": "ALLOW", "resolution_id": "res.1" } @@ -61,9 +61,8 @@ "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", - "previous_resolution_id": null, "previous_terminal_record_digest": null, - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution_id": "res.1" } } diff --git a/seed/canonical/conformance/cases/negative/RES-NEG-008.json b/seed/canonical/conformance/cases/negative/RES-NEG-008.json index 60d12f8..99347e2 100644 --- a/seed/canonical/conformance/cases/negative/RES-NEG-008.json +++ b/seed/canonical/conformance/cases/negative/RES-NEG-008.json @@ -11,8 +11,8 @@ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:7fbb24c7887f496f75f171ad04f9158e939ba2e250fdc48be6a3910a419570ea", - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "record_digest": "sha256:b0b887903271a5f7698fede3a0000fd125a01319084b6682d19f7c3858278d6c", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution": "ALLOW", "resolution_id": "res.1" } @@ -70,9 +70,8 @@ "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", - "previous_resolution_id": null, "previous_terminal_record_digest": null, - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution_id": "res.1" } } diff --git a/seed/canonical/conformance/cases/negative/RES-NEG-009.json b/seed/canonical/conformance/cases/negative/RES-NEG-009.json index cf8298f..26d6d9e 100644 --- a/seed/canonical/conformance/cases/negative/RES-NEG-009.json +++ b/seed/canonical/conformance/cases/negative/RES-NEG-009.json @@ -12,8 +12,8 @@ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:1519ef18d5bc656f9e1bb23df82886f85d00881d61747460c6ef42e651108435", - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "record_digest": "sha256:1a6acf903a9eb000eba5798c1395222073ad03983f94e914098114546aa42961", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution": "ALLOW", "resolution_id": "res.1" } @@ -79,9 +79,8 @@ "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", - "previous_resolution_id": null, "previous_terminal_record_digest": null, - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution_id": "res.1" } } diff --git a/seed/canonical/conformance/cases/negative/RES-NEG-010.json b/seed/canonical/conformance/cases/negative/RES-NEG-010.json index 7d06be4..b923ff5 100644 --- a/seed/canonical/conformance/cases/negative/RES-NEG-010.json +++ b/seed/canonical/conformance/cases/negative/RES-NEG-010.json @@ -9,8 +9,8 @@ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:6b65b489e529bcb77d58554d2b041e93c8c74f7bc4fbc5a2f8de70b89738ef52", - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "record_digest": "sha256:16f9e0b7709be009f3b00039f2b8cecb68932bca18ce9ceca099f44a3b32c2f5", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution": "BLOCK", "resolution_id": "res.1" } @@ -59,9 +59,8 @@ "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", - "previous_resolution_id": null, "previous_terminal_record_digest": null, - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution_id": "res.1" } } @@ -76,8 +75,8 @@ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:8d661d7fb6d5a3dc37ba474e18015cab8e9aa75aaa525006451c0605252f097f", - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "record_digest": "sha256:036914e827dcd520081da16232f409942e0f768d343b44e03079f2f73f749ae8", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution": "ALLOW", "resolution_id": "res.1" } diff --git a/seed/canonical/conformance/cases/negative/RES-NEG-011.json b/seed/canonical/conformance/cases/negative/RES-NEG-011.json index dbc9edb..4a438c9 100644 --- a/seed/canonical/conformance/cases/negative/RES-NEG-011.json +++ b/seed/canonical/conformance/cases/negative/RES-NEG-011.json @@ -14,9 +14,8 @@ "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", - "previous_resolution_id": "res.1", - "previous_terminal_record_digest": "sha256:8d661d7fb6d5a3dc37ba474e18015cab8e9aa75aaa525006451c0605252f097f", - "request_digest": "sha256:690f089c2addd4567ac642ff042b4ffc0e564ba14c7db7f8b6929bc5bc7c3abb", + "previous_terminal_record_digest": "sha256:036914e827dcd520081da16232f409942e0f768d343b44e03079f2f73f749ae8", + "request_digest": "sha256:268c4e8eab85b442766afbdc541578cab06409426aea12736fb292200a732e08", "resolution_id": "res.1" } } @@ -64,9 +63,8 @@ "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", - "previous_resolution_id": null, "previous_terminal_record_digest": null, - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution_id": "res.1" } } @@ -81,8 +79,8 @@ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:8d661d7fb6d5a3dc37ba474e18015cab8e9aa75aaa525006451c0605252f097f", - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "record_digest": "sha256:036914e827dcd520081da16232f409942e0f768d343b44e03079f2f73f749ae8", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution": "ALLOW", "resolution_id": "res.1" } diff --git a/seed/canonical/conformance/cases/negative/RES-NEG-012.json b/seed/canonical/conformance/cases/negative/RES-NEG-012.json index 128db03..66f8e42 100644 --- a/seed/canonical/conformance/cases/negative/RES-NEG-012.json +++ b/seed/canonical/conformance/cases/negative/RES-NEG-012.json @@ -14,18 +14,17 @@ "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", - "previous_resolution_id": "res.1", "previous_terminal_record_digest": "sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff", - "request_digest": "sha256:fbb621af47286412fd4f5766a9d7d003c7f64b2424170a365411afb6ccf2b12d", + "request_digest": "sha256:d3f94d38c625b857cfaf9318e4565c21bf671b4e2cea83c3f1994b2ad4ec6e98", "resolution_id": "res.2" } } }, "case_id": "RES-NEG-012", - "description": "Reject reconsideration linked to a non-terminal previous request.", + "description": "Reject reconsideration whose terminal-record commitment is not recognized.", "expected": { "accepted": false, - "code": "PREVIOUS_RESOLUTION_NOT_TERMINAL", + "code": "PREVIOUS_TERMINAL_COMMITMENT_UNRECOGNIZED", "effect_permitted": false, "reason": "REQUEST_NOT_FOUND_OR_INVALID", "resolution": "UNKNOWN", @@ -48,28 +47,5 @@ "requests": [] }, "postconditions": [], - "setup": [ - { - "kind": "REGISTER_REQUEST", - "payload": { - "request": { - "binding": { - "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "context_id": "ctx.local", - "policy_epoch": 1, - "question_digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", - "scope": [ - "effect:publish" - ], - "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" - }, - "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", - "previous_resolution_id": null, - "previous_terminal_record_digest": null, - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", - "resolution_id": "res.1" - } - } - } - ] + "setup": [] } diff --git a/seed/canonical/conformance/cases/negative/RES-NEG-013.json b/seed/canonical/conformance/cases/negative/RES-NEG-013.json index 711946a..01df253 100644 --- a/seed/canonical/conformance/cases/negative/RES-NEG-013.json +++ b/seed/canonical/conformance/cases/negative/RES-NEG-013.json @@ -14,18 +14,17 @@ "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", - "previous_resolution_id": "res.1", "previous_terminal_record_digest": "sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff", - "request_digest": "sha256:fbb621af47286412fd4f5766a9d7d003c7f64b2424170a365411afb6ccf2b12d", + "request_digest": "sha256:d3f94d38c625b857cfaf9318e4565c21bf671b4e2cea83c3f1994b2ad4ec6e98", "resolution_id": "res.2" } } }, "case_id": "RES-NEG-013", - "description": "Reject reconsideration with the wrong previous terminal record digest.", + "description": "Reject reconsideration whose commitment does not match any recognized terminal-record commitment.", "expected": { "accepted": false, - "code": "PREVIOUS_TERMINAL_RECORD_MISMATCH", + "code": "PREVIOUS_TERMINAL_COMMITMENT_UNRECOGNIZED", "effect_permitted": false, "reason": "REQUEST_NOT_FOUND_OR_INVALID", "resolution": "UNKNOWN", @@ -47,46 +46,9 @@ "records": [], "requests": [] }, + "recognized_terminal_record_digests": [ + "sha256:036914e827dcd520081da16232f409942e0f768d343b44e03079f2f73f749ae8" + ], "postconditions": [], - "setup": [ - { - "kind": "REGISTER_REQUEST", - "payload": { - "request": { - "binding": { - "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "context_id": "ctx.local", - "policy_epoch": 1, - "question_digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", - "scope": [ - "effect:publish" - ], - "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" - }, - "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", - "previous_resolution_id": null, - "previous_terminal_record_digest": null, - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", - "resolution_id": "res.1" - } - } - }, - { - "kind": "SUBMIT_RESOLUTION", - "payload": { - "record": { - "authority_id": "authority.root", - "authority_proof_digests": [], - "basis_digests": [ - "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" - ], - "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:8d661d7fb6d5a3dc37ba474e18015cab8e9aa75aaa525006451c0605252f097f", - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", - "resolution": "ALLOW", - "resolution_id": "res.1" - } - } - } - ] + "setup": [] } diff --git a/seed/canonical/conformance/cases/negative/RES-NEG-014.json b/seed/canonical/conformance/cases/negative/RES-NEG-014.json index 1195bfa..62f4dda 100644 --- a/seed/canonical/conformance/cases/negative/RES-NEG-014.json +++ b/seed/canonical/conformance/cases/negative/RES-NEG-014.json @@ -36,8 +36,8 @@ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:058ed530330d7e2c6e12bb7f9169a16167b81ce452b647ac9a71c42799d6fcd4", - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "record_digest": "sha256:542798c17991ade141d5e38f4cd900a2776a9c522340a29622d7aa0a32d3134d", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution": "ALLOW", "resolution_id": "res.1" } @@ -55,9 +55,8 @@ "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", - "previous_resolution_id": null, "previous_terminal_record_digest": null, - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution_id": "res.1" } ] diff --git a/seed/canonical/conformance/cases/negative/RES-NEG-015.json b/seed/canonical/conformance/cases/negative/RES-NEG-015.json index 7b6ebe4..98f3e2a 100644 --- a/seed/canonical/conformance/cases/negative/RES-NEG-015.json +++ b/seed/canonical/conformance/cases/negative/RES-NEG-015.json @@ -36,8 +36,8 @@ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:8d661d7fb6d5a3dc37ba474e18015cab8e9aa75aaa525006451c0605252f097f", - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "record_digest": "sha256:036914e827dcd520081da16232f409942e0f768d343b44e03079f2f73f749ae8", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution": "ALLOW", "resolution_id": "res.1" }, @@ -48,8 +48,8 @@ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:6b65b489e529bcb77d58554d2b041e93c8c74f7bc4fbc5a2f8de70b89738ef52", - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "record_digest": "sha256:16f9e0b7709be009f3b00039f2b8cecb68932bca18ce9ceca099f44a3b32c2f5", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution": "BLOCK", "resolution_id": "res.1" } @@ -67,9 +67,8 @@ "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", - "previous_resolution_id": null, "previous_terminal_record_digest": null, - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution_id": "res.1" } ] diff --git a/seed/canonical/conformance/cases/negative/RES-NEG-016.json b/seed/canonical/conformance/cases/negative/RES-NEG-016.json index ec9419f..9e8ad20 100644 --- a/seed/canonical/conformance/cases/negative/RES-NEG-016.json +++ b/seed/canonical/conformance/cases/negative/RES-NEG-016.json @@ -12,8 +12,8 @@ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:f13129aebdc8aad38ae4cd4e416b760e1e5c8f7eac0822776461a87dfdb54a70", - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "record_digest": "sha256:1f2ba03c380a63d9a357490aa9fda948a719bf8106655804ca9d3e79432d299d", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution": "ALLOW", "resolution_id": "res.1" } @@ -79,9 +79,8 @@ "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", - "previous_resolution_id": null, "previous_terminal_record_digest": null, - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution_id": "res.1" } } diff --git a/seed/canonical/conformance/cases/positive/RES-POS-001.json b/seed/canonical/conformance/cases/positive/RES-POS-001.json index 36dcb74..b87ff13 100644 --- a/seed/canonical/conformance/cases/positive/RES-POS-001.json +++ b/seed/canonical/conformance/cases/positive/RES-POS-001.json @@ -14,9 +14,8 @@ "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", - "previous_resolution_id": null, "previous_terminal_record_digest": null, - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution_id": "res.1" } } diff --git a/seed/canonical/conformance/cases/positive/RES-POS-002.json b/seed/canonical/conformance/cases/positive/RES-POS-002.json index a4df721..837bf0b 100644 --- a/seed/canonical/conformance/cases/positive/RES-POS-002.json +++ b/seed/canonical/conformance/cases/positive/RES-POS-002.json @@ -9,8 +9,8 @@ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:8d661d7fb6d5a3dc37ba474e18015cab8e9aa75aaa525006451c0605252f097f", - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "record_digest": "sha256:036914e827dcd520081da16232f409942e0f768d343b44e03079f2f73f749ae8", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution": "ALLOW", "resolution_id": "res.1" } @@ -64,9 +64,8 @@ "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", - "previous_resolution_id": null, "previous_terminal_record_digest": null, - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution_id": "res.1" } } diff --git a/seed/canonical/conformance/cases/positive/RES-POS-003.json b/seed/canonical/conformance/cases/positive/RES-POS-003.json index 2cbeec4..b423300 100644 --- a/seed/canonical/conformance/cases/positive/RES-POS-003.json +++ b/seed/canonical/conformance/cases/positive/RES-POS-003.json @@ -9,8 +9,8 @@ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:6b65b489e529bcb77d58554d2b041e93c8c74f7bc4fbc5a2f8de70b89738ef52", - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "record_digest": "sha256:16f9e0b7709be009f3b00039f2b8cecb68932bca18ce9ceca099f44a3b32c2f5", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution": "BLOCK", "resolution_id": "res.1" } @@ -64,9 +64,8 @@ "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", - "previous_resolution_id": null, "previous_terminal_record_digest": null, - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution_id": "res.1" } } diff --git a/seed/canonical/conformance/cases/positive/RES-POS-004.json b/seed/canonical/conformance/cases/positive/RES-POS-004.json index 0a7be73..df1506a 100644 --- a/seed/canonical/conformance/cases/positive/RES-POS-004.json +++ b/seed/canonical/conformance/cases/positive/RES-POS-004.json @@ -11,8 +11,8 @@ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:bcaf84dfe47973832e22c2dec73d8f9717711cacea67e60e35f20e39c36d5f82", - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "record_digest": "sha256:0de2f1ecfe293f0823d3126396d1480d3e8d022cd7e3745691d3616b4c053a25", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution": "ALLOW", "resolution_id": "res.1" } @@ -75,9 +75,8 @@ "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", - "previous_resolution_id": null, "previous_terminal_record_digest": null, - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution_id": "res.1" } } diff --git a/seed/canonical/conformance/cases/positive/RES-POS-005.json b/seed/canonical/conformance/cases/positive/RES-POS-005.json index c85987b..6da7e02 100644 --- a/seed/canonical/conformance/cases/positive/RES-POS-005.json +++ b/seed/canonical/conformance/cases/positive/RES-POS-005.json @@ -12,8 +12,8 @@ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:a78695e21e6466d416e869df4d9a250b07ab0d26667816a0cb4e0cd4e8322c99", - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "record_digest": "sha256:d6ab5a2233834429d3007bb0e3595327f39433f00b603b61c20cef6e23616db1", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution": "ALLOW", "resolution_id": "res.1" } @@ -84,9 +84,8 @@ "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", - "previous_resolution_id": null, "previous_terminal_record_digest": null, - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution_id": "res.1" } } diff --git a/seed/canonical/conformance/cases/positive/RES-POS-006.json b/seed/canonical/conformance/cases/positive/RES-POS-006.json index 5ecda7e..2e82145 100644 --- a/seed/canonical/conformance/cases/positive/RES-POS-006.json +++ b/seed/canonical/conformance/cases/positive/RES-POS-006.json @@ -48,9 +48,8 @@ "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", - "previous_resolution_id": null, "previous_terminal_record_digest": null, - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution_id": "res.1" } } diff --git a/seed/canonical/conformance/cases/positive/RES-POS-007.json b/seed/canonical/conformance/cases/positive/RES-POS-007.json index a0d02a5..9d41dc3 100644 --- a/seed/canonical/conformance/cases/positive/RES-POS-007.json +++ b/seed/canonical/conformance/cases/positive/RES-POS-007.json @@ -9,8 +9,8 @@ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:8d661d7fb6d5a3dc37ba474e18015cab8e9aa75aaa525006451c0605252f097f", - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "record_digest": "sha256:036914e827dcd520081da16232f409942e0f768d343b44e03079f2f73f749ae8", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution": "ALLOW", "resolution_id": "res.1" } @@ -44,7 +44,7 @@ }, "postconditions": [ { - "equals": "sha256:8d661d7fb6d5a3dc37ba474e18015cab8e9aa75aaa525006451c0605252f097f", + "equals": "sha256:036914e827dcd520081da16232f409942e0f768d343b44e03079f2f73f749ae8", "path": "/records/0/record_digest" } ], @@ -64,9 +64,8 @@ "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", - "previous_resolution_id": null, "previous_terminal_record_digest": null, - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution_id": "res.1" } } @@ -81,8 +80,8 @@ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:8d661d7fb6d5a3dc37ba474e18015cab8e9aa75aaa525006451c0605252f097f", - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", + "record_digest": "sha256:036914e827dcd520081da16232f409942e0f768d343b44e03079f2f73f749ae8", + "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", "resolution": "ALLOW", "resolution_id": "res.1" } diff --git a/seed/canonical/conformance/cases/positive/RES-POS-008.json b/seed/canonical/conformance/cases/positive/RES-POS-008.json index 1e84acb..551f533 100644 --- a/seed/canonical/conformance/cases/positive/RES-POS-008.json +++ b/seed/canonical/conformance/cases/positive/RES-POS-008.json @@ -14,15 +14,14 @@ "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", - "previous_resolution_id": "res.1", - "previous_terminal_record_digest": "sha256:8d661d7fb6d5a3dc37ba474e18015cab8e9aa75aaa525006451c0605252f097f", - "request_digest": "sha256:7c203310c1452ad60f3b44afeb8ef231a7c90afc79ea08d117b25c39639a4604", + "previous_terminal_record_digest": "sha256:036914e827dcd520081da16232f409942e0f768d343b44e03079f2f73f749ae8", + "request_digest": "sha256:cc40394a0dffa9731c978aa946e9660af8b34f7059d2d76cfde3f7657ffbf310", "resolution_id": "res.2" } } }, "case_id": "RES-POS-008", - "description": "Register a fresh reconsideration request linked to the previous terminal record.", + "description": "Register reconsideration from a recognized terminal commitment after predecessor request/record material has been pruned.", "expected": { "accepted": true, "code": "REQUEST_REGISTERED", @@ -47,51 +46,14 @@ "records": [], "requests": [] }, + "recognized_terminal_record_digests": [ + "sha256:036914e827dcd520081da16232f409942e0f768d343b44e03079f2f73f749ae8" + ], "postconditions": [ { - "equals": "res.1", - "path": "/requests/1/previous_resolution_id" + "equals": "sha256:036914e827dcd520081da16232f409942e0f768d343b44e03079f2f73f749ae8", + "path": "/requests/0/previous_terminal_record_digest" } ], - "setup": [ - { - "kind": "REGISTER_REQUEST", - "payload": { - "request": { - "binding": { - "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "context_id": "ctx.local", - "policy_epoch": 1, - "question_digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", - "scope": [ - "effect:publish" - ], - "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" - }, - "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", - "previous_resolution_id": null, - "previous_terminal_record_digest": null, - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", - "resolution_id": "res.1" - } - } - }, - { - "kind": "SUBMIT_RESOLUTION", - "payload": { - "record": { - "authority_id": "authority.root", - "authority_proof_digests": [], - "basis_digests": [ - "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" - ], - "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:8d661d7fb6d5a3dc37ba474e18015cab8e9aa75aaa525006451c0605252f097f", - "request_digest": "sha256:fadf0b74f42e057ea9e55190acf5ac9a222f60688b8514fbaa4ea8826a47d564", - "resolution": "ALLOW", - "resolution_id": "res.1" - } - } - } - ] + "setup": [] } diff --git a/seed/canonical/conformance/conformance-profile.json b/seed/canonical/conformance/conformance-profile.json index 2805a19..4c233c8 100644 --- a/seed/canonical/conformance/conformance-profile.json +++ b/seed/canonical/conformance/conformance-profile.json @@ -13,7 +13,7 @@ }, "path": "seed/canonical/conformance/cases/negative/RES-NEG-001.json", "polarity": "negative", - "sha256": "sha256:69b42c72acce747e3094c6ff9eca2d13e8e2d0fda1b63c9587dd9ce7d16d7fc4" + "sha256": "sha256:3352af05c6a51a02aef9c94639fe43903c22969f3d9a8e2836f23fce065507a7" }, { "case_id": "RES-NEG-002", @@ -27,7 +27,7 @@ }, "path": "seed/canonical/conformance/cases/negative/RES-NEG-002.json", "polarity": "negative", - "sha256": "sha256:8b1c7052db75a56c7abcf21a2822ca245878896f6f3f912920b41ff0959a9e1b" + "sha256": "sha256:ee69ab8301eea93cf52ab45114e56922f620e8aad8d4f621bbc98b6cf040cfa9" }, { "case_id": "RES-NEG-003", @@ -41,7 +41,7 @@ }, "path": "seed/canonical/conformance/cases/negative/RES-NEG-003.json", "polarity": "negative", - "sha256": "sha256:2da32fb30992c6132ae1546b9ed0837ac76c70672ad89c929d4f24d229e51b77" + "sha256": "sha256:4318727895ac37e61933c6686e785351211acdda10dd9c6f19f6c69f37820eac" }, { "case_id": "RES-NEG-004", @@ -55,7 +55,7 @@ }, "path": "seed/canonical/conformance/cases/negative/RES-NEG-004.json", "polarity": "negative", - "sha256": "sha256:a4faf9c34999fefb8093421027214501581b79b2ae6ffc343139035c35ee287d" + "sha256": "sha256:22b06e4c5bfac480dfddbba7a52370b7fdf104da371fe65dc3e8a928fed9b02c" }, { "case_id": "RES-NEG-005", @@ -69,7 +69,7 @@ }, "path": "seed/canonical/conformance/cases/negative/RES-NEG-005.json", "polarity": "negative", - "sha256": "sha256:be334721fa8539ff0c49c91aef264a9572ce0f9d69cdf53e7520c1e960972f46" + "sha256": "sha256:15e6d3059b4d769eabb5a166d350509b23ec359856eb4c0bae2c9f975377af07" }, { "case_id": "RES-NEG-006", @@ -83,7 +83,7 @@ }, "path": "seed/canonical/conformance/cases/negative/RES-NEG-006.json", "polarity": "negative", - "sha256": "sha256:c7aab9eecb2c6be1458c6fb992661b4ba78983cb7ba4e89f5d1159bda15ee04b" + "sha256": "sha256:4fcce1e7ebf701e5e994606320cb86a0129193154a33ee63792ee669419fbfec" }, { "case_id": "RES-NEG-007", @@ -97,7 +97,7 @@ }, "path": "seed/canonical/conformance/cases/negative/RES-NEG-007.json", "polarity": "negative", - "sha256": "sha256:27c1299c07a798b79d0de15036018f32996702fba156e0a73dad11606e31297e" + "sha256": "sha256:e95d67c12b028b328c538fb83cf00a01946734acc5048fd1035f3c2eeb9f8ff2" }, { "case_id": "RES-NEG-008", @@ -111,7 +111,7 @@ }, "path": "seed/canonical/conformance/cases/negative/RES-NEG-008.json", "polarity": "negative", - "sha256": "sha256:87351ee1cc22f2231bc9d9c1628bf5f54af34285f7fb6f67b4bced3e8bfd6e26" + "sha256": "sha256:783d86ab36bbcb1bdbad0d16c0481ea448d46c67b3501e1a76abfc828e7dde2f" }, { "case_id": "RES-NEG-009", @@ -125,7 +125,7 @@ }, "path": "seed/canonical/conformance/cases/negative/RES-NEG-009.json", "polarity": "negative", - "sha256": "sha256:61c50a87bd3e402de908d3231c469969a82412e1723e1f9eeeb58465d545feeb" + "sha256": "sha256:2ff892ee2e91c8d5c117a0990157f326d602876cda637f9a34eda454fee41b9f" }, { "case_id": "RES-NEG-010", @@ -139,7 +139,7 @@ }, "path": "seed/canonical/conformance/cases/negative/RES-NEG-010.json", "polarity": "negative", - "sha256": "sha256:538ad9f9aae5ab6f1e0b0d0635bb56e8db929bbad2fbb39642658257be56657f" + "sha256": "sha256:184aaf7b609ab4ab6947b2b1df68bde7facacd7b0b5452973a73f7e998d3f8a2" }, { "case_id": "RES-NEG-011", @@ -153,13 +153,13 @@ }, "path": "seed/canonical/conformance/cases/negative/RES-NEG-011.json", "polarity": "negative", - "sha256": "sha256:76eacf88aa6bd4b7430d16a0b6abd83306f0cafe1bdb1878ac2d604dcaa5e993" + "sha256": "sha256:675d861e51f13df1c5ec10ad6ddc4909c827f7e893fb3485471023130175f123" }, { "case_id": "RES-NEG-012", "expected": { "accepted": false, - "code": "PREVIOUS_RESOLUTION_NOT_TERMINAL", + "code": "PREVIOUS_TERMINAL_COMMITMENT_UNRECOGNIZED", "effect_permitted": false, "reason": "REQUEST_NOT_FOUND_OR_INVALID", "resolution": "UNKNOWN", @@ -167,13 +167,13 @@ }, "path": "seed/canonical/conformance/cases/negative/RES-NEG-012.json", "polarity": "negative", - "sha256": "sha256:783c7f76d2eb4cb02af1f077fa77ae22108cda0e92220fd40745cd18931510b2" + "sha256": "sha256:9c16ba5f4d95d959f1f4419fb2b646202204448fde49ac2669e0a5839c7a10a8" }, { "case_id": "RES-NEG-013", "expected": { "accepted": false, - "code": "PREVIOUS_TERMINAL_RECORD_MISMATCH", + "code": "PREVIOUS_TERMINAL_COMMITMENT_UNRECOGNIZED", "effect_permitted": false, "reason": "REQUEST_NOT_FOUND_OR_INVALID", "resolution": "UNKNOWN", @@ -181,7 +181,7 @@ }, "path": "seed/canonical/conformance/cases/negative/RES-NEG-013.json", "polarity": "negative", - "sha256": "sha256:e6dc8c007e837a9ac2c0af50c87f8b5e2ae59a53afb7e99bbf570172b9b73d2e" + "sha256": "sha256:f36aa4d3809a20c9842eac49c7aed6b31a916a8c089d376e83b0c29023863604" }, { "case_id": "RES-NEG-014", @@ -195,7 +195,7 @@ }, "path": "seed/canonical/conformance/cases/negative/RES-NEG-014.json", "polarity": "negative", - "sha256": "sha256:64355c1f3addd2dcbca60cdd4d7e1a3e7eb2d5e3eded9ca8ab7a75cdcdf7e068" + "sha256": "sha256:822f9b125bdb8ebbd50288b7360108c9657791caca7638a3d25ee4d095b249ee" }, { "case_id": "RES-NEG-015", @@ -209,7 +209,7 @@ }, "path": "seed/canonical/conformance/cases/negative/RES-NEG-015.json", "polarity": "negative", - "sha256": "sha256:8b73adb652f0962663ea7a7a86467037919fad636ab138c33886bfb3bce03a06" + "sha256": "sha256:49990c7ca0564af284139ad4ce276ecd33d7f3d05a4f3094449ea87e93825809" }, { "case_id": "RES-NEG-016", @@ -223,7 +223,7 @@ }, "path": "seed/canonical/conformance/cases/negative/RES-NEG-016.json", "polarity": "negative", - "sha256": "sha256:3db680a11ad82baa915ee0673dab19f1314b6c841a4cf72b5ea6997872168598" + "sha256": "sha256:90741b3701cd8e9ec043e978ba1f7bbb22b349ef04f425605f019bf599774311" }, { "case_id": "RES-POS-001", @@ -237,7 +237,7 @@ }, "path": "seed/canonical/conformance/cases/positive/RES-POS-001.json", "polarity": "positive", - "sha256": "sha256:629c8ec5d5c8754accc3bfb8371be70517cd22eff6df77b05f80b924d504db0c" + "sha256": "sha256:60585b00221d867f21ea98fe198b4d35f2acdf56118de3ab7403a8a6c3c1b9c7" }, { "case_id": "RES-POS-002", @@ -251,7 +251,7 @@ }, "path": "seed/canonical/conformance/cases/positive/RES-POS-002.json", "polarity": "positive", - "sha256": "sha256:d9e91bbbc7f4107a876f748951ba8bf6d54bdec7fc07d3c337865acc581748f8" + "sha256": "sha256:06e6f20764094764047c1b68404b30b135505214003082d52c2896d4d82c2f5c" }, { "case_id": "RES-POS-003", @@ -265,7 +265,7 @@ }, "path": "seed/canonical/conformance/cases/positive/RES-POS-003.json", "polarity": "positive", - "sha256": "sha256:2beb58bb1a248feae6ae4e58c3e79090d9968619eee02bfcc9d964e62daee472" + "sha256": "sha256:92f21b9d2efe2ecc2e3c11ec72f1969ebd78d48b91b39c1f2aa096c475766cfa" }, { "case_id": "RES-POS-004", @@ -279,7 +279,7 @@ }, "path": "seed/canonical/conformance/cases/positive/RES-POS-004.json", "polarity": "positive", - "sha256": "sha256:382fd819df34e3a07813d2bfb242699a0ac8ba3ca4237574640940c58aacba70" + "sha256": "sha256:a687f38d83674d2d3a92372be3048860463da19542ca74b2024d61d8361e9ffc" }, { "case_id": "RES-POS-005", @@ -293,7 +293,7 @@ }, "path": "seed/canonical/conformance/cases/positive/RES-POS-005.json", "polarity": "positive", - "sha256": "sha256:0a7bd554fc68db99cba30dfe8dd8573f176b573a4c30c5bc79820255c1f64171" + "sha256": "sha256:9459583800f64781bcda6e638200a6cb128a7a20aa8d177720966ac70e1d7308" }, { "case_id": "RES-POS-006", @@ -307,7 +307,7 @@ }, "path": "seed/canonical/conformance/cases/positive/RES-POS-006.json", "polarity": "positive", - "sha256": "sha256:1a77e9fb1ded33823854070104eb93e4cfdf57137bf544ece8dc9854b5c18429" + "sha256": "sha256:fded1536ea25f1c32d63907703bc9bccc46e3a74d5205a1ddf86991d2078c7f3" }, { "case_id": "RES-POS-007", @@ -321,7 +321,7 @@ }, "path": "seed/canonical/conformance/cases/positive/RES-POS-007.json", "polarity": "positive", - "sha256": "sha256:a5aa8a79fef5a07ccf35b1d296e421f801de66d4d74b57b82f96702ccc5208dd" + "sha256": "sha256:a309d632b1cd18b986cbe0a2442687fd111158eab72d689b0e266fb7d862d92a" }, { "case_id": "RES-POS-008", @@ -335,7 +335,7 @@ }, "path": "seed/canonical/conformance/cases/positive/RES-POS-008.json", "polarity": "positive", - "sha256": "sha256:866012e9620f528a28e41ab9372c63c2c27eba30a1badacf3eccbaaae271a334" + "sha256": "sha256:b227d0736e9344953a03afa436427bff54a52c6c58089375e16e154baf6fbcd9" } ], "document_type": "aset-seed-resolution-conformance-profile", diff --git a/seed/canonical/decisions/ADR-006-complete-invariant-closure.md b/seed/canonical/decisions/ADR-006-complete-invariant-closure.md index a5c1cbb..677d5f4 100644 --- a/seed/canonical/decisions/ADR-006-complete-invariant-closure.md +++ b/seed/canonical/decisions/ADR-006-complete-invariant-closure.md @@ -53,6 +53,11 @@ At the time of this decision, this closed the published bounded safety contract. Subsequent assurance work added an unbounded TLAPS deductive safety proof for the committed abstract TLA+ projection. -That proof does not establish machine-canon-to-TLA refinement, implementation -refinement or correctness, concrete grant-chain construction, liveness, -cryptographic primitive security or external certification. +Subsequent assurance work also added a source-locked generated canonical TLA+ +projection and a TLAPS theorem establishing behavioral equivalence between that +declared projection and `SeedResolution.tla`. The relation is explicitly +bounded by opaque Binding and Authority-proof abstractions. It does not prove +natural-language equivalence, concrete Binding/digest construction, +implementation refinement or correctness, concrete Authority grant-chain +construction, liveness, cryptographic primitive security or external +certification. diff --git a/seed/canonical/decisions/ADR-007-reconsideration-commitments-and-bounded-retention.md b/seed/canonical/decisions/ADR-007-reconsideration-commitments-and-bounded-retention.md new file mode 100644 index 0000000..f5e8436 --- /dev/null +++ b/seed/canonical/decisions/ADR-007-reconsideration-commitments-and-bounded-retention.md @@ -0,0 +1,32 @@ +# ADR-007 — Reconsideration commitments and bounded retention + +## Decision + +ASET Seed does not require a reconsideration request to retain, dereference or replay the predecessor `ResolutionRequest` or `ResolutionRecord` as live canonical state. + +A reconsideration carries `previous_terminal_record_digest`, an immutable content-addressed commitment to a previously recognized terminal `ResolutionRecord`. Recognition is a verification-boundary fact: an implementation must establish that the commitment denotes a valid previously recognized terminal record, but Seed does not prescribe how the corresponding historical material is retained. + +The canonical Seed state therefore does not contain an ever-growing registry of all recognized terminal commitments. A valid terminal record still present in the current state may establish recognition directly. Historical recognition may instead be established by externally validated proof material. + +Implementations MAY realize historical recognition with a cryptographic accumulator. A recommended scalable profile is: + +1. retain a bounded hot buffer of at most `N` recent terminal commitments; +2. when the buffer reaches its profile-defined compaction threshold, fold the completed block into an authenticated accumulator; +3. retain only the accumulator state required by that profile plus the current hot buffer; +4. supply an external membership/update witness when a pruned commitment must be recognized later. + +Merkle trees, Merkle Mountain Ranges, hash-chain checkpoints, RSA/class-group accumulators, recursive proofs or future authenticated-set constructions are profile choices, not Seed semantics. + +## Important boundary + +A digest by itself is not proof of authenticity or prior recognition. A profile must bind accumulator membership to a terminal record whose Authority and exact binding were valid under Seed rules. Seed's abstract `RecognizedTerminalCommitments` boundary represents the result of that verification, not an assumption that every syntactically valid digest is recognized. + +A generic Merkle root alone is also not sufficient to guarantee both root-only incremental updates and future individual membership proofs. Concrete profiles must specify which frontier, update witness, membership witness or external history is retained. Consequently, `N + 1` digest-sized values is a possible profile bound only for constructions whose update/verification protocol supports that bound; it is not a universal Seed invariant. + +## Consequences + +- Pruning, archiving and compaction are not Seed transitions and do not mutate a terminal resolution fact. +- Old requests and records may be physically removed after the implementation has preserved whatever proof material its selected recognition profile requires. +- The active Seed semantic state need not grow with the complete historical request chain. +- Reconsideration freshness remains a semantic property of a new `resolution_id` plus a recognized immutable predecessor commitment. +- Concrete accumulator soundness, collision resistance, witness maintenance and storage bounds require separate profile-level assurance. diff --git a/seed/canonical/formal/README.md b/seed/canonical/formal/README.md index 2fa2f97..6cd6ba8 100644 --- a/seed/canonical/formal/README.md +++ b/seed/canonical/formal/README.md @@ -12,7 +12,7 @@ The model covers: - an abstract validated delegated-Authority predicate; - non-authoritative external inputs; - conflict and invalid-material handling; -- fresh reconsideration lineage; +- fresh reconsideration through recognized immutable terminal commitments without predecessor-object retention; - append-only requests and inputs; - immutable terminal records; - exclusion of invalid or unrecognized candidates from the Seed transition relation; @@ -39,15 +39,27 @@ a new normative Seed requirement. Detailed grant-chain construction, canonical digest computation and static implementation neutrality are checked by the executable oracle and canon validators. The formal model abstracts validated Authority evidence through -`authorityProofBindings`. +`authorityProofBindings` and validated historical terminal-commitment recognition +through `RecognizedTerminalCommitments`. Concrete accumulator construction, +membership/update witnesses and retention are profile-level concerns. -The proof does not establish: +`SeedCanonProjection.tla` is a deterministic generated interpretation of the +exact machine-readable Seed identity under +`ASET-SEED-CANON-TLA-PROJECTION-V2`. `SeedCanonRefinementProofs.tla` proves +behavioral equivalence between that generated projection and +`SeedResolution.tla`. Projection parity and source/target digests are mandatory +release checks. -- refinement from the normative machine-readable canon to the TLA+ model; +This canon-to-TLA relation preserves the declared abstractions. It does not +establish: + +- equivalence of every natural-language sentence; +- concrete Binding or digest construction; - refinement from the TLA+ model to an implementation; - correctness of any implementation; -- concrete grant-chain construction; +- concrete Authority grant-chain construction; - cryptographic primitive security; +- concrete terminal-commitment accumulator or witness correctness; - liveness. `UNKNOWN` may remain unresolved indefinitely. This is intentional fail-closed diff --git a/seed/canonical/formal/SeedCanonProjection.tla b/seed/canonical/formal/SeedCanonProjection.tla new file mode 100644 index 0000000..cad589a --- /dev/null +++ b/seed/canonical/formal/SeedCanonProjection.tla @@ -0,0 +1,152 @@ +---------------- MODULE SeedCanonProjection ---------------- +EXTENDS SeedResolution + +(* +GENERATED FILE. DO NOT EDIT. +Source: seed/canonical/source/seed-model.json +Source SHA-256: sha256:b5e68692317600fd2833474a1f9c31f09e44d37ae92ec14573b416076c5dd7f6 +Projection profile: ASET-SEED-CANON-TLA-PROJECTION-V2 + +This module is the deterministic TLA+ interpretation used by the +canon-to-TLA refinement assurance. It intentionally preserves the declared +opaque Binding, authorityProofBindings and RecognizedTerminalCommitments +abstractions. +*) + +CanonResolutions == {"UNKNOWN", "ALLOW", "BLOCK"} +CanonTerminalResolutions == {"ALLOW", "BLOCK"} +CanonDerivedResolution == "UNKNOWN" +CanonEffectPermittedValue == "ALLOW" +CanonFailClosedValues == {"UNKNOWN", "BLOCK"} +CanonConflictResult == "UNKNOWN" + +CanonInit == + /\ localAuthorityBindings \in SUBSET (Authorities \X Bindings) + /\ authorityProofBindings \in SUBSET (Authorities \X Bindings) + /\ localAuthorityBindings \subseteq authorityProofBindings + /\ requests = {} + /\ requestBinding = [r \in ResolutionIds |-> CHOOSE b \in Bindings : TRUE] + /\ requestAuthority = [r \in ResolutionIds |-> CHOOSE a \in Authorities : TRUE] + /\ previousResolutionCommitment = [r \in ResolutionIds |-> NoCommitment] + /\ terminalRecord = [r \in ResolutionIds |-> NoRecord] + /\ terminalBinding = [r \in ResolutionIds |-> CHOOSE b \in Bindings : TRUE] + /\ terminalAuthority = [r \in ResolutionIds |-> CHOOSE a \in Authorities : TRUE] + /\ conflicts = {} + /\ invalidMaterial = {} + /\ observedInputs = {} + +CanonRegisterRequest(r, b, a, previous) == + /\ r \in ResolutionIds \ requests + /\ b \in Bindings + /\ a \in Authorities + /\ <> \in localAuthorityBindings + /\ \/ previous = NoCommitment + \/ previous \in RecognizedTerminalCommitments + /\ requests' = requests \cup {r} + /\ requestBinding' = [requestBinding EXCEPT ![r] = b] + /\ requestAuthority' = [requestAuthority EXCEPT ![r] = a] + /\ previousResolutionCommitment' = [previousResolutionCommitment EXCEPT ![r] = previous] + /\ UNCHANGED <> + +CanonSubmitResolution(r, b, a, value) == + /\ r \in requests + /\ b = requestBinding[r] + /\ a \in Authorities + /\ <> \in authorityProofBindings + /\ value \in CanonTerminalResolutions + /\ terminalRecord[r] = NoRecord + /\ r \notin conflicts + /\ terminalRecord' = [terminalRecord EXCEPT ![r] = value] + /\ terminalBinding' = [terminalBinding EXCEPT ![r] = b] + /\ terminalAuthority' = [terminalAuthority EXCEPT ![r] = a] + /\ UNCHANGED <> + +CanonObserveConflict(r) == + /\ r \in ResolutionIds + /\ conflicts' = conflicts \cup {r} + /\ UNCHANGED <> + +CanonObserveInvalidMaterial(r) == + /\ r \in ResolutionIds + /\ invalidMaterial' = invalidMaterial \cup {r} + /\ UNCHANGED <> + +CanonObserveNonAuthoritativeInput(r) == + /\ r \in ResolutionIds + /\ observedInputs' = observedInputs \cup {r} + /\ UNCHANGED <> + +CanonEvaluate == UNCHANGED vars + +CanonRecognizedCanonicalTransition == + \/ \E r \in ResolutionIds, b \in Bindings, a \in Authorities, + previous \in TerminalCommitments \cup {NoCommitment} : + CanonRegisterRequest(r, b, a, previous) + \/ \E r \in ResolutionIds, b \in Bindings, a \in Authorities, + value \in CanonTerminalResolutions : + CanonSubmitResolution(r, b, a, value) + \/ \E r \in ResolutionIds : CanonObserveConflict(r) + \/ \E r \in ResolutionIds : CanonObserveInvalidMaterial(r) + \/ \E r \in ResolutionIds : CanonObserveNonAuthoritativeInput(r) + +CanonNext == + \/ CanonRecognizedCanonicalTransition + \/ CanonEvaluate + +CanonResolutionOf(r) == + IF r \notin requests \/ r \in conflicts + THEN CanonConflictResult + ELSE IF terminalRecord[r] = NoRecord + THEN CanonDerivedResolution + ELSE terminalRecord[r] + +CanonEffectPermitted(r) == + CanonResolutionOf(r) = CanonEffectPermittedValue + +CanonSpec == CanonInit /\ [][CanonNext]_vars +============================================================================= diff --git a/seed/canonical/formal/SeedCanonRefinementProofs.tla b/seed/canonical/formal/SeedCanonRefinementProofs.tla new file mode 100644 index 0000000..23ef8c9 --- /dev/null +++ b/seed/canonical/formal/SeedCanonRefinementProofs.tla @@ -0,0 +1,74 @@ +---------------------- MODULE SeedCanonRefinementProofs ---------------------- +EXTENDS SeedCanonProjection, TLAPS + +(* +This proof establishes equivalence between SeedResolution and the generated +canonical projection for ASET-SEED-CANON-TLA-PROJECTION-V2. + +The theorem is intentionally limited to the declared projection. Opaque +Bindings, authorityProofBindings and RecognizedTerminalCommitments remain +abstractions; cryptographic digest construction, concrete Authority grant-chain +construction, terminal-commitment provenance, storage-compaction refinement, +natural-language text equivalence, implementation refinement and liveness are +not proved here. +*) + +THEOREM CanonResolutionAlgebraEquivalent == + /\ Resolutions = CanonResolutions + /\ TerminalResolutions = CanonTerminalResolutions + /\ CanonDerivedResolution = "UNKNOWN" + /\ CanonEffectPermittedValue = "ALLOW" + /\ CanonFailClosedValues = {"UNKNOWN", "BLOCK"} + /\ CanonConflictResult = "UNKNOWN" +PROOF + BY DEF Resolutions, + TerminalResolutions, + CanonResolutions, + CanonTerminalResolutions, + CanonDerivedResolution, + CanonEffectPermittedValue, + CanonFailClosedValues, + CanonConflictResult + + +THEOREM CanonEvaluatorEquivalent == + \A r \in ResolutionIds : + /\ ResolutionOf(r) = CanonResolutionOf(r) + /\ EffectPermitted(r) = CanonEffectPermitted(r) +PROOF + BY DEF ResolutionOf, + CanonResolutionOf, + EffectPermitted, + CanonEffectPermitted, + CanonConflictResult, + CanonDerivedResolution, + CanonEffectPermittedValue + + +THEOREM SeedResolutionBehaviorallyEquivalentToCanonProjection == + Spec <=> CanonSpec +PROOF + BY DEF Spec, + CanonSpec, + Init, + CanonInit, + Next, + CanonNext, + RecognizedCanonicalTransition, + CanonRecognizedCanonicalTransition, + RegisterRequest, + CanonRegisterRequest, + SubmitResolution, + CanonSubmitResolution, + ObserveConflict, + CanonObserveConflict, + ObserveInvalidMaterial, + CanonObserveInvalidMaterial, + ObserveNonAuthoritativeInput, + CanonObserveNonAuthoritativeInput, + Evaluate, + CanonEvaluate, + TerminalResolutions, + CanonTerminalResolutions + +============================================================================= diff --git a/seed/canonical/formal/SeedResolution.cfg b/seed/canonical/formal/SeedResolution.cfg index 6cb9755..f79de44 100644 --- a/seed/canonical/formal/SeedResolution.cfg +++ b/seed/canonical/formal/SeedResolution.cfg @@ -2,7 +2,9 @@ CONSTANTS ResolutionIds = {r1, r2} Bindings = {b1, b2} Authorities = {a1, a2} - NoResolution = noResolution + TerminalCommitments = {c1, c2} + RecognizedTerminalCommitments = {c1, c2} + NoCommitment = noCommitment NoRecord = noRecord SPECIFICATION Spec diff --git a/seed/canonical/formal/SeedResolution.tla b/seed/canonical/formal/SeedResolution.tla index 0833225..6a8bb82 100644 --- a/seed/canonical/formal/SeedResolution.tla +++ b/seed/canonical/formal/SeedResolution.tla @@ -1,12 +1,14 @@ ------------------------------ MODULE SeedResolution ------------------------------ EXTENDS FiniteSets -CONSTANTS ResolutionIds, Bindings, Authorities, NoResolution, NoRecord +CONSTANTS ResolutionIds, Bindings, Authorities, TerminalCommitments, + RecognizedTerminalCommitments, NoCommitment, NoRecord ASSUME ResolutionIds # {} ASSUME Bindings # {} ASSUME Authorities # {} -ASSUME NoResolution \notin ResolutionIds +ASSUME RecognizedTerminalCommitments \subseteq TerminalCommitments +ASSUME NoCommitment \notin TerminalCommitments ASSUME NoRecord \notin {"ALLOW", "BLOCK"} Resolutions == {"UNKNOWN", "ALLOW", "BLOCK"} @@ -15,8 +17,9 @@ TerminalResolutions == {"ALLOW", "BLOCK"} (* The formal model is a bounded safety projection of the minimal Seed kernel. Authority-proof construction is abstracted as the static relation -`authorityProofBindings`; the executable oracle and conformance corpus validate -exact grant-chain, acyclicity and non-expansion details. +`authorityProofBindings`; recognized prior terminal-record commitments are +abstracted as `RecognizedTerminalCommitments`. The executable oracle and +conformance corpus validate the corresponding concrete evidence boundaries. *) VARIABLES localAuthorityBindings, @@ -24,7 +27,7 @@ VARIABLES requests, requestBinding, requestAuthority, - previousResolution, + previousResolutionCommitment, terminalRecord, terminalBinding, terminalAuthority, @@ -38,7 +41,7 @@ canonicalVars == requests, requestBinding, requestAuthority, - previousResolution, + previousResolutionCommitment, terminalRecord, terminalBinding, terminalAuthority, @@ -52,7 +55,7 @@ vars == requests, requestBinding, requestAuthority, - previousResolution, + previousResolutionCommitment, terminalRecord, terminalBinding, terminalAuthority, @@ -67,7 +70,7 @@ Init == /\ requests = {} /\ requestBinding = [r \in ResolutionIds |-> CHOOSE b \in Bindings : TRUE] /\ requestAuthority = [r \in ResolutionIds |-> CHOOSE a \in Authorities : TRUE] - /\ previousResolution = [r \in ResolutionIds |-> NoResolution] + /\ previousResolutionCommitment = [r \in ResolutionIds |-> NoCommitment] /\ terminalRecord = [r \in ResolutionIds |-> NoRecord] /\ terminalBinding = [r \in ResolutionIds |-> CHOOSE b \in Bindings : TRUE] /\ terminalAuthority = [r \in ResolutionIds |-> CHOOSE a \in Authorities : TRUE] @@ -80,15 +83,12 @@ RegisterRequest(r, b, a, previous) == /\ b \in Bindings /\ a \in Authorities /\ <> \in localAuthorityBindings - /\ \/ previous = NoResolution - \/ /\ previous \in requests - /\ previous # r - /\ terminalRecord[previous] \in TerminalResolutions - /\ previous \notin conflicts + /\ \/ previous = NoCommitment + \/ previous \in RecognizedTerminalCommitments /\ requests' = requests \cup {r} /\ requestBinding' = [requestBinding EXCEPT ![r] = b] /\ requestAuthority' = [requestAuthority EXCEPT ![r] = a] - /\ previousResolution' = [previousResolution EXCEPT ![r] = previous] + /\ previousResolutionCommitment' = [previousResolutionCommitment EXCEPT ![r] = previous] /\ UNCHANGED <> @@ -127,7 +127,7 @@ ObserveConflict(r) == requests, requestBinding, requestAuthority, - previousResolution, + previousResolutionCommitment, terminalRecord, terminalBinding, terminalAuthority, @@ -142,7 +142,7 @@ ObserveInvalidMaterial(r) == requests, requestBinding, requestAuthority, - previousResolution, + previousResolutionCommitment, terminalRecord, terminalBinding, terminalAuthority, @@ -157,7 +157,7 @@ ObserveNonAuthoritativeInput(r) == requests, requestBinding, requestAuthority, - previousResolution, + previousResolutionCommitment, terminalRecord, terminalBinding, terminalAuthority, @@ -168,7 +168,7 @@ Evaluate == UNCHANGED vars RecognizedCanonicalTransition == \/ \E r \in ResolutionIds, b \in Bindings, a \in Authorities, - previous \in ResolutionIds \cup {NoResolution} : + previous \in TerminalCommitments \cup {NoCommitment} : RegisterRequest(r, b, a, previous) \/ \E r \in ResolutionIds, b \in Bindings, a \in Authorities, value \in TerminalResolutions : @@ -197,7 +197,7 @@ TypeOK == /\ requests \subseteq ResolutionIds /\ requestBinding \in [ResolutionIds -> Bindings] /\ requestAuthority \in [ResolutionIds -> Authorities] - /\ previousResolution \in [ResolutionIds -> ResolutionIds \cup {NoResolution}] + /\ previousResolutionCommitment \in [ResolutionIds -> TerminalCommitments \cup {NoCommitment}] /\ terminalRecord \in [ResolutionIds -> TerminalResolutions \cup {NoRecord}] /\ terminalBinding \in [ResolutionIds -> Bindings] /\ terminalAuthority \in [ResolutionIds -> Authorities] @@ -251,10 +251,8 @@ InvalidOrConflictUnknown == FreshReconsideration == \A r \in requests : - \/ previousResolution[r] = NoResolution - \/ /\ previousResolution[r] \in requests - /\ previousResolution[r] # r - /\ terminalRecord[previousResolution[r]] \in TerminalResolutions + \/ previousResolutionCommitment[r] = NoCommitment + \/ previousResolutionCommitment[r] \in RecognizedTerminalCommitments RequestsAppendOnlyStep == requests \subseteq requests' diff --git a/seed/canonical/formal/SeedResolutionProofs.tla b/seed/canonical/formal/SeedResolutionProofs.tla index 7e0e1f1..87316b7 100644 --- a/seed/canonical/formal/SeedResolutionProofs.tla +++ b/seed/canonical/formal/SeedResolutionProofs.tla @@ -44,6 +44,16 @@ PROOF BY DEF ResolutionOf +THEOREM TerminalRecordDeterminesResolution == + \A r \in ResolutionIds : + (/\ r \in requests + /\ r \notin conflicts + /\ terminalRecord[r] # NoRecord) + => ResolutionOf(r) = terminalRecord[r] +PROOF + BY DEF ResolutionOf + + THEOREM AllowResolutionCharacterization == \A r \in ResolutionIds : EffectPermitted(r) <=> @@ -303,7 +313,7 @@ THEOREM RegisterRequestPreservesTypeOK == NEW r \in ResolutionIds, NEW b \in Bindings, NEW a \in Authorities, - NEW previous \in ResolutionIds \cup {NoResolution}, + NEW previous \in TerminalCommitments \cup {NoCommitment}, RegisterRequest(r, b, a, previous) PROVE TypeOK' PROOF @@ -315,7 +325,7 @@ THEOREM RegisterRequestPreservesTerminalRecordRequiresRequest == NEW r \in ResolutionIds, NEW b \in Bindings, NEW a \in Authorities, - NEW previous \in ResolutionIds \cup {NoResolution}, + NEW previous \in TerminalCommitments \cup {NoCommitment}, RegisterRequest(r, b, a, previous) PROVE TerminalRecordRequiresRequest' PROOF @@ -329,12 +339,12 @@ THEOREM RegisterRequestNewKeyValues == NEW r \in ResolutionIds, NEW b \in Bindings, NEW a \in Authorities, - NEW previous \in ResolutionIds \cup {NoResolution}, + NEW previous \in TerminalCommitments \cup {NoCommitment}, RegisterRequest(r, b, a, previous) PROVE /\ requestBinding'[r] = b /\ requestAuthority'[r] = a - /\ previousResolution'[r] = previous + /\ previousResolutionCommitment'[r] = previous PROOF BY DEF RegisterRequest, InductiveInvariant, TypeOK @@ -344,14 +354,14 @@ THEOREM RegisterRequestOldKeyValues == NEW r \in ResolutionIds, NEW b \in Bindings, NEW a \in Authorities, - NEW previous \in ResolutionIds \cup {NoResolution}, + NEW previous \in TerminalCommitments \cup {NoCommitment}, RegisterRequest(r, b, a, previous), NEW q \in requests, q # r PROVE /\ requestBinding'[q] = requestBinding[q] /\ requestAuthority'[q] = requestAuthority[q] - /\ previousResolution'[q] = previousResolution[q] + /\ previousResolutionCommitment'[q] = previousResolutionCommitment[q] PROOF BY DEF RegisterRequest, InductiveInvariant, TypeOK @@ -360,7 +370,7 @@ THEOREM RegisterRequestUnchangedValues == ASSUME NEW r \in ResolutionIds, NEW b \in Bindings, NEW a \in Authorities, - NEW previous \in ResolutionIds \cup {NoResolution}, + NEW previous \in TerminalCommitments \cup {NoCommitment}, RegisterRequest(r, b, a, previous) PROVE /\ localAuthorityBindings' = localAuthorityBindings @@ -376,7 +386,7 @@ THEOREM RegisterRequestSetFacts == ASSUME NEW r \in ResolutionIds, NEW b \in Bindings, NEW a \in Authorities, - NEW previous \in ResolutionIds \cup {NoResolution}, + NEW previous \in TerminalCommitments \cup {NoCommitment}, RegisterRequest(r, b, a, previous) PROVE /\ requests' = requests \cup {r} @@ -389,13 +399,11 @@ THEOREM RegisterRequestPreviousGuard == ASSUME NEW r \in ResolutionIds, NEW b \in Bindings, NEW a \in Authorities, - NEW previous \in ResolutionIds \cup {NoResolution}, + NEW previous \in TerminalCommitments \cup {NoCommitment}, RegisterRequest(r, b, a, previous) PROVE - \/ previous = NoResolution - \/ /\ previous \in requests - /\ previous # r - /\ terminalRecord[previous] \in TerminalResolutions + \/ previous = NoCommitment + \/ previous \in RecognizedTerminalCommitments PROOF BY DEF RegisterRequest @@ -405,7 +413,7 @@ THEOREM RegisterRequestPreservesExactBindingPointwise == NEW r \in ResolutionIds, NEW b \in Bindings, NEW a \in Authorities, - NEW previous \in ResolutionIds \cup {NoResolution}, + NEW previous \in TerminalCommitments \cup {NoCommitment}, RegisterRequest(r, b, a, previous), NEW q \in requests' PROVE @@ -455,7 +463,7 @@ THEOREM RegisterRequestPreservesExactBinding == NEW r \in ResolutionIds, NEW b \in Bindings, NEW a \in Authorities, - NEW previous \in ResolutionIds \cup {NoResolution}, + NEW previous \in TerminalCommitments \cup {NoCommitment}, RegisterRequest(r, b, a, previous) PROVE ExactBinding' PROOF @@ -468,7 +476,7 @@ THEOREM RegisterRequestPreservesLocalAuthorityRootPointwise == NEW r \in ResolutionIds, NEW b \in Bindings, NEW a \in Authorities, - NEW previous \in ResolutionIds \cup {NoResolution}, + NEW previous \in TerminalCommitments \cup {NoCommitment}, RegisterRequest(r, b, a, previous), NEW q \in requests' PROVE @@ -521,7 +529,7 @@ THEOREM RegisterRequestPreservesLocalAuthorityRoot == NEW r \in ResolutionIds, NEW b \in Bindings, NEW a \in Authorities, - NEW previous \in ResolutionIds \cup {NoResolution}, + NEW previous \in TerminalCommitments \cup {NoCommitment}, RegisterRequest(r, b, a, previous) PROVE LocalAuthorityRoot' PROOF @@ -534,7 +542,7 @@ THEOREM RegisterRequestPreservesDelegatedAuthorityPointwise == NEW r \in ResolutionIds, NEW b \in Bindings, NEW a \in Authorities, - NEW previous \in ResolutionIds \cup {NoResolution}, + NEW previous \in TerminalCommitments \cup {NoCommitment}, RegisterRequest(r, b, a, previous), NEW q \in requests' PROVE @@ -587,7 +595,7 @@ THEOREM RegisterRequestPreservesDelegatedAuthoritySound == NEW r \in ResolutionIds, NEW b \in Bindings, NEW a \in Authorities, - NEW previous \in ResolutionIds \cup {NoResolution}, + NEW previous \in TerminalCommitments \cup {NoCommitment}, RegisterRequest(r, b, a, previous) PROVE DelegatedAuthoritySound' PROOF @@ -613,35 +621,24 @@ THEOREM RegisterRequestPreservesFreshReconsiderationPointwise == NEW r \in ResolutionIds, NEW b \in Bindings, NEW a \in Authorities, - NEW previous \in ResolutionIds \cup {NoResolution}, + NEW previous \in TerminalCommitments \cup {NoCommitment}, RegisterRequest(r, b, a, previous), NEW q \in requests' PROVE - \/ previousResolution'[q] = NoResolution - \/ /\ previousResolution'[q] \in requests' - /\ previousResolution'[q] # q - /\ terminalRecord'[previousResolution'[q]] - \in TerminalResolutions + \/ previousResolutionCommitment'[q] = NoCommitment + \/ previousResolutionCommitment'[q] \in RecognizedTerminalCommitments PROOF <1>1. CASE q = r - <2>1. - /\ previousResolution'[q] = previous - /\ requests' = requests \cup {r} - /\ terminalRecord' = terminalRecord - BY <1>1, - RegisterRequestNewKeyValues, - RegisterRequestSetFacts, - RegisterRequestUnchangedValues + <2>1. previousResolutionCommitment'[q] = previous + BY <1>1, RegisterRequestNewKeyValues <2>2. - \/ previous = NoResolution - \/ /\ previous \in requests - /\ previous # r - /\ terminalRecord[previous] \in TerminalResolutions + \/ previous = NoCommitment + \/ previous \in RecognizedTerminalCommitments BY RegisterRequestPreviousGuard <2>3. QED - BY <1>1, <2>1, <2>2 + BY <2>1, <2>2 <1>2. CASE q # r <2>1. q \in requests @@ -649,22 +646,13 @@ PROOF DEF RegisterRequest <2>2. - \/ previousResolution[q] = NoResolution - \/ /\ previousResolution[q] \in requests - /\ previousResolution[q] # q - /\ terminalRecord[previousResolution[q]] - \in TerminalResolutions + \/ previousResolutionCommitment[q] = NoCommitment + \/ previousResolutionCommitment[q] \in RecognizedTerminalCommitments BY <2>1 DEF InductiveInvariant, FreshReconsideration - <2>3. - /\ previousResolution'[q] = previousResolution[q] - /\ requests \subseteq requests' - /\ terminalRecord' = terminalRecord - BY <1>2, <2>1, - RegisterRequestOldKeyValues, - RegisterRequestSetFacts, - RegisterRequestUnchangedValues + <2>3. previousResolutionCommitment'[q] = previousResolutionCommitment[q] + BY <1>2, <2>1, RegisterRequestOldKeyValues <2>4. QED BY <2>2, <2>3 @@ -678,7 +666,7 @@ THEOREM RegisterRequestPreservesFreshReconsideration == NEW r \in ResolutionIds, NEW b \in Bindings, NEW a \in Authorities, - NEW previous \in ResolutionIds \cup {NoResolution}, + NEW previous \in TerminalCommitments \cup {NoCommitment}, RegisterRequest(r, b, a, previous) PROVE FreshReconsideration' PROOF @@ -692,7 +680,7 @@ THEOREM RegisterRequestPreservesInductiveInvariant == NEW r \in ResolutionIds, NEW b \in Bindings, NEW a \in Authorities, - NEW previous \in ResolutionIds \cup {NoResolution}, + NEW previous \in TerminalCommitments \cup {NoCommitment}, RegisterRequest(r, b, a, previous) PROVE InductiveInvariant' PROOF @@ -749,7 +737,7 @@ THEOREM SubmitResolutionUnchangedValues == /\ requests' = requests /\ requestBinding' = requestBinding /\ requestAuthority' = requestAuthority - /\ previousResolution' = previousResolution + /\ previousResolutionCommitment' = previousResolutionCommitment PROOF BY DEF SubmitResolution @@ -1051,67 +1039,23 @@ THEOREM SubmitResolutionPreservesFreshReconsiderationPointwise == SubmitResolution(r, b, a, value), NEW q \in requests' PROVE - \/ previousResolution'[q] = NoResolution - \/ /\ previousResolution'[q] \in requests' - /\ previousResolution'[q] # q - /\ terminalRecord'[previousResolution'[q]] - \in TerminalResolutions + \/ previousResolutionCommitment'[q] = NoCommitment + \/ previousResolutionCommitment'[q] \in RecognizedTerminalCommitments PROOF <1>1. q \in requests BY SubmitResolutionUnchangedValues <1>2. - \/ previousResolution[q] = NoResolution - \/ /\ previousResolution[q] \in requests - /\ previousResolution[q] # q - /\ terminalRecord[previousResolution[q]] - \in TerminalResolutions + \/ previousResolutionCommitment[q] = NoCommitment + \/ previousResolutionCommitment[q] \in RecognizedTerminalCommitments BY <1>1 DEF InductiveInvariant, FreshReconsideration - <1>3. - /\ requests' = requests - /\ previousResolution' = previousResolution + <1>3. previousResolutionCommitment' = previousResolutionCommitment BY SubmitResolutionUnchangedValues - <1>4. CASE previousResolution[q] = NoResolution - <2>1. QED - BY <1>3, <1>4 - - <1>5. CASE previousResolution[q] # NoResolution - <2>1. - /\ previousResolution[q] \in requests - /\ previousResolution[q] # q - /\ terminalRecord[previousResolution[q]] - \in TerminalResolutions - BY <1>2, <1>5 - - <2>2. previousResolution[q] \in ResolutionIds - BY <2>1 - DEF InductiveInvariant, TypeOK - - <2>3. previousResolution[q] # r - BY <2>1, - SubmitResolutionGuardFacts, - NoRecordIsNotTerminal - DEF TerminalResolutions - - <2>4. - terminalRecord'[previousResolution[q]] - = terminalRecord[previousResolution[q]] - BY <2>2, <2>3, - SubmitResolutionOldKeyValues - - <2>5. - terminalRecord'[previousResolution[q]] - \in TerminalResolutions - BY <2>1, <2>4 - - <2>6. QED - BY <1>3, <2>1, <2>5 - - <1>6. QED - BY <1>4, <1>5 + <1>4. QED + BY <1>2, <1>3 THEOREM SubmitResolutionPreservesFreshReconsideration == @@ -1271,7 +1215,7 @@ THEOREM RegisterRequestSatisfiesRequestsAppendOnlyStep == ASSUME NEW r \in ResolutionIds, NEW b \in Bindings, NEW a \in Authorities, - NEW previous \in ResolutionIds \cup {NoResolution}, + NEW previous \in TerminalCommitments \cup {NoCommitment}, RegisterRequest(r, b, a, previous) PROVE RequestsAppendOnlyStep PROOF @@ -1357,7 +1301,7 @@ THEOREM RegisterRequestSatisfiesObservedInputsAppendOnlyStep == ASSUME NEW r \in ResolutionIds, NEW b \in Bindings, NEW a \in Authorities, - NEW previous \in ResolutionIds \cup {NoResolution}, + NEW previous \in TerminalCommitments \cup {NoCommitment}, RegisterRequest(r, b, a, previous) PROVE ObservedInputsAppendOnlyStep PROOF @@ -1443,7 +1387,7 @@ THEOREM RegisterRequestSatisfiesTerminalRecordsImmutableStep == ASSUME NEW r \in ResolutionIds, NEW b \in Bindings, NEW a \in Authorities, - NEW previous \in ResolutionIds \cup {NoResolution}, + NEW previous \in TerminalCommitments \cup {NoCommitment}, RegisterRequest(r, b, a, previous) PROVE TerminalRecordsImmutableStep PROOF diff --git a/seed/canonical/migration/CANON_CHANGE_DECLARATION.json b/seed/canonical/migration/CANON_CHANGE_DECLARATION.json index 73712a2..baef48e 100644 --- a/seed/canonical/migration/CANON_CHANGE_DECLARATION.json +++ b/seed/canonical/migration/CANON_CHANGE_DECLARATION.json @@ -1,10 +1,10 @@ { - "candidate_model_sha256": "sha256:5b70adad64933b5785cbde54290c4c1db2916e8efe37b222c0928f4a1017a017", + "candidate_model_sha256": "sha256:b5e68692317600fd2833474a1f9c31f09e44d37ae92ec14573b416076c5dd7f6", "change_class": "BREAKING", "change_kind": "SEMANTIC_SIMPLIFICATION", - "decision_ref": "seed/canonical/decisions/ADR-005-minimal-resolution-recognition-kernel.md", + "decision_ref": "seed/canonical/decisions/ADR-007-reconsideration-commitments-and-bounded-retention.md", "document_type": "aset-canon-change-declaration", - "rationale": "Seed 0.3 removes coupled status/enforcement and mutable escalation state in favor of one fail-closed record-recognition kernel.", + "rationale": "Seed 0.3 keeps reconsideration tied to immutable recognized terminal commitments while removing any requirement to retain predecessor request/record objects or an ever-growing canonical receipt registry.", "schema_version": 1, "supersession_ref": "seed/canonical/migration/ALPHA2_TO_0.3_ALPHA1_CHANGE_DECLARATION.json" } diff --git a/seed/canonical/ontology/seed.ttl b/seed/canonical/ontology/seed.ttl index df9c866..3647a74 100644 --- a/seed/canonical/ontology/seed.ttl +++ b/seed/canonical/ontology/seed.ttl @@ -47,8 +47,8 @@ aset:resolution_record a owl:Class ; rdfs:label "registro de resolução"@pt-BR ; rdfs:comment "One immutable content-addressed terminal ALLOW or BLOCK record with exact binding and Authority proof."@en . -aset:reconsideration_link a owl:Class ; - rdfs:label "связь пересмотра"@ru ; - rdfs:label "reconsideration link"@en ; - rdfs:label "vínculo de reconsideração"@pt-BR ; - rdfs:comment "A link from a fresh request to the unique terminal record of a previous resolution without mutating that record."@en . +aset:reconsideration_commitment a owl:Class ; + rdfs:label "коммитмент пересмотра"@ru ; + rdfs:label "reconsideration commitment"@en ; + rdfs:label "compromisso de reconsideração"@pt-BR ; + rdfs:comment "An immutable content-addressed commitment from a fresh request to a previously recognized terminal ResolutionRecord; the predecessor request or record need not remain physically retained by the implementation. Recognition may be established by current retained material or by externally validated authenticated-set/accumulator proof material."@en . diff --git a/seed/canonical/protocol/protocol-profile.json b/seed/canonical/protocol/protocol-profile.json index 6f43add..fdef015 100644 --- a/seed/canonical/protocol/protocol-profile.json +++ b/seed/canonical/protocol/protocol-profile.json @@ -45,7 +45,7 @@ "id": "https://spec.aset.example/seed/0.3/schemas/resolution-request.schema.json", "name": "resolution-request.schema.json", "path": "seed/canonical/protocol/schemas/resolution-request.schema.json", - "sha256": "sha256:b2f50024b439cacb5cea8f3f38f8f150dd797a1511b961c7e9a23bd666d10662" + "sha256": "sha256:503473e6c492dac110f06fb5b9b1472341b7e3ccabef8949288fbad93c81fdda" }, { "id": "https://spec.aset.example/seed/0.3/schemas/resolution-record.schema.json", @@ -87,7 +87,7 @@ "id": "https://spec.aset.example/seed/0.3/schemas/conformance-case.schema.json", "name": "conformance-case.schema.json", "path": "seed/canonical/protocol/schemas/conformance-case.schema.json", - "sha256": "sha256:3992493600276b2f8117b3f8541c26555cf422f117e1e90f7ceb1977e1294983" + "sha256": "sha256:622cd3eb866b7fbfc2cc2f494b66e831cf8713a329ee89f73ed0f5f062a0343a" } ], "seed_version": "0.3.0-alpha.1", diff --git a/seed/canonical/protocol/schemas/conformance-case.schema.json b/seed/canonical/protocol/schemas/conformance-case.schema.json index 70b42a6..9c0af87 100644 --- a/seed/canonical/protocol/schemas/conformance-case.schema.json +++ b/seed/canonical/protocol/schemas/conformance-case.schema.json @@ -46,6 +46,14 @@ ], "type": "object" }, + "recognized_terminal_record_digests": { + "description": "Externally validated terminal-record commitments available at the conformance verification boundary. This is recognition evidence, not retained canonical Seed state.", + "items": { + "$ref": "common.schema.json#/$defs/digest" + }, + "type": "array", + "uniqueItems": true + }, "initial_store": { "$ref": "resolution-store.schema.json" }, diff --git a/seed/canonical/protocol/schemas/resolution-request.schema.json b/seed/canonical/protocol/schemas/resolution-request.schema.json index 873279c..fb4a920 100644 --- a/seed/canonical/protocol/schemas/resolution-request.schema.json +++ b/seed/canonical/protocol/schemas/resolution-request.schema.json @@ -9,16 +9,6 @@ "initial_authority_binding_digest": { "$ref": "common.schema.json#/$defs/digest" }, - "previous_resolution_id": { - "anyOf": [ - { - "$ref": "common.schema.json#/$defs/identifier" - }, - { - "type": "null" - } - ] - }, "previous_terminal_record_digest": { "anyOf": [ { @@ -27,7 +17,8 @@ { "type": "null" } - ] + ], + "description": "Immutable content-addressed commitment to a previously recognized terminal ResolutionRecord. Null means this request is not a reconsideration. The predecessor request or record need not remain in retained storage." }, "request_digest": { "$ref": "common.schema.json#/$defs/digest" @@ -40,7 +31,6 @@ "resolution_id", "binding", "initial_authority_binding_digest", - "previous_resolution_id", "previous_terminal_record_digest", "request_digest" ], diff --git a/seed/canonical/schemas/canon-tla-refinement.schema.json b/seed/canonical/schemas/canon-tla-refinement.schema.json new file mode 100644 index 0000000..7ad25bb --- /dev/null +++ b/seed/canonical/schemas/canon-tla-refinement.schema.json @@ -0,0 +1,292 @@ +{ + "$defs": { + "invariantCoverage": { + "additionalProperties": false, + "properties": { + "id": { + "pattern": "^SEED-INV-[0-9]{3}$", + "type": "string" + }, + "status": { + "$ref": "#/$defs/status" + } + }, + "required": [ + "id", + "status" + ], + "type": "object" + }, + "requirementCoverage": { + "additionalProperties": false, + "properties": { + "id": { + "pattern": "^ASET-SEED-REQ-[0-9]{3}$", + "type": "string" + }, + "predicate": { + "pattern": "^[a-z][a-z0-9_]+$", + "type": "string" + }, + "status": { + "$ref": "#/$defs/status" + } + }, + "required": [ + "id", + "predicate", + "status" + ], + "type": "object" + }, + "statement": { + "additionalProperties": false, + "properties": { + "description": { + "minLength": 20, + "type": "string" + }, + "id": { + "pattern": "^[A-Z][A-Z0-9_]+$", + "type": "string" + } + }, + "required": [ + "id", + "description" + ], + "type": "object" + }, + "status": { + "enum": [ + "PROVED_IN_DECLARED_PROJECTION", + "PARTIAL_OPAQUE_BINDING", + "PARTIAL_AUTHORITY_ABSTRACTION", + "ABSTRACTED_AUTHORITY_PROOF", + "PARTIAL_NO_CONTENT_ADDRESS_PROOF", + "PARTIAL_TERMINAL_COMMITMENT_ABSTRACTION", + "META_OUTSIDE_BEHAVIORAL_MODEL" + ] + }, + "transitionCoverage": { + "additionalProperties": false, + "properties": { + "id": { + "pattern": "^SEED-TX-[0-9]{3}$", + "type": "string" + }, + "kind": { + "enum": [ + "REGISTER_REQUEST", + "SUBMIT_RESOLUTION", + "EVALUATE_RESOLUTION" + ] + }, + "status": { + "const": "PROVED_IN_DECLARED_PROJECTION" + }, + "tla_action": { + "enum": [ + "RegisterRequest", + "SubmitResolution", + "Evaluate" + ] + } + }, + "required": [ + "id", + "kind", + "tla_action", + "status" + ], + "type": "object" + } + }, + "$id": "https://github.com/attractor-set/ASET/raw/main/seed/canonical/schemas/canon-tla-refinement.schema.json", + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "properties": { + "abstractions": { + "items": { + "$ref": "#/$defs/statement" + }, + "minItems": 3, + "type": "array" + }, + "claim_boundary": { + "minLength": 80, + "type": "string" + }, + "document_type": { + "const": "aset-canon-tla-refinement" + }, + "excluded_claims": { + "items": { + "minLength": 1, + "type": "string" + }, + "minItems": 1, + "type": "array" + }, + "generated_projection": { + "additionalProperties": false, + "properties": { + "generator": { + "const": "tools/generate_canon_tla_projection.py" + }, + "module": { + "const": "SeedCanonProjection" + }, + "path": { + "const": "seed/canonical/formal/SeedCanonProjection.tla" + }, + "profile": { + "const": "ASET-SEED-CANON-TLA-PROJECTION-V2" + } + }, + "required": [ + "path", + "module", + "generator", + "profile" + ], + "type": "object" + }, + "invariant_coverage": { + "items": { + "$ref": "#/$defs/invariantCoverage" + }, + "maxItems": 12, + "minItems": 12, + "type": "array" + }, + "proof": { + "additionalProperties": false, + "properties": { + "final_theorem": { + "const": "SeedResolutionBehaviorallyEquivalentToCanonProjection" + }, + "module": { + "const": "seed/canonical/formal/SeedCanonRefinementProofs.tla" + }, + "verification_method": { + "const": "ASET-VERIFY-CANON-TLA-REFINEMENT" + } + }, + "required": [ + "module", + "final_theorem", + "verification_method" + ], + "type": "object" + }, + "relation_type": { + "const": "GENERATED_PROJECTION_WITH_BEHAVIORAL_EQUIVALENCE_PROOF" + }, + "requirement_coverage": { + "items": { + "$ref": "#/$defs/requirementCoverage" + }, + "maxItems": 12, + "minItems": 12, + "type": "array" + }, + "resolution_algebra_fields": { + "items": { + "enum": [ + "values", + "derived", + "stored_terminal", + "effect_permitted_if", + "fail_closed_values", + "conflict_result", + "unknown_semantics" + ] + }, + "maxItems": 7, + "minItems": 7, + "type": "array", + "uniqueItems": true + }, + "schema_version": { + "const": 1 + }, + "scope": { + "const": "DECLARED_CANONICAL_SAFETY_PROJECTION" + }, + "source_model": { + "additionalProperties": false, + "properties": { + "model_id": { + "minLength": 1, + "type": "string" + }, + "path": { + "const": "seed/canonical/source/seed-model.json" + }, + "sha256": { + "pattern": "^sha256:[0-9a-f]{64}$", + "type": "string" + }, + "version": { + "minLength": 1, + "type": "string" + } + }, + "required": [ + "path", + "sha256", + "model_id", + "version" + ], + "type": "object" + }, + "target_model": { + "additionalProperties": false, + "properties": { + "module": { + "const": "SeedResolution" + }, + "path": { + "const": "seed/canonical/formal/SeedResolution.tla" + }, + "sha256": { + "pattern": "^sha256:[0-9a-f]{64}$", + "type": "string" + } + }, + "required": [ + "path", + "sha256", + "module" + ], + "type": "object" + }, + "transition_coverage": { + "items": { + "$ref": "#/$defs/transitionCoverage" + }, + "maxItems": 3, + "minItems": 3, + "type": "array" + } + }, + "required": [ + "document_type", + "schema_version", + "scope", + "relation_type", + "source_model", + "target_model", + "generated_projection", + "proof", + "resolution_algebra_fields", + "requirement_coverage", + "invariant_coverage", + "transition_coverage", + "abstractions", + "excluded_claims", + "claim_boundary" + ], + "type": "object" +} diff --git a/seed/canonical/schemas/repository-release-gates.schema.json b/seed/canonical/schemas/repository-release-gates.schema.json index 16106bb..f5bcb6a 100644 --- a/seed/canonical/schemas/repository-release-gates.schema.json +++ b/seed/canonical/schemas/repository-release-gates.schema.json @@ -38,7 +38,7 @@ ], "type": "object" }, - "minItems": 22, + "minItems": 26, "type": "array" }, "profile": { diff --git a/seed/canonical/source/seed-model.json b/seed/canonical/source/seed-model.json index 95e621d..158aeec 100644 --- a/seed/canonical/source/seed-model.json +++ b/seed/canonical/source/seed-model.json @@ -120,17 +120,17 @@ }, { "definitions": { - "en": "A link from a fresh request to the unique terminal record of a previous resolution without mutating that record.", - "pt-BR": "Um vínculo de uma nova solicitação ao registro terminal único de uma resolução anterior sem alterar esse registro.", - "ru": "Связь нового запроса с уникальной терминальной записью предыдущего разрешения без изменения этой записи." + "en": "An immutable content-addressed commitment from a fresh request to a previously recognized terminal ResolutionRecord; the predecessor request or record need not remain physically retained by the implementation. Recognition may be established by current retained material or by externally validated authenticated-set/accumulator proof material.", + "pt-BR": "Um compromisso imutável e endereçado por conteúdo de uma nova solicitação com um ResolutionRecord terminal previamente reconhecido; a solicitação ou o registro predecessor não precisa permanecer fisicamente retido pela implementação. O reconhecimento pode ser estabelecido por material atualmente retido ou por prova externa validada de conjunto autenticado/acumulador.", + "ru": "Неизменяемый контентно-адресуемый коммитмент нового запроса на ранее признанную терминальную ResolutionRecord; запрос или запись-предшественник не обязаны физически сохраняться реализацией. Признание может устанавливаться текущим сохранённым материалом либо внешним проверенным доказательством принадлежности аутентифицированному множеству/аккумулятору." }, - "id": "seed.reconsideration_link", + "id": "seed.reconsideration_commitment", "labels": { - "en": "reconsideration link", - "pt-BR": "vínculo de reconsideração", - "ru": "связь пересмотра" + "en": "reconsideration commitment", + "pt-BR": "compromisso de reconsideração", + "ru": "коммитмент пересмотра" }, - "symbol": "ReconsiderationLink" + "symbol": "ReconsiderationCommitment" } ], "conformance_profile_ref": "seed/canonical/conformance/conformance-profile.json", @@ -138,7 +138,7 @@ "conformance_protocol_ref": "seed/canonical/conformance/implementation-conformance-protocol.json", "implementation_precedence": "NONE", "normative_status": "IMPLEMENTATION_NEUTRAL", - "profile_rule": "Profiles and extensions may produce evidence, assessments, policies, authority proof material and transport, but they may not create ALLOW without one valid locally rooted exact-binding terminal ResolutionRecord, weaken fail-closed evaluation, mutate a terminal record, reuse a resolution_id for reconsideration, or claim semantic precedence.", + "profile_rule": "Profiles and extensions may produce evidence, assessments, policies, authority proof material and transport, but they may not create ALLOW without one valid locally rooted exact-binding terminal ResolutionRecord, weaken fail-closed evaluation, mutate a terminal record, reuse a resolution_id for reconsideration, accept an unrecognized reconsideration commitment, or claim semantic precedence.", "required_observables": [ "accepted", "code", @@ -162,7 +162,10 @@ "key custody", "federation topology", "AI model", - "artifact retention" + "artifact retention", + "retention, pruning, archiving and compaction of superseded request/record material", + "terminal-commitment accumulator construction", + "accumulator membership/update witness retention" ] }, "invariants": [ @@ -370,9 +373,9 @@ ], "id": "SEED-INV-012", "texts": { - "en": "Reconsideration uses a fresh resolution_id linked to a prior unique terminal record.", - "pt-BR": "A reconsideração usa um resolution_id novo vinculado a um registro terminal único anterior.", - "ru": "Пересмотр использует свежий resolution_id, связанный с предыдущей уникальной терминальной записью." + "en": "Reconsideration uses a fresh resolution_id linked by an immutable content-addressed commitment to a previously recognized terminal ResolutionRecord; predecessor object retention is not required.", + "pt-BR": "A reconsideração usa um resolution_id novo vinculado por um compromisso imutável e endereçado por conteúdo a um ResolutionRecord terminal previamente reconhecido; a retenção do objeto predecessor não é obrigatória.", + "ru": "Пересмотр использует свежий resolution_id, связанный неизменяемым контентно-адресуемым коммитментом с ранее признанной терминальной ResolutionRecord; хранение объекта-предшественника не требуется." }, "verification": [ "ASET-VERIFY-DECLARATIVE-STATE-VALIDATION", @@ -674,9 +677,9 @@ "source": "ASET Seed 0.3 minimal strong core", "subject": "ASET Seed", "texts": { - "en": "Reconsideration MUST create a fresh resolution_id linked to the unique terminal record of the previous resolution.", - "pt-BR": "A reconsideração DEVE criar um resolution_id novo vinculado ao registro terminal único da resolução anterior.", - "ru": "Пересмотр ДОЛЖЕН создавать свежий resolution_id, связанный с уникальной терминальной записью предыдущего разрешения." + "en": "Reconsideration MUST create a fresh resolution_id and carry an immutable content-addressed commitment to a previously recognized terminal ResolutionRecord; the predecessor request or record need not remain physically retained.", + "pt-BR": "A reconsideração DEVE criar um resolution_id novo e portar um compromisso imutável e endereçado por conteúdo com um ResolutionRecord terminal previamente reconhecido; a solicitação ou o registro predecessor não precisa permanecer fisicamente retido.", + "ru": "Пересмотр ДОЛЖЕН создавать свежий resolution_id и нести неизменяемый контентно-адресуемый коммитмент на ранее признанную терминальную ResolutionRecord; запрос или запись-предшественник не обязаны физически сохраняться." }, "verification": [ "ASET-VERIFY-DECLARATIVE-STATE-VALIDATION", @@ -731,7 +734,7 @@ "transitions": [ { "authority_rule": "The initial Authority binding must be locally rooted and exactly match the request binding.", - "binding_rule": "The request contains one canonical exact binding and a fresh resolution_id.", + "binding_rule": "The request contains one canonical exact binding and a fresh resolution_id. For reconsideration, previous_terminal_record_digest must be a recognized immutable terminal-record commitment; predecessor object presence in retained storage is not required.", "created_artifacts": [ "ResolutionRequest" ], diff --git a/seed/canonical/terminology/seed.skos.ttl b/seed/canonical/terminology/seed.skos.ttl index 50be29f..69d2e05 100644 --- a/seed/canonical/terminology/seed.skos.ttl +++ b/seed/canonical/terminology/seed.skos.ttl @@ -60,10 +60,10 @@ aset:resolution_record a skos:Concept ; skos:prefLabel "registro de resolução"@pt-BR ; skos:definition "One immutable content-addressed terminal ALLOW or BLOCK record with exact binding and Authority proof."@en . -aset:reconsideration_link a skos:Concept ; +aset:reconsideration_commitment a skos:Concept ; skos:inScheme aset:SeedConceptScheme ; - skos:notation "seed.reconsideration_link" ; - skos:prefLabel "связь пересмотра"@ru ; - skos:prefLabel "reconsideration link"@en ; - skos:prefLabel "vínculo de reconsideração"@pt-BR ; - skos:definition "A link from a fresh request to the unique terminal record of a previous resolution without mutating that record."@en . + skos:notation "seed.reconsideration_commitment" ; + skos:prefLabel "коммитмент пересмотра"@ru ; + skos:prefLabel "reconsideration commitment"@en ; + skos:prefLabel "compromisso de reconsideração"@pt-BR ; + skos:definition "An immutable content-addressed commitment from a fresh request to a previously recognized terminal ResolutionRecord; the predecessor request or record need not remain physically retained by the implementation. Recognition may be established by current retained material or by externally validated authenticated-set/accumulator proof material."@en . diff --git a/seed/canonical/terminology/seed.tbx b/seed/canonical/terminology/seed.tbx index 900e8aa..493e0f6 100644 --- a/seed/canonical/terminology/seed.tbx +++ b/seed/canonical/terminology/seed.tbx @@ -37,10 +37,10 @@ resolution recordpreferred registro de resoluçãopreferred - - связь пересмотраpreferred - reconsideration linkpreferred - vínculo de reconsideraçãopreferred + + коммитмент пересмотраpreferred + reconsideration commitmentpreferred + compromisso de reconsideraçãopreferred diff --git a/tests/test_ci_assurance.py b/tests/test_ci_assurance.py index 094a719..ad60c1d 100644 --- a/tests/test_ci_assurance.py +++ b/tests/test_ci_assurance.py @@ -42,9 +42,12 @@ def test_ci_workflows_have_distinct_assurance_roles(): ) assert "candidate-consistency" in candidate assert "tools/check_proof_traceability.py" in candidate + assert "tools/check_canon_tla_refinement.py" in candidate assert "tools/run_tlc.py" in formal assert "tools/run_tlaps.py" in formal assert "tools/check_proof_traceability.py" in formal + assert "tools/check_canon_tla_refinement.py" in formal + assert "tools/run_canon_tla_refinement.py" in formal assert "4600b24" in formal assert "tlaps-proof.json" in formal assert "tools/check_canon_compatibility.py" not in candidate @@ -52,6 +55,8 @@ def test_ci_workflows_have_distinct_assurance_roles(): assert "TLA2TOOLS_JAR" in release assert "TLAPM_BIN" in release assert "proof-traceability-check.json" in release + assert "canon-tla-refinement-check.json" in release + assert "canon-tla-refinement-proof.json" in release assert "tools/repository_release_gate.py" in release assert "tlc-model-check.json" in release assert "tlaps-proof.json" in release @@ -160,3 +165,61 @@ def test_mandatory_proof_traceability_gate_is_in_aggregate_runner(): assert "tools/check_proof_traceability.py" in gate["evidence"] assert "tools/check_proof_traceability.py" in runner assert "dist/proof-traceability-check.json" in runner + + +def test_canon_tla_refinement_relation_is_complete_and_mandatory(): + relation = load("seed/canonical/assurance/canon-tla-refinement.json") + gates = load("seed/canonical/assurance/repository-release-gates.json") + registry = load("seed/canonical/assurance/verification-registry.json") + runner = (ROOT / "tools/repository_release_gate.py").read_text(encoding="utf-8") + + assert len(relation["requirement_coverage"]) == 12 + assert len(relation["invariant_coverage"]) == 12 + assert len(relation["transition_coverage"]) == 3 + assert len(relation["resolution_algebra_fields"]) == 7 + assert relation["proof"]["final_theorem"] == ( + "SeedResolutionBehaviorallyEquivalentToCanonProjection" + ) + + assert len(gates["gates"]) >= 26 + + gate_030 = next(item for item in gates["gates"] if item["id"] == "ASET-GATE-030") + gate_031 = next(item for item in gates["gates"] if item["id"] == "ASET-GATE-031") + assert gate_030["mandatory"] is True + assert gate_031["mandatory"] is True + assert "check_canon_tla_refinement.py" in gate_030["evidence"] + assert "run_canon_tla_refinement.py" in gate_031["evidence"] + assert "check_canon_tla_refinement.py" in runner + assert "run_canon_tla_refinement.py" in runner + + method = next( + item + for item in registry["verification_methods"] + if item["id"] == "ASET-VERIFY-CANON-TLA-REFINEMENT" + ) + assert method["gate_ids"] == ["ASET-GATE-030", "ASET-GATE-031"] + + +def test_generated_canon_tla_projection_is_current(tmp_path): + result = subprocess.run( + [sys.executable, "tools/generate_canon_tla_projection.py", "--check"], + cwd=ROOT, + text=True, + capture_output=True, + check=False, + ) + assert result.returncode == 0, result.stdout + result.stderr + + result = subprocess.run( + [ + sys.executable, + "tools/check_canon_tla_refinement.py", + "--output", + str(tmp_path / "canon-tla-refinement.json"), + ], + cwd=ROOT, + text=True, + capture_output=True, + check=False, + ) + assert result.returncode == 0, result.stdout + result.stderr diff --git a/tests/test_minimal_resolution_kernel.py b/tests/test_minimal_resolution_kernel.py index d955d2f..22fece6 100644 --- a/tests/test_minimal_resolution_kernel.py +++ b/tests/test_minimal_resolution_kernel.py @@ -12,3 +12,20 @@ def test_all_canonical_cases_match_the_pure_oracle(): def test_unknown_is_derived_not_stored(): schema=json.loads((ROOT/'seed/canonical/protocol/schemas/resolution-record.schema.json').read_text()) assert schema['properties']['resolution']['$ref'].endswith('/terminal_resolution') + +def test_reconsideration_commitment_does_not_require_predecessor_retention(): + case=json.loads((ROOT/'seed/canonical/conformance/cases/positive/RES-POS-008.json').read_text()) + assert case['initial_store']['requests']==[] + assert case['initial_store']['records']==[] + previous=case['candidate']['payload']['request']['previous_terminal_record_digest'] + assert previous in case['recognized_terminal_record_digests'] + actual,final_store=execute_case(case) + assert actual['accepted'] is True + assert final_store['requests'][0]['previous_terminal_record_digest']==previous + + +def test_historical_recognition_context_is_not_canonical_store_state(): + store_schema=json.loads((ROOT/'seed/canonical/protocol/schemas/resolution-store.schema.json').read_text()) + case_schema=json.loads((ROOT/'seed/canonical/protocol/schemas/conformance-case.schema.json').read_text()) + assert 'recognized_terminal_record_digests' not in store_schema['properties'] + assert 'recognized_terminal_record_digests' in case_schema['properties'] diff --git a/tools/build_canon_package.py b/tools/build_canon_package.py index 99c54d9..aa8ee3a 100644 --- a/tools/build_canon_package.py +++ b/tools/build_canon_package.py @@ -25,6 +25,8 @@ "seed/canonical/schemas/invariant-coverage.schema.json", "seed/canonical/assurance/proof-traceability.json", "seed/canonical/schemas/proof-traceability.schema.json", + "seed/canonical/assurance/canon-tla-refinement.json", + "seed/canonical/schemas/canon-tla-refinement.schema.json", "seed/canonical/assurance/limitations.json", "seed/canonical/schemas/assurance-limitations.schema.json", "seed/canonical/assurance/repository-release-gates.json", @@ -32,10 +34,13 @@ "seed/canonical/shapes/seed.shacl.ttl", "seed/canonical/formal/SeedResolution.tla", "seed/canonical/formal/SeedResolutionProofs.tla", + "seed/canonical/formal/SeedCanonProjection.tla", + "seed/canonical/formal/SeedCanonRefinementProofs.tla", "seed/canonical/formal/SeedResolution.cfg", "seed/canonical/migration/ALPHA2_TO_0.3_ALPHA1_CHANGE_DECLARATION.json", "seed/canonical/decisions/ADR-005-minimal-resolution-recognition-kernel.md", "seed/canonical/decisions/ADR-006-complete-invariant-closure.md", + "seed/canonical/decisions/ADR-007-reconsideration-commitments-and-bounded-retention.md", ] diff --git a/tools/check_canon_tla_refinement.py b/tools/check_canon_tla_refinement.py new file mode 100755 index 0000000..7862ea5 --- /dev/null +++ b/tools/check_canon_tla_refinement.py @@ -0,0 +1,235 @@ +#!/usr/bin/env python3 +from __future__ import annotations + +import argparse +import hashlib +import json +import re +import subprocess +import sys +from pathlib import Path +from typing import Any + +from jsonschema import Draft202012Validator + +ROOT = Path(__file__).resolve().parents[1] +MODEL_PATH = ROOT / "seed/canonical/source/seed-model.json" +RELATION_PATH = ROOT / "seed/canonical/assurance/canon-tla-refinement.json" +SCHEMA_PATH = ROOT / "seed/canonical/schemas/canon-tla-refinement.schema.json" +TARGET_PATH = ROOT / "seed/canonical/formal/SeedResolution.tla" +PROJECTION_PATH = ROOT / "seed/canonical/formal/SeedCanonProjection.tla" +PROOF_PATH = ROOT / "seed/canonical/formal/SeedCanonRefinementProofs.tla" +GENERATOR_PATH = ROOT / "tools/generate_canon_tla_projection.py" + +EXPECTED_REQUIREMENT_STATUS = { + "ASET-SEED-REQ-001": "PARTIAL_OPAQUE_BINDING", + "ASET-SEED-REQ-002": "PROVED_IN_DECLARED_PROJECTION", + "ASET-SEED-REQ-003": "PROVED_IN_DECLARED_PROJECTION", + "ASET-SEED-REQ-004": "PROVED_IN_DECLARED_PROJECTION", + "ASET-SEED-REQ-005": "PROVED_IN_DECLARED_PROJECTION", + "ASET-SEED-REQ-006": "PARTIAL_AUTHORITY_ABSTRACTION", + "ASET-SEED-REQ-007": "ABSTRACTED_AUTHORITY_PROOF", + "ASET-SEED-REQ-008": "PROVED_IN_DECLARED_PROJECTION", + "ASET-SEED-REQ-009": "PROVED_IN_DECLARED_PROJECTION", + "ASET-SEED-REQ-010": "PARTIAL_NO_CONTENT_ADDRESS_PROOF", + "ASET-SEED-REQ-011": "PARTIAL_TERMINAL_COMMITMENT_ABSTRACTION", + "ASET-SEED-REQ-012": "META_OUTSIDE_BEHAVIORAL_MODEL", +} + +EXPECTED_INVARIANT_STATUS = { + "SEED-INV-001": "PROVED_IN_DECLARED_PROJECTION", + "SEED-INV-002": "PROVED_IN_DECLARED_PROJECTION", + "SEED-INV-003": "PROVED_IN_DECLARED_PROJECTION", + "SEED-INV-004": "PARTIAL_OPAQUE_BINDING", + "SEED-INV-005": "PARTIAL_AUTHORITY_ABSTRACTION", + "SEED-INV-006": "ABSTRACTED_AUTHORITY_PROOF", + "SEED-INV-007": "PROVED_IN_DECLARED_PROJECTION", + "SEED-INV-008": "PROVED_IN_DECLARED_PROJECTION", + "SEED-INV-009": "PROVED_IN_DECLARED_PROJECTION", + "SEED-INV-010": "PARTIAL_NO_CONTENT_ADDRESS_PROOF", + "SEED-INV-011": "PROVED_IN_DECLARED_PROJECTION", + "SEED-INV-012": "PARTIAL_TERMINAL_COMMITMENT_ABSTRACTION", +} + + +def strict(pairs: list[tuple[str, Any]]) -> dict[str, Any]: + result: dict[str, Any] = {} + for key, value in pairs: + if key in result: + raise ValueError(f"duplicate JSON member: {key}") + result[key] = value + return result + + +def load(path: Path) -> Any: + return json.loads(path.read_text(encoding="utf-8"), object_pairs_hook=strict) + + +def digest(path: Path) -> str: + return "sha256:" + hashlib.sha256(path.read_bytes()).hexdigest() + + +def theorems(text: str) -> set[str]: + return set( + re.findall( + r"^THEOREM\s+([A-Za-z][A-Za-z0-9_]*)\s*==", + text, + flags=re.MULTILINE, + ) + ) + + +def main() -> int: + parser = argparse.ArgumentParser() + parser.add_argument( + "--output", + type=Path, + default=Path("dist/canon-tla-refinement-check.json"), + ) + args = parser.parse_args() + + errors: list[str] = [] + model = load(MODEL_PATH) + relation = load(RELATION_PATH) + schema = load(SCHEMA_PATH) + + validator = Draft202012Validator(schema) + for error in sorted( + validator.iter_errors(relation), + key=lambda item: list(item.path), + ): + errors.append("schema: " + error.message) + + if relation["source_model"]["sha256"] != digest(MODEL_PATH): + errors.append("source model digest mismatch") + if relation["source_model"]["model_id"] != model["model_id"]: + errors.append("source model id mismatch") + if relation["source_model"]["version"] != model["version"]: + errors.append("source model version mismatch") + if relation["target_model"]["sha256"] != digest(TARGET_PATH): + errors.append("target model digest mismatch") + + expected_requirements = [ + (item["id"], item["predicate"]) for item in model["requirements"] + ] + actual_requirements = [ + (item["id"], item["predicate"]) for item in relation["requirement_coverage"] + ] + if actual_requirements != expected_requirements: + errors.append("requirement coverage differs from machine canon") + + actual_requirement_status = { + item["id"]: item["status"] for item in relation["requirement_coverage"] + } + if actual_requirement_status != EXPECTED_REQUIREMENT_STATUS: + errors.append("requirement projection status profile differs") + + expected_invariants = [item["id"] for item in model["invariants"]] + actual_invariants = [item["id"] for item in relation["invariant_coverage"]] + if actual_invariants != expected_invariants: + errors.append("invariant coverage differs from machine canon") + + actual_invariant_status = { + item["id"]: item["status"] for item in relation["invariant_coverage"] + } + if actual_invariant_status != EXPECTED_INVARIANT_STATUS: + errors.append("invariant projection status profile differs") + + action_by_kind = { + "REGISTER_REQUEST": "RegisterRequest", + "SUBMIT_RESOLUTION": "SubmitResolution", + "EVALUATE_RESOLUTION": "Evaluate", + } + expected_transitions = [ + (item["id"], item["kind"], action_by_kind[item["kind"]]) + for item in model["transitions"] + ] + actual_transitions = [ + (item["id"], item["kind"], item["tla_action"]) + for item in relation["transition_coverage"] + ] + if actual_transitions != expected_transitions: + errors.append("transition coverage differs from machine canon") + + if set(relation["resolution_algebra_fields"]) != set(model["resolution_algebra"]): + errors.append("resolution algebra field coverage differs from machine canon") + + abstraction_ids = [item["id"] for item in relation["abstractions"]] + if abstraction_ids != [ + "OPAQUE_BINDING", + "AUTHORITY_PROOF_ORACLE", + "TERMINAL_COMMITMENT_ORACLE", + "ENVIRONMENT_OBSERVATION", + ]: + errors.append("declared abstraction profile differs") + + generator = subprocess.run( + [sys.executable, str(GENERATOR_PATH), "--check"], + cwd=ROOT, + text=True, + stdout=subprocess.PIPE, + stderr=subprocess.STDOUT, + check=False, + ) + if generator.returncode: + errors.append("generated projection parity failed") + + proof_theorems = theorems(PROOF_PATH.read_text(encoding="utf-8")) + final_theorem = relation["proof"]["final_theorem"] + if final_theorem not in proof_theorems: + errors.append("refinement final theorem is absent from proof module") + + report = { + "document_type": "aset-canon-tla-refinement-check", + "schema_version": 1, + "source_model_sha256": digest(MODEL_PATH), + "target_model_sha256": digest(TARGET_PATH), + "projection_sha256": ( + digest(PROJECTION_PATH) if PROJECTION_PATH.is_file() else None + ), + "requirements_classified": len(actual_requirements), + "invariants_classified": len(actual_invariants), + "transitions_classified": len(actual_transitions), + "resolution_algebra_fields_classified": len( + relation["resolution_algebra_fields"] + ), + "projection_parity_returncode": generator.returncode, + "final_theorem": final_theorem, + "errors": errors, + "verdict": "PASS" if not errors else "FAIL", + } + + output = args.output if args.output.is_absolute() else ROOT / args.output + output.parent.mkdir(parents=True, exist_ok=True) + output.write_text( + json.dumps(report, sort_keys=True, indent=2) + "\n", + encoding="utf-8", + newline="\n", + ) + + print( + "CANON_TLA_REQUIREMENTS=" + f"{len(actual_requirements)}/{len(expected_requirements)}" + ) + print(f"CANON_TLA_INVARIANTS={len(actual_invariants)}/{len(expected_invariants)}") + print( + f"CANON_TLA_TRANSITIONS={len(actual_transitions)}/{len(expected_transitions)}" + ) + print( + "CANON_TLA_RESOLUTION_ALGEBRA=" + f"{len(relation['resolution_algebra_fields'])}/" + f"{len(model['resolution_algebra'])}" + ) + print( + "CANON_TLA_PROJECTION_PARITY=" + + ("PASS" if generator.returncode == 0 else "FAIL") + ) + print("CANON_TLA_REFINEMENT_CHECK=" + report["verdict"]) + for error in errors: + print("CANON_TLA_REFINEMENT_ERROR=" + error) + + return 0 if not errors else 1 + + +if __name__ == "__main__": + raise SystemExit(main()) diff --git a/tools/generate_canon_tla_projection.py b/tools/generate_canon_tla_projection.py new file mode 100755 index 0000000..4479f93 --- /dev/null +++ b/tools/generate_canon_tla_projection.py @@ -0,0 +1,293 @@ +#!/usr/bin/env python3 +from __future__ import annotations + +import argparse +import hashlib +import json +from pathlib import Path +from typing import Any + +ROOT = Path(__file__).resolve().parents[1] +MODEL_PATH = ROOT / "seed/canonical/source/seed-model.json" +RELATION_PATH = ROOT / "seed/canonical/assurance/canon-tla-refinement.json" +OUTPUT_PATH = ROOT / "seed/canonical/formal/SeedCanonProjection.tla" + +EXPECTED_PROFILE = "ASET-SEED-CANON-TLA-PROJECTION-V2" +EXPECTED_REQUIREMENT_PREDICATES = [ + "binding_exact", + "request_fresh", + "resolution_domain", + "allow_only", + "fail_closed", + "local_authority", + "proof_attenuating", + "inputs_non_authoritative", + "terminal_unique", + "record_immutable", + "reconsider_fresh", + "implementation_neutral", +] +EXPECTED_TRANSITIONS = [ + ("SEED-TX-001", "REGISTER_REQUEST"), + ("SEED-TX-002", "SUBMIT_RESOLUTION"), + ("SEED-TX-003", "EVALUATE_RESOLUTION"), +] +EXPECTED_INVARIANTS = [f"SEED-INV-{index:03d}" for index in range(1, 13)] + + +def strict(pairs: list[tuple[str, Any]]) -> dict[str, Any]: + result: dict[str, Any] = {} + for key, value in pairs: + if key in result: + raise ValueError(f"duplicate JSON member: {key}") + result[key] = value + return result + + +def load(path: Path) -> Any: + return json.loads(path.read_text(encoding="utf-8"), object_pairs_hook=strict) + + +def digest(path: Path) -> str: + return "sha256:" + hashlib.sha256(path.read_bytes()).hexdigest() + + +def tla_set(values: list[str]) -> str: + return "{" + ", ".join(json.dumps(value) for value in values) + "}" + + +def validate_inputs(model: dict[str, Any], relation: dict[str, Any]) -> None: + errors: list[str] = [] + + if relation["generated_projection"]["profile"] != EXPECTED_PROFILE: + errors.append("unexpected projection profile") + + if relation["source_model"]["sha256"] != digest(MODEL_PATH): + errors.append("source model digest mismatch") + + if relation["source_model"]["model_id"] != model["model_id"]: + errors.append("source model id mismatch") + + if relation["source_model"]["version"] != model["version"]: + errors.append("source model version mismatch") + + predicates = [item["predicate"] for item in model["requirements"]] + if predicates != EXPECTED_REQUIREMENT_PREDICATES: + errors.append("unsupported requirement predicate catalogue") + + invariants = [item["id"] for item in model["invariants"]] + if invariants != EXPECTED_INVARIANTS: + errors.append("unsupported invariant catalogue") + + transitions = [(item["id"], item["kind"]) for item in model["transitions"]] + if transitions != EXPECTED_TRANSITIONS: + errors.append("unsupported transition catalogue") + + algebra = model["resolution_algebra"] + if algebra["values"] != ["UNKNOWN", "ALLOW", "BLOCK"]: + errors.append("unsupported resolution values") + if algebra["stored_terminal"] != ["ALLOW", "BLOCK"]: + errors.append("unsupported terminal values") + if algebra["derived"] != "UNKNOWN": + errors.append("unsupported derived resolution") + if algebra["effect_permitted_if"] != "ALLOW": + errors.append("unsupported effect permission value") + if algebra["fail_closed_values"] != ["UNKNOWN", "BLOCK"]: + errors.append("unsupported fail-closed values") + if algebra["conflict_result"] != "UNKNOWN": + errors.append("unsupported conflict result") + + if errors: + raise ValueError("; ".join(errors)) + + +def render(model: dict[str, Any], relation: dict[str, Any]) -> str: + validate_inputs(model, relation) + algebra = model["resolution_algebra"] + source_sha = relation["source_model"]["sha256"] + profile = relation["generated_projection"]["profile"] + + return f"""---------------- MODULE SeedCanonProjection ---------------- +EXTENDS SeedResolution + +(* +GENERATED FILE. DO NOT EDIT. +Source: seed/canonical/source/seed-model.json +Source SHA-256: {source_sha} +Projection profile: {profile} + +This module is the deterministic TLA+ interpretation used by the +canon-to-TLA refinement assurance. It intentionally preserves the declared +opaque Binding, authorityProofBindings and RecognizedTerminalCommitments +abstractions. +*) + +CanonResolutions == {tla_set(algebra["values"])} +CanonTerminalResolutions == {tla_set(algebra["stored_terminal"])} +CanonDerivedResolution == {json.dumps(algebra["derived"])} +CanonEffectPermittedValue == {json.dumps(algebra["effect_permitted_if"])} +CanonFailClosedValues == {tla_set(algebra["fail_closed_values"])} +CanonConflictResult == {json.dumps(algebra["conflict_result"])} + +CanonInit == + /\\ localAuthorityBindings \\in SUBSET (Authorities \\X Bindings) + /\\ authorityProofBindings \\in SUBSET (Authorities \\X Bindings) + /\\ localAuthorityBindings \\subseteq authorityProofBindings + /\\ requests = {{}} + /\\ requestBinding = [r \\in ResolutionIds |-> CHOOSE b \\in Bindings : TRUE] + /\\ requestAuthority = [r \\in ResolutionIds |-> CHOOSE a \\in Authorities : TRUE] + /\\ previousResolutionCommitment = [r \\in ResolutionIds |-> NoCommitment] + /\\ terminalRecord = [r \\in ResolutionIds |-> NoRecord] + /\\ terminalBinding = [r \\in ResolutionIds |-> CHOOSE b \\in Bindings : TRUE] + /\\ terminalAuthority = [r \\in ResolutionIds |-> CHOOSE a \\in Authorities : TRUE] + /\\ conflicts = {{}} + /\\ invalidMaterial = {{}} + /\\ observedInputs = {{}} + +CanonRegisterRequest(r, b, a, previous) == + /\\ r \\in ResolutionIds \\ requests + /\\ b \\in Bindings + /\\ a \\in Authorities + /\\ <> \\in localAuthorityBindings + /\\ \\/ previous = NoCommitment + \\/ previous \\in RecognizedTerminalCommitments + /\\ requests' = requests \\cup {{r}} + /\\ requestBinding' = [requestBinding EXCEPT ![r] = b] + /\\ requestAuthority' = [requestAuthority EXCEPT ![r] = a] + /\\ previousResolutionCommitment' = [previousResolutionCommitment EXCEPT ![r] = previous] + /\\ UNCHANGED <> + +CanonSubmitResolution(r, b, a, value) == + /\\ r \\in requests + /\\ b = requestBinding[r] + /\\ a \\in Authorities + /\\ <> \\in authorityProofBindings + /\\ value \\in CanonTerminalResolutions + /\\ terminalRecord[r] = NoRecord + /\\ r \\notin conflicts + /\\ terminalRecord' = [terminalRecord EXCEPT ![r] = value] + /\\ terminalBinding' = [terminalBinding EXCEPT ![r] = b] + /\\ terminalAuthority' = [terminalAuthority EXCEPT ![r] = a] + /\\ UNCHANGED <> + +CanonObserveConflict(r) == + /\\ r \\in ResolutionIds + /\\ conflicts' = conflicts \\cup {{r}} + /\\ UNCHANGED <> + +CanonObserveInvalidMaterial(r) == + /\\ r \\in ResolutionIds + /\\ invalidMaterial' = invalidMaterial \\cup {{r}} + /\\ UNCHANGED <> + +CanonObserveNonAuthoritativeInput(r) == + /\\ r \\in ResolutionIds + /\\ observedInputs' = observedInputs \\cup {{r}} + /\\ UNCHANGED <> + +CanonEvaluate == UNCHANGED vars + +CanonRecognizedCanonicalTransition == + \\/ \\E r \\in ResolutionIds, b \\in Bindings, a \\in Authorities, + previous \\in TerminalCommitments \\cup {{NoCommitment}} : + CanonRegisterRequest(r, b, a, previous) + \\/ \\E r \\in ResolutionIds, b \\in Bindings, a \\in Authorities, + value \\in CanonTerminalResolutions : + CanonSubmitResolution(r, b, a, value) + \\/ \\E r \\in ResolutionIds : CanonObserveConflict(r) + \\/ \\E r \\in ResolutionIds : CanonObserveInvalidMaterial(r) + \\/ \\E r \\in ResolutionIds : CanonObserveNonAuthoritativeInput(r) + +CanonNext == + \\/ CanonRecognizedCanonicalTransition + \\/ CanonEvaluate + +CanonResolutionOf(r) == + IF r \\notin requests \\/ r \\in conflicts + THEN CanonConflictResult + ELSE IF terminalRecord[r] = NoRecord + THEN CanonDerivedResolution + ELSE terminalRecord[r] + +CanonEffectPermitted(r) == + CanonResolutionOf(r) = CanonEffectPermittedValue + +CanonSpec == CanonInit /\\ [][CanonNext]_vars +============================================================================= +""" + + +def main() -> int: + parser = argparse.ArgumentParser() + parser.add_argument("--check", action="store_true") + args = parser.parse_args() + + model = load(MODEL_PATH) + relation = load(RELATION_PATH) + + try: + content = render(model, relation) + except (KeyError, TypeError, ValueError) as exc: + print(f"CANON_TLA_PROJECTION_ERROR={exc}") + print("CANON_TLA_PROJECTION=FAIL") + return 1 + + if args.check: + ok = ( + OUTPUT_PATH.is_file() and OUTPUT_PATH.read_text(encoding="utf-8") == content + ) + print("CANON_TLA_PROJECTION_PARITY=" + ("PASS" if ok else "DIFFERENT")) + return 0 if ok else 1 + + OUTPUT_PATH.write_text(content, encoding="utf-8", newline="\n") + print("CANON_TLA_PROJECTION_GENERATED=PASS") + return 0 + + +if __name__ == "__main__": + raise SystemExit(main()) diff --git a/tools/model_check_seed.py b/tools/model_check_seed.py index 2fdfd98..0565a47 100755 --- a/tools/model_check_seed.py +++ b/tools/model_check_seed.py @@ -12,7 +12,8 @@ BINDINGS = (0, 1) AUTHORITIES = (0, 1) TERMINALS = ("ALLOW", "BLOCK") -NO_PREVIOUS = -1 +NO_COMMITMENT = -1 +RECOGNIZED_TERMINAL_COMMITMENTS = frozenset({0, 1}) LOCAL_AUTHORITY_BINDINGS = frozenset({(0, 0), (1, 1)}) AUTHORITY_PROOF_BINDINGS = frozenset({(0, 0), (1, 1), (1, 0)}) @@ -40,7 +41,7 @@ @dataclass(frozen=True) class State: - # request tuple: resolution_id, binding, initial_authority, previous_resolution + # request tuple: resolution_id, binding, initial_authority, previous_terminal_commitment requests: tuple[tuple[int, int, int, int], ...] # record tuple: resolution_id, binding, authority, terminal_value records: tuple[tuple[int, int, int, str], ...] @@ -94,16 +95,14 @@ def successors(state: State) -> Iterable[tuple[str, State]]: yield ( "RegisterRequest", State( - tuple(sorted((*state.requests, (rid, binding, authority, NO_PREVIOUS)))), + tuple(sorted((*state.requests, (rid, binding, authority, NO_COMMITMENT)))), state.records, state.conflicts, state.invalid_material, state.observed_inputs, ), ) - for previous in IDS: - if previous == rid or resolution_of(state, previous) not in TERMINALS: - continue + for previous in RECOGNIZED_TERMINAL_COMMITMENTS: for binding, authority in LOCAL_AUTHORITY_BINDINGS: yield ( "RegisterReconsideration", @@ -218,10 +217,10 @@ def state_errors(state: State) -> list[str]: ): errors.append("InvalidOrConflictUnknown") - for rid, (_, _, previous) in requests.items(): - if previous == NO_PREVIOUS: + for _, (_, _, previous) in requests.items(): + if previous == NO_COMMITMENT: continue - if previous == rid or previous not in requests or previous not in records: + if previous not in RECOGNIZED_TERMINAL_COMMITMENTS: errors.append("FreshReconsideration") return sorted(set(errors)) diff --git a/tools/repository_release_gate.py b/tools/repository_release_gate.py index 505c6d2..d52f337 100755 --- a/tools/repository_release_gate.py +++ b/tools/repository_release_gate.py @@ -34,6 +34,11 @@ "--output", "dist/proof-traceability-check.json", ], + [ + "tools/check_canon_tla_refinement.py", + "--output", + "dist/canon-tla-refinement-check.json", + ], [ "tools/check_invariant_coverage.py", "--mutation-report", @@ -88,6 +93,15 @@ def commands() -> list[list[str]]: "dist/tlaps-proof.json", ] ) + result.append( + [ + "tools/run_canon_tla_refinement.py", + "--tlapm", + tlapm_bin, + "--output", + "dist/canon-tla-refinement-proof.json", + ] + ) return result @@ -103,6 +117,7 @@ def write_report(rows: list[dict[str, object]], verdict: str) -> None: "approved_ref_checked": os.environ.get("ASET_APPROVED_REF"), "tlc_executed": bool(os.environ.get("TLA2TOOLS_JAR")), "tlaps_executed": bool(os.environ.get("TLAPM_BIN")), + "canon_tla_refinement_executed": bool(os.environ.get("TLAPM_BIN")), "verdict": verdict, }, sort_keys=True, diff --git a/tools/run_canon_tla_refinement.py b/tools/run_canon_tla_refinement.py new file mode 100755 index 0000000..5535c36 --- /dev/null +++ b/tools/run_canon_tla_refinement.py @@ -0,0 +1,189 @@ +#!/usr/bin/env python3 +from __future__ import annotations + +import argparse +import hashlib +import json +import os +import re +import shutil +import subprocess +import sys +from pathlib import Path + +ROOT = Path(__file__).resolve().parents[1] +EXPECTED_TLAPM_VERSION = "4600b24" +EXPECTED_TLAPM_COMMIT = "4600b24c6d95a25ff081ad37b63b2a01c29d43a5" +RELATION_PATH = ROOT / "seed/canonical/assurance/canon-tla-refinement.json" +PROJECTION_PATH = ROOT / "seed/canonical/formal/SeedCanonProjection.tla" +PROOF_PATH = ROOT / "seed/canonical/formal/SeedCanonRefinementProofs.tla" +CHECKER_PATH = ROOT / "tools/check_canon_tla_refinement.py" +FINAL_THEOREM = "SeedResolutionBehaviorallyEquivalentToCanonProjection" + + +def resolve(path: Path) -> Path: + return path if path.is_absolute() else ROOT / path + + +def digest(path: Path) -> str: + return "sha256:" + hashlib.sha256(path.read_bytes()).hexdigest() + + +def main() -> int: + parser = argparse.ArgumentParser() + parser.add_argument("--tlapm", type=Path, required=True) + parser.add_argument( + "--output", + type=Path, + default=Path("dist/canon-tla-refinement-proof.json"), + ) + parser.add_argument("--timeout-seconds", type=int, default=900) + args = parser.parse_args() + + errors: list[str] = [] + tlapm = resolve(args.tlapm) + + if not tlapm.is_file(): + errors.append(f"missing TLAPM executable: {tlapm}") + elif not os.access(tlapm, os.X_OK): + errors.append(f"TLAPM is not executable: {tlapm}") + + checker = subprocess.run( + [sys.executable, str(CHECKER_PATH)], + cwd=ROOT, + text=True, + stdout=subprocess.PIPE, + stderr=subprocess.STDOUT, + check=False, + ) + if checker.returncode: + errors.append("canon-to-TLA refinement integrity check failed") + + proof_text = PROOF_PATH.read_text(encoding="utf-8") if PROOF_PATH.is_file() else "" + if "EXTENDS SeedCanonProjection, TLAPS" not in proof_text: + errors.append( + "refinement proof module does not import SeedCanonProjection and TLAPS" + ) + if ( + re.search( + rf"^THEOREM {FINAL_THEOREM} ==\s*$", + proof_text, + flags=re.MULTILINE, + ) + is None + ): + errors.append(f"missing final theorem: {FINAL_THEOREM}") + + version_output = "" + if tlapm.is_file() and os.access(tlapm, os.X_OK): + try: + result = subprocess.run( + [str(tlapm), "--version"], + cwd=ROOT, + text=True, + stdout=subprocess.PIPE, + stderr=subprocess.STDOUT, + timeout=30, + check=False, + ) + version_output = result.stdout.strip() + if result.returncode: + errors.append(f"tlapm --version returned {result.returncode}") + if version_output != EXPECTED_TLAPM_VERSION: + errors.append(f"unexpected TLAPM version: {version_output!r}") + except subprocess.TimeoutExpired: + errors.append("tlapm --version timed out") + + print("CANON_TLA_REFINEMENT_PROOF=START") + print(f"TLAPM_COMMIT={EXPECTED_TLAPM_COMMIT}") + print(f"TLAPM_VERSION={version_output}") + print("CANON_TLA_PROJECTION=seed/canonical/formal/SeedCanonProjection.tla") + print("CANON_TLA_PROOF_MODULE=seed/canonical/formal/SeedCanonRefinementProofs.tla") + print(f"CANON_TLA_FINAL_THEOREM={FINAL_THEOREM}") + + output_text = "" + returncode: int | None = None + timed_out = False + + if not errors: + shutil.rmtree(ROOT / ".tlacache", ignore_errors=True) + try: + result = subprocess.run( + [str(tlapm), str(PROOF_PATH)], + cwd=ROOT, + text=True, + stdout=subprocess.PIPE, + stderr=subprocess.STDOUT, + timeout=args.timeout_seconds, + check=False, + ) + output_text = result.stdout + returncode = result.returncode + except subprocess.TimeoutExpired as exc: + timed_out = True + captured = exc.stdout or "" + if isinstance(captured, bytes): + captured = captured.decode("utf-8", errors="replace") + output_text = captured + errors.append("canon-to-TLA refinement proof timed out") + + if output_text: + print(output_text, end="" if output_text.endswith("\n") else "\n") + + matches = re.findall(r"All ([0-9]+) obligations? proved\.", output_text) + obligations = int(matches[-1]) if matches else None + + if returncode != 0: + errors.append(f"TLAPM returned {returncode}") + if obligations is None: + errors.append("TLAPM success summary was not found") + + for marker in ( + "obligations failed", + "unproved obligations", + "backend errors", + "Zenon error", + "Proof.Parser", + "[ERROR]", + ): + if marker in output_text: + errors.append(f"TLAPM output contains {marker!r}") + + verdict = "PASS" if not errors else "FAIL" + relation = json.loads(RELATION_PATH.read_text(encoding="utf-8")) + report = { + "document_type": "aset-canon-tla-refinement-proof-report", + "schema_version": 1, + "relation": "seed/canonical/assurance/canon-tla-refinement.json", + "source_model_sha256": relation["source_model"]["sha256"], + "target_model_sha256": relation["target_model"]["sha256"], + "projection_sha256": digest(PROJECTION_PATH), + "proof_module_sha256": digest(PROOF_PATH), + "tlapm_commit": EXPECTED_TLAPM_COMMIT, + "tlapm_version": version_output, + "final_theorem": FINAL_THEOREM, + "obligations_proved": obligations, + "returncode": returncode, + "timed_out": timed_out, + "errors": errors, + "verdict": verdict, + } + output = args.output if args.output.is_absolute() else ROOT / args.output + output.parent.mkdir(parents=True, exist_ok=True) + output.write_text( + json.dumps(report, sort_keys=True, indent=2) + "\n", + encoding="utf-8", + newline="\n", + ) + + if obligations is not None: + print(f"CANON_TLA_REFINEMENT_OBLIGATIONS={obligations}") + print("CANON_TLA_REFINEMENT_VERDICT=" + verdict) + for error in errors: + print("CANON_TLA_REFINEMENT_ERROR=" + error) + + return 0 if verdict == "PASS" else 1 + + +if __name__ == "__main__": + raise SystemExit(main()) diff --git a/tools/seed_resolution_oracle.py b/tools/seed_resolution_oracle.py index e096bf4..2e2a267 100755 --- a/tools/seed_resolution_oracle.py +++ b/tools/seed_resolution_oracle.py @@ -216,7 +216,40 @@ def actual(accepted: bool, code: str, state_changed: bool, evaluation: dict[str, } -def register_request(store: dict[str, list[dict[str, Any]]], request: dict[str, Any]) -> tuple[dict[str, Any], dict[str, Any]]: +def recognized_terminal_record_digests( + store: dict[str, Any], + externally_recognized: list[str] | tuple[str, ...] = (), +) -> set[str]: + """Return terminal commitments recognized at the verification boundary. + + `externally_recognized` represents proof material already validated by an + implementation/profile (for example an accumulator membership witness). It + is deliberately not canonical Seed state. Valid terminal records still + retained in the current store are recognized directly. + """ + recognized = {item for item in externally_recognized if isinstance(item, str)} + requests_by_id: dict[str, list[dict[str, Any]]] = {} + for request in store.get("requests", []): + rid = request.get("resolution_id") + if isinstance(rid, str): + requests_by_id.setdefault(rid, []).append(request) + for record in store.get("records", []): + rid = record.get("resolution_id") + candidates = requests_by_id.get(rid, []) + if len(candidates) != 1 or not request_valid(candidates[0]): + continue + ok, _ = record_valid(store, candidates[0], record) + digest = record.get("record_digest") + if ok and isinstance(digest, str): + recognized.add(digest) + return recognized + + +def register_request( + store: dict[str, list[dict[str, Any]]], + request: dict[str, Any], + externally_recognized: list[str] | tuple[str, ...] = (), +) -> tuple[dict[str, Any], dict[str, Any]]: resolution_id = str(request.get("resolution_id", "invalid-resolution")) before = copy.deepcopy(store) if not request_valid(request): @@ -236,19 +269,15 @@ def register_request(store: dict[str, list[dict[str, Any]]], request: dict[str, ): return actual(False, "LOCAL_AUTHORITY_BINDING_MISMATCH", False, evaluate(before, resolution_id)), before - previous_id = request.get("previous_resolution_id") previous_digest = request.get("previous_terminal_record_digest") - if previous_id is None: - if previous_digest is not None: - return actual(False, "RECONSIDERATION_LINK_INVALID", False, evaluate(before, resolution_id)), before - else: - if previous_id == resolution_id: - return actual(False, "RESOLUTION_ID_NOT_FRESH", False, evaluate(before, resolution_id)), before - previous = evaluate(store, previous_id) - if previous["resolution"] not in {"ALLOW", "BLOCK"}: - return actual(False, "PREVIOUS_RESOLUTION_NOT_TERMINAL", False, evaluate(before, resolution_id)), before - if previous_digest != previous["terminal_record_digest"]: - return actual(False, "PREVIOUS_TERMINAL_RECORD_MISMATCH", False, evaluate(before, resolution_id)), before + if previous_digest is not None: + if previous_digest not in recognized_terminal_record_digests(store, externally_recognized): + return actual( + False, + "PREVIOUS_TERMINAL_COMMITMENT_UNRECOGNIZED", + False, + evaluate(before, resolution_id), + ), before store = copy.deepcopy(store) store["requests"].append(copy.deepcopy(request)) @@ -281,6 +310,7 @@ def submit_resolution(store: dict[str, list[dict[str, Any]]], record: dict[str, def execute_operation( store: dict[str, list[dict[str, Any]]], operation: dict[str, Any], + externally_recognized: list[str] | tuple[str, ...] = (), ) -> tuple[dict[str, Any], dict[str, list[dict[str, Any]]]]: kind = operation.get("kind") payload = operation.get("payload") @@ -291,7 +321,7 @@ def execute_operation( request = payload.get("request") if not isinstance(request, dict): return actual(False, "OPERATION_INVALID", False, evaluate(store, "invalid-resolution")), copy.deepcopy(store) - return register_request(store, request) + return register_request(store, request, externally_recognized) if kind == "SUBMIT_RESOLUTION": record = payload.get("record") if not isinstance(record, dict): @@ -307,8 +337,9 @@ def execute_operation( def execute_case(case: dict[str, Any]) -> tuple[dict[str, Any], dict[str, Any]]: store = copy.deepcopy(case["initial_store"]) + externally_recognized = case.get("recognized_terminal_record_digests", []) for operation in case.get("setup", []): - result, store = execute_operation(store, operation) + result, store = execute_operation(store, operation, externally_recognized) if not result["accepted"]: raise ValueError(f"setup rejected for {case['case_id']}: {result['code']}") - return execute_operation(store, case["candidate"]) + return execute_operation(store, case["candidate"], externally_recognized) diff --git a/tools/validate_seed_canon.py b/tools/validate_seed_canon.py index 7ec9ecc..f7aef5e 100644 --- a/tools/validate_seed_canon.py +++ b/tools/validate_seed_canon.py @@ -168,6 +168,12 @@ def main() -> int: "seed/canonical/schemas/assurance-limitations.schema.json", "assurance_limitations", ) + validate_document( + errors, + "seed/canonical/assurance/canon-tla-refinement.json", + "seed/canonical/schemas/canon-tla-refinement.schema.json", + "canon_tla_refinement", + ) validate_document( errors, "seed/canonical/assurance/repository-release-gates.json", From 02b3e16da27891e83e3b9d291c55d4007fa6055d Mon Sep 17 00:00:00 2001 From: Dzmitry Prychyna Date: Fri, 7 Aug 2026 01:01:35 -0300 Subject: [PATCH 2/4] refactor(seed): minimize canonical semantic state --- MANIFEST.json | 88 +- audit/ACTIVE_AUDIT_INDEX.json | 2 +- docs/architecture/SEED_STATE_MINIMIZATION.md | 60 + seed/canonical/CANON_PACKAGE.json | 24 +- seed/canonical/README.md | 12 +- .../assurance/canon-tla-refinement.json | 8 +- .../assurance/invariant-coverage.json | 17 +- seed/canonical/assurance/limitations.json | 2 +- .../assurance/proof-traceability.json | 13 +- .../assurance/verification-registry.json | 26 +- ...08-normalize-seed-state-by-construction.md | 43 + seed/canonical/formal/README.md | 30 +- seed/canonical/formal/SeedCanonProjection.tla | 124 +- .../formal/SeedCanonRefinementProofs.tla | 8 +- seed/canonical/formal/SeedResolution.cfg | 10 +- seed/canonical/formal/SeedResolution.tla | 345 ++-- .../canonical/formal/SeedResolutionProofs.tla | 1607 +++++------------ .../schemas/canon-tla-refinement.schema.json | 2 +- tests/test_ci_assurance.py | 30 +- tools/check_assurance_traceability.py | 3 +- tools/check_proof_traceability.py | 3 +- tools/generate_canon_tla_projection.py | 128 +- tools/model_check_seed.py | 163 +- tools/run_tlaps.py | 3 +- 24 files changed, 1091 insertions(+), 1660 deletions(-) create mode 100644 docs/architecture/SEED_STATE_MINIMIZATION.md create mode 100644 seed/canonical/decisions/ADR-008-normalize-seed-state-by-construction.md diff --git a/MANIFEST.json b/MANIFEST.json index ad5fab0..12a55e2 100644 --- a/MANIFEST.json +++ b/MANIFEST.json @@ -188,7 +188,7 @@ }, { "path": "audit/ACTIVE_AUDIT_INDEX.json", - "sha256": "sha256:ccb148db338c7f447fa7b200c982e4808fb5d6e56f34b099e0385915fe513c7e", + "sha256": "sha256:6e410436a80d0e672a12e479aee0b85e875a77814041a9d46616c995f5ef8e0f", "size_bytes": 2781 }, { @@ -316,6 +316,11 @@ "sha256": "sha256:d14912b58d582e3a6515bb6332842ae3c3d57ea1947154021d37a34d0cf23b28", "size_bytes": 1277 }, + { + "path": "docs/architecture/SEED_STATE_MINIMIZATION.md", + "sha256": "sha256:33b601825012426108ed03380295096337ad649406970d46109f74b6ae72e86e", + "size_bytes": 2981 + }, { "path": "docs/architecture/TERMINAL_COMMITMENT_ACCUMULATION.md", "sha256": "sha256:2205fb3e83e5709c0900b41f12c136e4d8ccbf95588762b8833e10942f4fc718", @@ -463,33 +468,33 @@ }, { "path": "seed/canonical/CANON_PACKAGE.json", - "sha256": "sha256:52d29ae90734b1978398f15ce79a33487d191dc9b1f0c5dd58295bbf1eaa2658", + "sha256": "sha256:f81e9c80be5ef0a6c2ce79c8bfce27746bb98654955f7697a095502caf70bccc", "size_bytes": 12501 }, { "path": "seed/canonical/README.md", - "sha256": "sha256:1ee05c433e6b42f48daea4319970fdb531efbec5bde04366d7676459d9e07b35", - "size_bytes": 2461 + "sha256": "sha256:1e211f4db5cce375d7a51b7997161a6cb82ade38e103a407af1f2614b64ec49e", + "size_bytes": 2802 }, { "path": "seed/canonical/assurance/canon-tla-refinement.json", - "sha256": "sha256:8d510b7757c1afbfde9ffc808e4a6366a91c9f44368eca94413a0f019b6822e6", - "size_bytes": 6621 + "sha256": "sha256:d29c941ee0dca9fc725c2dcaec0b6a78d661cbe6630726418fc370c79d73ee38", + "size_bytes": 6661 }, { "path": "seed/canonical/assurance/invariant-coverage.json", - "sha256": "sha256:36a8da2d0ef0826c72d8ebe1196ecf65485f310a3e276a95ef72c491ac57461c", - "size_bytes": 14696 + "sha256": "sha256:da7a577b4f160ba5ac436808711f101dd2d9c66509ff1f7772dedc05174b9163", + "size_bytes": 14733 }, { "path": "seed/canonical/assurance/limitations.json", - "sha256": "sha256:76550e4414ee5d8f70a82c57296425bdc72f99f3af4c940223aadae3e66da3f8", + "sha256": "sha256:2b6bbf827dcb12b9674154efebcb6134366c614769b5874a5f4db0cbb81cb25f", "size_bytes": 3803 }, { "path": "seed/canonical/assurance/proof-traceability.json", - "sha256": "sha256:697d40a01f30fc9a14d5f79203c00795bc2126ee0c02878e91f2429547d1791e", - "size_bytes": 6762 + "sha256": "sha256:3c49b80547bf7a148688d49aeaa61a5e2074e14161b5597967613a07b0925609", + "size_bytes": 6944 }, { "path": "seed/canonical/assurance/repository-release-gates.json", @@ -498,8 +503,8 @@ }, { "path": "seed/canonical/assurance/verification-registry.json", - "sha256": "sha256:7a45c470a14c5dd1e55a1b12cd9438b9f43e0170ecdfe817eeb256ee61e225f6", - "size_bytes": 9517 + "sha256": "sha256:a3306079e7c38496063c5e46ec6a464bdf744d1271568963291cb71c08991b19", + "size_bytes": 9887 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-001.json", @@ -671,10 +676,15 @@ "sha256": "sha256:ed0fd693b305cbf93dae3533a348de837e4462bb57e204134a49d2b2c19bb457", "size_bytes": 3136 }, + { + "path": "seed/canonical/decisions/ADR-008-normalize-seed-state-by-construction.md", + "sha256": "sha256:229de9ba5db018f2726ae7e2b23e33a321eb12f4187c7dfffa35773691f2285c", + "size_bytes": 1980 + }, { "path": "seed/canonical/formal/README.md", - "sha256": "sha256:5c2bdf91639aad1277f133a73d8c2ccc0f648e96b31ee14444ace919c81365e1", - "size_bytes": 3264 + "sha256": "sha256:6672e2fecb4e81ac2a538be478f3f67ed7d0a866b8e9f7fc2a23cf636d0d3dc6", + "size_bytes": 4340 }, { "path": "seed/canonical/formal/SeedBootstrap.cfg", @@ -688,13 +698,13 @@ }, { "path": "seed/canonical/formal/SeedCanonProjection.tla", - "sha256": "sha256:696036279144ade00fcc83d59902a2bc4c93b0c16ba81d53606b271501922280", - "size_bytes": 5643 + "sha256": "sha256:26d6508c8c091fc9d204331be627a3a6cdb15600a1eddf4e755d67240da4efd5", + "size_bytes": 3383 }, { "path": "seed/canonical/formal/SeedCanonRefinementProofs.tla", - "sha256": "sha256:869c32d6ddcbd82f107c5093c73ec4d4962dde0e9ce533deb0530d911b70d385", - "size_bytes": 2379 + "sha256": "sha256:2445164299b87a1e819edc5df585cb84d18b8b6817e2b14a5158c79e3dca44d2", + "size_bytes": 2543 }, { "path": "seed/canonical/formal/SeedRC12.cfg", @@ -708,18 +718,18 @@ }, { "path": "seed/canonical/formal/SeedResolution.cfg", - "sha256": "sha256:45b03f914a6b81389fd41afe22b414486047437fe2e8b98617da5bc92c0e9b94", - "size_bytes": 612 + "sha256": "sha256:c5549986cb036f550e0c030a13944e8fb00372c28ccecacc88d84ede2a34d588", + "size_bytes": 731 }, { "path": "seed/canonical/formal/SeedResolution.tla", - "sha256": "sha256:89ae6f8500cedefdb2e4cc1a3939d074b1ccd480766384977115a7bd70290afe", - "size_bytes": 9616 + "sha256": "sha256:8cdbd66db0b4a5fabb38fb1a7739c2a2e3e418ab9bede02d5e49382d4442dd9f", + "size_bytes": 8765 }, { "path": "seed/canonical/formal/SeedResolutionProofs.tla", - "sha256": "sha256:078e123f28fbf012179484c8b559bbc55a6d24200e0b3ecc2b7ba9deeeefcbe3", - "size_bytes": 42571 + "sha256": "sha256:32c9f90bebcb1503f13b41535847ed5b4c16b066143fcf02578b63f627cf3805", + "size_bytes": 26293 }, { "path": "seed/canonical/migration/ALPHA2_TO_0.3_ALPHA1.md", @@ -1048,7 +1058,7 @@ }, { "path": "seed/canonical/schemas/canon-tla-refinement.schema.json", - "sha256": "sha256:ac5d713265a8ec0b6a229252fc5adab2f988da21fa69ff26bea082e3f103b4e4", + "sha256": "sha256:aaba0b7c0cc6a27158318702c87e5396ae2a0951852fcb21094b60d2d1dfccb6", "size_bytes": 6582 }, { @@ -2093,8 +2103,8 @@ }, { "path": "tests/test_ci_assurance.py", - "sha256": "sha256:531cae74d46487a2a9fc8f19e43474368050aec86524c3df9383f64f8b31f895", - "size_bytes": 8532 + "sha256": "sha256:b53064afba5d98de8c77cabd6fb54a85e8567741ca0d722d0a1cbbc47a7ba4df", + "size_bytes": 9103 }, { "path": "tests/test_implementation_conformance_protocol.py", @@ -2153,8 +2163,8 @@ }, { "path": "tools/check_assurance_traceability.py", - "sha256": "sha256:afb10fe7a8dc45d62a505a6071b9dae8a0b142d2ef3b060e970358540b285e21", - "size_bytes": 10270 + "sha256": "sha256:753b76fa5a7293c5bf389a188a264719b51b778f0b53a984fcdc22d32e0fedae", + "size_bytes": 10316 }, { "path": "tools/check_canon_compatibility.py", @@ -2178,13 +2188,13 @@ }, { "path": "tools/check_proof_traceability.py", - "sha256": "sha256:4a8fbf3306ef99da1f73a6c3b829e6a68c9450390726fa7f46ba04e8ed138406", - "size_bytes": 9292 + "sha256": "sha256:53edb5e064e9d9db9a2bb54afb752d098bb60e61815544d401135408249ef957", + "size_bytes": 9369 }, { "path": "tools/generate_canon_tla_projection.py", - "sha256": "sha256:178f45c8c1c88cfc9a7c073b3dad19512d9b19c2f8a1222bbe2e19b74e65f37b", - "size_bytes": 10429 + "sha256": "sha256:c81fadbdf922068a95c67bb3d80f81bdf48ae7deaabb42df0908919711c44597", + "size_bytes": 8140 }, { "path": "tools/generate_editions.py", @@ -2218,8 +2228,8 @@ }, { "path": "tools/model_check_seed.py", - "sha256": "sha256:b9acdb54d70548e83acc799463dc04f338a4ba134097ce5e21400f09082ee86f", - "size_bytes": 11042 + "sha256": "sha256:118d2519eadae60c5105d9506bd69d54fc4acda321ed277b9328230c90081626", + "size_bytes": 10388 }, { "path": "tools/production_gate.py", @@ -2253,8 +2263,8 @@ }, { "path": "tools/run_tlaps.py", - "sha256": "sha256:6cb99f93a34fc462f03b52c4df62d1c32a7ea032039a67aa49be34b01e0cc323", - "size_bytes": 6750 + "sha256": "sha256:860c16d6fe19934f5b04590723671b626c0f5da83e33fc338fc24ee4be225bda", + "size_bytes": 6796 }, { "path": "tools/run_tlc.py", @@ -2312,7 +2322,7 @@ "size_bytes": 1035 } ], - "files_count": 462, + "files_count": 464, "manifest_scope": "all repository regular files except MANIFEST.json, Git metadata, virtual environments, caches and dist", "package": "ASET-Seed-0.3.0-alpha.1-Minimal-Strong-Core", "repository_root": "ASET" diff --git a/audit/ACTIVE_AUDIT_INDEX.json b/audit/ACTIVE_AUDIT_INDEX.json index 508a46f..25b8660 100644 --- a/audit/ACTIVE_AUDIT_INDEX.json +++ b/audit/ACTIVE_AUDIT_INDEX.json @@ -1,6 +1,6 @@ { "active_candidate": { - "canon_package_digest": "sha256:1cdd37e997626a15471b6125dfccf22895b4b104a7239b5c4ced8679165a07f8", + "canon_package_digest": "sha256:ff77a6a022aae70c576613f31ab083778adc27bc7ff5af94363481d77f4161e1", "extension_separation": "COMPLETE", "implementation_precedence": "NONE", "repository_role": "OPEN_IMPLEMENTATION_NEUTRAL_SPECIFICATION", diff --git a/docs/architecture/SEED_STATE_MINIMIZATION.md b/docs/architecture/SEED_STATE_MINIMIZATION.md new file mode 100644 index 0000000..44eb3a7 --- /dev/null +++ b/docs/architecture/SEED_STATE_MINIMIZATION.md @@ -0,0 +1,60 @@ +# Seed state minimization + +## Decision + +The abstract Seed safety state is normalized to three independent variables: + +1. `requestMeta` — a partial function containing immutable request metadata only for registered `resolution_id` values; +2. `terminalMeta` — a partial function containing accepted terminal metadata only for terminal `resolution_id` values; +3. `conflicts` — the only retained environment observation because conflict can + change a previously terminal derived resolution to `UNKNOWN`. + +`LocalAuthorityBindings` and `AuthorityProofBindings` are immutable context +parameters, not mutable Seed state. + +## Removed independent state + +The formal projection no longer stores independent copies of: + +- `requests` — exactly `DOMAIN requestMeta`; +- request/terminal absence sentinels — absence is represented by an identifier not being in the corresponding function domain; +- request binding, request Authority and predecessor maps — normalized into one + request metadata cell (the initial Authority is admission evidence and need not + be duplicated after successful local-root validation); +- terminal binding — derived from immutable request binding; +- terminal Authority/value maps — normalized into one terminal metadata cell; +- invalid-material observations — rejected material cannot become accepted + terminal state, so the abstract resolution state stutters; +- non-authoritative inputs — they have no canonical state slot and therefore + stutter by construction. + +This is a representation strengthening, not a move of guarantees into a +cryptographic accumulator. No Merkle/MMR/hash algorithm is introduced into +Seed. + +## Why this is stronger + +The old projection represented several impossible or undesirable disagreement +states and then proved invariants excluding them. The normalized projection also +uses partial functions instead of mixed sentinel-or-record values, so each +metadata function is homogeneous whenever it is defined. The normalized projection does +not represent those disagreements at all. In particular an accepted terminal +record cannot carry a binding different from its registered request because no +independent terminal-binding state exists. + +The externally visible protocol remains unchanged. Invalid records, digest +mismatches and Authority-proof failures are rejected at the protocol/conformance +boundary before they can enter the accepted abstract state. + +## Formal boundary + +The minimized model keeps explicit proofs for fail-closed resolution, +Authority soundness, fresh reconsideration, terminal immutability, append-only +request identity and recognized-transition state changes. It additionally makes +two boundary properties explicit: + +- invalid material is a semantic stutter in the accepted abstract state; +- non-authoritative input is a semantic stutter and has no retained state slot. + +Concrete cryptography, terminal-commitment accumulators, persistence and +implementation refinement remain separate profiles. diff --git a/seed/canonical/CANON_PACKAGE.json b/seed/canonical/CANON_PACKAGE.json index 8b4cd6c..b1a2306 100644 --- a/seed/canonical/CANON_PACKAGE.json +++ b/seed/canonical/CANON_PACKAGE.json @@ -50,11 +50,11 @@ }, { "path": "seed/canonical/assurance/verification-registry.json", - "sha256": "sha256:7a45c470a14c5dd1e55a1b12cd9438b9f43e0170ecdfe817eeb256ee61e225f6" + "sha256": "sha256:a3306079e7c38496063c5e46ec6a464bdf744d1271568963291cb71c08991b19" }, { "path": "seed/canonical/assurance/invariant-coverage.json", - "sha256": "sha256:36a8da2d0ef0826c72d8ebe1196ecf65485f310a3e276a95ef72c491ac57461c" + "sha256": "sha256:da7a577b4f160ba5ac436808711f101dd2d9c66509ff1f7772dedc05174b9163" }, { "path": "seed/canonical/schemas/invariant-coverage.schema.json", @@ -62,7 +62,7 @@ }, { "path": "seed/canonical/assurance/proof-traceability.json", - "sha256": "sha256:697d40a01f30fc9a14d5f79203c00795bc2126ee0c02878e91f2429547d1791e" + "sha256": "sha256:3c49b80547bf7a148688d49aeaa61a5e2074e14161b5597967613a07b0925609" }, { "path": "seed/canonical/schemas/proof-traceability.schema.json", @@ -70,15 +70,15 @@ }, { "path": "seed/canonical/assurance/canon-tla-refinement.json", - "sha256": "sha256:8d510b7757c1afbfde9ffc808e4a6366a91c9f44368eca94413a0f019b6822e6" + "sha256": "sha256:d29c941ee0dca9fc725c2dcaec0b6a78d661cbe6630726418fc370c79d73ee38" }, { "path": "seed/canonical/schemas/canon-tla-refinement.schema.json", - "sha256": "sha256:ac5d713265a8ec0b6a229252fc5adab2f988da21fa69ff26bea082e3f103b4e4" + "sha256": "sha256:aaba0b7c0cc6a27158318702c87e5396ae2a0951852fcb21094b60d2d1dfccb6" }, { "path": "seed/canonical/assurance/limitations.json", - "sha256": "sha256:76550e4414ee5d8f70a82c57296425bdc72f99f3af4c940223aadae3e66da3f8" + "sha256": "sha256:2b6bbf827dcb12b9674154efebcb6134366c614769b5874a5f4db0cbb81cb25f" }, { "path": "seed/canonical/schemas/assurance-limitations.schema.json", @@ -98,23 +98,23 @@ }, { "path": "seed/canonical/formal/SeedResolution.tla", - "sha256": "sha256:89ae6f8500cedefdb2e4cc1a3939d074b1ccd480766384977115a7bd70290afe" + "sha256": "sha256:8cdbd66db0b4a5fabb38fb1a7739c2a2e3e418ab9bede02d5e49382d4442dd9f" }, { "path": "seed/canonical/formal/SeedResolutionProofs.tla", - "sha256": "sha256:078e123f28fbf012179484c8b559bbc55a6d24200e0b3ecc2b7ba9deeeefcbe3" + "sha256": "sha256:32c9f90bebcb1503f13b41535847ed5b4c16b066143fcf02578b63f627cf3805" }, { "path": "seed/canonical/formal/SeedCanonProjection.tla", - "sha256": "sha256:696036279144ade00fcc83d59902a2bc4c93b0c16ba81d53606b271501922280" + "sha256": "sha256:26d6508c8c091fc9d204331be627a3a6cdb15600a1eddf4e755d67240da4efd5" }, { "path": "seed/canonical/formal/SeedCanonRefinementProofs.tla", - "sha256": "sha256:869c32d6ddcbd82f107c5093c73ec4d4962dde0e9ce533deb0530d911b70d385" + "sha256": "sha256:2445164299b87a1e819edc5df585cb84d18b8b6817e2b14a5158c79e3dca44d2" }, { "path": "seed/canonical/formal/SeedResolution.cfg", - "sha256": "sha256:45b03f914a6b81389fd41afe22b414486047437fe2e8b98617da5bc92c0e9b94" + "sha256": "sha256:c5549986cb036f550e0c030a13944e8fb00372c28ccecacc88d84ede2a34d588" }, { "path": "seed/canonical/migration/ALPHA2_TO_0.3_ALPHA1_CHANGE_DECLARATION.json", @@ -279,6 +279,6 @@ ], "implementation_precedence": "NONE", "normative_source": "seed/canonical/source/seed-model.json", - "package_digest": "sha256:1cdd37e997626a15471b6125dfccf22895b4b104a7239b5c4ced8679165a07f8", + "package_digest": "sha256:ff77a6a022aae70c576613f31ab083778adc27bc7ff5af94363481d77f4161e1", "schema_version": 2 } diff --git a/seed/canonical/README.md b/seed/canonical/README.md index c94be9e..b9471f0 100644 --- a/seed/canonical/README.md +++ b/seed/canonical/README.md @@ -25,16 +25,22 @@ The published safety contract has complete machine traceability: - 12/12 canonical requirements covered; - 12/12 canonical invariants covered; - 3/3 transitions covered positively and negatively; -- 15 bounded TLA+/TLC properties; -- 15/15 registered TLA+/TLC safety properties covered by unbounded TLAPS proof; +- 16 bounded TLA+/TLC properties; +- 16/16 registered TLA+/TLC safety properties covered by unbounded TLAPS proof; - 4 exact executable-or-static properties; - 24 portable conformance cases; - 13 semantic mutations, all required to be killed. The unbounded safety proof applies to the committed abstract TLA+ safety -projection. It establishes all eleven registered state invariants and all four +projection. It establishes all eleven registered state invariants and all five registered temporal safety properties for every behaviour of `Spec`. +The abstract formal projection is normalized to three state variables +(`requestMeta`, `terminalMeta`, `conflicts`). Authority relations are immutable +context constants; exact terminal binding is derived from request metadata; +invalid material and non-authoritative inputs have no retained state slot and +are proved to be semantic stutters. + The canon-to-TLA assurance adds a second proof layer. `SeedCanonProjection.tla` is generated deterministically from the exact `seed-model.json` identity under a versioned projection profile, and TLAPS diff --git a/seed/canonical/assurance/canon-tla-refinement.json b/seed/canonical/assurance/canon-tla-refinement.json index ae6725b..a621d16 100644 --- a/seed/canonical/assurance/canon-tla-refinement.json +++ b/seed/canonical/assurance/canon-tla-refinement.json @@ -13,11 +13,11 @@ "id": "TERMINAL_COMMITMENT_ORACLE" }, { - "description": "Conflict, invalid-material and non-authoritative-input observations are modeled as environment bookkeeping actions outside the three canonical command kinds.", + "description": "Conflict remains explicit because it changes derived resolution; invalid-material and non-authoritative-input observations are separate semantic stutters with no retained canonical state component.", "id": "ENVIRONMENT_OBSERVATION" } ], - "claim_boundary": "The proof establishes behavioral equivalence between SeedResolution.tla and a deterministic TLA+ projection generated from the exact machine-readable Seed model under ASET-SEED-CANON-TLA-PROJECTION-V2. It is not a proof that every natural-language sentence, cryptographic construction, opaque binding representation, concrete Authority-proof implementation, terminal-commitment provenance mechanism, storage compaction, or implementation refinement is fully verified by the TLA+ model. The deterministic projection generator is part of the assurance trusted computing base; this proof does not itself verify the generator implementation.", + "claim_boundary": "The proof establishes behavioral equivalence between SeedResolution.tla and a deterministic TLA+ projection generated from the exact machine-readable Seed model under ASET-SEED-CANON-TLA-PROJECTION-V3. It is not a proof that every natural-language sentence, cryptographic construction, opaque binding representation, concrete Authority-proof implementation, terminal-commitment provenance mechanism, storage compaction, or implementation refinement is fully verified by the TLA+ model. The deterministic projection generator is part of the assurance trusted computing base; this proof does not itself verify the generator implementation.", "document_type": "aset-canon-tla-refinement", "excluded_claims": [ "natural-language-text equivalence", @@ -33,7 +33,7 @@ "generator": "tools/generate_canon_tla_projection.py", "module": "SeedCanonProjection", "path": "seed/canonical/formal/SeedCanonProjection.tla", - "profile": "ASET-SEED-CANON-TLA-PROJECTION-V2" + "profile": "ASET-SEED-CANON-TLA-PROJECTION-V3" }, "invariant_coverage": [ { @@ -173,7 +173,7 @@ "target_model": { "module": "SeedResolution", "path": "seed/canonical/formal/SeedResolution.tla", - "sha256": "sha256:89ae6f8500cedefdb2e4cc1a3939d074b1ccd480766384977115a7bd70290afe" + "sha256": "sha256:8cdbd66db0b4a5fabb38fb1a7739c2a2e3e418ab9bede02d5e49382d4442dd9f" }, "transition_coverage": [ { diff --git a/seed/canonical/assurance/invariant-coverage.json b/seed/canonical/assurance/invariant-coverage.json index b95238f..5a35435 100644 --- a/seed/canonical/assurance/invariant-coverage.json +++ b/seed/canonical/assurance/invariant-coverage.json @@ -5,7 +5,7 @@ "all twelve canonical safety invariants have formal properties, conformance cases and semantic mutations", "all three canonical transitions have positive and negative conformance coverage", "bounded state and transition preservation for the published finite model", - "all fifteen registered TLA/TLC safety properties have unbounded TLAPS deductive closure over the abstract projection", + "all sixteen registered TLA/TLC safety properties have unbounded TLAPS deductive closure over the abstract projection", "source-locked generated canonical projection with TLAPS-proved behavioral equivalence to SeedResolution.tla under the declared abstraction profile" ], "not_claimed": [ @@ -77,7 +77,7 @@ "RES-NEG-006" ], "formal_properties": [ - "ExactBinding", + "TerminalBindingDerived", "CanonicalDigestIdentity" ], "id": "SEED-INV-004", @@ -126,7 +126,7 @@ ], "formal_properties": [ "InputsNonAuthoritative", - "ObservedInputsAppendOnly" + "NonAuthoritativeInputsStutter" ], "id": "SEED-INV-007", "semantic_mutations": [ @@ -154,7 +154,8 @@ ], "formal_properties": [ "FailClosed", - "InvalidOrConflictUnknown" + "ConflictUnknown", + "InvalidMaterialStutter" ], "id": "SEED-INV-009", "semantic_mutations": [ @@ -396,7 +397,7 @@ ], "formal_properties": [ "TypeOK", - "ExactBinding", + "TerminalBindingDerived", "CanonicalDigestIdentity" ], "id": "ASET-SEED-REQ-001", @@ -469,7 +470,7 @@ ], "formal_properties": [ "FailClosed", - "InvalidOrConflictUnknown" + "ConflictUnknown" ], "id": "ASET-SEED-REQ-005", "invariants": [ @@ -527,7 +528,7 @@ ], "formal_properties": [ "InputsNonAuthoritative", - "ObservedInputsAppendOnly" + "NonAuthoritativeInputsStutter" ], "id": "ASET-SEED-REQ-008", "invariants": [ @@ -544,7 +545,7 @@ ], "formal_properties": [ "TerminalUnique", - "InvalidOrConflictUnknown" + "ConflictUnknown" ], "id": "ASET-SEED-REQ-009", "invariants": [ diff --git a/seed/canonical/assurance/limitations.json b/seed/canonical/assurance/limitations.json index 787bfa1..6fddd4f 100644 --- a/seed/canonical/assurance/limitations.json +++ b/seed/canonical/assurance/limitations.json @@ -24,7 +24,7 @@ }, { "closure_criteria": "Keep the pinned TLAPS gate passing for the exact committed formal model and proof-module identities.", - "description": "The abstract TLA+ Seed safety projection has an unbounded deductive proof covering all eleven registered state invariants and all four registered temporal safety properties.", + "description": "The abstract TLA+ Seed safety projection has an unbounded deductive proof covering all eleven registered state invariants and all five registered temporal safety properties.", "id": "LIMIT-004", "scope": "abstract-tla-safety-proof", "status": "CLOSED" diff --git a/seed/canonical/assurance/proof-traceability.json b/seed/canonical/assurance/proof-traceability.json index 08e83b6..b854e5c 100644 --- a/seed/canonical/assurance/proof-traceability.json +++ b/seed/canonical/assurance/proof-traceability.json @@ -67,7 +67,7 @@ }, { "kind": "STATE_INVARIANT", - "operator": "ExactBinding", + "operator": "TerminalBindingDerived", "proof_theorem": "SpecImpliesAlwaysSeedStateSafety" } ], @@ -124,8 +124,8 @@ }, { "kind": "TEMPORAL_PROPERTY", - "operator": "ObservedInputsAppendOnly", - "proof_theorem": "SpecImpliesObservedInputsAppendOnly" + "operator": "NonAuthoritativeInputsStutter", + "proof_theorem": "SpecImpliesNonAuthoritativeInputsStutter" } ], "id": "ASET-PROOF-INV-007", @@ -163,8 +163,13 @@ }, { "kind": "STATE_INVARIANT", - "operator": "InvalidOrConflictUnknown", + "operator": "ConflictUnknown", "proof_theorem": "SpecImpliesAlwaysSeedStateSafety" + }, + { + "kind": "TEMPORAL_PROPERTY", + "operator": "InvalidMaterialStutter", + "proof_theorem": "SpecImpliesInvalidMaterialStutter" } ], "id": "ASET-PROOF-INV-009", diff --git a/seed/canonical/assurance/verification-registry.json b/seed/canonical/assurance/verification-registry.json index f5a1d6c..4b8d507 100644 --- a/seed/canonical/assurance/verification-registry.json +++ b/seed/canonical/assurance/verification-registry.json @@ -1,5 +1,5 @@ { - "claim_boundary": "Registry membership proves complete machine traceability for the published minimal Seed safety contract. The committed abstract TLA+ projection has bounded TLC coverage and an unbounded TLAPS deductive proof of all eleven registered state invariants and four registered temporal safety properties. A source-locked generated canonical TLA+ projection is machine-checked against the exact seed-model.json identity, and TLAPS proves behavioral equivalence between that declared projection and SeedResolution.tla. Opaque Binding construction, concrete Authority grant-chain construction, cryptographic primitive security, implementation refinement, liveness, implementation correctness and external certification are not claimed.", + "claim_boundary": "Registry membership proves complete machine traceability for the published minimal Seed safety contract. The committed abstract TLA+ projection has bounded TLC coverage and an unbounded TLAPS deductive proof of all eleven registered state invariants and five registered temporal safety properties over the normalized three-variable state. A source-locked generated canonical TLA+ projection is machine-checked against the exact seed-model.json identity, and TLAPS proves behavioral equivalence between that declared projection and SeedResolution.tla. Opaque Binding construction, concrete Authority grant-chain construction, cryptographic primitive security, implementation refinement, liveness, implementation correctness and external certification are not claimed.", "document_type": "aset-seed-verification-registry", "formal_properties": [ { @@ -56,8 +56,8 @@ { "engine": "TLA_TLC", "kind": "STATE_INVARIANT", - "name": "ExactBinding", - "projection_status": "BOUNDED_ABSTRACTION", + "name": "TerminalBindingDerived", + "projection_status": "STRUCTURAL_BY_CONSTRUCTION", "seed_invariants": [ "SEED-INV-004" ], @@ -93,7 +93,7 @@ "engine": "TLA_TLC", "kind": "STATE_INVARIANT", "name": "InputsNonAuthoritative", - "projection_status": "BOUNDED_ABSTRACTION", + "projection_status": "STRUCTURAL_NO_STATE_SLOT", "seed_invariants": [ "SEED-INV-007" ], @@ -116,7 +116,7 @@ { "engine": "TLA_TLC", "kind": "STATE_INVARIANT", - "name": "InvalidOrConflictUnknown", + "name": "ConflictUnknown", "projection_status": "BOUNDED_ABSTRACTION", "seed_invariants": [ "SEED-INV-009" @@ -177,8 +177,8 @@ { "engine": "TLA_TLC", "kind": "TEMPORAL_PROPERTY", - "name": "ObservedInputsAppendOnly", - "projection_status": "BOUNDED_ABSTRACTION", + "name": "NonAuthoritativeInputsStutter", + "projection_status": "STRUCTURAL_STUTTER_ABSTRACTION", "seed_invariants": [ "SEED-INV-007" ], @@ -186,6 +186,18 @@ "ASET-SEED-REQ-008" ] }, + { + "engine": "TLA_TLC", + "kind": "TEMPORAL_PROPERTY", + "name": "InvalidMaterialStutter", + "projection_status": "STRUCTURAL_STUTTER_ABSTRACTION", + "seed_invariants": [ + "SEED-INV-009" + ], + "seed_requirements": [ + "ASET-SEED-REQ-005" + ] + }, { "engine": "EXECUTABLE_ORACLE", "kind": "STATIC_AND_EXECUTABLE_PROPERTY", diff --git a/seed/canonical/decisions/ADR-008-normalize-seed-state-by-construction.md b/seed/canonical/decisions/ADR-008-normalize-seed-state-by-construction.md new file mode 100644 index 0000000..49d887d --- /dev/null +++ b/seed/canonical/decisions/ADR-008-normalize-seed-state-by-construction.md @@ -0,0 +1,43 @@ +# ADR-008 — Normalize Seed state by construction + +## Status + +Accepted for the abstract Seed 0.3 safety projection. This ADR does not change +the normative wire/protocol contract in `seed-model.json`; it reduces the +formal representation while preserving its observable resolution semantics. + +## Context + +The previous TLA+ projection used twelve mutable variables, including parallel +request/terminal binding and Authority maps plus bookkeeping for invalid and +non-authoritative observations. Several invariants existed primarily to prove +that duplicated fields stayed equal or that stored observations had no effect. + +## Decision + +Use three mutable formal variables: `requestMeta`, `terminalMeta`, and +`conflicts`. + +Make local/validated Authority-binding relations immutable context constants. +Represent `requestMeta` and `terminalMeta` as partial functions and derive +request/terminal membership directly from their domains. No `NoRequest` or +`NoTerminal` sentinel is retained. Do not store an independent +terminal binding; derive it from the immutable request binding. Model invalid +material and non-authoritative inputs as explicit stuttering observations. + +## Consequences + +- metadata absence is represented structurally by function-domain absence, so + sentinel/record type disagreement is unrepresentable; +- exact-binding disagreement is unrepresentable after admission; +- initial local Authority need not be duplicated in mutable state after the + local-root check; +- terminal uniqueness follows from one keyed terminal metadata cell; +- invalid/non-authoritative observation bookkeeping no longer grows state; +- conflict remains explicit because it changes `ResolutionOf` to `UNKNOWN`; +- the formal state space and proof surface are reduced without adding crypto or + accumulator assumptions. + +The executable protocol oracle remains responsible for concrete digest, +record-binding and Authority-proof validation before a candidate becomes an +accepted abstract transition. diff --git a/seed/canonical/formal/README.md b/seed/canonical/formal/README.md index 6cd6ba8..a1dfe22 100644 --- a/seed/canonical/formal/README.md +++ b/seed/canonical/formal/README.md @@ -7,21 +7,36 @@ The model covers: - the closed resolution domain `UNKNOWN | ALLOW | BLOCK`; - sound and fail-closed effect permission; -- exact request/record binding; +- exact request/record binding by construction: accepted terminal state derives binding from immutable request metadata; - local Authority roots; - an abstract validated delegated-Authority predicate; -- non-authoritative external inputs; -- conflict and invalid-material handling; +- non-authoritative external inputs as explicit semantic stutters with no retained state slot; +- explicit conflict handling and invalid-material admission as a semantic stutter; - fresh reconsideration through recognized immutable terminal commitments without predecessor-object retention; -- append-only requests and inputs; +- append-only request identity; - immutable terminal records; - exclusion of invalid or unrecognized candidates from the Seed transition relation; - canonical-state changes only through recognized Seed transitions. `SeedResolution.cfg` drives bounded TLC checking of eleven state invariants -and four temporal safety properties. The Python bounded explorer checks the +and five temporal safety properties. The Python bounded explorer checks the same registered property names and validates bounded transition preservation. + +The formal state is intentionally normalized to three variables: + +- `requestMeta`: a partial function containing one immutable metadata cell per registered `resolution_id`; +- `terminalMeta`: a partial function containing one accepted metadata cell per terminal `resolution_id`; +- `conflicts`: the only retained environment observation because it changes resolution semantics. + +`LocalAuthorityBindings` and `AuthorityProofBindings` are immutable context +constants. `requestBinding`, `requestAuthority`, `terminalBinding`, +`terminalAuthority`, `invalidMaterial` and `observedInputs` are not independent +state components. `Requests` and `TerminalRequests` are the domains of the two +metadata functions; absence uses no sentinel value. This removes representable +disagreement and mixed-type states instead of merely adding invariants that forbid +them. + `SeedResolutionProofs.tla` provides the unbounded deductive safety layer. Its final theorems establish: @@ -29,7 +44,8 @@ Its final theorems establish: - `Spec => RequestsAppendOnly`; - `Spec => TerminalRecordsImmutable`; - `Spec => CanonicalStateChangesOnlyByRecognizedTransition`; -- `Spec => ObservedInputsAppendOnly`. +- `Spec => InvalidMaterialStutter`; +- `Spec => NonAuthoritativeInputsStutter`. The proof uses a strengthened inductive invariant containing the auxiliary reachability property that a terminal record can exist only for a registered @@ -45,7 +61,7 @@ membership/update witnesses and retention are profile-level concerns. `SeedCanonProjection.tla` is a deterministic generated interpretation of the exact machine-readable Seed identity under -`ASET-SEED-CANON-TLA-PROJECTION-V2`. `SeedCanonRefinementProofs.tla` proves +`ASET-SEED-CANON-TLA-PROJECTION-V3`. `SeedCanonRefinementProofs.tla` proves behavioral equivalence between that generated projection and `SeedResolution.tla`. Projection parity and source/target digests are mandatory release checks. diff --git a/seed/canonical/formal/SeedCanonProjection.tla b/seed/canonical/formal/SeedCanonProjection.tla index cad589a..c0dbe47 100644 --- a/seed/canonical/formal/SeedCanonProjection.tla +++ b/seed/canonical/formal/SeedCanonProjection.tla @@ -5,12 +5,12 @@ EXTENDS SeedResolution GENERATED FILE. DO NOT EDIT. Source: seed/canonical/source/seed-model.json Source SHA-256: sha256:b5e68692317600fd2833474a1f9c31f09e44d37ae92ec14573b416076c5dd7f6 -Projection profile: ASET-SEED-CANON-TLA-PROJECTION-V2 +Projection profile: ASET-SEED-CANON-TLA-PROJECTION-V3 -This module is the deterministic TLA+ interpretation used by the -canon-to-TLA refinement assurance. It intentionally preserves the declared -opaque Binding, authorityProofBindings and RecognizedTerminalCommitments -abstractions. +V3 projects the same canonical behavior onto the normalized three-variable +Seed state. Immutable Authority relations are context constants. Accepted +terminal binding is derived from requestMeta; invalid/non-authoritative inputs +are stuttering observations rather than retained canonical state. *) CanonResolutions == {"UNKNOWN", "ALLOW", "BLOCK"} @@ -21,129 +21,81 @@ CanonFailClosedValues == {"UNKNOWN", "BLOCK"} CanonConflictResult == "UNKNOWN" CanonInit == - /\ localAuthorityBindings \in SUBSET (Authorities \X Bindings) - /\ authorityProofBindings \in SUBSET (Authorities \X Bindings) - /\ localAuthorityBindings \subseteq authorityProofBindings - /\ requests = {} - /\ requestBinding = [r \in ResolutionIds |-> CHOOSE b \in Bindings : TRUE] - /\ requestAuthority = [r \in ResolutionIds |-> CHOOSE a \in Authorities : TRUE] - /\ previousResolutionCommitment = [r \in ResolutionIds |-> NoCommitment] - /\ terminalRecord = [r \in ResolutionIds |-> NoRecord] - /\ terminalBinding = [r \in ResolutionIds |-> CHOOSE b \in Bindings : TRUE] - /\ terminalAuthority = [r \in ResolutionIds |-> CHOOSE a \in Authorities : TRUE] + /\ requestMeta = [r \in {} |-> r] + /\ terminalMeta = [r \in {} |-> r] /\ conflicts = {} - /\ invalidMaterial = {} - /\ observedInputs = {} CanonRegisterRequest(r, b, a, previous) == - /\ r \in ResolutionIds \ requests + /\ r \in ResolutionIds \ Requests /\ b \in Bindings /\ a \in Authorities - /\ <> \in localAuthorityBindings + /\ <> \in LocalAuthorityBindings /\ \/ previous = NoCommitment \/ previous \in RecognizedTerminalCommitments - /\ requests' = requests \cup {r} - /\ requestBinding' = [requestBinding EXCEPT ![r] = b] - /\ requestAuthority' = [requestAuthority EXCEPT ![r] = a] - /\ previousResolutionCommitment' = [previousResolutionCommitment EXCEPT ![r] = previous] - /\ UNCHANGED <> + /\ requestMeta' = + [x \in Requests \cup {r} |-> + IF x = r + THEN [binding |-> b, previous |-> previous] + ELSE requestMeta[x]] + /\ UNCHANGED <> CanonSubmitResolution(r, b, a, value) == - /\ r \in requests - /\ b = requestBinding[r] + /\ r \in Requests + /\ b = RequestBinding(r) /\ a \in Authorities - /\ <> \in authorityProofBindings + /\ <> \in AuthorityProofBindings /\ value \in CanonTerminalResolutions - /\ terminalRecord[r] = NoRecord + /\ r \notin TerminalRequests /\ r \notin conflicts - /\ terminalRecord' = [terminalRecord EXCEPT ![r] = value] - /\ terminalBinding' = [terminalBinding EXCEPT ![r] = b] - /\ terminalAuthority' = [terminalAuthority EXCEPT ![r] = a] - /\ UNCHANGED <> + /\ terminalMeta' = + [x \in TerminalRequests \cup {r} |-> + IF x = r + THEN [resolution |-> value, authority |-> a] + ELSE terminalMeta[x]] + /\ UNCHANGED <> CanonObserveConflict(r) == /\ r \in ResolutionIds /\ conflicts' = conflicts \cup {r} - /\ UNCHANGED <> + /\ UNCHANGED <> CanonObserveInvalidMaterial(r) == /\ r \in ResolutionIds - /\ invalidMaterial' = invalidMaterial \cup {r} - /\ UNCHANGED <> + /\ UNCHANGED vars CanonObserveNonAuthoritativeInput(r) == /\ r \in ResolutionIds - /\ observedInputs' = observedInputs \cup {r} - /\ UNCHANGED <> + /\ UNCHANGED vars CanonEvaluate == UNCHANGED vars -CanonRecognizedCanonicalTransition == +CanonRecognizedSeedTransition == \/ \E r \in ResolutionIds, b \in Bindings, a \in Authorities, previous \in TerminalCommitments \cup {NoCommitment} : CanonRegisterRequest(r, b, a, previous) \/ \E r \in ResolutionIds, b \in Bindings, a \in Authorities, value \in CanonTerminalResolutions : CanonSubmitResolution(r, b, a, value) + +CanonRecognizedEnvironmentTransition == \/ \E r \in ResolutionIds : CanonObserveConflict(r) \/ \E r \in ResolutionIds : CanonObserveInvalidMaterial(r) \/ \E r \in ResolutionIds : CanonObserveNonAuthoritativeInput(r) +CanonRecognizedCanonicalTransition == + \/ CanonRecognizedSeedTransition + \/ CanonRecognizedEnvironmentTransition + CanonNext == \/ CanonRecognizedCanonicalTransition \/ CanonEvaluate CanonResolutionOf(r) == - IF r \notin requests \/ r \in conflicts + IF r \notin Requests \/ r \in conflicts THEN CanonConflictResult - ELSE IF terminalRecord[r] = NoRecord + ELSE IF r \notin TerminalRequests THEN CanonDerivedResolution - ELSE terminalRecord[r] + ELSE TerminalResolution(r) CanonEffectPermitted(r) == CanonResolutionOf(r) = CanonEffectPermittedValue diff --git a/seed/canonical/formal/SeedCanonRefinementProofs.tla b/seed/canonical/formal/SeedCanonRefinementProofs.tla index 23ef8c9..bf652fa 100644 --- a/seed/canonical/formal/SeedCanonRefinementProofs.tla +++ b/seed/canonical/formal/SeedCanonRefinementProofs.tla @@ -3,10 +3,10 @@ EXTENDS SeedCanonProjection, TLAPS (* This proof establishes equivalence between SeedResolution and the generated -canonical projection for ASET-SEED-CANON-TLA-PROJECTION-V2. +canonical projection for ASET-SEED-CANON-TLA-PROJECTION-V3. The theorem is intentionally limited to the declared projection. Opaque -Bindings, authorityProofBindings and RecognizedTerminalCommitments remain +Bindings, AuthorityProofBindings and RecognizedTerminalCommitments remain abstractions; cryptographic digest construction, concrete Authority grant-chain construction, terminal-commitment provenance, storage-compaction refinement, natural-language text equivalence, implementation refinement and liveness are @@ -56,6 +56,10 @@ PROOF CanonNext, RecognizedCanonicalTransition, CanonRecognizedCanonicalTransition, + RecognizedSeedTransition, + CanonRecognizedSeedTransition, + RecognizedEnvironmentTransition, + CanonRecognizedEnvironmentTransition, RegisterRequest, CanonRegisterRequest, SubmitResolution, diff --git a/seed/canonical/formal/SeedResolution.cfg b/seed/canonical/formal/SeedResolution.cfg index f79de44..57366a4 100644 --- a/seed/canonical/formal/SeedResolution.cfg +++ b/seed/canonical/formal/SeedResolution.cfg @@ -5,7 +5,8 @@ CONSTANTS TerminalCommitments = {c1, c2} RecognizedTerminalCommitments = {c1, c2} NoCommitment = noCommitment - NoRecord = noRecord + LocalAuthorityBindings <- TLC_LocalAuthorityBindings + AuthorityProofBindings <- TLC_AuthorityProofBindings SPECIFICATION Spec INVARIANTS @@ -13,16 +14,17 @@ INVARIANTS ResolutionDomain AllowSoundness FailClosed - ExactBinding + TerminalBindingDerived LocalAuthorityRoot DelegatedAuthoritySound InputsNonAuthoritative TerminalUnique - InvalidOrConflictUnknown + ConflictUnknown FreshReconsideration PROPERTIES RequestsAppendOnly TerminalRecordsImmutable CanonicalStateChangesOnlyByRecognizedTransition - ObservedInputsAppendOnly + InvalidMaterialStutter + NonAuthoritativeInputsStutter CHECK_DEADLOCK FALSE diff --git a/seed/canonical/formal/SeedResolution.tla b/seed/canonical/formal/SeedResolution.tla index 6a8bb82..11973d2 100644 --- a/seed/canonical/formal/SeedResolution.tla +++ b/seed/canonical/formal/SeedResolution.tla @@ -2,208 +2,169 @@ EXTENDS FiniteSets CONSTANTS ResolutionIds, Bindings, Authorities, TerminalCommitments, - RecognizedTerminalCommitments, NoCommitment, NoRecord + RecognizedTerminalCommitments, NoCommitment, + LocalAuthorityBindings, AuthorityProofBindings ASSUME ResolutionIds # {} ASSUME Bindings # {} ASSUME Authorities # {} ASSUME RecognizedTerminalCommitments \subseteq TerminalCommitments ASSUME NoCommitment \notin TerminalCommitments -ASSUME NoRecord \notin {"ALLOW", "BLOCK"} +ASSUME LocalAuthorityBindings \subseteq Authorities \X Bindings +ASSUME AuthorityProofBindings \subseteq Authorities \X Bindings +ASSUME LocalAuthorityBindings \subseteq AuthorityProofBindings Resolutions == {"UNKNOWN", "ALLOW", "BLOCK"} TerminalResolutions == {"ALLOW", "BLOCK"} +RequestMetaType == + [binding : Bindings, + previous : TerminalCommitments \cup {NoCommitment}] + +TerminalMetaType == + [resolution : TerminalResolutions, + authority : Authorities] + +(* +Bounded TLC fixture values for relation-valued constants. TLC configuration +files accept simple values and sets of simple values, but not tuple-valued set +literals. These operators are used only through cfg definition overrides; they +do not participate in the normative Seed transition semantics or TLAPS proofs. +The bounded cfg supplies exactly two Authorities and two Bindings. +*) +TLC_Authority1 == CHOOSE a \in Authorities : TRUE +TLC_Authority2 == CHOOSE a \in Authorities \ {TLC_Authority1} : TRUE +TLC_Binding1 == CHOOSE b \in Bindings : TRUE +TLC_Binding2 == CHOOSE b \in Bindings \ {TLC_Binding1} : TRUE + +TLC_LocalAuthorityBindings == + {<>, + <>} + +TLC_AuthorityProofBindings == + TLC_LocalAuthorityBindings \cup + {<>} + (* -The formal model is a bounded safety projection of the minimal Seed kernel. -Authority-proof construction is abstracted as the static relation -`authorityProofBindings`; recognized prior terminal-record commitments are -abstracted as `RecognizedTerminalCommitments`. The executable oracle and -conformance corpus validate the corresponding concrete evidence boundaries. +Minimal abstract state. + +The two Authority relations are immutable context parameters rather than state: +Seed has no transition that mutates them. Request identity is represented once +in requestMeta; terminal state stores only facts that are not derivable from the +request. Consequently an accepted terminal binding cannot diverge from the +registered binding because there is no independent terminal-binding field. + +Invalid material and non-authoritative inputs have no canonical state component. +They are modeled as explicit stuttering observations. Conflict is retained +because it changes the derived resolution to UNKNOWN even after a terminal +record exists. *) VARIABLES - localAuthorityBindings, - authorityProofBindings, - requests, - requestBinding, - requestAuthority, - previousResolutionCommitment, - terminalRecord, - terminalBinding, - terminalAuthority, - conflicts, - invalidMaterial, - observedInputs - -canonicalVars == - <> - -vars == - <> + requestMeta, + terminalMeta, + conflicts + +canonicalVars == <> +vars == canonicalVars + +Requests == DOMAIN requestMeta +TerminalRequests == DOMAIN terminalMeta + +RequestBinding(r) == requestMeta[r].binding +PreviousCommitment(r) == requestMeta[r].previous +TerminalResolution(r) == terminalMeta[r].resolution +TerminalAuthority(r) == terminalMeta[r].authority + +(* Binding of an accepted terminal record is derived from its immutable request. *) +TerminalBinding(r) == RequestBinding(r) Init == - /\ localAuthorityBindings \in SUBSET (Authorities \X Bindings) - /\ authorityProofBindings \in SUBSET (Authorities \X Bindings) - /\ localAuthorityBindings \subseteq authorityProofBindings - /\ requests = {} - /\ requestBinding = [r \in ResolutionIds |-> CHOOSE b \in Bindings : TRUE] - /\ requestAuthority = [r \in ResolutionIds |-> CHOOSE a \in Authorities : TRUE] - /\ previousResolutionCommitment = [r \in ResolutionIds |-> NoCommitment] - /\ terminalRecord = [r \in ResolutionIds |-> NoRecord] - /\ terminalBinding = [r \in ResolutionIds |-> CHOOSE b \in Bindings : TRUE] - /\ terminalAuthority = [r \in ResolutionIds |-> CHOOSE a \in Authorities : TRUE] + /\ requestMeta = [r \in {} |-> r] + /\ terminalMeta = [r \in {} |-> r] /\ conflicts = {} - /\ invalidMaterial = {} - /\ observedInputs = {} RegisterRequest(r, b, a, previous) == - /\ r \in ResolutionIds \ requests + /\ r \in ResolutionIds \ Requests /\ b \in Bindings /\ a \in Authorities - /\ <> \in localAuthorityBindings + /\ <> \in LocalAuthorityBindings /\ \/ previous = NoCommitment \/ previous \in RecognizedTerminalCommitments - /\ requests' = requests \cup {r} - /\ requestBinding' = [requestBinding EXCEPT ![r] = b] - /\ requestAuthority' = [requestAuthority EXCEPT ![r] = a] - /\ previousResolutionCommitment' = [previousResolutionCommitment EXCEPT ![r] = previous] - /\ UNCHANGED <> + /\ requestMeta' = + [x \in Requests \cup {r} |-> + IF x = r + THEN [binding |-> b, previous |-> previous] + ELSE requestMeta[x]] + /\ UNCHANGED <> SubmitResolution(r, b, a, value) == - /\ r \in requests - /\ b = requestBinding[r] + /\ r \in Requests + /\ b = RequestBinding(r) /\ a \in Authorities - /\ <> \in authorityProofBindings + /\ <> \in AuthorityProofBindings /\ value \in TerminalResolutions - /\ terminalRecord[r] = NoRecord + /\ r \notin TerminalRequests /\ r \notin conflicts - /\ terminalRecord' = [terminalRecord EXCEPT ![r] = value] - /\ terminalBinding' = [terminalBinding EXCEPT ![r] = b] - /\ terminalAuthority' = [terminalAuthority EXCEPT ![r] = a] - /\ UNCHANGED <> + /\ terminalMeta' = + [x \in TerminalRequests \cup {r} |-> + IF x = r + THEN [resolution |-> value, authority |-> a] + ELSE terminalMeta[x]] + /\ UNCHANGED <> ObserveConflict(r) == /\ r \in ResolutionIds /\ conflicts' = conflicts \cup {r} - /\ UNCHANGED <> + /\ UNCHANGED <> +(* Invalid material cannot become accepted terminal state. *) ObserveInvalidMaterial(r) == /\ r \in ResolutionIds - /\ invalidMaterial' = invalidMaterial \cup {r} - /\ UNCHANGED <> + /\ UNCHANGED vars +(* Non-authoritative inputs have no canonical state representation. *) ObserveNonAuthoritativeInput(r) == /\ r \in ResolutionIds - /\ observedInputs' = observedInputs \cup {r} - /\ UNCHANGED <> + /\ UNCHANGED vars Evaluate == UNCHANGED vars -RecognizedCanonicalTransition == +RecognizedSeedTransition == \/ \E r \in ResolutionIds, b \in Bindings, a \in Authorities, previous \in TerminalCommitments \cup {NoCommitment} : RegisterRequest(r, b, a, previous) \/ \E r \in ResolutionIds, b \in Bindings, a \in Authorities, value \in TerminalResolutions : SubmitResolution(r, b, a, value) + +RecognizedEnvironmentTransition == \/ \E r \in ResolutionIds : ObserveConflict(r) \/ \E r \in ResolutionIds : ObserveInvalidMaterial(r) \/ \E r \in ResolutionIds : ObserveNonAuthoritativeInput(r) +RecognizedCanonicalTransition == + \/ RecognizedSeedTransition + \/ RecognizedEnvironmentTransition + Next == \/ RecognizedCanonicalTransition \/ Evaluate ResolutionOf(r) == - IF r \notin requests \/ r \in conflicts + IF r \notin Requests \/ r \in conflicts THEN "UNKNOWN" - ELSE IF terminalRecord[r] = NoRecord + ELSE IF r \notin TerminalRequests THEN "UNKNOWN" - ELSE terminalRecord[r] + ELSE TerminalResolution(r) EffectPermitted(r) == ResolutionOf(r) = "ALLOW" TypeOK == - /\ localAuthorityBindings \subseteq Authorities \X Bindings - /\ authorityProofBindings \subseteq Authorities \X Bindings - /\ localAuthorityBindings \subseteq authorityProofBindings - /\ requests \subseteq ResolutionIds - /\ requestBinding \in [ResolutionIds -> Bindings] - /\ requestAuthority \in [ResolutionIds -> Authorities] - /\ previousResolutionCommitment \in [ResolutionIds -> TerminalCommitments \cup {NoCommitment}] - /\ terminalRecord \in [ResolutionIds -> TerminalResolutions \cup {NoRecord}] - /\ terminalBinding \in [ResolutionIds -> Bindings] - /\ terminalAuthority \in [ResolutionIds -> Authorities] + /\ DOMAIN requestMeta \subseteq ResolutionIds + /\ requestMeta \in [DOMAIN requestMeta -> RequestMetaType] + /\ DOMAIN terminalMeta \subseteq ResolutionIds + /\ terminalMeta \in [DOMAIN terminalMeta -> TerminalMetaType] /\ conflicts \subseteq ResolutionIds - /\ invalidMaterial \subseteq ResolutionIds - /\ observedInputs \subseteq ResolutionIds ResolutionDomain == \A r \in ResolutionIds : ResolutionOf(r) \in Resolutions @@ -211,61 +172,87 @@ ResolutionDomain == AllowSoundness == \A r \in ResolutionIds : EffectPermitted(r) => - /\ r \in requests + /\ r \in Requests /\ r \notin conflicts - /\ terminalRecord[r] = "ALLOW" - /\ terminalBinding[r] = requestBinding[r] - /\ <> \in authorityProofBindings + /\ r \in TerminalRequests + /\ TerminalResolution(r) = "ALLOW" + /\ <> + \in AuthorityProofBindings FailClosed == \A r \in ResolutionIds : ResolutionOf(r) # "ALLOW" => ~EffectPermitted(r) -ExactBinding == - \A r \in requests : - terminalRecord[r] = NoRecord \/ terminalBinding[r] = requestBinding[r] +(* Exact binding is structural: accepted terminal state has no second binding. *) +TerminalBindingDerived == + \A r \in TerminalRequests : + /\ r \in Requests + /\ TerminalBinding(r) = RequestBinding(r) LocalAuthorityRoot == - \A r \in requests : - <> \in localAuthorityBindings + \A r \in Requests : + \E a \in Authorities : + <> \in LocalAuthorityBindings DelegatedAuthoritySound == - /\ localAuthorityBindings \subseteq authorityProofBindings - /\ \A r \in requests : - terminalRecord[r] = NoRecord \/ - <> \in authorityProofBindings + \A r \in TerminalRequests : + /\ r \in Requests + /\ <> + \in AuthorityProofBindings +(* +Structural assurance: the complete canonical decision state is exactly the +three variables above; non-authoritative inputs have no independent state slot. +*) InputsNonAuthoritative == - \A r \in observedInputs : - terminalRecord[r] = NoRecord => ResolutionOf(r) = "UNKNOWN" + canonicalVars = <> +(* A function keyed by resolution_id makes multiple accepted terminals unrepresentable. *) TerminalUnique == - \A r \in ResolutionIds : - r \in conflicts => ResolutionOf(r) = "UNKNOWN" + terminalMeta \in [DOMAIN terminalMeta -> TerminalMetaType] -InvalidOrConflictUnknown == - \A r \in ResolutionIds : - /\ (r \in conflicts => ResolutionOf(r) = "UNKNOWN") - /\ (r \in invalidMaterial /\ terminalRecord[r] = NoRecord => - ResolutionOf(r) = "UNKNOWN") +ConflictUnknown == + \A r \in conflicts : ResolutionOf(r) = "UNKNOWN" FreshReconsideration == - \A r \in requests : - \/ previousResolutionCommitment[r] = NoCommitment - \/ previousResolutionCommitment[r] \in RecognizedTerminalCommitments + \A r \in Requests : + \/ PreviousCommitment(r) = NoCommitment + \/ PreviousCommitment(r) \in RecognizedTerminalCommitments + +TerminalRecordRequiresRequest == + TerminalRequests \subseteq Requests + +SeedStateSafety == + /\ TypeOK + /\ ResolutionDomain + /\ AllowSoundness + /\ FailClosed + /\ TerminalBindingDerived + /\ LocalAuthorityRoot + /\ DelegatedAuthoritySound + /\ InputsNonAuthoritative + /\ TerminalUnique + /\ ConflictUnknown + /\ FreshReconsideration + +InductiveInvariant == + /\ TypeOK + /\ TerminalBindingDerived + /\ LocalAuthorityRoot + /\ DelegatedAuthoritySound + /\ FreshReconsideration + /\ TerminalRecordRequiresRequest RequestsAppendOnlyStep == - requests \subseteq requests' + Requests \subseteq Requests' RequestsAppendOnly == [][RequestsAppendOnlyStep]_vars TerminalRecordsImmutableStep == - \A r \in ResolutionIds : - terminalRecord[r] # NoRecord => - /\ terminalRecord'[r] = terminalRecord[r] - /\ terminalBinding'[r] = terminalBinding[r] - /\ terminalAuthority'[r] = terminalAuthority[r] + \A r \in TerminalRequests : + /\ r \in TerminalRequests' + /\ terminalMeta'[r] = terminalMeta[r] TerminalRecordsImmutable == [][TerminalRecordsImmutableStep]_vars @@ -276,11 +263,19 @@ CanonicalStateChangesOnlyByRecognizedTransitionStep == CanonicalStateChangesOnlyByRecognizedTransition == [][CanonicalStateChangesOnlyByRecognizedTransitionStep]_vars -ObservedInputsAppendOnlyStep == - observedInputs \subseteq observedInputs' +InvalidMaterialStutterStep == + \A r \in ResolutionIds : + ObserveInvalidMaterial(r) => UNCHANGED vars + +InvalidMaterialStutter == + [][InvalidMaterialStutterStep]_vars + +NonAuthoritativeInputsStutterStep == + \A r \in ResolutionIds : + ObserveNonAuthoritativeInput(r) => UNCHANGED vars -ObservedInputsAppendOnly == - [][ObservedInputsAppendOnlyStep]_vars +NonAuthoritativeInputsStutter == + [][NonAuthoritativeInputsStutterStep]_vars Spec == Init /\ [][Next]_vars ================================================================================= diff --git a/seed/canonical/formal/SeedResolutionProofs.tla b/seed/canonical/formal/SeedResolutionProofs.tla index 87316b7..6e2be2d 100644 --- a/seed/canonical/formal/SeedResolutionProofs.tla +++ b/seed/canonical/formal/SeedResolutionProofs.tla @@ -1,20 +1,14 @@ ------------------------- MODULE SeedResolutionProofs ------------------------- - EXTENDS SeedResolution, TLAPS (* -The first unbounded proof layer covers the pure resolution evaluator. - -It does not yet claim: -- inductiveness of the complete state invariant; -- preservation by every Next action; -- temporal safety of Spec; -- liveness; -- cryptographic correctness; -- implementation conformance. -*) +Unbounded safety proof for the normalized Seed state. -ASSUME NoRecordIsNotTerminal == NoRecord \notin {"ALLOW", "BLOCK"} +Compared with the previous projection, request/terminal metadata are stored once, +Authority relations are immutable context constants, and invalid/non-authoritative +observations are explicit semantic stutters. The proof therefore establishes the +same observable resolution safety over a smaller representable state space. +*) THEOREM EffectPermissionDefinition == \A r \in ResolutionIds : @@ -25,7 +19,7 @@ PROOF THEOREM UnregisteredResolutionIsUnknown == \A r \in ResolutionIds : - r \notin requests => ResolutionOf(r) = "UNKNOWN" + r \notin Requests => ResolutionOf(r) = "UNKNOWN" PROOF BY DEF ResolutionOf @@ -39,17 +33,17 @@ PROOF THEOREM MissingTerminalRecordIsUnknown == \A r \in ResolutionIds : - terminalRecord[r] = NoRecord => ResolutionOf(r) = "UNKNOWN" + r \notin TerminalRequests => ResolutionOf(r) = "UNKNOWN" PROOF BY DEF ResolutionOf THEOREM TerminalRecordDeterminesResolution == \A r \in ResolutionIds : - (/\ r \in requests + (/\ r \in Requests /\ r \notin conflicts - /\ terminalRecord[r] # NoRecord) - => ResolutionOf(r) = terminalRecord[r] + /\ r \in TerminalRequests) + => ResolutionOf(r) = TerminalResolution(r) PROOF BY DEF ResolutionOf @@ -57,58 +51,69 @@ PROOF THEOREM AllowResolutionCharacterization == \A r \in ResolutionIds : EffectPermitted(r) <=> - /\ r \in requests + /\ r \in Requests /\ r \notin conflicts - /\ terminalRecord[r] = "ALLOW" + /\ r \in TerminalRequests + /\ TerminalResolution(r) = "ALLOW" PROOF - BY NoRecordIsNotTerminal DEF EffectPermitted, ResolutionOf + BY DEF EffectPermitted, ResolutionOf THEOREM BlockResolutionCharacterization == \A r \in ResolutionIds : ResolutionOf(r) = "BLOCK" <=> - /\ r \in requests + /\ r \in Requests /\ r \notin conflicts - /\ terminalRecord[r] = "BLOCK" + /\ r \in TerminalRequests + /\ TerminalResolution(r) = "BLOCK" PROOF - BY NoRecordIsNotTerminal DEF ResolutionOf + BY DEF ResolutionOf -THEOREM NoAllowWithoutTerminalAllow == - \A r \in ResolutionIds : - terminalRecord[r] # "ALLOW" => ~EffectPermitted(r) +THEOREM FailClosedByEvaluator == + FailClosed PROOF - BY DEF EffectPermitted, ResolutionOf + BY DEF FailClosed, EffectPermitted + + +THEOREM InputsNonAuthoritativeByStructure == + InputsNonAuthoritative +PROOF + BY DEF InputsNonAuthoritative, canonicalVars + + +THEOREM ConflictUnknownFromTypeOK == + TypeOK => ConflictUnknown +PROOF + BY ConflictedResolutionIsUnknown + DEF TypeOK, ConflictUnknown + THEOREM ResolutionDomainPointwise == ASSUME TypeOK, NEW r \in ResolutionIds PROVE ResolutionOf(r) \in Resolutions PROOF - <1>1. terminalRecord[r] \in TerminalResolutions \cup {NoRecord} - BY DEF TypeOK - - <1>2. CASE r \notin requests \/ r \in conflicts + <1>1. CASE r \notin Requests \/ r \in conflicts <2>1. QED - BY <1>2 - DEF ResolutionOf, Resolutions - - <1>3. CASE - /\ ~(r \notin requests \/ r \in conflicts) - /\ terminalRecord[r] = NoRecord - <2>1. QED - BY <1>3 - DEF ResolutionOf, Resolutions - - <1>4. CASE - /\ ~(r \notin requests \/ r \in conflicts) - /\ terminalRecord[r] # NoRecord + BY <1>1 DEF ResolutionOf, Resolutions + <1>2. CASE + /\ ~(r \notin Requests \/ r \in conflicts) + /\ r \notin TerminalRequests <2>1. QED - BY <1>1, <1>4 + BY <1>2 DEF ResolutionOf, Resolutions + <1>3. CASE + /\ ~(r \notin Requests \/ r \in conflicts) + /\ r \in TerminalRequests + <2>1. terminalMeta[r] \in TerminalMetaType + BY <1>3 DEF TypeOK, TerminalRequests + <2>2. TerminalResolution(r) \in TerminalResolutions + BY <2>1 DEF TerminalMetaType, TerminalResolution + <2>3. QED + BY <1>3, <2>2 DEF ResolutionOf, Resolutions, TerminalResolutions - - <1>5. QED - BY <1>2, <1>3, <1>4 + <1>4. QED + BY <1>1, <1>2, <1>3 THEOREM ResolutionDomainFromTypeOK == @@ -118,1037 +123,440 @@ PROOF DEF ResolutionDomain -THEOREM FailClosedByEvaluator == - FailClosed -PROOF - BY DEF FailClosed, EffectPermitted - - -THEOREM InputsNonAuthoritativeFromTypeOK == - TypeOK => InputsNonAuthoritative -PROOF - BY MissingTerminalRecordIsUnknown - DEF TypeOK, InputsNonAuthoritative - - -THEOREM TerminalUniqueByEvaluator == - TerminalUnique -PROOF - BY ConflictedResolutionIsUnknown - DEF TerminalUnique - - -THEOREM InvalidOrConflictUnknownByEvaluator == - InvalidOrConflictUnknown +THEOREM TerminalUniqueFromTypeOK == + TypeOK => TerminalUnique PROOF - BY ConflictedResolutionIsUnknown, - MissingTerminalRecordIsUnknown - DEF InvalidOrConflictUnknown + BY DEF TypeOK, TerminalUnique THEOREM AllowSoundnessPointwise == - ASSUME ExactBinding, + ASSUME TerminalBindingDerived, DelegatedAuthoritySound, NEW r \in ResolutionIds, EffectPermitted(r) PROVE - /\ r \in requests + /\ r \in Requests /\ r \notin conflicts - /\ terminalRecord[r] = "ALLOW" - /\ terminalBinding[r] = requestBinding[r] - /\ <> - \in authorityProofBindings + /\ r \in TerminalRequests + /\ TerminalResolution(r) = "ALLOW" + /\ <> + \in AuthorityProofBindings PROOF <1>1. - /\ r \in requests + /\ r \in Requests /\ r \notin conflicts - /\ terminalRecord[r] = "ALLOW" + /\ r \in TerminalRequests + /\ TerminalResolution(r) = "ALLOW" BY AllowResolutionCharacterization - - <1>2. terminalRecord[r] # NoRecord - BY <1>1, NoRecordIsNotTerminal - - <1>3. terminalBinding[r] = requestBinding[r] - BY <1>1, <1>2 - DEF ExactBinding - - <1>4. - <> - \in authorityProofBindings + <1>2. + <> + \in AuthorityProofBindings + BY <1>1 DEF DelegatedAuthoritySound + <1>3. QED BY <1>1, <1>2 - DEF DelegatedAuthoritySound - - <1>5. QED - BY <1>1, <1>3, <1>4 THEOREM AllowSoundnessFromStructuralInvariants == - ExactBinding /\ DelegatedAuthoritySound + TerminalBindingDerived /\ DelegatedAuthoritySound => AllowSoundness PROOF BY AllowSoundnessPointwise DEF AllowSoundness -SeedStateSafety == - /\ TypeOK - /\ ResolutionDomain - /\ AllowSoundness - /\ FailClosed - /\ ExactBinding - /\ LocalAuthorityRoot - /\ DelegatedAuthoritySound - /\ InputsNonAuthoritative - /\ TerminalUnique - /\ InvalidOrConflictUnknown - /\ FreshReconsideration - - -TerminalRecordRequiresRequest == - \A r \in ResolutionIds : - terminalRecord[r] # NoRecord => r \in requests - - -InductiveInvariant == - /\ TypeOK - /\ TerminalRecordRequiresRequest - /\ ExactBinding - /\ LocalAuthorityRoot - /\ DelegatedAuthoritySound - /\ FreshReconsideration - - THEOREM InductiveInvariantImpliesSeedStateSafety == InductiveInvariant => SeedStateSafety PROOF BY ResolutionDomainFromTypeOK, AllowSoundnessFromStructuralInvariants, FailClosedByEvaluator, - InputsNonAuthoritativeFromTypeOK, - TerminalUniqueByEvaluator, - InvalidOrConflictUnknownByEvaluator + InputsNonAuthoritativeByStructure, + TerminalUniqueFromTypeOK, + ConflictUnknownFromTypeOK DEF InductiveInvariant, SeedStateSafety -ASSUME BindingsNonempty == - Bindings # {} - -ASSUME AuthoritiesNonempty == - Authorities # {} - - -THEOREM ChosenBindingInBindings == - (CHOOSE b \in Bindings : TRUE) \in Bindings -PROOF - BY BindingsNonempty - - -THEOREM ChosenAuthorityInAuthorities == - (CHOOSE a \in Authorities : TRUE) \in Authorities -PROOF - BY AuthoritiesNonempty - - THEOREM InitImpliesTypeOK == Init => TypeOK PROOF - BY ChosenBindingInBindings, - ChosenAuthorityInAuthorities - DEF Init, TypeOK, TerminalResolutions + BY DEF Init, + TypeOK, + RequestMetaType, + TerminalMetaType -THEOREM InitImpliesExactBinding == - Init => ExactBinding +THEOREM InitImpliesTerminalBindingDerived == + Init => TerminalBindingDerived PROOF - BY DEF Init, ExactBinding + BY DEF Init, + TerminalBindingDerived, + Requests, + TerminalRequests THEOREM InitImpliesLocalAuthorityRoot == Init => LocalAuthorityRoot PROOF - BY DEF Init, LocalAuthorityRoot + BY DEF Init, + LocalAuthorityRoot, + Requests THEOREM InitImpliesDelegatedAuthoritySound == Init => DelegatedAuthoritySound PROOF - BY DEF Init, DelegatedAuthoritySound + BY DEF Init, + DelegatedAuthoritySound, + TerminalRequests THEOREM InitImpliesFreshReconsideration == Init => FreshReconsideration PROOF - BY DEF Init, FreshReconsideration + BY DEF Init, + FreshReconsideration, + Requests THEOREM InitImpliesTerminalRecordRequiresRequest == Init => TerminalRecordRequiresRequest PROOF - BY DEF Init, TerminalRecordRequiresRequest + BY DEF Init, + TerminalRecordRequiresRequest, + Requests, + TerminalRequests THEOREM InitImpliesInductiveInvariant == Init => InductiveInvariant PROOF BY InitImpliesTypeOK, - InitImpliesTerminalRecordRequiresRequest, - InitImpliesExactBinding, + InitImpliesTerminalBindingDerived, InitImpliesLocalAuthorityRoot, InitImpliesDelegatedAuthoritySound, - InitImpliesFreshReconsideration + InitImpliesFreshReconsideration, + InitImpliesTerminalRecordRequiresRequest DEF InductiveInvariant -THEOREM UnrequestedHasNoTerminalRecord == - ASSUME TerminalRecordRequiresRequest, - NEW r \in ResolutionIds, - r \notin requests - PROVE terminalRecord[r] = NoRecord -PROOF - BY DEF TerminalRecordRequiresRequest - - THEOREM RegisterRequestPreservesTypeOK == - ASSUME InductiveInvariant, - NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW previous \in TerminalCommitments \cup {NoCommitment}, - RegisterRequest(r, b, a, previous) - PROVE TypeOK' + \A r \in ResolutionIds, b \in Bindings, a \in Authorities, + previous \in TerminalCommitments \cup {NoCommitment} : + InductiveInvariant /\ RegisterRequest(r, b, a, previous) + => TypeOK' PROOF - BY DEF RegisterRequest, InductiveInvariant, TypeOK + BY DEF InductiveInvariant, + TypeOK, + RegisterRequest, + Requests, + RequestMetaType, + TerminalMetaType THEOREM RegisterRequestPreservesTerminalRecordRequiresRequest == - ASSUME InductiveInvariant, - NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW previous \in TerminalCommitments \cup {NoCommitment}, - RegisterRequest(r, b, a, previous) - PROVE TerminalRecordRequiresRequest' -PROOF - BY DEF RegisterRequest, - InductiveInvariant, - TerminalRecordRequiresRequest - - -THEOREM RegisterRequestNewKeyValues == - ASSUME InductiveInvariant, - NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW previous \in TerminalCommitments \cup {NoCommitment}, - RegisterRequest(r, b, a, previous) - PROVE - /\ requestBinding'[r] = b - /\ requestAuthority'[r] = a - /\ previousResolutionCommitment'[r] = previous -PROOF - BY DEF RegisterRequest, InductiveInvariant, TypeOK - - -THEOREM RegisterRequestOldKeyValues == - ASSUME InductiveInvariant, - NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW previous \in TerminalCommitments \cup {NoCommitment}, - RegisterRequest(r, b, a, previous), - NEW q \in requests, - q # r - PROVE - /\ requestBinding'[q] = requestBinding[q] - /\ requestAuthority'[q] = requestAuthority[q] - /\ previousResolutionCommitment'[q] = previousResolutionCommitment[q] -PROOF - BY DEF RegisterRequest, InductiveInvariant, TypeOK - - -THEOREM RegisterRequestUnchangedValues == - ASSUME NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW previous \in TerminalCommitments \cup {NoCommitment}, - RegisterRequest(r, b, a, previous) - PROVE - /\ localAuthorityBindings' = localAuthorityBindings - /\ authorityProofBindings' = authorityProofBindings - /\ terminalRecord' = terminalRecord - /\ terminalBinding' = terminalBinding - /\ terminalAuthority' = terminalAuthority -PROOF - BY DEF RegisterRequest - - -THEOREM RegisterRequestSetFacts == - ASSUME NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW previous \in TerminalCommitments \cup {NoCommitment}, - RegisterRequest(r, b, a, previous) - PROVE - /\ requests' = requests \cup {r} - /\ requests \subseteq requests' -PROOF - BY DEF RegisterRequest - - -THEOREM RegisterRequestPreviousGuard == - ASSUME NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW previous \in TerminalCommitments \cup {NoCommitment}, - RegisterRequest(r, b, a, previous) - PROVE - \/ previous = NoCommitment - \/ previous \in RecognizedTerminalCommitments + \A r \in ResolutionIds, b \in Bindings, a \in Authorities, + previous \in TerminalCommitments \cup {NoCommitment} : + InductiveInvariant /\ RegisterRequest(r, b, a, previous) + => TerminalRecordRequiresRequest' PROOF - BY DEF RegisterRequest - - -THEOREM RegisterRequestPreservesExactBindingPointwise == - ASSUME InductiveInvariant, - NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW previous \in TerminalCommitments \cup {NoCommitment}, - RegisterRequest(r, b, a, previous), - NEW q \in requests' - PROVE - terminalRecord'[q] = NoRecord \/ - terminalBinding'[q] = requestBinding'[q] -PROOF - <1>1. CASE q = r - <2>1. terminalRecord[r] = NoRecord - BY DEF RegisterRequest, - InductiveInvariant, - TerminalRecordRequiresRequest - - <2>2. terminalRecord' = terminalRecord - BY RegisterRequestUnchangedValues - - <2>3. QED - BY <1>1, <2>1, <2>2 - - <1>2. CASE q # r - <2>1. q \in requests - BY <1>2 - DEF RegisterRequest - - <2>2. - terminalRecord[q] = NoRecord \/ - terminalBinding[q] = requestBinding[q] - BY <2>1 - DEF InductiveInvariant, ExactBinding - - <2>3. - /\ requestBinding'[q] = requestBinding[q] - /\ terminalRecord'[q] = terminalRecord[q] - /\ terminalBinding'[q] = terminalBinding[q] - BY <1>2, <2>1, - RegisterRequestOldKeyValues, - RegisterRequestUnchangedValues - - <2>4. QED - BY <2>2, <2>3 - - <1>3. QED - BY <1>1, <1>2 - - -THEOREM RegisterRequestPreservesExactBinding == - ASSUME InductiveInvariant, - NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW previous \in TerminalCommitments \cup {NoCommitment}, - RegisterRequest(r, b, a, previous) - PROVE ExactBinding' -PROOF - BY RegisterRequestPreservesExactBindingPointwise - DEF ExactBinding + BY DEF InductiveInvariant, + TerminalRecordRequiresRequest, + TerminalBindingDerived, + RegisterRequest, + Requests, + TerminalRequests -THEOREM RegisterRequestPreservesLocalAuthorityRootPointwise == - ASSUME InductiveInvariant, - NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW previous \in TerminalCommitments \cup {NoCommitment}, - RegisterRequest(r, b, a, previous), - NEW q \in requests' - PROVE - <> - \in localAuthorityBindings' +THEOREM RegisterRequestPreservesTerminalBindingDerived == + \A r \in ResolutionIds, b \in Bindings, a \in Authorities, + previous \in TerminalCommitments \cup {NoCommitment} : + InductiveInvariant /\ RegisterRequest(r, b, a, previous) + => TerminalBindingDerived' PROOF - <1>1. CASE q = r - <2>1. <> \in localAuthorityBindings - BY DEF RegisterRequest - - <2>2. - /\ requestAuthority'[q] = a - /\ requestBinding'[q] = b - /\ localAuthorityBindings' = localAuthorityBindings - BY <1>1, - RegisterRequestNewKeyValues, - RegisterRequestUnchangedValues - - <2>3. QED - BY <2>1, <2>2 - - <1>2. CASE q # r - <2>1. q \in requests - BY <1>2 - DEF RegisterRequest - - <2>2. - <> - \in localAuthorityBindings - BY <2>1 - DEF InductiveInvariant, LocalAuthorityRoot - - <2>3. - /\ requestAuthority'[q] = requestAuthority[q] - /\ requestBinding'[q] = requestBinding[q] - /\ localAuthorityBindings' = localAuthorityBindings - BY <1>2, <2>1, - RegisterRequestOldKeyValues, - RegisterRequestUnchangedValues - - <2>4. QED - BY <2>2, <2>3 - - <1>3. QED - BY <1>1, <1>2 + BY DEF InductiveInvariant, + TerminalBindingDerived, + TerminalRecordRequiresRequest, + RegisterRequest, + Requests, + TerminalRequests, + TerminalBinding, + RequestBinding THEOREM RegisterRequestPreservesLocalAuthorityRoot == - ASSUME InductiveInvariant, - NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW previous \in TerminalCommitments \cup {NoCommitment}, - RegisterRequest(r, b, a, previous) - PROVE LocalAuthorityRoot' + \A r \in ResolutionIds, b \in Bindings, a \in Authorities, + previous \in TerminalCommitments \cup {NoCommitment} : + InductiveInvariant /\ RegisterRequest(r, b, a, previous) + => LocalAuthorityRoot' PROOF - BY RegisterRequestPreservesLocalAuthorityRootPointwise - DEF LocalAuthorityRoot - - -THEOREM RegisterRequestPreservesDelegatedAuthorityPointwise == - ASSUME InductiveInvariant, - NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW previous \in TerminalCommitments \cup {NoCommitment}, - RegisterRequest(r, b, a, previous), - NEW q \in requests' - PROVE - terminalRecord'[q] = NoRecord \/ - <> - \in authorityProofBindings' -PROOF - <1>1. CASE q = r - <2>1. terminalRecord[r] = NoRecord - BY DEF RegisterRequest, - InductiveInvariant, - TerminalRecordRequiresRequest - - <2>2. terminalRecord' = terminalRecord - BY RegisterRequestUnchangedValues - - <2>3. QED - BY <1>1, <2>1, <2>2 - - <1>2. CASE q # r - <2>1. q \in requests - BY <1>2 - DEF RegisterRequest - - <2>2. - terminalRecord[q] = NoRecord \/ - <> - \in authorityProofBindings - BY <2>1 - DEF InductiveInvariant, DelegatedAuthoritySound - - <2>3. - /\ terminalRecord'[q] = terminalRecord[q] - /\ terminalAuthority'[q] = terminalAuthority[q] - /\ requestBinding'[q] = requestBinding[q] - /\ authorityProofBindings' = authorityProofBindings - BY <1>2, <2>1, - RegisterRequestOldKeyValues, - RegisterRequestUnchangedValues - - <2>4. QED - BY <2>2, <2>3 - - <1>3. QED - BY <1>1, <1>2 + BY DEF InductiveInvariant, + LocalAuthorityRoot, + RegisterRequest, + Requests, + RequestBinding THEOREM RegisterRequestPreservesDelegatedAuthoritySound == - ASSUME InductiveInvariant, - NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW previous \in TerminalCommitments \cup {NoCommitment}, - RegisterRequest(r, b, a, previous) - PROVE DelegatedAuthoritySound' -PROOF - <1>1. - localAuthorityBindings' \subseteq authorityProofBindings' - BY RegisterRequestUnchangedValues - DEF InductiveInvariant, DelegatedAuthoritySound - - <1>2. - \A q \in requests' : - terminalRecord'[q] = NoRecord \/ - <> - \in authorityProofBindings' - BY RegisterRequestPreservesDelegatedAuthorityPointwise - - <1>3. QED - BY <1>1, <1>2 - DEF DelegatedAuthoritySound - - -THEOREM RegisterRequestPreservesFreshReconsiderationPointwise == - ASSUME InductiveInvariant, - NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW previous \in TerminalCommitments \cup {NoCommitment}, - RegisterRequest(r, b, a, previous), - NEW q \in requests' - PROVE - \/ previousResolutionCommitment'[q] = NoCommitment - \/ previousResolutionCommitment'[q] \in RecognizedTerminalCommitments + \A r \in ResolutionIds, b \in Bindings, a \in Authorities, + previous \in TerminalCommitments \cup {NoCommitment} : + InductiveInvariant /\ RegisterRequest(r, b, a, previous) + => DelegatedAuthoritySound' PROOF - <1>1. CASE q = r - <2>1. previousResolutionCommitment'[q] = previous - BY <1>1, RegisterRequestNewKeyValues - - <2>2. - \/ previous = NoCommitment - \/ previous \in RecognizedTerminalCommitments - BY RegisterRequestPreviousGuard - - <2>3. QED - BY <2>1, <2>2 - - <1>2. CASE q # r - <2>1. q \in requests - BY <1>2 - DEF RegisterRequest - - <2>2. - \/ previousResolutionCommitment[q] = NoCommitment - \/ previousResolutionCommitment[q] \in RecognizedTerminalCommitments - BY <2>1 - DEF InductiveInvariant, FreshReconsideration - - <2>3. previousResolutionCommitment'[q] = previousResolutionCommitment[q] - BY <1>2, <2>1, RegisterRequestOldKeyValues - - <2>4. QED - BY <2>2, <2>3 - - <1>3. QED - BY <1>1, <1>2 + BY DEF InductiveInvariant, + DelegatedAuthoritySound, + TerminalRecordRequiresRequest, + RegisterRequest, + Requests, + TerminalRequests, + RequestBinding, + TerminalAuthority THEOREM RegisterRequestPreservesFreshReconsideration == - ASSUME InductiveInvariant, - NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW previous \in TerminalCommitments \cup {NoCommitment}, - RegisterRequest(r, b, a, previous) - PROVE FreshReconsideration' + \A r \in ResolutionIds, b \in Bindings, a \in Authorities, + previous \in TerminalCommitments \cup {NoCommitment} : + InductiveInvariant /\ RegisterRequest(r, b, a, previous) + => FreshReconsideration' PROOF - BY RegisterRequestPreservesFreshReconsiderationPointwise - DEF FreshReconsideration - + BY DEF InductiveInvariant, + FreshReconsideration, + RegisterRequest, + Requests, + PreviousCommitment THEOREM RegisterRequestPreservesInductiveInvariant == - ASSUME InductiveInvariant, - NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW previous \in TerminalCommitments \cup {NoCommitment}, - RegisterRequest(r, b, a, previous) - PROVE InductiveInvariant' + \A r \in ResolutionIds, b \in Bindings, a \in Authorities, + previous \in TerminalCommitments \cup {NoCommitment} : + InductiveInvariant /\ RegisterRequest(r, b, a, previous) + => InductiveInvariant' PROOF BY RegisterRequestPreservesTypeOK, RegisterRequestPreservesTerminalRecordRequiresRequest, - RegisterRequestPreservesExactBinding, + RegisterRequestPreservesTerminalBindingDerived, RegisterRequestPreservesLocalAuthorityRoot, RegisterRequestPreservesDelegatedAuthoritySound, RegisterRequestPreservesFreshReconsideration DEF InductiveInvariant -THEOREM SubmitResolutionNewKeyValues == - ASSUME InductiveInvariant, - NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW value \in TerminalResolutions, - SubmitResolution(r, b, a, value) - PROVE - /\ terminalRecord'[r] = value - /\ terminalBinding'[r] = b - /\ terminalAuthority'[r] = a +THEOREM SubmitResolutionPreservesTypeOK == + \A r \in ResolutionIds, b \in Bindings, a \in Authorities, + value \in TerminalResolutions : + InductiveInvariant /\ SubmitResolution(r, b, a, value) + => TypeOK' PROOF - BY DEF SubmitResolution, InductiveInvariant, TypeOK + BY DEF InductiveInvariant, + TypeOK, + SubmitResolution, + Requests, + TerminalRequests, + RequestMetaType, + TerminalMetaType -THEOREM SubmitResolutionOldKeyValues == - ASSUME InductiveInvariant, - NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW value \in TerminalResolutions, - SubmitResolution(r, b, a, value), - NEW q \in ResolutionIds, - q # r - PROVE - /\ terminalRecord'[q] = terminalRecord[q] - /\ terminalBinding'[q] = terminalBinding[q] - /\ terminalAuthority'[q] = terminalAuthority[q] +THEOREM SubmitResolutionPreservesTerminalRecordRequiresRequest == + \A r \in ResolutionIds, b \in Bindings, a \in Authorities, + value \in TerminalResolutions : + InductiveInvariant /\ SubmitResolution(r, b, a, value) + => TerminalRecordRequiresRequest' PROOF - BY DEF SubmitResolution, InductiveInvariant, TypeOK + BY DEF InductiveInvariant, + TerminalRecordRequiresRequest, + SubmitResolution, + Requests, + TerminalRequests -THEOREM SubmitResolutionUnchangedValues == - ASSUME NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW value \in TerminalResolutions, - SubmitResolution(r, b, a, value) - PROVE - /\ localAuthorityBindings' = localAuthorityBindings - /\ authorityProofBindings' = authorityProofBindings - /\ requests' = requests - /\ requestBinding' = requestBinding - /\ requestAuthority' = requestAuthority - /\ previousResolutionCommitment' = previousResolutionCommitment -PROOF - BY DEF SubmitResolution - - -THEOREM SubmitResolutionGuardFacts == - ASSUME NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW value \in TerminalResolutions, - SubmitResolution(r, b, a, value) - PROVE - /\ r \in requests - /\ b = requestBinding[r] - /\ <> \in authorityProofBindings - /\ value \in TerminalResolutions - /\ terminalRecord[r] = NoRecord - /\ r \notin conflicts +THEOREM SubmitResolutionPreservesTerminalBindingDerived == + \A r \in ResolutionIds, b \in Bindings, a \in Authorities, + value \in TerminalResolutions : + InductiveInvariant /\ SubmitResolution(r, b, a, value) + => TerminalBindingDerived' PROOF - BY DEF SubmitResolution + BY DEF InductiveInvariant, + TerminalBindingDerived, + TerminalRecordRequiresRequest, + SubmitResolution, + Requests, + TerminalRequests, + TerminalBinding, + RequestBinding -THEOREM SubmitResolutionPreservesTypeOK == - ASSUME InductiveInvariant, - NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW value \in TerminalResolutions, - SubmitResolution(r, b, a, value) - PROVE TypeOK' +THEOREM SubmitResolutionPreservesLocalAuthorityRoot == + \A r \in ResolutionIds, b \in Bindings, a \in Authorities, + value \in TerminalResolutions : + InductiveInvariant /\ SubmitResolution(r, b, a, value) + => LocalAuthorityRoot' PROOF - BY DEF SubmitResolution, - InductiveInvariant, - TypeOK, - TerminalResolutions + BY DEF InductiveInvariant, + LocalAuthorityRoot, + SubmitResolution, + Requests, + RequestBinding -THEOREM SubmitResolutionPreservesTerminalRecordRequiresRequestPointwise == - ASSUME InductiveInvariant, - NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW value \in TerminalResolutions, - SubmitResolution(r, b, a, value), - NEW q \in ResolutionIds, - terminalRecord'[q] # NoRecord - PROVE q \in requests' +THEOREM SubmitResolutionPreservesDelegatedAuthoritySound == + \A r \in ResolutionIds, b \in Bindings, a \in Authorities, + value \in TerminalResolutions : + InductiveInvariant /\ SubmitResolution(r, b, a, value) + => DelegatedAuthoritySound' PROOF - <1>1. CASE q = r - <2>1. r \in requests - BY SubmitResolutionGuardFacts - - <2>2. requests' = requests - BY SubmitResolutionUnchangedValues - - <2>3. QED - BY <1>1, <2>1, <2>2 - - <1>2. CASE q # r - <2>1. terminalRecord'[q] = terminalRecord[q] - BY <1>2, - SubmitResolutionOldKeyValues - - <2>2. terminalRecord[q] # NoRecord - BY <2>1 - - <2>3. q \in requests - BY <2>2 - DEF InductiveInvariant, - TerminalRecordRequiresRequest - - <2>4. requests' = requests - BY SubmitResolutionUnchangedValues - - <2>5. QED - BY <2>3, <2>4 - - <1>3. QED - BY <1>1, <1>2 + BY DEF InductiveInvariant, + DelegatedAuthoritySound, + TerminalRecordRequiresRequest, + SubmitResolution, + Requests, + TerminalRequests, + RequestBinding, + TerminalAuthority -THEOREM SubmitResolutionPreservesTerminalRecordRequiresRequest == - ASSUME InductiveInvariant, - NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW value \in TerminalResolutions, - SubmitResolution(r, b, a, value) - PROVE TerminalRecordRequiresRequest' +THEOREM SubmitResolutionPreservesFreshReconsideration == + \A r \in ResolutionIds, b \in Bindings, a \in Authorities, + value \in TerminalResolutions : + InductiveInvariant /\ SubmitResolution(r, b, a, value) + => FreshReconsideration' PROOF - BY SubmitResolutionPreservesTerminalRecordRequiresRequestPointwise - DEF TerminalRecordRequiresRequest - - -THEOREM SubmitResolutionPreservesExactBindingPointwise == - ASSUME InductiveInvariant, - NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW value \in TerminalResolutions, - SubmitResolution(r, b, a, value), - NEW q \in requests' - PROVE - terminalRecord'[q] = NoRecord \/ - terminalBinding'[q] = requestBinding'[q] -PROOF - <1>1. CASE q = r - <2>1. - /\ terminalBinding'[r] = b - /\ b = requestBinding[r] - /\ requestBinding' = requestBinding - BY SubmitResolutionNewKeyValues, - SubmitResolutionGuardFacts, - SubmitResolutionUnchangedValues - - <2>2. QED - BY <1>1, <2>1 - - <1>2. CASE q # r - <2>1. q \in requests - BY <1>2, - SubmitResolutionUnchangedValues - - <2>2. - terminalRecord[q] = NoRecord \/ - terminalBinding[q] = requestBinding[q] - BY <2>1 - DEF InductiveInvariant, ExactBinding - - <2>3. q \in ResolutionIds - BY <2>1 - DEF InductiveInvariant, TypeOK - - <2>4. terminalRecord'[q] = terminalRecord[q] - BY <1>2, <2>3, - SubmitResolutionOldKeyValues - - <2>5. terminalBinding'[q] = terminalBinding[q] - BY <1>2, <2>3, - SubmitResolutionOldKeyValues - - <2>6. requestBinding' = requestBinding - BY SubmitResolutionUnchangedValues - - <2>7. QED - BY <2>2, <2>4, <2>5, <2>6 - - <1>3. QED - BY <1>1, <1>2 + BY DEF InductiveInvariant, + FreshReconsideration, + SubmitResolution, + Requests, + PreviousCommitment -THEOREM SubmitResolutionPreservesExactBinding == - ASSUME InductiveInvariant, - NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW value \in TerminalResolutions, - SubmitResolution(r, b, a, value) - PROVE ExactBinding' +THEOREM SubmitResolutionPreservesInductiveInvariant == + \A r \in ResolutionIds, b \in Bindings, a \in Authorities, + value \in TerminalResolutions : + InductiveInvariant /\ SubmitResolution(r, b, a, value) + => InductiveInvariant' PROOF - BY SubmitResolutionPreservesExactBindingPointwise - DEF ExactBinding + BY SubmitResolutionPreservesTypeOK, + SubmitResolutionPreservesTerminalRecordRequiresRequest, + SubmitResolutionPreservesTerminalBindingDerived, + SubmitResolutionPreservesLocalAuthorityRoot, + SubmitResolutionPreservesDelegatedAuthoritySound, + SubmitResolutionPreservesFreshReconsideration + DEF InductiveInvariant -THEOREM SubmitResolutionPreservesLocalAuthorityRoot == - ASSUME InductiveInvariant, - NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW value \in TerminalResolutions, - SubmitResolution(r, b, a, value) - PROVE LocalAuthorityRoot' +THEOREM StateStutterPreservesInductiveInvariant == + InductiveInvariant /\ UNCHANGED vars + => InductiveInvariant' PROOF - BY SubmitResolutionUnchangedValues - DEF InductiveInvariant, LocalAuthorityRoot - - -THEOREM SubmitResolutionPreservesDelegatedAuthorityPointwise == - ASSUME InductiveInvariant, - NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW value \in TerminalResolutions, - SubmitResolution(r, b, a, value), - NEW q \in requests' - PROVE - terminalRecord'[q] = NoRecord \/ - <> - \in authorityProofBindings' -PROOF - <1>1. CASE q = r - <2>1. - /\ terminalAuthority'[r] = a - /\ requestBinding' = requestBinding - /\ authorityProofBindings' = authorityProofBindings - /\ b = requestBinding[r] - /\ <> \in authorityProofBindings - BY SubmitResolutionNewKeyValues, - SubmitResolutionUnchangedValues, - SubmitResolutionGuardFacts - - <2>2. QED - BY <1>1, <2>1 - - <1>2. CASE q # r - <2>1. q \in requests - BY <1>2, - SubmitResolutionUnchangedValues - - <2>2. - terminalRecord[q] = NoRecord \/ - <> - \in authorityProofBindings - BY <2>1 - DEF InductiveInvariant, DelegatedAuthoritySound - - <2>3. q \in ResolutionIds - BY <2>1 - DEF InductiveInvariant, TypeOK - - <2>4. terminalRecord'[q] = terminalRecord[q] - BY <1>2, <2>3, - SubmitResolutionOldKeyValues - - <2>5. terminalAuthority'[q] = terminalAuthority[q] - BY <1>2, <2>3, - SubmitResolutionOldKeyValues - - <2>6. requestBinding' = requestBinding - BY SubmitResolutionUnchangedValues - - <2>7. authorityProofBindings' = authorityProofBindings - BY SubmitResolutionUnchangedValues - - <2>8. QED - BY <2>2, <2>4, <2>5, <2>6, <2>7 - - <1>3. QED - BY <1>1, <1>2 + BY DEF vars, + canonicalVars, + InductiveInvariant, + TypeOK, + TerminalBindingDerived, + LocalAuthorityRoot, + DelegatedAuthoritySound, + FreshReconsideration, + TerminalRecordRequiresRequest, + Requests, + TerminalRequests, + RequestBinding, + PreviousCommitment, + TerminalBinding, + TerminalAuthority -THEOREM SubmitResolutionPreservesDelegatedAuthoritySound == - ASSUME InductiveInvariant, - NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW value \in TerminalResolutions, - SubmitResolution(r, b, a, value) - PROVE DelegatedAuthoritySound' +THEOREM ObserveConflictPreservesTypeOK == + \A r \in ResolutionIds : + TypeOK /\ ObserveConflict(r) => TypeOK' PROOF - <1>1. - localAuthorityBindings' \subseteq authorityProofBindings' - BY SubmitResolutionUnchangedValues - DEF InductiveInvariant, DelegatedAuthoritySound + BY DEF TypeOK, ObserveConflict - <1>2. - \A q \in requests' : - terminalRecord'[q] = NoRecord \/ - <> - \in authorityProofBindings' - BY SubmitResolutionPreservesDelegatedAuthorityPointwise - <1>3. QED - BY <1>1, <1>2 - DEF DelegatedAuthoritySound - - -THEOREM SubmitResolutionPreservesExistingTerminal == - ASSUME InductiveInvariant, - NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW value \in TerminalResolutions, - SubmitResolution(r, b, a, value), - NEW p \in ResolutionIds, - terminalRecord[p] \in TerminalResolutions - PROVE terminalRecord'[p] \in TerminalResolutions +THEOREM ObserveConflictPreservesTerminalBindingDerived == + \A r \in ResolutionIds : + TerminalBindingDerived /\ ObserveConflict(r) + => TerminalBindingDerived' PROOF - <1>1. terminalRecord[r] = NoRecord - BY SubmitResolutionGuardFacts - - <1>2. p # r - BY <1>1, NoRecordIsNotTerminal - DEF TerminalResolutions + BY DEF TerminalBindingDerived, + ObserveConflict, + Requests, + TerminalRequests, + TerminalBinding, + RequestBinding - <1>3. terminalRecord'[p] = terminalRecord[p] - BY <1>2, - SubmitResolutionOldKeyValues - <1>4. QED - BY <1>3 - - -THEOREM SubmitResolutionPreservesFreshReconsiderationPointwise == - ASSUME InductiveInvariant, - NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW value \in TerminalResolutions, - SubmitResolution(r, b, a, value), - NEW q \in requests' - PROVE - \/ previousResolutionCommitment'[q] = NoCommitment - \/ previousResolutionCommitment'[q] \in RecognizedTerminalCommitments +THEOREM ObserveConflictPreservesLocalAuthorityRoot == + \A r \in ResolutionIds : + LocalAuthorityRoot /\ ObserveConflict(r) => LocalAuthorityRoot' PROOF - <1>1. q \in requests - BY SubmitResolutionUnchangedValues + BY DEF LocalAuthorityRoot, + ObserveConflict, + Requests, + RequestBinding - <1>2. - \/ previousResolutionCommitment[q] = NoCommitment - \/ previousResolutionCommitment[q] \in RecognizedTerminalCommitments - BY <1>1 - DEF InductiveInvariant, FreshReconsideration - <1>3. previousResolutionCommitment' = previousResolutionCommitment - BY SubmitResolutionUnchangedValues - - <1>4. QED - BY <1>2, <1>3 +THEOREM ObserveConflictPreservesDelegatedAuthoritySound == + \A r \in ResolutionIds : + DelegatedAuthoritySound /\ ObserveConflict(r) + => DelegatedAuthoritySound' +PROOF + BY DEF DelegatedAuthoritySound, + ObserveConflict, + Requests, + TerminalRequests, + RequestBinding, + TerminalAuthority -THEOREM SubmitResolutionPreservesFreshReconsideration == - ASSUME InductiveInvariant, - NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW value \in TerminalResolutions, - SubmitResolution(r, b, a, value) - PROVE FreshReconsideration' +THEOREM ObserveConflictPreservesFreshReconsideration == + \A r \in ResolutionIds : + FreshReconsideration /\ ObserveConflict(r) + => FreshReconsideration' PROOF - BY SubmitResolutionPreservesFreshReconsiderationPointwise - DEF FreshReconsideration + BY DEF FreshReconsideration, + ObserveConflict, + Requests, + PreviousCommitment -THEOREM SubmitResolutionPreservesInductiveInvariant == - ASSUME InductiveInvariant, - NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW value \in TerminalResolutions, - SubmitResolution(r, b, a, value) - PROVE InductiveInvariant' +THEOREM ObserveConflictPreservesTerminalRecordRequiresRequest == + \A r \in ResolutionIds : + TerminalRecordRequiresRequest /\ ObserveConflict(r) + => TerminalRecordRequiresRequest' PROOF - BY SubmitResolutionPreservesTypeOK, - SubmitResolutionPreservesTerminalRecordRequiresRequest, - SubmitResolutionPreservesExactBinding, - SubmitResolutionPreservesLocalAuthorityRoot, - SubmitResolutionPreservesDelegatedAuthoritySound, - SubmitResolutionPreservesFreshReconsideration - DEF InductiveInvariant + BY DEF TerminalRecordRequiresRequest, + ObserveConflict, + Requests, + TerminalRequests THEOREM ObserveConflictPreservesInductiveInvariant == - ASSUME InductiveInvariant, - NEW r \in ResolutionIds, - ObserveConflict(r) - PROVE InductiveInvariant' -PROOF - BY DEF ObserveConflict, - InductiveInvariant, - TypeOK, - TerminalRecordRequiresRequest, - ExactBinding, - LocalAuthorityRoot, - DelegatedAuthoritySound, - FreshReconsideration + \A r \in ResolutionIds : + InductiveInvariant /\ ObserveConflict(r) + => InductiveInvariant' +PROOF + BY ObserveConflictPreservesTypeOK, + ObserveConflictPreservesTerminalBindingDerived, + ObserveConflictPreservesLocalAuthorityRoot, + ObserveConflictPreservesDelegatedAuthoritySound, + ObserveConflictPreservesFreshReconsideration, + ObserveConflictPreservesTerminalRecordRequiresRequest + DEF InductiveInvariant THEOREM ObserveInvalidMaterialPreservesInductiveInvariant == - ASSUME InductiveInvariant, - NEW r \in ResolutionIds, - ObserveInvalidMaterial(r) - PROVE InductiveInvariant' + \A r \in ResolutionIds : + InductiveInvariant /\ ObserveInvalidMaterial(r) + => InductiveInvariant' PROOF - BY DEF ObserveInvalidMaterial, - InductiveInvariant, - TypeOK, - TerminalRecordRequiresRequest, - ExactBinding, - LocalAuthorityRoot, - DelegatedAuthoritySound, - FreshReconsideration + BY StateStutterPreservesInductiveInvariant + DEF ObserveInvalidMaterial THEOREM ObserveNonAuthoritativeInputPreservesInductiveInvariant == - ASSUME InductiveInvariant, - NEW r \in ResolutionIds, - ObserveNonAuthoritativeInput(r) - PROVE InductiveInvariant' -PROOF - BY DEF ObserveNonAuthoritativeInput, - InductiveInvariant, - TypeOK, - TerminalRecordRequiresRequest, - ExactBinding, - LocalAuthorityRoot, - DelegatedAuthoritySound, - FreshReconsideration - - -THEOREM StateStutterPreservesInductiveInvariant == - InductiveInvariant /\ UNCHANGED vars - => InductiveInvariant' + \A r \in ResolutionIds : + InductiveInvariant /\ ObserveNonAuthoritativeInput(r) + => InductiveInvariant' PROOF - BY DEF vars, - InductiveInvariant, - TypeOK, - TerminalRecordRequiresRequest, - ExactBinding, - LocalAuthorityRoot, - DelegatedAuthoritySound, - FreshReconsideration + BY StateStutterPreservesInductiveInvariant + DEF ObserveNonAuthoritativeInput THEOREM EvaluatePreservesInductiveInvariant == @@ -1159,15 +567,31 @@ PROOF DEF Evaluate -THEOREM RecognizedCanonicalTransitionPreservesInductiveInvariant == - InductiveInvariant /\ RecognizedCanonicalTransition +THEOREM RecognizedSeedTransitionPreservesInductiveInvariant == + InductiveInvariant /\ RecognizedSeedTransition => InductiveInvariant' PROOF BY RegisterRequestPreservesInductiveInvariant, - SubmitResolutionPreservesInductiveInvariant, - ObserveConflictPreservesInductiveInvariant, + SubmitResolutionPreservesInductiveInvariant + DEF RecognizedSeedTransition + + +THEOREM RecognizedEnvironmentTransitionPreservesInductiveInvariant == + InductiveInvariant /\ RecognizedEnvironmentTransition + => InductiveInvariant' +PROOF + BY ObserveConflictPreservesInductiveInvariant, ObserveInvalidMaterialPreservesInductiveInvariant, ObserveNonAuthoritativeInputPreservesInductiveInvariant + DEF RecognizedEnvironmentTransition + + +THEOREM RecognizedCanonicalTransitionPreservesInductiveInvariant == + InductiveInvariant /\ RecognizedCanonicalTransition + => InductiveInvariant' +PROOF + BY RecognizedSeedTransitionPreservesInductiveInvariant, + RecognizedEnvironmentTransitionPreservesInductiveInvariant DEF RecognizedCanonicalTransition @@ -1186,6 +610,7 @@ THEOREM BoxNextPreservesInductiveInvariant == PROOF BY NextPreservesInductiveInvariant, StateStutterPreservesInductiveInvariant + DEF vars THEOREM SpecImpliesAlwaysInductiveInvariant == @@ -1212,55 +637,61 @@ PROOF THEOREM RegisterRequestSatisfiesRequestsAppendOnlyStep == - ASSUME NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW previous \in TerminalCommitments \cup {NoCommitment}, - RegisterRequest(r, b, a, previous) - PROVE RequestsAppendOnlyStep + \A r \in ResolutionIds, b \in Bindings, a \in Authorities, + previous \in TerminalCommitments \cup {NoCommitment} : + RegisterRequest(r, b, a, previous) => RequestsAppendOnlyStep PROOF - BY DEF RegisterRequest, RequestsAppendOnlyStep + BY DEF RegisterRequest, + RequestsAppendOnlyStep, + Requests THEOREM SubmitResolutionSatisfiesRequestsAppendOnlyStep == - ASSUME NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW value \in TerminalResolutions, - SubmitResolution(r, b, a, value) - PROVE RequestsAppendOnlyStep + \A r \in ResolutionIds, b \in Bindings, a \in Authorities, + value \in TerminalResolutions : + SubmitResolution(r, b, a, value) => RequestsAppendOnlyStep PROOF - BY DEF SubmitResolution, RequestsAppendOnlyStep + BY DEF SubmitResolution, + RequestsAppendOnlyStep, + Requests THEOREM ObserveConflictSatisfiesRequestsAppendOnlyStep == - ASSUME NEW r \in ResolutionIds, - ObserveConflict(r) - PROVE RequestsAppendOnlyStep + \A r \in ResolutionIds : + ObserveConflict(r) => RequestsAppendOnlyStep +PROOF + BY DEF ObserveConflict, + RequestsAppendOnlyStep, + Requests + + +THEOREM StateStutterSatisfiesRequestsAppendOnlyStep == + UNCHANGED vars => RequestsAppendOnlyStep PROOF - BY DEF ObserveConflict, RequestsAppendOnlyStep + BY DEF vars, canonicalVars, RequestsAppendOnlyStep, Requests THEOREM ObserveInvalidMaterialSatisfiesRequestsAppendOnlyStep == - ASSUME NEW r \in ResolutionIds, - ObserveInvalidMaterial(r) - PROVE RequestsAppendOnlyStep + \A r \in ResolutionIds : + ObserveInvalidMaterial(r) => RequestsAppendOnlyStep PROOF - BY DEF ObserveInvalidMaterial, RequestsAppendOnlyStep + BY StateStutterSatisfiesRequestsAppendOnlyStep + DEF ObserveInvalidMaterial THEOREM ObserveNonAuthoritativeInputSatisfiesRequestsAppendOnlyStep == - ASSUME NEW r \in ResolutionIds, - ObserveNonAuthoritativeInput(r) - PROVE RequestsAppendOnlyStep + \A r \in ResolutionIds : + ObserveNonAuthoritativeInput(r) => RequestsAppendOnlyStep PROOF - BY DEF ObserveNonAuthoritativeInput, RequestsAppendOnlyStep + BY StateStutterSatisfiesRequestsAppendOnlyStep + DEF ObserveNonAuthoritativeInput THEOREM EvaluateSatisfiesRequestsAppendOnlyStep == Evaluate => RequestsAppendOnlyStep PROOF - BY DEF Evaluate, vars, RequestsAppendOnlyStep + BY StateStutterSatisfiesRequestsAppendOnlyStep + DEF Evaluate THEOREM RecognizedCanonicalTransitionSatisfiesRequestsAppendOnlyStep == @@ -1271,7 +702,9 @@ PROOF ObserveConflictSatisfiesRequestsAppendOnlyStep, ObserveInvalidMaterialSatisfiesRequestsAppendOnlyStep, ObserveNonAuthoritativeInputSatisfiesRequestsAppendOnlyStep - DEF RecognizedCanonicalTransition + DEF RecognizedCanonicalTransition, + RecognizedSeedTransition, + RecognizedEnvironmentTransition THEOREM NextSatisfiesRequestsAppendOnlyStep == @@ -1297,187 +730,79 @@ PROOF DEF Spec, RequestsAppendOnly -THEOREM RegisterRequestSatisfiesObservedInputsAppendOnlyStep == - ASSUME NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW previous \in TerminalCommitments \cup {NoCommitment}, - RegisterRequest(r, b, a, previous) - PROVE ObservedInputsAppendOnlyStep -PROOF - BY DEF RegisterRequest, ObservedInputsAppendOnlyStep - - -THEOREM SubmitResolutionSatisfiesObservedInputsAppendOnlyStep == - ASSUME NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW value \in TerminalResolutions, - SubmitResolution(r, b, a, value) - PROVE ObservedInputsAppendOnlyStep -PROOF - BY DEF SubmitResolution, ObservedInputsAppendOnlyStep - - -THEOREM ObserveConflictSatisfiesObservedInputsAppendOnlyStep == - ASSUME NEW r \in ResolutionIds, - ObserveConflict(r) - PROVE ObservedInputsAppendOnlyStep -PROOF - BY DEF ObserveConflict, ObservedInputsAppendOnlyStep - - -THEOREM ObserveInvalidMaterialSatisfiesObservedInputsAppendOnlyStep == - ASSUME NEW r \in ResolutionIds, - ObserveInvalidMaterial(r) - PROVE ObservedInputsAppendOnlyStep -PROOF - BY DEF ObserveInvalidMaterial, ObservedInputsAppendOnlyStep - - -THEOREM ObserveNonAuthoritativeInputSatisfiesObservedInputsAppendOnlyStep == - ASSUME NEW r \in ResolutionIds, - ObserveNonAuthoritativeInput(r) - PROVE ObservedInputsAppendOnlyStep -PROOF - BY DEF ObserveNonAuthoritativeInput, ObservedInputsAppendOnlyStep - - -THEOREM EvaluateSatisfiesObservedInputsAppendOnlyStep == - Evaluate => ObservedInputsAppendOnlyStep -PROOF - BY DEF Evaluate, vars, ObservedInputsAppendOnlyStep - - -THEOREM RecognizedCanonicalTransitionSatisfiesObservedInputsAppendOnlyStep == - RecognizedCanonicalTransition => ObservedInputsAppendOnlyStep -PROOF - BY RegisterRequestSatisfiesObservedInputsAppendOnlyStep, - SubmitResolutionSatisfiesObservedInputsAppendOnlyStep, - ObserveConflictSatisfiesObservedInputsAppendOnlyStep, - ObserveInvalidMaterialSatisfiesObservedInputsAppendOnlyStep, - ObserveNonAuthoritativeInputSatisfiesObservedInputsAppendOnlyStep - DEF RecognizedCanonicalTransition - - -THEOREM NextSatisfiesObservedInputsAppendOnlyStep == - Next => ObservedInputsAppendOnlyStep -PROOF - BY RecognizedCanonicalTransitionSatisfiesObservedInputsAppendOnlyStep, - EvaluateSatisfiesObservedInputsAppendOnlyStep - DEF Next - - -THEOREM BoxNextSatisfiesBoxObservedInputsAppendOnlyStep == - [Next]_vars => [ObservedInputsAppendOnlyStep]_vars -PROOF - BY NextSatisfiesObservedInputsAppendOnlyStep - DEF vars, ObservedInputsAppendOnlyStep - - -THEOREM SpecImpliesObservedInputsAppendOnly == - Spec => ObservedInputsAppendOnly -PROOF - BY PTL, - BoxNextSatisfiesBoxObservedInputsAppendOnlyStep - DEF Spec, ObservedInputsAppendOnly - - THEOREM RegisterRequestSatisfiesTerminalRecordsImmutableStep == - ASSUME NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW previous \in TerminalCommitments \cup {NoCommitment}, - RegisterRequest(r, b, a, previous) - PROVE TerminalRecordsImmutableStep + \A r \in ResolutionIds, b \in Bindings, a \in Authorities, + previous \in TerminalCommitments \cup {NoCommitment} : + RegisterRequest(r, b, a, previous) => TerminalRecordsImmutableStep PROOF - BY DEF RegisterRequest, TerminalRecordsImmutableStep + BY DEF RegisterRequest, + TerminalRecordsImmutableStep, + TerminalRequests -THEOREM SubmitResolutionSatisfiesTerminalRecordsImmutablePointwise == - ASSUME InductiveInvariant, - NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW value \in TerminalResolutions, - SubmitResolution(r, b, a, value), - NEW p \in ResolutionIds, - terminalRecord[p] # NoRecord - PROVE - /\ terminalRecord'[p] = terminalRecord[p] - /\ terminalBinding'[p] = terminalBinding[p] - /\ terminalAuthority'[p] = terminalAuthority[p] +THEOREM SubmitResolutionSatisfiesTerminalRecordsImmutableStep == + \A r \in ResolutionIds, b \in Bindings, a \in Authorities, + value \in TerminalResolutions : + SubmitResolution(r, b, a, value) => TerminalRecordsImmutableStep PROOF - <1>1. terminalRecord[r] = NoRecord - BY SubmitResolutionGuardFacts - - <1>2. p # r - BY <1>1 - - <1>3. QED - BY <1>2, - SubmitResolutionOldKeyValues + BY DEF SubmitResolution, + TerminalRecordsImmutableStep, + TerminalRequests -THEOREM SubmitResolutionSatisfiesTerminalRecordsImmutableStep == - ASSUME InductiveInvariant, - NEW r \in ResolutionIds, - NEW b \in Bindings, - NEW a \in Authorities, - NEW value \in TerminalResolutions, - SubmitResolution(r, b, a, value) - PROVE TerminalRecordsImmutableStep +THEOREM ObserveConflictSatisfiesTerminalRecordsImmutableStep == + \A r \in ResolutionIds : + ObserveConflict(r) => TerminalRecordsImmutableStep PROOF - BY SubmitResolutionSatisfiesTerminalRecordsImmutablePointwise - DEF TerminalRecordsImmutableStep + BY DEF ObserveConflict, + TerminalRecordsImmutableStep, + TerminalRequests -THEOREM ObserveConflictSatisfiesTerminalRecordsImmutableStep == - ASSUME NEW r \in ResolutionIds, - ObserveConflict(r) - PROVE TerminalRecordsImmutableStep +THEOREM StateStutterSatisfiesTerminalRecordsImmutableStep == + UNCHANGED vars => TerminalRecordsImmutableStep PROOF - BY DEF ObserveConflict, TerminalRecordsImmutableStep + BY DEF vars, canonicalVars, TerminalRecordsImmutableStep, TerminalRequests THEOREM ObserveInvalidMaterialSatisfiesTerminalRecordsImmutableStep == - ASSUME NEW r \in ResolutionIds, - ObserveInvalidMaterial(r) - PROVE TerminalRecordsImmutableStep + \A r \in ResolutionIds : + ObserveInvalidMaterial(r) => TerminalRecordsImmutableStep PROOF - BY DEF ObserveInvalidMaterial, TerminalRecordsImmutableStep + BY StateStutterSatisfiesTerminalRecordsImmutableStep + DEF ObserveInvalidMaterial THEOREM ObserveNonAuthoritativeInputSatisfiesTerminalRecordsImmutableStep == - ASSUME NEW r \in ResolutionIds, - ObserveNonAuthoritativeInput(r) - PROVE TerminalRecordsImmutableStep + \A r \in ResolutionIds : + ObserveNonAuthoritativeInput(r) => TerminalRecordsImmutableStep PROOF - BY DEF ObserveNonAuthoritativeInput, - TerminalRecordsImmutableStep + BY StateStutterSatisfiesTerminalRecordsImmutableStep + DEF ObserveNonAuthoritativeInput THEOREM EvaluateSatisfiesTerminalRecordsImmutableStep == Evaluate => TerminalRecordsImmutableStep PROOF - BY DEF Evaluate, vars, TerminalRecordsImmutableStep + BY StateStutterSatisfiesTerminalRecordsImmutableStep + DEF Evaluate THEOREM RecognizedCanonicalTransitionSatisfiesTerminalRecordsImmutableStep == - InductiveInvariant /\ RecognizedCanonicalTransition - => TerminalRecordsImmutableStep + RecognizedCanonicalTransition => TerminalRecordsImmutableStep PROOF BY RegisterRequestSatisfiesTerminalRecordsImmutableStep, SubmitResolutionSatisfiesTerminalRecordsImmutableStep, ObserveConflictSatisfiesTerminalRecordsImmutableStep, ObserveInvalidMaterialSatisfiesTerminalRecordsImmutableStep, ObserveNonAuthoritativeInputSatisfiesTerminalRecordsImmutableStep - DEF RecognizedCanonicalTransition + DEF RecognizedCanonicalTransition, + RecognizedSeedTransition, + RecognizedEnvironmentTransition THEOREM NextSatisfiesTerminalRecordsImmutableStep == - InductiveInvariant /\ Next - => TerminalRecordsImmutableStep + Next => TerminalRecordsImmutableStep PROOF BY RecognizedCanonicalTransitionSatisfiesTerminalRecordsImmutableStep, EvaluateSatisfiesTerminalRecordsImmutableStep @@ -1485,8 +810,7 @@ PROOF THEOREM BoxNextSatisfiesBoxTerminalRecordsImmutableStep == - InductiveInvariant /\ [Next]_vars - => [TerminalRecordsImmutableStep]_vars + [Next]_vars => [TerminalRecordsImmutableStep]_vars PROOF BY NextSatisfiesTerminalRecordsImmutableStep DEF vars, TerminalRecordsImmutableStep @@ -1496,7 +820,6 @@ THEOREM SpecImpliesTerminalRecordsImmutable == Spec => TerminalRecordsImmutable PROOF BY PTL, - SpecImpliesAlwaysInductiveInvariant, BoxNextSatisfiesBoxTerminalRecordsImmutableStep DEF Spec, TerminalRecordsImmutable @@ -1509,8 +832,7 @@ PROOF THEOREM EvaluateSatisfiesCanonicalTransitionStep == - Evaluate - => CanonicalStateChangesOnlyByRecognizedTransitionStep + Evaluate => CanonicalStateChangesOnlyByRecognizedTransitionStep PROOF BY DEF Evaluate, vars, @@ -1519,8 +841,7 @@ PROOF THEOREM NextSatisfiesCanonicalTransitionStep == - Next - => CanonicalStateChangesOnlyByRecognizedTransitionStep + Next => CanonicalStateChangesOnlyByRecognizedTransitionStep PROOF BY RecognizedCanonicalTransitionSatisfiesCanonicalTransitionStep, EvaluateSatisfiesCanonicalTransitionStep @@ -1528,8 +849,7 @@ PROOF THEOREM BoxNextSatisfiesBoxCanonicalTransitionStep == - [Next]_vars - => [CanonicalStateChangesOnlyByRecognizedTransitionStep]_vars + [Next]_vars => [CanonicalStateChangesOnlyByRecognizedTransitionStep]_vars PROOF BY NextSatisfiesCanonicalTransitionStep DEF vars, @@ -1542,7 +862,64 @@ THEOREM SpecImpliesCanonicalStateChangesOnlyByRecognizedTransition == PROOF BY PTL, BoxNextSatisfiesBoxCanonicalTransitionStep - DEF Spec, - CanonicalStateChangesOnlyByRecognizedTransition + DEF Spec, CanonicalStateChangesOnlyByRecognizedTransition + + +THEOREM InvalidMaterialActionIsStutter == + \A r \in ResolutionIds : + ObserveInvalidMaterial(r) => UNCHANGED vars +PROOF + BY DEF ObserveInvalidMaterial + + +THEOREM NextSatisfiesInvalidMaterialStutterStep == + Next => InvalidMaterialStutterStep +PROOF + BY InvalidMaterialActionIsStutter + DEF InvalidMaterialStutterStep + + +THEOREM BoxNextSatisfiesBoxInvalidMaterialStutterStep == + [Next]_vars => [InvalidMaterialStutterStep]_vars +PROOF + BY NextSatisfiesInvalidMaterialStutterStep + DEF vars, InvalidMaterialStutterStep + + +THEOREM SpecImpliesInvalidMaterialStutter == + Spec => InvalidMaterialStutter +PROOF + BY PTL, + BoxNextSatisfiesBoxInvalidMaterialStutterStep + DEF Spec, InvalidMaterialStutter + + +THEOREM NonAuthoritativeInputActionIsStutter == + \A r \in ResolutionIds : + ObserveNonAuthoritativeInput(r) => UNCHANGED vars +PROOF + BY DEF ObserveNonAuthoritativeInput + + +THEOREM NextSatisfiesNonAuthoritativeInputsStutterStep == + Next => NonAuthoritativeInputsStutterStep +PROOF + BY NonAuthoritativeInputActionIsStutter + DEF NonAuthoritativeInputsStutterStep + + +THEOREM BoxNextSatisfiesBoxNonAuthoritativeInputsStutterStep == + [Next]_vars => [NonAuthoritativeInputsStutterStep]_vars +PROOF + BY NextSatisfiesNonAuthoritativeInputsStutterStep + DEF vars, NonAuthoritativeInputsStutterStep + + +THEOREM SpecImpliesNonAuthoritativeInputsStutter == + Spec => NonAuthoritativeInputsStutter +PROOF + BY PTL, + BoxNextSatisfiesBoxNonAuthoritativeInputsStutterStep + DEF Spec, NonAuthoritativeInputsStutter ============================================================================= diff --git a/seed/canonical/schemas/canon-tla-refinement.schema.json b/seed/canonical/schemas/canon-tla-refinement.schema.json index 7ad25bb..81b981e 100644 --- a/seed/canonical/schemas/canon-tla-refinement.schema.json +++ b/seed/canonical/schemas/canon-tla-refinement.schema.json @@ -141,7 +141,7 @@ "const": "seed/canonical/formal/SeedCanonProjection.tla" }, "profile": { - "const": "ASET-SEED-CANON-TLA-PROJECTION-V2" + "const": "ASET-SEED-CANON-TLA-PROJECTION-V3" } }, "required": [ diff --git a/tests/test_ci_assurance.py b/tests/test_ci_assurance.py index ad60c1d..baa6725 100644 --- a/tests/test_ci_assurance.py +++ b/tests/test_ci_assurance.py @@ -85,7 +85,8 @@ def test_tlaps_gate_and_final_theorems_are_declared(): "SpecImpliesRequestsAppendOnly", "SpecImpliesTerminalRecordsImmutable", "SpecImpliesCanonicalStateChangesOnlyByRecognizedTransition", - "SpecImpliesObservedInputsAppendOnly", + "SpecImpliesInvalidMaterialStutter", + "SpecImpliesNonAuthoritativeInputsStutter", ): assert f"THEOREM {theorem} ==" in proof @@ -121,14 +122,20 @@ def test_seed_resolution_tla_uses_valid_operator_tokens(): specification = (ROOT / "seed/canonical/formal/SeedResolution.tla").read_text( encoding="utf-8" ) - assert "/\\\\" not in specification + assert r"/\\" not in specification assert "Range(" not in specification - assert ( - "Init ==\n /\\ localAuthorityBindings \\in SUBSET (Authorities \\X Bindings)" - in specification - ) - assert " /\\ requests = {}" in specification - assert "Spec == Init /\\ [][Next]_vars" in specification + assert "VARIABLES\n requestMeta,\n terminalMeta,\n conflicts" in specification + assert "LocalAuthorityBindings" in specification + assert "AuthorityProofBindings" in specification + assert "observedInputs" not in specification + assert "invalidMaterial" not in specification + assert "terminalBinding," not in specification + assert "requestAuthority," not in specification + assert "Requests == DOMAIN requestMeta" in specification + assert "TerminalRequests == DOMAIN terminalMeta" in specification + assert "NoRequest" not in specification + assert "NoTerminal" not in specification + assert r"Spec == Init /\ [][Next]_vars" in specification def test_seed_resolution_tlc_treats_terminal_states_as_intended_quiescence(): @@ -140,10 +147,9 @@ def test_seed_resolution_tlc_treats_terminal_states_as_intended_quiescence(): ) assert "TerminalUnique ==" in specification assert "CHECK_DEADLOCK FALSE" in configuration - assert "LocalAuthorityBindings =" not in configuration - assert ( - r"localAuthorityBindings \in SUBSET (Authorities \X Bindings)" in specification - ) + assert "LocalAuthorityBindings <- TLC_LocalAuthorityBindings" in configuration + assert "AuthorityProofBindings <- TLC_AuthorityProofBindings" in configuration + assert r"LocalAuthorityBindings \subseteq AuthorityProofBindings" in specification def test_active_audit_index_tracks_active_canon_package(): diff --git a/tools/check_assurance_traceability.py b/tools/check_assurance_traceability.py index 70d0f88..4408305 100755 --- a/tools/check_assurance_traceability.py +++ b/tools/check_assurance_traceability.py @@ -15,7 +15,8 @@ "SpecImpliesRequestsAppendOnly", "SpecImpliesTerminalRecordsImmutable", "SpecImpliesCanonicalStateChangesOnlyByRecognizedTransition", - "SpecImpliesObservedInputsAppendOnly", + "SpecImpliesInvalidMaterialStutter", + "SpecImpliesNonAuthoritativeInputsStutter", ) diff --git a/tools/check_proof_traceability.py b/tools/check_proof_traceability.py index 7745efe..3709b0d 100644 --- a/tools/check_proof_traceability.py +++ b/tools/check_proof_traceability.py @@ -25,7 +25,8 @@ "CanonicalStateChangesOnlyByRecognizedTransition": ( "SpecImpliesCanonicalStateChangesOnlyByRecognizedTransition" ), - "ObservedInputsAppendOnly": "SpecImpliesObservedInputsAppendOnly", + "InvalidMaterialStutter": "SpecImpliesInvalidMaterialStutter", + "NonAuthoritativeInputsStutter": "SpecImpliesNonAuthoritativeInputsStutter", } STATE_SAFETY_THEOREM = "SpecImpliesAlwaysSeedStateSafety" diff --git a/tools/generate_canon_tla_projection.py b/tools/generate_canon_tla_projection.py index 4479f93..ead59d3 100755 --- a/tools/generate_canon_tla_projection.py +++ b/tools/generate_canon_tla_projection.py @@ -12,7 +12,7 @@ RELATION_PATH = ROOT / "seed/canonical/assurance/canon-tla-refinement.json" OUTPUT_PATH = ROOT / "seed/canonical/formal/SeedCanonProjection.tla" -EXPECTED_PROFILE = "ASET-SEED-CANON-TLA-PROJECTION-V2" +EXPECTED_PROFILE = "ASET-SEED-CANON-TLA-PROJECTION-V3" EXPECTED_REQUIREMENT_PREDICATES = [ "binding_exact", "request_fresh", @@ -107,7 +107,7 @@ def render(model: dict[str, Any], relation: dict[str, Any]) -> str: source_sha = relation["source_model"]["sha256"] profile = relation["generated_projection"]["profile"] - return f"""---------------- MODULE SeedCanonProjection ---------------- + return f'''---------------- MODULE SeedCanonProjection ---------------- EXTENDS SeedResolution (* @@ -116,10 +116,10 @@ def render(model: dict[str, Any], relation: dict[str, Any]) -> str: Source SHA-256: {source_sha} Projection profile: {profile} -This module is the deterministic TLA+ interpretation used by the -canon-to-TLA refinement assurance. It intentionally preserves the declared -opaque Binding, authorityProofBindings and RecognizedTerminalCommitments -abstractions. +V3 projects the same canonical behavior onto the normalized three-variable +Seed state. Immutable Authority relations are context constants. Accepted +terminal binding is derived from requestMeta; invalid/non-authoritative inputs +are stuttering observations rather than retained canonical state. *) CanonResolutions == {tla_set(algebra["values"])} @@ -130,136 +130,88 @@ def render(model: dict[str, Any], relation: dict[str, Any]) -> str: CanonConflictResult == {json.dumps(algebra["conflict_result"])} CanonInit == - /\\ localAuthorityBindings \\in SUBSET (Authorities \\X Bindings) - /\\ authorityProofBindings \\in SUBSET (Authorities \\X Bindings) - /\\ localAuthorityBindings \\subseteq authorityProofBindings - /\\ requests = {{}} - /\\ requestBinding = [r \\in ResolutionIds |-> CHOOSE b \\in Bindings : TRUE] - /\\ requestAuthority = [r \\in ResolutionIds |-> CHOOSE a \\in Authorities : TRUE] - /\\ previousResolutionCommitment = [r \\in ResolutionIds |-> NoCommitment] - /\\ terminalRecord = [r \\in ResolutionIds |-> NoRecord] - /\\ terminalBinding = [r \\in ResolutionIds |-> CHOOSE b \\in Bindings : TRUE] - /\\ terminalAuthority = [r \\in ResolutionIds |-> CHOOSE a \\in Authorities : TRUE] + /\\ requestMeta = [r \\in {{}} |-> r] + /\\ terminalMeta = [r \\in {{}} |-> r] /\\ conflicts = {{}} - /\\ invalidMaterial = {{}} - /\\ observedInputs = {{}} CanonRegisterRequest(r, b, a, previous) == - /\\ r \\in ResolutionIds \\ requests + /\\ r \\in ResolutionIds \\ Requests /\\ b \\in Bindings /\\ a \\in Authorities - /\\ <> \\in localAuthorityBindings + /\\ <> \\in LocalAuthorityBindings /\\ \\/ previous = NoCommitment \\/ previous \\in RecognizedTerminalCommitments - /\\ requests' = requests \\cup {{r}} - /\\ requestBinding' = [requestBinding EXCEPT ![r] = b] - /\\ requestAuthority' = [requestAuthority EXCEPT ![r] = a] - /\\ previousResolutionCommitment' = [previousResolutionCommitment EXCEPT ![r] = previous] - /\\ UNCHANGED <> + /\\ requestMeta' = + [x \\in Requests \\cup {{r}} |-> + IF x = r + THEN [binding |-> b, previous |-> previous] + ELSE requestMeta[x]] + /\\ UNCHANGED <> CanonSubmitResolution(r, b, a, value) == - /\\ r \\in requests - /\\ b = requestBinding[r] + /\\ r \\in Requests + /\\ b = RequestBinding(r) /\\ a \\in Authorities - /\\ <> \\in authorityProofBindings + /\\ <> \\in AuthorityProofBindings /\\ value \\in CanonTerminalResolutions - /\\ terminalRecord[r] = NoRecord + /\\ r \\notin TerminalRequests /\\ r \\notin conflicts - /\\ terminalRecord' = [terminalRecord EXCEPT ![r] = value] - /\\ terminalBinding' = [terminalBinding EXCEPT ![r] = b] - /\\ terminalAuthority' = [terminalAuthority EXCEPT ![r] = a] - /\\ UNCHANGED <> + /\\ terminalMeta' = + [x \\in TerminalRequests \\cup {{r}} |-> + IF x = r + THEN [resolution |-> value, authority |-> a] + ELSE terminalMeta[x]] + /\\ UNCHANGED <> CanonObserveConflict(r) == /\\ r \\in ResolutionIds /\\ conflicts' = conflicts \\cup {{r}} - /\\ UNCHANGED <> + /\\ UNCHANGED <> CanonObserveInvalidMaterial(r) == /\\ r \\in ResolutionIds - /\\ invalidMaterial' = invalidMaterial \\cup {{r}} - /\\ UNCHANGED <> + /\\ UNCHANGED vars CanonObserveNonAuthoritativeInput(r) == /\\ r \\in ResolutionIds - /\\ observedInputs' = observedInputs \\cup {{r}} - /\\ UNCHANGED <> + /\\ UNCHANGED vars CanonEvaluate == UNCHANGED vars -CanonRecognizedCanonicalTransition == +CanonRecognizedSeedTransition == \\/ \\E r \\in ResolutionIds, b \\in Bindings, a \\in Authorities, previous \\in TerminalCommitments \\cup {{NoCommitment}} : CanonRegisterRequest(r, b, a, previous) \\/ \\E r \\in ResolutionIds, b \\in Bindings, a \\in Authorities, value \\in CanonTerminalResolutions : CanonSubmitResolution(r, b, a, value) + +CanonRecognizedEnvironmentTransition == \\/ \\E r \\in ResolutionIds : CanonObserveConflict(r) \\/ \\E r \\in ResolutionIds : CanonObserveInvalidMaterial(r) \\/ \\E r \\in ResolutionIds : CanonObserveNonAuthoritativeInput(r) +CanonRecognizedCanonicalTransition == + \\/ CanonRecognizedSeedTransition + \\/ CanonRecognizedEnvironmentTransition + CanonNext == \\/ CanonRecognizedCanonicalTransition \\/ CanonEvaluate CanonResolutionOf(r) == - IF r \\notin requests \\/ r \\in conflicts + IF r \\notin Requests \\/ r \\in conflicts THEN CanonConflictResult - ELSE IF terminalRecord[r] = NoRecord + ELSE IF r \\notin TerminalRequests THEN CanonDerivedResolution - ELSE terminalRecord[r] + ELSE TerminalResolution(r) CanonEffectPermitted(r) == CanonResolutionOf(r) = CanonEffectPermittedValue CanonSpec == CanonInit /\\ [][CanonNext]_vars ============================================================================= -""" +''' def main() -> int: diff --git a/tools/model_check_seed.py b/tools/model_check_seed.py index 0565a47..5b33f11 100755 --- a/tools/model_check_seed.py +++ b/tools/model_check_seed.py @@ -22,44 +22,44 @@ "ResolutionDomain", "AllowSoundness", "FailClosed", - "ExactBinding", + "TerminalBindingDerived", "LocalAuthorityRoot", "DelegatedAuthoritySound", "InputsNonAuthoritative", "TerminalUnique", - "InvalidOrConflictUnknown", + "ConflictUnknown", "FreshReconsideration", ) TEMPORAL_PROPERTIES = ( "RequestsAppendOnly", "TerminalRecordsImmutable", "CanonicalStateChangesOnlyByRecognizedTransition", - "ObservedInputsAppendOnly", + "InvalidMaterialStutter", + "NonAuthoritativeInputsStutter", ) FORMAL_PROPERTIES = STATE_PROPERTIES + TEMPORAL_PROPERTIES @dataclass(frozen=True) class State: - # request tuple: resolution_id, binding, initial_authority, previous_terminal_commitment - requests: tuple[tuple[int, int, int, int], ...] - # record tuple: resolution_id, binding, authority, terminal_value - records: tuple[tuple[int, int, int, str], ...] + # request tuple: resolution_id, binding, previous_terminal_commitment + requests: tuple[tuple[int, int, int], ...] + # accepted terminal tuple: resolution_id, authority, terminal_value + records: tuple[tuple[int, int, str], ...] + # conflict is the only environment observation that changes resolution semantics conflicts: frozenset[int] - invalid_material: frozenset[int] - observed_inputs: frozenset[int] def initial() -> State: - return State((), (), frozenset(), frozenset(), frozenset()) + return State((), (), frozenset()) -def request_map(state: State) -> dict[int, tuple[int, int, int]]: - return {rid: (binding, authority, previous) for rid, binding, authority, previous in state.requests} +def request_map(state: State) -> dict[int, tuple[int, int]]: + return {rid: (binding, previous) for rid, binding, previous in state.requests} -def record_map(state: State) -> dict[int, tuple[int, int, str]]: - return {rid: (binding, authority, value) for rid, binding, authority, value in state.records} +def record_map(state: State) -> dict[int, tuple[int, str]]: + return {rid: (authority, value) for rid, authority, value in state.records} def resolution_of(state: State, rid: int) -> str: @@ -67,7 +67,7 @@ def resolution_of(state: State, rid: int) -> str: records = record_map(state) if rid not in requests or rid in state.conflicts or rid not in records: return "UNKNOWN" - return records[rid][2] + return records[rid][1] def effect_permitted(state: State, rid: int) -> bool: @@ -75,47 +75,40 @@ def effect_permitted(state: State, rid: int) -> bool: def canonical_projection(state: State) -> tuple[object, ...]: - return ( - state.requests, - state.records, - state.conflicts, - state.invalid_material, - state.observed_inputs, - ) + return (state.requests, state.records, state.conflicts) def successors(state: State) -> Iterable[tuple[str, State]]: requests = request_map(state) records = record_map(state) + # Initial Authority identity is checked at admission but not retained as an + # independent state component. The binding remains sufficient to prove the + # existence of a local root because LOCAL_AUTHORITY_BINDINGS is immutable. for rid in IDS: if rid in requests: continue for binding, authority in LOCAL_AUTHORITY_BINDINGS: + del authority yield ( "RegisterRequest", State( - tuple(sorted((*state.requests, (rid, binding, authority, NO_COMMITMENT)))), + tuple(sorted((*state.requests, (rid, binding, NO_COMMITMENT)))), state.records, state.conflicts, - state.invalid_material, - state.observed_inputs, ), ) - for previous in RECOGNIZED_TERMINAL_COMMITMENTS: - for binding, authority in LOCAL_AUTHORITY_BINDINGS: + for previous in RECOGNIZED_TERMINAL_COMMITMENTS: yield ( "RegisterReconsideration", State( - tuple(sorted((*state.requests, (rid, binding, authority, previous)))), + tuple(sorted((*state.requests, (rid, binding, previous)))), state.records, state.conflicts, - state.invalid_material, - state.observed_inputs, ), ) - for rid, (binding, _, _) in requests.items(): + for rid, (binding, _) in requests.items(): if rid in records or rid in state.conflicts: continue for authority, proof_binding in AUTHORITY_PROOF_BINDINGS: @@ -126,10 +119,8 @@ def successors(state: State) -> Iterable[tuple[str, State]]: "SubmitResolution", State( state.requests, - tuple(sorted((*state.records, (rid, binding, authority, value)))), + tuple(sorted((*state.records, (rid, authority, value)))), state.conflicts, - state.invalid_material, - state.observed_inputs, ), ) @@ -137,37 +128,14 @@ def successors(state: State) -> Iterable[tuple[str, State]]: if rid not in state.conflicts: yield ( "ObserveConflict", - State( - state.requests, - state.records, - state.conflicts | {rid}, - state.invalid_material, - state.observed_inputs, - ), - ) - if rid not in state.invalid_material: - yield ( - "ObserveInvalidMaterial", - State( - state.requests, - state.records, - state.conflicts, - state.invalid_material | {rid}, - state.observed_inputs, - ), - ) - if rid not in state.observed_inputs: - yield ( - "ObserveNonAuthoritativeInput", - State( - state.requests, - state.records, - state.conflicts, - state.invalid_material, - state.observed_inputs | {rid}, - ), + State(state.requests, state.records, state.conflicts | {rid}), ) + # These observations are explicit semantic stutters. They are not + # retained as Seed state and therefore cannot create ALLOW. + yield "ObserveInvalidMaterial", state + yield "ObserveNonAuthoritativeInput", state + yield "Evaluate", state @@ -178,46 +146,56 @@ def state_errors(state: State) -> list[str]: if len(requests) != len(state.requests) or len(records) != len(state.records): errors.append("TypeOK") - if not state.conflicts.issubset(IDS) or not state.invalid_material.issubset(IDS): - errors.append("TypeOK") - if not state.observed_inputs.issubset(IDS): + if not state.conflicts.issubset(IDS): errors.append("TypeOK") + # Structural properties created by representation rather than duplicated state. + if not set(records).issubset(requests): + errors.append("TerminalBindingDerived") + if len(records) != len(state.records): + errors.append("TerminalUnique") + + for rid, (binding, _) in requests.items(): + if not any( + authority in AUTHORITIES and (authority, binding) in LOCAL_AUTHORITY_BINDINGS + for authority in AUTHORITIES + ): + errors.append("LocalAuthorityRoot") + + for rid, (authority, _) in records.items(): + request = requests.get(rid) + if request is None or (authority, request[0]) not in AUTHORITY_PROOF_BINDINGS: + errors.append("DelegatedAuthoritySound") + + # InputsNonAuthoritative is structural in the minimized model: State has + # exactly the three canonical decision components and no observed-input slot. + if tuple(State.__dataclass_fields__) != ("requests", "records", "conflicts"): + errors.append("InputsNonAuthoritative") + for rid in IDS: value = resolution_of(state, rid) if value not in {"UNKNOWN", "ALLOW", "BLOCK"}: errors.append("ResolutionDomain") + if effect_permitted(state, rid): record = records.get(rid) + request = requests.get(rid) if ( - rid not in requests + request is None or rid in state.conflicts or record is None - or record[2] != "ALLOW" - or record[0] != requests[rid][0] - or (record[1], record[0]) not in AUTHORITY_PROOF_BINDINGS + or record[1] != "ALLOW" + or (record[0], request[0]) not in AUTHORITY_PROOF_BINDINGS ): errors.append("AllowSoundness") + if value != "ALLOW" and effect_permitted(state, rid): errors.append("FailClosed") - if rid in records and rid in requests and records[rid][0] != requests[rid][0]: - errors.append("ExactBinding") - if rid in requests and (requests[rid][1], requests[rid][0]) not in LOCAL_AUTHORITY_BINDINGS: - errors.append("LocalAuthorityRoot") - if rid in records and (records[rid][1], records[rid][0]) not in AUTHORITY_PROOF_BINDINGS: - errors.append("DelegatedAuthoritySound") - if rid in state.observed_inputs and rid not in records and value != "UNKNOWN": - errors.append("InputsNonAuthoritative") if rid in state.conflicts and value != "UNKNOWN": - errors.append("TerminalUnique") - if ( - (rid in state.conflicts or (rid in state.invalid_material and rid not in records)) - and value != "UNKNOWN" - ): - errors.append("InvalidOrConflictUnknown") + errors.append("ConflictUnknown") - for _, (_, _, previous) in requests.items(): + for _, (_, previous) in requests.items(): if previous == NO_COMMITMENT: continue if previous not in RECOGNIZED_TERMINAL_COMMITMENTS: @@ -228,13 +206,16 @@ def state_errors(state: State) -> list[str]: def transition_errors(action: str, before: State, after: State) -> list[str]: errors: list[str] = [] + if not set(before.requests).issubset(after.requests): errors.append("RequestsAppendOnly") + before_records = record_map(before) after_records = record_map(after) for rid, record in before_records.items(): if after_records.get(rid) != record: errors.append("TerminalRecordsImmutable") + recognized_canonical_actions = { "RegisterRequest", "RegisterReconsideration", @@ -248,8 +229,12 @@ def transition_errors(action: str, before: State, after: State) -> list[str]: and action not in recognized_canonical_actions ): errors.append("CanonicalStateChangesOnlyByRecognizedTransition") - if not before.observed_inputs.issubset(after.observed_inputs): - errors.append("ObservedInputsAppendOnly") + + if action == "ObserveInvalidMaterial" and before != after: + errors.append("InvalidMaterialStutter") + if action == "ObserveNonAuthoritativeInput" and before != after: + errors.append("NonAuthoritativeInputsStutter") + return sorted(set(errors)) @@ -305,7 +290,9 @@ def main() -> int: } if args.output: args.output.parent.mkdir(parents=True, exist_ok=True) - args.output.write_text(json.dumps(report, sort_keys=True, indent=2) + "\n", encoding="utf-8") + args.output.write_text( + json.dumps(report, sort_keys=True, indent=2) + "\n", encoding="utf-8" + ) print(f"MODEL_CHECK_STATES={report['states']}") print(f"MODEL_CHECK_TRANSITIONS={transitions}") diff --git a/tools/run_tlaps.py b/tools/run_tlaps.py index 6ce18aa..88a4404 100755 --- a/tools/run_tlaps.py +++ b/tools/run_tlaps.py @@ -23,7 +23,8 @@ "SpecImpliesRequestsAppendOnly", "SpecImpliesTerminalRecordsImmutable", "SpecImpliesCanonicalStateChangesOnlyByRecognizedTransition", - "SpecImpliesObservedInputsAppendOnly", + "SpecImpliesInvalidMaterialStutter", + "SpecImpliesNonAuthoritativeInputsStutter", ) From 28ba59c3718907a32ea6080c16ab9ed15dd69694 Mon Sep 17 00:00:00 2001 From: Dzmitry Prychyna Date: Fri, 7 Aug 2026 08:43:56 -0300 Subject: [PATCH 3/4] refactor(seed): remove legacy semantics and sharpen formal boundaries --- MANIFEST.json | 575 ++++++------------ README.md | 2 +- README.pt-BR.md | 2 +- README.ru.md | 2 +- REPOSITORY_STATUS.json | 2 +- audit/ACTIVE_AUDIT_INDEX.json | 2 +- docs/architecture/SEED_ROLE.md | 42 +- docs/architecture/SEED_STATE_MINIMIZATION.md | 77 +-- docs/generated/en/ASET_Seed_Next.md | 36 +- .../en/ASET_Seed_Resolution_0.3-alpha.1.md | 36 +- docs/generated/pt-BR/ASET_Seed_Next.md | 36 +- .../pt-BR/ASET_Seed_Resolution_0.3-alpha.1.md | 36 +- docs/generated/ru/ASET_Seed_Next.md | 36 +- .../ru/ASET_Seed_Resolution_0.3-alpha.1.md | 36 +- docs/repository/CI_ASSURANCE.md | 12 +- seed/canonical/CANON_PACKAGE.json | 130 ++-- seed/canonical/README.md | 98 ++- .../assurance/canon-tla-refinement.json | 40 +- .../assurance/invariant-coverage.json | 58 +- seed/canonical/assurance/limitations.json | 10 +- .../assurance/proof-traceability.json | 60 +- .../assurance/repository-release-gates.json | 2 +- .../assurance/verification-registry.json | 77 +-- .../cases/negative/RES-NEG-001.json | 9 +- .../cases/negative/RES-NEG-002.json | 13 +- .../cases/negative/RES-NEG-003.json | 9 +- .../cases/negative/RES-NEG-004.json | 13 +- .../cases/negative/RES-NEG-005.json | 15 +- .../cases/negative/RES-NEG-006.json | 15 +- .../cases/negative/RES-NEG-007.json | 21 +- .../cases/negative/RES-NEG-008.json | 35 +- .../cases/negative/RES-NEG-009.json | 38 +- .../cases/negative/RES-NEG-010.json | 21 +- .../cases/negative/RES-NEG-011.json | 21 +- .../cases/negative/RES-NEG-012.json | 9 +- .../cases/negative/RES-NEG-013.json | 11 +- .../cases/negative/RES-NEG-014.json | 15 +- .../cases/negative/RES-NEG-015.json | 21 +- .../cases/negative/RES-NEG-016.json | 38 +- .../cases/positive/RES-POS-001.json | 9 +- .../cases/positive/RES-POS-002.json | 15 +- .../cases/positive/RES-POS-003.json | 15 +- .../cases/positive/RES-POS-004.json | 29 +- .../cases/positive/RES-POS-005.json | 37 +- .../cases/positive/RES-POS-006.json | 9 +- .../cases/positive/RES-POS-007.json | 21 +- .../cases/positive/RES-POS-008.json | 15 +- .../cases/positive/RES-POS-009.json | 75 +++ .../conformance/conformance-profile.json | 80 ++- .../implementation-conformance-protocol.json | 2 +- .../conformance/model-based-conformance.json | 10 +- .../ADR-003-narrow-seed-to-resolution-core.md | 4 + .../ADR-006-complete-invariant-closure.md | 4 + ...08-normalize-seed-state-by-construction.md | 7 +- ...ronment-observer-and-authority-boundary.md | 56 ++ seed/canonical/formal/README.md | 152 ++--- seed/canonical/formal/SeedBootstrap.cfg | 6 - seed/canonical/formal/SeedBootstrap.tla | 29 - seed/canonical/formal/SeedCanonProjection.tla | 98 +-- .../formal/SeedCanonRefinementProofs.tla | 114 ++-- seed/canonical/formal/SeedRC12.cfg | 10 - seed/canonical/formal/SeedRC12.tla | 82 --- seed/canonical/formal/SeedResolution.cfg | 14 +- seed/canonical/formal/SeedResolution.tla | 134 ++-- .../canonical/formal/SeedResolutionProofs.tla | 423 ++++--------- .../migration/ALPHA2_TO_0.3_ALPHA1.md | 4 +- .../migration/CANON_CHANGE_DECLARATION.json | 6 +- .../migration/RC12_TO_RESOLUTION_CORE.md | 18 +- seed/canonical/migration/WIRE_V2_TO_V3.md | 34 ++ seed/canonical/ontology/seed.ttl | 14 +- seed/canonical/protocol/README.md | 13 + seed/canonical/protocol/protocol-profile.json | 18 +- .../schemas/authority-binding.schema.json | 73 --- .../schemas/authority-grant.schema.json | 41 -- .../protocol/schemas/constitution.schema.json | 66 -- .../schemas/context-descriptor.schema.json | 152 ----- .../context-redefinition-record.schema.json | 57 -- .../schemas/correction-record.schema.json | 61 -- .../protocol/schemas/decision.schema.json | 82 --- .../schemas/execution-intent.schema.json | 50 -- .../schemas/export-receipt.schema.json | 82 --- .../schemas/import-observation.schema.json | 50 -- .../membership-withdrawal-record.schema.json | 71 --- .../protocol/schemas/observation.schema.json | 75 --- .../protocol/schemas/outcome.schema.json | 57 -- .../payload-authority-transfer.schema.json | 31 - .../payload-context-redefine.schema.json | 121 ---- .../payload-context-terminate.schema.json | 37 -- .../schemas/payload-correction.schema.json | 40 -- .../schemas/payload-decision.schema.json | 60 -- .../schemas/payload-export.schema.json | 34 -- .../payload-guarantee-suspend.schema.json | 22 - .../schemas/payload-import.schema.json | 31 - ...payload-member-context-genesis.schema.json | 90 --- .../payload-membership-withdraw.schema.json | 14 - .../schemas/payload-observation.schema.json | 54 -- .../schemas/payload-outcome.schema.json | 36 -- ...oad-partition-local-transition.schema.json | 37 -- .../payload-permit-attenuate.schema.json | 63 -- .../schemas/payload-permit-issue.schema.json | 77 --- .../schemas/payload-permit-use.schema.json | 29 - .../schemas/payload-reconcile.schema.json | 73 --- .../schemas/payload-verification.schema.json | 64 -- .../schemas/permit-use-receipt.schema.json | 62 -- .../protocol/schemas/permit.schema.json | 154 ----- .../reconciliation-receipt.schema.json | 66 -- .../resolution-authority-binding.schema.json | 10 +- .../schemas/resolution-record.schema.json | 10 +- .../schemas/resolution-store.schema.json | 9 +- .../protocol/schemas/root-genesis.schema.json | 102 ---- .../schemas/trust-space-state.schema.json | 386 ------------ .../protocol/schemas/verification.schema.json | 85 --- .../schemas/canon-tla-refinement.schema.json | 15 +- .../schemas/conformance-profile.schema.json | 14 +- ...mentation-conformance-envelope.schema.json | 6 +- ...mentation-conformance-protocol.schema.json | 2 +- .../schemas/proof-traceability.schema.json | 15 +- .../schemas/protocol-profile.schema.json | 10 +- .../schemas/repository-status.schema.json | 2 +- seed/canonical/schemas/seed-model.schema.json | 7 + seed/canonical/source/seed-model.json | 90 +-- seed/canonical/terminology/seed.skos.ttl | 16 +- seed/canonical/terminology/seed.tbx | 8 +- tests/test_canonical_model.py | 10 +- tests/test_ci_assurance.py | 19 +- ...est_implementation_conformance_protocol.py | 2 +- tests/test_minimal_resolution_kernel.py | 9 + tools/build_canon_package.py | 6 +- tools/check_assurance_traceability.py | 13 +- tools/check_canon_tla_refinement.py | 24 +- tools/check_proof_traceability.py | 29 +- tools/generate_canon_tla_projection.py | 169 ++--- tools/model_check_seed.py | 109 ++-- tools/run_canon_tla_refinement.py | 16 +- tools/run_invariant_mutations.py | 2 +- tools/run_tlaps.py | 5 +- tools/seed_resolution_oracle.py | 87 ++- tools/validate_seed_canon.py | 12 + 138 files changed, 1782 insertions(+), 4897 deletions(-) create mode 100644 seed/canonical/conformance/cases/positive/RES-POS-009.json create mode 100644 seed/canonical/decisions/ADR-009-seed-state-environment-observer-and-authority-boundary.md delete mode 100644 seed/canonical/formal/SeedBootstrap.cfg delete mode 100644 seed/canonical/formal/SeedBootstrap.tla delete mode 100644 seed/canonical/formal/SeedRC12.cfg delete mode 100644 seed/canonical/formal/SeedRC12.tla create mode 100644 seed/canonical/migration/WIRE_V2_TO_V3.md create mode 100644 seed/canonical/protocol/README.md delete mode 100644 seed/canonical/protocol/schemas/authority-binding.schema.json delete mode 100644 seed/canonical/protocol/schemas/authority-grant.schema.json delete mode 100644 seed/canonical/protocol/schemas/constitution.schema.json delete mode 100644 seed/canonical/protocol/schemas/context-descriptor.schema.json delete mode 100644 seed/canonical/protocol/schemas/context-redefinition-record.schema.json delete mode 100644 seed/canonical/protocol/schemas/correction-record.schema.json delete mode 100644 seed/canonical/protocol/schemas/decision.schema.json delete mode 100644 seed/canonical/protocol/schemas/execution-intent.schema.json delete mode 100644 seed/canonical/protocol/schemas/export-receipt.schema.json delete mode 100644 seed/canonical/protocol/schemas/import-observation.schema.json delete mode 100644 seed/canonical/protocol/schemas/membership-withdrawal-record.schema.json delete mode 100644 seed/canonical/protocol/schemas/observation.schema.json delete mode 100644 seed/canonical/protocol/schemas/outcome.schema.json delete mode 100644 seed/canonical/protocol/schemas/payload-authority-transfer.schema.json delete mode 100644 seed/canonical/protocol/schemas/payload-context-redefine.schema.json delete mode 100644 seed/canonical/protocol/schemas/payload-context-terminate.schema.json delete mode 100644 seed/canonical/protocol/schemas/payload-correction.schema.json delete mode 100644 seed/canonical/protocol/schemas/payload-decision.schema.json delete mode 100644 seed/canonical/protocol/schemas/payload-export.schema.json delete mode 100644 seed/canonical/protocol/schemas/payload-guarantee-suspend.schema.json delete mode 100644 seed/canonical/protocol/schemas/payload-import.schema.json delete mode 100644 seed/canonical/protocol/schemas/payload-member-context-genesis.schema.json delete mode 100644 seed/canonical/protocol/schemas/payload-membership-withdraw.schema.json delete mode 100644 seed/canonical/protocol/schemas/payload-observation.schema.json delete mode 100644 seed/canonical/protocol/schemas/payload-outcome.schema.json delete mode 100644 seed/canonical/protocol/schemas/payload-partition-local-transition.schema.json delete mode 100644 seed/canonical/protocol/schemas/payload-permit-attenuate.schema.json delete mode 100644 seed/canonical/protocol/schemas/payload-permit-issue.schema.json delete mode 100644 seed/canonical/protocol/schemas/payload-permit-use.schema.json delete mode 100644 seed/canonical/protocol/schemas/payload-reconcile.schema.json delete mode 100644 seed/canonical/protocol/schemas/payload-verification.schema.json delete mode 100644 seed/canonical/protocol/schemas/permit-use-receipt.schema.json delete mode 100644 seed/canonical/protocol/schemas/permit.schema.json delete mode 100644 seed/canonical/protocol/schemas/reconciliation-receipt.schema.json delete mode 100644 seed/canonical/protocol/schemas/root-genesis.schema.json delete mode 100644 seed/canonical/protocol/schemas/trust-space-state.schema.json delete mode 100644 seed/canonical/protocol/schemas/verification.schema.json diff --git a/MANIFEST.json b/MANIFEST.json index 12a55e2..a3f5fbe 100644 --- a/MANIFEST.json +++ b/MANIFEST.json @@ -158,22 +158,22 @@ }, { "path": "README.md", - "sha256": "sha256:209a08a5840f099e46cb6e6f16885e83384193508ded90d947a4b71d6b073106", - "size_bytes": 777 + "sha256": "sha256:ee26300d85ffa55761724a943b8a954869c747badbe8d1200ad8b98d4993b843", + "size_bytes": 877 }, { "path": "README.pt-BR.md", - "sha256": "sha256:cfc5adab18ebb417b5a8890dcc0bca48e786d57b571812c8d192bb93137813af", - "size_bytes": 823 + "sha256": "sha256:0a5692fbb3765e89bc6fd4d87a0208f44ab3dfce8cff6481aac30d0b86ffb2c3", + "size_bytes": 992 }, { "path": "README.ru.md", - "sha256": "sha256:f35e536cea37ff61e45901b35e8d13232c1ef3097a8ecdf126973d6749d5f009", - "size_bytes": 1110 + "sha256": "sha256:30d594f18c5e0f8a8f8f39c1b00ed362cac1e253f88bd7f72faed58f28ddeee4", + "size_bytes": 1427 }, { "path": "REPOSITORY_STATUS.json", - "sha256": "sha256:d0a94d62bbe61591800bd41ab5028526854412d30f29a289199d8ec22476edf6", + "sha256": "sha256:a05e0e7b45ee4be79185de047741a97ac906b5fe5a10ff0d9f2a000a8d69ffbe", "size_bytes": 593 }, { @@ -188,7 +188,7 @@ }, { "path": "audit/ACTIVE_AUDIT_INDEX.json", - "sha256": "sha256:6e410436a80d0e672a12e479aee0b85e875a77814041a9d46616c995f5ef8e0f", + "sha256": "sha256:9990eedf03b0b6f95911df34d6cca15e966204abdc12918f62937f07e2be0a18", "size_bytes": 2781 }, { @@ -313,13 +313,13 @@ }, { "path": "docs/architecture/SEED_ROLE.md", - "sha256": "sha256:d14912b58d582e3a6515bb6332842ae3c3d57ea1947154021d37a34d0cf23b28", - "size_bytes": 1277 + "sha256": "sha256:d5f3f88f91959131304988f264932f1373c7527cda2cbf16c259d3877acd7989", + "size_bytes": 1615 }, { "path": "docs/architecture/SEED_STATE_MINIMIZATION.md", - "sha256": "sha256:33b601825012426108ed03380295096337ad649406970d46109f74b6ae72e86e", - "size_bytes": 2981 + "sha256": "sha256:73c0f19ed820dc44e34624f6e4f1829972437ba90a8fc439f563ca7d23e75058", + "size_bytes": 1570 }, { "path": "docs/architecture/TERMINAL_COMMITMENT_ACCUMULATION.md", @@ -338,13 +338,13 @@ }, { "path": "docs/generated/en/ASET_Seed_Next.md", - "sha256": "sha256:817160ba2cf58d9fe16281328ad1240f29db6c61ade27935aab4076d71f4ae4f", - "size_bytes": 10185 + "sha256": "sha256:b348604389008b45d1eebcbf93214040c5b18d63614fa62b12f77231d13ee8b2", + "size_bytes": 11273 }, { "path": "docs/generated/en/ASET_Seed_Resolution_0.3-alpha.1.md", - "sha256": "sha256:817160ba2cf58d9fe16281328ad1240f29db6c61ade27935aab4076d71f4ae4f", - "size_bytes": 10185 + "sha256": "sha256:b348604389008b45d1eebcbf93214040c5b18d63614fa62b12f77231d13ee8b2", + "size_bytes": 11273 }, { "path": "docs/generated/pt-BR/ASET_Seed_0.1-rc12.md", @@ -353,13 +353,13 @@ }, { "path": "docs/generated/pt-BR/ASET_Seed_Next.md", - "sha256": "sha256:6fab8822bc7c065a44782734daf8c860097b972be82115034314e99caaa9a57a", - "size_bytes": 10802 + "sha256": "sha256:1998e820c3144e2303fc0e330a00b489a41f6b83301686f81871334b3dcbf1e7", + "size_bytes": 12022 }, { "path": "docs/generated/pt-BR/ASET_Seed_Resolution_0.3-alpha.1.md", - "sha256": "sha256:6fab8822bc7c065a44782734daf8c860097b972be82115034314e99caaa9a57a", - "size_bytes": 10802 + "sha256": "sha256:1998e820c3144e2303fc0e330a00b489a41f6b83301686f81871334b3dcbf1e7", + "size_bytes": 12022 }, { "path": "docs/generated/ru/ASET_Seed_0.1-rc12.md", @@ -368,13 +368,13 @@ }, { "path": "docs/generated/ru/ASET_Seed_Next.md", - "sha256": "sha256:756a29b5e133ed2e8431b7ec0a9eeb9e866365615e6c76159fc6f386e90f7eb6", - "size_bytes": 14024 + "sha256": "sha256:f5ee3f5db4a02c6ccd3182af886a6efbe6cbf8c5b531a283c9260cefeda917d0", + "size_bytes": 15982 }, { "path": "docs/generated/ru/ASET_Seed_Resolution_0.3-alpha.1.md", - "sha256": "sha256:756a29b5e133ed2e8431b7ec0a9eeb9e866365615e6c76159fc6f386e90f7eb6", - "size_bytes": 14024 + "sha256": "sha256:f5ee3f5db4a02c6ccd3182af886a6efbe6cbf8c5b531a283c9260cefeda917d0", + "size_bytes": 15982 }, { "path": "docs/implementation/CROSS_IMPLEMENTATION_CONFORMANCE_PLAN.md", @@ -393,8 +393,8 @@ }, { "path": "docs/repository/CI_ASSURANCE.md", - "sha256": "sha256:0430d1e771f7f12bc3462a2f7903308e475543d254cd10a0e1f2ae6fbcee6547", - "size_bytes": 3190 + "sha256": "sha256:e233f5f4ce76e4b156e85d18edba23f70bd785a83f3a08c85f2b747e29c4092e", + "size_bytes": 3304 }, { "path": "docs/repository/DEPENDENCY_POLICY.md", @@ -468,178 +468,183 @@ }, { "path": "seed/canonical/CANON_PACKAGE.json", - "sha256": "sha256:f81e9c80be5ef0a6c2ce79c8bfce27746bb98654955f7697a095502caf70bccc", - "size_bytes": 12501 + "sha256": "sha256:58455e83e101e7a112a521c66cd68e56312227cfbf2accdbf668eba493d17942", + "size_bytes": 13241 }, { "path": "seed/canonical/README.md", - "sha256": "sha256:1e211f4db5cce375d7a51b7997161a6cb82ade38e103a407af1f2614b64ec49e", - "size_bytes": 2802 + "sha256": "sha256:dd873b7b201da02d7b9ea6f8e1f219b6c6ca31eca1c6c44be42af0d0cf4399cb", + "size_bytes": 2556 }, { "path": "seed/canonical/assurance/canon-tla-refinement.json", - "sha256": "sha256:d29c941ee0dca9fc725c2dcaec0b6a78d661cbe6630726418fc370c79d73ee38", - "size_bytes": 6661 + "sha256": "sha256:2095b62595d056c8a5a3b0700239a0211417979e4d5f2b4a535df0827017371b", + "size_bytes": 6791 }, { "path": "seed/canonical/assurance/invariant-coverage.json", - "sha256": "sha256:da7a577b4f160ba5ac436808711f101dd2d9c66509ff1f7772dedc05174b9163", - "size_bytes": 14733 + "sha256": "sha256:2d89e21d092bf4d340e271dc3bcba2d7df618c4c4b41e67beb626f518cdb163b", + "size_bytes": 15093 }, { "path": "seed/canonical/assurance/limitations.json", - "sha256": "sha256:2b6bbf827dcb12b9674154efebcb6134366c614769b5874a5f4db0cbb81cb25f", - "size_bytes": 3803 + "sha256": "sha256:c9379206486a61592398485658cb434174e0a1cbdbb6a37c2792d1d312f35c3b", + "size_bytes": 3846 }, { "path": "seed/canonical/assurance/proof-traceability.json", - "sha256": "sha256:3c49b80547bf7a148688d49aeaa61a5e2074e14161b5597967613a07b0925609", - "size_bytes": 6944 + "sha256": "sha256:043bb3b1717d0c41123d326dc9b1d8dcae1cdde78c7ebf2d2ae26e79d2248eaf", + "size_bytes": 6966 }, { "path": "seed/canonical/assurance/repository-release-gates.json", - "sha256": "sha256:9b945c1665038e8e4a642ffa6b9510d5ab8aaeeb45b5403bf578fb230e666c77", - "size_bytes": 6815 + "sha256": "sha256:96c3b5f009b64eedc0348109f6545b92b8a0c67b1a9087765868afaff7be11dd", + "size_bytes": 6819 }, { "path": "seed/canonical/assurance/verification-registry.json", - "sha256": "sha256:a3306079e7c38496063c5e46ec6a464bdf744d1271568963291cb71c08991b19", - "size_bytes": 9887 + "sha256": "sha256:b4bb28e5a8965e984013ad7408522749cfef3008c913a518f455fefda7136187", + "size_bytes": 9717 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-001.json", - "sha256": "sha256:3352af05c6a51a02aef9c94639fe43903c22969f3d9a8e2836f23fce065507a7", - "size_bytes": 1822 + "sha256": "sha256:e5688046d1ccc8cafffb0520aa044a2f37f1ca3a4df7325052661213d6ba15fc", + "size_bytes": 1652 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-002.json", - "sha256": "sha256:ee69ab8301eea93cf52ab45114e56922f620e8aad8d4f621bbc98b6cf040cfa9", - "size_bytes": 2718 + "sha256": "sha256:ca9b2b633ae32bffefdd3d8939e9614917e8cd04cafb7813c547f641122949ce", + "size_bytes": 2548 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-003.json", - "sha256": "sha256:4318727895ac37e61933c6686e785351211acdda10dd9c6f19f6c69f37820eac", - "size_bytes": 1866 + "sha256": "sha256:0a71111771482553160e98363d6f8773c965697cd9325673ed82ba64cc8c85f7", + "size_bytes": 1696 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-004.json", - "sha256": "sha256:22b06e4c5bfac480dfddbba7a52370b7fdf104da371fe65dc3e8a928fed9b02c", - "size_bytes": 2342 + "sha256": "sha256:e30ce83892f1c90f546e7410596a8f35936622f999efebb172b83d08f8fe181c", + "size_bytes": 2030 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-005.json", - "sha256": "sha256:15e6d3059b4d769eabb5a166d350509b23ec359856eb4c0bae2c9f975377af07", - "size_bytes": 2531 + "sha256": "sha256:52a9c7253bfb886dcc2b091b643fa36a75f3d96ae01e89d5c6621c8552de9d9a", + "size_bytes": 2364 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-006.json", - "sha256": "sha256:4fcce1e7ebf701e5e994606320cb86a0129193154a33ee63792ee669419fbfec", - "size_bytes": 2536 + "sha256": "sha256:03d11760f4abe91ed1913933600097f52babf57a76984a6ff5d75b4f0ff386ce", + "size_bytes": 2369 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-007.json", - "sha256": "sha256:e95d67c12b028b328c538fb83cf00a01946734acc5048fd1035f3c2eeb9f8ff2", - "size_bytes": 2634 + "sha256": "sha256:24774174dc294a03106711abeb39c0ef4f776ecca89b8b41d0e6dff21c42b2ab", + "size_bytes": 2528 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-008.json", - "sha256": "sha256:783d86ab36bbcb1bdbad0d16c0481ea448d46c67b3501e1a76abfc828e7dde2f", - "size_bytes": 3048 + "sha256": "sha256:fcbdef8907d41df526a388217a234c6e966adbce259924bf60027a14aaa418cb", + "size_bytes": 2823 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-009.json", - "sha256": "sha256:2ff892ee2e91c8d5c117a0990157f326d602876cda637f9a34eda454fee41b9f", - "size_bytes": 3579 + "sha256": "sha256:b7342e2b2ebd187ddaf0b02ff925f27f4f00d42eb079667620e745bf8e3e74a5", + "size_bytes": 2562 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-010.json", - "sha256": "sha256:184aaf7b609ab4ab6947b2b1df68bde7facacd7b0b5452973a73f7e998d3f8a2", - "size_bytes": 3236 + "sha256": "sha256:0d0dc5feddea9bf480b0f1ab5c4a43ef61967f53ed615ffa3cb8b1720b1e79e9", + "size_bytes": 3072 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-011.json", - "sha256": "sha256:675d861e51f13df1c5ec10ad6ddc4909c827f7e893fb3485471023130175f123", - "size_bytes": 3504 + "sha256": "sha256:94d472765378007e09ccf295a46ad1d244e2d34accd17bd2b8d33eb8d9c223e4", + "size_bytes": 3337 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-012.json", - "sha256": "sha256:9c16ba5f4d95d959f1f4419fb2b646202204448fde49ac2669e0a5839c7a10a8", - "size_bytes": 1940 + "sha256": "sha256:be05dfafb0ff2c0dda6eb91f01425d57a4940c1c5716dd8089512337a93ec4fb", + "size_bytes": 1770 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-013.json", - "sha256": "sha256:f36aa4d3809a20c9842eac49c7aed6b31a916a8c089d376e83b0c29023863604", - "size_bytes": 2088 + "sha256": "sha256:84e3849b6c1f9ebec704385974f065bbee233d48abfd5819521d97c2814910a0", + "size_bytes": 1918 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-014.json", - "sha256": "sha256:822f9b125bdb8ebbd50288b7360108c9657791caca7638a3d25ee4d095b249ee", - "size_bytes": 2461 + "sha256": "sha256:3716a2847f9c31788d2d705629b036d53b8646404be135922e64f61de8fad5ea", + "size_bytes": 2294 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-015.json", - "sha256": "sha256:49990c7ca0564af284139ad4ce276ecd33d7f3d05a4f3094449ea87e93825809", - "size_bytes": 3046 + "sha256": "sha256:fd697dbb671d55d99bab8cedc87d81bca1d312d3e542b8fd297f2f4583021ca7", + "size_bytes": 2882 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-016.json", - "sha256": "sha256:90741b3701cd8e9ec043e978ba1f7bbb22b349ef04f425605f019bf599774311", - "size_bytes": 3599 + "sha256": "sha256:2834c82838393611694ceb7171cdbb406d39bfba60a0fa6d5cb01c1b02e4f0f5", + "size_bytes": 2590 }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-001.json", - "sha256": "sha256:60585b00221d867f21ea98fe198b4d35f2acdf56118de3ab7403a8a6c3c1b9c7", - "size_bytes": 1921 + "sha256": "sha256:661cd889e7b091ed6dc969c17dd5934a6104d1919a108b790c3ffdcf1cf5a322", + "size_bytes": 1751 }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-002.json", - "sha256": "sha256:06e6f20764094764047c1b68404b30b135505214003082d52c2896d4d82c2f5c", - "size_bytes": 2597 + "sha256": "sha256:916fc7a3bcc353612e1c4a09882e24f20e41e2a8ca3f8dfff2b3613a97b3f215", + "size_bytes": 2430 }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-003.json", - "sha256": "sha256:92f21b9d2efe2ecc2e3c11ec72f1969ebd78d48b91b39c1f2aa096c475766cfa", - "size_bytes": 2607 + "sha256": "sha256:c77ea28272320c3bd7a8e240b896ac4d21923b32ce5ccc0704f84797cfaa5665", + "size_bytes": 2440 }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-004.json", - "sha256": "sha256:a687f38d83674d2d3a92372be3048860463da19542ca74b2024d61d8361e9ffc", - "size_bytes": 3118 + "sha256": "sha256:dcf5f81b0e60f2aa0c157aab5297177d3f082544d64a54081d83e9d7d6093763", + "size_bytes": 2888 }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-005.json", - "sha256": "sha256:9459583800f64781bcda6e638200a6cb128a7a20aa8d177720966ac70e1d7308", - "size_bytes": 3665 + "sha256": "sha256:7e37edfaeb010ba65dfc197bf60a7bdcf883c41d686eb2ab5ea44de23ee6da0d", + "size_bytes": 3028 }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-006.json", - "sha256": "sha256:fded1536ea25f1c32d63907703bc9bccc46e3a74d5205a1ddf86991d2078c7f3", - "size_bytes": 1970 + "sha256": "sha256:e99a01c9d4acf1833697124bf4d75f3d077b80af49c3dc53c73a4d9a245c92fd", + "size_bytes": 1800 }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-007.json", - "sha256": "sha256:a309d632b1cd18b986cbe0a2442687fd111158eab72d689b0e266fb7d862d92a", - "size_bytes": 3375 + "sha256": "sha256:4f13d237a0868177d216a31635e8fec220b67cbda9c6fe2419a36aff289663c5", + "size_bytes": 3211 }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-008.json", - "sha256": "sha256:b227d0736e9344953a03afa436427bff54a52c6c58089375e16e154baf6fbcd9", - "size_bytes": 2247 + "sha256": "sha256:415e874abf0e1212b542546bfceea41681d9c30252ff7d955e1cfbb214964efb", + "size_bytes": 2077 + }, + { + "path": "seed/canonical/conformance/cases/positive/RES-POS-009.json", + "sha256": "sha256:b7fd5b2160abe684c05af1408468d94590a9bd45355b87cecb910799f9a852c8", + "size_bytes": 2899 }, { "path": "seed/canonical/conformance/conformance-profile.json", - "sha256": "sha256:ecdfee84abc59767bb32b15639ec9503896c4cbda16c8f00ff2f5e4cea10963c", - "size_bytes": 11926 + "sha256": "sha256:aabbf317e0c51a1a1f1021dfbd0b2981c3dcf1142b89eb6a1bbfb1c7e1e9dcd6", + "size_bytes": 12423 }, { "path": "seed/canonical/conformance/implementation-conformance-protocol.json", - "sha256": "sha256:79e949885857af3797a84432b12902ee55f24b296a66325a94a7131254ad31f4", + "sha256": "sha256:b34572ee7a8394ef173d3ae45519c39dc24f77602b956ecf583772ca1aa64040", "size_bytes": 2125 }, { "path": "seed/canonical/conformance/model-based-conformance.json", - "sha256": "sha256:6e833d150f4f8dc1fbac5f0c69fae6a68fc785182a0974875e4f273793cd7065", - "size_bytes": 1107 + "sha256": "sha256:db4b3f9e76aff7e8ef3a87f02ae748bb4f718428370306454eb94b9dcc6212b4", + "size_bytes": 1453 }, { "path": "seed/canonical/decisions/ADR-001-semantic-canon-authority.md", @@ -653,8 +658,8 @@ }, { "path": "seed/canonical/decisions/ADR-003-narrow-seed-to-resolution-core.md", - "sha256": "sha256:92af6ba2f6d08118f3706845e99d04998ec94a5ca6c2077a2ddaf4fdf14e9fc0", - "size_bytes": 817 + "sha256": "sha256:efa447147768ba6a9aef4654f56e2f92700f1e2cf7658c085b7ed4b9849114a5", + "size_bytes": 1109 }, { "path": "seed/canonical/decisions/ADR-004-externalize-legacy-components.md", @@ -668,8 +673,8 @@ }, { "path": "seed/canonical/decisions/ADR-006-complete-invariant-closure.md", - "sha256": "sha256:e7f91577c81b6659bb6129e31ffe6b37a78bd05ca53c985511df4c9faaec1128", - "size_bytes": 2659 + "sha256": "sha256:0545be007291eb0e2be22fce7af30a528919afe2bf57e5ccb5502f4e958692d2", + "size_bytes": 2937 }, { "path": "seed/canonical/decisions/ADR-007-reconsideration-commitments-and-bounded-retention.md", @@ -678,63 +683,48 @@ }, { "path": "seed/canonical/decisions/ADR-008-normalize-seed-state-by-construction.md", - "sha256": "sha256:229de9ba5db018f2726ae7e2b23e33a321eb12f4187c7dfffa35773691f2285c", - "size_bytes": 1980 + "sha256": "sha256:b219bd91da708861847f017c35328d47fee298c2313326b326d75660b733ae63", + "size_bytes": 2219 }, { - "path": "seed/canonical/formal/README.md", - "sha256": "sha256:6672e2fecb4e81ac2a538be478f3f67ed7d0a866b8e9f7fc2a23cf636d0d3dc6", - "size_bytes": 4340 - }, - { - "path": "seed/canonical/formal/SeedBootstrap.cfg", - "sha256": "sha256:e6ef020e118b298adb25015a335a360450bde33ebf2794b35032ce80aecea282", - "size_bytes": 95 + "path": "seed/canonical/decisions/ADR-009-seed-state-environment-observer-and-authority-boundary.md", + "sha256": "sha256:fdb642c8f306d2136345e19c3650c22805f63139ac93d8f81f6773aa249881a0", + "size_bytes": 2604 }, { - "path": "seed/canonical/formal/SeedBootstrap.tla", - "sha256": "sha256:eed849079a74056710d47d8d243131305742e86acd6995b1272e598c0dc05e6a", - "size_bytes": 512 + "path": "seed/canonical/formal/README.md", + "sha256": "sha256:38ef56c859221204201f3bed365f810bc383ca1fb257328ea6b774a67fe7ff82", + "size_bytes": 2373 }, { "path": "seed/canonical/formal/SeedCanonProjection.tla", - "sha256": "sha256:26d6508c8c091fc9d204331be627a3a6cdb15600a1eddf4e755d67240da4efd5", - "size_bytes": 3383 + "sha256": "sha256:b7265eb707795b592c678842f764a5bfa7ce303bdc66f55f858366e20d64eb4e", + "size_bytes": 4377 }, { "path": "seed/canonical/formal/SeedCanonRefinementProofs.tla", - "sha256": "sha256:2445164299b87a1e819edc5df585cb84d18b8b6817e2b14a5158c79e3dca44d2", - "size_bytes": 2543 - }, - { - "path": "seed/canonical/formal/SeedRC12.cfg", - "sha256": "sha256:4f8c0f53530247ed4306f9ca00376d3d4bb9962ee870c0a477aff198fb9f278a", - "size_bytes": 175 - }, - { - "path": "seed/canonical/formal/SeedRC12.tla", - "sha256": "sha256:a94408e12ed4ca06fc5e0ee816dff4eba8acac22c6370f7027fe76c628db6573", - "size_bytes": 2957 + "sha256": "sha256:46ef7336b86d066ee531eb2c43873d9b6e1622dd48632b9af08ea6f412cf6338", + "size_bytes": 3391 }, { "path": "seed/canonical/formal/SeedResolution.cfg", - "sha256": "sha256:c5549986cb036f550e0c030a13944e8fb00372c28ccecacc88d84ede2a34d588", - "size_bytes": 731 + "sha256": "sha256:b4ee7fb775fbf8909fded4e7b2086b8022e1412e648e21f470c464a625f690c0", + "size_bytes": 706 }, { "path": "seed/canonical/formal/SeedResolution.tla", - "sha256": "sha256:8cdbd66db0b4a5fabb38fb1a7739c2a2e3e418ab9bede02d5e49382d4442dd9f", - "size_bytes": 8765 + "sha256": "sha256:1c53b058d738e074c2a9de96fe27d8d7dd384d3ffa52f3bb95f7732908d66276", + "size_bytes": 7417 }, { "path": "seed/canonical/formal/SeedResolutionProofs.tla", - "sha256": "sha256:32c9f90bebcb1503f13b41535847ed5b4c16b066143fcf02578b63f627cf3805", - "size_bytes": 26293 + "sha256": "sha256:bcb4652249d66cbcb16f7c5a4538ad3bc2c31ef7d37b49fd27328eff6a6725f9", + "size_bytes": 21892 }, { "path": "seed/canonical/migration/ALPHA2_TO_0.3_ALPHA1.md", - "sha256": "sha256:c270eaedbcfc42354198191e5ed74641743578c46124332c57b0523c94f15c6c", - "size_bytes": 780 + "sha256": "sha256:181e53833e17c71136343f2dbd0e3381379a057f568d4bce4f1109b739c04b56", + "size_bytes": 810 }, { "path": "seed/canonical/migration/ALPHA2_TO_0.3_ALPHA1_CHANGE_DECLARATION.json", @@ -743,8 +733,8 @@ }, { "path": "seed/canonical/migration/CANON_CHANGE_DECLARATION.json", - "sha256": "sha256:997134c763754c726b939823ffa37528a5860cde7111584f577029982c379767", - "size_bytes": 679 + "sha256": "sha256:4eb176ddb006c0957a2bf1d79685fd86b263b89500cc53df919193ec91459bf8", + "size_bytes": 820 }, { "path": "seed/canonical/migration/RC11_TO_RC12_SEMANTIC_COVERAGE.json", @@ -768,13 +758,23 @@ }, { "path": "seed/canonical/migration/RC12_TO_RESOLUTION_CORE.md", - "sha256": "sha256:1affaba5d5bc41489b1c1e0cc98117a432f9745cff4fc91b348e4667d681ecd2", - "size_bytes": 727 + "sha256": "sha256:05b6f0b3b304915ac7d3cc37eaed6efe55b693af4a328d3c00c508355a2edf96", + "size_bytes": 931 + }, + { + "path": "seed/canonical/migration/WIRE_V2_TO_V3.md", + "sha256": "sha256:b01a89274299c4a21f876dc811fdf61b87f00c8be1735cef37b9adad7e5cc4c3", + "size_bytes": 1185 }, { "path": "seed/canonical/ontology/seed.ttl", - "sha256": "sha256:a5c9e95511eb45edfb16672bf9149178829b6a87486507e373800097c67aaa0a", - "size_bytes": 2885 + "sha256": "sha256:291c2fb5b81baad7515c03cc8b6c6c5df1ac2c07b02f9de0e633c778f3700ac9", + "size_bytes": 3128 + }, + { + "path": "seed/canonical/protocol/README.md", + "sha256": "sha256:c80ad3eab8fa110dc83214355fa19eb5643156945e79f0c83104e7c282ab779d", + "size_bytes": 682 }, { "path": "seed/canonical/protocol/digest-profile.json", @@ -783,18 +783,8 @@ }, { "path": "seed/canonical/protocol/protocol-profile.json", - "sha256": "sha256:cb699538f0f6fa10d5958b6f059a2891fdd89cb7fdef56e458f10cd4968b955f", - "size_bytes": 4405 - }, - { - "path": "seed/canonical/protocol/schemas/authority-binding.schema.json", - "sha256": "sha256:fffa30b84e6bd54bb873851006c126bdac1856555ec80d6196139233b9d0bb39", - "size_bytes": 1619 - }, - { - "path": "seed/canonical/protocol/schemas/authority-grant.schema.json", - "sha256": "sha256:1acedba9b138bbf18969bccdc77cdc891e768338f90a6a527adf75fa49f7204f", - "size_bytes": 972 + "sha256": "sha256:b0f147bad148bf4f2369b157c79c1ac96b87da3d4727bdec46427732960c84b1", + "size_bytes": 4094 }, { "path": "seed/canonical/protocol/schemas/common.schema.json", @@ -806,151 +796,11 @@ "sha256": "sha256:622cd3eb866b7fbfc2cc2f494b66e831cf8713a329ee89f73ed0f5f062a0343a", "size_bytes": 2220 }, - { - "path": "seed/canonical/protocol/schemas/constitution.schema.json", - "sha256": "sha256:9a72dc02bf20bbecb4b90a1b610a36f13b86df136e106779cf3559c7afccff58", - "size_bytes": 1482 - }, - { - "path": "seed/canonical/protocol/schemas/context-descriptor.schema.json", - "sha256": "sha256:bdb68557cc76d4e455099f55aa9823410be2e91563d8a9eac39ab854a76c48f9", - "size_bytes": 3499 - }, - { - "path": "seed/canonical/protocol/schemas/context-redefinition-record.schema.json", - "sha256": "sha256:2fd0353277cc1ba627e0d2787b93e615696be08d709f3ae1d45a1a8b2f7b90c2", - "size_bytes": 1828 - }, - { - "path": "seed/canonical/protocol/schemas/correction-record.schema.json", - "sha256": "sha256:c4057bd148f08e4eadc3525ccaad43d6c7936afdb128438dfac3660f22eb8814", - "size_bytes": 1434 - }, - { - "path": "seed/canonical/protocol/schemas/decision.schema.json", - "sha256": "sha256:fdeedb26f090d9ae21a73aba67b04e59e97cc6cd88820ad508e52a80e67af4f3", - "size_bytes": 1857 - }, - { - "path": "seed/canonical/protocol/schemas/execution-intent.schema.json", - "sha256": "sha256:93362ed26690871b804834f6e7837108fead16a30e352f9a68d0373064389a5c", - "size_bytes": 1263 - }, - { - "path": "seed/canonical/protocol/schemas/export-receipt.schema.json", - "sha256": "sha256:54820f2ce98a9bb8af5f4977d4bdd559427397de63531b532c40fd06fc9081c5", - "size_bytes": 1921 - }, - { - "path": "seed/canonical/protocol/schemas/import-observation.schema.json", - "sha256": "sha256:1c26f94e93f078d998bbdf3e95ca47b10e2e88602fc0e5ed319b47028ac7eb39", - "size_bytes": 1243 - }, - { - "path": "seed/canonical/protocol/schemas/membership-withdrawal-record.schema.json", - "sha256": "sha256:1e79ca9fb2d7b56a1cbc6a1c00f13358030adf0d4694d592ebef34fba6031e71", - "size_bytes": 2003 - }, - { - "path": "seed/canonical/protocol/schemas/observation.schema.json", - "sha256": "sha256:60cac8b03c38ab0524f3d99823c6ac6f4284bfb1f612efeefe47cee913dc7796", - "size_bytes": 1796 - }, { "path": "seed/canonical/protocol/schemas/operation.schema.json", "sha256": "sha256:be3c89c9c2068c1707070f0ab94226b0bd1052b8ae6dfd3851a691ba83c91742", "size_bytes": 1585 }, - { - "path": "seed/canonical/protocol/schemas/outcome.schema.json", - "sha256": "sha256:92be42cb436d998f91faf8b8a4b1eac9d332b1432b54e87340121b4869b6c706", - "size_bytes": 1340 - }, - { - "path": "seed/canonical/protocol/schemas/payload-authority-transfer.schema.json", - "sha256": "sha256:4831aafefd0412d5ff1a136fed3b3a657db302d0e7d671a235aef163c79429c8", - "size_bytes": 799 - }, - { - "path": "seed/canonical/protocol/schemas/payload-context-redefine.schema.json", - "sha256": "sha256:833084d7ea8bb080f8464370f2991ebfaced6607842dd2d456903f7b0fc52569", - "size_bytes": 3943 - }, - { - "path": "seed/canonical/protocol/schemas/payload-context-terminate.schema.json", - "sha256": "sha256:6b803ec2d7c6ab9cf098a80a32875cd7aa8f938fd99b6430510a5dd5a086f432", - "size_bytes": 816 - }, - { - "path": "seed/canonical/protocol/schemas/payload-correction.schema.json", - "sha256": "sha256:23ea29d8e5da1ed85b4a5566aac7734d7e83927e28ae330e9637aa386df90514", - "size_bytes": 898 - }, - { - "path": "seed/canonical/protocol/schemas/payload-decision.schema.json", - "sha256": "sha256:77f482fc4fdec17410dd0a6c59698e2260969a56ea8bd9c18e026899976a6090", - "size_bytes": 1347 - }, - { - "path": "seed/canonical/protocol/schemas/payload-export.schema.json", - "sha256": "sha256:1edfadc3582a75bb9832b5a7913f5f50177ef5c8b4faf0a7cacd3bca96419275", - "size_bytes": 764 - }, - { - "path": "seed/canonical/protocol/schemas/payload-guarantee-suspend.schema.json", - "sha256": "sha256:ee9e791d467f3b1776f4751d1be46ddc4a394699b5e56e063ff1b1a684651e42", - "size_bytes": 554 - }, - { - "path": "seed/canonical/protocol/schemas/payload-import.schema.json", - "sha256": "sha256:f37c53635c8db33cc849a35e3379a68d9a80be3ec0e44f9cc64af9fbb0d382b4", - "size_bytes": 779 - }, - { - "path": "seed/canonical/protocol/schemas/payload-member-context-genesis.schema.json", - "sha256": "sha256:218cf717aa6c1da148568b0167aa25495d013d9d69755709888113777d969c1c", - "size_bytes": 2184 - }, - { - "path": "seed/canonical/protocol/schemas/payload-membership-withdraw.schema.json", - "sha256": "sha256:8953d37084477bb009f2cd5db0accc43b7dc0d6a555903f4d3c6eeee5fbd0528", - "size_bytes": 407 - }, - { - "path": "seed/canonical/protocol/schemas/payload-observation.schema.json", - "sha256": "sha256:d218234511b2cf68484bf2d32ec8500506172557f5e46fe5040633463710ab3d", - "size_bytes": 1267 - }, - { - "path": "seed/canonical/protocol/schemas/payload-outcome.schema.json", - "sha256": "sha256:8800f5cb5d66c5758027777b89a0b28acbad9173e1ff89114d0b4ab4a49e91c7", - "size_bytes": 817 - }, - { - "path": "seed/canonical/protocol/schemas/payload-partition-local-transition.schema.json", - "sha256": "sha256:6ae208300829f1f83806506cac1d22cf313ff32a8bdd53f4c7954b5808b3b62f", - "size_bytes": 847 - }, - { - "path": "seed/canonical/protocol/schemas/payload-permit-attenuate.schema.json", - "sha256": "sha256:680dce823fd17f511080f58617b214f5e73d445b16173090112f7ddb3eaa438f", - "size_bytes": 1405 - }, - { - "path": "seed/canonical/protocol/schemas/payload-permit-issue.schema.json", - "sha256": "sha256:76c28709068fc90467b23cbdc21a10663a479b5c6a855988ca918d00b6daf62c", - "size_bytes": 1718 - }, - { - "path": "seed/canonical/protocol/schemas/payload-permit-use.schema.json", - "sha256": "sha256:3bc589d919e1893c066197cb2cc213904c8976bffb0f01df6e0df1e11672ad6f", - "size_bytes": 716 - }, - { - "path": "seed/canonical/protocol/schemas/payload-reconcile.schema.json", - "sha256": "sha256:415450a4a88d20e22489a14aac14e2394f240ed24fcf4fdeecf130c90bba7453", - "size_bytes": 1937 - }, { "path": "seed/canonical/protocol/schemas/payload-register-request.schema.json", "sha256": "sha256:7cdaf0b2aca9f3baca646861dfd21a545cb4f487e8bb227b6ba79e38aff1e84c", @@ -961,30 +811,10 @@ "sha256": "sha256:6fd8a00e4f8f9f4f525b2505692a9e8b24e1bf74b1493d6944ccd9cf99875b89", "size_bytes": 335 }, - { - "path": "seed/canonical/protocol/schemas/payload-verification.schema.json", - "sha256": "sha256:7709adcc14d5c25c52c8313e5a8642b1a093b5b75fb79522e9ee47bbddcb4674", - "size_bytes": 1420 - }, - { - "path": "seed/canonical/protocol/schemas/permit-use-receipt.schema.json", - "sha256": "sha256:375621cc2aeab3a67e1a15e210ad27479ba9772b35dbd126a08dd9878985dc29", - "size_bytes": 1531 - }, - { - "path": "seed/canonical/protocol/schemas/permit.schema.json", - "sha256": "sha256:cf4a02399a82a7c1ebf046bececc50ec678d78bc4f93761c22c6e405cd10dc5f", - "size_bytes": 3358 - }, - { - "path": "seed/canonical/protocol/schemas/reconciliation-receipt.schema.json", - "sha256": "sha256:f5ccd6922da37f1ecf6113d616538346138c25c3654b87e930a8dc6bef2dcd04", - "size_bytes": 1481 - }, { "path": "seed/canonical/protocol/schemas/resolution-authority-binding.schema.json", - "sha256": "sha256:803f1747968009dd4f4a6d35406439ec52036686bb0eecd57be56a606dc9e022", - "size_bytes": 969 + "sha256": "sha256:7d5858951bc412ea095cf36867304293c521ee03bc1682ce9683782004d1c94d", + "size_bytes": 772 }, { "path": "seed/canonical/protocol/schemas/resolution-binding.schema.json", @@ -998,8 +828,8 @@ }, { "path": "seed/canonical/protocol/schemas/resolution-record.schema.json", - "sha256": "sha256:0f37ae49b8365f89efdd96ba3bcc8adb827ecaf973b8ddbaf40169fb7ee6f6ca", - "size_bytes": 1235 + "sha256": "sha256:a5f49bd2dcfd0aff0bc6413a0b32e7f6996250fd06d8bc2ab53ff98eb22a9450", + "size_bytes": 1241 }, { "path": "seed/canonical/protocol/schemas/resolution-request.schema.json", @@ -1008,23 +838,8 @@ }, { "path": "seed/canonical/protocol/schemas/resolution-store.schema.json", - "sha256": "sha256:bebd92802b3e6bb6264c08599bdff34bcc40e26e76d0163470953ea0e1d1e5da", - "size_bytes": 835 - }, - { - "path": "seed/canonical/protocol/schemas/root-genesis.schema.json", - "sha256": "sha256:73025e6332df60e341d10cb27e5989cce3935cb42d40ab0cceed46a71f39b99f", - "size_bytes": 2622 - }, - { - "path": "seed/canonical/protocol/schemas/trust-space-state.schema.json", - "sha256": "sha256:f245cf6a37a5b67f754ab3df4a151c04c3c301cebf02867374a688880b97cad4", - "size_bytes": 10489 - }, - { - "path": "seed/canonical/protocol/schemas/verification.schema.json", - "sha256": "sha256:0653d498cce281d578a1952682291f3c3e52e71376406a8cfb7c8778751a3872", - "size_bytes": 1951 + "sha256": "sha256:24a175ef5345c0f9fb0b555a7eeec08c20e557937e7aa51682dd4dcc50acc449", + "size_bytes": 684 }, { "path": "seed/canonical/release/RC12_FREEZE_ENTRY.json", @@ -1058,22 +873,22 @@ }, { "path": "seed/canonical/schemas/canon-tla-refinement.schema.json", - "sha256": "sha256:aaba0b7c0cc6a27158318702c87e5396ae2a0951852fcb21094b60d2d1dfccb6", - "size_bytes": 6582 + "sha256": "sha256:17b142a998bbc8dd7b82b61c54d75e0c0e735211f35f90312565b78a4e7758e5", + "size_bytes": 6776 }, { "path": "seed/canonical/schemas/conformance-profile.schema.json", - "sha256": "sha256:3d4eab2037567b55a8903d55a71f97bd98851d2282766332a86460f2c83d5bb7", + "sha256": "sha256:01d5156f63f850946fbb7c8ed31bb9b3e1b4f21d01b200271da9ad3a13f5a0e8", "size_bytes": 1724 }, { "path": "seed/canonical/schemas/implementation-conformance-envelope.schema.json", - "sha256": "sha256:e7d0b4674a6db735c485822c6a541eccc265f8f07cb6d12425f32f5aef4ba6d6", + "sha256": "sha256:491b9aa4458a11f57424a5eb92f0f7f61d776c8de00a333e47985ff956701e9d", "size_bytes": 3331 }, { "path": "seed/canonical/schemas/implementation-conformance-protocol.schema.json", - "sha256": "sha256:939ee1ac9a8921ceb0f735fbb79cc6925269cfbed5c16232809b385e19f3922a", + "sha256": "sha256:40295089c6bb1e8a0f5b7181bd4cfda4526be61095a822c9014a2a7ebac69de8", "size_bytes": 1280 }, { @@ -1083,12 +898,12 @@ }, { "path": "seed/canonical/schemas/proof-traceability.schema.json", - "sha256": "sha256:7139c370d2cf0709a8c2dfcf891ffc2aecc374d6558f6124aa4bc639795de53f", - "size_bytes": 2875 + "sha256": "sha256:855790c3357025cae6110b813c13b66edc9685433b41873c20c6b9d41fb82517", + "size_bytes": 3050 }, { "path": "seed/canonical/schemas/protocol-profile.schema.json", - "sha256": "sha256:b8a85e60203997172f05b64ed73bcac46121fbc9aee7b2762f77a8f3f8cbf1f2", + "sha256": "sha256:6a4f07a2e94a5b72c1136e92a7385ad3b4e3c70aa473b9ec9788d02b905ae4d1", "size_bytes": 2025 }, { @@ -1103,13 +918,13 @@ }, { "path": "seed/canonical/schemas/repository-status.schema.json", - "sha256": "sha256:cea3bd42e5b7a1feeb4c668d5a1ad2f92d99abf1c44bffd0e64a4ead0550654f", + "sha256": "sha256:a3178e72ef74aeffd1ea30c4ae8f31ad505ea0fa3d793b36d39573b208040781", "size_bytes": 1525 }, { "path": "seed/canonical/schemas/seed-model.schema.json", - "sha256": "sha256:09e679bc379fdab2ff78c09ad6f71b3969ca654bbb53f5f1d432e10a79921fa1", - "size_bytes": 8661 + "sha256": "sha256:1f1a727764b5d0138951f76fac1ab1155f4ba67c92f21aa8a21f7ef105bf9f94", + "size_bytes": 8807 }, { "path": "seed/canonical/shapes/seed.shacl.ttl", @@ -1118,8 +933,8 @@ }, { "path": "seed/canonical/source/seed-model.json", - "sha256": "sha256:b5e68692317600fd2833474a1f9c31f09e44d37ae92ec14573b416076c5dd7f6", - "size_bytes": 36127 + "sha256": "sha256:c43ca7b642a11c3ab140884a6bbff34bbd741f5cb905e6a779c860c813998fcf", + "size_bytes": 40151 }, { "path": "seed/canonical/terminology/foreign-terms.json", @@ -1128,13 +943,13 @@ }, { "path": "seed/canonical/terminology/seed.skos.ttl", - "sha256": "sha256:02359ded1ff2f14a7252fb489f18c0ab3f3dbceab9932d4503cb2b5ce376b8bd", - "size_bytes": 3712 + "sha256": "sha256:ac10d88a1001cc0cfef57e31f076c2e4a54639085fba6289d8ba523731933ca8", + "size_bytes": 3961 }, { "path": "seed/canonical/terminology/seed.tbx", - "sha256": "sha256:fbb6350feb0d8061352b8ca7b3da3eb3a60038668568c22db88460e111a156d8", - "size_bytes": 4541 + "sha256": "sha256:572d4f8a4e506256ba4658987262fb2e1f0138ac663c76f3bac60c9f31eeaade", + "size_bytes": 4552 }, { "path": "seed/releases/0.1-rc11/README.md", @@ -2098,17 +1913,17 @@ }, { "path": "tests/test_canonical_model.py", - "sha256": "sha256:6d317d4cba9d10c771c86b6629c80c07a9dd1e2041892cf76626ecc4af38b507", - "size_bytes": 970 + "sha256": "sha256:a31ea5918db6c34161996edbe3a1ea11fe664aa311134c13ed92f35a6e25ea4e", + "size_bytes": 1451 }, { "path": "tests/test_ci_assurance.py", - "sha256": "sha256:b53064afba5d98de8c77cabd6fb54a85e8567741ca0d722d0a1cbbc47a7ba4df", - "size_bytes": 9103 + "sha256": "sha256:d9339a902b4c78bf0b2d9d5dce3d705b2dce0a58f51a9c45f7efceaddd87c8f6", + "size_bytes": 9353 }, { "path": "tests/test_implementation_conformance_protocol.py", - "sha256": "sha256:7994b642e82e31809a81606efdb72ad7d4e8625b385816bb80b7f1db2d0edd67", + "sha256": "sha256:957de7274384b7ef319c4f4b7fc6c6fa52186cfbc413e4fcd0ef6d5a8b741874", "size_bytes": 703 }, { @@ -2118,8 +1933,8 @@ }, { "path": "tests/test_minimal_resolution_kernel.py", - "sha256": "sha256:44a236f50aa85c960eb58f74a5b84a51fd0d91a2cc249c689a488282dba807fa", - "size_bytes": 1722 + "sha256": "sha256:a15c9e4146a1c9ff469848a0e2b25854c6df2bedd4dbcdf38304ce905c738a66", + "size_bytes": 2108 }, { "path": "tests/test_production_repository.py", @@ -2153,8 +1968,8 @@ }, { "path": "tools/build_canon_package.py", - "sha256": "sha256:d3fdf7895f3910feb3d6974dfd72ef25f317834035e95d398c58bf249ea12569", - "size_bytes": 4083 + "sha256": "sha256:ec71afc2e51b342694d061e6117360602aebde4ac2c74799b85a9dfda255e2fd", + "size_bytes": 4372 }, { "path": "tools/build_release.py", @@ -2163,8 +1978,8 @@ }, { "path": "tools/check_assurance_traceability.py", - "sha256": "sha256:753b76fa5a7293c5bf389a188a264719b51b778f0b53a984fcdc22d32e0fedae", - "size_bytes": 10316 + "sha256": "sha256:7a4076a25b2e73af9244f1bb8e9d57ffede103a454c36dec028a415ed36ecbc6", + "size_bytes": 10419 }, { "path": "tools/check_canon_compatibility.py", @@ -2173,8 +1988,8 @@ }, { "path": "tools/check_canon_tla_refinement.py", - "sha256": "sha256:ea28442031c166417173649141304b9fe343fde7223af165f62897c559466ffb", - "size_bytes": 8507 + "sha256": "sha256:95a6a771244177f7e4fe83921baadd11170c4b6967fc39d6238a1a87a5e3c02b", + "size_bytes": 8989 }, { "path": "tools/check_invariant_coverage.py", @@ -2188,13 +2003,13 @@ }, { "path": "tools/check_proof_traceability.py", - "sha256": "sha256:53edb5e064e9d9db9a2bb54afb752d098bb60e61815544d401135408249ef957", - "size_bytes": 9369 + "sha256": "sha256:332c6055d77dac1c83c0491e82009b7bbaa7ed50ff844285255985fe468249df", + "size_bytes": 9612 }, { "path": "tools/generate_canon_tla_projection.py", - "sha256": "sha256:c81fadbdf922068a95c67bb3d80f81bdf48ae7deaabb42df0908919711c44597", - "size_bytes": 8140 + "sha256": "sha256:fb0bc3d79d0d8e4c7bffa4a1f5ab6c76b45bb621adae8ef4367958e9a7b16127", + "size_bytes": 9119 }, { "path": "tools/generate_editions.py", @@ -2228,8 +2043,8 @@ }, { "path": "tools/model_check_seed.py", - "sha256": "sha256:118d2519eadae60c5105d9506bd69d54fc4acda321ed277b9328230c90081626", - "size_bytes": 10388 + "sha256": "sha256:40411d867950450af17bbdf5f4db47c83916c6edb65a45fb565d26d7fbbe67be", + "size_bytes": 9720 }, { "path": "tools/production_gate.py", @@ -2248,8 +2063,8 @@ }, { "path": "tools/run_canon_tla_refinement.py", - "sha256": "sha256:f6b6228d979badccb2705a515a9a97bd9dc051c907a0ad9d90f2c339ca30a280", - "size_bytes": 6441 + "sha256": "sha256:8f15d25a41eaa5f20b71533b4fccc71ebc703c98ca3dbb9eb5bba36c10d15ee7", + "size_bytes": 6762 }, { "path": "tools/run_external_conformance.py", @@ -2258,13 +2073,13 @@ }, { "path": "tools/run_invariant_mutations.py", - "sha256": "sha256:03f277e79b597eb787e2431725151308d75193983c4af16e9340aa7c682570be", - "size_bytes": 5649 + "sha256": "sha256:8b5b70289d46ed97b70fa17b082564aff01709744a3a1218873e702393e5567b", + "size_bytes": 5668 }, { "path": "tools/run_tlaps.py", - "sha256": "sha256:860c16d6fe19934f5b04590723671b626c0f5da83e33fc338fc24ee4be225bda", - "size_bytes": 6796 + "sha256": "sha256:aff11c54128a248ed9fe697b019b8ef4e9fe501ef0ee3b25b0ece65fac647f8b", + "size_bytes": 6758 }, { "path": "tools/run_tlc.py", @@ -2273,8 +2088,8 @@ }, { "path": "tools/seed_resolution_oracle.py", - "sha256": "sha256:f7af5e9ba460b1c4947e769c84adc4f81421d7c6ba7acf85b1035af8d9e525be", - "size_bytes": 14076 + "sha256": "sha256:24fb9c2a54479c19eadba837b2000c8f8f25169de4bbcae5d69b4f7788803406", + "size_bytes": 13489 }, { "path": "tools/semantic_diff.py", @@ -2313,8 +2128,8 @@ }, { "path": "tools/validate_seed_canon.py", - "sha256": "sha256:e92f2c8e3e47bae69a69f33d7069b50df3f25262a6b3794737ad5827e8449e7e", - "size_bytes": 7211 + "sha256": "sha256:39100a61aef4cfed479a9a91a98e7312976bb31970c32aa2fa9e90a093b1d87d", + "size_bytes": 7891 }, { "path": "tools/verify_frozen_release.py", @@ -2322,7 +2137,7 @@ "size_bytes": 1035 } ], - "files_count": 464, + "files_count": 427, "manifest_scope": "all repository regular files except MANIFEST.json, Git metadata, virtual environments, caches and dist", "package": "ASET-Seed-0.3.0-alpha.1-Minimal-Strong-Core", "repository_root": "ASET" diff --git a/README.md b/README.md index ccaef7a..5db5e12 100644 --- a/README.md +++ b/README.md @@ -8,7 +8,7 @@ ASET is an open, implementation-neutral specification for Authority-Signed Evide UNKNOWN | ALLOW | BLOCK ``` -Only one unique valid, locally authorized and exact-binding `ALLOW` record permits the bound effect. Missing, invalid or conflicting material is `UNKNOWN`; explicit prohibition is `BLOCK`. Evidence, AI output and remote outcomes never create local Authority by themselves. +Only one unique valid, locally authorized and exact-binding `ALLOW` record permits the bound effect. Missing or conflicting valid terminal state is `UNKNOWN`; explicit prohibition is `BLOCK`. Invalid or non-authoritative material cannot override an otherwise unique valid terminal record. Evidence, AI output and remote outcomes never create local Authority by themselves. Repository boundary records: [EXTRACTION.md](EXTRACTION.md), [IMPLEMENTATIONS.md](IMPLEMENTATIONS.md), [EXTENSIONS.md](EXTENSIONS.md). diff --git a/README.pt-BR.md b/README.pt-BR.md index 028dda5..212b658 100644 --- a/README.pt-BR.md +++ b/README.pt-BR.md @@ -8,7 +8,7 @@ ASET é uma especificação aberta e neutra de implementação para Authority-Si UNKNOWN | ALLOW | BLOCK ``` -Somente um registro `ALLOW` único, válido, localmente autorizado e exatamente vinculado permite o efeito vinculado. Material ausente, inválido ou conflitante resulta em `UNKNOWN`; proibição explícita é `BLOCK`. Evidence, saída de AI e outcome remoto não criam Authority local por si só. +Somente um registro `ALLOW` único, válido, localmente autorizado e exatamente vinculado permite o efeito vinculado. A ausência de estado terminal válido ou o conflito entre registros terminais válidos resulta em `UNKNOWN`; proibição explícita é `BLOCK`. Material inválido ou não autoritativo não pode substituir um registro terminal válido que, de outro modo, seria único. Evidence, saída de AI e outcome remoto não criam Authority local por si só. Repository boundary records: [EXTRACTION.md](EXTRACTION.md), [IMPLEMENTATIONS.md](IMPLEMENTATIONS.md), [EXTENSIONS.md](EXTENSIONS.md). diff --git a/README.ru.md b/README.ru.md index b6b6242..abe1ecf 100644 --- a/README.ru.md +++ b/README.ru.md @@ -8,7 +8,7 @@ ASET — открытая технологически нейтральная с UNKNOWN | ALLOW | BLOCK ``` -Точно связанный эффект разрешает только одна уникальная действительная, локально авторизованная запись `ALLOW`. Отсутствующий, недействительный или конфликтующий материал даёт `UNKNOWN`; явный запрет — `BLOCK`. Evidence, выход AI и удалённый outcome сами по себе не создают локальную Authority. +Точно связанный эффект разрешает только одна уникальная действительная, локально авторизованная запись `ALLOW`. Отсутствие действительной терминальной записи или конфликт между действительными терминальными записями даёт `UNKNOWN`; явный запрет — `BLOCK`. Недействительный или неавторитетный материал не может переопределить иначе уникальную действительную терминальную запись. Evidence, выход AI и удалённый outcome сами по себе не создают локальную Authority. Repository boundary records: [EXTRACTION.md](EXTRACTION.md), [IMPLEMENTATIONS.md](IMPLEMENTATIONS.md), [EXTENSIONS.md](EXTENSIONS.md). diff --git a/REPOSITORY_STATUS.json b/REPOSITORY_STATUS.json index c08db50..f632602 100644 --- a/REPOSITORY_STATUS.json +++ b/REPOSITORY_STATUS.json @@ -1,5 +1,5 @@ { - "active_conformance_protocol": "ASET-SEED-RESOLUTION-CONFORMANCE-V2", + "active_conformance_protocol": "ASET-SEED-RESOLUTION-CONFORMANCE-V3", "active_seed_model": "seed/canonical/source/seed-model.json", "active_seed_status": "MINIMAL_STRONG_CORE_ALPHA", "active_seed_version": "0.3.0-alpha.1", diff --git a/audit/ACTIVE_AUDIT_INDEX.json b/audit/ACTIVE_AUDIT_INDEX.json index 25b8660..8f0c17a 100644 --- a/audit/ACTIVE_AUDIT_INDEX.json +++ b/audit/ACTIVE_AUDIT_INDEX.json @@ -1,6 +1,6 @@ { "active_candidate": { - "canon_package_digest": "sha256:ff77a6a022aae70c576613f31ab083778adc27bc7ff5af94363481d77f4161e1", + "canon_package_digest": "sha256:392ff8e36eecb2bf6cfa9a6cbc76117025a4c7d8a170e8ddf562f1ea5df27d38", "extension_separation": "COMPLETE", "implementation_precedence": "NONE", "repository_role": "OPEN_IMPLEMENTATION_NEUTRAL_SPECIFICATION", diff --git a/docs/architecture/SEED_ROLE.md b/docs/architecture/SEED_ROLE.md index 30fd42a..d0ae67a 100644 --- a/docs/architecture/SEED_ROLE.md +++ b/docs/architecture/SEED_ROLE.md @@ -1,20 +1,38 @@ # Role of ASET Seed -ASET Seed is the minimal local resolution-recognition kernel of the ecosystem. +ASET Seed is the minimal local resolution-recognition core. -It defines: +It owns only the state necessary to remember admitted requests and accepted +terminal resolutions. It does not own the world that supplies evidence, +conflict observations, policy results or cryptographic proofs. -- exact `ResolutionBinding`; -- fresh `ResolutionRequest`; -- locally rooted Authority and attenuating Authority proof; -- immutable terminal `ResolutionRecord`; -- derived `UNKNOWN`, terminal `ALLOW` and terminal `BLOCK`; -- fail-closed effect permission; -- fresh reconsideration linked by an immutable recognized terminal-record commitment. +## Seed-owned state -It does not define policy evaluation, evidence acquisition, workflow, federation, storage, retention/compaction, a concrete cryptographic accumulator or enforcement. Extensions may produce and transport inputs and proof material, but only Seed semantics determine whether a terminal record is valid. +- immutable request metadata for registered `resolution_id` values; +- immutable terminal metadata for accepted terminal `ALLOW`/`BLOCK` values. -Evidence, AI output, consensus and remote outcomes remain non-authoritative until a locally authorized exact-binding terminal record is recognized. +## Environment and observers +Conflict is environment state because an independently established conflict +between valid terminal records changes the derived resolution to `UNKNOWN`. +`EVALUATE_RESOLUTION` is a pure observer and never mutates Seed-owned state. -Historical predecessor objects are not part of the reconsideration requirement. An implementation may prune them after preserving profile-specific proof material sufficient to re-establish recognition of the terminal commitment. A bounded hot buffer plus an authenticated accumulator is one scalable profile; Merkle/MMR or any other concrete construction is non-normative. +Invalid, malformed or non-authoritative material has no Seed state slot. It may +fail admission or be ignored by the resolution algebra, but it cannot create +Authority, `ALLOW` or a conflict by mere presence. + +## Authority boundary + +Seed requires an exact-binding Authority to be explicitly recognized by the +local Context. How that recognition is established—signature, certificate, +delegation chain, hardware root, external verifier or another mechanism—is a +profile concern. Opaque evidence references are not Authority by themselves. + +## Outside Seed + +Policy evaluation, evidence acquisition, workflow, federation, storage, +retention/compaction, cryptographic accumulators, signature schemes and effect +enforcement are extension or implementation concerns. + +Reconsideration refers to a recognized immutable terminal commitment. The +predecessor object need not remain physically retained. diff --git a/docs/architecture/SEED_STATE_MINIMIZATION.md b/docs/architecture/SEED_STATE_MINIMIZATION.md index 44eb3a7..1275c28 100644 --- a/docs/architecture/SEED_STATE_MINIMIZATION.md +++ b/docs/architecture/SEED_STATE_MINIMIZATION.md @@ -1,60 +1,41 @@ -# Seed state minimization +# Seed state boundary and minimization -## Decision +## Current decomposition -The abstract Seed safety state is normalized to three independent variables: +The active formal model has two Seed-owned mutable state dimensions and one +environment dimension: -1. `requestMeta` — a partial function containing immutable request metadata only for registered `resolution_id` values; -2. `terminalMeta` — a partial function containing accepted terminal metadata only for terminal `resolution_id` values; -3. `conflicts` — the only retained environment observation because conflict can - change a previously terminal derived resolution to `UNKNOWN`. +1. `requestMeta` — partial map of admitted request metadata; +2. `terminalMeta` — partial map of accepted terminal metadata; +3. `conflicts` — environment observation state. -`LocalAuthorityBindings` and `AuthorityProofBindings` are immutable context -parameters, not mutable Seed state. +`seedVars == <>`; conflict is deliberately excluded +from Seed-owned state. -## Removed independent state +## Derived, not stored -The formal projection no longer stores independent copies of: +- `Requests == DOMAIN requestMeta`; +- `TerminalRequests == DOMAIN terminalMeta`; +- terminal binding is the request binding; +- request/terminal absence is domain absence, not a sentinel; +- evaluation is an observer, not stored state. -- `requests` — exactly `DOMAIN requestMeta`; -- request/terminal absence sentinels — absence is represented by an identifier not being in the corresponding function domain; -- request binding, request Authority and predecessor maps — normalized into one - request metadata cell (the initial Authority is admission evidence and need not - be duplicated after successful local-root validation); -- terminal binding — derived from immutable request binding; -- terminal Authority/value maps — normalized into one terminal metadata cell; -- invalid-material observations — rejected material cannot become accepted - terminal state, so the abstract resolution state stutters; -- non-authoritative inputs — they have no canonical state slot and therefore - stutter by construction. +This makes several disagreement states unrepresentable instead of proving that +duplicated fields remain synchronized. -This is a representation strengthening, not a move of guarantees into a -cryptographic accumulator. No Merkle/MMR/hash algorithm is introduced into -Seed. +## Provenance versus decision state -## Why this is stronger +`requestMeta.previous` and `terminalMeta.authority` carry provenance needed for +reconsideration and Authority-soundness claims. They are not independent +resolution-algebra dimensions, but remain in the abstract state until a +separate provenance refinement is specified and proved. -The old projection represented several impossible or undesirable disagreement -states and then proved invariants excluding them. The normalized projection also -uses partial functions instead of mixed sentinel-or-record values, so each -metadata function is homogeneous whenever it is defined. The normalized projection does -not represent those disagreements at all. In particular an accepted terminal -record cannot carry a binding different from its registered request because no -independent terminal-binding state exists. +## External material -The externally visible protocol remains unchanged. Invalid records, digest -mismatches and Authority-proof failures are rejected at the protocol/conformance -boundary before they can enter the accepted abstract state. +Invalid/non-authoritative material has no artificial stutter action. It remains +outside the abstract state machine. The executable admission boundary verifies +that it cannot create accepted state. Valid conflict observation is modeled +separately as environment state and is proved not to mutate Seed-owned state. -## Formal boundary - -The minimized model keeps explicit proofs for fail-closed resolution, -Authority soundness, fresh reconsideration, terminal immutability, append-only -request identity and recognized-transition state changes. It additionally makes -two boundary properties explicit: - -- invalid material is a semantic stutter in the accepted abstract state; -- non-authoritative input is a semantic stutter and has no retained state slot. - -Concrete cryptography, terminal-commitment accumulators, persistence and -implementation refinement remain separate profiles. +No Merkle tree, MMR, signature algorithm or accumulator is introduced into the +Seed core. diff --git a/docs/generated/en/ASET_Seed_Next.md b/docs/generated/en/ASET_Seed_Next.md index 09716db..a9e0495 100644 --- a/docs/generated/en/ASET_Seed_Next.md +++ b/docs/generated/en/ASET_Seed_Next.md @@ -4,7 +4,7 @@ **Status:** `MINIMAL_STRONG_CORE_ALPHA` -**Canonical model SHA-256:** `sha256:5bbdfefe35a0adf83fd5e5dd86475a4f57ae92d4f9b9c06a7d530faf2e484396` +**Canonical model SHA-256:** `sha256:54c46e46d4e6b5870353bb0ed229310f60583e9acd11798b655bdd837c8dba74` > This edition is derived from the machine canon. @@ -40,21 +40,21 @@ An Authority explicitly recognized by one Context for one exact binding and poli Identifier: `seed.local_authority` -### Authority proof (`AuthorityProof`) +### Authority recognition (`AuthorityRecognition`) -A locally rooted, exact-binding, acyclic and non-expanding chain of explicit Authority grants. +A local exact-binding recognition result stating that one Authority is authorized for one ResolutionBinding; concrete grant chains, signatures and proof construction are external to Seed. -Identifier: `seed.authority_proof` +Identifier: `seed.authority_recognition` ### evidence reference (`EvidenceReference`) -A content-addressed non-authoritative input cited as the basis of a terminal record. +An opaque content-addressed reference to non-authoritative evidence or proof material. It has no normative effect until a Seed admission boundary recognizes the fact it supports. Identifier: `seed.evidence_reference` ### resolution record (`ResolutionRecord`) -One immutable content-addressed terminal ALLOW or BLOCK record with exact binding and Authority proof. +One immutable content-addressed terminal ALLOW or BLOCK record with exact binding, a recognized Authority, and optional opaque evidence references. Identifier: `seed.resolution_record` @@ -108,7 +108,7 @@ Predicate: `allow_only` ### `ASET-SEED-REQ-005` -UNKNOWN and BLOCK MUST prohibit the effect; absence, invalidity, ambiguity or verification error MUST resolve to UNKNOWN rather than ALLOW. +UNKNOWN and BLOCK MUST prohibit the effect. Missing or ambiguous valid terminal state, or failure to establish a valid terminal record, MUST resolve to UNKNOWN. Invalid or non-authoritative material MUST NOT override an otherwise unique valid terminal record. Modality: `MUST` @@ -128,17 +128,17 @@ Predicate: `local_authority` ### `ASET-SEED-REQ-007` -Every delegated Authority proof MUST be explicit, acyclic, exact-binding and non-expanding. +Authority evidence or delegation material MUST NOT create or expand Authority by itself; a terminal record Authority MUST be explicitly recognized for the exact binding before the record can become valid. Modality: `MUST` -Predicate: `proof_attenuating` +Predicate: `authority_recognition_boundary` `verification`: `ASET-VERIFY-DECLARATIVE-STATE-VALIDATION`, `ASET-VERIFY-PORTABLE-CASES`, `ASET-VERIFY-BOUNDED-MODEL`, `ASET-VERIFY-INVARIANT-COVERAGE`, `ASET-VERIFY-SEMANTIC-MUTATIONS` ### `ASET-SEED-REQ-008` -Evidence, verification results, AI outputs, consensus results and remote outcomes MUST NOT by themselves create ALLOW or local Authority. +Evidence, verification results, AI outputs, consensus results, remote outcomes and other external statements MUST NOT by themselves mutate Seed-owned canonical state or create ALLOW or local Authority. Modality: `MUST` @@ -192,13 +192,13 @@ Predicate: `implementation_neutral` - `SEED-INV-002` — Effect permission is true if and only if the unique valid terminal record is ALLOW. - `SEED-INV-003` — UNKNOWN and BLOCK never permit an effect. - `SEED-INV-004` — Every request and terminal record preserves one exact binding digest. -- `SEED-INV-005` — Every valid terminal record is rooted in a local Authority binding. -- `SEED-INV-006` — Every delegated Authority proof is exact-binding, acyclic and non-expanding. -- `SEED-INV-007` — Evidence and external statements are non-authoritative inputs. +- `SEED-INV-005` — Every valid terminal record uses an Authority explicitly recognized for the exact local binding. +- `SEED-INV-006` — Authority evidence is non-authoritative until exact-binding Authority recognition succeeds; opaque proof material cannot create or expand Authority by itself. +- `SEED-INV-007` — External statements and evidence are outside Seed-owned canonical state unless accepted by a recognized Seed transition. - `SEED-INV-008` — At most one valid terminal record exists for one resolution_id. -- `SEED-INV-009` — Conflicting or invalid terminal material yields UNKNOWN and never ALLOW. +- `SEED-INV-009` — Conflicting valid terminal records yield UNKNOWN. Invalid or non-authoritative material cannot create ALLOW, create a conflict, or override an otherwise unique valid terminal record. - `SEED-INV-010` — Resolution records are append-only, immutable and content-addressed. -- `SEED-INV-011` — Only recognized Seed transitions may change the canonical store; an invalid or unrecognized candidate is not a Seed transition. +- `SEED-INV-011` — Only recognized Seed state transitions may change Seed-owned canonical state; environment observations and observer operations do not mutate that state. - `SEED-INV-012` — Reconsideration uses a fresh resolution_id linked by an immutable content-addressed commitment to a previously recognized terminal ResolutionRecord; predecessor object retention is not required. ## Transitions @@ -213,7 +213,7 @@ Predicate: `implementation_neutral` ### `SEED-TX-002` — `SUBMIT_RESOLUTION` - `payload_schema`: `seed/canonical/protocol/schemas/payload-submit-resolution.schema.json` -- `authority_rule`: The record Authority must be the local root Authority or be justified by a valid exact-binding Authority proof. +- `authority_rule`: The record Authority must be explicitly recognized for the exact request binding. Concrete signatures, delegation chains and proof construction are external validation mechanisms. - `binding_rule`: The record request_digest and binding_digest must exactly match the registered request. - `created_artifacts`: `ResolutionRecord` @@ -221,7 +221,7 @@ Predicate: `implementation_neutral` - `payload_schema`: `seed/canonical/protocol/schemas/operation.schema.json` - `authority_rule`: Evaluation creates no Authority and accepts no external statement as a resolution. -- `binding_rule`: Evaluation is performed for one registered resolution_id and fails closed on missing, invalid or conflicting terminal material. +- `binding_rule`: Evaluation observes one resolution_id without mutating Seed-owned state. It derives UNKNOWN when no unique valid terminal record is established; invalid or non-authoritative material cannot override a unique valid record. - `created_artifacts`: `ResolutionEvaluation` ## Implementation boundary @@ -229,4 +229,4 @@ Predicate: `implementation_neutral` - `normative_status`: `IMPLEMENTATION_NEUTRAL` - `implementation_precedence`: `NONE` - `conformance_protocol_ref`: `seed/canonical/conformance/implementation-conformance-protocol.json` -- `unspecified_by_seed`: `policy evaluation language`, `evidence acquisition`, `orchestration semantics`, `enforcement mechanism`, `storage engine`, `durability level`, `concurrency control`, `network topology`, `consensus protocol`, `cryptographic provider`, `key custody`, `federation topology`, `AI model`, `artifact retention`, `retention, pruning, archiving and compaction of superseded request/record material`, `terminal-commitment accumulator construction`, `accumulator membership/update witness retention` +- `unspecified_by_seed`: `policy evaluation language`, `evidence acquisition`, `orchestration semantics`, `enforcement mechanism`, `storage engine`, `durability level`, `concurrency control`, `network topology`, `consensus protocol`, `cryptographic provider`, `concrete Authority grant-chain construction and validation`, `key custody`, `federation topology`, `AI model`, `artifact retention`, `retention, pruning, archiving and compaction of superseded request/record material`, `terminal-commitment accumulator construction`, `accumulator membership/update witness retention` diff --git a/docs/generated/en/ASET_Seed_Resolution_0.3-alpha.1.md b/docs/generated/en/ASET_Seed_Resolution_0.3-alpha.1.md index 09716db..a9e0495 100644 --- a/docs/generated/en/ASET_Seed_Resolution_0.3-alpha.1.md +++ b/docs/generated/en/ASET_Seed_Resolution_0.3-alpha.1.md @@ -4,7 +4,7 @@ **Status:** `MINIMAL_STRONG_CORE_ALPHA` -**Canonical model SHA-256:** `sha256:5bbdfefe35a0adf83fd5e5dd86475a4f57ae92d4f9b9c06a7d530faf2e484396` +**Canonical model SHA-256:** `sha256:54c46e46d4e6b5870353bb0ed229310f60583e9acd11798b655bdd837c8dba74` > This edition is derived from the machine canon. @@ -40,21 +40,21 @@ An Authority explicitly recognized by one Context for one exact binding and poli Identifier: `seed.local_authority` -### Authority proof (`AuthorityProof`) +### Authority recognition (`AuthorityRecognition`) -A locally rooted, exact-binding, acyclic and non-expanding chain of explicit Authority grants. +A local exact-binding recognition result stating that one Authority is authorized for one ResolutionBinding; concrete grant chains, signatures and proof construction are external to Seed. -Identifier: `seed.authority_proof` +Identifier: `seed.authority_recognition` ### evidence reference (`EvidenceReference`) -A content-addressed non-authoritative input cited as the basis of a terminal record. +An opaque content-addressed reference to non-authoritative evidence or proof material. It has no normative effect until a Seed admission boundary recognizes the fact it supports. Identifier: `seed.evidence_reference` ### resolution record (`ResolutionRecord`) -One immutable content-addressed terminal ALLOW or BLOCK record with exact binding and Authority proof. +One immutable content-addressed terminal ALLOW or BLOCK record with exact binding, a recognized Authority, and optional opaque evidence references. Identifier: `seed.resolution_record` @@ -108,7 +108,7 @@ Predicate: `allow_only` ### `ASET-SEED-REQ-005` -UNKNOWN and BLOCK MUST prohibit the effect; absence, invalidity, ambiguity or verification error MUST resolve to UNKNOWN rather than ALLOW. +UNKNOWN and BLOCK MUST prohibit the effect. Missing or ambiguous valid terminal state, or failure to establish a valid terminal record, MUST resolve to UNKNOWN. Invalid or non-authoritative material MUST NOT override an otherwise unique valid terminal record. Modality: `MUST` @@ -128,17 +128,17 @@ Predicate: `local_authority` ### `ASET-SEED-REQ-007` -Every delegated Authority proof MUST be explicit, acyclic, exact-binding and non-expanding. +Authority evidence or delegation material MUST NOT create or expand Authority by itself; a terminal record Authority MUST be explicitly recognized for the exact binding before the record can become valid. Modality: `MUST` -Predicate: `proof_attenuating` +Predicate: `authority_recognition_boundary` `verification`: `ASET-VERIFY-DECLARATIVE-STATE-VALIDATION`, `ASET-VERIFY-PORTABLE-CASES`, `ASET-VERIFY-BOUNDED-MODEL`, `ASET-VERIFY-INVARIANT-COVERAGE`, `ASET-VERIFY-SEMANTIC-MUTATIONS` ### `ASET-SEED-REQ-008` -Evidence, verification results, AI outputs, consensus results and remote outcomes MUST NOT by themselves create ALLOW or local Authority. +Evidence, verification results, AI outputs, consensus results, remote outcomes and other external statements MUST NOT by themselves mutate Seed-owned canonical state or create ALLOW or local Authority. Modality: `MUST` @@ -192,13 +192,13 @@ Predicate: `implementation_neutral` - `SEED-INV-002` — Effect permission is true if and only if the unique valid terminal record is ALLOW. - `SEED-INV-003` — UNKNOWN and BLOCK never permit an effect. - `SEED-INV-004` — Every request and terminal record preserves one exact binding digest. -- `SEED-INV-005` — Every valid terminal record is rooted in a local Authority binding. -- `SEED-INV-006` — Every delegated Authority proof is exact-binding, acyclic and non-expanding. -- `SEED-INV-007` — Evidence and external statements are non-authoritative inputs. +- `SEED-INV-005` — Every valid terminal record uses an Authority explicitly recognized for the exact local binding. +- `SEED-INV-006` — Authority evidence is non-authoritative until exact-binding Authority recognition succeeds; opaque proof material cannot create or expand Authority by itself. +- `SEED-INV-007` — External statements and evidence are outside Seed-owned canonical state unless accepted by a recognized Seed transition. - `SEED-INV-008` — At most one valid terminal record exists for one resolution_id. -- `SEED-INV-009` — Conflicting or invalid terminal material yields UNKNOWN and never ALLOW. +- `SEED-INV-009` — Conflicting valid terminal records yield UNKNOWN. Invalid or non-authoritative material cannot create ALLOW, create a conflict, or override an otherwise unique valid terminal record. - `SEED-INV-010` — Resolution records are append-only, immutable and content-addressed. -- `SEED-INV-011` — Only recognized Seed transitions may change the canonical store; an invalid or unrecognized candidate is not a Seed transition. +- `SEED-INV-011` — Only recognized Seed state transitions may change Seed-owned canonical state; environment observations and observer operations do not mutate that state. - `SEED-INV-012` — Reconsideration uses a fresh resolution_id linked by an immutable content-addressed commitment to a previously recognized terminal ResolutionRecord; predecessor object retention is not required. ## Transitions @@ -213,7 +213,7 @@ Predicate: `implementation_neutral` ### `SEED-TX-002` — `SUBMIT_RESOLUTION` - `payload_schema`: `seed/canonical/protocol/schemas/payload-submit-resolution.schema.json` -- `authority_rule`: The record Authority must be the local root Authority or be justified by a valid exact-binding Authority proof. +- `authority_rule`: The record Authority must be explicitly recognized for the exact request binding. Concrete signatures, delegation chains and proof construction are external validation mechanisms. - `binding_rule`: The record request_digest and binding_digest must exactly match the registered request. - `created_artifacts`: `ResolutionRecord` @@ -221,7 +221,7 @@ Predicate: `implementation_neutral` - `payload_schema`: `seed/canonical/protocol/schemas/operation.schema.json` - `authority_rule`: Evaluation creates no Authority and accepts no external statement as a resolution. -- `binding_rule`: Evaluation is performed for one registered resolution_id and fails closed on missing, invalid or conflicting terminal material. +- `binding_rule`: Evaluation observes one resolution_id without mutating Seed-owned state. It derives UNKNOWN when no unique valid terminal record is established; invalid or non-authoritative material cannot override a unique valid record. - `created_artifacts`: `ResolutionEvaluation` ## Implementation boundary @@ -229,4 +229,4 @@ Predicate: `implementation_neutral` - `normative_status`: `IMPLEMENTATION_NEUTRAL` - `implementation_precedence`: `NONE` - `conformance_protocol_ref`: `seed/canonical/conformance/implementation-conformance-protocol.json` -- `unspecified_by_seed`: `policy evaluation language`, `evidence acquisition`, `orchestration semantics`, `enforcement mechanism`, `storage engine`, `durability level`, `concurrency control`, `network topology`, `consensus protocol`, `cryptographic provider`, `key custody`, `federation topology`, `AI model`, `artifact retention`, `retention, pruning, archiving and compaction of superseded request/record material`, `terminal-commitment accumulator construction`, `accumulator membership/update witness retention` +- `unspecified_by_seed`: `policy evaluation language`, `evidence acquisition`, `orchestration semantics`, `enforcement mechanism`, `storage engine`, `durability level`, `concurrency control`, `network topology`, `consensus protocol`, `cryptographic provider`, `concrete Authority grant-chain construction and validation`, `key custody`, `federation topology`, `AI model`, `artifact retention`, `retention, pruning, archiving and compaction of superseded request/record material`, `terminal-commitment accumulator construction`, `accumulator membership/update witness retention` diff --git a/docs/generated/pt-BR/ASET_Seed_Next.md b/docs/generated/pt-BR/ASET_Seed_Next.md index d9bb411..1d6d520 100644 --- a/docs/generated/pt-BR/ASET_Seed_Next.md +++ b/docs/generated/pt-BR/ASET_Seed_Next.md @@ -4,7 +4,7 @@ **Status:** `MINIMAL_STRONG_CORE_ALPHA` -**SHA-256 do modelo canônico:** `sha256:5bbdfefe35a0adf83fd5e5dd86475a4f57ae92d4f9b9c06a7d530faf2e484396` +**SHA-256 do modelo canônico:** `sha256:54c46e46d4e6b5870353bb0ed229310f60583e9acd11798b655bdd837c8dba74` > Esta edição é derivada do cânone legível por máquina. @@ -40,21 +40,21 @@ Uma Authority explicitamente reconhecida por um Context para uma vinculação ex Identificador: `seed.local_authority` -### prova de Authority (`AuthorityProof`) +### reconhecimento de Authority (`AuthorityRecognition`) -Uma cadeia localmente enraizada, exatamente vinculada, acíclica e não expansiva de concessões explícitas de Authority. +Um resultado local de reconhecimento com vinculação exata que declara uma Authority autorizada para uma ResolutionBinding; cadeias de concessão, assinaturas e construção de prova concretas são externas ao Seed. -Identificador: `seed.authority_proof` +Identificador: `seed.authority_recognition` ### referência de evidência (`EvidenceReference`) -Uma entrada não autoritativa endereçada por conteúdo, citada como base de um registro terminal. +Uma referência opaca e endereçada por conteúdo a evidência ou material de prova não autoritativo. Ela não tem efeito normativo até que uma fronteira de admissão do Seed reconheça o fato que suporta. Identificador: `seed.evidence_reference` ### registro de resolução (`ResolutionRecord`) -Um registro terminal imutável e endereçado por conteúdo, ALLOW ou BLOCK, com vinculação exata e prova de Authority. +Um registro terminal imutável e endereçado por conteúdo, ALLOW ou BLOCK, com vinculação exata, uma Authority reconhecida e referências opacas de evidência opcionais. Identificador: `seed.resolution_record` @@ -108,7 +108,7 @@ Predicado: `allow_only` ### `ASET-SEED-REQ-005` -UNKNOWN e BLOCK DEVEM proibir o efeito; ausência, invalidade, ambiguidade ou erro de verificação DEVEM resultar em UNKNOWN, nunca ALLOW. +UNKNOWN e BLOCK DEVEM proibir o efeito. Estado terminal válido ausente ou ambíguo, ou falha em estabelecer um registro terminal válido, DEVE resultar em UNKNOWN. Material inválido ou não autoritativo NÃO DEVE substituir um registro terminal válido e único. Modalidade: `MUST` @@ -128,17 +128,17 @@ Predicado: `local_authority` ### `ASET-SEED-REQ-007` -Toda prova de Authority delegada DEVE ser explícita, acíclica, exatamente vinculada e não expansiva. +Evidência de Authority ou material de delegação NÃO DEVE criar ou ampliar Authority por si só; a Authority de um registro terminal DEVE ser explicitamente reconhecida para a vinculação exata antes que o registro possa se tornar válido. Modalidade: `MUST` -Predicado: `proof_attenuating` +Predicado: `authority_recognition_boundary` `verification`: `ASET-VERIFY-DECLARATIVE-STATE-VALIDATION`, `ASET-VERIFY-PORTABLE-CASES`, `ASET-VERIFY-BOUNDED-MODEL`, `ASET-VERIFY-INVARIANT-COVERAGE`, `ASET-VERIFY-SEMANTIC-MUTATIONS` ### `ASET-SEED-REQ-008` -Evidence, resultados de verificação, saídas de AI, resultados de consenso e outcomes remotos NÃO DEVEM, por si só, criar ALLOW ou Authority local. +Evidence, resultados de verificação, saídas de IA, resultados de consenso, outcomes remotos e outras declarações externas NÃO DEVEM, por si só, alterar o estado canônico pertencente ao Seed nem criar ALLOW ou Authority local. Modalidade: `MUST` @@ -192,13 +192,13 @@ Predicado: `implementation_neutral` - `SEED-INV-002` — A permissão do efeito é verdadeira se, e somente se, o único registro terminal válido for ALLOW. - `SEED-INV-003` — UNKNOWN e BLOCK nunca permitem um efeito. - `SEED-INV-004` — Toda solicitação e registro terminal preservam um único digest exato de vinculação. -- `SEED-INV-005` — Todo registro terminal válido está enraizado em uma vinculação de Authority local. -- `SEED-INV-006` — Toda prova de Authority delegada é exatamente vinculada, acíclica e não expansiva. -- `SEED-INV-007` — Evidence e declarações externas são entradas não autoritativas. +- `SEED-INV-005` — Todo registro terminal válido usa uma Authority explicitamente reconhecida para a vinculação local exata. +- `SEED-INV-006` — Evidência de Authority é não autoritativa até que o reconhecimento de Authority com vinculação exata seja bem-sucedido; material de prova opaco não pode criar ou ampliar Authority por si só. +- `SEED-INV-007` — Declarações externas e Evidence ficam fora do estado canônico pertencente ao Seed, salvo quando aceitas por uma transição reconhecida do Seed. - `SEED-INV-008` — Existe no máximo um registro terminal válido para um resolution_id. -- `SEED-INV-009` — Material terminal conflitante ou inválido resulta em UNKNOWN e nunca ALLOW. +- `SEED-INV-009` — Registros terminais válidos conflitantes resultam em UNKNOWN. Material inválido ou não autoritativo não pode criar ALLOW, criar conflito nem substituir um registro terminal válido e único. - `SEED-INV-010` — Registros de resolução são append-only, imutáveis e endereçados por conteúdo. -- `SEED-INV-011` — Somente transições reconhecidas do Seed podem alterar o armazenamento canônico; um candidato inválido ou não reconhecido não é uma transição do Seed. +- `SEED-INV-011` — Somente transições de estado reconhecidas do Seed podem alterar o estado canônico pertencente ao Seed; observações do ambiente e operações de observador não alteram esse estado. - `SEED-INV-012` — A reconsideração usa um resolution_id novo vinculado por um compromisso imutável e endereçado por conteúdo a um ResolutionRecord terminal previamente reconhecido; a retenção do objeto predecessor não é obrigatória. ## Transições @@ -213,7 +213,7 @@ Predicado: `implementation_neutral` ### `SEED-TX-002` — `SUBMIT_RESOLUTION` - `payload_schema`: `seed/canonical/protocol/schemas/payload-submit-resolution.schema.json` -- `authority_rule`: The record Authority must be the local root Authority or be justified by a valid exact-binding Authority proof. +- `authority_rule`: The record Authority must be explicitly recognized for the exact request binding. Concrete signatures, delegation chains and proof construction are external validation mechanisms. - `binding_rule`: The record request_digest and binding_digest must exactly match the registered request. - `created_artifacts`: `ResolutionRecord` @@ -221,7 +221,7 @@ Predicado: `implementation_neutral` - `payload_schema`: `seed/canonical/protocol/schemas/operation.schema.json` - `authority_rule`: Evaluation creates no Authority and accepts no external statement as a resolution. -- `binding_rule`: Evaluation is performed for one registered resolution_id and fails closed on missing, invalid or conflicting terminal material. +- `binding_rule`: Evaluation observes one resolution_id without mutating Seed-owned state. It derives UNKNOWN when no unique valid terminal record is established; invalid or non-authoritative material cannot override a unique valid record. - `created_artifacts`: `ResolutionEvaluation` ## Limite da implementação @@ -229,4 +229,4 @@ Predicado: `implementation_neutral` - `normative_status`: `IMPLEMENTATION_NEUTRAL` - `implementation_precedence`: `NONE` - `conformance_protocol_ref`: `seed/canonical/conformance/implementation-conformance-protocol.json` -- `unspecified_by_seed`: `policy evaluation language`, `evidence acquisition`, `orchestration semantics`, `enforcement mechanism`, `storage engine`, `durability level`, `concurrency control`, `network topology`, `consensus protocol`, `cryptographic provider`, `key custody`, `federation topology`, `AI model`, `artifact retention`, `retention, pruning, archiving and compaction of superseded request/record material`, `terminal-commitment accumulator construction`, `accumulator membership/update witness retention` +- `unspecified_by_seed`: `policy evaluation language`, `evidence acquisition`, `orchestration semantics`, `enforcement mechanism`, `storage engine`, `durability level`, `concurrency control`, `network topology`, `consensus protocol`, `cryptographic provider`, `concrete Authority grant-chain construction and validation`, `key custody`, `federation topology`, `AI model`, `artifact retention`, `retention, pruning, archiving and compaction of superseded request/record material`, `terminal-commitment accumulator construction`, `accumulator membership/update witness retention` diff --git a/docs/generated/pt-BR/ASET_Seed_Resolution_0.3-alpha.1.md b/docs/generated/pt-BR/ASET_Seed_Resolution_0.3-alpha.1.md index d9bb411..1d6d520 100644 --- a/docs/generated/pt-BR/ASET_Seed_Resolution_0.3-alpha.1.md +++ b/docs/generated/pt-BR/ASET_Seed_Resolution_0.3-alpha.1.md @@ -4,7 +4,7 @@ **Status:** `MINIMAL_STRONG_CORE_ALPHA` -**SHA-256 do modelo canônico:** `sha256:5bbdfefe35a0adf83fd5e5dd86475a4f57ae92d4f9b9c06a7d530faf2e484396` +**SHA-256 do modelo canônico:** `sha256:54c46e46d4e6b5870353bb0ed229310f60583e9acd11798b655bdd837c8dba74` > Esta edição é derivada do cânone legível por máquina. @@ -40,21 +40,21 @@ Uma Authority explicitamente reconhecida por um Context para uma vinculação ex Identificador: `seed.local_authority` -### prova de Authority (`AuthorityProof`) +### reconhecimento de Authority (`AuthorityRecognition`) -Uma cadeia localmente enraizada, exatamente vinculada, acíclica e não expansiva de concessões explícitas de Authority. +Um resultado local de reconhecimento com vinculação exata que declara uma Authority autorizada para uma ResolutionBinding; cadeias de concessão, assinaturas e construção de prova concretas são externas ao Seed. -Identificador: `seed.authority_proof` +Identificador: `seed.authority_recognition` ### referência de evidência (`EvidenceReference`) -Uma entrada não autoritativa endereçada por conteúdo, citada como base de um registro terminal. +Uma referência opaca e endereçada por conteúdo a evidência ou material de prova não autoritativo. Ela não tem efeito normativo até que uma fronteira de admissão do Seed reconheça o fato que suporta. Identificador: `seed.evidence_reference` ### registro de resolução (`ResolutionRecord`) -Um registro terminal imutável e endereçado por conteúdo, ALLOW ou BLOCK, com vinculação exata e prova de Authority. +Um registro terminal imutável e endereçado por conteúdo, ALLOW ou BLOCK, com vinculação exata, uma Authority reconhecida e referências opacas de evidência opcionais. Identificador: `seed.resolution_record` @@ -108,7 +108,7 @@ Predicado: `allow_only` ### `ASET-SEED-REQ-005` -UNKNOWN e BLOCK DEVEM proibir o efeito; ausência, invalidade, ambiguidade ou erro de verificação DEVEM resultar em UNKNOWN, nunca ALLOW. +UNKNOWN e BLOCK DEVEM proibir o efeito. Estado terminal válido ausente ou ambíguo, ou falha em estabelecer um registro terminal válido, DEVE resultar em UNKNOWN. Material inválido ou não autoritativo NÃO DEVE substituir um registro terminal válido e único. Modalidade: `MUST` @@ -128,17 +128,17 @@ Predicado: `local_authority` ### `ASET-SEED-REQ-007` -Toda prova de Authority delegada DEVE ser explícita, acíclica, exatamente vinculada e não expansiva. +Evidência de Authority ou material de delegação NÃO DEVE criar ou ampliar Authority por si só; a Authority de um registro terminal DEVE ser explicitamente reconhecida para a vinculação exata antes que o registro possa se tornar válido. Modalidade: `MUST` -Predicado: `proof_attenuating` +Predicado: `authority_recognition_boundary` `verification`: `ASET-VERIFY-DECLARATIVE-STATE-VALIDATION`, `ASET-VERIFY-PORTABLE-CASES`, `ASET-VERIFY-BOUNDED-MODEL`, `ASET-VERIFY-INVARIANT-COVERAGE`, `ASET-VERIFY-SEMANTIC-MUTATIONS` ### `ASET-SEED-REQ-008` -Evidence, resultados de verificação, saídas de AI, resultados de consenso e outcomes remotos NÃO DEVEM, por si só, criar ALLOW ou Authority local. +Evidence, resultados de verificação, saídas de IA, resultados de consenso, outcomes remotos e outras declarações externas NÃO DEVEM, por si só, alterar o estado canônico pertencente ao Seed nem criar ALLOW ou Authority local. Modalidade: `MUST` @@ -192,13 +192,13 @@ Predicado: `implementation_neutral` - `SEED-INV-002` — A permissão do efeito é verdadeira se, e somente se, o único registro terminal válido for ALLOW. - `SEED-INV-003` — UNKNOWN e BLOCK nunca permitem um efeito. - `SEED-INV-004` — Toda solicitação e registro terminal preservam um único digest exato de vinculação. -- `SEED-INV-005` — Todo registro terminal válido está enraizado em uma vinculação de Authority local. -- `SEED-INV-006` — Toda prova de Authority delegada é exatamente vinculada, acíclica e não expansiva. -- `SEED-INV-007` — Evidence e declarações externas são entradas não autoritativas. +- `SEED-INV-005` — Todo registro terminal válido usa uma Authority explicitamente reconhecida para a vinculação local exata. +- `SEED-INV-006` — Evidência de Authority é não autoritativa até que o reconhecimento de Authority com vinculação exata seja bem-sucedido; material de prova opaco não pode criar ou ampliar Authority por si só. +- `SEED-INV-007` — Declarações externas e Evidence ficam fora do estado canônico pertencente ao Seed, salvo quando aceitas por uma transição reconhecida do Seed. - `SEED-INV-008` — Existe no máximo um registro terminal válido para um resolution_id. -- `SEED-INV-009` — Material terminal conflitante ou inválido resulta em UNKNOWN e nunca ALLOW. +- `SEED-INV-009` — Registros terminais válidos conflitantes resultam em UNKNOWN. Material inválido ou não autoritativo não pode criar ALLOW, criar conflito nem substituir um registro terminal válido e único. - `SEED-INV-010` — Registros de resolução são append-only, imutáveis e endereçados por conteúdo. -- `SEED-INV-011` — Somente transições reconhecidas do Seed podem alterar o armazenamento canônico; um candidato inválido ou não reconhecido não é uma transição do Seed. +- `SEED-INV-011` — Somente transições de estado reconhecidas do Seed podem alterar o estado canônico pertencente ao Seed; observações do ambiente e operações de observador não alteram esse estado. - `SEED-INV-012` — A reconsideração usa um resolution_id novo vinculado por um compromisso imutável e endereçado por conteúdo a um ResolutionRecord terminal previamente reconhecido; a retenção do objeto predecessor não é obrigatória. ## Transições @@ -213,7 +213,7 @@ Predicado: `implementation_neutral` ### `SEED-TX-002` — `SUBMIT_RESOLUTION` - `payload_schema`: `seed/canonical/protocol/schemas/payload-submit-resolution.schema.json` -- `authority_rule`: The record Authority must be the local root Authority or be justified by a valid exact-binding Authority proof. +- `authority_rule`: The record Authority must be explicitly recognized for the exact request binding. Concrete signatures, delegation chains and proof construction are external validation mechanisms. - `binding_rule`: The record request_digest and binding_digest must exactly match the registered request. - `created_artifacts`: `ResolutionRecord` @@ -221,7 +221,7 @@ Predicado: `implementation_neutral` - `payload_schema`: `seed/canonical/protocol/schemas/operation.schema.json` - `authority_rule`: Evaluation creates no Authority and accepts no external statement as a resolution. -- `binding_rule`: Evaluation is performed for one registered resolution_id and fails closed on missing, invalid or conflicting terminal material. +- `binding_rule`: Evaluation observes one resolution_id without mutating Seed-owned state. It derives UNKNOWN when no unique valid terminal record is established; invalid or non-authoritative material cannot override a unique valid record. - `created_artifacts`: `ResolutionEvaluation` ## Limite da implementação @@ -229,4 +229,4 @@ Predicado: `implementation_neutral` - `normative_status`: `IMPLEMENTATION_NEUTRAL` - `implementation_precedence`: `NONE` - `conformance_protocol_ref`: `seed/canonical/conformance/implementation-conformance-protocol.json` -- `unspecified_by_seed`: `policy evaluation language`, `evidence acquisition`, `orchestration semantics`, `enforcement mechanism`, `storage engine`, `durability level`, `concurrency control`, `network topology`, `consensus protocol`, `cryptographic provider`, `key custody`, `federation topology`, `AI model`, `artifact retention`, `retention, pruning, archiving and compaction of superseded request/record material`, `terminal-commitment accumulator construction`, `accumulator membership/update witness retention` +- `unspecified_by_seed`: `policy evaluation language`, `evidence acquisition`, `orchestration semantics`, `enforcement mechanism`, `storage engine`, `durability level`, `concurrency control`, `network topology`, `consensus protocol`, `cryptographic provider`, `concrete Authority grant-chain construction and validation`, `key custody`, `federation topology`, `AI model`, `artifact retention`, `retention, pruning, archiving and compaction of superseded request/record material`, `terminal-commitment accumulator construction`, `accumulator membership/update witness retention` diff --git a/docs/generated/ru/ASET_Seed_Next.md b/docs/generated/ru/ASET_Seed_Next.md index 85cbf6b..958cbcb 100644 --- a/docs/generated/ru/ASET_Seed_Next.md +++ b/docs/generated/ru/ASET_Seed_Next.md @@ -4,7 +4,7 @@ **Статус:** `MINIMAL_STRONG_CORE_ALPHA` -**SHA-256 канонической модели:** `sha256:5bbdfefe35a0adf83fd5e5dd86475a4f57ae92d4f9b9c06a7d530faf2e484396` +**SHA-256 канонической модели:** `sha256:54c46e46d4e6b5870353bb0ed229310f60583e9acd11798b655bdd837c8dba74` > Эта редакция выводится из машинного канона. @@ -40,21 +40,21 @@ Authority, явно признанная одним Context для одной т Идентификатор: `seed.local_authority` -### доказательство Authority (`AuthorityProof`) +### признание Authority (`AuthorityRecognition`) -Локально укоренённая, точно связанная, ациклическая и нерасширяющая цепочка явных разрешений Authority. +Локальный результат точного признания, устанавливающий полномочие одной Authority для одной ResolutionBinding; конкретные цепочки делегирования, подписи и построение доказательства находятся вне Seed. -Идентификатор: `seed.authority_proof` +Идентификатор: `seed.authority_recognition` ### ссылка на основание (`EvidenceReference`) -Контентно-адресуемый неавторитетный вход, указанный как основание терминальной записи. +Непрозрачная контентно-адресуемая ссылка на неавторитетное основание или доказательный материал. Она не имеет нормативного эффекта, пока граница допуска Seed не признает подтверждаемый ею факт. Идентификатор: `seed.evidence_reference` ### запись разрешения (`ResolutionRecord`) -Одна неизменяемая контентно-адресуемая терминальная запись ALLOW или BLOCK с точной связкой и доказательством Authority. +Одна неизменяемая контентно-адресуемая терминальная запись ALLOW или BLOCK с точной связкой, признанной Authority и необязательными непрозрачными ссылками на основания. Идентификатор: `seed.resolution_record` @@ -108,7 +108,7 @@ ResolutionBinding ДОЛЖЕН содержать точные context_id, state ### `ASET-SEED-REQ-005` -UNKNOWN и BLOCK ДОЛЖНЫ запрещать эффект; отсутствие, недействительность, неоднозначность или ошибка проверки ДОЛЖНЫ давать UNKNOWN, а не ALLOW. +UNKNOWN и BLOCK ДОЛЖНЫ запрещать эффект. Отсутствие или неоднозначность действительного терминального состояния либо невозможность установить действительную терминальную запись ДОЛЖНЫ давать UNKNOWN. Недействительный или неавторитетный материал НЕ ДОЛЖЕН переопределять уже установленную единственную действительную терминальную запись. Модальность: `MUST` @@ -128,17 +128,17 @@ UNKNOWN и BLOCK ДОЛЖНЫ запрещать эффект; отсутств ### `ASET-SEED-REQ-007` -Каждое делегированное доказательство Authority ДОЛЖНО быть явным, ациклическим, точно связанным и нерасширяющим. +Доказательный или делегационный материал Authority НЕ ДОЛЖЕН сам по себе создавать или расширять полномочие; Authority терминальной записи ДОЛЖНА быть явно признана для точной связки до того, как запись может стать действительной. Модальность: `MUST` -Предикат: `proof_attenuating` +Предикат: `authority_recognition_boundary` `verification`: `ASET-VERIFY-DECLARATIVE-STATE-VALIDATION`, `ASET-VERIFY-PORTABLE-CASES`, `ASET-VERIFY-BOUNDED-MODEL`, `ASET-VERIFY-INVARIANT-COVERAGE`, `ASET-VERIFY-SEMANTIC-MUTATIONS` ### `ASET-SEED-REQ-008` -Evidence, результаты проверки, выходы AI, результаты консенсуса и удалённые outcomes НЕ ДОЛЖНЫ сами по себе создавать ALLOW или локальную Authority. +Evidence, результаты проверки, выводы ИИ, результаты консенсуса, удалённые outcomes и иные внешние утверждения НЕ ДОЛЖНЫ сами по себе изменять принадлежащее Seed каноническое состояние либо создавать ALLOW или локальную Authority. Модальность: `MUST` @@ -192,13 +192,13 @@ Evidence, результаты проверки, выходы AI, результ - `SEED-INV-002` — Разрешение эффекта истинно тогда и только тогда, когда единственная действительная терминальная запись равна ALLOW. - `SEED-INV-003` — UNKNOWN и BLOCK никогда не разрешают эффект. - `SEED-INV-004` — Каждый запрос и терминальная запись сохраняют один точный digest связки. -- `SEED-INV-005` — Каждая действительная терминальная запись укоренена в локальной связке Authority. -- `SEED-INV-006` — Каждое делегированное доказательство Authority точно связано, ациклично и не расширяет полномочие. -- `SEED-INV-007` — Evidence и внешние утверждения являются неавторитетными входами. +- `SEED-INV-005` — Каждая действительная терминальная запись использует Authority, явно признанную для точной локальной связки. +- `SEED-INV-006` — Доказательный материал Authority неавторитетен до успешного точного признания Authority; непрозрачный proof material не может сам по себе создать или расширить полномочие. +- `SEED-INV-007` — Внешние утверждения и Evidence находятся вне принадлежащего Seed канонического состояния, пока не приняты признанным переходом Seed. - `SEED-INV-008` — Для одного resolution_id существует не более одной действительной терминальной записи. -- `SEED-INV-009` — Конфликтующий или недействительный терминальный материал даёт UNKNOWN и никогда не ALLOW. +- `SEED-INV-009` — Конфликтующие действительные терминальные записи дают UNKNOWN. Недействительный или неавторитетный материал не может создать ALLOW, создать конфликт или переопределить единственную действительную терминальную запись. - `SEED-INV-010` — Записи разрешения являются append-only, неизменяемыми и контентно-адресуемыми. -- `SEED-INV-011` — Только признанные переходы Seed могут изменять каноническое хранилище; недействительный или непризнанный кандидат не является переходом Seed. +- `SEED-INV-011` — Только признанные переходы состояния Seed могут изменять принадлежащее Seed каноническое состояние; наблюдения среды и observer-операции его не изменяют. - `SEED-INV-012` — Пересмотр использует свежий resolution_id, связанный неизменяемым контентно-адресуемым коммитментом с ранее признанной терминальной ResolutionRecord; хранение объекта-предшественника не требуется. ## Переходы @@ -213,7 +213,7 @@ Evidence, результаты проверки, выходы AI, результ ### `SEED-TX-002` — `SUBMIT_RESOLUTION` - `payload_schema`: `seed/canonical/protocol/schemas/payload-submit-resolution.schema.json` -- `authority_rule`: The record Authority must be the local root Authority or be justified by a valid exact-binding Authority proof. +- `authority_rule`: The record Authority must be explicitly recognized for the exact request binding. Concrete signatures, delegation chains and proof construction are external validation mechanisms. - `binding_rule`: The record request_digest and binding_digest must exactly match the registered request. - `created_artifacts`: `ResolutionRecord` @@ -221,7 +221,7 @@ Evidence, результаты проверки, выходы AI, результ - `payload_schema`: `seed/canonical/protocol/schemas/operation.schema.json` - `authority_rule`: Evaluation creates no Authority and accepts no external statement as a resolution. -- `binding_rule`: Evaluation is performed for one registered resolution_id and fails closed on missing, invalid or conflicting terminal material. +- `binding_rule`: Evaluation observes one resolution_id without mutating Seed-owned state. It derives UNKNOWN when no unique valid terminal record is established; invalid or non-authoritative material cannot override a unique valid record. - `created_artifacts`: `ResolutionEvaluation` ## Граница реализации @@ -229,4 +229,4 @@ Evidence, результаты проверки, выходы AI, результ - `normative_status`: `IMPLEMENTATION_NEUTRAL` - `implementation_precedence`: `NONE` - `conformance_protocol_ref`: `seed/canonical/conformance/implementation-conformance-protocol.json` -- `unspecified_by_seed`: `policy evaluation language`, `evidence acquisition`, `orchestration semantics`, `enforcement mechanism`, `storage engine`, `durability level`, `concurrency control`, `network topology`, `consensus protocol`, `cryptographic provider`, `key custody`, `federation topology`, `AI model`, `artifact retention`, `retention, pruning, archiving and compaction of superseded request/record material`, `terminal-commitment accumulator construction`, `accumulator membership/update witness retention` +- `unspecified_by_seed`: `policy evaluation language`, `evidence acquisition`, `orchestration semantics`, `enforcement mechanism`, `storage engine`, `durability level`, `concurrency control`, `network topology`, `consensus protocol`, `cryptographic provider`, `concrete Authority grant-chain construction and validation`, `key custody`, `federation topology`, `AI model`, `artifact retention`, `retention, pruning, archiving and compaction of superseded request/record material`, `terminal-commitment accumulator construction`, `accumulator membership/update witness retention` diff --git a/docs/generated/ru/ASET_Seed_Resolution_0.3-alpha.1.md b/docs/generated/ru/ASET_Seed_Resolution_0.3-alpha.1.md index 85cbf6b..958cbcb 100644 --- a/docs/generated/ru/ASET_Seed_Resolution_0.3-alpha.1.md +++ b/docs/generated/ru/ASET_Seed_Resolution_0.3-alpha.1.md @@ -4,7 +4,7 @@ **Статус:** `MINIMAL_STRONG_CORE_ALPHA` -**SHA-256 канонической модели:** `sha256:5bbdfefe35a0adf83fd5e5dd86475a4f57ae92d4f9b9c06a7d530faf2e484396` +**SHA-256 канонической модели:** `sha256:54c46e46d4e6b5870353bb0ed229310f60583e9acd11798b655bdd837c8dba74` > Эта редакция выводится из машинного канона. @@ -40,21 +40,21 @@ Authority, явно признанная одним Context для одной т Идентификатор: `seed.local_authority` -### доказательство Authority (`AuthorityProof`) +### признание Authority (`AuthorityRecognition`) -Локально укоренённая, точно связанная, ациклическая и нерасширяющая цепочка явных разрешений Authority. +Локальный результат точного признания, устанавливающий полномочие одной Authority для одной ResolutionBinding; конкретные цепочки делегирования, подписи и построение доказательства находятся вне Seed. -Идентификатор: `seed.authority_proof` +Идентификатор: `seed.authority_recognition` ### ссылка на основание (`EvidenceReference`) -Контентно-адресуемый неавторитетный вход, указанный как основание терминальной записи. +Непрозрачная контентно-адресуемая ссылка на неавторитетное основание или доказательный материал. Она не имеет нормативного эффекта, пока граница допуска Seed не признает подтверждаемый ею факт. Идентификатор: `seed.evidence_reference` ### запись разрешения (`ResolutionRecord`) -Одна неизменяемая контентно-адресуемая терминальная запись ALLOW или BLOCK с точной связкой и доказательством Authority. +Одна неизменяемая контентно-адресуемая терминальная запись ALLOW или BLOCK с точной связкой, признанной Authority и необязательными непрозрачными ссылками на основания. Идентификатор: `seed.resolution_record` @@ -108,7 +108,7 @@ ResolutionBinding ДОЛЖЕН содержать точные context_id, state ### `ASET-SEED-REQ-005` -UNKNOWN и BLOCK ДОЛЖНЫ запрещать эффект; отсутствие, недействительность, неоднозначность или ошибка проверки ДОЛЖНЫ давать UNKNOWN, а не ALLOW. +UNKNOWN и BLOCK ДОЛЖНЫ запрещать эффект. Отсутствие или неоднозначность действительного терминального состояния либо невозможность установить действительную терминальную запись ДОЛЖНЫ давать UNKNOWN. Недействительный или неавторитетный материал НЕ ДОЛЖЕН переопределять уже установленную единственную действительную терминальную запись. Модальность: `MUST` @@ -128,17 +128,17 @@ UNKNOWN и BLOCK ДОЛЖНЫ запрещать эффект; отсутств ### `ASET-SEED-REQ-007` -Каждое делегированное доказательство Authority ДОЛЖНО быть явным, ациклическим, точно связанным и нерасширяющим. +Доказательный или делегационный материал Authority НЕ ДОЛЖЕН сам по себе создавать или расширять полномочие; Authority терминальной записи ДОЛЖНА быть явно признана для точной связки до того, как запись может стать действительной. Модальность: `MUST` -Предикат: `proof_attenuating` +Предикат: `authority_recognition_boundary` `verification`: `ASET-VERIFY-DECLARATIVE-STATE-VALIDATION`, `ASET-VERIFY-PORTABLE-CASES`, `ASET-VERIFY-BOUNDED-MODEL`, `ASET-VERIFY-INVARIANT-COVERAGE`, `ASET-VERIFY-SEMANTIC-MUTATIONS` ### `ASET-SEED-REQ-008` -Evidence, результаты проверки, выходы AI, результаты консенсуса и удалённые outcomes НЕ ДОЛЖНЫ сами по себе создавать ALLOW или локальную Authority. +Evidence, результаты проверки, выводы ИИ, результаты консенсуса, удалённые outcomes и иные внешние утверждения НЕ ДОЛЖНЫ сами по себе изменять принадлежащее Seed каноническое состояние либо создавать ALLOW или локальную Authority. Модальность: `MUST` @@ -192,13 +192,13 @@ Evidence, результаты проверки, выходы AI, результ - `SEED-INV-002` — Разрешение эффекта истинно тогда и только тогда, когда единственная действительная терминальная запись равна ALLOW. - `SEED-INV-003` — UNKNOWN и BLOCK никогда не разрешают эффект. - `SEED-INV-004` — Каждый запрос и терминальная запись сохраняют один точный digest связки. -- `SEED-INV-005` — Каждая действительная терминальная запись укоренена в локальной связке Authority. -- `SEED-INV-006` — Каждое делегированное доказательство Authority точно связано, ациклично и не расширяет полномочие. -- `SEED-INV-007` — Evidence и внешние утверждения являются неавторитетными входами. +- `SEED-INV-005` — Каждая действительная терминальная запись использует Authority, явно признанную для точной локальной связки. +- `SEED-INV-006` — Доказательный материал Authority неавторитетен до успешного точного признания Authority; непрозрачный proof material не может сам по себе создать или расширить полномочие. +- `SEED-INV-007` — Внешние утверждения и Evidence находятся вне принадлежащего Seed канонического состояния, пока не приняты признанным переходом Seed. - `SEED-INV-008` — Для одного resolution_id существует не более одной действительной терминальной записи. -- `SEED-INV-009` — Конфликтующий или недействительный терминальный материал даёт UNKNOWN и никогда не ALLOW. +- `SEED-INV-009` — Конфликтующие действительные терминальные записи дают UNKNOWN. Недействительный или неавторитетный материал не может создать ALLOW, создать конфликт или переопределить единственную действительную терминальную запись. - `SEED-INV-010` — Записи разрешения являются append-only, неизменяемыми и контентно-адресуемыми. -- `SEED-INV-011` — Только признанные переходы Seed могут изменять каноническое хранилище; недействительный или непризнанный кандидат не является переходом Seed. +- `SEED-INV-011` — Только признанные переходы состояния Seed могут изменять принадлежащее Seed каноническое состояние; наблюдения среды и observer-операции его не изменяют. - `SEED-INV-012` — Пересмотр использует свежий resolution_id, связанный неизменяемым контентно-адресуемым коммитментом с ранее признанной терминальной ResolutionRecord; хранение объекта-предшественника не требуется. ## Переходы @@ -213,7 +213,7 @@ Evidence, результаты проверки, выходы AI, результ ### `SEED-TX-002` — `SUBMIT_RESOLUTION` - `payload_schema`: `seed/canonical/protocol/schemas/payload-submit-resolution.schema.json` -- `authority_rule`: The record Authority must be the local root Authority or be justified by a valid exact-binding Authority proof. +- `authority_rule`: The record Authority must be explicitly recognized for the exact request binding. Concrete signatures, delegation chains and proof construction are external validation mechanisms. - `binding_rule`: The record request_digest and binding_digest must exactly match the registered request. - `created_artifacts`: `ResolutionRecord` @@ -221,7 +221,7 @@ Evidence, результаты проверки, выходы AI, результ - `payload_schema`: `seed/canonical/protocol/schemas/operation.schema.json` - `authority_rule`: Evaluation creates no Authority and accepts no external statement as a resolution. -- `binding_rule`: Evaluation is performed for one registered resolution_id and fails closed on missing, invalid or conflicting terminal material. +- `binding_rule`: Evaluation observes one resolution_id without mutating Seed-owned state. It derives UNKNOWN when no unique valid terminal record is established; invalid or non-authoritative material cannot override a unique valid record. - `created_artifacts`: `ResolutionEvaluation` ## Граница реализации @@ -229,4 +229,4 @@ Evidence, результаты проверки, выходы AI, результ - `normative_status`: `IMPLEMENTATION_NEUTRAL` - `implementation_precedence`: `NONE` - `conformance_protocol_ref`: `seed/canonical/conformance/implementation-conformance-protocol.json` -- `unspecified_by_seed`: `policy evaluation language`, `evidence acquisition`, `orchestration semantics`, `enforcement mechanism`, `storage engine`, `durability level`, `concurrency control`, `network topology`, `consensus protocol`, `cryptographic provider`, `key custody`, `federation topology`, `AI model`, `artifact retention`, `retention, pruning, archiving and compaction of superseded request/record material`, `terminal-commitment accumulator construction`, `accumulator membership/update witness retention` +- `unspecified_by_seed`: `policy evaluation language`, `evidence acquisition`, `orchestration semantics`, `enforcement mechanism`, `storage engine`, `durability level`, `concurrency control`, `network topology`, `consensus protocol`, `cryptographic provider`, `concrete Authority grant-chain construction and validation`, `key custody`, `federation topology`, `AI model`, `artifact retention`, `retention, pruning, archiving and compaction of superseded request/record material`, `terminal-commitment accumulator construction`, `accumulator membership/update witness retention` diff --git a/docs/repository/CI_ASSURANCE.md b/docs/repository/CI_ASSURANCE.md index ace6f86..c7a856c 100644 --- a/docs/repository/CI_ASSURANCE.md +++ b/docs/repository/CI_ASSURANCE.md @@ -11,7 +11,7 @@ aggregate command. - deterministic generated views; - language policy; - machine-canon and canon-package validity; -- bounded model output; +- finite-state saturation output; - assurance, proof traceability and canon-to-TLA refinement integrity; - specification tests; - critical Ruff rules; @@ -24,7 +24,7 @@ normative change. `.github/workflows/production-assurance.yml` independently executes: -- the bounded Python state-space model; +- the Python finite-state model to saturation; - the checked formal-property registry; - TLC over the committed TLA+ model; - TLAPS over the committed safety proof module; @@ -77,16 +77,16 @@ An implementation adapter cannot issue its own PASS verdict. The formal contour establishes: -- bounded model assurance for the committed finite configuration; +- exhaustive reachable-state assurance for the committed finite Python configuration, with saturation asserted; - unbounded deductive safety for the committed abstract TLA+ projection; -- byte-for-byte parity of the deterministic canonical projection generated from the exact machine-readable Seed identity; -- TLAPS-proved behavioral equivalence between that declared projection and `SeedResolution.tla`. +- byte-for-byte parity of a standalone deterministic canonical projection generated from the exact machine-readable Seed identity; +- TLAPS-proved behavioral equivalence between that standalone projection and `SeedResolution.tla`. The canon-to-TLA theorem is scoped to the declared abstraction profile. It does not establish: - equivalence of every natural-language sentence; - concrete Binding/digest construction; -- concrete Authority grant-chain construction; +- concrete Authority-recognition evidence, signature or delegation-chain construction; - implementation refinement or production readiness; - liveness; - cryptographic primitive security; diff --git a/seed/canonical/CANON_PACKAGE.json b/seed/canonical/CANON_PACKAGE.json index b1a2306..54cb356 100644 --- a/seed/canonical/CANON_PACKAGE.json +++ b/seed/canonical/CANON_PACKAGE.json @@ -1,20 +1,20 @@ { "canon_id": "ASET-SEED-RESOLUTION-CANON-0.3-ALPHA1", "canon_version": "0.3.0-alpha.1", - "conformance_protocol": "ASET-SEED-RESOLUTION-CONFORMANCE-V2", + "conformance_protocol": "ASET-SEED-RESOLUTION-CONFORMANCE-V3", "document_type": "aset-canon-package", "files": [ { "path": "seed/canonical/source/seed-model.json", - "sha256": "sha256:b5e68692317600fd2833474a1f9c31f09e44d37ae92ec14573b416076c5dd7f6" + "sha256": "sha256:c43ca7b642a11c3ab140884a6bbff34bbd741f5cb905e6a779c860c813998fcf" }, { "path": "seed/canonical/schemas/seed-model.schema.json", - "sha256": "sha256:09e679bc379fdab2ff78c09ad6f71b3969ca654bbb53f5f1d432e10a79921fa1" + "sha256": "sha256:1f1a727764b5d0138951f76fac1ab1155f4ba67c92f21aa8a21f7ef105bf9f94" }, { "path": "seed/canonical/protocol/protocol-profile.json", - "sha256": "sha256:cb699538f0f6fa10d5958b6f059a2891fdd89cb7fdef56e458f10cd4968b955f" + "sha256": "sha256:b0f147bad148bf4f2369b157c79c1ac96b87da3d4727bdec46427732960c84b1" }, { "path": "seed/canonical/protocol/digest-profile.json", @@ -22,39 +22,39 @@ }, { "path": "seed/canonical/schemas/protocol-profile.schema.json", - "sha256": "sha256:b8a85e60203997172f05b64ed73bcac46121fbc9aee7b2762f77a8f3f8cbf1f2" + "sha256": "sha256:6a4f07a2e94a5b72c1136e92a7385ad3b4e3c70aa473b9ec9788d02b905ae4d1" }, { "path": "seed/canonical/conformance/conformance-profile.json", - "sha256": "sha256:ecdfee84abc59767bb32b15639ec9503896c4cbda16c8f00ff2f5e4cea10963c" + "sha256": "sha256:aabbf317e0c51a1a1f1021dfbd0b2981c3dcf1142b89eb6a1bbfb1c7e1e9dcd6" }, { "path": "seed/canonical/schemas/conformance-profile.schema.json", - "sha256": "sha256:3d4eab2037567b55a8903d55a71f97bd98851d2282766332a86460f2c83d5bb7" + "sha256": "sha256:01d5156f63f850946fbb7c8ed31bb9b3e1b4f21d01b200271da9ad3a13f5a0e8" }, { "path": "seed/canonical/conformance/implementation-conformance-protocol.json", - "sha256": "sha256:79e949885857af3797a84432b12902ee55f24b296a66325a94a7131254ad31f4" + "sha256": "sha256:b34572ee7a8394ef173d3ae45519c39dc24f77602b956ecf583772ca1aa64040" }, { "path": "seed/canonical/schemas/implementation-conformance-protocol.schema.json", - "sha256": "sha256:939ee1ac9a8921ceb0f735fbb79cc6925269cfbed5c16232809b385e19f3922a" + "sha256": "sha256:40295089c6bb1e8a0f5b7181bd4cfda4526be61095a822c9014a2a7ebac69de8" }, { "path": "seed/canonical/schemas/implementation-conformance-envelope.schema.json", - "sha256": "sha256:e7d0b4674a6db735c485822c6a541eccc265f8f07cb6d12425f32f5aef4ba6d6" + "sha256": "sha256:491b9aa4458a11f57424a5eb92f0f7f61d776c8de00a333e47985ff956701e9d" }, { "path": "seed/canonical/conformance/model-based-conformance.json", - "sha256": "sha256:6e833d150f4f8dc1fbac5f0c69fae6a68fc785182a0974875e4f273793cd7065" + "sha256": "sha256:db4b3f9e76aff7e8ef3a87f02ae748bb4f718428370306454eb94b9dcc6212b4" }, { "path": "seed/canonical/assurance/verification-registry.json", - "sha256": "sha256:a3306079e7c38496063c5e46ec6a464bdf744d1271568963291cb71c08991b19" + "sha256": "sha256:b4bb28e5a8965e984013ad7408522749cfef3008c913a518f455fefda7136187" }, { "path": "seed/canonical/assurance/invariant-coverage.json", - "sha256": "sha256:da7a577b4f160ba5ac436808711f101dd2d9c66509ff1f7772dedc05174b9163" + "sha256": "sha256:2d89e21d092bf4d340e271dc3bcba2d7df618c4c4b41e67beb626f518cdb163b" }, { "path": "seed/canonical/schemas/invariant-coverage.schema.json", @@ -62,23 +62,23 @@ }, { "path": "seed/canonical/assurance/proof-traceability.json", - "sha256": "sha256:3c49b80547bf7a148688d49aeaa61a5e2074e14161b5597967613a07b0925609" + "sha256": "sha256:043bb3b1717d0c41123d326dc9b1d8dcae1cdde78c7ebf2d2ae26e79d2248eaf" }, { "path": "seed/canonical/schemas/proof-traceability.schema.json", - "sha256": "sha256:7139c370d2cf0709a8c2dfcf891ffc2aecc374d6558f6124aa4bc639795de53f" + "sha256": "sha256:855790c3357025cae6110b813c13b66edc9685433b41873c20c6b9d41fb82517" }, { "path": "seed/canonical/assurance/canon-tla-refinement.json", - "sha256": "sha256:d29c941ee0dca9fc725c2dcaec0b6a78d661cbe6630726418fc370c79d73ee38" + "sha256": "sha256:2095b62595d056c8a5a3b0700239a0211417979e4d5f2b4a535df0827017371b" }, { "path": "seed/canonical/schemas/canon-tla-refinement.schema.json", - "sha256": "sha256:aaba0b7c0cc6a27158318702c87e5396ae2a0951852fcb21094b60d2d1dfccb6" + "sha256": "sha256:17b142a998bbc8dd7b82b61c54d75e0c0e735211f35f90312565b78a4e7758e5" }, { "path": "seed/canonical/assurance/limitations.json", - "sha256": "sha256:2b6bbf827dcb12b9674154efebcb6134366c614769b5874a5f4db0cbb81cb25f" + "sha256": "sha256:c9379206486a61592398485658cb434174e0a1cbdbb6a37c2792d1d312f35c3b" }, { "path": "seed/canonical/schemas/assurance-limitations.schema.json", @@ -86,7 +86,7 @@ }, { "path": "seed/canonical/assurance/repository-release-gates.json", - "sha256": "sha256:9b945c1665038e8e4a642ffa6b9510d5ab8aaeeb45b5403bf578fb230e666c77" + "sha256": "sha256:96c3b5f009b64eedc0348109f6545b92b8a0c67b1a9087765868afaff7be11dd" }, { "path": "seed/canonical/schemas/repository-release-gates.schema.json", @@ -98,23 +98,23 @@ }, { "path": "seed/canonical/formal/SeedResolution.tla", - "sha256": "sha256:8cdbd66db0b4a5fabb38fb1a7739c2a2e3e418ab9bede02d5e49382d4442dd9f" + "sha256": "sha256:1c53b058d738e074c2a9de96fe27d8d7dd384d3ffa52f3bb95f7732908d66276" }, { "path": "seed/canonical/formal/SeedResolutionProofs.tla", - "sha256": "sha256:32c9f90bebcb1503f13b41535847ed5b4c16b066143fcf02578b63f627cf3805" + "sha256": "sha256:bcb4652249d66cbcb16f7c5a4538ad3bc2c31ef7d37b49fd27328eff6a6725f9" }, { "path": "seed/canonical/formal/SeedCanonProjection.tla", - "sha256": "sha256:26d6508c8c091fc9d204331be627a3a6cdb15600a1eddf4e755d67240da4efd5" + "sha256": "sha256:b7265eb707795b592c678842f764a5bfa7ce303bdc66f55f858366e20d64eb4e" }, { "path": "seed/canonical/formal/SeedCanonRefinementProofs.tla", - "sha256": "sha256:2445164299b87a1e819edc5df585cb84d18b8b6817e2b14a5158c79e3dca44d2" + "sha256": "sha256:46ef7336b86d066ee531eb2c43873d9b6e1622dd48632b9af08ea6f412cf6338" }, { "path": "seed/canonical/formal/SeedResolution.cfg", - "sha256": "sha256:c5549986cb036f550e0c030a13944e8fb00372c28ccecacc88d84ede2a34d588" + "sha256": "sha256:b4ee7fb775fbf8909fded4e7b2086b8022e1412e648e21f470c464a625f690c0" }, { "path": "seed/canonical/migration/ALPHA2_TO_0.3_ALPHA1_CHANGE_DECLARATION.json", @@ -126,12 +126,28 @@ }, { "path": "seed/canonical/decisions/ADR-006-complete-invariant-closure.md", - "sha256": "sha256:e7f91577c81b6659bb6129e31ffe6b37a78bd05ca53c985511df4c9faaec1128" + "sha256": "sha256:0545be007291eb0e2be22fce7af30a528919afe2bf57e5ccb5502f4e958692d2" }, { "path": "seed/canonical/decisions/ADR-007-reconsideration-commitments-and-bounded-retention.md", "sha256": "sha256:ed0fd693b305cbf93dae3533a348de837e4462bb57e204134a49d2b2c19bb457" }, + { + "path": "seed/canonical/decisions/ADR-008-normalize-seed-state-by-construction.md", + "sha256": "sha256:b219bd91da708861847f017c35328d47fee298c2313326b326d75660b733ae63" + }, + { + "path": "seed/canonical/decisions/ADR-009-seed-state-environment-observer-and-authority-boundary.md", + "sha256": "sha256:fdb642c8f306d2136345e19c3650c22805f63139ac93d8f81f6773aa249881a0" + }, + { + "path": "seed/canonical/migration/CANON_CHANGE_DECLARATION.json", + "sha256": "sha256:4eb176ddb006c0957a2bf1d79685fd86b263b89500cc53df919193ec91459bf8" + }, + { + "path": "seed/canonical/migration/WIRE_V2_TO_V3.md", + "sha256": "sha256:b01a89274299c4a21f876dc811fdf61b87f00c8be1735cef37b9adad7e5cc4c3" + }, { "path": "seed/canonical/protocol/schemas/common.schema.json", "sha256": "sha256:abe887fb3d039c3bddcbd8f9227d23b2a3593cde09158ee16bb4a170cc1d5351" @@ -142,11 +158,7 @@ }, { "path": "seed/canonical/protocol/schemas/resolution-authority-binding.schema.json", - "sha256": "sha256:803f1747968009dd4f4a6d35406439ec52036686bb0eecd57be56a606dc9e022" - }, - { - "path": "seed/canonical/protocol/schemas/authority-grant.schema.json", - "sha256": "sha256:1acedba9b138bbf18969bccdc77cdc891e768338f90a6a527adf75fa49f7204f" + "sha256": "sha256:7d5858951bc412ea095cf36867304293c521ee03bc1682ce9683782004d1c94d" }, { "path": "seed/canonical/protocol/schemas/resolution-request.schema.json", @@ -154,11 +166,11 @@ }, { "path": "seed/canonical/protocol/schemas/resolution-record.schema.json", - "sha256": "sha256:0f37ae49b8365f89efdd96ba3bcc8adb827ecaf973b8ddbaf40169fb7ee6f6ca" + "sha256": "sha256:a5f49bd2dcfd0aff0bc6413a0b32e7f6996250fd06d8bc2ab53ff98eb22a9450" }, { "path": "seed/canonical/protocol/schemas/resolution-store.schema.json", - "sha256": "sha256:bebd92802b3e6bb6264c08599bdff34bcc40e26e76d0163470953ea0e1d1e5da" + "sha256": "sha256:24a175ef5345c0f9fb0b555a7eeec08c20e557937e7aa51682dd4dcc50acc449" }, { "path": "seed/canonical/protocol/schemas/resolution-evaluation.schema.json", @@ -182,103 +194,107 @@ }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-001.json", - "sha256": "sha256:3352af05c6a51a02aef9c94639fe43903c22969f3d9a8e2836f23fce065507a7" + "sha256": "sha256:e5688046d1ccc8cafffb0520aa044a2f37f1ca3a4df7325052661213d6ba15fc" }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-002.json", - "sha256": "sha256:ee69ab8301eea93cf52ab45114e56922f620e8aad8d4f621bbc98b6cf040cfa9" + "sha256": "sha256:ca9b2b633ae32bffefdd3d8939e9614917e8cd04cafb7813c547f641122949ce" }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-003.json", - "sha256": "sha256:4318727895ac37e61933c6686e785351211acdda10dd9c6f19f6c69f37820eac" + "sha256": "sha256:0a71111771482553160e98363d6f8773c965697cd9325673ed82ba64cc8c85f7" }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-004.json", - "sha256": "sha256:22b06e4c5bfac480dfddbba7a52370b7fdf104da371fe65dc3e8a928fed9b02c" + "sha256": "sha256:e30ce83892f1c90f546e7410596a8f35936622f999efebb172b83d08f8fe181c" }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-005.json", - "sha256": "sha256:15e6d3059b4d769eabb5a166d350509b23ec359856eb4c0bae2c9f975377af07" + "sha256": "sha256:52a9c7253bfb886dcc2b091b643fa36a75f3d96ae01e89d5c6621c8552de9d9a" }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-006.json", - "sha256": "sha256:4fcce1e7ebf701e5e994606320cb86a0129193154a33ee63792ee669419fbfec" + "sha256": "sha256:03d11760f4abe91ed1913933600097f52babf57a76984a6ff5d75b4f0ff386ce" }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-007.json", - "sha256": "sha256:e95d67c12b028b328c538fb83cf00a01946734acc5048fd1035f3c2eeb9f8ff2" + "sha256": "sha256:24774174dc294a03106711abeb39c0ef4f776ecca89b8b41d0e6dff21c42b2ab" }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-008.json", - "sha256": "sha256:783d86ab36bbcb1bdbad0d16c0481ea448d46c67b3501e1a76abfc828e7dde2f" + "sha256": "sha256:fcbdef8907d41df526a388217a234c6e966adbce259924bf60027a14aaa418cb" }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-009.json", - "sha256": "sha256:2ff892ee2e91c8d5c117a0990157f326d602876cda637f9a34eda454fee41b9f" + "sha256": "sha256:b7342e2b2ebd187ddaf0b02ff925f27f4f00d42eb079667620e745bf8e3e74a5" }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-010.json", - "sha256": "sha256:184aaf7b609ab4ab6947b2b1df68bde7facacd7b0b5452973a73f7e998d3f8a2" + "sha256": "sha256:0d0dc5feddea9bf480b0f1ab5c4a43ef61967f53ed615ffa3cb8b1720b1e79e9" }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-011.json", - "sha256": "sha256:675d861e51f13df1c5ec10ad6ddc4909c827f7e893fb3485471023130175f123" + "sha256": "sha256:94d472765378007e09ccf295a46ad1d244e2d34accd17bd2b8d33eb8d9c223e4" }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-012.json", - "sha256": "sha256:9c16ba5f4d95d959f1f4419fb2b646202204448fde49ac2669e0a5839c7a10a8" + "sha256": "sha256:be05dfafb0ff2c0dda6eb91f01425d57a4940c1c5716dd8089512337a93ec4fb" }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-013.json", - "sha256": "sha256:f36aa4d3809a20c9842eac49c7aed6b31a916a8c089d376e83b0c29023863604" + "sha256": "sha256:84e3849b6c1f9ebec704385974f065bbee233d48abfd5819521d97c2814910a0" }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-014.json", - "sha256": "sha256:822f9b125bdb8ebbd50288b7360108c9657791caca7638a3d25ee4d095b249ee" + "sha256": "sha256:3716a2847f9c31788d2d705629b036d53b8646404be135922e64f61de8fad5ea" }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-015.json", - "sha256": "sha256:49990c7ca0564af284139ad4ce276ecd33d7f3d05a4f3094449ea87e93825809" + "sha256": "sha256:fd697dbb671d55d99bab8cedc87d81bca1d312d3e542b8fd297f2f4583021ca7" }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-016.json", - "sha256": "sha256:90741b3701cd8e9ec043e978ba1f7bbb22b349ef04f425605f019bf599774311" + "sha256": "sha256:2834c82838393611694ceb7171cdbb406d39bfba60a0fa6d5cb01c1b02e4f0f5" }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-001.json", - "sha256": "sha256:60585b00221d867f21ea98fe198b4d35f2acdf56118de3ab7403a8a6c3c1b9c7" + "sha256": "sha256:661cd889e7b091ed6dc969c17dd5934a6104d1919a108b790c3ffdcf1cf5a322" }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-002.json", - "sha256": "sha256:06e6f20764094764047c1b68404b30b135505214003082d52c2896d4d82c2f5c" + "sha256": "sha256:916fc7a3bcc353612e1c4a09882e24f20e41e2a8ca3f8dfff2b3613a97b3f215" }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-003.json", - "sha256": "sha256:92f21b9d2efe2ecc2e3c11ec72f1969ebd78d48b91b39c1f2aa096c475766cfa" + "sha256": "sha256:c77ea28272320c3bd7a8e240b896ac4d21923b32ce5ccc0704f84797cfaa5665" }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-004.json", - "sha256": "sha256:a687f38d83674d2d3a92372be3048860463da19542ca74b2024d61d8361e9ffc" + "sha256": "sha256:dcf5f81b0e60f2aa0c157aab5297177d3f082544d64a54081d83e9d7d6093763" }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-005.json", - "sha256": "sha256:9459583800f64781bcda6e638200a6cb128a7a20aa8d177720966ac70e1d7308" + "sha256": "sha256:7e37edfaeb010ba65dfc197bf60a7bdcf883c41d686eb2ab5ea44de23ee6da0d" }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-006.json", - "sha256": "sha256:fded1536ea25f1c32d63907703bc9bccc46e3a74d5205a1ddf86991d2078c7f3" + "sha256": "sha256:e99a01c9d4acf1833697124bf4d75f3d077b80af49c3dc53c73a4d9a245c92fd" }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-007.json", - "sha256": "sha256:a309d632b1cd18b986cbe0a2442687fd111158eab72d689b0e266fb7d862d92a" + "sha256": "sha256:4f13d237a0868177d216a31635e8fec220b67cbda9c6fe2419a36aff289663c5" }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-008.json", - "sha256": "sha256:b227d0736e9344953a03afa436427bff54a52c6c58089375e16e154baf6fbcd9" + "sha256": "sha256:415e874abf0e1212b542546bfceea41681d9c30252ff7d955e1cfbb214964efb" + }, + { + "path": "seed/canonical/conformance/cases/positive/RES-POS-009.json", + "sha256": "sha256:b7fd5b2160abe684c05af1408468d94590a9bd45355b87cecb910799f9a852c8" } ], "implementation_precedence": "NONE", "normative_source": "seed/canonical/source/seed-model.json", - "package_digest": "sha256:ff77a6a022aae70c576613f31ab083778adc27bc7ff5af94363481d77f4161e1", + "package_digest": "sha256:392ff8e36eecb2bf6cfa9a6cbc76117025a4c7d8a170e8ddf562f1ea5df27d38", "schema_version": 2 } diff --git a/seed/canonical/README.md b/seed/canonical/README.md index b9471f0..cca6a99 100644 --- a/seed/canonical/README.md +++ b/seed/canonical/README.md @@ -1,65 +1,61 @@ -# ASET Seed 0.3 minimal strong core +# ASET Seed 0.3 minimal resolution core ASET Seed is a local resolution-recognition kernel. Resolution = UNKNOWN | ALLOW | BLOCK - EffectPermitted(binding) iff one unique valid exact-binding - terminal record is ALLOW + EffectPermitted(r) iff ResolutionOf(r) = ALLOW -`UNKNOWN` is derived when no unique valid terminal record exists. `BLOCK` is -an explicit terminal prohibition. Both are fail-closed. +A valid terminal `ALLOW` or `BLOCK` is immutable and exact-binding. `UNKNOWN` +is derived when no unique valid terminal record can be established or when +valid terminal material conflicts. Invalid or non-authoritative material cannot +create Authority, create `ALLOW`, create a valid conflict, or override an +otherwise unique valid terminal record. -Seed normatively defines exact binding, local Authority roots, attenuating -Authority proof, terminal uniqueness, immutable content-addressed records and -fresh reconsideration identifiers and recognized immutable predecessor commitments. +Seed normatively defines: -Policy evaluation, evidence acquisition, workflow, federation, persistence, -retention/compaction and concrete terminal-commitment accumulation are extension -or implementation concerns. Seed does not require predecessor requests or records -to remain physically retained after recognition evidence has been preserved. +- exact `ResolutionBinding`; +- fresh request identity and reconsideration commitment; +- exact-binding local Authority recognition as an admission boundary; +- immutable content-addressed terminal records; +- terminal uniqueness and fail-closed evaluation; +- implementation-neutral observable semantics. -## Assurance closure - -The published safety contract has complete machine traceability: - -- 12/12 canonical requirements covered; -- 12/12 canonical invariants covered; -- 3/3 transitions covered positively and negatively; -- 16 bounded TLA+/TLC properties; -- 16/16 registered TLA+/TLC safety properties covered by unbounded TLAPS proof; -- 4 exact executable-or-static properties; -- 24 portable conformance cases; -- 13 semantic mutations, all required to be killed. +Concrete policy evaluation, evidence acquisition, signatures, delegation-chain +construction, workflow, federation, persistence, retention/compaction, +cryptographic accumulators and enforcement are outside Seed. -The unbounded safety proof applies to the committed abstract TLA+ safety -projection. It establishes all eleven registered state invariants and all five -registered temporal safety properties for every behaviour of `Spec`. +## State boundary -The abstract formal projection is normalized to three state variables -(`requestMeta`, `terminalMeta`, `conflicts`). Authority relations are immutable -context constants; exact terminal binding is derived from request metadata; -invalid material and non-authoritative inputs have no retained state slot and -are proved to be semantic stutters. +The formal model deliberately distinguishes ownership: -The canon-to-TLA assurance adds a second proof layer. -`SeedCanonProjection.tla` is generated deterministically from the exact -`seed-model.json` identity under a versioned projection profile, and TLAPS -proves behavioral equivalence between that generated projection and -`SeedResolution.tla`. +- Seed-owned mutable state: `requestMeta`, `terminalMeta`; +- environment state: `conflicts`; +- pure observer: `EvaluateResolution(r)`. -That relation is explicitly scoped. It does not establish: +`Requests` and `TerminalRequests` are derived from partial-function domains. +Terminal binding is derived from immutable request metadata. Environment +conflict observation cannot mutate Seed-owned state. -- equivalence of every natural-language sentence; -- concrete Binding or digest construction; -- correctness or refinement of implementations; -- concrete Authority grant-chain construction; -- liveness; -- cryptographic primitive security; -- concrete terminal-commitment accumulator or witness correctness; -- external certification. - -The normative source remains -`seed/canonical/source/seed-model.json`. +## Assurance closure -Neither the TLA+ model, the proof module nor TLAPM receives normative, -semantic or implementation precedence. +The active assurance surface contains: + +- 12 canonical requirements and 12 canonical invariants; +- 3 canonical operations: two state transitions and one observer; +- 25 portable conformance cases; +- 13 semantic mutations; +- 14 TLA/TLC properties: 10 state invariants and 4 temporal properties; +- finite Python state exploration to saturation for the published fixture; +- independent TLC checking; +- unbounded TLAPS safety proof for the abstract TLA model; +- a standalone generated canonical TLA projection with TLAPS-proved behavioral + equivalence to `SeedResolution.tla`. + +The TLA proof boundary intentionally abstracts exact Binding construction, +Authority-recognition establishment and recognized terminal-commitment +establishment. External invalid/non-authoritative material processing is checked +at executable/conformance boundaries rather than represented as Seed state. + +The normative source remains `seed/canonical/source/seed-model.json`. Generated +projections, TLA modules and reference implementations have no normative +precedence. diff --git a/seed/canonical/assurance/canon-tla-refinement.json b/seed/canonical/assurance/canon-tla-refinement.json index a621d16..d5df439 100644 --- a/seed/canonical/assurance/canon-tla-refinement.json +++ b/seed/canonical/assurance/canon-tla-refinement.json @@ -5,24 +5,24 @@ "id": "OPAQUE_BINDING" }, { - "description": "authorityProofBindings abstracts exact grant-chain construction, acyclicity, attenuation and cryptographic verification.", - "id": "AUTHORITY_PROOF_ORACLE" + "description": "RequestAuthorityBindings and TerminalAuthorityBindings represent already-recognized exact-binding Authority facts. Concrete signatures, delegation chains, federation proof material and their validation are external to Seed.", + "id": "AUTHORITY_RECOGNITION_BOUNDARY" }, { - "description": "RecognizedTerminalCommitments abstracts validation that a previous_terminal_record_digest commits to a previously recognized terminal ResolutionRecord. Recognition may be backed by retained material or externally validated authenticated-set/accumulator proof material; predecessor object retention is not required.", + "description": "RecognizedTerminalCommitments abstracts validation that a previous_terminal_record_digest commits to a previously recognized terminal ResolutionRecord; predecessor object retention is not required.", "id": "TERMINAL_COMMITMENT_ORACLE" }, { - "description": "Conflict remains explicit because it changes derived resolution; invalid-material and non-authoritative-input observations are separate semantic stutters with no retained canonical state component.", - "id": "ENVIRONMENT_OBSERVATION" + "description": "Conflict is modeled separately from Seed-owned state because an independently established conflicting valid terminal record changes the derived resolution while not mutating accepted request or terminal state.", + "id": "ENVIRONMENT_CONFLICT_STATE" } ], - "claim_boundary": "The proof establishes behavioral equivalence between SeedResolution.tla and a deterministic TLA+ projection generated from the exact machine-readable Seed model under ASET-SEED-CANON-TLA-PROJECTION-V3. It is not a proof that every natural-language sentence, cryptographic construction, opaque binding representation, concrete Authority-proof implementation, terminal-commitment provenance mechanism, storage compaction, or implementation refinement is fully verified by the TLA+ model. The deterministic projection generator is part of the assurance trusted computing base; this proof does not itself verify the generator implementation.", + "claim_boundary": "The proof establishes behavioral equivalence between SeedResolution.tla and a standalone TLA+ projection generated from the exact machine-readable Seed model under ASET-SEED-CANON-TLA-PROJECTION-V4. The generated projection does not import or extend SeedResolution; the proof explicitly instantiates the independent projection onto the target state. Opaque Binding construction, concrete Authority-recognition evidence, terminal-commitment provenance, cryptographic primitives, implementation refinement, liveness and natural-language completeness remain outside this proof boundary. The deterministic generator remains part of the assurance trusted computing base.", "document_type": "aset-canon-tla-refinement", "excluded_claims": [ "natural-language-text equivalence", "cryptographic digest correctness", - "concrete Authority grant-chain construction", + "concrete Authority evidence or delegation-chain validation", "implementation refinement", "liveness", "formal proof of projection-generator correctness", @@ -33,7 +33,7 @@ "generator": "tools/generate_canon_tla_projection.py", "module": "SeedCanonProjection", "path": "seed/canonical/formal/SeedCanonProjection.tla", - "profile": "ASET-SEED-CANON-TLA-PROJECTION-V3" + "profile": "ASET-SEED-CANON-TLA-PROJECTION-V4" }, "invariant_coverage": [ { @@ -58,11 +58,11 @@ }, { "id": "SEED-INV-006", - "status": "ABSTRACTED_AUTHORITY_PROOF" + "status": "ABSTRACTED_AUTHORITY_RECOGNITION" }, { "id": "SEED-INV-007", - "status": "PROVED_IN_DECLARED_PROJECTION" + "status": "STRUCTURAL_BOUNDARY_OUTSIDE_STATE_MACHINE" }, { "id": "SEED-INV-008", @@ -70,7 +70,7 @@ }, { "id": "SEED-INV-009", - "status": "PROVED_IN_DECLARED_PROJECTION" + "status": "PARTIAL_EXTERNAL_MATERIAL_BOUNDARY" }, { "id": "SEED-INV-010", @@ -90,7 +90,7 @@ "module": "seed/canonical/formal/SeedCanonRefinementProofs.tla", "verification_method": "ASET-VERIFY-CANON-TLA-REFINEMENT" }, - "relation_type": "GENERATED_PROJECTION_WITH_BEHAVIORAL_EQUIVALENCE_PROOF", + "relation_type": "STANDALONE_GENERATED_PROJECTION_WITH_BEHAVIORAL_EQUIVALENCE_PROOF", "requirement_coverage": [ { "id": "ASET-SEED-REQ-001", @@ -115,7 +115,7 @@ { "id": "ASET-SEED-REQ-005", "predicate": "fail_closed", - "status": "PROVED_IN_DECLARED_PROJECTION" + "status": "PARTIAL_EXTERNAL_MATERIAL_BOUNDARY" }, { "id": "ASET-SEED-REQ-006", @@ -124,13 +124,13 @@ }, { "id": "ASET-SEED-REQ-007", - "predicate": "proof_attenuating", - "status": "ABSTRACTED_AUTHORITY_PROOF" + "predicate": "authority_recognition_boundary", + "status": "ABSTRACTED_AUTHORITY_RECOGNITION" }, { "id": "ASET-SEED-REQ-008", "predicate": "inputs_non_authoritative", - "status": "PROVED_IN_DECLARED_PROJECTION" + "status": "STRUCTURAL_BOUNDARY_OUTSIDE_STATE_MACHINE" }, { "id": "ASET-SEED-REQ-009", @@ -167,13 +167,13 @@ "source_model": { "model_id": "ASET-SEED-RESOLUTION-CANON-0.3-ALPHA1", "path": "seed/canonical/source/seed-model.json", - "sha256": "sha256:b5e68692317600fd2833474a1f9c31f09e44d37ae92ec14573b416076c5dd7f6", + "sha256": "sha256:c43ca7b642a11c3ab140884a6bbff34bbd741f5cb905e6a779c860c813998fcf", "version": "0.3.0-alpha.1" }, "target_model": { "module": "SeedResolution", "path": "seed/canonical/formal/SeedResolution.tla", - "sha256": "sha256:8cdbd66db0b4a5fabb38fb1a7739c2a2e3e418ab9bede02d5e49382d4442dd9f" + "sha256": "sha256:1c53b058d738e074c2a9de96fe27d8d7dd384d3ffa52f3bb95f7732908d66276" }, "transition_coverage": [ { @@ -191,8 +191,8 @@ { "id": "SEED-TX-003", "kind": "EVALUATE_RESOLUTION", - "status": "PROVED_IN_DECLARED_PROJECTION", - "tla_action": "Evaluate" + "status": "OBSERVER_EQUIVALENCE_PROVED", + "tla_action": "EvaluateResolution" } ] } diff --git a/seed/canonical/assurance/invariant-coverage.json b/seed/canonical/assurance/invariant-coverage.json index 5a35435..ac3dc5d 100644 --- a/seed/canonical/assurance/invariant-coverage.json +++ b/seed/canonical/assurance/invariant-coverage.json @@ -2,11 +2,11 @@ "claim_boundary": { "covered": [ "all twelve canonical requirements have machine-traceable assurance evidence", - "all twelve canonical safety invariants have formal properties, conformance cases and semantic mutations", - "all three canonical transitions have positive and negative conformance coverage", - "bounded state and transition preservation for the published finite model", - "all sixteen registered TLA/TLC safety properties have unbounded TLAPS deductive closure over the abstract projection", - "source-locked generated canonical projection with TLAPS-proved behavioral equivalence to SeedResolution.tla under the declared abstraction profile" + "all twelve canonical safety invariants have explicit formal, executable or boundary evidence", + "all three canonical operations have positive and negative conformance coverage, with EVALUATE_RESOLUTION classified as an observer", + "finite-state saturation for the published Python model and independent TLC model checking", + "all fourteen registered TLA/TLC safety properties have TLAPS deductive closure over the abstract model", + "standalone source-locked canonical projection with TLAPS-proved behavioral equivalence to SeedResolution.tla under the declared abstraction profile" ], "not_claimed": [ "cryptographic primitive security", @@ -14,7 +14,9 @@ "liveness or workflow completion", "external certification", "implementation refinement proof", - "full natural-language, concrete binding/digest and concrete Authority-proof refinement beyond the declared projection" + "concrete Binding/digest construction", + "concrete Authority evidence, signature or delegation-chain correctness", + "external invalid/non-authoritative material processing beyond the declared boundary" ] }, "coverage_policy": { @@ -93,8 +95,8 @@ "RES-NEG-014" ], "formal_properties": [ - "LocalAuthorityRoot", - "GrantChainValidation" + "RequestAuthorityRecognized", + "AuthorityRecognitionBoundary" ], "id": "SEED-INV-005", "semantic_mutations": [ @@ -111,8 +113,8 @@ "RES-NEG-016" ], "formal_properties": [ - "DelegatedAuthoritySound", - "GrantChainValidation" + "TerminalAuthorityRecognized", + "AuthorityRecognitionBoundary" ], "id": "SEED-INV-006", "semantic_mutations": [ @@ -125,8 +127,7 @@ "RES-NEG-014" ], "formal_properties": [ - "InputsNonAuthoritative", - "NonAuthoritativeInputsStutter" + "ExternalMaterialNonAuthoritative" ], "id": "SEED-INV-007", "semantic_mutations": [ @@ -150,12 +151,13 @@ "conformance_cases": [ "RES-NEG-005", "RES-NEG-014", - "RES-NEG-015" + "RES-NEG-015", + "RES-POS-009" ], "formal_properties": [ "FailClosed", "ConflictUnknown", - "InvalidMaterialStutter" + "ExternalMaterialNonAuthoritative" ], "id": "SEED-INV-009", "semantic_mutations": [ @@ -184,7 +186,8 @@ "RES-NEG-010" ], "formal_properties": [ - "CanonicalStateChangesOnlyByRecognizedTransition" + "SeedStateChangesOnlyByRecognizedTransition", + "ConflictObservationPreservesSeedState" ], "id": "SEED-INV-011", "semantic_mutations": [ @@ -283,9 +286,9 @@ "case_ids": [ "RES-NEG-016" ], - "description": "Accept a cyclic Authority proof.", + "description": "Treat opaque Authority evidence as sufficient exact-binding Authority recognition.", "id": "SEED-MUT-006", - "operator": "accept_cyclic_grant", + "operator": "authority_evidence_creates_recognition", "seed_invariants": [ "SEED-INV-006" ], @@ -325,7 +328,7 @@ "case_ids": [ "RES-NEG-005" ], - "description": "Allow invalid terminal material.", + "description": "Allow invalid or non-authoritative terminal material to create ALLOW.", "id": "SEED-MUT-009", "operator": "invalid_material_allows", "seed_invariants": [ @@ -354,7 +357,7 @@ "case_ids": [ "RES-NEG-001" ], - "description": "Mutate canonical state for an invalid or unrecognized candidate.", + "description": "Mutate Seed-owned state for an invalid or unrecognized candidate.", "id": "SEED-MUT-011", "operator": "unrecognized_candidate_mutates_store", "seed_invariants": [ @@ -466,7 +469,8 @@ "RES-POS-003", "RES-POS-006", "RES-NEG-005", - "RES-NEG-015" + "RES-NEG-015", + "RES-POS-009" ], "formal_properties": [ "FailClosed", @@ -490,8 +494,8 @@ "RES-NEG-014" ], "formal_properties": [ - "LocalAuthorityRoot", - "GrantChainValidation" + "RequestAuthorityRecognized", + "AuthorityRecognitionBoundary" ], "id": "ASET-SEED-REQ-006", "invariants": [ @@ -510,8 +514,8 @@ "RES-NEG-016" ], "formal_properties": [ - "DelegatedAuthoritySound", - "GrantChainValidation" + "TerminalAuthorityRecognized", + "AuthorityRecognitionBoundary" ], "id": "ASET-SEED-REQ-007", "invariants": [ @@ -527,8 +531,7 @@ "RES-NEG-014" ], "formal_properties": [ - "InputsNonAuthoritative", - "NonAuthoritativeInputsStutter" + "ExternalMaterialNonAuthoritative" ], "id": "ASET-SEED-REQ-008", "invariants": [ @@ -651,7 +654,8 @@ "RES-NEG-015" ], "positive_cases": [ - "RES-POS-006" + "RES-POS-006", + "RES-POS-009" ] } ] diff --git a/seed/canonical/assurance/limitations.json b/seed/canonical/assurance/limitations.json index 6fddd4f..49e7f59 100644 --- a/seed/canonical/assurance/limitations.json +++ b/seed/canonical/assurance/limitations.json @@ -3,7 +3,7 @@ "limitations": [ { "closure_criteria": "A separately versioned federation extension defines topology, delegation and coordination without weakening Seed invariants.", - "description": "Seed validates local Authority material but does not define federation topology, discovery, routing or consensus.", + "description": "Seed consumes local exact-binding Authority recognition but does not define federation topology, discovery, routing, consensus or the mechanism used to establish that recognition.", "id": "LIMIT-001", "scope": "federation-topology", "status": "EXTENSION_RESPONSIBILITY" @@ -24,7 +24,7 @@ }, { "closure_criteria": "Keep the pinned TLAPS gate passing for the exact committed formal model and proof-module identities.", - "description": "The abstract TLA+ Seed safety projection has an unbounded deductive proof covering all eleven registered state invariants and all five registered temporal safety properties.", + "description": "The abstract TLA+ Seed safety model has an unbounded deductive proof covering all ten registered state invariants and all four registered temporal safety properties.", "id": "LIMIT-004", "scope": "abstract-tla-safety-proof", "status": "CLOSED" @@ -44,15 +44,15 @@ "status": "BREAKING_CHANGE_DECLARED" }, { - "closure_criteria": "Add separate proofs only for concrete binding/digest construction, concrete Authority grant chains, selected terminal-commitment accumulator profiles, selected implementation profiles, liveness or cryptography where those stronger claims are required.", - "description": "The generated canonical TLA+ projection is source-locked and behaviorally equivalent to SeedResolution.tla under the declared abstraction profile. Full refinement of natural-language semantics, concrete binding/digest construction, concrete Authority grant chains, concrete terminal-commitment accumulator/witness verification, implementations, liveness and cryptographic primitive security is not proved.", + "closure_criteria": "Add separate proofs only for concrete Binding/digest construction, Authority-recognition mechanisms, selected terminal-commitment accumulator profiles, implementation refinement, liveness or cryptography where those stronger claims are required.", + "description": "The standalone generated canonical TLA+ projection is behaviorally equivalent to SeedResolution.tla under the declared abstraction mapping. Concrete Binding/digest construction, Authority evidence/signature/delegation mechanisms, terminal-commitment accumulator/witness verification, implementation refinement, liveness and cryptographic primitive security are not proved by Seed.", "id": "LIMIT-007", "scope": "remaining-refinement-liveness-and-cryptography", "status": "OPEN_ACCEPTED" }, { "closure_criteria": "Keep the projection parity, source/target digest checks and pinned TLAPS behavioral-equivalence gate passing for the exact committed identities.", - "description": "The exact machine-readable Seed model is source-locked to a deterministic generated TLA+ projection, and TLAPS proves behavioral equivalence between that declared projection and SeedResolution.tla.", + "description": "The exact machine-readable Seed model is source-locked to a standalone deterministic TLA+ projection, and TLAPS proves behavioral equivalence between that independently generated projection and SeedResolution.tla.", "id": "LIMIT-008", "scope": "declared-canon-tla-projection-refinement", "status": "CLOSED" diff --git a/seed/canonical/assurance/proof-traceability.json b/seed/canonical/assurance/proof-traceability.json index b854e5c..c545a14 100644 --- a/seed/canonical/assurance/proof-traceability.json +++ b/seed/canonical/assurance/proof-traceability.json @@ -1,5 +1,5 @@ { - "claim_boundary": "This document declares machine-checkable traceability from canonical Seed invariants to operators in the abstract TLA+ projection and to TLAPS theorems proving those projected safety properties. It does not constitute a refinement proof from the machine-readable canon to TLA+.", + "claim_boundary": "This document traces the TLA-expressible portion of each canonical Seed invariant to abstract operators and TLAPS theorems. Claims marked PARTIAL_BOUNDARY intentionally leave concrete Authority evidence and invalid/non-authoritative external-material handling outside the TLA state machine. Standalone canon-to-TLA behavioral equivalence is proved separately by SeedCanonRefinementProofs.tla.", "claims": [ { "formal_projection": [ @@ -22,6 +22,7 @@ "ASET-SEED-REQ-001", "ASET-SEED-REQ-003" ], + "status": "PROVED_IN_TLA", "verification_method": "ASET-VERIFY-TLAPS-UNBOUNDED" }, { @@ -39,6 +40,7 @@ "seed_requirements": [ "ASET-SEED-REQ-004" ], + "status": "PROVED_IN_TLA", "verification_method": "ASET-VERIFY-TLAPS-UNBOUNDED" }, { @@ -56,6 +58,7 @@ "seed_requirements": [ "ASET-SEED-REQ-005" ], + "status": "PROVED_IN_TLA", "verification_method": "ASET-VERIFY-TLAPS-UNBOUNDED" }, { @@ -79,13 +82,14 @@ "ASET-SEED-REQ-001", "ASET-SEED-REQ-003" ], + "status": "PROVED_IN_TLA", "verification_method": "ASET-VERIFY-TLAPS-UNBOUNDED" }, { "formal_projection": [ { "kind": "STATE_INVARIANT", - "operator": "LocalAuthorityRoot", + "operator": "RequestAuthorityRecognized", "proof_theorem": "SpecImpliesAlwaysSeedStateSafety" } ], @@ -96,13 +100,14 @@ "seed_requirements": [ "ASET-SEED-REQ-006" ], + "status": "PROVED_IN_TLA", "verification_method": "ASET-VERIFY-TLAPS-UNBOUNDED" }, { "formal_projection": [ { "kind": "STATE_INVARIANT", - "operator": "DelegatedAuthoritySound", + "operator": "TerminalAuthorityRecognized", "proof_theorem": "SpecImpliesAlwaysSeedStateSafety" } ], @@ -113,28 +118,17 @@ "seed_requirements": [ "ASET-SEED-REQ-007" ], + "status": "PARTIAL_BOUNDARY", "verification_method": "ASET-VERIFY-TLAPS-UNBOUNDED" }, { - "formal_projection": [ - { - "kind": "STATE_INVARIANT", - "operator": "InputsNonAuthoritative", - "proof_theorem": "SpecImpliesAlwaysSeedStateSafety" - }, - { - "kind": "TEMPORAL_PROPERTY", - "operator": "NonAuthoritativeInputsStutter", - "proof_theorem": "SpecImpliesNonAuthoritativeInputsStutter" - } - ], + "formal_projection": [], "id": "ASET-PROOF-INV-007", "seed_invariants": [ "SEED-INV-007" ], - "seed_requirements": [ - "ASET-SEED-REQ-008" - ], + "seed_requirements": [], + "status": "PARTIAL_BOUNDARY", "verification_method": "ASET-VERIFY-TLAPS-UNBOUNDED" }, { @@ -152,24 +146,15 @@ "seed_requirements": [ "ASET-SEED-REQ-009" ], + "status": "PROVED_IN_TLA", "verification_method": "ASET-VERIFY-TLAPS-UNBOUNDED" }, { "formal_projection": [ - { - "kind": "STATE_INVARIANT", - "operator": "FailClosed", - "proof_theorem": "SpecImpliesAlwaysSeedStateSafety" - }, { "kind": "STATE_INVARIANT", "operator": "ConflictUnknown", "proof_theorem": "SpecImpliesAlwaysSeedStateSafety" - }, - { - "kind": "TEMPORAL_PROPERTY", - "operator": "InvalidMaterialStutter", - "proof_theorem": "SpecImpliesInvalidMaterialStutter" } ], "id": "ASET-PROOF-INV-009", @@ -180,6 +165,7 @@ "ASET-SEED-REQ-005", "ASET-SEED-REQ-009" ], + "status": "PARTIAL_BOUNDARY", "verification_method": "ASET-VERIFY-TLAPS-UNBOUNDED" }, { @@ -197,14 +183,20 @@ "seed_requirements": [ "ASET-SEED-REQ-010" ], + "status": "PROVED_IN_TLA", "verification_method": "ASET-VERIFY-TLAPS-UNBOUNDED" }, { "formal_projection": [ { "kind": "TEMPORAL_PROPERTY", - "operator": "CanonicalStateChangesOnlyByRecognizedTransition", - "proof_theorem": "SpecImpliesCanonicalStateChangesOnlyByRecognizedTransition" + "operator": "SeedStateChangesOnlyByRecognizedTransition", + "proof_theorem": "SpecImpliesSeedStateChangesOnlyByRecognizedTransition" + }, + { + "kind": "TEMPORAL_PROPERTY", + "operator": "ConflictObservationPreservesSeedState", + "proof_theorem": "SpecImpliesConflictObservationPreservesSeedState" } ], "id": "ASET-PROOF-INV-011", @@ -212,6 +204,7 @@ "SEED-INV-011" ], "seed_requirements": [], + "status": "PROVED_IN_TLA", "verification_method": "ASET-VERIFY-TLAPS-UNBOUNDED" }, { @@ -235,13 +228,14 @@ "ASET-SEED-REQ-002", "ASET-SEED-REQ-011" ], + "status": "PROVED_IN_TLA", "verification_method": "ASET-VERIFY-TLAPS-UNBOUNDED" } ], "document_type": "aset-seed-proof-traceability", "formal_model": "seed/canonical/formal/SeedResolution.tla", "proof_module": "seed/canonical/formal/SeedResolutionProofs.tla", - "refinement_status": "DECLARED_PROJECTION_NOT_REFINEMENT_PROOF", - "schema_version": 1, - "scope": "ABSTRACT_TLA_SAFETY_PROJECTION" + "refinement_status": "STANDALONE_CANON_PROJECTION_EQUIVALENCE_PROVED", + "schema_version": 2, + "scope": "ABSTRACT_TLA_SAFETY_WITH_EXPLICIT_BOUNDARIES" } diff --git a/seed/canonical/assurance/repository-release-gates.json b/seed/canonical/assurance/repository-release-gates.json index 3ce7cb4..e3f9b9d 100644 --- a/seed/canonical/assurance/repository-release-gates.json +++ b/seed/canonical/assurance/repository-release-gates.json @@ -82,7 +82,7 @@ "evidence": "python tools/model_check_seed.py --output dist/seed-model-check.json", "id": "ASET-GATE-010", "mandatory": true, - "name": "bounded_seed_resolution_model_check" + "name": "finite_seed_resolution_saturation_check" }, { "evidence": "python -m pytest -q", diff --git a/seed/canonical/assurance/verification-registry.json b/seed/canonical/assurance/verification-registry.json index 4b8d507..e25cf71 100644 --- a/seed/canonical/assurance/verification-registry.json +++ b/seed/canonical/assurance/verification-registry.json @@ -1,5 +1,5 @@ { - "claim_boundary": "Registry membership proves complete machine traceability for the published minimal Seed safety contract. The committed abstract TLA+ projection has bounded TLC coverage and an unbounded TLAPS deductive proof of all eleven registered state invariants and five registered temporal safety properties over the normalized three-variable state. A source-locked generated canonical TLA+ projection is machine-checked against the exact seed-model.json identity, and TLAPS proves behavioral equivalence between that declared projection and SeedResolution.tla. Opaque Binding construction, concrete Authority grant-chain construction, cryptographic primitive security, implementation refinement, liveness, implementation correctness and external certification are not claimed.", + "claim_boundary": "Registry membership provides machine traceability for the active minimal Seed contract. The formal model separates two Seed-owned mutable state dimensions (requestMeta, terminalMeta) from one environment conflict dimension. Fourteen TLA/TLC properties (ten state invariants and four temporal safety properties) have bounded finite-state coverage and TLAPS deductive closure. A standalone source-locked canonical TLA+ projection is behaviorally equivalent to SeedResolution.tla under the declared abstraction mapping. Invalid/non-authoritative material processing, concrete Binding construction, concrete Authority evidence/signatures/delegation-chain construction, cryptographic security, implementation refinement, liveness and external certification remain outside the formal Seed state-machine proof boundary.", "document_type": "aset-seed-verification-registry", "formal_properties": [ { @@ -46,8 +46,7 @@ "name": "FailClosed", "projection_status": "BOUNDED_ABSTRACTION", "seed_invariants": [ - "SEED-INV-003", - "SEED-INV-009" + "SEED-INV-003" ], "seed_requirements": [ "ASET-SEED-REQ-005" @@ -68,8 +67,8 @@ { "engine": "TLA_TLC", "kind": "STATE_INVARIANT", - "name": "LocalAuthorityRoot", - "projection_status": "BOUNDED_ABSTRACTION", + "name": "RequestAuthorityRecognized", + "projection_status": "ABSTRACT_AUTHORITY_RECOGNITION", "seed_invariants": [ "SEED-INV-005" ], @@ -80,8 +79,8 @@ { "engine": "TLA_TLC", "kind": "STATE_INVARIANT", - "name": "DelegatedAuthoritySound", - "projection_status": "ABSTRACT_PROOF_PREDICATE", + "name": "TerminalAuthorityRecognized", + "projection_status": "ABSTRACT_AUTHORITY_RECOGNITION", "seed_invariants": [ "SEED-INV-006" ], @@ -89,23 +88,11 @@ "ASET-SEED-REQ-007" ] }, - { - "engine": "TLA_TLC", - "kind": "STATE_INVARIANT", - "name": "InputsNonAuthoritative", - "projection_status": "STRUCTURAL_NO_STATE_SLOT", - "seed_invariants": [ - "SEED-INV-007" - ], - "seed_requirements": [ - "ASET-SEED-REQ-008" - ] - }, { "engine": "TLA_TLC", "kind": "STATE_INVARIANT", "name": "TerminalUnique", - "projection_status": "BOUNDED_ABSTRACTION", + "projection_status": "STRUCTURAL_BY_CONSTRUCTION", "seed_invariants": [ "SEED-INV-008" ], @@ -130,7 +117,7 @@ "engine": "TLA_TLC", "kind": "STATE_INVARIANT", "name": "FreshReconsideration", - "projection_status": "BOUNDED_ABSTRACTION", + "projection_status": "ABSTRACT_COMMITMENT_RECOGNITION", "seed_invariants": [ "SEED-INV-012" ], @@ -167,8 +154,8 @@ { "engine": "TLA_TLC", "kind": "TEMPORAL_PROPERTY", - "name": "CanonicalStateChangesOnlyByRecognizedTransition", - "projection_status": "BOUNDED_ABSTRACTION", + "name": "SeedStateChangesOnlyByRecognizedTransition", + "projection_status": "SEED_STATE_BOUNDARY", "seed_invariants": [ "SEED-INV-011" ], @@ -177,26 +164,12 @@ { "engine": "TLA_TLC", "kind": "TEMPORAL_PROPERTY", - "name": "NonAuthoritativeInputsStutter", - "projection_status": "STRUCTURAL_STUTTER_ABSTRACTION", - "seed_invariants": [ - "SEED-INV-007" - ], - "seed_requirements": [ - "ASET-SEED-REQ-008" - ] - }, - { - "engine": "TLA_TLC", - "kind": "TEMPORAL_PROPERTY", - "name": "InvalidMaterialStutter", - "projection_status": "STRUCTURAL_STUTTER_ABSTRACTION", + "name": "ConflictObservationPreservesSeedState", + "projection_status": "ENVIRONMENT_STATE_BOUNDARY", "seed_invariants": [ - "SEED-INV-009" + "SEED-INV-011" ], - "seed_requirements": [ - "ASET-SEED-REQ-005" - ] + "seed_requirements": [] }, { "engine": "EXECUTABLE_ORACLE", @@ -215,7 +188,7 @@ { "engine": "EXECUTABLE_ORACLE", "kind": "EXECUTABLE_PROPERTY", - "name": "GrantChainValidation", + "name": "AuthorityRecognitionBoundary", "projection_status": "EXACT_CANON_PROPERTY", "seed_invariants": [ "SEED-INV-005", @@ -226,6 +199,20 @@ "ASET-SEED-REQ-007" ] }, + { + "engine": "EXECUTABLE_ORACLE", + "kind": "EXECUTABLE_PROPERTY", + "name": "ExternalMaterialNonAuthoritative", + "projection_status": "BOUNDARY_PROPERTY", + "seed_invariants": [ + "SEED-INV-007", + "SEED-INV-009" + ], + "seed_requirements": [ + "ASET-SEED-REQ-005", + "ASET-SEED-REQ-008" + ] + }, { "engine": "EXECUTABLE_ORACLE", "kind": "EXECUTABLE_PROPERTY", @@ -257,7 +244,7 @@ } ], "normative": true, - "schema_version": 3, + "schema_version": 4, "transition_case_policy": { "declared_exceptions": [], "require_negative_case": true, @@ -292,7 +279,7 @@ "kind": "DECLARATIVE_INVARIANT_VALIDATION" }, { - "evidence": "Python bounded model and TLC formal model", + "evidence": "Python finite-state saturation check and TLC formal model", "gate_ids": [ "ASET-GATE-010", "ASET-GATE-019" @@ -346,7 +333,7 @@ "ASET-GATE-031" ], "id": "ASET-VERIFY-CANON-TLA-REFINEMENT", - "kind": "DECLARED_CANONICAL_PROJECTION_BEHAVIORAL_EQUIVALENCE_PROOF" + "kind": "STANDALONE_CANONICAL_PROJECTION_BEHAVIORAL_EQUIVALENCE_PROOF" } ] } diff --git a/seed/canonical/conformance/cases/negative/RES-NEG-001.json b/seed/canonical/conformance/cases/negative/RES-NEG-001.json index 6ece6e6..6dd5dbf 100644 --- a/seed/canonical/conformance/cases/negative/RES-NEG-001.json +++ b/seed/canonical/conformance/cases/negative/RES-NEG-001.json @@ -13,9 +13,9 @@ ], "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, - "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "initial_authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "previous_terminal_record_digest": null, - "request_digest": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "request_digest": "sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff", "resolution_id": "res.1" } } @@ -33,16 +33,13 @@ "initial_store": { "authority_bindings": [ { - "authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "authority_id": "authority.root", "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "constitution_digest": "sha256:9999999999999999999999999999999999999999999999999999999999999999", "context_id": "ctx.local", - "delegation_allowed": true, "policy_epoch": 1 } ], - "authority_grants": [], "records": [], "requests": [] }, diff --git a/seed/canonical/conformance/cases/negative/RES-NEG-002.json b/seed/canonical/conformance/cases/negative/RES-NEG-002.json index 9c6937c..8d98f70 100644 --- a/seed/canonical/conformance/cases/negative/RES-NEG-002.json +++ b/seed/canonical/conformance/cases/negative/RES-NEG-002.json @@ -13,9 +13,9 @@ ], "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, - "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "initial_authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "previous_terminal_record_digest": null, - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution_id": "res.1" } } @@ -33,16 +33,13 @@ "initial_store": { "authority_bindings": [ { - "authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "authority_id": "authority.root", "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "constitution_digest": "sha256:9999999999999999999999999999999999999999999999999999999999999999", "context_id": "ctx.local", - "delegation_allowed": true, "policy_epoch": 1 } ], - "authority_grants": [], "records": [], "requests": [] }, @@ -62,9 +59,9 @@ ], "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, - "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "initial_authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "previous_terminal_record_digest": null, - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution_id": "res.1" } } diff --git a/seed/canonical/conformance/cases/negative/RES-NEG-003.json b/seed/canonical/conformance/cases/negative/RES-NEG-003.json index a2d4a00..718a7c1 100644 --- a/seed/canonical/conformance/cases/negative/RES-NEG-003.json +++ b/seed/canonical/conformance/cases/negative/RES-NEG-003.json @@ -13,9 +13,9 @@ ], "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, - "initial_authority_binding_digest": "sha256:8888888888888888888888888888888888888888888888888888888888888888", + "initial_authority_binding_digest": "sha256:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee", "previous_terminal_record_digest": null, - "request_digest": "sha256:af5e16ad8048b82307864b7a592d58b34ec023a744b9227dcb3fc670ca51a213", + "request_digest": "sha256:695a70469aaa7e41a07914f8d0918b67a782b4c69cb31e682382ee46d99d10a9", "resolution_id": "res.bad.auth" } } @@ -33,16 +33,13 @@ "initial_store": { "authority_bindings": [ { - "authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "authority_id": "authority.root", "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "constitution_digest": "sha256:9999999999999999999999999999999999999999999999999999999999999999", "context_id": "ctx.local", - "delegation_allowed": true, "policy_epoch": 1 } ], - "authority_grants": [], "records": [], "requests": [] }, diff --git a/seed/canonical/conformance/cases/negative/RES-NEG-004.json b/seed/canonical/conformance/cases/negative/RES-NEG-004.json index 42677d3..382a6a1 100644 --- a/seed/canonical/conformance/cases/negative/RES-NEG-004.json +++ b/seed/canonical/conformance/cases/negative/RES-NEG-004.json @@ -13,9 +13,9 @@ ], "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, - "initial_authority_binding_digest": "sha256:a59dcf9a37fe20a954493350b44a6f983ace899be77c5a4fc49476f4c95da254", + "initial_authority_binding_digest": "sha256:c28c2cadf979d11dee7c3873dcbd1704bdf8ac86826d4f99d26b8aa3883f0eda", "previous_terminal_record_digest": null, - "request_digest": "sha256:a32ea50cac3aadea4342b1aa36ede8a8fdb743633334bb56feeb7c3b732548c5", + "request_digest": "sha256:3d7e79d6a82ffd0657c048fef3344d6fa80977bbbf4854816c575893c843f9e1", "resolution_id": "res.mismatch" } } @@ -33,25 +33,20 @@ "initial_store": { "authority_bindings": [ { - "authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "authority_id": "authority.root", "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "constitution_digest": "sha256:9999999999999999999999999999999999999999999999999999999999999999", "context_id": "ctx.local", - "delegation_allowed": true, "policy_epoch": 1 }, { - "authority_binding_digest": "sha256:a59dcf9a37fe20a954493350b44a6f983ace899be77c5a4fc49476f4c95da254", + "authority_binding_digest": "sha256:c28c2cadf979d11dee7c3873dcbd1704bdf8ac86826d4f99d26b8aa3883f0eda", "authority_id": "authority.other-root", "binding_digest": "sha256:bed87a20469ae35fc516742005f4851f7be80855a08a9d6d265d82907f5d7fb1", - "constitution_digest": "sha256:9999999999999999999999999999999999999999999999999999999999999999", "context_id": "ctx.local", - "delegation_allowed": true, "policy_epoch": 1 } ], - "authority_grants": [], "records": [], "requests": [] }, diff --git a/seed/canonical/conformance/cases/negative/RES-NEG-005.json b/seed/canonical/conformance/cases/negative/RES-NEG-005.json index 818ff60..1b15c32 100644 --- a/seed/canonical/conformance/cases/negative/RES-NEG-005.json +++ b/seed/canonical/conformance/cases/negative/RES-NEG-005.json @@ -3,14 +3,14 @@ "kind": "SUBMIT_RESOLUTION", "payload": { "record": { + "authority_evidence_digests": [], "authority_id": "authority.root", - "authority_proof_digests": [], "basis_digests": [ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:0000000000000000000000000000000000000000000000000000000000000000", - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "record_digest": "sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution": "ALLOW", "resolution_id": "res.1" } @@ -29,16 +29,13 @@ "initial_store": { "authority_bindings": [ { - "authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "authority_id": "authority.root", "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "constitution_digest": "sha256:9999999999999999999999999999999999999999999999999999999999999999", "context_id": "ctx.local", - "delegation_allowed": true, "policy_epoch": 1 } ], - "authority_grants": [], "records": [], "requests": [] }, @@ -58,9 +55,9 @@ ], "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, - "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "initial_authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "previous_terminal_record_digest": null, - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution_id": "res.1" } } diff --git a/seed/canonical/conformance/cases/negative/RES-NEG-006.json b/seed/canonical/conformance/cases/negative/RES-NEG-006.json index b4f8232..6bd6774 100644 --- a/seed/canonical/conformance/cases/negative/RES-NEG-006.json +++ b/seed/canonical/conformance/cases/negative/RES-NEG-006.json @@ -3,14 +3,14 @@ "kind": "SUBMIT_RESOLUTION", "payload": { "record": { + "authority_evidence_digests": [], "authority_id": "authority.root", - "authority_proof_digests": [], "basis_digests": [ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:bed87a20469ae35fc516742005f4851f7be80855a08a9d6d265d82907f5d7fb1", - "record_digest": "sha256:2003cf6837a7708318faccef76b451e0ad30ed135c666b3e0c4633d9b3debfd5", - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "record_digest": "sha256:305d513a243d7b2041929d8ffb2760be4f454aba2c131f9eb46be224635e13c2", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution": "ALLOW", "resolution_id": "res.1" } @@ -29,16 +29,13 @@ "initial_store": { "authority_bindings": [ { - "authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "authority_id": "authority.root", "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "constitution_digest": "sha256:9999999999999999999999999999999999999999999999999999999999999999", "context_id": "ctx.local", - "delegation_allowed": true, "policy_epoch": 1 } ], - "authority_grants": [], "records": [], "requests": [] }, @@ -58,9 +55,9 @@ ], "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, - "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "initial_authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "previous_terminal_record_digest": null, - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution_id": "res.1" } } diff --git a/seed/canonical/conformance/cases/negative/RES-NEG-007.json b/seed/canonical/conformance/cases/negative/RES-NEG-007.json index 3688f44..0d999e4 100644 --- a/seed/canonical/conformance/cases/negative/RES-NEG-007.json +++ b/seed/canonical/conformance/cases/negative/RES-NEG-007.json @@ -3,26 +3,26 @@ "kind": "SUBMIT_RESOLUTION", "payload": { "record": { - "authority_id": "authority.delegate", - "authority_proof_digests": [ + "authority_evidence_digests": [ "sha256:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee" ], + "authority_id": "authority.delegate", "basis_digests": [ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:728f353c06d139bf5486fbe9dadf5dc33d3a20a0c1f3e254e2987a21ae46dac2", - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "record_digest": "sha256:cde286ac232c418de1ddb1285eec2e8cfaf109b05160ec588d7134511476bd36", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution": "ALLOW", "resolution_id": "res.1" } } }, "case_id": "RES-NEG-007", - "description": "Reject delegated Authority without the cited explicit grant.", + "description": "Reject a terminal Authority that has evidence references but no recognized exact-binding Authority authorization.", "expected": { "accepted": false, - "code": "AUTHORITY_GRANT_INVALID", + "code": "TERMINAL_AUTHORITY_UNRECOGNIZED", "effect_permitted": false, "reason": "TERMINAL_RECORD_ABSENT", "resolution": "UNKNOWN", @@ -31,16 +31,13 @@ "initial_store": { "authority_bindings": [ { - "authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "authority_id": "authority.root", "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "constitution_digest": "sha256:9999999999999999999999999999999999999999999999999999999999999999", "context_id": "ctx.local", - "delegation_allowed": true, "policy_epoch": 1 } ], - "authority_grants": [], "records": [], "requests": [] }, @@ -60,9 +57,9 @@ ], "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, - "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "initial_authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "previous_terminal_record_digest": null, - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution_id": "res.1" } } diff --git a/seed/canonical/conformance/cases/negative/RES-NEG-008.json b/seed/canonical/conformance/cases/negative/RES-NEG-008.json index 99347e2..20b0017 100644 --- a/seed/canonical/conformance/cases/negative/RES-NEG-008.json +++ b/seed/canonical/conformance/cases/negative/RES-NEG-008.json @@ -3,26 +3,26 @@ "kind": "SUBMIT_RESOLUTION", "payload": { "record": { - "authority_id": "authority.delegate", - "authority_proof_digests": [ + "authority_evidence_digests": [ "sha256:e3346d498d01abf928a71d70d0b157ca4727afb2efd8189694a3ec42a7002988" ], + "authority_id": "authority.delegate", "basis_digests": [ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:b0b887903271a5f7698fede3a0000fd125a01319084b6682d19f7c3858278d6c", - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "record_digest": "sha256:ab8f76cf551d48b875e93a031dd501f7315a10efb090a8d212c62bc51924e76f", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution": "ALLOW", "resolution_id": "res.1" } } }, "case_id": "RES-NEG-008", - "description": "Reject an Authority grant bound to a different resolution binding.", + "description": "Reject a terminal Authority recognized only for a different binding.", "expected": { "accepted": false, - "code": "AUTHORITY_GRANT_BINDING_MISMATCH", + "code": "TERMINAL_AUTHORITY_BINDING_MISMATCH", "effect_permitted": false, "reason": "TERMINAL_RECORD_ABSENT", "resolution": "UNKNOWN", @@ -31,23 +31,18 @@ "initial_store": { "authority_bindings": [ { - "authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "authority_id": "authority.root", "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "constitution_digest": "sha256:9999999999999999999999999999999999999999999999999999999999999999", "context_id": "ctx.local", - "delegation_allowed": true, "policy_epoch": 1 - } - ], - "authority_grants": [ + }, { - "binding_digest": "sha256:bed87a20469ae35fc516742005f4851f7be80855a08a9d6d265d82907f5d7fb1", - "delegation_allowed": false, - "grant_digest": "sha256:e3346d498d01abf928a71d70d0b157ca4727afb2efd8189694a3ec42a7002988", - "issuer_authority_id": "authority.root", - "previous_grant_digest": null, - "subject_authority_id": "authority.delegate" + "authority_binding_digest": "sha256:67e0831c5d4cd0381241f09873e3fb0e47feaa7e8446e8a99ce6347d6e47c546", + "authority_id": "authority.delegate", + "binding_digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc", + "context_id": "ctx.local", + "policy_epoch": 1 } ], "records": [], @@ -69,9 +64,9 @@ ], "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, - "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "initial_authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "previous_terminal_record_digest": null, - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution_id": "res.1" } } diff --git a/seed/canonical/conformance/cases/negative/RES-NEG-009.json b/seed/canonical/conformance/cases/negative/RES-NEG-009.json index 26d6d9e..72fb6bc 100644 --- a/seed/canonical/conformance/cases/negative/RES-NEG-009.json +++ b/seed/canonical/conformance/cases/negative/RES-NEG-009.json @@ -3,27 +3,27 @@ "kind": "SUBMIT_RESOLUTION", "payload": { "record": { - "authority_id": "authority.root", - "authority_proof_digests": [ + "authority_evidence_digests": [ "sha256:4e8eda2117648c7c437e51dec3a6d061d22b2f45c5ef0013b7b3034cced4d449", "sha256:c90de3c15e44bd9afbe9c4cecee097a8dc4fb3fae41c65cd73374e43ac57d371" ], + "authority_id": "authority.delegate", "basis_digests": [ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:1a6acf903a9eb000eba5798c1395222073ad03983f94e914098114546aa42961", - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "record_digest": "sha256:0bbf94324d657686726d95ad5c62aeed961ca4a8acfdf3b7881f47c1fd9736bc", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution": "ALLOW", "resolution_id": "res.1" } } }, "case_id": "RES-NEG-009", - "description": "Reject a cyclic or otherwise non-canonical Authority proof.", + "description": "Opaque Authority evidence cannot create Authority recognition.", "expected": { "accepted": false, - "code": "UNEXPECTED_AUTHORITY_PROOF", + "code": "TERMINAL_AUTHORITY_UNRECOGNIZED", "effect_permitted": false, "reason": "TERMINAL_RECORD_ABSENT", "resolution": "UNKNOWN", @@ -32,33 +32,13 @@ "initial_store": { "authority_bindings": [ { - "authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "authority_id": "authority.root", "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "constitution_digest": "sha256:9999999999999999999999999999999999999999999999999999999999999999", "context_id": "ctx.local", - "delegation_allowed": true, "policy_epoch": 1 } ], - "authority_grants": [ - { - "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "delegation_allowed": true, - "grant_digest": "sha256:4e8eda2117648c7c437e51dec3a6d061d22b2f45c5ef0013b7b3034cced4d449", - "issuer_authority_id": "authority.root", - "previous_grant_digest": null, - "subject_authority_id": "authority.delegate" - }, - { - "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "delegation_allowed": false, - "grant_digest": "sha256:c90de3c15e44bd9afbe9c4cecee097a8dc4fb3fae41c65cd73374e43ac57d371", - "issuer_authority_id": "authority.delegate", - "previous_grant_digest": "sha256:4e8eda2117648c7c437e51dec3a6d061d22b2f45c5ef0013b7b3034cced4d449", - "subject_authority_id": "authority.root" - } - ], "records": [], "requests": [] }, @@ -78,9 +58,9 @@ ], "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, - "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "initial_authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "previous_terminal_record_digest": null, - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution_id": "res.1" } } diff --git a/seed/canonical/conformance/cases/negative/RES-NEG-010.json b/seed/canonical/conformance/cases/negative/RES-NEG-010.json index b923ff5..4238090 100644 --- a/seed/canonical/conformance/cases/negative/RES-NEG-010.json +++ b/seed/canonical/conformance/cases/negative/RES-NEG-010.json @@ -3,14 +3,14 @@ "kind": "SUBMIT_RESOLUTION", "payload": { "record": { + "authority_evidence_digests": [], "authority_id": "authority.root", - "authority_proof_digests": [], "basis_digests": [ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:16f9e0b7709be009f3b00039f2b8cecb68932bca18ce9ceca099f44a3b32c2f5", - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "record_digest": "sha256:203822912499460c097e98c0c63569965609cc77be909e4b30b5639748a6804e", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution": "BLOCK", "resolution_id": "res.1" } @@ -29,16 +29,13 @@ "initial_store": { "authority_bindings": [ { - "authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "authority_id": "authority.root", "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "constitution_digest": "sha256:9999999999999999999999999999999999999999999999999999999999999999", "context_id": "ctx.local", - "delegation_allowed": true, "policy_epoch": 1 } ], - "authority_grants": [], "records": [], "requests": [] }, @@ -58,9 +55,9 @@ ], "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, - "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "initial_authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "previous_terminal_record_digest": null, - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution_id": "res.1" } } @@ -69,14 +66,14 @@ "kind": "SUBMIT_RESOLUTION", "payload": { "record": { + "authority_evidence_digests": [], "authority_id": "authority.root", - "authority_proof_digests": [], "basis_digests": [ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:036914e827dcd520081da16232f409942e0f768d343b44e03079f2f73f749ae8", - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "record_digest": "sha256:4f32a4864d57c647b1761a084507ce9c081bc257ac9ba4cd7f066a5598083499", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution": "ALLOW", "resolution_id": "res.1" } diff --git a/seed/canonical/conformance/cases/negative/RES-NEG-011.json b/seed/canonical/conformance/cases/negative/RES-NEG-011.json index 4a438c9..48dc451 100644 --- a/seed/canonical/conformance/cases/negative/RES-NEG-011.json +++ b/seed/canonical/conformance/cases/negative/RES-NEG-011.json @@ -13,9 +13,9 @@ ], "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, - "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", - "previous_terminal_record_digest": "sha256:036914e827dcd520081da16232f409942e0f768d343b44e03079f2f73f749ae8", - "request_digest": "sha256:268c4e8eab85b442766afbdc541578cab06409426aea12736fb292200a732e08", + "initial_authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", + "previous_terminal_record_digest": "sha256:4f32a4864d57c647b1761a084507ce9c081bc257ac9ba4cd7f066a5598083499", + "request_digest": "sha256:576fcf0ab5b9ad862a5649f1e893d5a4d3c574b908e2c66ba5f0c277afb5e11b", "resolution_id": "res.1" } } @@ -33,16 +33,13 @@ "initial_store": { "authority_bindings": [ { - "authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "authority_id": "authority.root", "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "constitution_digest": "sha256:9999999999999999999999999999999999999999999999999999999999999999", "context_id": "ctx.local", - "delegation_allowed": true, "policy_epoch": 1 } ], - "authority_grants": [], "records": [], "requests": [] }, @@ -62,9 +59,9 @@ ], "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, - "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "initial_authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "previous_terminal_record_digest": null, - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution_id": "res.1" } } @@ -73,14 +70,14 @@ "kind": "SUBMIT_RESOLUTION", "payload": { "record": { + "authority_evidence_digests": [], "authority_id": "authority.root", - "authority_proof_digests": [], "basis_digests": [ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:036914e827dcd520081da16232f409942e0f768d343b44e03079f2f73f749ae8", - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "record_digest": "sha256:4f32a4864d57c647b1761a084507ce9c081bc257ac9ba4cd7f066a5598083499", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution": "ALLOW", "resolution_id": "res.1" } diff --git a/seed/canonical/conformance/cases/negative/RES-NEG-012.json b/seed/canonical/conformance/cases/negative/RES-NEG-012.json index 66f8e42..e83f448 100644 --- a/seed/canonical/conformance/cases/negative/RES-NEG-012.json +++ b/seed/canonical/conformance/cases/negative/RES-NEG-012.json @@ -13,9 +13,9 @@ ], "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, - "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "initial_authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "previous_terminal_record_digest": "sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff", - "request_digest": "sha256:d3f94d38c625b857cfaf9318e4565c21bf671b4e2cea83c3f1994b2ad4ec6e98", + "request_digest": "sha256:f576a90486dd05617b3c117f3915b405b61185c7eb0bbb9a11f84586743d3e0f", "resolution_id": "res.2" } } @@ -33,16 +33,13 @@ "initial_store": { "authority_bindings": [ { - "authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "authority_id": "authority.root", "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "constitution_digest": "sha256:9999999999999999999999999999999999999999999999999999999999999999", "context_id": "ctx.local", - "delegation_allowed": true, "policy_epoch": 1 } ], - "authority_grants": [], "records": [], "requests": [] }, diff --git a/seed/canonical/conformance/cases/negative/RES-NEG-013.json b/seed/canonical/conformance/cases/negative/RES-NEG-013.json index 01df253..bbc17d4 100644 --- a/seed/canonical/conformance/cases/negative/RES-NEG-013.json +++ b/seed/canonical/conformance/cases/negative/RES-NEG-013.json @@ -13,9 +13,9 @@ ], "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, - "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "initial_authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "previous_terminal_record_digest": "sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff", - "request_digest": "sha256:d3f94d38c625b857cfaf9318e4565c21bf671b4e2cea83c3f1994b2ad4ec6e98", + "request_digest": "sha256:f576a90486dd05617b3c117f3915b405b61185c7eb0bbb9a11f84586743d3e0f", "resolution_id": "res.2" } } @@ -33,22 +33,19 @@ "initial_store": { "authority_bindings": [ { - "authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "authority_id": "authority.root", "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "constitution_digest": "sha256:9999999999999999999999999999999999999999999999999999999999999999", "context_id": "ctx.local", - "delegation_allowed": true, "policy_epoch": 1 } ], - "authority_grants": [], "records": [], "requests": [] }, + "postconditions": [], "recognized_terminal_record_digests": [ "sha256:036914e827dcd520081da16232f409942e0f768d343b44e03079f2f73f749ae8" ], - "postconditions": [], "setup": [] } diff --git a/seed/canonical/conformance/cases/negative/RES-NEG-014.json b/seed/canonical/conformance/cases/negative/RES-NEG-014.json index 62f4dda..5f31741 100644 --- a/seed/canonical/conformance/cases/negative/RES-NEG-014.json +++ b/seed/canonical/conformance/cases/negative/RES-NEG-014.json @@ -18,26 +18,23 @@ "initial_store": { "authority_bindings": [ { - "authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "authority_id": "authority.root", "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "constitution_digest": "sha256:9999999999999999999999999999999999999999999999999999999999999999", "context_id": "ctx.local", - "delegation_allowed": true, "policy_epoch": 1 } ], - "authority_grants": [], "records": [ { + "authority_evidence_digests": [], "authority_id": "authority.remote", - "authority_proof_digests": [], "basis_digests": [ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:542798c17991ade141d5e38f4cd900a2776a9c522340a29622d7aa0a32d3134d", - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "record_digest": "sha256:20f9eb1547646f68b1cc889d77f916b89823ad27aa8fe8ed6927d8605ff17e18", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution": "ALLOW", "resolution_id": "res.1" } @@ -54,9 +51,9 @@ ], "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, - "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "initial_authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "previous_terminal_record_digest": null, - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution_id": "res.1" } ] diff --git a/seed/canonical/conformance/cases/negative/RES-NEG-015.json b/seed/canonical/conformance/cases/negative/RES-NEG-015.json index 98f3e2a..8043995 100644 --- a/seed/canonical/conformance/cases/negative/RES-NEG-015.json +++ b/seed/canonical/conformance/cases/negative/RES-NEG-015.json @@ -18,38 +18,35 @@ "initial_store": { "authority_bindings": [ { - "authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "authority_id": "authority.root", "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "constitution_digest": "sha256:9999999999999999999999999999999999999999999999999999999999999999", "context_id": "ctx.local", - "delegation_allowed": true, "policy_epoch": 1 } ], - "authority_grants": [], "records": [ { + "authority_evidence_digests": [], "authority_id": "authority.root", - "authority_proof_digests": [], "basis_digests": [ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:036914e827dcd520081da16232f409942e0f768d343b44e03079f2f73f749ae8", - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "record_digest": "sha256:4f32a4864d57c647b1761a084507ce9c081bc257ac9ba4cd7f066a5598083499", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution": "ALLOW", "resolution_id": "res.1" }, { + "authority_evidence_digests": [], "authority_id": "authority.root", - "authority_proof_digests": [], "basis_digests": [ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:16f9e0b7709be009f3b00039f2b8cecb68932bca18ce9ceca099f44a3b32c2f5", - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "record_digest": "sha256:203822912499460c097e98c0c63569965609cc77be909e4b30b5639748a6804e", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution": "BLOCK", "resolution_id": "res.1" } @@ -66,9 +63,9 @@ ], "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, - "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "initial_authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "previous_terminal_record_digest": null, - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution_id": "res.1" } ] diff --git a/seed/canonical/conformance/cases/negative/RES-NEG-016.json b/seed/canonical/conformance/cases/negative/RES-NEG-016.json index 9e8ad20..2bab6fb 100644 --- a/seed/canonical/conformance/cases/negative/RES-NEG-016.json +++ b/seed/canonical/conformance/cases/negative/RES-NEG-016.json @@ -3,27 +3,27 @@ "kind": "SUBMIT_RESOLUTION", "payload": { "record": { - "authority_id": "authority.unreachable", - "authority_proof_digests": [ + "authority_evidence_digests": [ "sha256:4e8eda2117648c7c437e51dec3a6d061d22b2f45c5ef0013b7b3034cced4d449", "sha256:c90de3c15e44bd9afbe9c4cecee097a8dc4fb3fae41c65cd73374e43ac57d371" ], + "authority_id": "authority.unreachable", "basis_digests": [ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:1f2ba03c380a63d9a357490aa9fda948a719bf8106655804ca9d3e79432d299d", - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "record_digest": "sha256:e78a6552474c3a5a0c4f01262b6b27cb3c75ccf624e3a8c82dbd5b910ed2f145", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution": "ALLOW", "resolution_id": "res.1" } } }, "case_id": "RES-NEG-016", - "description": "Reject a delegated Authority proof containing a cycle back to the local root.", + "description": "Unrecognized Authority remains invalid even when opaque Authority evidence is supplied.", "expected": { "accepted": false, - "code": "AUTHORITY_GRANT_CYCLE", + "code": "TERMINAL_AUTHORITY_UNRECOGNIZED", "effect_permitted": false, "reason": "TERMINAL_RECORD_ABSENT", "resolution": "UNKNOWN", @@ -32,33 +32,13 @@ "initial_store": { "authority_bindings": [ { - "authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "authority_id": "authority.root", "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "constitution_digest": "sha256:9999999999999999999999999999999999999999999999999999999999999999", "context_id": "ctx.local", - "delegation_allowed": true, "policy_epoch": 1 } ], - "authority_grants": [ - { - "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "delegation_allowed": true, - "grant_digest": "sha256:4e8eda2117648c7c437e51dec3a6d061d22b2f45c5ef0013b7b3034cced4d449", - "issuer_authority_id": "authority.root", - "previous_grant_digest": null, - "subject_authority_id": "authority.delegate" - }, - { - "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "delegation_allowed": false, - "grant_digest": "sha256:c90de3c15e44bd9afbe9c4cecee097a8dc4fb3fae41c65cd73374e43ac57d371", - "issuer_authority_id": "authority.delegate", - "previous_grant_digest": "sha256:4e8eda2117648c7c437e51dec3a6d061d22b2f45c5ef0013b7b3034cced4d449", - "subject_authority_id": "authority.root" - } - ], "records": [], "requests": [] }, @@ -78,9 +58,9 @@ ], "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, - "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "initial_authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "previous_terminal_record_digest": null, - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution_id": "res.1" } } diff --git a/seed/canonical/conformance/cases/positive/RES-POS-001.json b/seed/canonical/conformance/cases/positive/RES-POS-001.json index b87ff13..55e99a3 100644 --- a/seed/canonical/conformance/cases/positive/RES-POS-001.json +++ b/seed/canonical/conformance/cases/positive/RES-POS-001.json @@ -13,9 +13,9 @@ ], "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, - "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "initial_authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "previous_terminal_record_digest": null, - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution_id": "res.1" } } @@ -33,16 +33,13 @@ "initial_store": { "authority_bindings": [ { - "authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "authority_id": "authority.root", "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "constitution_digest": "sha256:9999999999999999999999999999999999999999999999999999999999999999", "context_id": "ctx.local", - "delegation_allowed": true, "policy_epoch": 1 } ], - "authority_grants": [], "records": [], "requests": [] }, diff --git a/seed/canonical/conformance/cases/positive/RES-POS-002.json b/seed/canonical/conformance/cases/positive/RES-POS-002.json index 837bf0b..b8575b0 100644 --- a/seed/canonical/conformance/cases/positive/RES-POS-002.json +++ b/seed/canonical/conformance/cases/positive/RES-POS-002.json @@ -3,14 +3,14 @@ "kind": "SUBMIT_RESOLUTION", "payload": { "record": { + "authority_evidence_digests": [], "authority_id": "authority.root", - "authority_proof_digests": [], "basis_digests": [ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:036914e827dcd520081da16232f409942e0f768d343b44e03079f2f73f749ae8", - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "record_digest": "sha256:4f32a4864d57c647b1761a084507ce9c081bc257ac9ba4cd7f066a5598083499", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution": "ALLOW", "resolution_id": "res.1" } @@ -29,16 +29,13 @@ "initial_store": { "authority_bindings": [ { - "authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "authority_id": "authority.root", "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "constitution_digest": "sha256:9999999999999999999999999999999999999999999999999999999999999999", "context_id": "ctx.local", - "delegation_allowed": true, "policy_epoch": 1 } ], - "authority_grants": [], "records": [], "requests": [] }, @@ -63,9 +60,9 @@ ], "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, - "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "initial_authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "previous_terminal_record_digest": null, - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution_id": "res.1" } } diff --git a/seed/canonical/conformance/cases/positive/RES-POS-003.json b/seed/canonical/conformance/cases/positive/RES-POS-003.json index b423300..068854a 100644 --- a/seed/canonical/conformance/cases/positive/RES-POS-003.json +++ b/seed/canonical/conformance/cases/positive/RES-POS-003.json @@ -3,14 +3,14 @@ "kind": "SUBMIT_RESOLUTION", "payload": { "record": { + "authority_evidence_digests": [], "authority_id": "authority.root", - "authority_proof_digests": [], "basis_digests": [ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:16f9e0b7709be009f3b00039f2b8cecb68932bca18ce9ceca099f44a3b32c2f5", - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "record_digest": "sha256:203822912499460c097e98c0c63569965609cc77be909e4b30b5639748a6804e", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution": "BLOCK", "resolution_id": "res.1" } @@ -29,16 +29,13 @@ "initial_store": { "authority_bindings": [ { - "authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "authority_id": "authority.root", "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "constitution_digest": "sha256:9999999999999999999999999999999999999999999999999999999999999999", "context_id": "ctx.local", - "delegation_allowed": true, "policy_epoch": 1 } ], - "authority_grants": [], "records": [], "requests": [] }, @@ -63,9 +60,9 @@ ], "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, - "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "initial_authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "previous_terminal_record_digest": null, - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution_id": "res.1" } } diff --git a/seed/canonical/conformance/cases/positive/RES-POS-004.json b/seed/canonical/conformance/cases/positive/RES-POS-004.json index df1506a..1a170e8 100644 --- a/seed/canonical/conformance/cases/positive/RES-POS-004.json +++ b/seed/canonical/conformance/cases/positive/RES-POS-004.json @@ -3,16 +3,16 @@ "kind": "SUBMIT_RESOLUTION", "payload": { "record": { - "authority_id": "authority.delegate", - "authority_proof_digests": [ + "authority_evidence_digests": [ "sha256:111da21dcd5fbb1d9d51bea977d06427e6788e58bd02d1701c84ea795f85295e" ], + "authority_id": "authority.delegate", "basis_digests": [ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:0de2f1ecfe293f0823d3126396d1480d3e8d022cd7e3745691d3616b4c053a25", - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "record_digest": "sha256:2a775efb4cfcfd30987d696e9f78cff22d82a2363d9215340a189d72762d64eb", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution": "ALLOW", "resolution_id": "res.1" } @@ -31,23 +31,18 @@ "initial_store": { "authority_bindings": [ { - "authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "authority_id": "authority.root", "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "constitution_digest": "sha256:9999999999999999999999999999999999999999999999999999999999999999", "context_id": "ctx.local", - "delegation_allowed": true, "policy_epoch": 1 - } - ], - "authority_grants": [ + }, { + "authority_binding_digest": "sha256:ade3e1c84838571c58b423fc8b4d539c68404c74d2b69d7dc4f63380e5e9f64b", + "authority_id": "authority.delegate", "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "delegation_allowed": false, - "grant_digest": "sha256:111da21dcd5fbb1d9d51bea977d06427e6788e58bd02d1701c84ea795f85295e", - "issuer_authority_id": "authority.root", - "previous_grant_digest": null, - "subject_authority_id": "authority.delegate" + "context_id": "ctx.local", + "policy_epoch": 1 } ], "records": [], @@ -74,9 +69,9 @@ ], "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, - "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "initial_authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "previous_terminal_record_digest": null, - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution_id": "res.1" } } diff --git a/seed/canonical/conformance/cases/positive/RES-POS-005.json b/seed/canonical/conformance/cases/positive/RES-POS-005.json index 6da7e02..983f6aa 100644 --- a/seed/canonical/conformance/cases/positive/RES-POS-005.json +++ b/seed/canonical/conformance/cases/positive/RES-POS-005.json @@ -3,24 +3,24 @@ "kind": "SUBMIT_RESOLUTION", "payload": { "record": { - "authority_id": "authority.final", - "authority_proof_digests": [ + "authority_evidence_digests": [ "sha256:4e8eda2117648c7c437e51dec3a6d061d22b2f45c5ef0013b7b3034cced4d449", "sha256:7029ae832bea27db5ad915ed05929ec7f81a4fd4d46c11f4dcf3eba352979c42" ], + "authority_id": "authority.final", "basis_digests": [ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:d6ab5a2233834429d3007bb0e3595327f39433f00b603b61c20cef6e23616db1", - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "record_digest": "sha256:9bde7274f2d2f06351adc4d7cc618582b569b35c08e53df7aa8e0db79898283b", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution": "ALLOW", "resolution_id": "res.1" } } }, "case_id": "RES-POS-005", - "description": "Record ALLOW through a two-hop attenuating Authority proof.", + "description": "Record ALLOW using an Authority that is explicitly recognized for the exact binding; evidence references remain opaque.", "expected": { "accepted": true, "code": "RESOLUTION_RECORDED", @@ -32,31 +32,18 @@ "initial_store": { "authority_bindings": [ { - "authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "authority_id": "authority.root", "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "constitution_digest": "sha256:9999999999999999999999999999999999999999999999999999999999999999", "context_id": "ctx.local", - "delegation_allowed": true, "policy_epoch": 1 - } - ], - "authority_grants": [ - { - "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "delegation_allowed": true, - "grant_digest": "sha256:4e8eda2117648c7c437e51dec3a6d061d22b2f45c5ef0013b7b3034cced4d449", - "issuer_authority_id": "authority.root", - "previous_grant_digest": null, - "subject_authority_id": "authority.delegate" }, { + "authority_binding_digest": "sha256:65e063b22ed629905303f0c6d6759718e429cd565cdb13767e9e862a179a9a8d", + "authority_id": "authority.final", "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "delegation_allowed": false, - "grant_digest": "sha256:7029ae832bea27db5ad915ed05929ec7f81a4fd4d46c11f4dcf3eba352979c42", - "issuer_authority_id": "authority.delegate", - "previous_grant_digest": "sha256:4e8eda2117648c7c437e51dec3a6d061d22b2f45c5ef0013b7b3034cced4d449", - "subject_authority_id": "authority.final" + "context_id": "ctx.local", + "policy_epoch": 1 } ], "records": [], @@ -83,9 +70,9 @@ ], "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, - "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "initial_authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "previous_terminal_record_digest": null, - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution_id": "res.1" } } diff --git a/seed/canonical/conformance/cases/positive/RES-POS-006.json b/seed/canonical/conformance/cases/positive/RES-POS-006.json index 2e82145..6fbba29 100644 --- a/seed/canonical/conformance/cases/positive/RES-POS-006.json +++ b/seed/canonical/conformance/cases/positive/RES-POS-006.json @@ -18,16 +18,13 @@ "initial_store": { "authority_bindings": [ { - "authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "authority_id": "authority.root", "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "constitution_digest": "sha256:9999999999999999999999999999999999999999999999999999999999999999", "context_id": "ctx.local", - "delegation_allowed": true, "policy_epoch": 1 } ], - "authority_grants": [], "records": [], "requests": [] }, @@ -47,9 +44,9 @@ ], "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, - "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "initial_authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "previous_terminal_record_digest": null, - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution_id": "res.1" } } diff --git a/seed/canonical/conformance/cases/positive/RES-POS-007.json b/seed/canonical/conformance/cases/positive/RES-POS-007.json index 9d41dc3..65ade66 100644 --- a/seed/canonical/conformance/cases/positive/RES-POS-007.json +++ b/seed/canonical/conformance/cases/positive/RES-POS-007.json @@ -3,14 +3,14 @@ "kind": "SUBMIT_RESOLUTION", "payload": { "record": { + "authority_evidence_digests": [], "authority_id": "authority.root", - "authority_proof_digests": [], "basis_digests": [ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:036914e827dcd520081da16232f409942e0f768d343b44e03079f2f73f749ae8", - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "record_digest": "sha256:4f32a4864d57c647b1761a084507ce9c081bc257ac9ba4cd7f066a5598083499", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution": "ALLOW", "resolution_id": "res.1" } @@ -29,16 +29,13 @@ "initial_store": { "authority_bindings": [ { - "authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "authority_id": "authority.root", "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "constitution_digest": "sha256:9999999999999999999999999999999999999999999999999999999999999999", "context_id": "ctx.local", - "delegation_allowed": true, "policy_epoch": 1 } ], - "authority_grants": [], "records": [], "requests": [] }, @@ -63,9 +60,9 @@ ], "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, - "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "initial_authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "previous_terminal_record_digest": null, - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution_id": "res.1" } } @@ -74,14 +71,14 @@ "kind": "SUBMIT_RESOLUTION", "payload": { "record": { + "authority_evidence_digests": [], "authority_id": "authority.root", - "authority_proof_digests": [], "basis_digests": [ "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" ], "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "record_digest": "sha256:036914e827dcd520081da16232f409942e0f768d343b44e03079f2f73f749ae8", - "request_digest": "sha256:eb016dbdaa1f95ae99f9e0f8dd8dd54865e951e39140e4df2afa3eb0e1b70e92", + "record_digest": "sha256:4f32a4864d57c647b1761a084507ce9c081bc257ac9ba4cd7f066a5598083499", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", "resolution": "ALLOW", "resolution_id": "res.1" } diff --git a/seed/canonical/conformance/cases/positive/RES-POS-008.json b/seed/canonical/conformance/cases/positive/RES-POS-008.json index 551f533..584e3c7 100644 --- a/seed/canonical/conformance/cases/positive/RES-POS-008.json +++ b/seed/canonical/conformance/cases/positive/RES-POS-008.json @@ -13,9 +13,9 @@ ], "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" }, - "initial_authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "initial_authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "previous_terminal_record_digest": "sha256:036914e827dcd520081da16232f409942e0f768d343b44e03079f2f73f749ae8", - "request_digest": "sha256:cc40394a0dffa9731c978aa946e9660af8b34f7059d2d76cfde3f7657ffbf310", + "request_digest": "sha256:b5431b0f5656735751694d9844579e1731a848cc870af128f748000e1932f0c5", "resolution_id": "res.2" } } @@ -33,27 +33,24 @@ "initial_store": { "authority_bindings": [ { - "authority_binding_digest": "sha256:e330f53f77a7adc81a4f37ede069effea59a1267ad4407b3b241bf9ce7b79730", + "authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", "authority_id": "authority.root", "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", - "constitution_digest": "sha256:9999999999999999999999999999999999999999999999999999999999999999", "context_id": "ctx.local", - "delegation_allowed": true, "policy_epoch": 1 } ], - "authority_grants": [], "records": [], "requests": [] }, - "recognized_terminal_record_digests": [ - "sha256:036914e827dcd520081da16232f409942e0f768d343b44e03079f2f73f749ae8" - ], "postconditions": [ { "equals": "sha256:036914e827dcd520081da16232f409942e0f768d343b44e03079f2f73f749ae8", "path": "/requests/0/previous_terminal_record_digest" } ], + "recognized_terminal_record_digests": [ + "sha256:036914e827dcd520081da16232f409942e0f768d343b44e03079f2f73f749ae8" + ], "setup": [] } diff --git a/seed/canonical/conformance/cases/positive/RES-POS-009.json b/seed/canonical/conformance/cases/positive/RES-POS-009.json new file mode 100644 index 0000000..6a16318 --- /dev/null +++ b/seed/canonical/conformance/cases/positive/RES-POS-009.json @@ -0,0 +1,75 @@ +{ + "candidate": { + "kind": "EVALUATE_RESOLUTION", + "payload": { + "resolution_id": "res.1" + } + }, + "case_id": "RES-POS-009", + "description": "A unique valid ALLOW remains authoritative when additional malformed terminal material is present.", + "expected": { + "accepted": true, + "code": "EVALUATED", + "effect_permitted": true, + "reason": "UNIQUE_VALID_TERMINAL_RECORD", + "resolution": "ALLOW", + "state_changed": false + }, + "initial_store": { + "authority_bindings": [ + { + "authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", + "authority_id": "authority.root", + "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", + "context_id": "ctx.local", + "policy_epoch": 1 + } + ], + "records": [ + { + "authority_evidence_digests": [], + "authority_id": "authority.root", + "basis_digests": [ + "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" + ], + "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", + "record_digest": "sha256:4f32a4864d57c647b1761a084507ce9c081bc257ac9ba4cd7f066a5598083499", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", + "resolution": "ALLOW", + "resolution_id": "res.1" + }, + { + "authority_evidence_digests": [], + "authority_id": "authority.root", + "basis_digests": [ + "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" + ], + "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", + "record_digest": "sha256:ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff", + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", + "resolution": "ALLOW", + "resolution_id": "res.1" + } + ], + "requests": [ + { + "binding": { + "binding_digest": "sha256:beabd05fc065bec06af622d23f9c9e45909c1b9d9970fdecf609d10a5efe8c15", + "context_id": "ctx.local", + "policy_epoch": 1, + "question_digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb", + "scope": [ + "effect:publish" + ], + "state_root": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + }, + "initial_authority_binding_digest": "sha256:da5da8d35eda73a672311a29bd9b27f75127f10d2817cbdb2171edbc7f61fa8f", + "previous_terminal_record_digest": null, + "request_digest": "sha256:b4be857c41ad7a5884cde2b5b8e78b6f318d7c3b7f10b28b9fe7974446f7e766", + "resolution_id": "res.1" + } + ] + }, + "postconditions": [], + "setup": [] +} diff --git a/seed/canonical/conformance/conformance-profile.json b/seed/canonical/conformance/conformance-profile.json index 4c233c8..90af44d 100644 --- a/seed/canonical/conformance/conformance-profile.json +++ b/seed/canonical/conformance/conformance-profile.json @@ -1,5 +1,5 @@ { - "case_count": 24, + "case_count": 25, "cases": [ { "case_id": "RES-NEG-001", @@ -13,7 +13,7 @@ }, "path": "seed/canonical/conformance/cases/negative/RES-NEG-001.json", "polarity": "negative", - "sha256": "sha256:3352af05c6a51a02aef9c94639fe43903c22969f3d9a8e2836f23fce065507a7" + "sha256": "sha256:e5688046d1ccc8cafffb0520aa044a2f37f1ca3a4df7325052661213d6ba15fc" }, { "case_id": "RES-NEG-002", @@ -27,7 +27,7 @@ }, "path": "seed/canonical/conformance/cases/negative/RES-NEG-002.json", "polarity": "negative", - "sha256": "sha256:ee69ab8301eea93cf52ab45114e56922f620e8aad8d4f621bbc98b6cf040cfa9" + "sha256": "sha256:ca9b2b633ae32bffefdd3d8939e9614917e8cd04cafb7813c547f641122949ce" }, { "case_id": "RES-NEG-003", @@ -41,7 +41,7 @@ }, "path": "seed/canonical/conformance/cases/negative/RES-NEG-003.json", "polarity": "negative", - "sha256": "sha256:4318727895ac37e61933c6686e785351211acdda10dd9c6f19f6c69f37820eac" + "sha256": "sha256:0a71111771482553160e98363d6f8773c965697cd9325673ed82ba64cc8c85f7" }, { "case_id": "RES-NEG-004", @@ -55,7 +55,7 @@ }, "path": "seed/canonical/conformance/cases/negative/RES-NEG-004.json", "polarity": "negative", - "sha256": "sha256:22b06e4c5bfac480dfddbba7a52370b7fdf104da371fe65dc3e8a928fed9b02c" + "sha256": "sha256:e30ce83892f1c90f546e7410596a8f35936622f999efebb172b83d08f8fe181c" }, { "case_id": "RES-NEG-005", @@ -69,7 +69,7 @@ }, "path": "seed/canonical/conformance/cases/negative/RES-NEG-005.json", "polarity": "negative", - "sha256": "sha256:15e6d3059b4d769eabb5a166d350509b23ec359856eb4c0bae2c9f975377af07" + "sha256": "sha256:52a9c7253bfb886dcc2b091b643fa36a75f3d96ae01e89d5c6621c8552de9d9a" }, { "case_id": "RES-NEG-006", @@ -83,13 +83,13 @@ }, "path": "seed/canonical/conformance/cases/negative/RES-NEG-006.json", "polarity": "negative", - "sha256": "sha256:4fcce1e7ebf701e5e994606320cb86a0129193154a33ee63792ee669419fbfec" + "sha256": "sha256:03d11760f4abe91ed1913933600097f52babf57a76984a6ff5d75b4f0ff386ce" }, { "case_id": "RES-NEG-007", "expected": { "accepted": false, - "code": "AUTHORITY_GRANT_INVALID", + "code": "TERMINAL_AUTHORITY_UNRECOGNIZED", "effect_permitted": false, "reason": "TERMINAL_RECORD_ABSENT", "resolution": "UNKNOWN", @@ -97,13 +97,13 @@ }, "path": "seed/canonical/conformance/cases/negative/RES-NEG-007.json", "polarity": "negative", - "sha256": "sha256:e95d67c12b028b328c538fb83cf00a01946734acc5048fd1035f3c2eeb9f8ff2" + "sha256": "sha256:24774174dc294a03106711abeb39c0ef4f776ecca89b8b41d0e6dff21c42b2ab" }, { "case_id": "RES-NEG-008", "expected": { "accepted": false, - "code": "AUTHORITY_GRANT_BINDING_MISMATCH", + "code": "TERMINAL_AUTHORITY_BINDING_MISMATCH", "effect_permitted": false, "reason": "TERMINAL_RECORD_ABSENT", "resolution": "UNKNOWN", @@ -111,13 +111,13 @@ }, "path": "seed/canonical/conformance/cases/negative/RES-NEG-008.json", "polarity": "negative", - "sha256": "sha256:783d86ab36bbcb1bdbad0d16c0481ea448d46c67b3501e1a76abfc828e7dde2f" + "sha256": "sha256:fcbdef8907d41df526a388217a234c6e966adbce259924bf60027a14aaa418cb" }, { "case_id": "RES-NEG-009", "expected": { "accepted": false, - "code": "UNEXPECTED_AUTHORITY_PROOF", + "code": "TERMINAL_AUTHORITY_UNRECOGNIZED", "effect_permitted": false, "reason": "TERMINAL_RECORD_ABSENT", "resolution": "UNKNOWN", @@ -125,7 +125,7 @@ }, "path": "seed/canonical/conformance/cases/negative/RES-NEG-009.json", "polarity": "negative", - "sha256": "sha256:2ff892ee2e91c8d5c117a0990157f326d602876cda637f9a34eda454fee41b9f" + "sha256": "sha256:b7342e2b2ebd187ddaf0b02ff925f27f4f00d42eb079667620e745bf8e3e74a5" }, { "case_id": "RES-NEG-010", @@ -139,7 +139,7 @@ }, "path": "seed/canonical/conformance/cases/negative/RES-NEG-010.json", "polarity": "negative", - "sha256": "sha256:184aaf7b609ab4ab6947b2b1df68bde7facacd7b0b5452973a73f7e998d3f8a2" + "sha256": "sha256:0d0dc5feddea9bf480b0f1ab5c4a43ef61967f53ed615ffa3cb8b1720b1e79e9" }, { "case_id": "RES-NEG-011", @@ -153,7 +153,7 @@ }, "path": "seed/canonical/conformance/cases/negative/RES-NEG-011.json", "polarity": "negative", - "sha256": "sha256:675d861e51f13df1c5ec10ad6ddc4909c827f7e893fb3485471023130175f123" + "sha256": "sha256:94d472765378007e09ccf295a46ad1d244e2d34accd17bd2b8d33eb8d9c223e4" }, { "case_id": "RES-NEG-012", @@ -167,7 +167,7 @@ }, "path": "seed/canonical/conformance/cases/negative/RES-NEG-012.json", "polarity": "negative", - "sha256": "sha256:9c16ba5f4d95d959f1f4419fb2b646202204448fde49ac2669e0a5839c7a10a8" + "sha256": "sha256:be05dfafb0ff2c0dda6eb91f01425d57a4940c1c5716dd8089512337a93ec4fb" }, { "case_id": "RES-NEG-013", @@ -181,7 +181,7 @@ }, "path": "seed/canonical/conformance/cases/negative/RES-NEG-013.json", "polarity": "negative", - "sha256": "sha256:f36aa4d3809a20c9842eac49c7aed6b31a916a8c089d376e83b0c29023863604" + "sha256": "sha256:84e3849b6c1f9ebec704385974f065bbee233d48abfd5819521d97c2814910a0" }, { "case_id": "RES-NEG-014", @@ -195,7 +195,7 @@ }, "path": "seed/canonical/conformance/cases/negative/RES-NEG-014.json", "polarity": "negative", - "sha256": "sha256:822f9b125bdb8ebbd50288b7360108c9657791caca7638a3d25ee4d095b249ee" + "sha256": "sha256:3716a2847f9c31788d2d705629b036d53b8646404be135922e64f61de8fad5ea" }, { "case_id": "RES-NEG-015", @@ -209,13 +209,13 @@ }, "path": "seed/canonical/conformance/cases/negative/RES-NEG-015.json", "polarity": "negative", - "sha256": "sha256:49990c7ca0564af284139ad4ce276ecd33d7f3d05a4f3094449ea87e93825809" + "sha256": "sha256:fd697dbb671d55d99bab8cedc87d81bca1d312d3e542b8fd297f2f4583021ca7" }, { "case_id": "RES-NEG-016", "expected": { "accepted": false, - "code": "AUTHORITY_GRANT_CYCLE", + "code": "TERMINAL_AUTHORITY_UNRECOGNIZED", "effect_permitted": false, "reason": "TERMINAL_RECORD_ABSENT", "resolution": "UNKNOWN", @@ -223,7 +223,7 @@ }, "path": "seed/canonical/conformance/cases/negative/RES-NEG-016.json", "polarity": "negative", - "sha256": "sha256:90741b3701cd8e9ec043e978ba1f7bbb22b349ef04f425605f019bf599774311" + "sha256": "sha256:2834c82838393611694ceb7171cdbb406d39bfba60a0fa6d5cb01c1b02e4f0f5" }, { "case_id": "RES-POS-001", @@ -237,7 +237,7 @@ }, "path": "seed/canonical/conformance/cases/positive/RES-POS-001.json", "polarity": "positive", - "sha256": "sha256:60585b00221d867f21ea98fe198b4d35f2acdf56118de3ab7403a8a6c3c1b9c7" + "sha256": "sha256:661cd889e7b091ed6dc969c17dd5934a6104d1919a108b790c3ffdcf1cf5a322" }, { "case_id": "RES-POS-002", @@ -251,7 +251,7 @@ }, "path": "seed/canonical/conformance/cases/positive/RES-POS-002.json", "polarity": "positive", - "sha256": "sha256:06e6f20764094764047c1b68404b30b135505214003082d52c2896d4d82c2f5c" + "sha256": "sha256:916fc7a3bcc353612e1c4a09882e24f20e41e2a8ca3f8dfff2b3613a97b3f215" }, { "case_id": "RES-POS-003", @@ -265,7 +265,7 @@ }, "path": "seed/canonical/conformance/cases/positive/RES-POS-003.json", "polarity": "positive", - "sha256": "sha256:92f21b9d2efe2ecc2e3c11ec72f1969ebd78d48b91b39c1f2aa096c475766cfa" + "sha256": "sha256:c77ea28272320c3bd7a8e240b896ac4d21923b32ce5ccc0704f84797cfaa5665" }, { "case_id": "RES-POS-004", @@ -279,7 +279,7 @@ }, "path": "seed/canonical/conformance/cases/positive/RES-POS-004.json", "polarity": "positive", - "sha256": "sha256:a687f38d83674d2d3a92372be3048860463da19542ca74b2024d61d8361e9ffc" + "sha256": "sha256:dcf5f81b0e60f2aa0c157aab5297177d3f082544d64a54081d83e9d7d6093763" }, { "case_id": "RES-POS-005", @@ -293,7 +293,7 @@ }, "path": "seed/canonical/conformance/cases/positive/RES-POS-005.json", "polarity": "positive", - "sha256": "sha256:9459583800f64781bcda6e638200a6cb128a7a20aa8d177720966ac70e1d7308" + "sha256": "sha256:7e37edfaeb010ba65dfc197bf60a7bdcf883c41d686eb2ab5ea44de23ee6da0d" }, { "case_id": "RES-POS-006", @@ -307,7 +307,7 @@ }, "path": "seed/canonical/conformance/cases/positive/RES-POS-006.json", "polarity": "positive", - "sha256": "sha256:fded1536ea25f1c32d63907703bc9bccc46e3a74d5205a1ddf86991d2078c7f3" + "sha256": "sha256:e99a01c9d4acf1833697124bf4d75f3d077b80af49c3dc53c73a4d9a245c92fd" }, { "case_id": "RES-POS-007", @@ -321,7 +321,7 @@ }, "path": "seed/canonical/conformance/cases/positive/RES-POS-007.json", "polarity": "positive", - "sha256": "sha256:a309d632b1cd18b986cbe0a2442687fd111158eab72d689b0e266fb7d862d92a" + "sha256": "sha256:4f13d237a0868177d216a31635e8fec220b67cbda9c6fe2419a36aff289663c5" }, { "case_id": "RES-POS-008", @@ -335,14 +335,28 @@ }, "path": "seed/canonical/conformance/cases/positive/RES-POS-008.json", "polarity": "positive", - "sha256": "sha256:b227d0736e9344953a03afa436427bff54a52c6c58089375e16e154baf6fbcd9" + "sha256": "sha256:415e874abf0e1212b542546bfceea41681d9c30252ff7d955e1cfbb214964efb" + }, + { + "case_id": "RES-POS-009", + "expected": { + "accepted": true, + "code": "EVALUATED", + "effect_permitted": true, + "reason": "UNIQUE_VALID_TERMINAL_RECORD", + "resolution": "ALLOW", + "state_changed": false + }, + "path": "seed/canonical/conformance/cases/positive/RES-POS-009.json", + "polarity": "positive", + "sha256": "sha256:b7fd5b2160abe684c05af1408468d94590a9bd45355b87cecb910799f9a852c8" } ], "document_type": "aset-seed-resolution-conformance-profile", "negative_count": 16, - "positive_count": 8, - "profile_id": "ASET-SEED-RESOLUTION-CONFORMANCE-CORPUS-V2", - "protocol": "ASET-SEED-RESOLUTION-CONFORMANCE-V2", - "schema_version": 2, + "positive_count": 9, + "profile_id": "ASET-SEED-RESOLUTION-CONFORMANCE-CORPUS-V3", + "protocol": "ASET-SEED-RESOLUTION-CONFORMANCE-V3", + "schema_version": 3, "seed_version": "0.3.0-alpha.1" } diff --git a/seed/canonical/conformance/implementation-conformance-protocol.json b/seed/canonical/conformance/implementation-conformance-protocol.json index f5e7e64..67c4da2 100644 --- a/seed/canonical/conformance/implementation-conformance-protocol.json +++ b/seed/canonical/conformance/implementation-conformance-protocol.json @@ -63,7 +63,7 @@ ] } }, - "protocol_id": "ASET-SEED-RESOLUTION-CONFORMANCE-V2", + "protocol_id": "ASET-SEED-RESOLUTION-CONFORMANCE-V3", "response_schema_ref": "seed/canonical/schemas/implementation-conformance-envelope.schema.json", "schema_version": 3, "transport": { diff --git a/seed/canonical/conformance/model-based-conformance.json b/seed/canonical/conformance/model-based-conformance.json index aa34a83..53abf70 100644 --- a/seed/canonical/conformance/model-based-conformance.json +++ b/seed/canonical/conformance/model-based-conformance.json @@ -1,14 +1,14 @@ { "document_type": "aset-model-based-conformance", "model": { - "command_set": "REGISTER_REQUEST, SUBMIT_RESOLUTION and EVALUATE_RESOLUTION", + "command_set": "REGISTER_REQUEST and SUBMIT_RESOLUTION are state transitions; EVALUATE_RESOLUTION is a pure observer.", "formal_projection": "seed/canonical/formal/SeedResolution.tla", - "state_set": "Append-only request and terminal-record stores satisfying the minimal Seed invariants", - "transition_relation": "delta(store, operation) appends a valid request or record or evaluates without mutation; invalid and unrecognized candidates are outside the Seed transition relation" + "state_set": "Seed-owned request/terminal metadata plus separate environment conflict observations satisfying the active minimal Seed invariants.", + "transition_relation": "delta(seed_state, environment_state, operation) mutates Seed-owned state only for recognized REGISTER_REQUEST or SUBMIT_RESOLUTION operations; conflict observation changes only environment state; EVALUATE_RESOLUTION observes without mutation." }, "normative": true, "profile_boundary": "Policy evaluation, evidence acquisition, workflow, enforcement, federation, storage and cryptographic mechanisms are extension or implementation responsibilities.", - "resolution_obligation": "UNKNOWN is derived when no unique valid terminal record exists; only one valid locally authorized exact-binding ALLOW record permits the effect.", + "resolution_obligation": "UNKNOWN is derived when no unique valid terminal record can be established or valid terminal material conflicts. Invalid/non-authoritative material cannot override an otherwise unique valid record. Only ALLOW permits the effect.", "schema_version": 3, - "transition_boundary_obligation": "Only recognized Seed transitions may change the canonical store; an invalid or unrecognized candidate MUST NOT become a Seed transition." + "transition_boundary_obligation": "Only recognized Seed state transitions may change Seed-owned state. Environment conflict observation and observer operations do not mutate Seed-owned state; invalid/unrecognized material cannot become accepted state by mere presence." } diff --git a/seed/canonical/decisions/ADR-003-narrow-seed-to-resolution-core.md b/seed/canonical/decisions/ADR-003-narrow-seed-to-resolution-core.md index d73c50a..af0504d 100644 --- a/seed/canonical/decisions/ADR-003-narrow-seed-to-resolution-core.md +++ b/seed/canonical/decisions/ADR-003-narrow-seed-to-resolution-core.md @@ -11,3 +11,7 @@ Execution, Permit consumption, evidence acquisition, attempt journals, Context l ## Compatibility This is a breaking semantic change from 0.1-rc12. Historical bytes and component bridges remain evidence for migration but do not expand the active Seed. + +## Supersession note + +ADR-005 fixed the active resolution algebra to `UNKNOWN | ALLOW | BLOCK`; ADR-009 removed the active escalation/grant-chain interpretation and defined the exact-binding Authority-recognition boundary. The original text above is retained as historical decision context. diff --git a/seed/canonical/decisions/ADR-006-complete-invariant-closure.md b/seed/canonical/decisions/ADR-006-complete-invariant-closure.md index 677d5f4..88ab9c0 100644 --- a/seed/canonical/decisions/ADR-006-complete-invariant-closure.md +++ b/seed/canonical/decisions/ADR-006-complete-invariant-closure.md @@ -61,3 +61,7 @@ natural-language equivalence, concrete Binding/digest construction, implementation refinement or correctness, concrete Authority grant-chain construction, liveness, cryptographic primitive security or external certification. + +## Supersession note + +ADR-009 supersedes the active property-count, state-boundary and Authority grant-chain wording in this historical assurance decision. The active formal property set and Authority boundary are defined by the current verification registry and formal model. diff --git a/seed/canonical/decisions/ADR-008-normalize-seed-state-by-construction.md b/seed/canonical/decisions/ADR-008-normalize-seed-state-by-construction.md index 49d887d..6edabf0 100644 --- a/seed/canonical/decisions/ADR-008-normalize-seed-state-by-construction.md +++ b/seed/canonical/decisions/ADR-008-normalize-seed-state-by-construction.md @@ -2,7 +2,7 @@ ## Status -Accepted for the abstract Seed 0.3 safety projection. This ADR does not change +Superseded in part by ADR-009 for state/environment and Authority-boundary semantics. The representation-normalization decision remains historical context for the abstract Seed 0.3 safety projection. This ADR does not change the normative wire/protocol contract in `seed-model.json`; it reduces the formal representation while preserving its observable resolution semantics. @@ -22,8 +22,7 @@ Make local/validated Authority-binding relations immutable context constants. Represent `requestMeta` and `terminalMeta` as partial functions and derive request/terminal membership directly from their domains. No `NoRequest` or `NoTerminal` sentinel is retained. Do not store an independent -terminal binding; derive it from the immutable request binding. Model invalid -material and non-authoritative inputs as explicit stuttering observations. +terminal binding; derive it from the immutable request binding. Do not retain invalid or non-authoritative material in Seed state. ADR-009 later clarified that these are admission/external-material boundaries rather than artificial TLA stutter actions. ## Consequences @@ -33,7 +32,7 @@ material and non-authoritative inputs as explicit stuttering observations. - initial local Authority need not be duplicated in mutable state after the local-root check; - terminal uniqueness follows from one keyed terminal metadata cell; -- invalid/non-authoritative observation bookkeeping no longer grows state; +- invalid/non-authoritative material is not retained in Seed state; - conflict remains explicit because it changes `ResolutionOf` to `UNKNOWN`; - the formal state space and proof surface are reduced without adding crypto or accumulator assumptions. diff --git a/seed/canonical/decisions/ADR-009-seed-state-environment-observer-and-authority-boundary.md b/seed/canonical/decisions/ADR-009-seed-state-environment-observer-and-authority-boundary.md new file mode 100644 index 0000000..a5a3f38 --- /dev/null +++ b/seed/canonical/decisions/ADR-009-seed-state-environment-observer-and-authority-boundary.md @@ -0,0 +1,56 @@ +# ADR-009 — Separate Seed state, environment observations, observers and Authority recognition + +## Status + +Accepted. Supersedes the state-boundary and Authority-proof wording of ADR-008 +for the active Seed 0.3 model. Historical release bundles are not rewritten. + +## Context + +The minimized formal model had already removed duplicated binding and Authority +maps, but several older descriptions still conflated four different things: + +1. Seed-owned canonical state; +2. environment observations that can change a derived resolution; +3. read-only evaluation operations; +4. concrete evidence/signature/delegation mechanisms used to establish Authority. + +The same legacy also caused the active canon to describe invalid material as if +its mere presence necessarily overrode a unique valid terminal record. That +would permit trivial denial-of-service by injecting malformed material. + +## Decision + +The active Seed boundary is: + +- **Seed-owned mutable state:** `requestMeta` and `terminalMeta`; +- **environment state:** conflict observation only; +- **observer:** `EVALUATE_RESOLUTION` derives `Resolution` and effect permission + and never mutates Seed-owned state; +- **Authority boundary:** Seed consumes an exact-binding local Authority + recognition result. Concrete signatures, delegation chains, credentials and + proof construction are outside Seed semantics; +- **invalid/non-authoritative material:** cannot create Authority, ALLOW or a + valid conflict, and cannot override an otherwise unique valid terminal record; +- **conflict:** means conflict between valid terminal material and therefore + derives `UNKNOWN`. + +The canonical TLA projection is standalone. It does not import the handwritten +`SeedResolution` model. Behavioral equivalence is proved by explicit +instantiation in `SeedCanonRefinementProofs.tla`. + +## Consequences + +- `SeedStateChangesOnlyByRecognizedTransition` applies specifically to + Seed-owned state, not environment state. +- `ConflictObservationPreservesSeedState` makes the environment boundary + explicit. +- invalid and non-authoritative material have no TLA state slot or artificial + stutter transition; their treatment is an admission/executable boundary. +- `EVALUATE_RESOLUTION` is an observer, not a transition in `Next`. +- concrete Authority grant-chain schemas are not part of the active 0.3 + protocol profile. +- finite Python model checking runs to saturation rather than relying on an + arbitrary depth bound. +- assurance metadata distinguishes TLA-proved properties from partial external + boundaries instead of claiming full formal coverage of concrete mechanisms. diff --git a/seed/canonical/formal/README.md b/seed/canonical/formal/README.md index a1dfe22..50b4109 100644 --- a/seed/canonical/formal/README.md +++ b/seed/canonical/formal/README.md @@ -1,89 +1,63 @@ -# ASET Seed formal safety projection - -`SeedResolution.tla` is the abstract formal projection of the Seed 0.3 -minimal resolution-recognition kernel. - -The model covers: - -- the closed resolution domain `UNKNOWN | ALLOW | BLOCK`; -- sound and fail-closed effect permission; -- exact request/record binding by construction: accepted terminal state derives binding from immutable request metadata; -- local Authority roots; -- an abstract validated delegated-Authority predicate; -- non-authoritative external inputs as explicit semantic stutters with no retained state slot; -- explicit conflict handling and invalid-material admission as a semantic stutter; -- fresh reconsideration through recognized immutable terminal commitments without predecessor-object retention; -- append-only request identity; -- immutable terminal records; -- exclusion of invalid or unrecognized candidates from the Seed transition relation; -- canonical-state changes only through recognized Seed transitions. - -`SeedResolution.cfg` drives bounded TLC checking of eleven state invariants -and five temporal safety properties. The Python bounded explorer checks the -same registered property names and validates bounded transition preservation. - - -The formal state is intentionally normalized to three variables: - -- `requestMeta`: a partial function containing one immutable metadata cell per registered `resolution_id`; -- `terminalMeta`: a partial function containing one accepted metadata cell per terminal `resolution_id`; -- `conflicts`: the only retained environment observation because it changes resolution semantics. - -`LocalAuthorityBindings` and `AuthorityProofBindings` are immutable context -constants. `requestBinding`, `requestAuthority`, `terminalBinding`, -`terminalAuthority`, `invalidMaterial` and `observedInputs` are not independent -state components. `Requests` and `TerminalRequests` are the domains of the two -metadata functions; absence uses no sentinel value. This removes representable -disagreement and mixed-type states instead of merely adding invariants that forbid -them. - -`SeedResolutionProofs.tla` provides the unbounded deductive safety layer. -Its final theorems establish: - -- `Spec => []SeedStateSafety`; -- `Spec => RequestsAppendOnly`; -- `Spec => TerminalRecordsImmutable`; -- `Spec => CanonicalStateChangesOnlyByRecognizedTransition`; -- `Spec => InvalidMaterialStutter`; -- `Spec => NonAuthoritativeInputsStutter`. - -The proof uses a strengthened inductive invariant containing the auxiliary -reachability property that a terminal record can exist only for a registered -request. This auxiliary predicate supports induction and does not introduce -a new normative Seed requirement. - -Detailed grant-chain construction, canonical digest computation and static -implementation neutrality are checked by the executable oracle and canon -validators. The formal model abstracts validated Authority evidence through -`authorityProofBindings` and validated historical terminal-commitment recognition -through `RecognizedTerminalCommitments`. Concrete accumulator construction, -membership/update witnesses and retention are profile-level concerns. - -`SeedCanonProjection.tla` is a deterministic generated interpretation of the -exact machine-readable Seed identity under -`ASET-SEED-CANON-TLA-PROJECTION-V3`. `SeedCanonRefinementProofs.tla` proves -behavioral equivalence between that generated projection and -`SeedResolution.tla`. Projection parity and source/target digests are mandatory -release checks. - -This canon-to-TLA relation preserves the declared abstractions. It does not -establish: - -- equivalence of every natural-language sentence; -- concrete Binding or digest construction; -- refinement from the TLA+ model to an implementation; -- correctness of any implementation; -- concrete Authority grant-chain construction; -- cryptographic primitive security; -- concrete terminal-commitment accumulator or witness correctness; -- liveness. - -`UNKNOWN` may remain unresolved indefinitely. This is intentional fail-closed -behaviour for a recognition kernel rather than a workflow engine. - -The CI proof gate pins TLAPM commit -`4600b24c6d95a25ff081ad37b63b2a01c29d43a5`. It verifies process exit status, -the TLAPM success summary and the presence of every final theorem. - -The number of generated proof obligations is recorded as evidence and is not -a fixed semantic contract. +# ASET Seed formal safety model + +`SeedResolution.tla` models the active Seed 0.3 resolution core. + +## State ownership + +Seed-owned mutable state: + +- `requestMeta`; +- `terminalMeta`. + +Environment state: + +- `conflicts`. + +The model therefore has three TLA variables but only two Seed-owned mutable +state dimensions. `Requests` and `TerminalRequests` are partial-map domains. +`EvaluateResolution(r)` is a pure observer and is not included in `Next`. + +## Authority and external-material boundary + +`RequestAuthorityBindings` and `TerminalAuthorityBindings` are immutable +abstract recognition relations. They mean that Authority recognition has +already succeeded for an exact binding; the formal model does not interpret +signatures, credentials or delegation chains. + +Invalid or non-authoritative material has no state variable and no artificial +transition. It cannot enter accepted state by construction of the admission +boundary. The TLA model covers conflict between valid terminal material as an +environment observation. + +## Checked properties + +`SeedResolution.cfg` registers ten state invariants and four temporal safety +properties. The Python finite model checker explores its published finite +fixture to saturation; TLC independently checks the TLA model. + +The final TLAPS theorem surface is: + +- `SpecImpliesAlwaysSeedStateSafety`; +- `SpecImpliesRequestsAppendOnly`; +- `SpecImpliesTerminalRecordsImmutable`; +- `SpecImpliesSeedStateChangesOnlyByRecognizedTransition`; +- `SpecImpliesConflictObservationPreservesSeedState`. + +## Canon-to-TLA relation + +`SeedCanonProjection.tla` is generated under +`ASET-SEED-CANON-TLA-PROJECTION-V4` as a **standalone module**. It does not +`EXTEND` or instantiate `SeedResolution`. `SeedCanonRefinementProofs.tla` +explicitly instantiates the standalone projection onto the handwritten model +and proves evaluator and behavioral equivalence. + +The relation still abstracts concrete Binding/digest construction, +Authority-recognition establishment, terminal-commitment recognition, +cryptographic security, implementation refinement and liveness. + +The normative source remains the machine-readable canon; formal artifacts are +assurance projections, not normative implementations. + +Historical bootstrap/RC12 formal models are not duplicated in the active formal +directory. Their immutable copies remain available in frozen historical release +bundles. diff --git a/seed/canonical/formal/SeedBootstrap.cfg b/seed/canonical/formal/SeedBootstrap.cfg deleted file mode 100644 index 5479d1f..0000000 --- a/seed/canonical/formal/SeedBootstrap.cfg +++ /dev/null @@ -1,6 +0,0 @@ -SPECIFICATION Spec -INVARIANT NoDoubleUse - -CONSTANTS - Contexts = {c1, c2} - Permits = {p1, p2} diff --git a/seed/canonical/formal/SeedBootstrap.tla b/seed/canonical/formal/SeedBootstrap.tla deleted file mode 100644 index 4d78fc2..0000000 --- a/seed/canonical/formal/SeedBootstrap.tla +++ /dev/null @@ -1,29 +0,0 @@ ----- MODULE SeedBootstrap ---- -EXTENDS Naturals, FiniteSets - -CONSTANTS Contexts, Permits - -VARIABLES activeContexts, usedPermits - -vars == <> - -Init == - /\ activeContexts = Contexts - /\ usedPermits = {} - -UsePermit(p) == - /\ p \in Permits - /\ p \notin usedPermits - /\ usedPermits' = usedPermits \cup {p} - /\ UNCHANGED activeContexts - -Next == - \E p \in Permits : UsePermit(p) - -NoDoubleUse == - usedPermits \subseteq Permits - -Spec == - Init /\ [][Next]_vars - -==== diff --git a/seed/canonical/formal/SeedCanonProjection.tla b/seed/canonical/formal/SeedCanonProjection.tla index c0dbe47..a330264 100644 --- a/seed/canonical/formal/SeedCanonProjection.tla +++ b/seed/canonical/formal/SeedCanonProjection.tla @@ -1,18 +1,31 @@ ---------------- MODULE SeedCanonProjection ---------------- -EXTENDS SeedResolution +EXTENDS FiniteSets (* GENERATED FILE. DO NOT EDIT. Source: seed/canonical/source/seed-model.json -Source SHA-256: sha256:b5e68692317600fd2833474a1f9c31f09e44d37ae92ec14573b416076c5dd7f6 -Projection profile: ASET-SEED-CANON-TLA-PROJECTION-V3 +Source SHA-256: sha256:c43ca7b642a11c3ab140884a6bbff34bbd741f5cb905e6a779c860c813998fcf +Projection profile: ASET-SEED-CANON-TLA-PROJECTION-V4 -V3 projects the same canonical behavior onto the normalized three-variable -Seed state. Immutable Authority relations are context constants. Accepted -terminal binding is derived from requestMeta; invalid/non-authoritative inputs -are stuttering observations rather than retained canonical state. +V4 is a standalone projection. It does not EXTEND or import SeedResolution. +The refinement proof explicitly instantiates this model onto the target state. +Seed-owned state is requestMeta + terminalMeta. Conflict is environment state. +EVALUATE_RESOLUTION is a pure observer and is not part of CanonNext. *) +CONSTANTS ResolutionIds, Bindings, Authorities, TerminalCommitments, + RecognizedTerminalCommitments, NoCommitment, + RequestAuthorityBindings, TerminalAuthorityBindings + +ASSUME ResolutionIds # {} +ASSUME Bindings # {} +ASSUME Authorities # {} +ASSUME RecognizedTerminalCommitments \subseteq TerminalCommitments +ASSUME NoCommitment \notin TerminalCommitments +ASSUME RequestAuthorityBindings \subseteq Authorities \X Bindings +ASSUME TerminalAuthorityBindings \subseteq Authorities \X Bindings +ASSUME RequestAuthorityBindings \subseteq TerminalAuthorityBindings + CanonResolutions == {"UNKNOWN", "ALLOW", "BLOCK"} CanonTerminalResolutions == {"ALLOW", "BLOCK"} CanonDerivedResolution == "UNKNOWN" @@ -20,35 +33,56 @@ CanonEffectPermittedValue == "ALLOW" CanonFailClosedValues == {"UNKNOWN", "BLOCK"} CanonConflictResult == "UNKNOWN" +CanonRequestMetaType == + [binding : Bindings, + previous : TerminalCommitments \cup {NoCommitment}] + +CanonTerminalMetaType == + [resolution : CanonTerminalResolutions, + authority : Authorities] + +VARIABLES requestMeta, terminalMeta, conflicts + +CanonSeedVars == <> +CanonEnvironmentVars == <> +CanonVars == <> + +CanonRequests == DOMAIN requestMeta +CanonTerminalRequests == DOMAIN terminalMeta +CanonRequestBinding(r) == requestMeta[r].binding +CanonPreviousCommitment(r) == requestMeta[r].previous +CanonTerminalResolution(r) == terminalMeta[r].resolution +CanonTerminalAuthority(r) == terminalMeta[r].authority + CanonInit == /\ requestMeta = [r \in {} |-> r] /\ terminalMeta = [r \in {} |-> r] /\ conflicts = {} CanonRegisterRequest(r, b, a, previous) == - /\ r \in ResolutionIds \ Requests + /\ r \in ResolutionIds \ CanonRequests /\ b \in Bindings /\ a \in Authorities - /\ <> \in LocalAuthorityBindings + /\ <> \in RequestAuthorityBindings /\ \/ previous = NoCommitment \/ previous \in RecognizedTerminalCommitments /\ requestMeta' = - [x \in Requests \cup {r} |-> + [x \in CanonRequests \cup {r} |-> IF x = r THEN [binding |-> b, previous |-> previous] ELSE requestMeta[x]] /\ UNCHANGED <> CanonSubmitResolution(r, b, a, value) == - /\ r \in Requests - /\ b = RequestBinding(r) + /\ r \in CanonRequests + /\ b = CanonRequestBinding(r) /\ a \in Authorities - /\ <> \in AuthorityProofBindings + /\ <> \in TerminalAuthorityBindings /\ value \in CanonTerminalResolutions - /\ r \notin TerminalRequests + /\ r \notin CanonTerminalRequests /\ r \notin conflicts /\ terminalMeta' = - [x \in TerminalRequests \cup {r} |-> + [x \in CanonTerminalRequests \cup {r} |-> IF x = r THEN [resolution |-> value, authority |-> a] ELSE terminalMeta[x]] @@ -57,17 +91,7 @@ CanonSubmitResolution(r, b, a, value) == CanonObserveConflict(r) == /\ r \in ResolutionIds /\ conflicts' = conflicts \cup {r} - /\ UNCHANGED <> - -CanonObserveInvalidMaterial(r) == - /\ r \in ResolutionIds - /\ UNCHANGED vars - -CanonObserveNonAuthoritativeInput(r) == - /\ r \in ResolutionIds - /\ UNCHANGED vars - -CanonEvaluate == UNCHANGED vars + /\ UNCHANGED CanonSeedVars CanonRecognizedSeedTransition == \/ \E r \in ResolutionIds, b \in Bindings, a \in Authorities, @@ -78,27 +102,25 @@ CanonRecognizedSeedTransition == CanonSubmitResolution(r, b, a, value) CanonRecognizedEnvironmentTransition == - \/ \E r \in ResolutionIds : CanonObserveConflict(r) - \/ \E r \in ResolutionIds : CanonObserveInvalidMaterial(r) - \/ \E r \in ResolutionIds : CanonObserveNonAuthoritativeInput(r) + \E r \in ResolutionIds : CanonObserveConflict(r) -CanonRecognizedCanonicalTransition == +CanonNext == \/ CanonRecognizedSeedTransition \/ CanonRecognizedEnvironmentTransition -CanonNext == - \/ CanonRecognizedCanonicalTransition - \/ CanonEvaluate - CanonResolutionOf(r) == - IF r \notin Requests \/ r \in conflicts + IF r \notin CanonRequests \/ r \in conflicts THEN CanonConflictResult - ELSE IF r \notin TerminalRequests + ELSE IF r \notin CanonTerminalRequests THEN CanonDerivedResolution - ELSE TerminalResolution(r) + ELSE CanonTerminalResolution(r) CanonEffectPermitted(r) == CanonResolutionOf(r) = CanonEffectPermittedValue -CanonSpec == CanonInit /\ [][CanonNext]_vars +CanonEvaluateResolution(r) == + [resolution |-> CanonResolutionOf(r), + effect_permitted |-> CanonEffectPermitted(r)] + +CanonSpec == CanonInit /\ [][CanonNext]_CanonVars ============================================================================= diff --git a/seed/canonical/formal/SeedCanonRefinementProofs.tla b/seed/canonical/formal/SeedCanonRefinementProofs.tla index bf652fa..eff57bb 100644 --- a/seed/canonical/formal/SeedCanonRefinementProofs.tla +++ b/seed/canonical/formal/SeedCanonRefinementProofs.tla @@ -1,78 +1,100 @@ ---------------------- MODULE SeedCanonRefinementProofs ---------------------- -EXTENDS SeedCanonProjection, TLAPS +EXTENDS SeedResolution, TLAPS (* -This proof establishes equivalence between SeedResolution and the generated -canonical projection for ASET-SEED-CANON-TLA-PROJECTION-V3. +Behavioral equivalence proof for projection profile V4. -The theorem is intentionally limited to the declared projection. Opaque -Bindings, AuthorityProofBindings and RecognizedTerminalCommitments remain -abstractions; cryptographic digest construction, concrete Authority grant-chain -construction, terminal-commitment provenance, storage-compaction refinement, -natural-language text equivalence, implementation refinement and liveness are -not proved here. +SeedCanonProjection is standalone and does not import SeedResolution. The +instance below explicitly maps the generated projection constants and state +onto SeedResolution. This removes target-model aliasing from the projection +module while keeping opaque Binding, Authority-recognition and terminal- +commitment boundaries explicit. *) +Canon == INSTANCE SeedCanonProjection + WITH ResolutionIds <- ResolutionIds, + Bindings <- Bindings, + Authorities <- Authorities, + TerminalCommitments <- TerminalCommitments, + RecognizedTerminalCommitments <- RecognizedTerminalCommitments, + NoCommitment <- NoCommitment, + RequestAuthorityBindings <- RequestAuthorityBindings, + TerminalAuthorityBindings <- TerminalAuthorityBindings, + requestMeta <- requestMeta, + terminalMeta <- terminalMeta, + conflicts <- conflicts + THEOREM CanonResolutionAlgebraEquivalent == - /\ Resolutions = CanonResolutions - /\ TerminalResolutions = CanonTerminalResolutions - /\ CanonDerivedResolution = "UNKNOWN" - /\ CanonEffectPermittedValue = "ALLOW" - /\ CanonFailClosedValues = {"UNKNOWN", "BLOCK"} - /\ CanonConflictResult = "UNKNOWN" + /\ Resolutions = Canon!CanonResolutions + /\ TerminalResolutions = Canon!CanonTerminalResolutions + /\ Canon!CanonDerivedResolution = "UNKNOWN" + /\ Canon!CanonEffectPermittedValue = "ALLOW" + /\ Canon!CanonFailClosedValues = {"UNKNOWN", "BLOCK"} + /\ Canon!CanonConflictResult = "UNKNOWN" PROOF BY DEF Resolutions, TerminalResolutions, - CanonResolutions, - CanonTerminalResolutions, - CanonDerivedResolution, - CanonEffectPermittedValue, - CanonFailClosedValues, - CanonConflictResult + Canon!CanonResolutions, + Canon!CanonTerminalResolutions, + Canon!CanonDerivedResolution, + Canon!CanonEffectPermittedValue, + Canon!CanonFailClosedValues, + Canon!CanonConflictResult THEOREM CanonEvaluatorEquivalent == \A r \in ResolutionIds : - /\ ResolutionOf(r) = CanonResolutionOf(r) - /\ EffectPermitted(r) = CanonEffectPermitted(r) + /\ ResolutionOf(r) = Canon!CanonResolutionOf(r) + /\ EffectPermitted(r) = Canon!CanonEffectPermitted(r) + /\ EvaluateResolution(r) = Canon!CanonEvaluateResolution(r) PROOF BY DEF ResolutionOf, - CanonResolutionOf, EffectPermitted, - CanonEffectPermitted, - CanonConflictResult, - CanonDerivedResolution, - CanonEffectPermittedValue + EvaluateResolution, + Requests, + TerminalRequests, + TerminalResolution, + Canon!CanonResolutionOf, + Canon!CanonEffectPermitted, + Canon!CanonEvaluateResolution, + Canon!CanonRequests, + Canon!CanonTerminalRequests, + Canon!CanonTerminalResolution, + Canon!CanonConflictResult, + Canon!CanonDerivedResolution, + Canon!CanonEffectPermittedValue THEOREM SeedResolutionBehaviorallyEquivalentToCanonProjection == - Spec <=> CanonSpec + Spec <=> Canon!CanonSpec PROOF BY DEF Spec, - CanonSpec, Init, - CanonInit, Next, - CanonNext, - RecognizedCanonicalTransition, - CanonRecognizedCanonicalTransition, RecognizedSeedTransition, - CanonRecognizedSeedTransition, RecognizedEnvironmentTransition, - CanonRecognizedEnvironmentTransition, RegisterRequest, - CanonRegisterRequest, SubmitResolution, - CanonSubmitResolution, ObserveConflict, - CanonObserveConflict, - ObserveInvalidMaterial, - CanonObserveInvalidMaterial, - ObserveNonAuthoritativeInput, - CanonObserveNonAuthoritativeInput, - Evaluate, - CanonEvaluate, + Requests, + TerminalRequests, + RequestBinding, TerminalResolutions, - CanonTerminalResolutions + vars, + seedVars, + Canon!CanonSpec, + Canon!CanonInit, + Canon!CanonNext, + Canon!CanonRecognizedSeedTransition, + Canon!CanonRecognizedEnvironmentTransition, + Canon!CanonRegisterRequest, + Canon!CanonSubmitResolution, + Canon!CanonObserveConflict, + Canon!CanonRequests, + Canon!CanonTerminalRequests, + Canon!CanonRequestBinding, + Canon!CanonTerminalResolutions, + Canon!CanonVars, + Canon!CanonSeedVars ============================================================================= diff --git a/seed/canonical/formal/SeedRC12.cfg b/seed/canonical/formal/SeedRC12.cfg deleted file mode 100644 index eacf195..0000000 --- a/seed/canonical/formal/SeedRC12.cfg +++ /dev/null @@ -1,10 +0,0 @@ -SPECIFICATION Spec -CONSTANTS - Contexts = {c1, c2} - Permits = {p1, p2} - MaxAuditLength = 7 -INVARIANTS - AttemptBound - OutcomeVerified - InactiveNoAuthority - AuditMonotone diff --git a/seed/canonical/formal/SeedRC12.tla b/seed/canonical/formal/SeedRC12.tla deleted file mode 100644 index 58e4dbf..0000000 --- a/seed/canonical/formal/SeedRC12.tla +++ /dev/null @@ -1,82 +0,0 @@ - ------------------------------ MODULE SeedRC12 ----------------------------- -EXTENDS Naturals, FiniteSets, Sequences - -CONSTANTS Contexts, Permits, MaxAuditLength -VARIABLES lifecycle, authorityActive, permitActive, attempts, maxAttempts, - verified, outcome, auditLength - -vars == <> - -Init == - /\ lifecycle = [c \in Contexts |-> "ACTIVE"] - /\ authorityActive = [c \in Contexts |-> FALSE] - /\ permitActive = [p \in Permits |-> FALSE] - /\ attempts = [p \in Permits |-> 0] - /\ maxAttempts = [p \in Permits |-> 1] - /\ verified = [p \in Permits |-> FALSE] - /\ outcome = [p \in Permits |-> FALSE] - /\ auditLength = 0 - -GrantAuthority(c) == - /\ lifecycle[c] = "ACTIVE" - /\ ~authorityActive[c] - /\ authorityActive' = [authorityActive EXCEPT ![c] = TRUE] - /\ UNCHANGED <> - /\ auditLength' = auditLength + 1 - -IssuePermit(p) == - /\ ~permitActive[p] - /\ ~outcome[p] - /\ permitActive' = [permitActive EXCEPT ![p] = TRUE] - /\ UNCHANGED <> - /\ auditLength' = auditLength + 1 - -UsePermit(p) == - /\ permitActive[p] - /\ attempts[p] < maxAttempts[p] - /\ attempts' = [attempts EXCEPT ![p] = @ + 1] - /\ UNCHANGED <> - /\ auditLength' = auditLength + 1 - -Verify(p) == - /\ attempts[p] > 0 - /\ ~verified[p] - /\ verified' = [verified EXCEPT ![p] = TRUE] - /\ UNCHANGED <> - /\ auditLength' = auditLength + 1 - -RecognizeOutcome(p) == - /\ verified[p] - /\ ~outcome[p] - /\ outcome' = [outcome EXCEPT ![p] = TRUE] - /\ permitActive' = [permitActive EXCEPT ![p] = FALSE] - /\ UNCHANGED <> - /\ auditLength' = auditLength + 1 - -Withdraw(c) == - /\ lifecycle[c] = "ACTIVE" - /\ lifecycle' = [lifecycle EXCEPT ![c] = "WITHDRAWN"] - /\ authorityActive' = [authorityActive EXCEPT ![c] = FALSE] - /\ UNCHANGED <> - /\ auditLength' = auditLength + 1 - -Step == - /\ auditLength < MaxAuditLength - /\ \/ \E c \in Contexts : GrantAuthority(c) - \/ \E p \in Permits : IssuePermit(p) - \/ \E p \in Permits : UsePermit(p) - \/ \E p \in Permits : Verify(p) - \/ \E p \in Permits : RecognizeOutcome(p) - \/ \E c \in Contexts : Withdraw(c) - -Next == Step \/ UNCHANGED vars - -AttemptBound == \A p \in Permits : attempts[p] <= maxAttempts[p] -OutcomeVerified == \A p \in Permits : outcome[p] => verified[p] -InactiveNoAuthority == \A c \in Contexts : lifecycle[c] # "ACTIVE" => ~authorityActive[c] -AuditMonotone == auditLength \in 0..MaxAuditLength - -Spec == Init /\ [][Next]_vars -============================================================================= diff --git a/seed/canonical/formal/SeedResolution.cfg b/seed/canonical/formal/SeedResolution.cfg index 57366a4..2eaa677 100644 --- a/seed/canonical/formal/SeedResolution.cfg +++ b/seed/canonical/formal/SeedResolution.cfg @@ -5,8 +5,8 @@ CONSTANTS TerminalCommitments = {c1, c2} RecognizedTerminalCommitments = {c1, c2} NoCommitment = noCommitment - LocalAuthorityBindings <- TLC_LocalAuthorityBindings - AuthorityProofBindings <- TLC_AuthorityProofBindings + RequestAuthorityBindings <- TLC_RequestAuthorityBindings + TerminalAuthorityBindings <- TLC_TerminalAuthorityBindings SPECIFICATION Spec INVARIANTS @@ -15,16 +15,14 @@ INVARIANTS AllowSoundness FailClosed TerminalBindingDerived - LocalAuthorityRoot - DelegatedAuthoritySound - InputsNonAuthoritative + RequestAuthorityRecognized + TerminalAuthorityRecognized TerminalUnique ConflictUnknown FreshReconsideration PROPERTIES RequestsAppendOnly TerminalRecordsImmutable - CanonicalStateChangesOnlyByRecognizedTransition - InvalidMaterialStutter - NonAuthoritativeInputsStutter + SeedStateChangesOnlyByRecognizedTransition + ConflictObservationPreservesSeedState CHECK_DEADLOCK FALSE diff --git a/seed/canonical/formal/SeedResolution.tla b/seed/canonical/formal/SeedResolution.tla index 11973d2..944556a 100644 --- a/seed/canonical/formal/SeedResolution.tla +++ b/seed/canonical/formal/SeedResolution.tla @@ -3,16 +3,16 @@ EXTENDS FiniteSets CONSTANTS ResolutionIds, Bindings, Authorities, TerminalCommitments, RecognizedTerminalCommitments, NoCommitment, - LocalAuthorityBindings, AuthorityProofBindings + RequestAuthorityBindings, TerminalAuthorityBindings ASSUME ResolutionIds # {} ASSUME Bindings # {} ASSUME Authorities # {} ASSUME RecognizedTerminalCommitments \subseteq TerminalCommitments ASSUME NoCommitment \notin TerminalCommitments -ASSUME LocalAuthorityBindings \subseteq Authorities \X Bindings -ASSUME AuthorityProofBindings \subseteq Authorities \X Bindings -ASSUME LocalAuthorityBindings \subseteq AuthorityProofBindings +ASSUME RequestAuthorityBindings \subseteq Authorities \X Bindings +ASSUME TerminalAuthorityBindings \subseteq Authorities \X Bindings +ASSUME RequestAuthorityBindings \subseteq TerminalAuthorityBindings Resolutions == {"UNKNOWN", "ALLOW", "BLOCK"} TerminalResolutions == {"ALLOW", "BLOCK"} @@ -25,47 +25,37 @@ TerminalMetaType == [resolution : TerminalResolutions, authority : Authorities] -(* -Bounded TLC fixture values for relation-valued constants. TLC configuration -files accept simple values and sets of simple values, but not tuple-valued set -literals. These operators are used only through cfg definition overrides; they -do not participate in the normative Seed transition semantics or TLAPS proofs. -The bounded cfg supplies exactly two Authorities and two Bindings. -*) +(* Bounded TLC fixture relations. They are configuration helpers only. *) TLC_Authority1 == CHOOSE a \in Authorities : TRUE TLC_Authority2 == CHOOSE a \in Authorities \ {TLC_Authority1} : TRUE TLC_Binding1 == CHOOSE b \in Bindings : TRUE TLC_Binding2 == CHOOSE b \in Bindings \ {TLC_Binding1} : TRUE -TLC_LocalAuthorityBindings == +TLC_RequestAuthorityBindings == {<>, <>} -TLC_AuthorityProofBindings == - TLC_LocalAuthorityBindings \cup +TLC_TerminalAuthorityBindings == + TLC_RequestAuthorityBindings \cup {<>} (* -Minimal abstract state. - -The two Authority relations are immutable context parameters rather than state: -Seed has no transition that mutates them. Request identity is represented once -in requestMeta; terminal state stores only facts that are not derivable from the -request. Consequently an accepted terminal binding cannot diverge from the -registered binding because there is no independent terminal-binding field. - -Invalid material and non-authoritative inputs have no canonical state component. -They are modeled as explicit stuttering observations. Conflict is retained -because it changes the derived resolution to UNKNOWN even after a terminal -record exists. +Seed-owned state and environment state are deliberately separated. + +- requestMeta and terminalMeta are the only Seed-owned mutable state. +- conflicts is an environment observation because a later independently + established conflicting valid terminal record changes the derived resolution. +- invalid/unrecognized/non-authoritative material has no state slot and is not + a transition. It cannot mutate accepted Seed state by construction. *) VARIABLES requestMeta, terminalMeta, conflicts -canonicalVars == <> -vars == canonicalVars +seedVars == <> +environmentVars == <> +vars == <> Requests == DOMAIN requestMeta TerminalRequests == DOMAIN terminalMeta @@ -74,8 +64,6 @@ RequestBinding(r) == requestMeta[r].binding PreviousCommitment(r) == requestMeta[r].previous TerminalResolution(r) == terminalMeta[r].resolution TerminalAuthority(r) == terminalMeta[r].authority - -(* Binding of an accepted terminal record is derived from its immutable request. *) TerminalBinding(r) == RequestBinding(r) Init == @@ -87,7 +75,7 @@ RegisterRequest(r, b, a, previous) == /\ r \in ResolutionIds \ Requests /\ b \in Bindings /\ a \in Authorities - /\ <> \in LocalAuthorityBindings + /\ <> \in RequestAuthorityBindings /\ \/ previous = NoCommitment \/ previous \in RecognizedTerminalCommitments /\ requestMeta' = @@ -101,7 +89,7 @@ SubmitResolution(r, b, a, value) == /\ r \in Requests /\ b = RequestBinding(r) /\ a \in Authorities - /\ <> \in AuthorityProofBindings + /\ <> \in TerminalAuthorityBindings /\ value \in TerminalResolutions /\ r \notin TerminalRequests /\ r \notin conflicts @@ -112,22 +100,11 @@ SubmitResolution(r, b, a, value) == ELSE terminalMeta[x]] /\ UNCHANGED <> +(* Environment transition: it changes only environment state. *) ObserveConflict(r) == /\ r \in ResolutionIds /\ conflicts' = conflicts \cup {r} - /\ UNCHANGED <> - -(* Invalid material cannot become accepted terminal state. *) -ObserveInvalidMaterial(r) == - /\ r \in ResolutionIds - /\ UNCHANGED vars - -(* Non-authoritative inputs have no canonical state representation. *) -ObserveNonAuthoritativeInput(r) == - /\ r \in ResolutionIds - /\ UNCHANGED vars - -Evaluate == UNCHANGED vars + /\ UNCHANGED seedVars RecognizedSeedTransition == \/ \E r \in ResolutionIds, b \in Bindings, a \in Authorities, @@ -138,18 +115,12 @@ RecognizedSeedTransition == SubmitResolution(r, b, a, value) RecognizedEnvironmentTransition == - \/ \E r \in ResolutionIds : ObserveConflict(r) - \/ \E r \in ResolutionIds : ObserveInvalidMaterial(r) - \/ \E r \in ResolutionIds : ObserveNonAuthoritativeInput(r) + \E r \in ResolutionIds : ObserveConflict(r) -RecognizedCanonicalTransition == +Next == \/ RecognizedSeedTransition \/ RecognizedEnvironmentTransition -Next == - \/ RecognizedCanonicalTransition - \/ Evaluate - ResolutionOf(r) == IF r \notin Requests \/ r \in conflicts THEN "UNKNOWN" @@ -159,6 +130,11 @@ ResolutionOf(r) == EffectPermitted(r) == ResolutionOf(r) = "ALLOW" +(* Pure observer corresponding to wire operation EVALUATE_RESOLUTION. *) +EvaluateResolution(r) == + [resolution |-> ResolutionOf(r), + effect_permitted |-> EffectPermitted(r)] + TypeOK == /\ DOMAIN requestMeta \subseteq ResolutionIds /\ requestMeta \in [DOMAIN requestMeta -> RequestMetaType] @@ -177,37 +153,29 @@ AllowSoundness == /\ r \in TerminalRequests /\ TerminalResolution(r) = "ALLOW" /\ <> - \in AuthorityProofBindings + \in TerminalAuthorityBindings FailClosed == \A r \in ResolutionIds : ResolutionOf(r) # "ALLOW" => ~EffectPermitted(r) -(* Exact binding is structural: accepted terminal state has no second binding. *) TerminalBindingDerived == \A r \in TerminalRequests : /\ r \in Requests /\ TerminalBinding(r) = RequestBinding(r) -LocalAuthorityRoot == +RequestAuthorityRecognized == \A r \in Requests : \E a \in Authorities : - <> \in LocalAuthorityBindings + <> \in RequestAuthorityBindings -DelegatedAuthoritySound == +TerminalAuthorityRecognized == \A r \in TerminalRequests : /\ r \in Requests /\ <> - \in AuthorityProofBindings + \in TerminalAuthorityBindings -(* -Structural assurance: the complete canonical decision state is exactly the -three variables above; non-authoritative inputs have no independent state slot. -*) -InputsNonAuthoritative == - canonicalVars = <> - -(* A function keyed by resolution_id makes multiple accepted terminals unrepresentable. *) +(* One keyed terminal metadata cell makes multiple accepted terminals unrepresentable. *) TerminalUnique == terminalMeta \in [DOMAIN terminalMeta -> TerminalMetaType] @@ -228,9 +196,8 @@ SeedStateSafety == /\ AllowSoundness /\ FailClosed /\ TerminalBindingDerived - /\ LocalAuthorityRoot - /\ DelegatedAuthoritySound - /\ InputsNonAuthoritative + /\ RequestAuthorityRecognized + /\ TerminalAuthorityRecognized /\ TerminalUnique /\ ConflictUnknown /\ FreshReconsideration @@ -238,8 +205,8 @@ SeedStateSafety == InductiveInvariant == /\ TypeOK /\ TerminalBindingDerived - /\ LocalAuthorityRoot - /\ DelegatedAuthoritySound + /\ RequestAuthorityRecognized + /\ TerminalAuthorityRecognized /\ FreshReconsideration /\ TerminalRecordRequiresRequest @@ -257,25 +224,18 @@ TerminalRecordsImmutableStep == TerminalRecordsImmutable == [][TerminalRecordsImmutableStep]_vars -CanonicalStateChangesOnlyByRecognizedTransitionStep == - canonicalVars' # canonicalVars => RecognizedCanonicalTransition - -CanonicalStateChangesOnlyByRecognizedTransition == - [][CanonicalStateChangesOnlyByRecognizedTransitionStep]_vars - -InvalidMaterialStutterStep == - \A r \in ResolutionIds : - ObserveInvalidMaterial(r) => UNCHANGED vars +SeedStateChangesOnlyByRecognizedTransitionStep == + seedVars' # seedVars => RecognizedSeedTransition -InvalidMaterialStutter == - [][InvalidMaterialStutterStep]_vars +SeedStateChangesOnlyByRecognizedTransition == + [][SeedStateChangesOnlyByRecognizedTransitionStep]_vars -NonAuthoritativeInputsStutterStep == +ConflictObservationPreservesSeedStateStep == \A r \in ResolutionIds : - ObserveNonAuthoritativeInput(r) => UNCHANGED vars + ObserveConflict(r) => UNCHANGED seedVars -NonAuthoritativeInputsStutter == - [][NonAuthoritativeInputsStutterStep]_vars +ConflictObservationPreservesSeedState == + [][ConflictObservationPreservesSeedStateStep]_vars Spec == Init /\ [][Next]_vars ================================================================================= diff --git a/seed/canonical/formal/SeedResolutionProofs.tla b/seed/canonical/formal/SeedResolutionProofs.tla index 6e2be2d..ab4b9a1 100644 --- a/seed/canonical/formal/SeedResolutionProofs.tla +++ b/seed/canonical/formal/SeedResolutionProofs.tla @@ -4,10 +4,10 @@ EXTENDS SeedResolution, TLAPS (* Unbounded safety proof for the normalized Seed state. -Compared with the previous projection, request/terminal metadata are stored once, -Authority relations are immutable context constants, and invalid/non-authoritative -observations are explicit semantic stutters. The proof therefore establishes the -same observable resolution safety over a smaller representable state space. +The proof separates Seed-owned state from environment conflict state. Authority +recognition is an exact-binding boundary predicate; concrete evidence and grant +chains remain external. Invalid and non-authoritative material are outside the +accepted transition system rather than modeled as artificial stutter actions. *) THEOREM EffectPermissionDefinition == @@ -16,28 +16,24 @@ THEOREM EffectPermissionDefinition == PROOF BY DEF EffectPermitted - THEOREM UnregisteredResolutionIsUnknown == \A r \in ResolutionIds : r \notin Requests => ResolutionOf(r) = "UNKNOWN" PROOF BY DEF ResolutionOf - THEOREM ConflictedResolutionIsUnknown == \A r \in ResolutionIds : r \in conflicts => ResolutionOf(r) = "UNKNOWN" PROOF BY DEF ResolutionOf - THEOREM MissingTerminalRecordIsUnknown == \A r \in ResolutionIds : r \notin TerminalRequests => ResolutionOf(r) = "UNKNOWN" PROOF BY DEF ResolutionOf - THEOREM TerminalRecordDeterminesResolution == \A r \in ResolutionIds : (/\ r \in Requests @@ -47,7 +43,6 @@ THEOREM TerminalRecordDeterminesResolution == PROOF BY DEF ResolutionOf - THEOREM AllowResolutionCharacterization == \A r \in ResolutionIds : EffectPermitted(r) <=> @@ -58,7 +53,6 @@ THEOREM AllowResolutionCharacterization == PROOF BY DEF EffectPermitted, ResolutionOf - THEOREM BlockResolutionCharacterization == \A r \in ResolutionIds : ResolutionOf(r) = "BLOCK" <=> @@ -69,26 +63,17 @@ THEOREM BlockResolutionCharacterization == PROOF BY DEF ResolutionOf - THEOREM FailClosedByEvaluator == FailClosed PROOF BY DEF FailClosed, EffectPermitted - -THEOREM InputsNonAuthoritativeByStructure == - InputsNonAuthoritative -PROOF - BY DEF InputsNonAuthoritative, canonicalVars - - THEOREM ConflictUnknownFromTypeOK == TypeOK => ConflictUnknown PROOF BY ConflictedResolutionIsUnknown DEF TypeOK, ConflictUnknown - THEOREM ResolutionDomainPointwise == ASSUME TypeOK, NEW r \in ResolutionIds @@ -115,23 +100,20 @@ PROOF <1>4. QED BY <1>1, <1>2, <1>3 - THEOREM ResolutionDomainFromTypeOK == TypeOK => ResolutionDomain PROOF BY ResolutionDomainPointwise DEF ResolutionDomain - THEOREM TerminalUniqueFromTypeOK == TypeOK => TerminalUnique PROOF BY DEF TypeOK, TerminalUnique - THEOREM AllowSoundnessPointwise == ASSUME TerminalBindingDerived, - DelegatedAuthoritySound, + TerminalAuthorityRecognized, NEW r \in ResolutionIds, EffectPermitted(r) PROVE @@ -140,7 +122,7 @@ THEOREM AllowSoundnessPointwise == /\ r \in TerminalRequests /\ TerminalResolution(r) = "ALLOW" /\ <> - \in AuthorityProofBindings + \in TerminalAuthorityBindings PROOF <1>1. /\ r \in Requests @@ -150,32 +132,28 @@ PROOF BY AllowResolutionCharacterization <1>2. <> - \in AuthorityProofBindings - BY <1>1 DEF DelegatedAuthoritySound + \in TerminalAuthorityBindings + BY <1>1 DEF TerminalAuthorityRecognized <1>3. QED BY <1>1, <1>2 - THEOREM AllowSoundnessFromStructuralInvariants == - TerminalBindingDerived /\ DelegatedAuthoritySound + TerminalBindingDerived /\ TerminalAuthorityRecognized => AllowSoundness PROOF BY AllowSoundnessPointwise DEF AllowSoundness - THEOREM InductiveInvariantImpliesSeedStateSafety == InductiveInvariant => SeedStateSafety PROOF BY ResolutionDomainFromTypeOK, AllowSoundnessFromStructuralInvariants, FailClosedByEvaluator, - InputsNonAuthoritativeByStructure, TerminalUniqueFromTypeOK, ConflictUnknownFromTypeOK DEF InductiveInvariant, SeedStateSafety - THEOREM InitImpliesTypeOK == Init => TypeOK PROOF @@ -184,7 +162,6 @@ PROOF RequestMetaType, TerminalMetaType - THEOREM InitImpliesTerminalBindingDerived == Init => TerminalBindingDerived PROOF @@ -193,23 +170,20 @@ PROOF Requests, TerminalRequests - -THEOREM InitImpliesLocalAuthorityRoot == - Init => LocalAuthorityRoot +THEOREM InitImpliesRequestAuthorityRecognized == + Init => RequestAuthorityRecognized PROOF BY DEF Init, - LocalAuthorityRoot, + RequestAuthorityRecognized, Requests - -THEOREM InitImpliesDelegatedAuthoritySound == - Init => DelegatedAuthoritySound +THEOREM InitImpliesTerminalAuthorityRecognized == + Init => TerminalAuthorityRecognized PROOF BY DEF Init, - DelegatedAuthoritySound, + TerminalAuthorityRecognized, TerminalRequests - THEOREM InitImpliesFreshReconsideration == Init => FreshReconsideration PROOF @@ -217,7 +191,6 @@ PROOF FreshReconsideration, Requests - THEOREM InitImpliesTerminalRecordRequiresRequest == Init => TerminalRecordRequiresRequest PROOF @@ -226,19 +199,17 @@ PROOF Requests, TerminalRequests - THEOREM InitImpliesInductiveInvariant == Init => InductiveInvariant PROOF BY InitImpliesTypeOK, InitImpliesTerminalBindingDerived, - InitImpliesLocalAuthorityRoot, - InitImpliesDelegatedAuthoritySound, + InitImpliesRequestAuthorityRecognized, + InitImpliesTerminalAuthorityRecognized, InitImpliesFreshReconsideration, InitImpliesTerminalRecordRequiresRequest DEF InductiveInvariant - THEOREM RegisterRequestPreservesTypeOK == \A r \in ResolutionIds, b \in Bindings, a \in Authorities, previous \in TerminalCommitments \cup {NoCommitment} : @@ -252,7 +223,6 @@ PROOF RequestMetaType, TerminalMetaType - THEOREM RegisterRequestPreservesTerminalRecordRequiresRequest == \A r \in ResolutionIds, b \in Bindings, a \in Authorities, previous \in TerminalCommitments \cup {NoCommitment} : @@ -266,7 +236,6 @@ PROOF Requests, TerminalRequests - THEOREM RegisterRequestPreservesTerminalBindingDerived == \A r \in ResolutionIds, b \in Bindings, a \in Authorities, previous \in TerminalCommitments \cup {NoCommitment} : @@ -282,28 +251,26 @@ PROOF TerminalBinding, RequestBinding - -THEOREM RegisterRequestPreservesLocalAuthorityRoot == +THEOREM RegisterRequestPreservesRequestAuthorityRecognized == \A r \in ResolutionIds, b \in Bindings, a \in Authorities, previous \in TerminalCommitments \cup {NoCommitment} : InductiveInvariant /\ RegisterRequest(r, b, a, previous) - => LocalAuthorityRoot' + => RequestAuthorityRecognized' PROOF BY DEF InductiveInvariant, - LocalAuthorityRoot, + RequestAuthorityRecognized, RegisterRequest, Requests, RequestBinding - -THEOREM RegisterRequestPreservesDelegatedAuthoritySound == +THEOREM RegisterRequestPreservesTerminalAuthorityRecognized == \A r \in ResolutionIds, b \in Bindings, a \in Authorities, previous \in TerminalCommitments \cup {NoCommitment} : InductiveInvariant /\ RegisterRequest(r, b, a, previous) - => DelegatedAuthoritySound' + => TerminalAuthorityRecognized' PROOF BY DEF InductiveInvariant, - DelegatedAuthoritySound, + TerminalAuthorityRecognized, TerminalRecordRequiresRequest, RegisterRequest, Requests, @@ -311,7 +278,6 @@ PROOF RequestBinding, TerminalAuthority - THEOREM RegisterRequestPreservesFreshReconsideration == \A r \in ResolutionIds, b \in Bindings, a \in Authorities, previous \in TerminalCommitments \cup {NoCommitment} : @@ -324,7 +290,6 @@ PROOF Requests, PreviousCommitment - THEOREM RegisterRequestPreservesInductiveInvariant == \A r \in ResolutionIds, b \in Bindings, a \in Authorities, previous \in TerminalCommitments \cup {NoCommitment} : @@ -334,12 +299,11 @@ PROOF BY RegisterRequestPreservesTypeOK, RegisterRequestPreservesTerminalRecordRequiresRequest, RegisterRequestPreservesTerminalBindingDerived, - RegisterRequestPreservesLocalAuthorityRoot, - RegisterRequestPreservesDelegatedAuthoritySound, + RegisterRequestPreservesRequestAuthorityRecognized, + RegisterRequestPreservesTerminalAuthorityRecognized, RegisterRequestPreservesFreshReconsideration DEF InductiveInvariant - THEOREM SubmitResolutionPreservesTypeOK == \A r \in ResolutionIds, b \in Bindings, a \in Authorities, value \in TerminalResolutions : @@ -354,7 +318,6 @@ PROOF RequestMetaType, TerminalMetaType - THEOREM SubmitResolutionPreservesTerminalRecordRequiresRequest == \A r \in ResolutionIds, b \in Bindings, a \in Authorities, value \in TerminalResolutions : @@ -367,7 +330,6 @@ PROOF Requests, TerminalRequests - THEOREM SubmitResolutionPreservesTerminalBindingDerived == \A r \in ResolutionIds, b \in Bindings, a \in Authorities, value \in TerminalResolutions : @@ -383,28 +345,26 @@ PROOF TerminalBinding, RequestBinding - -THEOREM SubmitResolutionPreservesLocalAuthorityRoot == +THEOREM SubmitResolutionPreservesRequestAuthorityRecognized == \A r \in ResolutionIds, b \in Bindings, a \in Authorities, value \in TerminalResolutions : InductiveInvariant /\ SubmitResolution(r, b, a, value) - => LocalAuthorityRoot' + => RequestAuthorityRecognized' PROOF BY DEF InductiveInvariant, - LocalAuthorityRoot, + RequestAuthorityRecognized, SubmitResolution, Requests, RequestBinding - -THEOREM SubmitResolutionPreservesDelegatedAuthoritySound == +THEOREM SubmitResolutionPreservesTerminalAuthorityRecognized == \A r \in ResolutionIds, b \in Bindings, a \in Authorities, value \in TerminalResolutions : InductiveInvariant /\ SubmitResolution(r, b, a, value) - => DelegatedAuthoritySound' + => TerminalAuthorityRecognized' PROOF BY DEF InductiveInvariant, - DelegatedAuthoritySound, + TerminalAuthorityRecognized, TerminalRecordRequiresRequest, SubmitResolution, Requests, @@ -412,7 +372,6 @@ PROOF RequestBinding, TerminalAuthority - THEOREM SubmitResolutionPreservesFreshReconsideration == \A r \in ResolutionIds, b \in Bindings, a \in Authorities, value \in TerminalResolutions : @@ -425,7 +384,6 @@ PROOF Requests, PreviousCommitment - THEOREM SubmitResolutionPreservesInductiveInvariant == \A r \in ResolutionIds, b \in Bindings, a \in Authorities, value \in TerminalResolutions : @@ -435,23 +393,23 @@ PROOF BY SubmitResolutionPreservesTypeOK, SubmitResolutionPreservesTerminalRecordRequiresRequest, SubmitResolutionPreservesTerminalBindingDerived, - SubmitResolutionPreservesLocalAuthorityRoot, - SubmitResolutionPreservesDelegatedAuthoritySound, + SubmitResolutionPreservesRequestAuthorityRecognized, + SubmitResolutionPreservesTerminalAuthorityRecognized, SubmitResolutionPreservesFreshReconsideration DEF InductiveInvariant - THEOREM StateStutterPreservesInductiveInvariant == InductiveInvariant /\ UNCHANGED vars => InductiveInvariant' PROOF BY DEF vars, - canonicalVars, + seedVars, + environmentVars, InductiveInvariant, TypeOK, TerminalBindingDerived, - LocalAuthorityRoot, - DelegatedAuthoritySound, + RequestAuthorityRecognized, + TerminalAuthorityRecognized, FreshReconsideration, TerminalRecordRequiresRequest, Requests, @@ -461,13 +419,11 @@ PROOF TerminalBinding, TerminalAuthority - THEOREM ObserveConflictPreservesTypeOK == \A r \in ResolutionIds : TypeOK /\ ObserveConflict(r) => TypeOK' PROOF - BY DEF TypeOK, ObserveConflict - + BY DEF TypeOK, ObserveConflict, seedVars THEOREM ObserveConflictPreservesTerminalBindingDerived == \A r \in ResolutionIds : @@ -476,35 +432,35 @@ THEOREM ObserveConflictPreservesTerminalBindingDerived == PROOF BY DEF TerminalBindingDerived, ObserveConflict, + seedVars, Requests, TerminalRequests, TerminalBinding, RequestBinding - -THEOREM ObserveConflictPreservesLocalAuthorityRoot == +THEOREM ObserveConflictPreservesRequestAuthorityRecognized == \A r \in ResolutionIds : - LocalAuthorityRoot /\ ObserveConflict(r) => LocalAuthorityRoot' + RequestAuthorityRecognized /\ ObserveConflict(r) => RequestAuthorityRecognized' PROOF - BY DEF LocalAuthorityRoot, + BY DEF RequestAuthorityRecognized, ObserveConflict, + seedVars, Requests, RequestBinding - -THEOREM ObserveConflictPreservesDelegatedAuthoritySound == +THEOREM ObserveConflictPreservesTerminalAuthorityRecognized == \A r \in ResolutionIds : - DelegatedAuthoritySound /\ ObserveConflict(r) - => DelegatedAuthoritySound' + TerminalAuthorityRecognized /\ ObserveConflict(r) + => TerminalAuthorityRecognized' PROOF - BY DEF DelegatedAuthoritySound, + BY DEF TerminalAuthorityRecognized, ObserveConflict, + seedVars, Requests, TerminalRequests, RequestBinding, TerminalAuthority - THEOREM ObserveConflictPreservesFreshReconsideration == \A r \in ResolutionIds : FreshReconsideration /\ ObserveConflict(r) @@ -512,10 +468,10 @@ THEOREM ObserveConflictPreservesFreshReconsideration == PROOF BY DEF FreshReconsideration, ObserveConflict, + seedVars, Requests, PreviousCommitment - THEOREM ObserveConflictPreservesTerminalRecordRequiresRequest == \A r \in ResolutionIds : TerminalRecordRequiresRequest /\ ObserveConflict(r) @@ -523,10 +479,10 @@ THEOREM ObserveConflictPreservesTerminalRecordRequiresRequest == PROOF BY DEF TerminalRecordRequiresRequest, ObserveConflict, + seedVars, Requests, TerminalRequests - THEOREM ObserveConflictPreservesInductiveInvariant == \A r \in ResolutionIds : InductiveInvariant /\ ObserveConflict(r) @@ -534,39 +490,12 @@ THEOREM ObserveConflictPreservesInductiveInvariant == PROOF BY ObserveConflictPreservesTypeOK, ObserveConflictPreservesTerminalBindingDerived, - ObserveConflictPreservesLocalAuthorityRoot, - ObserveConflictPreservesDelegatedAuthoritySound, + ObserveConflictPreservesRequestAuthorityRecognized, + ObserveConflictPreservesTerminalAuthorityRecognized, ObserveConflictPreservesFreshReconsideration, ObserveConflictPreservesTerminalRecordRequiresRequest DEF InductiveInvariant - -THEOREM ObserveInvalidMaterialPreservesInductiveInvariant == - \A r \in ResolutionIds : - InductiveInvariant /\ ObserveInvalidMaterial(r) - => InductiveInvariant' -PROOF - BY StateStutterPreservesInductiveInvariant - DEF ObserveInvalidMaterial - - -THEOREM ObserveNonAuthoritativeInputPreservesInductiveInvariant == - \A r \in ResolutionIds : - InductiveInvariant /\ ObserveNonAuthoritativeInput(r) - => InductiveInvariant' -PROOF - BY StateStutterPreservesInductiveInvariant - DEF ObserveNonAuthoritativeInput - - -THEOREM EvaluatePreservesInductiveInvariant == - InductiveInvariant /\ Evaluate - => InductiveInvariant' -PROOF - BY StateStutterPreservesInductiveInvariant - DEF Evaluate - - THEOREM RecognizedSeedTransitionPreservesInductiveInvariant == InductiveInvariant /\ RecognizedSeedTransition => InductiveInvariant' @@ -575,35 +504,21 @@ PROOF SubmitResolutionPreservesInductiveInvariant DEF RecognizedSeedTransition - THEOREM RecognizedEnvironmentTransitionPreservesInductiveInvariant == InductiveInvariant /\ RecognizedEnvironmentTransition => InductiveInvariant' PROOF - BY ObserveConflictPreservesInductiveInvariant, - ObserveInvalidMaterialPreservesInductiveInvariant, - ObserveNonAuthoritativeInputPreservesInductiveInvariant + BY ObserveConflictPreservesInductiveInvariant DEF RecognizedEnvironmentTransition - -THEOREM RecognizedCanonicalTransitionPreservesInductiveInvariant == - InductiveInvariant /\ RecognizedCanonicalTransition - => InductiveInvariant' -PROOF - BY RecognizedSeedTransitionPreservesInductiveInvariant, - RecognizedEnvironmentTransitionPreservesInductiveInvariant - DEF RecognizedCanonicalTransition - - THEOREM NextPreservesInductiveInvariant == InductiveInvariant /\ Next => InductiveInvariant' PROOF - BY RecognizedCanonicalTransitionPreservesInductiveInvariant, - EvaluatePreservesInductiveInvariant + BY RecognizedSeedTransitionPreservesInductiveInvariant, + RecognizedEnvironmentTransitionPreservesInductiveInvariant DEF Next - THEOREM BoxNextPreservesInductiveInvariant == InductiveInvariant /\ [Next]_vars => InductiveInvariant' @@ -612,7 +527,6 @@ PROOF StateStutterPreservesInductiveInvariant DEF vars - THEOREM SpecImpliesAlwaysInductiveInvariant == Spec => []InductiveInvariant PROOF @@ -621,29 +535,24 @@ PROOF BoxNextPreservesInductiveInvariant DEF Spec - THEOREM AlwaysInductiveInvariantImpliesAlwaysSeedStateSafety == []InductiveInvariant => []SeedStateSafety PROOF BY PTL, InductiveInvariantImpliesSeedStateSafety - THEOREM SpecImpliesAlwaysSeedStateSafety == Spec => []SeedStateSafety PROOF BY SpecImpliesAlwaysInductiveInvariant, AlwaysInductiveInvariantImpliesAlwaysSeedStateSafety - THEOREM RegisterRequestSatisfiesRequestsAppendOnlyStep == \A r \in ResolutionIds, b \in Bindings, a \in Authorities, previous \in TerminalCommitments \cup {NoCommitment} : RegisterRequest(r, b, a, previous) => RequestsAppendOnlyStep PROOF - BY DEF RegisterRequest, - RequestsAppendOnlyStep, - Requests + BY DEF RegisterRequest, RequestsAppendOnlyStep, Requests THEOREM SubmitResolutionSatisfiesRequestsAppendOnlyStep == @@ -651,68 +560,23 @@ THEOREM SubmitResolutionSatisfiesRequestsAppendOnlyStep == value \in TerminalResolutions : SubmitResolution(r, b, a, value) => RequestsAppendOnlyStep PROOF - BY DEF SubmitResolution, - RequestsAppendOnlyStep, - Requests + BY DEF SubmitResolution, RequestsAppendOnlyStep, Requests THEOREM ObserveConflictSatisfiesRequestsAppendOnlyStep == \A r \in ResolutionIds : ObserveConflict(r) => RequestsAppendOnlyStep PROOF - BY DEF ObserveConflict, - RequestsAppendOnlyStep, - Requests - - -THEOREM StateStutterSatisfiesRequestsAppendOnlyStep == - UNCHANGED vars => RequestsAppendOnlyStep -PROOF - BY DEF vars, canonicalVars, RequestsAppendOnlyStep, Requests - - -THEOREM ObserveInvalidMaterialSatisfiesRequestsAppendOnlyStep == - \A r \in ResolutionIds : - ObserveInvalidMaterial(r) => RequestsAppendOnlyStep -PROOF - BY StateStutterSatisfiesRequestsAppendOnlyStep - DEF ObserveInvalidMaterial - - -THEOREM ObserveNonAuthoritativeInputSatisfiesRequestsAppendOnlyStep == - \A r \in ResolutionIds : - ObserveNonAuthoritativeInput(r) => RequestsAppendOnlyStep -PROOF - BY StateStutterSatisfiesRequestsAppendOnlyStep - DEF ObserveNonAuthoritativeInput - - -THEOREM EvaluateSatisfiesRequestsAppendOnlyStep == - Evaluate => RequestsAppendOnlyStep -PROOF - BY StateStutterSatisfiesRequestsAppendOnlyStep - DEF Evaluate - - -THEOREM RecognizedCanonicalTransitionSatisfiesRequestsAppendOnlyStep == - RecognizedCanonicalTransition => RequestsAppendOnlyStep -PROOF - BY RegisterRequestSatisfiesRequestsAppendOnlyStep, - SubmitResolutionSatisfiesRequestsAppendOnlyStep, - ObserveConflictSatisfiesRequestsAppendOnlyStep, - ObserveInvalidMaterialSatisfiesRequestsAppendOnlyStep, - ObserveNonAuthoritativeInputSatisfiesRequestsAppendOnlyStep - DEF RecognizedCanonicalTransition, - RecognizedSeedTransition, - RecognizedEnvironmentTransition + BY DEF ObserveConflict, RequestsAppendOnlyStep, Requests, seedVars THEOREM NextSatisfiesRequestsAppendOnlyStep == Next => RequestsAppendOnlyStep PROOF - BY RecognizedCanonicalTransitionSatisfiesRequestsAppendOnlyStep, - EvaluateSatisfiesRequestsAppendOnlyStep - DEF Next + BY RegisterRequestSatisfiesRequestsAppendOnlyStep, + SubmitResolutionSatisfiesRequestsAppendOnlyStep, + ObserveConflictSatisfiesRequestsAppendOnlyStep + DEF Next, RecognizedSeedTransition, RecognizedEnvironmentTransition THEOREM BoxNextSatisfiesBoxRequestsAppendOnlyStep == @@ -735,9 +599,7 @@ THEOREM RegisterRequestSatisfiesTerminalRecordsImmutableStep == previous \in TerminalCommitments \cup {NoCommitment} : RegisterRequest(r, b, a, previous) => TerminalRecordsImmutableStep PROOF - BY DEF RegisterRequest, - TerminalRecordsImmutableStep, - TerminalRequests + BY DEF RegisterRequest, TerminalRecordsImmutableStep, TerminalRequests THEOREM SubmitResolutionSatisfiesTerminalRecordsImmutableStep == @@ -745,68 +607,23 @@ THEOREM SubmitResolutionSatisfiesTerminalRecordsImmutableStep == value \in TerminalResolutions : SubmitResolution(r, b, a, value) => TerminalRecordsImmutableStep PROOF - BY DEF SubmitResolution, - TerminalRecordsImmutableStep, - TerminalRequests + BY DEF SubmitResolution, TerminalRecordsImmutableStep, TerminalRequests THEOREM ObserveConflictSatisfiesTerminalRecordsImmutableStep == \A r \in ResolutionIds : ObserveConflict(r) => TerminalRecordsImmutableStep PROOF - BY DEF ObserveConflict, - TerminalRecordsImmutableStep, - TerminalRequests - - -THEOREM StateStutterSatisfiesTerminalRecordsImmutableStep == - UNCHANGED vars => TerminalRecordsImmutableStep -PROOF - BY DEF vars, canonicalVars, TerminalRecordsImmutableStep, TerminalRequests - - -THEOREM ObserveInvalidMaterialSatisfiesTerminalRecordsImmutableStep == - \A r \in ResolutionIds : - ObserveInvalidMaterial(r) => TerminalRecordsImmutableStep -PROOF - BY StateStutterSatisfiesTerminalRecordsImmutableStep - DEF ObserveInvalidMaterial - - -THEOREM ObserveNonAuthoritativeInputSatisfiesTerminalRecordsImmutableStep == - \A r \in ResolutionIds : - ObserveNonAuthoritativeInput(r) => TerminalRecordsImmutableStep -PROOF - BY StateStutterSatisfiesTerminalRecordsImmutableStep - DEF ObserveNonAuthoritativeInput - - -THEOREM EvaluateSatisfiesTerminalRecordsImmutableStep == - Evaluate => TerminalRecordsImmutableStep -PROOF - BY StateStutterSatisfiesTerminalRecordsImmutableStep - DEF Evaluate - - -THEOREM RecognizedCanonicalTransitionSatisfiesTerminalRecordsImmutableStep == - RecognizedCanonicalTransition => TerminalRecordsImmutableStep -PROOF - BY RegisterRequestSatisfiesTerminalRecordsImmutableStep, - SubmitResolutionSatisfiesTerminalRecordsImmutableStep, - ObserveConflictSatisfiesTerminalRecordsImmutableStep, - ObserveInvalidMaterialSatisfiesTerminalRecordsImmutableStep, - ObserveNonAuthoritativeInputSatisfiesTerminalRecordsImmutableStep - DEF RecognizedCanonicalTransition, - RecognizedSeedTransition, - RecognizedEnvironmentTransition + BY DEF ObserveConflict, TerminalRecordsImmutableStep, TerminalRequests, seedVars THEOREM NextSatisfiesTerminalRecordsImmutableStep == Next => TerminalRecordsImmutableStep PROOF - BY RecognizedCanonicalTransitionSatisfiesTerminalRecordsImmutableStep, - EvaluateSatisfiesTerminalRecordsImmutableStep - DEF Next + BY RegisterRequestSatisfiesTerminalRecordsImmutableStep, + SubmitResolutionSatisfiesTerminalRecordsImmutableStep, + ObserveConflictSatisfiesTerminalRecordsImmutableStep + DEF Next, RecognizedSeedTransition, RecognizedEnvironmentTransition THEOREM BoxNextSatisfiesBoxTerminalRecordsImmutableStep == @@ -824,102 +641,68 @@ PROOF DEF Spec, TerminalRecordsImmutable -THEOREM RecognizedCanonicalTransitionSatisfiesCanonicalTransitionStep == - RecognizedCanonicalTransition - => CanonicalStateChangesOnlyByRecognizedTransitionStep -PROOF - BY DEF CanonicalStateChangesOnlyByRecognizedTransitionStep - - -THEOREM EvaluateSatisfiesCanonicalTransitionStep == - Evaluate => CanonicalStateChangesOnlyByRecognizedTransitionStep -PROOF - BY DEF Evaluate, - vars, - canonicalVars, - CanonicalStateChangesOnlyByRecognizedTransitionStep - - -THEOREM NextSatisfiesCanonicalTransitionStep == - Next => CanonicalStateChangesOnlyByRecognizedTransitionStep +THEOREM RecognizedSeedTransitionSatisfiesSeedStateTransitionStep == + RecognizedSeedTransition => SeedStateChangesOnlyByRecognizedTransitionStep PROOF - BY RecognizedCanonicalTransitionSatisfiesCanonicalTransitionStep, - EvaluateSatisfiesCanonicalTransitionStep - DEF Next - - -THEOREM BoxNextSatisfiesBoxCanonicalTransitionStep == - [Next]_vars => [CanonicalStateChangesOnlyByRecognizedTransitionStep]_vars -PROOF - BY NextSatisfiesCanonicalTransitionStep - DEF vars, - canonicalVars, - CanonicalStateChangesOnlyByRecognizedTransitionStep - - -THEOREM SpecImpliesCanonicalStateChangesOnlyByRecognizedTransition == - Spec => CanonicalStateChangesOnlyByRecognizedTransition -PROOF - BY PTL, - BoxNextSatisfiesBoxCanonicalTransitionStep - DEF Spec, CanonicalStateChangesOnlyByRecognizedTransition + BY DEF SeedStateChangesOnlyByRecognizedTransitionStep -THEOREM InvalidMaterialActionIsStutter == +THEOREM ObserveConflictSatisfiesSeedStateTransitionStep == \A r \in ResolutionIds : - ObserveInvalidMaterial(r) => UNCHANGED vars + ObserveConflict(r) => SeedStateChangesOnlyByRecognizedTransitionStep PROOF - BY DEF ObserveInvalidMaterial + BY DEF ObserveConflict, seedVars, SeedStateChangesOnlyByRecognizedTransitionStep -THEOREM NextSatisfiesInvalidMaterialStutterStep == - Next => InvalidMaterialStutterStep +THEOREM NextSatisfiesSeedStateTransitionStep == + Next => SeedStateChangesOnlyByRecognizedTransitionStep PROOF - BY InvalidMaterialActionIsStutter - DEF InvalidMaterialStutterStep + BY RecognizedSeedTransitionSatisfiesSeedStateTransitionStep, + ObserveConflictSatisfiesSeedStateTransitionStep + DEF Next, RecognizedEnvironmentTransition -THEOREM BoxNextSatisfiesBoxInvalidMaterialStutterStep == - [Next]_vars => [InvalidMaterialStutterStep]_vars +THEOREM BoxNextSatisfiesBoxSeedStateTransitionStep == + [Next]_vars => [SeedStateChangesOnlyByRecognizedTransitionStep]_vars PROOF - BY NextSatisfiesInvalidMaterialStutterStep - DEF vars, InvalidMaterialStutterStep + BY NextSatisfiesSeedStateTransitionStep + DEF vars, SeedStateChangesOnlyByRecognizedTransitionStep -THEOREM SpecImpliesInvalidMaterialStutter == - Spec => InvalidMaterialStutter +THEOREM SpecImpliesSeedStateChangesOnlyByRecognizedTransition == + Spec => SeedStateChangesOnlyByRecognizedTransition PROOF BY PTL, - BoxNextSatisfiesBoxInvalidMaterialStutterStep - DEF Spec, InvalidMaterialStutter + BoxNextSatisfiesBoxSeedStateTransitionStep + DEF Spec, SeedStateChangesOnlyByRecognizedTransition -THEOREM NonAuthoritativeInputActionIsStutter == +THEOREM ObserveConflictPreservesSeedState == \A r \in ResolutionIds : - ObserveNonAuthoritativeInput(r) => UNCHANGED vars + ObserveConflict(r) => UNCHANGED seedVars PROOF - BY DEF ObserveNonAuthoritativeInput + BY DEF ObserveConflict -THEOREM NextSatisfiesNonAuthoritativeInputsStutterStep == - Next => NonAuthoritativeInputsStutterStep +THEOREM NextSatisfiesConflictObservationPreservesSeedStateStep == + Next => ConflictObservationPreservesSeedStateStep PROOF - BY NonAuthoritativeInputActionIsStutter - DEF NonAuthoritativeInputsStutterStep + BY ObserveConflictPreservesSeedState + DEF ConflictObservationPreservesSeedStateStep -THEOREM BoxNextSatisfiesBoxNonAuthoritativeInputsStutterStep == - [Next]_vars => [NonAuthoritativeInputsStutterStep]_vars +THEOREM BoxNextSatisfiesBoxConflictObservationPreservesSeedStateStep == + [Next]_vars => [ConflictObservationPreservesSeedStateStep]_vars PROOF - BY NextSatisfiesNonAuthoritativeInputsStutterStep - DEF vars, NonAuthoritativeInputsStutterStep + BY NextSatisfiesConflictObservationPreservesSeedStateStep + DEF vars, ConflictObservationPreservesSeedStateStep -THEOREM SpecImpliesNonAuthoritativeInputsStutter == - Spec => NonAuthoritativeInputsStutter +THEOREM SpecImpliesConflictObservationPreservesSeedState == + Spec => ConflictObservationPreservesSeedState PROOF BY PTL, - BoxNextSatisfiesBoxNonAuthoritativeInputsStutterStep - DEF Spec, NonAuthoritativeInputsStutter + BoxNextSatisfiesBoxConflictObservationPreservesSeedStateStep + DEF Spec, ConflictObservationPreservesSeedState ============================================================================= diff --git a/seed/canonical/migration/ALPHA2_TO_0.3_ALPHA1.md b/seed/canonical/migration/ALPHA2_TO_0.3_ALPHA1.md index b8ab3bf..584a59b 100644 --- a/seed/canonical/migration/ALPHA2_TO_0.3_ALPHA1.md +++ b/seed/canonical/migration/ALPHA2_TO_0.3_ALPHA1.md @@ -7,7 +7,7 @@ This migration is intentionally breaking. | `status = UNKNOWN` and `enforcement = BLOCKED` | derived `resolution = UNKNOWN` | | `status = ACCEPT` and `enforcement = ALLOW` | terminal `resolution = ALLOW` | | `status = DENY` and `enforcement = BLOCKED` | terminal `resolution = BLOCK` | -| mutable current Authority and escalation chain | immutable Authority proof material attached to the terminal record | +| mutable current Authority and escalation chain | exact-binding Authority recognition plus optional opaque evidence references | | open/escalate/resolve workflow state | append-only request and terminal-record store | -A 0.2 implementation cannot claim 0.3 conformance by renaming fields. It must implement the 0.3 exact-binding, local Authority proof, terminal uniqueness and fail-closed evaluation rules. +A 0.2 implementation cannot claim 0.3 conformance by renaming fields. It must implement the 0.3 exact-binding, local exact-binding Authority recognition, terminal uniqueness and fail-closed evaluation rules. diff --git a/seed/canonical/migration/CANON_CHANGE_DECLARATION.json b/seed/canonical/migration/CANON_CHANGE_DECLARATION.json index baef48e..998d023 100644 --- a/seed/canonical/migration/CANON_CHANGE_DECLARATION.json +++ b/seed/canonical/migration/CANON_CHANGE_DECLARATION.json @@ -1,10 +1,10 @@ { - "candidate_model_sha256": "sha256:b5e68692317600fd2833474a1f9c31f09e44d37ae92ec14573b416076c5dd7f6", + "candidate_model_sha256": "sha256:c43ca7b642a11c3ab140884a6bbff34bbd741f5cb905e6a779c860c813998fcf", "change_class": "BREAKING", "change_kind": "SEMANTIC_SIMPLIFICATION", - "decision_ref": "seed/canonical/decisions/ADR-007-reconsideration-commitments-and-bounded-retention.md", + "decision_ref": "seed/canonical/decisions/ADR-009-seed-state-environment-observer-and-authority-boundary.md", "document_type": "aset-canon-change-declaration", - "rationale": "Seed 0.3 keeps reconsideration tied to immutable recognized terminal commitments while removing any requirement to retain predecessor request/record objects or an ever-growing canonical receipt registry.", + "rationale": "Seed 0.3 deep-refactors the active resolution core: exact-binding Authority recognition replaces grant-chain semantics, Seed-owned state is separated from environment conflict state, evaluation is an observer, invalid/non-authoritative material cannot override a unique valid terminal record, and the canon-to-TLA projection is standalone.", "schema_version": 1, "supersession_ref": "seed/canonical/migration/ALPHA2_TO_0.3_ALPHA1_CHANGE_DECLARATION.json" } diff --git a/seed/canonical/migration/RC12_TO_RESOLUTION_CORE.md b/seed/canonical/migration/RC12_TO_RESOLUTION_CORE.md index 4aec60b..03b06aa 100644 --- a/seed/canonical/migration/RC12_TO_RESOLUTION_CORE.md +++ b/seed/canonical/migration/RC12_TO_RESOLUTION_CORE.md @@ -2,8 +2,20 @@ This is an intentional breaking semantic narrowing. -The active Seed no longer defines the complete execution, verification, federation and lifecycle protocol. It defines only an exact resolution cycle whose semantic state starts as `UNKNOWN`, may be explicitly escalated while remaining `UNKNOWN`, and terminates as `ACCEPT` or `DENY`. +The active Seed no longer defines the RC11/RC12 execution, permit, +verification, federation, membership or context-lifecycle protocol. It defines +only local resolution recognition: -`UNKNOWN` is always operationally blocked and is never silently rewritten as `DENY`. Context ancestry and federation membership do not create authority; every escalation requires an exact grant. + UNKNOWN | ALLOW | BLOCK -The former rc11/rc12 concepts remain historical evidence and are migration sources for separate Context, Federation, Core, Monade and implementation extensions. +`UNKNOWN` is derived and fail-closed. `ALLOW` and `BLOCK` are immutable terminal +values. A request is admitted under an exact binding and recognized local +Authority. A terminal record is accepted only when its Authority is explicitly +recognized for that exact binding. + +There is no active Seed escalation workflow or grant-chain interpreter. +Concrete delegation/signature/evidence mechanisms may establish Authority +recognition externally, but they are not Seed state or Seed transitions. + +The former RC11/RC12 concepts remain historical migration evidence and belong +to separately versioned extensions or implementations when reused. diff --git a/seed/canonical/migration/WIRE_V2_TO_V3.md b/seed/canonical/migration/WIRE_V2_TO_V3.md new file mode 100644 index 0000000..12212ec --- /dev/null +++ b/seed/canonical/migration/WIRE_V2_TO_V3.md @@ -0,0 +1,34 @@ +# Seed resolution wire V2 → V3 + +Wire/profile V3 is a breaking cleanup of the active Seed 0.3 candidate. + +## Removed from the active store + +- `authority_grants`; +- concrete delegation/grant-chain interpretation. + +## Authority recognition + +`ResolutionAuthorityBinding` now represents the exact-binding recognition fact +consumed by Seed. Concrete signatures, certificates, delegation chains and +other evidence mechanisms are external to the Seed wire semantics. + +`ResolutionRecord.authority_proof_digests` is replaced by +`authority_evidence_digests`. These references are opaque and non-authoritative; +they do not create Authority by themselves. + +## Operation roles + +`REGISTER_REQUEST` and `SUBMIT_RESOLUTION` are state transitions. +`EVALUATE_RESOLUTION` is a pure observer. + +## Invalid material + +Malformed or non-authoritative material does not override an otherwise unique +valid terminal record. Conflict means conflict among valid terminal material. + +## Active schema surface + +Wire V3 contains only the schemas declared by the active protocol profile. +Historical RC11/RC12 schema copies remain in frozen release bundles rather than +being duplicated in the active protocol directory. diff --git a/seed/canonical/ontology/seed.ttl b/seed/canonical/ontology/seed.ttl index 3647a74..b37902a 100644 --- a/seed/canonical/ontology/seed.ttl +++ b/seed/canonical/ontology/seed.ttl @@ -29,23 +29,23 @@ aset:local_authority a owl:Class ; rdfs:label "Authority local"@pt-BR ; rdfs:comment "An Authority explicitly recognized by one Context for one exact binding and policy epoch."@en . -aset:authority_proof a owl:Class ; - rdfs:label "доказательство Authority"@ru ; - rdfs:label "Authority proof"@en ; - rdfs:label "prova de Authority"@pt-BR ; - rdfs:comment "A locally rooted, exact-binding, acyclic and non-expanding chain of explicit Authority grants."@en . +aset:authority_recognition a owl:Class ; + rdfs:label "признание Authority"@ru ; + rdfs:label "Authority recognition"@en ; + rdfs:label "reconhecimento de Authority"@pt-BR ; + rdfs:comment "A local exact-binding recognition result stating that one Authority is authorized for one ResolutionBinding; concrete grant chains, signatures and proof construction are external to Seed."@en . aset:evidence_reference a owl:Class ; rdfs:label "ссылка на основание"@ru ; rdfs:label "evidence reference"@en ; rdfs:label "referência de evidência"@pt-BR ; - rdfs:comment "A content-addressed non-authoritative input cited as the basis of a terminal record."@en . + rdfs:comment "An opaque content-addressed reference to non-authoritative evidence or proof material. It has no normative effect until a Seed admission boundary recognizes the fact it supports."@en . aset:resolution_record a owl:Class ; rdfs:label "запись разрешения"@ru ; rdfs:label "resolution record"@en ; rdfs:label "registro de resolução"@pt-BR ; - rdfs:comment "One immutable content-addressed terminal ALLOW or BLOCK record with exact binding and Authority proof."@en . + rdfs:comment "One immutable content-addressed terminal ALLOW or BLOCK record with exact binding, a recognized Authority, and optional opaque evidence references."@en . aset:reconsideration_commitment a owl:Class ; rdfs:label "коммитмент пересмотра"@ru ; diff --git a/seed/canonical/protocol/README.md b/seed/canonical/protocol/README.md new file mode 100644 index 0000000..7bdeb22 --- /dev/null +++ b/seed/canonical/protocol/README.md @@ -0,0 +1,13 @@ +# Active Seed 0.3 protocol surface + +This directory contains only schemas declared by +`seed/canonical/protocol/protocol-profile.json`. + +Older RC11/RC12 permit, outcome, membership, context-lifecycle and federation +schemas are not part of the active Seed 0.3 protocol. Their immutable historical +copies remain in frozen release bundles and historical generated editions under +`seed/releases/` and `docs/generated/*/ASET_Seed_0.1-rc12.md`. + +The active protocol intentionally exposes an exact-binding Authority recognition +record rather than a grant-chain interpreter. `authority_evidence_digests` in a +terminal record are opaque references; they do not create Authority by themselves. diff --git a/seed/canonical/protocol/protocol-profile.json b/seed/canonical/protocol/protocol-profile.json index fdef015..8301b39 100644 --- a/seed/canonical/protocol/protocol-profile.json +++ b/seed/canonical/protocol/protocol-profile.json @@ -8,14 +8,14 @@ "SUBMIT_RESOLUTION", "EVALUATE_RESOLUTION" ], - "profile_id": "ASET-SEED-RESOLUTION-WIRE-V2", + "profile_id": "ASET-SEED-RESOLUTION-WIRE-V3", "resolution_values": [ "UNKNOWN", "ALLOW", "BLOCK" ], - "schema_count": 12, - "schema_version": 2, + "schema_count": 11, + "schema_version": 3, "schemas": [ { "id": "https://spec.aset.example/seed/0.3/schemas/common.schema.json", @@ -33,13 +33,7 @@ "id": "https://spec.aset.example/seed/0.3/schemas/resolution-authority-binding.schema.json", "name": "resolution-authority-binding.schema.json", "path": "seed/canonical/protocol/schemas/resolution-authority-binding.schema.json", - "sha256": "sha256:803f1747968009dd4f4a6d35406439ec52036686bb0eecd57be56a606dc9e022" - }, - { - "id": "https://spec.aset.example/seed/0.3/schemas/authority-grant.schema.json", - "name": "authority-grant.schema.json", - "path": "seed/canonical/protocol/schemas/authority-grant.schema.json", - "sha256": "sha256:1acedba9b138bbf18969bccdc77cdc891e768338f90a6a527adf75fa49f7204f" + "sha256": "sha256:7d5858951bc412ea095cf36867304293c521ee03bc1682ce9683782004d1c94d" }, { "id": "https://spec.aset.example/seed/0.3/schemas/resolution-request.schema.json", @@ -51,13 +45,13 @@ "id": "https://spec.aset.example/seed/0.3/schemas/resolution-record.schema.json", "name": "resolution-record.schema.json", "path": "seed/canonical/protocol/schemas/resolution-record.schema.json", - "sha256": "sha256:0f37ae49b8365f89efdd96ba3bcc8adb827ecaf973b8ddbaf40169fb7ee6f6ca" + "sha256": "sha256:a5f49bd2dcfd0aff0bc6413a0b32e7f6996250fd06d8bc2ab53ff98eb22a9450" }, { "id": "https://spec.aset.example/seed/0.3/schemas/resolution-store.schema.json", "name": "resolution-store.schema.json", "path": "seed/canonical/protocol/schemas/resolution-store.schema.json", - "sha256": "sha256:bebd92802b3e6bb6264c08599bdff34bcc40e26e76d0163470953ea0e1d1e5da" + "sha256": "sha256:24a175ef5345c0f9fb0b555a7eeec08c20e557937e7aa51682dd4dcc50acc449" }, { "id": "https://spec.aset.example/seed/0.3/schemas/resolution-evaluation.schema.json", diff --git a/seed/canonical/protocol/schemas/authority-binding.schema.json b/seed/canonical/protocol/schemas/authority-binding.schema.json deleted file mode 100644 index aeac0c1..0000000 --- a/seed/canonical/protocol/schemas/authority-binding.schema.json +++ /dev/null @@ -1,73 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/authority-binding.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "authority_epoch": { - "minimum": 0, - "type": "integer" - }, - "authority_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "capability_kind": { - "minLength": 1, - "type": "string" - }, - "context_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "grant_provenance": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "holder_principal_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "scope": { - "items": { - "maxLength": 120, - "minLength": 1, - "type": "string" - }, - "minItems": 1, - "type": "array", - "uniqueItems": true - }, - "scope_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "status": { - "enum": [ - "ACTIVE", - "TRANSFERRED", - "REVOKED", - "SUSPENDED" - ] - } - }, - "required": [ - "authority_id", - "context_id", - "capability_kind", - "scope", - "scope_digest", - "holder_principal_id", - "authority_epoch", - "status", - "grant_provenance" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/authority-grant.schema.json b/seed/canonical/protocol/schemas/authority-grant.schema.json deleted file mode 100644 index 9cbe029..0000000 --- a/seed/canonical/protocol/schemas/authority-grant.schema.json +++ /dev/null @@ -1,41 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.3/schemas/authority-grant.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "binding_digest": { - "$ref": "common.schema.json#/$defs/digest" - }, - "delegation_allowed": { - "type": "boolean" - }, - "grant_digest": { - "$ref": "common.schema.json#/$defs/digest" - }, - "issuer_authority_id": { - "$ref": "common.schema.json#/$defs/identifier" - }, - "previous_grant_digest": { - "anyOf": [ - { - "$ref": "common.schema.json#/$defs/digest" - }, - { - "type": "null" - } - ] - }, - "subject_authority_id": { - "$ref": "common.schema.json#/$defs/identifier" - } - }, - "required": [ - "grant_digest", - "issuer_authority_id", - "subject_authority_id", - "binding_digest", - "previous_grant_digest", - "delegation_allowed" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/constitution.schema.json b/seed/canonical/protocol/schemas/constitution.schema.json deleted file mode 100644 index 80bdbae..0000000 --- a/seed/canonical/protocol/schemas/constitution.schema.json +++ /dev/null @@ -1,66 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/constitution.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "accepted_coordination_proofs": { - "items": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "type": "array", - "uniqueItems": true - }, - "accepted_patches": { - "items": { - "type": "object" - }, - "type": "array" - }, - "constitution_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "coordination_classes": { - "additionalProperties": { - "enum": [ - "MONOTONE_LOCAL", - "INVARIANT_CONFLUENT", - "COORDINATION_REQUIRED" - ] - }, - "type": "object" - }, - "identity_immunities": { - "items": { - "minLength": 1, - "type": "string" - }, - "type": "array", - "uniqueItems": true - }, - "policy_version": { - "minimum": 1, - "type": "integer" - }, - "rules": { - "additionalProperties": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "type": "object" - } - }, - "required": [ - "constitution_id", - "policy_version", - "identity_immunities", - "coordination_classes", - "accepted_coordination_proofs", - "accepted_patches", - "rules" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/context-descriptor.schema.json b/seed/canonical/protocol/schemas/context-descriptor.schema.json deleted file mode 100644 index cdab739..0000000 --- a/seed/canonical/protocol/schemas/context-descriptor.schema.json +++ /dev/null @@ -1,152 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/context-descriptor.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "alias": { - "minLength": 1, - "type": "string" - }, - "constitution_epoch": { - "minimum": 0, - "type": "integer" - }, - "context_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "context_kind": { - "enum": [ - "ROOT", - "FEDERATION", - "SUBJECT", - "ORGANIZATION", - "AI_AGENT" - ] - }, - "export_root": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "genesis_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "guarantee_status": { - "enum": [ - "CONFIRMED", - "SUSPENDED", - "TERMINATED" - ] - }, - "internal_state_root": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "last_confirmed_export_root": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "lifecycle": { - "enum": [ - "ACTIVE", - "WITHDRAWN", - "SUPERSEDED", - "TERMINATED" - ] - }, - "local_ordinal": { - "minimum": 0, - "type": "integer" - }, - "member_principal_id": { - "oneOf": [ - { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - { - "type": "null" - } - ] - }, - "parent_context_id": { - "oneOf": [ - { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - { - "type": "null" - } - ] - }, - "unconfirmed_commits": { - "additionalProperties": { - "additionalProperties": false, - "properties": { - "commit_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "commit_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "new_export_root": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "operation_class": { - "minLength": 1, - "type": "string" - }, - "parent_export_root": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "signer_principal_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - } - }, - "required": [ - "commit_id", - "parent_export_root", - "new_export_root", - "operation_class", - "commit_digest", - "signer_principal_id" - ], - "type": "object" - }, - "type": "object" - } - }, - "required": [ - "context_id", - "parent_context_id", - "context_kind", - "member_principal_id", - "genesis_digest", - "constitution_epoch", - "local_ordinal", - "lifecycle", - "guarantee_status", - "internal_state_root", - "export_root", - "last_confirmed_export_root", - "alias" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/context-redefinition-record.schema.json b/seed/canonical/protocol/schemas/context-redefinition-record.schema.json deleted file mode 100644 index 1b50d7c..0000000 --- a/seed/canonical/protocol/schemas/context-redefinition-record.schema.json +++ /dev/null @@ -1,57 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/context-redefinition-record.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "affected_context_ids": { - "items": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/common.schema.json#/$defs/id" - }, - "type": "array", - "uniqueItems": true - }, - "context_id": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/common.schema.json#/$defs/id" - }, - "proposal": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/payload-context-redefine.schema.json#/properties/proposal" - }, - "proposal_digest": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/common.schema.json#/$defs/digest" - }, - "redefinition_id": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/common.schema.json#/$defs/id" - }, - "successor_map": { - "additionalProperties": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/common.schema.json#/$defs/id" - }, - "type": "object" - }, - "target_context_id": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/common.schema.json#/$defs/id" - }, - "transition_ref": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/common.schema.json#/$defs/id" - }, - "withdrawal_refs": { - "items": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/common.schema.json#/$defs/id" - }, - "type": "array", - "uniqueItems": true - } - }, - "required": [ - "redefinition_id", - "context_id", - "target_context_id", - "proposal", - "proposal_digest", - "affected_context_ids", - "successor_map", - "withdrawal_refs", - "transition_ref" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/correction-record.schema.json b/seed/canonical/protocol/schemas/correction-record.schema.json deleted file mode 100644 index 4750591..0000000 --- a/seed/canonical/protocol/schemas/correction-record.schema.json +++ /dev/null @@ -1,61 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/correction-record.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "context_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "correction_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "corrector_principal_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "reason_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "replacement_ref": { - "oneOf": [ - { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - { - "type": "null" - } - ] - }, - "target_ref": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "target_type": { - "const": "VERIFICATION" - } - }, - "required": [ - "correction_id", - "context_id", - "target_type", - "target_ref", - "replacement_ref", - "reason_digest", - "corrector_principal_id" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/decision.schema.json b/seed/canonical/protocol/schemas/decision.schema.json deleted file mode 100644 index 564ef04..0000000 --- a/seed/canonical/protocol/schemas/decision.schema.json +++ /dev/null @@ -1,82 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/decision.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "conditions_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "constitution_epoch": { - "minimum": 0, - "type": "integer" - }, - "context_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "decision_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "decision_kind": { - "type": "string" - }, - "issuer_principal_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "related_ref": { - "oneOf": [ - { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - { - "type": "null" - } - ] - }, - "scope": { - "items": { - "maxLength": 120, - "minLength": 1, - "type": "string" - }, - "minItems": 1, - "type": "array", - "uniqueItems": true - }, - "scope_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "subject_principal_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - } - }, - "required": [ - "decision_id", - "context_id", - "decision_kind", - "issuer_principal_id", - "subject_principal_id", - "scope", - "scope_digest", - "conditions_digest", - "related_ref", - "constitution_epoch" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/execution-intent.schema.json b/seed/canonical/protocol/schemas/execution-intent.schema.json deleted file mode 100644 index ba5b71e..0000000 --- a/seed/canonical/protocol/schemas/execution-intent.schema.json +++ /dev/null @@ -1,50 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/execution-intent.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "candidate_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "context_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "execution_intent_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "permit_ref": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "presenter_principal_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "submission_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - } - }, - "required": [ - "execution_intent_id", - "context_id", - "permit_ref", - "presenter_principal_id", - "submission_id", - "candidate_digest" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/export-receipt.schema.json b/seed/canonical/protocol/schemas/export-receipt.schema.json deleted file mode 100644 index fa74587..0000000 --- a/seed/canonical/protocol/schemas/export-receipt.schema.json +++ /dev/null @@ -1,82 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/export-receipt.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "claim_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "context_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "export_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "guarantee_status": { - "enum": [ - "CONFIRMED", - "SUSPENDED", - "TERMINATED" - ] - }, - "issuer_principal_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "outcome_ref": { - "oneOf": [ - { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - { - "type": "null" - } - ] - }, - "previous_export_root": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "source_context_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "source_export_root": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "transition_ref": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - } - }, - "required": [ - "export_id", - "context_id", - "source_context_id", - "source_export_root", - "claim_digest", - "outcome_ref", - "guarantee_status", - "issuer_principal_id", - "previous_export_root", - "transition_ref" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/import-observation.schema.json b/seed/canonical/protocol/schemas/import-observation.schema.json deleted file mode 100644 index 4c36d7c..0000000 --- a/seed/canonical/protocol/schemas/import-observation.schema.json +++ /dev/null @@ -1,50 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/import-observation.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "claim_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "context_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "export_ref": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "import_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "importer_principal_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "target_context_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - } - }, - "required": [ - "import_id", - "context_id", - "target_context_id", - "export_ref", - "claim_digest", - "importer_principal_id" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/membership-withdrawal-record.schema.json b/seed/canonical/protocol/schemas/membership-withdrawal-record.schema.json deleted file mode 100644 index c595488..0000000 --- a/seed/canonical/protocol/schemas/membership-withdrawal-record.schema.json +++ /dev/null @@ -1,71 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/membership-withdrawal-record.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "authorization_proof_digest": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/common.schema.json#/$defs/digest" - }, - "context_id": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/common.schema.json#/$defs/id" - }, - "member_principal_id": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/common.schema.json#/$defs/id" - }, - "mode": { - "enum": [ - "VOLUNTARY_EXIT", - "REDEFINITION" - ] - }, - "parent_context_id": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/common.schema.json#/$defs/id" - }, - "proposal_digest": { - "oneOf": [ - { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/common.schema.json#/$defs/digest" - }, - { - "type": "null" - } - ] - }, - "reason_digest": { - "oneOf": [ - { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/common.schema.json#/$defs/digest" - }, - { - "type": "null" - } - ] - }, - "transition_ref": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/common.schema.json#/$defs/id" - }, - "withdrawal_id": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/common.schema.json#/$defs/id" - }, - "withdrawn_context_ids": { - "items": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/common.schema.json#/$defs/id" - }, - "type": "array", - "uniqueItems": true - } - }, - "required": [ - "withdrawal_id", - "context_id", - "parent_context_id", - "mode", - "member_principal_id", - "reason_digest", - "proposal_digest", - "withdrawn_context_ids", - "authorization_proof_digest", - "transition_ref" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/observation.schema.json b/seed/canonical/protocol/schemas/observation.schema.json deleted file mode 100644 index da3c337..0000000 --- a/seed/canonical/protocol/schemas/observation.schema.json +++ /dev/null @@ -1,75 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/observation.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "claim_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "claim_subject_context_id": { - "oneOf": [ - { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - { - "type": "null" - } - ] - }, - "context_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "evidence_refs": { - "items": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "type": "array", - "uniqueItems": true - }, - "observation_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "observer_principal_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "permit_ref": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "receipt_ref": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - } - }, - "required": [ - "observation_id", - "context_id", - "permit_ref", - "receipt_ref", - "observer_principal_id", - "claim_digest", - "evidence_refs", - "claim_subject_context_id" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/outcome.schema.json b/seed/canonical/protocol/schemas/outcome.schema.json deleted file mode 100644 index f99804b..0000000 --- a/seed/canonical/protocol/schemas/outcome.schema.json +++ /dev/null @@ -1,57 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/outcome.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "confirmer_principal_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "context_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "outcome_class": { - "enum": [ - "POSITIVE", - "NEGATIVE" - ] - }, - "outcome_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "permit_ref": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "verification_refs": { - "items": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "minItems": 1, - "type": "array", - "uniqueItems": true - } - }, - "required": [ - "outcome_id", - "context_id", - "permit_ref", - "verification_refs", - "confirmer_principal_id", - "outcome_class" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/payload-authority-transfer.schema.json b/seed/canonical/protocol/schemas/payload-authority-transfer.schema.json deleted file mode 100644 index e8febee..0000000 --- a/seed/canonical/protocol/schemas/payload-authority-transfer.schema.json +++ /dev/null @@ -1,31 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/payload-authority-transfer.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "authority_ref": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "new_holder_principal_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "outcome_ref": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - } - }, - "required": [ - "authority_ref", - "outcome_ref", - "new_holder_principal_id" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/payload-context-redefine.schema.json b/seed/canonical/protocol/schemas/payload-context-redefine.schema.json deleted file mode 100644 index a38b8e9..0000000 --- a/seed/canonical/protocol/schemas/payload-context-redefine.schema.json +++ /dev/null @@ -1,121 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/payload-context-redefine.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "proposal": { - "additionalProperties": false, - "properties": { - "parent_context_id": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/common.schema.json#/$defs/id" - }, - "proposal_nonce": { - "minLength": 1, - "type": "string" - }, - "replacements": { - "items": { - "additionalProperties": false, - "properties": { - "context_genesis_nonce": { - "minLength": 1, - "type": "string" - }, - "depends_on_context_ids": { - "items": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/common.schema.json#/$defs/id" - }, - "type": "array", - "uniqueItems": true - }, - "initial_authorities": { - "items": { - "additionalProperties": false, - "properties": { - "capability_kind": { - "minLength": 1, - "type": "string" - }, - "holder_principal_id": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/common.schema.json#/$defs/id" - }, - "scope": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/common.schema.json#/$defs/scope" - } - }, - "required": [ - "capability_kind", - "holder_principal_id", - "scope" - ], - "type": "object" - }, - "type": "array", - "uniqueItems": true - }, - "old_context_id": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/common.schema.json#/$defs/id" - } - }, - "required": [ - "old_context_id", - "context_genesis_nonce", - "initial_authorities", - "depends_on_context_ids" - ], - "type": "object" - }, - "minItems": 1, - "type": "array" - }, - "target_context_id": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/common.schema.json#/$defs/id" - } - }, - "required": [ - "parent_context_id", - "target_context_id", - "proposal_nonce", - "replacements" - ], - "type": "object" - }, - "proposal_digest": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/common.schema.json#/$defs/digest" - }, - "withdrawal_authorizations": { - "items": { - "additionalProperties": false, - "properties": { - "context_id": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/common.schema.json#/$defs/id" - }, - "member_principal_id": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/common.schema.json#/$defs/id" - }, - "proof_digest": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/common.schema.json#/$defs/digest" - }, - "proposal_digest": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/common.schema.json#/$defs/digest" - } - }, - "required": [ - "context_id", - "member_principal_id", - "proposal_digest", - "proof_digest" - ], - "type": "object" - }, - "minItems": 1, - "type": "array" - } - }, - "required": [ - "proposal", - "proposal_digest", - "withdrawal_authorizations" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/payload-context-terminate.schema.json b/seed/canonical/protocol/schemas/payload-context-terminate.schema.json deleted file mode 100644 index b6ba4a0..0000000 --- a/seed/canonical/protocol/schemas/payload-context-terminate.schema.json +++ /dev/null @@ -1,37 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/payload-context-terminate.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "child_context_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "reason": { - "enum": [ - "TRUST_LINEAGE_LOST" - ] - }, - "verification_ref": { - "oneOf": [ - { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - { - "type": "null" - } - ] - } - }, - "required": [ - "child_context_id", - "reason", - "verification_ref" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/payload-correction.schema.json b/seed/canonical/protocol/schemas/payload-correction.schema.json deleted file mode 100644 index ffc6083..0000000 --- a/seed/canonical/protocol/schemas/payload-correction.schema.json +++ /dev/null @@ -1,40 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/payload-correction.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "reason_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "replacement_ref": { - "oneOf": [ - { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - { - "type": "null" - } - ] - }, - "target_ref": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "target_type": { - "const": "VERIFICATION" - } - }, - "required": [ - "target_type", - "target_ref", - "replacement_ref", - "reason_digest" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/payload-decision.schema.json b/seed/canonical/protocol/schemas/payload-decision.schema.json deleted file mode 100644 index 039c62b..0000000 --- a/seed/canonical/protocol/schemas/payload-decision.schema.json +++ /dev/null @@ -1,60 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/payload-decision.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "conditions_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "decision_kind": { - "enum": [ - "READINESS_EXECUTE", - "READINESS_ACCEPT_RESPONSIBILITY", - "ISSUE_PERMIT", - "CONFIRM_OUTCOME", - "AMEND", - "SUSPEND_GUARANTEE", - "TERMINATE_CONTEXT", - "TRANSFER_AUTHORITY" - ] - }, - "related_ref": { - "oneOf": [ - { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - { - "type": "null" - } - ] - }, - "scope": { - "items": { - "maxLength": 120, - "minLength": 1, - "type": "string" - }, - "minItems": 1, - "type": "array", - "uniqueItems": true - }, - "subject_principal_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - } - }, - "required": [ - "decision_kind", - "subject_principal_id", - "scope", - "conditions_digest", - "related_ref" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/payload-export.schema.json b/seed/canonical/protocol/schemas/payload-export.schema.json deleted file mode 100644 index 87ccb2a..0000000 --- a/seed/canonical/protocol/schemas/payload-export.schema.json +++ /dev/null @@ -1,34 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/payload-export.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "claim_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "outcome_ref": { - "oneOf": [ - { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - { - "type": "null" - } - ] - }, - "source_export_root": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - } - }, - "required": [ - "source_export_root", - "claim_digest", - "outcome_ref" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/payload-guarantee-suspend.schema.json b/seed/canonical/protocol/schemas/payload-guarantee-suspend.schema.json deleted file mode 100644 index 26029f3..0000000 --- a/seed/canonical/protocol/schemas/payload-guarantee-suspend.schema.json +++ /dev/null @@ -1,22 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/payload-guarantee-suspend.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "child_context_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "reason_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - } - }, - "required": [ - "child_context_id", - "reason_digest" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/payload-import.schema.json b/seed/canonical/protocol/schemas/payload-import.schema.json deleted file mode 100644 index 9303870..0000000 --- a/seed/canonical/protocol/schemas/payload-import.schema.json +++ /dev/null @@ -1,31 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/payload-import.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "export_ref": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "local_permit_ref": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "local_receipt_ref": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - } - }, - "required": [ - "export_ref", - "local_permit_ref", - "local_receipt_ref" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/payload-member-context-genesis.schema.json b/seed/canonical/protocol/schemas/payload-member-context-genesis.schema.json deleted file mode 100644 index 34358e1..0000000 --- a/seed/canonical/protocol/schemas/payload-member-context-genesis.schema.json +++ /dev/null @@ -1,90 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/payload-member-context-genesis.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "context_genesis_nonce": { - "minLength": 1, - "type": "string" - }, - "context_kind": { - "enum": [ - "FEDERATION", - "SUBJECT", - "ORGANIZATION", - "AI_AGENT" - ] - }, - "depends_on_context_ids": { - "items": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "type": "array", - "uniqueItems": true - }, - "initial_authorities": { - "items": { - "additionalProperties": false, - "properties": { - "capability_kind": { - "minLength": 1, - "type": "string" - }, - "holder_principal_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "scope": { - "items": { - "maxLength": 120, - "minLength": 1, - "type": "string" - }, - "minItems": 1, - "type": "array", - "uniqueItems": true - } - }, - "required": [ - "capability_kind", - "holder_principal_id", - "scope" - ], - "type": "object" - }, - "type": "array", - "uniqueItems": true - }, - "local_alias": { - "pattern": "^[A-Za-z0-9._-]+$", - "type": "string" - }, - "member_principal_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "parent_context_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - } - }, - "required": [ - "parent_context_id", - "member_principal_id", - "context_kind", - "context_genesis_nonce", - "local_alias", - "initial_authorities", - "depends_on_context_ids" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/payload-membership-withdraw.schema.json b/seed/canonical/protocol/schemas/payload-membership-withdraw.schema.json deleted file mode 100644 index 2aec58c..0000000 --- a/seed/canonical/protocol/schemas/payload-membership-withdraw.schema.json +++ /dev/null @@ -1,14 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/payload-membership-withdraw.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "reason_digest": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/common.schema.json#/$defs/digest" - } - }, - "required": [ - "reason_digest" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/payload-observation.schema.json b/seed/canonical/protocol/schemas/payload-observation.schema.json deleted file mode 100644 index b91000b..0000000 --- a/seed/canonical/protocol/schemas/payload-observation.schema.json +++ /dev/null @@ -1,54 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/payload-observation.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "claim_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "claim_subject_context_id": { - "oneOf": [ - { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - { - "type": "null" - } - ] - }, - "evidence_refs": { - "items": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "type": "array", - "uniqueItems": true - }, - "permit_ref": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "receipt_ref": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - } - }, - "required": [ - "permit_ref", - "receipt_ref", - "claim_digest", - "evidence_refs", - "claim_subject_context_id" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/payload-outcome.schema.json b/seed/canonical/protocol/schemas/payload-outcome.schema.json deleted file mode 100644 index 197ad08..0000000 --- a/seed/canonical/protocol/schemas/payload-outcome.schema.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/payload-outcome.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "outcome_class": { - "enum": [ - "POSITIVE", - "NEGATIVE" - ] - }, - "permit_ref": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "verification_refs": { - "items": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "minItems": 1, - "type": "array", - "uniqueItems": true - } - }, - "required": [ - "permit_ref", - "verification_refs", - "outcome_class" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/payload-partition-local-transition.schema.json b/seed/canonical/protocol/schemas/payload-partition-local-transition.schema.json deleted file mode 100644 index b168814..0000000 --- a/seed/canonical/protocol/schemas/payload-partition-local-transition.schema.json +++ /dev/null @@ -1,37 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/payload-partition-local-transition.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "commit_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "coordination_proof_digest": { - "oneOf": [ - { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - { - "type": "null" - } - ] - }, - "operation_class": { - "minLength": 1, - "type": "string" - }, - "parent_export_root": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - } - }, - "required": [ - "operation_class", - "parent_export_root", - "commit_digest", - "coordination_proof_digest" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/payload-permit-attenuate.schema.json b/seed/canonical/protocol/schemas/payload-permit-attenuate.schema.json deleted file mode 100644 index e2a0001..0000000 --- a/seed/canonical/protocol/schemas/payload-permit-attenuate.schema.json +++ /dev/null @@ -1,63 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/payload-permit-attenuate.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "caveats": { - "additionalProperties": { - "type": [ - "string", - "integer", - "boolean" - ] - }, - "type": "object" - }, - "delegate_principal_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "max_attempts": { - "minimum": 1, - "type": "integer" - }, - "parent_permit_ref": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "readiness_ref": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "scope": { - "items": { - "maxLength": 120, - "minLength": 1, - "type": "string" - }, - "minItems": 1, - "type": "array", - "uniqueItems": true - }, - "validity_end_ordinal": { - "minimum": 1, - "type": "integer" - } - }, - "required": [ - "parent_permit_ref", - "delegate_principal_id", - "scope", - "max_attempts", - "validity_end_ordinal", - "caveats", - "readiness_ref" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/payload-permit-issue.schema.json b/seed/canonical/protocol/schemas/payload-permit-issue.schema.json deleted file mode 100644 index 923fb41..0000000 --- a/seed/canonical/protocol/schemas/payload-permit-issue.schema.json +++ /dev/null @@ -1,77 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/payload-permit-issue.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "caveats": { - "additionalProperties": { - "type": [ - "string", - "integer", - "boolean" - ] - }, - "type": "object" - }, - "decision_ref": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "delegate_principal_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "max_attempts": { - "minimum": 1, - "type": "integer" - }, - "readiness_ref": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "scope": { - "items": { - "maxLength": 120, - "minLength": 1, - "type": "string" - }, - "minItems": 1, - "type": "array", - "uniqueItems": true - }, - "stop_on_positive": { - "const": true - }, - "success_predicate_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "task_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "validity_end_ordinal": { - "minimum": 1, - "type": "integer" - } - }, - "required": [ - "decision_ref", - "readiness_ref", - "delegate_principal_id", - "task_digest", - "scope", - "success_predicate_digest", - "max_attempts", - "stop_on_positive", - "validity_end_ordinal", - "caveats" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/payload-permit-use.schema.json b/seed/canonical/protocol/schemas/payload-permit-use.schema.json deleted file mode 100644 index d0fe057..0000000 --- a/seed/canonical/protocol/schemas/payload-permit-use.schema.json +++ /dev/null @@ -1,29 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/payload-permit-use.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "candidate_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "permit_ref": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "submission_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - } - }, - "required": [ - "permit_ref", - "submission_id", - "candidate_digest" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/payload-reconcile.schema.json b/seed/canonical/protocol/schemas/payload-reconcile.schema.json deleted file mode 100644 index 1ba0f8c..0000000 --- a/seed/canonical/protocol/schemas/payload-reconcile.schema.json +++ /dev/null @@ -1,73 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/payload-reconcile.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "child_context_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "common_export_root": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "lineage": { - "items": { - "additionalProperties": false, - "properties": { - "commit_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "commit_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "new_export_root": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "operation_class": { - "minLength": 1, - "type": "string" - }, - "parent_export_root": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "proof_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "signer_principal_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - } - }, - "required": [ - "commit_id", - "parent_export_root", - "new_export_root", - "operation_class", - "commit_digest", - "signer_principal_id", - "proof_digest" - ], - "type": "object" - }, - "type": "array" - } - }, - "required": [ - "child_context_id", - "common_export_root", - "lineage" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/payload-verification.schema.json b/seed/canonical/protocol/schemas/payload-verification.schema.json deleted file mode 100644 index 3e71334..0000000 --- a/seed/canonical/protocol/schemas/payload-verification.schema.json +++ /dev/null @@ -1,64 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/payload-verification.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "evidence_refs": { - "items": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "type": "array", - "uniqueItems": true - }, - "observation_ref": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "permit_ref": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "policy_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "receipt_ref": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "result_class": { - "enum": [ - "SUCCESS", - "FAILURE", - "TRUST_LINEAGE_LOST", - "UNDETERMINED" - ] - }, - "status": { - "enum": [ - "PASS", - "FAIL", - "UNKNOWN" - ] - } - }, - "required": [ - "permit_ref", - "receipt_ref", - "observation_ref", - "policy_digest", - "evidence_refs", - "status", - "result_class" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/permit-use-receipt.schema.json b/seed/canonical/protocol/schemas/permit-use-receipt.schema.json deleted file mode 100644 index c3940ee..0000000 --- a/seed/canonical/protocol/schemas/permit-use-receipt.schema.json +++ /dev/null @@ -1,62 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/permit-use-receipt.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "attempt_index": { - "minimum": 1, - "type": "integer" - }, - "candidate_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "context_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "execution_intent_ref": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "permit_ref": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "presenter_principal_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "receipt_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "submission_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - } - }, - "required": [ - "receipt_id", - "context_id", - "permit_ref", - "execution_intent_ref", - "presenter_principal_id", - "submission_id", - "candidate_digest", - "attempt_index" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/permit.schema.json b/seed/canonical/protocol/schemas/permit.schema.json deleted file mode 100644 index b54eb7b..0000000 --- a/seed/canonical/protocol/schemas/permit.schema.json +++ /dev/null @@ -1,154 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/permit.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "attempts_used": { - "minimum": 0, - "type": "integer" - }, - "caveats": { - "additionalProperties": { - "type": [ - "string", - "integer", - "boolean" - ] - }, - "type": "object" - }, - "constitution_epoch": { - "minimum": 0, - "type": "integer" - }, - "context_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "decision_ref": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "delegate_principal_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "final_outcome_ref": { - "oneOf": [ - { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - { - "type": "null" - } - ] - }, - "issuer_principal_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "max_attempts": { - "minimum": 1, - "type": "integer" - }, - "parent_permit_ref": { - "oneOf": [ - { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - { - "type": "null" - } - ] - }, - "permit_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "readiness_ref": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "scope": { - "items": { - "maxLength": 120, - "minLength": 1, - "type": "string" - }, - "minItems": 1, - "type": "array", - "uniqueItems": true - }, - "scope_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "status": { - "enum": [ - "ACTIVE", - "SATISFIED", - "EXHAUSTED", - "EXPIRED", - "REVOKED", - "TERMINATED_WITH_CONTEXT", - "UNRESOLVED", - "ATTENUATED" - ] - }, - "stop_on_positive": { - "const": true - }, - "success_predicate_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "task_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "validity_end_ordinal": { - "minimum": 1, - "type": "integer" - } - }, - "required": [ - "permit_id", - "context_id", - "issuer_principal_id", - "delegate_principal_id", - "decision_ref", - "readiness_ref", - "task_digest", - "scope", - "scope_digest", - "success_predicate_digest", - "max_attempts", - "attempts_used", - "stop_on_positive", - "validity_end_ordinal", - "caveats", - "status", - "final_outcome_ref", - "parent_permit_ref", - "constitution_epoch" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/reconciliation-receipt.schema.json b/seed/canonical/protocol/schemas/reconciliation-receipt.schema.json deleted file mode 100644 index 9f551b9..0000000 --- a/seed/canonical/protocol/schemas/reconciliation-receipt.schema.json +++ /dev/null @@ -1,66 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/reconciliation-receipt.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "accepted_prefix_length": { - "minimum": 0, - "type": "integer" - }, - "child_context_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "common_export_root": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "context_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "invalid_code": { - "oneOf": [ - { - "type": "string" - }, - { - "type": "null" - } - ] - }, - "lineage_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "reconciliation_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "result": { - "enum": [ - "CONFIRMED", - "PARTIALLY_CONFIRMED", - "FORK_DETECTED", - "INSUFFICIENT_EVIDENCE" - ] - } - }, - "required": [ - "reconciliation_id", - "context_id", - "child_context_id", - "common_export_root", - "result", - "accepted_prefix_length", - "invalid_code", - "lineage_digest" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/resolution-authority-binding.schema.json b/seed/canonical/protocol/schemas/resolution-authority-binding.schema.json index e3951e7..9edc66b 100644 --- a/seed/canonical/protocol/schemas/resolution-authority-binding.schema.json +++ b/seed/canonical/protocol/schemas/resolution-authority-binding.schema.json @@ -12,15 +12,9 @@ "binding_digest": { "$ref": "common.schema.json#/$defs/digest" }, - "constitution_digest": { - "$ref": "common.schema.json#/$defs/digest" - }, "context_id": { "$ref": "common.schema.json#/$defs/identifier" }, - "delegation_allowed": { - "type": "boolean" - }, "policy_epoch": { "minimum": 0, "type": "integer" @@ -31,9 +25,7 @@ "authority_id", "context_id", "policy_epoch", - "binding_digest", - "constitution_digest", - "delegation_allowed" + "binding_digest" ], "type": "object" } diff --git a/seed/canonical/protocol/schemas/resolution-record.schema.json b/seed/canonical/protocol/schemas/resolution-record.schema.json index 234daa6..7fbc2ad 100644 --- a/seed/canonical/protocol/schemas/resolution-record.schema.json +++ b/seed/canonical/protocol/schemas/resolution-record.schema.json @@ -3,16 +3,16 @@ "$schema": "https://json-schema.org/draft/2020-12/schema", "additionalProperties": false, "properties": { - "authority_id": { - "$ref": "common.schema.json#/$defs/identifier" - }, - "authority_proof_digests": { + "authority_evidence_digests": { "items": { "$ref": "common.schema.json#/$defs/digest" }, "type": "array", "uniqueItems": true }, + "authority_id": { + "$ref": "common.schema.json#/$defs/identifier" + }, "basis_digests": { "items": { "$ref": "common.schema.json#/$defs/digest" @@ -43,7 +43,7 @@ "binding_digest", "resolution", "authority_id", - "authority_proof_digests", + "authority_evidence_digests", "basis_digests" ], "type": "object" diff --git a/seed/canonical/protocol/schemas/resolution-store.schema.json b/seed/canonical/protocol/schemas/resolution-store.schema.json index b33489c..b7b9388 100644 --- a/seed/canonical/protocol/schemas/resolution-store.schema.json +++ b/seed/canonical/protocol/schemas/resolution-store.schema.json @@ -9,12 +9,6 @@ }, "type": "array" }, - "authority_grants": { - "items": { - "$ref": "authority-grant.schema.json" - }, - "type": "array" - }, "records": { "items": { "$ref": "resolution-record.schema.json" @@ -31,8 +25,7 @@ "required": [ "requests", "records", - "authority_bindings", - "authority_grants" + "authority_bindings" ], "type": "object" } diff --git a/seed/canonical/protocol/schemas/root-genesis.schema.json b/seed/canonical/protocol/schemas/root-genesis.schema.json deleted file mode 100644 index f94911a..0000000 --- a/seed/canonical/protocol/schemas/root-genesis.schema.json +++ /dev/null @@ -1,102 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/root-genesis.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "bootstrap_policy": { - "additionalProperties": false, - "properties": { - "allowed_context_kinds": { - "items": { - "enum": [ - "FEDERATION", - "SUBJECT", - "ORGANIZATION", - "AI_AGENT" - ] - }, - "minItems": 1, - "type": "array", - "uniqueItems": true - }, - "allowed_initial_capabilities": { - "items": { - "minLength": 1, - "type": "string" - }, - "minItems": 1, - "type": "array", - "uniqueItems": true - }, - "max_admissions": { - "minimum": 1, - "type": "integer" - }, - "validator_principal_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - } - }, - "required": [ - "validator_principal_id", - "max_admissions", - "allowed_context_kinds", - "allowed_initial_capabilities" - ], - "type": "object" - }, - "constitution": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/constitution.schema.json" - }, - "expected_constitution_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "expected_root_context_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "expected_root_genesis_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "expected_trust_space_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "external_anchor_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "root_context_nonce": { - "maxLength": 200, - "minLength": 1, - "type": "string" - }, - "schema_version": { - "const": "0.1-rc11" - }, - "seed_semantics_id": { - "const": "aset-seed:0.1-rc11" - } - }, - "required": [ - "schema_version", - "seed_semantics_id", - "constitution", - "external_anchor_digest", - "root_context_nonce", - "bootstrap_policy", - "expected_constitution_digest", - "expected_root_genesis_digest", - "expected_root_context_id", - "expected_trust_space_id" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/trust-space-state.schema.json b/seed/canonical/protocol/schemas/trust-space-state.schema.json deleted file mode 100644 index c828285..0000000 --- a/seed/canonical/protocol/schemas/trust-space-state.schema.json +++ /dev/null @@ -1,386 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/trust-space-state.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "accepted_transition_count": { - "minimum": 0, - "type": "integer" - }, - "authorities": { - "additionalProperties": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/authority-binding.schema.json" - }, - "type": "object" - }, - "bootstrap": { - "additionalProperties": false, - "properties": { - "admissions_used": { - "minimum": 0, - "type": "integer" - }, - "open": { - "type": "boolean" - }, - "policy": { - "additionalProperties": false, - "properties": { - "allowed_context_kinds": { - "items": { - "enum": [ - "FEDERATION", - "SUBJECT", - "ORGANIZATION", - "AI_AGENT" - ] - }, - "minItems": 1, - "type": "array", - "uniqueItems": true - }, - "allowed_initial_capabilities": { - "items": { - "minLength": 1, - "type": "string" - }, - "minItems": 1, - "type": "array", - "uniqueItems": true - }, - "max_admissions": { - "minimum": 1, - "type": "integer" - }, - "validator_principal_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - } - }, - "required": [ - "validator_principal_id", - "max_admissions", - "allowed_context_kinds", - "allowed_initial_capabilities" - ], - "type": "object" - } - }, - "required": [ - "open", - "admissions_used", - "policy" - ], - "type": "object" - }, - "constitution": { - "additionalProperties": false, - "properties": { - "body": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/constitution.schema.json" - }, - "digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "epoch": { - "minimum": 0, - "type": "integer" - } - }, - "required": [ - "epoch", - "digest", - "body" - ], - "type": "object" - }, - "context_aliases": { - "additionalProperties": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "type": "object" - }, - "context_redefinitions": { - "additionalProperties": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/context-redefinition-record.schema.json" - }, - "type": "object" - }, - "contexts": { - "additionalProperties": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/context-descriptor.schema.json" - }, - "type": "object" - }, - "corrections": { - "additionalProperties": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/correction-record.schema.json" - }, - "type": "object" - }, - "current_state_root": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "decisions": { - "additionalProperties": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/decision.schema.json" - }, - "type": "object" - }, - "execution_intents": { - "additionalProperties": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/execution-intent.schema.json" - }, - "type": "object" - }, - "exports": { - "additionalProperties": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/export-receipt.schema.json" - }, - "type": "object" - }, - "external_anchor_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "imports": { - "additionalProperties": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/import-observation.schema.json" - }, - "type": "object" - }, - "membership_withdrawals": { - "additionalProperties": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/membership-withdrawal-record.schema.json" - }, - "type": "object" - }, - "normative_dependencies": { - "items": { - "additionalProperties": false, - "properties": { - "dependency_kind": { - "enum": [ - "NORMATIVE", - "EVIDENTIAL", - "INTERFACE", - "RESPONSIBILITY" - ] - }, - "source_context_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "target_context_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - } - }, - "required": [ - "source_context_id", - "target_context_id", - "dependency_kind" - ], - "type": "object" - }, - "type": "array" - }, - "observations": { - "additionalProperties": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/observation.schema.json" - }, - "type": "object" - }, - "outcomes": { - "additionalProperties": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/outcome.schema.json" - }, - "type": "object" - }, - "permit_use_receipts": { - "additionalProperties": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/permit-use-receipt.schema.json" - }, - "type": "object" - }, - "permits": { - "additionalProperties": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/permit.schema.json" - }, - "type": "object" - }, - "reconciliations": { - "additionalProperties": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/reconciliation-receipt.schema.json" - }, - "type": "object" - }, - "root_context_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "root_genesis_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "schema_version": { - "const": "0.1-rc11" - }, - "seed_semantics_id": { - "const": "aset-seed:0.1-rc11" - }, - "submission_index": { - "additionalProperties": { - "additionalProperties": false, - "properties": { - "candidate_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "permit_ref": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "receipt_ref": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - } - }, - "required": [ - "permit_ref", - "candidate_digest", - "receipt_ref" - ], - "type": "object" - }, - "type": "object" - }, - "transition_records": { - "additionalProperties": { - "additionalProperties": false, - "properties": { - "accepted_index": { - "minimum": 1, - "type": "integer" - }, - "artifact_refs": { - "items": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/common.schema.json#/$defs/id" - }, - "type": "array", - "uniqueItems": true - }, - "causal_basis_refs": { - "items": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/common.schema.json#/$defs/id" - }, - "type": "array", - "uniqueItems": true - }, - "causal_parents": { - "items": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "type": "array", - "uniqueItems": true - }, - "context_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "kind": { - "type": "string" - }, - "transition_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "transition_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - } - }, - "required": [ - "transition_id", - "transition_digest", - "context_id", - "kind", - "causal_parents", - "causal_basis_refs", - "artifact_refs", - "accepted_index" - ], - "type": "object" - }, - "type": "object" - }, - "trust_space_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "verifications": { - "additionalProperties": { - "$ref": "https://spec.aset.example/seed/0.1-rc11/schemas/verification.schema.json" - }, - "type": "object" - } - }, - "required": [ - "schema_version", - "seed_semantics_id", - "trust_space_id", - "root_genesis_digest", - "external_anchor_digest", - "root_context_id", - "constitution", - "bootstrap", - "accepted_transition_count", - "current_state_root", - "contexts", - "context_aliases", - "authorities", - "decisions", - "permits", - "execution_intents", - "permit_use_receipts", - "submission_index", - "observations", - "verifications", - "outcomes", - "exports", - "imports", - "reconciliations", - "corrections", - "normative_dependencies", - "transition_records", - "membership_withdrawals", - "context_redefinitions" - ], - "type": "object" -} diff --git a/seed/canonical/protocol/schemas/verification.schema.json b/seed/canonical/protocol/schemas/verification.schema.json deleted file mode 100644 index dc7a207..0000000 --- a/seed/canonical/protocol/schemas/verification.schema.json +++ /dev/null @@ -1,85 +0,0 @@ -{ - "$id": "https://spec.aset.example/seed/0.1-rc11/schemas/verification.schema.json", - "$schema": "https://json-schema.org/draft/2020-12/schema", - "additionalProperties": false, - "properties": { - "context_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "evidence_refs": { - "items": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "type": "array", - "uniqueItems": true - }, - "observation_ref": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "permit_ref": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "policy_digest": { - "pattern": "^sha256:[0-9a-f]{64}$", - "type": "string" - }, - "receipt_ref": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "result_class": { - "enum": [ - "SUCCESS", - "FAILURE", - "TRUST_LINEAGE_LOST", - "UNDETERMINED" - ] - }, - "status": { - "enum": [ - "PASS", - "FAIL", - "UNKNOWN" - ] - }, - "verification_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - }, - "verifier_principal_id": { - "maxLength": 300, - "minLength": 1, - "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+\\-]*$", - "type": "string" - } - }, - "required": [ - "verification_id", - "context_id", - "permit_ref", - "receipt_ref", - "observation_ref", - "verifier_principal_id", - "policy_digest", - "evidence_refs", - "status", - "result_class" - ], - "type": "object" -} diff --git a/seed/canonical/schemas/canon-tla-refinement.schema.json b/seed/canonical/schemas/canon-tla-refinement.schema.json index 81b981e..07868da 100644 --- a/seed/canonical/schemas/canon-tla-refinement.schema.json +++ b/seed/canonical/schemas/canon-tla-refinement.schema.json @@ -62,7 +62,9 @@ "PROVED_IN_DECLARED_PROJECTION", "PARTIAL_OPAQUE_BINDING", "PARTIAL_AUTHORITY_ABSTRACTION", - "ABSTRACTED_AUTHORITY_PROOF", + "ABSTRACTED_AUTHORITY_RECOGNITION", + "PARTIAL_EXTERNAL_MATERIAL_BOUNDARY", + "STRUCTURAL_BOUNDARY_OUTSIDE_STATE_MACHINE", "PARTIAL_NO_CONTENT_ADDRESS_PROOF", "PARTIAL_TERMINAL_COMMITMENT_ABSTRACTION", "META_OUTSIDE_BEHAVIORAL_MODEL" @@ -83,13 +85,16 @@ ] }, "status": { - "const": "PROVED_IN_DECLARED_PROJECTION" + "enum": [ + "PROVED_IN_DECLARED_PROJECTION", + "OBSERVER_EQUIVALENCE_PROVED" + ] }, "tla_action": { "enum": [ "RegisterRequest", "SubmitResolution", - "Evaluate" + "EvaluateResolution" ] } }, @@ -141,7 +146,7 @@ "const": "seed/canonical/formal/SeedCanonProjection.tla" }, "profile": { - "const": "ASET-SEED-CANON-TLA-PROJECTION-V3" + "const": "ASET-SEED-CANON-TLA-PROJECTION-V4" } }, "required": [ @@ -181,7 +186,7 @@ "type": "object" }, "relation_type": { - "const": "GENERATED_PROJECTION_WITH_BEHAVIORAL_EQUIVALENCE_PROOF" + "const": "STANDALONE_GENERATED_PROJECTION_WITH_BEHAVIORAL_EQUIVALENCE_PROOF" }, "requirement_coverage": { "items": { diff --git a/seed/canonical/schemas/conformance-profile.schema.json b/seed/canonical/schemas/conformance-profile.schema.json index 11e3efb..cd678bc 100644 --- a/seed/canonical/schemas/conformance-profile.schema.json +++ b/seed/canonical/schemas/conformance-profile.schema.json @@ -4,7 +4,7 @@ "additionalProperties": false, "properties": { "case_count": { - "const": 24 + "const": 25 }, "cases": { "items": { @@ -39,8 +39,8 @@ ], "type": "object" }, - "maxItems": 24, - "minItems": 24, + "maxItems": 25, + "minItems": 25, "type": "array" }, "document_type": { @@ -50,16 +50,16 @@ "const": 16 }, "positive_count": { - "const": 8 + "const": 9 }, "profile_id": { - "const": "ASET-SEED-RESOLUTION-CONFORMANCE-CORPUS-V2" + "const": "ASET-SEED-RESOLUTION-CONFORMANCE-CORPUS-V3" }, "protocol": { - "const": "ASET-SEED-RESOLUTION-CONFORMANCE-V2" + "const": "ASET-SEED-RESOLUTION-CONFORMANCE-V3" }, "schema_version": { - "const": 2 + "const": 3 }, "seed_version": { "const": "0.3.0-alpha.1" diff --git a/seed/canonical/schemas/implementation-conformance-envelope.schema.json b/seed/canonical/schemas/implementation-conformance-envelope.schema.json index 96ff3f9..4226b31 100644 --- a/seed/canonical/schemas/implementation-conformance-envelope.schema.json +++ b/seed/canonical/schemas/implementation-conformance-envelope.schema.json @@ -43,7 +43,7 @@ "additionalProperties": false, "properties": { "protocol": { - "const": "ASET-SEED-RESOLUTION-CONFORMANCE-V2" + "const": "ASET-SEED-RESOLUTION-CONFORMANCE-V3" }, "results": { "items": { @@ -72,7 +72,7 @@ "type": "object" }, "protocol": { - "const": "ASET-SEED-RESOLUTION-CONFORMANCE-V2" + "const": "ASET-SEED-RESOLUTION-CONFORMANCE-V3" } }, "required": [ @@ -103,7 +103,7 @@ "type": "object" }, "protocol": { - "const": "ASET-SEED-RESOLUTION-CONFORMANCE-V2" + "const": "ASET-SEED-RESOLUTION-CONFORMANCE-V3" }, "supported_operations": { "allOf": [ diff --git a/seed/canonical/schemas/implementation-conformance-protocol.schema.json b/seed/canonical/schemas/implementation-conformance-protocol.schema.json index ff8d7b8..8c691ae 100644 --- a/seed/canonical/schemas/implementation-conformance-protocol.schema.json +++ b/seed/canonical/schemas/implementation-conformance-protocol.schema.json @@ -23,7 +23,7 @@ "type": "object" }, "protocol_id": { - "const": "ASET-SEED-RESOLUTION-CONFORMANCE-V2" + "const": "ASET-SEED-RESOLUTION-CONFORMANCE-V3" }, "response_schema_ref": { "const": "seed/canonical/schemas/implementation-conformance-envelope.schema.json" diff --git a/seed/canonical/schemas/proof-traceability.schema.json b/seed/canonical/schemas/proof-traceability.schema.json index 8971b96..64904a1 100644 --- a/seed/canonical/schemas/proof-traceability.schema.json +++ b/seed/canonical/schemas/proof-traceability.schema.json @@ -37,7 +37,7 @@ ], "type": "object" }, - "minItems": 1, + "minItems": 0, "type": "array" }, "id": { @@ -62,6 +62,12 @@ "type": "array", "uniqueItems": true }, + "status": { + "enum": [ + "PROVED_IN_TLA", + "PARTIAL_BOUNDARY" + ] + }, "verification_method": { "const": "ASET-VERIFY-TLAPS-UNBOUNDED" } @@ -70,6 +76,7 @@ "id", "seed_invariants", "seed_requirements", + "status", "formal_projection", "verification_method" ], @@ -89,13 +96,13 @@ "const": "seed/canonical/formal/SeedResolutionProofs.tla" }, "refinement_status": { - "const": "DECLARED_PROJECTION_NOT_REFINEMENT_PROOF" + "const": "STANDALONE_CANON_PROJECTION_EQUIVALENCE_PROVED" }, "schema_version": { - "const": 1 + "const": 2 }, "scope": { - "const": "ABSTRACT_TLA_SAFETY_PROJECTION" + "const": "ABSTRACT_TLA_SAFETY_WITH_EXPLICIT_BOUNDARIES" } }, "required": [ diff --git a/seed/canonical/schemas/protocol-profile.schema.json b/seed/canonical/schemas/protocol-profile.schema.json index 28f1f3f..e17db1a 100644 --- a/seed/canonical/schemas/protocol-profile.schema.json +++ b/seed/canonical/schemas/protocol-profile.schema.json @@ -23,7 +23,7 @@ ] }, "profile_id": { - "const": "ASET-SEED-RESOLUTION-WIRE-V2" + "const": "ASET-SEED-RESOLUTION-WIRE-V3" }, "resolution_values": { "const": [ @@ -33,10 +33,10 @@ ] }, "schema_count": { - "const": 12 + "const": 11 }, "schema_version": { - "const": 2 + "const": 3 }, "schemas": { "items": { @@ -64,8 +64,8 @@ ], "type": "object" }, - "maxItems": 12, - "minItems": 12, + "maxItems": 11, + "minItems": 11, "type": "array" }, "seed_version": { diff --git a/seed/canonical/schemas/repository-status.schema.json b/seed/canonical/schemas/repository-status.schema.json index 067503d..9f8fa7a 100644 --- a/seed/canonical/schemas/repository-status.schema.json +++ b/seed/canonical/schemas/repository-status.schema.json @@ -4,7 +4,7 @@ "additionalProperties": false, "properties": { "active_conformance_protocol": { - "const": "ASET-SEED-RESOLUTION-CONFORMANCE-V2" + "const": "ASET-SEED-RESOLUTION-CONFORMANCE-V3" }, "active_seed_model": { "const": "seed/canonical/source/seed-model.json" diff --git a/seed/canonical/schemas/seed-model.schema.json b/seed/canonical/schemas/seed-model.schema.json index aac1d22..1b6b44d 100644 --- a/seed/canonical/schemas/seed-model.schema.json +++ b/seed/canonical/schemas/seed-model.schema.json @@ -329,6 +329,12 @@ "payload_schema": { "type": "string" }, + "role": { + "enum": [ + "STATE_TRANSITION", + "OBSERVER" + ] + }, "terminal": { "type": "boolean" }, @@ -349,6 +355,7 @@ "authority_rule", "binding_rule", "created_artifacts", + "role", "terminal" ], "type": "object" diff --git a/seed/canonical/source/seed-model.json b/seed/canonical/source/seed-model.json index 158aeec..e0af6d8 100644 --- a/seed/canonical/source/seed-model.json +++ b/seed/canonical/source/seed-model.json @@ -78,23 +78,23 @@ }, { "definitions": { - "en": "A locally rooted, exact-binding, acyclic and non-expanding chain of explicit Authority grants.", - "pt-BR": "Uma cadeia localmente enraizada, exatamente vinculada, acíclica e não expansiva de concessões explícitas de Authority.", - "ru": "Локально укоренённая, точно связанная, ациклическая и нерасширяющая цепочка явных разрешений Authority." + "en": "A local exact-binding recognition result stating that one Authority is authorized for one ResolutionBinding; concrete grant chains, signatures and proof construction are external to Seed.", + "pt-BR": "Um resultado local de reconhecimento com vinculação exata que declara uma Authority autorizada para uma ResolutionBinding; cadeias de concessão, assinaturas e construção de prova concretas são externas ao Seed.", + "ru": "Локальный результат точного признания, устанавливающий полномочие одной Authority для одной ResolutionBinding; конкретные цепочки делегирования, подписи и построение доказательства находятся вне Seed." }, - "id": "seed.authority_proof", + "id": "seed.authority_recognition", "labels": { - "en": "Authority proof", - "pt-BR": "prova de Authority", - "ru": "доказательство Authority" + "en": "Authority recognition", + "pt-BR": "reconhecimento de Authority", + "ru": "признание Authority" }, - "symbol": "AuthorityProof" + "symbol": "AuthorityRecognition" }, { "definitions": { - "en": "A content-addressed non-authoritative input cited as the basis of a terminal record.", - "pt-BR": "Uma entrada não autoritativa endereçada por conteúdo, citada como base de um registro terminal.", - "ru": "Контентно-адресуемый неавторитетный вход, указанный как основание терминальной записи." + "en": "An opaque content-addressed reference to non-authoritative evidence or proof material. It has no normative effect until a Seed admission boundary recognizes the fact it supports.", + "pt-BR": "Uma referência opaca e endereçada por conteúdo a evidência ou material de prova não autoritativo. Ela não tem efeito normativo até que uma fronteira de admissão do Seed reconheça o fato que suporta.", + "ru": "Непрозрачная контентно-адресуемая ссылка на неавторитетное основание или доказательный материал. Она не имеет нормативного эффекта, пока граница допуска Seed не признает подтверждаемый ею факт." }, "id": "seed.evidence_reference", "labels": { @@ -106,9 +106,9 @@ }, { "definitions": { - "en": "One immutable content-addressed terminal ALLOW or BLOCK record with exact binding and Authority proof.", - "pt-BR": "Um registro terminal imutável e endereçado por conteúdo, ALLOW ou BLOCK, com vinculação exata e prova de Authority.", - "ru": "Одна неизменяемая контентно-адресуемая терминальная запись ALLOW или BLOCK с точной связкой и доказательством Authority." + "en": "One immutable content-addressed terminal ALLOW or BLOCK record with exact binding, a recognized Authority, and optional opaque evidence references.", + "pt-BR": "Um registro terminal imutável e endereçado por conteúdo, ALLOW ou BLOCK, com vinculação exata, uma Authority reconhecida e referências opacas de evidência opcionais.", + "ru": "Одна неизменяемая контентно-адресуемая терминальная запись ALLOW или BLOCK с точной связкой, признанной Authority и необязательными непрозрачными ссылками на основания." }, "id": "seed.resolution_record", "labels": { @@ -138,7 +138,7 @@ "conformance_protocol_ref": "seed/canonical/conformance/implementation-conformance-protocol.json", "implementation_precedence": "NONE", "normative_status": "IMPLEMENTATION_NEUTRAL", - "profile_rule": "Profiles and extensions may produce evidence, assessments, policies, authority proof material and transport, but they may not create ALLOW without one valid locally rooted exact-binding terminal ResolutionRecord, weaken fail-closed evaluation, mutate a terminal record, reuse a resolution_id for reconsideration, accept an unrecognized reconsideration commitment, or claim semantic precedence.", + "profile_rule": "Profiles and extensions may produce evidence, assessments, policies, Authority-recognition evidence and transport, but they may not create ALLOW without one valid exact-binding terminal ResolutionRecord whose Authority has been locally recognized, weaken fail-closed evaluation, mutate a terminal record, reuse a resolution_id for reconsideration, accept an unrecognized reconsideration commitment, mutate Seed-owned state outside recognized Seed transitions, or claim semantic precedence.", "required_observables": [ "accepted", "code", @@ -159,6 +159,7 @@ "network topology", "consensus protocol", "cryptographic provider", + "concrete Authority grant-chain construction and validation", "key custody", "federation topology", "AI model", @@ -247,9 +248,9 @@ ], "id": "SEED-INV-005", "texts": { - "en": "Every valid terminal record is rooted in a local Authority binding.", - "pt-BR": "Todo registro terminal válido está enraizado em uma vinculação de Authority local.", - "ru": "Каждая действительная терминальная запись укоренена в локальной связке Authority." + "en": "Every valid terminal record uses an Authority explicitly recognized for the exact local binding.", + "pt-BR": "Todo registro terminal válido usa uma Authority explicitamente reconhecida para a vinculação local exata.", + "ru": "Каждая действительная терминальная запись использует Authority, явно признанную для точной локальной связки." }, "verification": [ "ASET-VERIFY-DECLARATIVE-STATE-VALIDATION", @@ -265,9 +266,9 @@ ], "id": "SEED-INV-006", "texts": { - "en": "Every delegated Authority proof is exact-binding, acyclic and non-expanding.", - "pt-BR": "Toda prova de Authority delegada é exatamente vinculada, acíclica e não expansiva.", - "ru": "Каждое делегированное доказательство Authority точно связано, ациклично и не расширяет полномочие." + "en": "Authority evidence is non-authoritative until exact-binding Authority recognition succeeds; opaque proof material cannot create or expand Authority by itself.", + "pt-BR": "Evidência de Authority é não autoritativa até que o reconhecimento de Authority com vinculação exata seja bem-sucedido; material de prova opaco não pode criar ou ampliar Authority por si só.", + "ru": "Доказательный материал Authority неавторитетен до успешного точного признания Authority; непрозрачный proof material не может сам по себе создать или расширить полномочие." }, "verification": [ "ASET-VERIFY-DECLARATIVE-STATE-VALIDATION", @@ -283,9 +284,9 @@ ], "id": "SEED-INV-007", "texts": { - "en": "Evidence and external statements are non-authoritative inputs.", - "pt-BR": "Evidence e declarações externas são entradas não autoritativas.", - "ru": "Evidence и внешние утверждения являются неавторитетными входами." + "en": "External statements and evidence are outside Seed-owned canonical state unless accepted by a recognized Seed transition.", + "pt-BR": "Declarações externas e Evidence ficam fora do estado canônico pertencente ao Seed, salvo quando aceitas por uma transição reconhecida do Seed.", + "ru": "Внешние утверждения и Evidence находятся вне принадлежащего Seed канонического состояния, пока не приняты признанным переходом Seed." }, "verification": [ "ASET-VERIFY-DECLARATIVE-STATE-VALIDATION", @@ -319,9 +320,9 @@ ], "id": "SEED-INV-009", "texts": { - "en": "Conflicting or invalid terminal material yields UNKNOWN and never ALLOW.", - "pt-BR": "Material terminal conflitante ou inválido resulta em UNKNOWN e nunca ALLOW.", - "ru": "Конфликтующий или недействительный терминальный материал даёт UNKNOWN и никогда не ALLOW." + "en": "Conflicting valid terminal records yield UNKNOWN. Invalid or non-authoritative material cannot create ALLOW, create a conflict, or override an otherwise unique valid terminal record.", + "pt-BR": "Registros terminais válidos conflitantes resultam em UNKNOWN. Material inválido ou não autoritativo não pode criar ALLOW, criar conflito nem substituir um registro terminal válido e único.", + "ru": "Конфликтующие действительные терминальные записи дают UNKNOWN. Недействительный или неавторитетный материал не может создать ALLOW, создать конфликт или переопределить единственную действительную терминальную запись." }, "verification": [ "ASET-VERIFY-DECLARATIVE-STATE-VALIDATION", @@ -355,9 +356,9 @@ ], "id": "SEED-INV-011", "texts": { - "en": "Only recognized Seed transitions may change the canonical store; an invalid or unrecognized candidate is not a Seed transition.", - "pt-BR": "Somente transições reconhecidas do Seed podem alterar o armazenamento canônico; um candidato inválido ou não reconhecido não é uma transição do Seed.", - "ru": "Только признанные переходы Seed могут изменять каноническое хранилище; недействительный или непризнанный кандидат не является переходом Seed." + "en": "Only recognized Seed state transitions may change Seed-owned canonical state; environment observations and observer operations do not mutate that state.", + "pt-BR": "Somente transições de estado reconhecidas do Seed podem alterar o estado canônico pertencente ao Seed; observações do ambiente e operações de observador não alteram esse estado.", + "ru": "Только признанные переходы состояния Seed могут изменять принадлежащее Seed каноническое состояние; наблюдения среды и observer-операции его не изменяют." }, "verification": [ "ASET-VERIFY-DECLARATIVE-STATE-VALIDATION", @@ -557,9 +558,9 @@ "source": "ASET Seed 0.3 minimal strong core", "subject": "ASET Seed", "texts": { - "en": "UNKNOWN and BLOCK MUST prohibit the effect; absence, invalidity, ambiguity or verification error MUST resolve to UNKNOWN rather than ALLOW.", - "pt-BR": "UNKNOWN e BLOCK DEVEM proibir o efeito; ausência, invalidade, ambiguidade ou erro de verificação DEVEM resultar em UNKNOWN, nunca ALLOW.", - "ru": "UNKNOWN и BLOCK ДОЛЖНЫ запрещать эффект; отсутствие, недействительность, неоднозначность или ошибка проверки ДОЛЖНЫ давать UNKNOWN, а не ALLOW." + "en": "UNKNOWN and BLOCK MUST prohibit the effect. Missing or ambiguous valid terminal state, or failure to establish a valid terminal record, MUST resolve to UNKNOWN. Invalid or non-authoritative material MUST NOT override an otherwise unique valid terminal record.", + "pt-BR": "UNKNOWN e BLOCK DEVEM proibir o efeito. Estado terminal válido ausente ou ambíguo, ou falha em estabelecer um registro terminal válido, DEVE resultar em UNKNOWN. Material inválido ou não autoritativo NÃO DEVE substituir um registro terminal válido e único.", + "ru": "UNKNOWN и BLOCK ДОЛЖНЫ запрещать эффект. Отсутствие или неоднозначность действительного терминального состояния либо невозможность установить действительную терминальную запись ДОЛЖНЫ давать UNKNOWN. Недействительный или неавторитетный материал НЕ ДОЛЖЕН переопределять уже установленную единственную действительную терминальную запись." }, "verification": [ "ASET-VERIFY-DECLARATIVE-STATE-VALIDATION", @@ -593,13 +594,13 @@ "area": "minimal resolution-recognition kernel", "id": "ASET-SEED-REQ-007", "modality": "MUST", - "predicate": "proof_attenuating", + "predicate": "authority_recognition_boundary", "source": "ASET Seed 0.3 minimal strong core", "subject": "ASET Seed", "texts": { - "en": "Every delegated Authority proof MUST be explicit, acyclic, exact-binding and non-expanding.", - "pt-BR": "Toda prova de Authority delegada DEVE ser explícita, acíclica, exatamente vinculada e não expansiva.", - "ru": "Каждое делегированное доказательство Authority ДОЛЖНО быть явным, ациклическим, точно связанным и нерасширяющим." + "en": "Authority evidence or delegation material MUST NOT create or expand Authority by itself; a terminal record Authority MUST be explicitly recognized for the exact binding before the record can become valid.", + "pt-BR": "Evidência de Authority ou material de delegação NÃO DEVE criar ou ampliar Authority por si só; a Authority de um registro terminal DEVE ser explicitamente reconhecida para a vinculação exata antes que o registro possa se tornar válido.", + "ru": "Доказательный или делегационный материал Authority НЕ ДОЛЖЕН сам по себе создавать или расширять полномочие; Authority терминальной записи ДОЛЖНА быть явно признана для точной связки до того, как запись может стать действительной." }, "verification": [ "ASET-VERIFY-DECLARATIVE-STATE-VALIDATION", @@ -617,9 +618,9 @@ "source": "ASET Seed 0.3 minimal strong core", "subject": "ASET Seed", "texts": { - "en": "Evidence, verification results, AI outputs, consensus results and remote outcomes MUST NOT by themselves create ALLOW or local Authority.", - "pt-BR": "Evidence, resultados de verificação, saídas de AI, resultados de consenso e outcomes remotos NÃO DEVEM, por si só, criar ALLOW ou Authority local.", - "ru": "Evidence, результаты проверки, выходы AI, результаты консенсуса и удалённые outcomes НЕ ДОЛЖНЫ сами по себе создавать ALLOW или локальную Authority." + "en": "Evidence, verification results, AI outputs, consensus results, remote outcomes and other external statements MUST NOT by themselves mutate Seed-owned canonical state or create ALLOW or local Authority.", + "pt-BR": "Evidence, resultados de verificação, saídas de IA, resultados de consenso, outcomes remotos e outras declarações externas NÃO DEVEM, por si só, alterar o estado canônico pertencente ao Seed nem criar ALLOW ou Authority local.", + "ru": "Evidence, результаты проверки, выводы ИИ, результаты консенсуса, удалённые outcomes и иные внешние утверждения НЕ ДОЛЖНЫ сами по себе изменять принадлежащее Seed каноническое состояние либо создавать ALLOW или локальную Authority." }, "verification": [ "ASET-VERIFY-DECLARATIVE-STATE-VALIDATION", @@ -722,7 +723,7 @@ "ALLOW", "BLOCK" ], - "unknown_semantics": "No unique valid terminal ResolutionRecord exists for the exact request binding.", + "unknown_semantics": "No unique valid terminal ResolutionRecord is established for the exact request binding, or conflicting valid terminal records are observed.", "values": [ "UNKNOWN", "ALLOW", @@ -742,11 +743,12 @@ "id": "SEED-TX-001", "kind": "REGISTER_REQUEST", "payload_schema": "seed/canonical/protocol/schemas/payload-register-request.schema.json", + "role": "STATE_TRANSITION", "terminal": false, "to_resolution": "UNKNOWN" }, { - "authority_rule": "The record Authority must be the local root Authority or be justified by a valid exact-binding Authority proof.", + "authority_rule": "The record Authority must be explicitly recognized for the exact request binding. Concrete signatures, delegation chains and proof construction are external validation mechanisms.", "binding_rule": "The record request_digest and binding_digest must exactly match the registered request.", "created_artifacts": [ "ResolutionRecord" @@ -755,12 +757,13 @@ "id": "SEED-TX-002", "kind": "SUBMIT_RESOLUTION", "payload_schema": "seed/canonical/protocol/schemas/payload-submit-resolution.schema.json", + "role": "STATE_TRANSITION", "terminal": true, "to_resolution": "ALLOW_OR_BLOCK" }, { "authority_rule": "Evaluation creates no Authority and accepts no external statement as a resolution.", - "binding_rule": "Evaluation is performed for one registered resolution_id and fails closed on missing, invalid or conflicting terminal material.", + "binding_rule": "Evaluation observes one resolution_id without mutating Seed-owned state. It derives UNKNOWN when no unique valid terminal record is established; invalid or non-authoritative material cannot override a unique valid record.", "created_artifacts": [ "ResolutionEvaluation" ], @@ -768,6 +771,7 @@ "id": "SEED-TX-003", "kind": "EVALUATE_RESOLUTION", "payload_schema": "seed/canonical/protocol/schemas/operation.schema.json", + "role": "OBSERVER", "terminal": false, "to_resolution": "DERIVED" } diff --git a/seed/canonical/terminology/seed.skos.ttl b/seed/canonical/terminology/seed.skos.ttl index 69d2e05..a9fdae4 100644 --- a/seed/canonical/terminology/seed.skos.ttl +++ b/seed/canonical/terminology/seed.skos.ttl @@ -36,13 +36,13 @@ aset:local_authority a skos:Concept ; skos:prefLabel "Authority local"@pt-BR ; skos:definition "An Authority explicitly recognized by one Context for one exact binding and policy epoch."@en . -aset:authority_proof a skos:Concept ; +aset:authority_recognition a skos:Concept ; skos:inScheme aset:SeedConceptScheme ; - skos:notation "seed.authority_proof" ; - skos:prefLabel "доказательство Authority"@ru ; - skos:prefLabel "Authority proof"@en ; - skos:prefLabel "prova de Authority"@pt-BR ; - skos:definition "A locally rooted, exact-binding, acyclic and non-expanding chain of explicit Authority grants."@en . + skos:notation "seed.authority_recognition" ; + skos:prefLabel "признание Authority"@ru ; + skos:prefLabel "Authority recognition"@en ; + skos:prefLabel "reconhecimento de Authority"@pt-BR ; + skos:definition "A local exact-binding recognition result stating that one Authority is authorized for one ResolutionBinding; concrete grant chains, signatures and proof construction are external to Seed."@en . aset:evidence_reference a skos:Concept ; skos:inScheme aset:SeedConceptScheme ; @@ -50,7 +50,7 @@ aset:evidence_reference a skos:Concept ; skos:prefLabel "ссылка на основание"@ru ; skos:prefLabel "evidence reference"@en ; skos:prefLabel "referência de evidência"@pt-BR ; - skos:definition "A content-addressed non-authoritative input cited as the basis of a terminal record."@en . + skos:definition "An opaque content-addressed reference to non-authoritative evidence or proof material. It has no normative effect until a Seed admission boundary recognizes the fact it supports."@en . aset:resolution_record a skos:Concept ; skos:inScheme aset:SeedConceptScheme ; @@ -58,7 +58,7 @@ aset:resolution_record a skos:Concept ; skos:prefLabel "запись разрешения"@ru ; skos:prefLabel "resolution record"@en ; skos:prefLabel "registro de resolução"@pt-BR ; - skos:definition "One immutable content-addressed terminal ALLOW or BLOCK record with exact binding and Authority proof."@en . + skos:definition "One immutable content-addressed terminal ALLOW or BLOCK record with exact binding, a recognized Authority, and optional opaque evidence references."@en . aset:reconsideration_commitment a skos:Concept ; skos:inScheme aset:SeedConceptScheme ; diff --git a/seed/canonical/terminology/seed.tbx b/seed/canonical/terminology/seed.tbx index 493e0f6..b87b972 100644 --- a/seed/canonical/terminology/seed.tbx +++ b/seed/canonical/terminology/seed.tbx @@ -22,10 +22,10 @@ local Authoritypreferred Authority localpreferred - - доказательство Authoritypreferred - Authority proofpreferred - prova de Authoritypreferred + + признание Authoritypreferred + Authority recognitionpreferred + reconhecimento de Authoritypreferred ссылка на основаниеpreferred diff --git a/tests/test_canonical_model.py b/tests/test_canonical_model.py index 8a731f3..aade692 100644 --- a/tests/test_canonical_model.py +++ b/tests/test_canonical_model.py @@ -12,4 +12,12 @@ def test_localization_is_complete(): def test_minimal_resolution_algebra_is_exact(): algebra=model()['resolution_algebra']; assert algebra['values']==['UNKNOWN','ALLOW','BLOCK']; assert algebra['stored_terminal']==['ALLOW','BLOCK']; assert algebra['effect_permitted_if']=='ALLOW' def test_operations_are_minimal(): - assert [item['kind'] for item in model()['transitions']]==['REGISTER_REQUEST','SUBMIT_RESOLUTION','EVALUATE_RESOLUTION'] + transitions=model()['transitions'] + assert [item['kind'] for item in transitions]==['REGISTER_REQUEST','SUBMIT_RESOLUTION','EVALUATE_RESOLUTION'] + assert [item['role'] for item in transitions]==['STATE_TRANSITION','STATE_TRANSITION','OBSERVER'] + +def test_protocol_directory_contains_only_active_profile_schemas(): + profile=json.loads((ROOT/'seed/canonical/protocol/protocol-profile.json').read_text(encoding='utf-8')) + declared={Path(item['path']).name for item in profile['schemas']} + physical={path.name for path in (ROOT/'seed/canonical/protocol/schemas').glob('*.json')} + assert physical==declared diff --git a/tests/test_ci_assurance.py b/tests/test_ci_assurance.py index baa6725..2a7697d 100644 --- a/tests/test_ci_assurance.py +++ b/tests/test_ci_assurance.py @@ -84,9 +84,8 @@ def test_tlaps_gate_and_final_theorems_are_declared(): "SpecImpliesAlwaysSeedStateSafety", "SpecImpliesRequestsAppendOnly", "SpecImpliesTerminalRecordsImmutable", - "SpecImpliesCanonicalStateChangesOnlyByRecognizedTransition", - "SpecImpliesInvalidMaterialStutter", - "SpecImpliesNonAuthoritativeInputsStutter", + "SpecImpliesSeedStateChangesOnlyByRecognizedTransition", + "SpecImpliesConflictObservationPreservesSeedState", ): assert f"THEOREM {theorem} ==" in proof @@ -125,8 +124,8 @@ def test_seed_resolution_tla_uses_valid_operator_tokens(): assert r"/\\" not in specification assert "Range(" not in specification assert "VARIABLES\n requestMeta,\n terminalMeta,\n conflicts" in specification - assert "LocalAuthorityBindings" in specification - assert "AuthorityProofBindings" in specification + assert "RequestAuthorityBindings" in specification + assert "TerminalAuthorityBindings" in specification assert "observedInputs" not in specification assert "invalidMaterial" not in specification assert "terminalBinding," not in specification @@ -147,9 +146,9 @@ def test_seed_resolution_tlc_treats_terminal_states_as_intended_quiescence(): ) assert "TerminalUnique ==" in specification assert "CHECK_DEADLOCK FALSE" in configuration - assert "LocalAuthorityBindings <- TLC_LocalAuthorityBindings" in configuration - assert "AuthorityProofBindings <- TLC_AuthorityProofBindings" in configuration - assert r"LocalAuthorityBindings \subseteq AuthorityProofBindings" in specification + assert "RequestAuthorityBindings <- TLC_RequestAuthorityBindings" in configuration + assert "TerminalAuthorityBindings <- TLC_TerminalAuthorityBindings" in configuration + assert r"RequestAuthorityBindings \subseteq TerminalAuthorityBindings" in specification def test_active_audit_index_tracks_active_canon_package(): @@ -186,6 +185,10 @@ def test_canon_tla_refinement_relation_is_complete_and_mandatory(): assert relation["proof"]["final_theorem"] == ( "SeedResolutionBehaviorallyEquivalentToCanonProjection" ) + projection = (ROOT / "seed/canonical/formal/SeedCanonProjection.tla").read_text(encoding="utf-8") + assert "EXTENDS SeedResolution" not in projection + assert "INSTANCE SeedResolution" not in projection + assert "V4 is a standalone projection" in projection assert len(gates["gates"]) >= 26 diff --git a/tests/test_implementation_conformance_protocol.py b/tests/test_implementation_conformance_protocol.py index 874acbe..c36a32b 100644 --- a/tests/test_implementation_conformance_protocol.py +++ b/tests/test_implementation_conformance_protocol.py @@ -5,4 +5,4 @@ def test_canon_package_and_protocol_validate(): for tool in ('tools/build_canon_package.py --check','tools/validate_canon_package.py','tools/validate_seed_canon.py'): result=subprocess.run([sys.executable,*tool.split()],cwd=ROOT,text=True,capture_output=True); assert result.returncode==0,result.stdout+result.stderr def test_protocol_has_no_implementation_precedence(): - protocol=json.loads((ROOT/'seed/canonical/conformance/implementation-conformance-protocol.json').read_text()); assert protocol['implementation_precedence']=='NONE'; assert protocol['protocol_id']=='ASET-SEED-RESOLUTION-CONFORMANCE-V2' + protocol=json.loads((ROOT/'seed/canonical/conformance/implementation-conformance-protocol.json').read_text()); assert protocol['implementation_precedence']=='NONE'; assert protocol['protocol_id']=='ASET-SEED-RESOLUTION-CONFORMANCE-V3' diff --git a/tests/test_minimal_resolution_kernel.py b/tests/test_minimal_resolution_kernel.py index 22fece6..422a77a 100644 --- a/tests/test_minimal_resolution_kernel.py +++ b/tests/test_minimal_resolution_kernel.py @@ -29,3 +29,12 @@ def test_historical_recognition_context_is_not_canonical_store_state(): case_schema=json.loads((ROOT/'seed/canonical/protocol/schemas/conformance-case.schema.json').read_text()) assert 'recognized_terminal_record_digests' not in store_schema['properties'] assert 'recognized_terminal_record_digests' in case_schema['properties'] + + +def test_invalid_extra_material_cannot_override_unique_valid_allow(): + case=json.loads((ROOT/'seed/canonical/conformance/cases/positive/RES-POS-009.json').read_text()) + actual,final_store=execute_case(case) + assert actual['resolution']=='ALLOW' + assert actual['effect_permitted'] is True + assert actual['reason']=='UNIQUE_VALID_TERMINAL_RECORD' + assert len(final_store['records'])==2 diff --git a/tools/build_canon_package.py b/tools/build_canon_package.py index aa8ee3a..a13fe0c 100644 --- a/tools/build_canon_package.py +++ b/tools/build_canon_package.py @@ -41,6 +41,10 @@ "seed/canonical/decisions/ADR-005-minimal-resolution-recognition-kernel.md", "seed/canonical/decisions/ADR-006-complete-invariant-closure.md", "seed/canonical/decisions/ADR-007-reconsideration-commitments-and-bounded-retention.md", + "seed/canonical/decisions/ADR-008-normalize-seed-state-by-construction.md", + "seed/canonical/decisions/ADR-009-seed-state-environment-observer-and-authority-boundary.md", + "seed/canonical/migration/CANON_CHANGE_DECLARATION.json", + "seed/canonical/migration/WIRE_V2_TO_V3.md", ] @@ -76,7 +80,7 @@ def expected() -> dict[str, Any]: "canon_version": "0.3.0-alpha.1", "normative_source": "seed/canonical/source/seed-model.json", "implementation_precedence": "NONE", - "conformance_protocol": "ASET-SEED-RESOLUTION-CONFORMANCE-V2", + "conformance_protocol": "ASET-SEED-RESOLUTION-CONFORMANCE-V3", "files": rows, "package_digest": package_digest, } diff --git a/tools/check_assurance_traceability.py b/tools/check_assurance_traceability.py index 4408305..ca34806 100755 --- a/tools/check_assurance_traceability.py +++ b/tools/check_assurance_traceability.py @@ -14,9 +14,8 @@ "SpecImpliesAlwaysSeedStateSafety", "SpecImpliesRequestsAppendOnly", "SpecImpliesTerminalRecordsImmutable", - "SpecImpliesCanonicalStateChangesOnlyByRecognizedTransition", - "SpecImpliesInvalidMaterialStutter", - "SpecImpliesNonAuthoritativeInputsStutter", + "SpecImpliesSeedStateChangesOnlyByRecognizedTransition", + "SpecImpliesConflictObservationPreservesSeedState", ) @@ -171,15 +170,17 @@ def main() -> int: model_report_path = ROOT / args.model_report if not model_report_path.is_file(): - errors.append(f"missing bounded model report: {args.model_report}") + errors.append(f"missing finite-state model report: {args.model_report}") else: model_report = load(model_report_path) if set(model_report.get("invariants", [])) != set(tla_formal): errors.append( - "bounded model property set differs from TLA/TLC verification registry" + "finite-state model property set differs from TLA/TLC verification registry" ) if model_report.get("verdict") != "PASS": - errors.append("bounded model report is not PASS") + errors.append("finite-state model report is not PASS") + if model_report.get("saturated") is not True: + errors.append("finite-state model report is not saturated") formal_invariant_coverage = { identifier diff --git a/tools/check_canon_tla_refinement.py b/tools/check_canon_tla_refinement.py index 7862ea5..a1d49b3 100755 --- a/tools/check_canon_tla_refinement.py +++ b/tools/check_canon_tla_refinement.py @@ -26,10 +26,10 @@ "ASET-SEED-REQ-002": "PROVED_IN_DECLARED_PROJECTION", "ASET-SEED-REQ-003": "PROVED_IN_DECLARED_PROJECTION", "ASET-SEED-REQ-004": "PROVED_IN_DECLARED_PROJECTION", - "ASET-SEED-REQ-005": "PROVED_IN_DECLARED_PROJECTION", + "ASET-SEED-REQ-005": "PARTIAL_EXTERNAL_MATERIAL_BOUNDARY", "ASET-SEED-REQ-006": "PARTIAL_AUTHORITY_ABSTRACTION", - "ASET-SEED-REQ-007": "ABSTRACTED_AUTHORITY_PROOF", - "ASET-SEED-REQ-008": "PROVED_IN_DECLARED_PROJECTION", + "ASET-SEED-REQ-007": "ABSTRACTED_AUTHORITY_RECOGNITION", + "ASET-SEED-REQ-008": "STRUCTURAL_BOUNDARY_OUTSIDE_STATE_MACHINE", "ASET-SEED-REQ-009": "PROVED_IN_DECLARED_PROJECTION", "ASET-SEED-REQ-010": "PARTIAL_NO_CONTENT_ADDRESS_PROOF", "ASET-SEED-REQ-011": "PARTIAL_TERMINAL_COMMITMENT_ABSTRACTION", @@ -42,10 +42,10 @@ "SEED-INV-003": "PROVED_IN_DECLARED_PROJECTION", "SEED-INV-004": "PARTIAL_OPAQUE_BINDING", "SEED-INV-005": "PARTIAL_AUTHORITY_ABSTRACTION", - "SEED-INV-006": "ABSTRACTED_AUTHORITY_PROOF", - "SEED-INV-007": "PROVED_IN_DECLARED_PROJECTION", + "SEED-INV-006": "ABSTRACTED_AUTHORITY_RECOGNITION", + "SEED-INV-007": "STRUCTURAL_BOUNDARY_OUTSIDE_STATE_MACHINE", "SEED-INV-008": "PROVED_IN_DECLARED_PROJECTION", - "SEED-INV-009": "PROVED_IN_DECLARED_PROJECTION", + "SEED-INV-009": "PARTIAL_EXTERNAL_MATERIAL_BOUNDARY", "SEED-INV-010": "PARTIAL_NO_CONTENT_ADDRESS_PROOF", "SEED-INV-011": "PROVED_IN_DECLARED_PROJECTION", "SEED-INV-012": "PARTIAL_TERMINAL_COMMITMENT_ABSTRACTION", @@ -138,7 +138,7 @@ def main() -> int: action_by_kind = { "REGISTER_REQUEST": "RegisterRequest", "SUBMIT_RESOLUTION": "SubmitResolution", - "EVALUATE_RESOLUTION": "Evaluate", + "EVALUATE_RESOLUTION": "EvaluateResolution", } expected_transitions = [ (item["id"], item["kind"], action_by_kind[item["kind"]]) @@ -157,12 +157,18 @@ def main() -> int: abstraction_ids = [item["id"] for item in relation["abstractions"]] if abstraction_ids != [ "OPAQUE_BINDING", - "AUTHORITY_PROOF_ORACLE", + "AUTHORITY_RECOGNITION_BOUNDARY", "TERMINAL_COMMITMENT_ORACLE", - "ENVIRONMENT_OBSERVATION", + "ENVIRONMENT_CONFLICT_STATE", ]: errors.append("declared abstraction profile differs") + projection_text = PROJECTION_PATH.read_text(encoding="utf-8") if PROJECTION_PATH.is_file() else "" + if "EXTENDS SeedResolution" in projection_text or "INSTANCE SeedResolution" in projection_text: + errors.append("generated projection depends on target SeedResolution module") + if "V4 is a standalone projection" not in projection_text: + errors.append("standalone projection marker missing") + generator = subprocess.run( [sys.executable, str(GENERATOR_PATH), "--check"], cwd=ROOT, diff --git a/tools/check_proof_traceability.py b/tools/check_proof_traceability.py index 3709b0d..9fcbb74 100644 --- a/tools/check_proof_traceability.py +++ b/tools/check_proof_traceability.py @@ -22,11 +22,12 @@ TEMPORAL_THEOREMS = { "RequestsAppendOnly": "SpecImpliesRequestsAppendOnly", "TerminalRecordsImmutable": "SpecImpliesTerminalRecordsImmutable", - "CanonicalStateChangesOnlyByRecognizedTransition": ( - "SpecImpliesCanonicalStateChangesOnlyByRecognizedTransition" + "SeedStateChangesOnlyByRecognizedTransition": ( + "SpecImpliesSeedStateChangesOnlyByRecognizedTransition" + ), + "ConflictObservationPreservesSeedState": ( + "SpecImpliesConflictObservationPreservesSeedState" ), - "InvalidMaterialStutter": "SpecImpliesInvalidMaterialStutter", - "NonAuthoritativeInputsStutter": "SpecImpliesNonAuthoritativeInputsStutter", } STATE_SAFETY_THEOREM = "SpecImpliesAlwaysSeedStateSafety" @@ -182,25 +183,23 @@ def main() -> int: expected_properties = { name for name, prop in tla_properties.items() - if invariant - in prop.get( - "seed_invariants", - [], - ) + if invariant in prop.get("seed_invariants", []) } - actual_properties = {item["operator"] for item in claim["formal_projection"]} - + status = claim["status"] if actual_properties != expected_properties: errors.append(f"{claim_id} formal-property mapping differs from registry") + if status == "PROVED_IN_TLA" and not actual_properties: + errors.append(f"{claim_id} claims PROVED_IN_TLA without a formal projection") + if status == "PARTIAL_BOUNDARY" and invariant not in { + "SEED-INV-006", "SEED-INV-007", "SEED-INV-009" + }: + errors.append(f"{claim_id} uses PARTIAL_BOUNDARY unexpectedly") expected_requirements = { requirement for name in expected_properties - for requirement in tla_properties[name].get( - "seed_requirements", - [], - ) + for requirement in tla_properties[name].get("seed_requirements", []) } actual_requirements = set(claim["seed_requirements"]) diff --git a/tools/generate_canon_tla_projection.py b/tools/generate_canon_tla_projection.py index ead59d3..421d0f0 100755 --- a/tools/generate_canon_tla_projection.py +++ b/tools/generate_canon_tla_projection.py @@ -12,7 +12,7 @@ RELATION_PATH = ROOT / "seed/canonical/assurance/canon-tla-refinement.json" OUTPUT_PATH = ROOT / "seed/canonical/formal/SeedCanonProjection.tla" -EXPECTED_PROFILE = "ASET-SEED-CANON-TLA-PROJECTION-V3" +EXPECTED_PROFILE = "ASET-SEED-CANON-TLA-PROJECTION-V4" EXPECTED_REQUIREMENT_PREDICATES = [ "binding_exact", "request_fresh", @@ -20,7 +20,7 @@ "allow_only", "fail_closed", "local_authority", - "proof_attenuating", + "authority_recognition_boundary", "inputs_non_authoritative", "terminal_unique", "record_immutable", @@ -28,9 +28,9 @@ "implementation_neutral", ] EXPECTED_TRANSITIONS = [ - ("SEED-TX-001", "REGISTER_REQUEST"), - ("SEED-TX-002", "SUBMIT_RESOLUTION"), - ("SEED-TX-003", "EVALUATE_RESOLUTION"), + ("SEED-TX-001", "REGISTER_REQUEST", "STATE_TRANSITION"), + ("SEED-TX-002", "SUBMIT_RESOLUTION", "STATE_TRANSITION"), + ("SEED-TX-003", "EVALUATE_RESOLUTION", "OBSERVER"), ] EXPECTED_INVARIANTS = [f"SEED-INV-{index:03d}" for index in range(1, 13)] @@ -58,30 +58,26 @@ def tla_set(values: list[str]) -> str: def validate_inputs(model: dict[str, Any], relation: dict[str, Any]) -> None: errors: list[str] = [] - if relation["generated_projection"]["profile"] != EXPECTED_PROFILE: errors.append("unexpected projection profile") - if relation["source_model"]["sha256"] != digest(MODEL_PATH): errors.append("source model digest mismatch") - if relation["source_model"]["model_id"] != model["model_id"]: errors.append("source model id mismatch") - if relation["source_model"]["version"] != model["version"]: errors.append("source model version mismatch") predicates = [item["predicate"] for item in model["requirements"]] if predicates != EXPECTED_REQUIREMENT_PREDICATES: errors.append("unsupported requirement predicate catalogue") - invariants = [item["id"] for item in model["invariants"]] if invariants != EXPECTED_INVARIANTS: errors.append("unsupported invariant catalogue") - - transitions = [(item["id"], item["kind"]) for item in model["transitions"]] + transitions = [ + (item["id"], item["kind"], item["role"]) for item in model["transitions"] + ] if transitions != EXPECTED_TRANSITIONS: - errors.append("unsupported transition catalogue") + errors.append("unsupported operation catalogue") algebra = model["resolution_algebra"] if algebra["values"] != ["UNKNOWN", "ALLOW", "BLOCK"]: @@ -96,7 +92,6 @@ def validate_inputs(model: dict[str, Any], relation: dict[str, Any]) -> None: errors.append("unsupported fail-closed values") if algebra["conflict_result"] != "UNKNOWN": errors.append("unsupported conflict result") - if errors: raise ValueError("; ".join(errors)) @@ -107,8 +102,8 @@ def render(model: dict[str, Any], relation: dict[str, Any]) -> str: source_sha = relation["source_model"]["sha256"] profile = relation["generated_projection"]["profile"] - return f'''---------------- MODULE SeedCanonProjection ---------------- -EXTENDS SeedResolution + return rf'''---------------- MODULE SeedCanonProjection ---------------- +EXTENDS FiniteSets (* GENERATED FILE. DO NOT EDIT. @@ -116,12 +111,25 @@ def render(model: dict[str, Any], relation: dict[str, Any]) -> str: Source SHA-256: {source_sha} Projection profile: {profile} -V3 projects the same canonical behavior onto the normalized three-variable -Seed state. Immutable Authority relations are context constants. Accepted -terminal binding is derived from requestMeta; invalid/non-authoritative inputs -are stuttering observations rather than retained canonical state. +V4 is a standalone projection. It does not EXTEND or import SeedResolution. +The refinement proof explicitly instantiates this model onto the target state. +Seed-owned state is requestMeta + terminalMeta. Conflict is environment state. +EVALUATE_RESOLUTION is a pure observer and is not part of CanonNext. *) +CONSTANTS ResolutionIds, Bindings, Authorities, TerminalCommitments, + RecognizedTerminalCommitments, NoCommitment, + RequestAuthorityBindings, TerminalAuthorityBindings + +ASSUME ResolutionIds # {{}} +ASSUME Bindings # {{}} +ASSUME Authorities # {{}} +ASSUME RecognizedTerminalCommitments \subseteq TerminalCommitments +ASSUME NoCommitment \notin TerminalCommitments +ASSUME RequestAuthorityBindings \subseteq Authorities \X Bindings +ASSUME TerminalAuthorityBindings \subseteq Authorities \X Bindings +ASSUME RequestAuthorityBindings \subseteq TerminalAuthorityBindings + CanonResolutions == {tla_set(algebra["values"])} CanonTerminalResolutions == {tla_set(algebra["stored_terminal"])} CanonDerivedResolution == {json.dumps(algebra["derived"])} @@ -129,87 +137,96 @@ def render(model: dict[str, Any], relation: dict[str, Any]) -> str: CanonFailClosedValues == {tla_set(algebra["fail_closed_values"])} CanonConflictResult == {json.dumps(algebra["conflict_result"])} +CanonRequestMetaType == + [binding : Bindings, + previous : TerminalCommitments \cup {{NoCommitment}}] + +CanonTerminalMetaType == + [resolution : CanonTerminalResolutions, + authority : Authorities] + +VARIABLES requestMeta, terminalMeta, conflicts + +CanonSeedVars == <> +CanonEnvironmentVars == <> +CanonVars == <> + +CanonRequests == DOMAIN requestMeta +CanonTerminalRequests == DOMAIN terminalMeta +CanonRequestBinding(r) == requestMeta[r].binding +CanonPreviousCommitment(r) == requestMeta[r].previous +CanonTerminalResolution(r) == terminalMeta[r].resolution +CanonTerminalAuthority(r) == terminalMeta[r].authority + CanonInit == - /\\ requestMeta = [r \\in {{}} |-> r] - /\\ terminalMeta = [r \\in {{}} |-> r] - /\\ conflicts = {{}} + /\ requestMeta = [r \in {{}} |-> r] + /\ terminalMeta = [r \in {{}} |-> r] + /\ conflicts = {{}} CanonRegisterRequest(r, b, a, previous) == - /\\ r \\in ResolutionIds \\ Requests - /\\ b \\in Bindings - /\\ a \\in Authorities - /\\ <> \\in LocalAuthorityBindings - /\\ \\/ previous = NoCommitment - \\/ previous \\in RecognizedTerminalCommitments - /\\ requestMeta' = - [x \\in Requests \\cup {{r}} |-> + /\ r \in ResolutionIds \ CanonRequests + /\ b \in Bindings + /\ a \in Authorities + /\ <> \in RequestAuthorityBindings + /\ \/ previous = NoCommitment + \/ previous \in RecognizedTerminalCommitments + /\ requestMeta' = + [x \in CanonRequests \cup {{r}} |-> IF x = r THEN [binding |-> b, previous |-> previous] ELSE requestMeta[x]] - /\\ UNCHANGED <> + /\ UNCHANGED <> CanonSubmitResolution(r, b, a, value) == - /\\ r \\in Requests - /\\ b = RequestBinding(r) - /\\ a \\in Authorities - /\\ <> \\in AuthorityProofBindings - /\\ value \\in CanonTerminalResolutions - /\\ r \\notin TerminalRequests - /\\ r \\notin conflicts - /\\ terminalMeta' = - [x \\in TerminalRequests \\cup {{r}} |-> + /\ r \in CanonRequests + /\ b = CanonRequestBinding(r) + /\ a \in Authorities + /\ <> \in TerminalAuthorityBindings + /\ value \in CanonTerminalResolutions + /\ r \notin CanonTerminalRequests + /\ r \notin conflicts + /\ terminalMeta' = + [x \in CanonTerminalRequests \cup {{r}} |-> IF x = r THEN [resolution |-> value, authority |-> a] ELSE terminalMeta[x]] - /\\ UNCHANGED <> + /\ UNCHANGED <> CanonObserveConflict(r) == - /\\ r \\in ResolutionIds - /\\ conflicts' = conflicts \\cup {{r}} - /\\ UNCHANGED <> - -CanonObserveInvalidMaterial(r) == - /\\ r \\in ResolutionIds - /\\ UNCHANGED vars - -CanonObserveNonAuthoritativeInput(r) == - /\\ r \\in ResolutionIds - /\\ UNCHANGED vars - -CanonEvaluate == UNCHANGED vars + /\ r \in ResolutionIds + /\ conflicts' = conflicts \cup {{r}} + /\ UNCHANGED CanonSeedVars CanonRecognizedSeedTransition == - \\/ \\E r \\in ResolutionIds, b \\in Bindings, a \\in Authorities, - previous \\in TerminalCommitments \\cup {{NoCommitment}} : + \/ \E r \in ResolutionIds, b \in Bindings, a \in Authorities, + previous \in TerminalCommitments \cup {{NoCommitment}} : CanonRegisterRequest(r, b, a, previous) - \\/ \\E r \\in ResolutionIds, b \\in Bindings, a \\in Authorities, - value \\in CanonTerminalResolutions : + \/ \E r \in ResolutionIds, b \in Bindings, a \in Authorities, + value \in CanonTerminalResolutions : CanonSubmitResolution(r, b, a, value) CanonRecognizedEnvironmentTransition == - \\/ \\E r \\in ResolutionIds : CanonObserveConflict(r) - \\/ \\E r \\in ResolutionIds : CanonObserveInvalidMaterial(r) - \\/ \\E r \\in ResolutionIds : CanonObserveNonAuthoritativeInput(r) - -CanonRecognizedCanonicalTransition == - \\/ CanonRecognizedSeedTransition - \\/ CanonRecognizedEnvironmentTransition + \E r \in ResolutionIds : CanonObserveConflict(r) CanonNext == - \\/ CanonRecognizedCanonicalTransition - \\/ CanonEvaluate + \/ CanonRecognizedSeedTransition + \/ CanonRecognizedEnvironmentTransition CanonResolutionOf(r) == - IF r \\notin Requests \\/ r \\in conflicts + IF r \notin CanonRequests \/ r \in conflicts THEN CanonConflictResult - ELSE IF r \\notin TerminalRequests + ELSE IF r \notin CanonTerminalRequests THEN CanonDerivedResolution - ELSE TerminalResolution(r) + ELSE CanonTerminalResolution(r) CanonEffectPermitted(r) == CanonResolutionOf(r) = CanonEffectPermittedValue -CanonSpec == CanonInit /\\ [][CanonNext]_vars +CanonEvaluateResolution(r) == + [resolution |-> CanonResolutionOf(r), + effect_permitted |-> CanonEffectPermitted(r)] + +CanonSpec == CanonInit /\ [][CanonNext]_CanonVars ============================================================================= ''' @@ -218,24 +235,18 @@ def main() -> int: parser = argparse.ArgumentParser() parser.add_argument("--check", action="store_true") args = parser.parse_args() - model = load(MODEL_PATH) relation = load(RELATION_PATH) - try: content = render(model, relation) except (KeyError, TypeError, ValueError) as exc: print(f"CANON_TLA_PROJECTION_ERROR={exc}") print("CANON_TLA_PROJECTION=FAIL") return 1 - if args.check: - ok = ( - OUTPUT_PATH.is_file() and OUTPUT_PATH.read_text(encoding="utf-8") == content - ) + ok = OUTPUT_PATH.is_file() and OUTPUT_PATH.read_text(encoding="utf-8") == content print("CANON_TLA_PROJECTION_PARITY=" + ("PASS" if ok else "DIFFERENT")) return 0 if ok else 1 - OUTPUT_PATH.write_text(content, encoding="utf-8", newline="\n") print("CANON_TLA_PROJECTION_GENERATED=PASS") return 0 diff --git a/tools/model_check_seed.py b/tools/model_check_seed.py index 5b33f11..a75b19f 100755 --- a/tools/model_check_seed.py +++ b/tools/model_check_seed.py @@ -14,8 +14,8 @@ TERMINALS = ("ALLOW", "BLOCK") NO_COMMITMENT = -1 RECOGNIZED_TERMINAL_COMMITMENTS = frozenset({0, 1}) -LOCAL_AUTHORITY_BINDINGS = frozenset({(0, 0), (1, 1)}) -AUTHORITY_PROOF_BINDINGS = frozenset({(0, 0), (1, 1), (1, 0)}) +REQUEST_AUTHORITY_BINDINGS = frozenset({(0, 0), (1, 1)}) +TERMINAL_AUTHORITY_BINDINGS = frozenset({(0, 0), (1, 1), (1, 0)}) STATE_PROPERTIES = ( "TypeOK", @@ -23,9 +23,8 @@ "AllowSoundness", "FailClosed", "TerminalBindingDerived", - "LocalAuthorityRoot", - "DelegatedAuthoritySound", - "InputsNonAuthoritative", + "RequestAuthorityRecognized", + "TerminalAuthorityRecognized", "TerminalUnique", "ConflictUnknown", "FreshReconsideration", @@ -33,20 +32,19 @@ TEMPORAL_PROPERTIES = ( "RequestsAppendOnly", "TerminalRecordsImmutable", - "CanonicalStateChangesOnlyByRecognizedTransition", - "InvalidMaterialStutter", - "NonAuthoritativeInputsStutter", + "SeedStateChangesOnlyByRecognizedTransition", + "ConflictObservationPreservesSeedState", ) FORMAL_PROPERTIES = STATE_PROPERTIES + TEMPORAL_PROPERTIES @dataclass(frozen=True) class State: - # request tuple: resolution_id, binding, previous_terminal_commitment + # Seed-owned request provenance: resolution_id, binding, previous commitment. requests: tuple[tuple[int, int, int], ...] - # accepted terminal tuple: resolution_id, authority, terminal_value + # Seed-owned accepted terminal provenance: resolution_id, authority, terminal value. records: tuple[tuple[int, int, str], ...] - # conflict is the only environment observation that changes resolution semantics + # Environment state: observed conflict among valid terminal records. conflicts: frozenset[int] @@ -74,22 +72,18 @@ def effect_permitted(state: State, rid: int) -> bool: return resolution_of(state, rid) == "ALLOW" -def canonical_projection(state: State) -> tuple[object, ...]: - return (state.requests, state.records, state.conflicts) +def seed_projection(state: State) -> tuple[object, ...]: + return (state.requests, state.records) def successors(state: State) -> Iterable[tuple[str, State]]: requests = request_map(state) records = record_map(state) - # Initial Authority identity is checked at admission but not retained as an - # independent state component. The binding remains sufficient to prove the - # existence of a local root because LOCAL_AUTHORITY_BINDINGS is immutable. for rid in IDS: if rid in requests: continue - for binding, authority in LOCAL_AUTHORITY_BINDINGS: - del authority + for binding, _authority in REQUEST_AUTHORITY_BINDINGS: yield ( "RegisterRequest", State( @@ -108,10 +102,10 @@ def successors(state: State) -> Iterable[tuple[str, State]]: ), ) - for rid, (binding, _) in requests.items(): + for rid, (binding, _previous) in requests.items(): if rid in records or rid in state.conflicts: continue - for authority, proof_binding in AUTHORITY_PROOF_BINDINGS: + for authority, proof_binding in TERMINAL_AUTHORITY_BINDINGS: if proof_binding != binding: continue for value in TERMINALS: @@ -131,13 +125,6 @@ def successors(state: State) -> Iterable[tuple[str, State]]: State(state.requests, state.records, state.conflicts | {rid}), ) - # These observations are explicit semantic stutters. They are not - # retained as Seed state and therefore cannot create ALLOW. - yield "ObserveInvalidMaterial", state - yield "ObserveNonAuthoritativeInput", state - - yield "Evaluate", state - def state_errors(state: State) -> list[str]: errors: list[str] = [] @@ -149,28 +136,23 @@ def state_errors(state: State) -> list[str]: if not state.conflicts.issubset(IDS): errors.append("TypeOK") - # Structural properties created by representation rather than duplicated state. if not set(records).issubset(requests): errors.append("TerminalBindingDerived") if len(records) != len(state.records): errors.append("TerminalUnique") - for rid, (binding, _) in requests.items(): + for _rid, (binding, _previous) in requests.items(): if not any( - authority in AUTHORITIES and (authority, binding) in LOCAL_AUTHORITY_BINDINGS + authority in AUTHORITIES + and (authority, binding) in REQUEST_AUTHORITY_BINDINGS for authority in AUTHORITIES ): - errors.append("LocalAuthorityRoot") + errors.append("RequestAuthorityRecognized") - for rid, (authority, _) in records.items(): + for rid, (authority, _value) in records.items(): request = requests.get(rid) - if request is None or (authority, request[0]) not in AUTHORITY_PROOF_BINDINGS: - errors.append("DelegatedAuthoritySound") - - # InputsNonAuthoritative is structural in the minimized model: State has - # exactly the three canonical decision components and no observed-input slot. - if tuple(State.__dataclass_fields__) != ("requests", "records", "conflicts"): - errors.append("InputsNonAuthoritative") + if request is None or (authority, request[0]) not in TERMINAL_AUTHORITY_BINDINGS: + errors.append("TerminalAuthorityRecognized") for rid in IDS: value = resolution_of(state, rid) @@ -185,7 +167,7 @@ def state_errors(state: State) -> list[str]: or rid in state.conflicts or record is None or record[1] != "ALLOW" - or (record[0], request[0]) not in AUTHORITY_PROOF_BINDINGS + or (record[0], request[0]) not in TERMINAL_AUTHORITY_BINDINGS ): errors.append("AllowSoundness") @@ -195,7 +177,7 @@ def state_errors(state: State) -> list[str]: if rid in state.conflicts and value != "UNKNOWN": errors.append("ConflictUnknown") - for _, (_, previous) in requests.items(): + for _rid, (_binding, previous) in requests.items(): if previous == NO_COMMITMENT: continue if previous not in RECOGNIZED_TERMINAL_COMMITMENTS: @@ -216,31 +198,24 @@ def transition_errors(action: str, before: State, after: State) -> list[str]: if after_records.get(rid) != record: errors.append("TerminalRecordsImmutable") - recognized_canonical_actions = { - "RegisterRequest", - "RegisterReconsideration", - "SubmitResolution", - "ObserveConflict", - "ObserveInvalidMaterial", - "ObserveNonAuthoritativeInput", - } - if ( - canonical_projection(before) != canonical_projection(after) - and action not in recognized_canonical_actions - ): - errors.append("CanonicalStateChangesOnlyByRecognizedTransition") + recognized_seed_actions = {"RegisterRequest", "RegisterReconsideration", "SubmitResolution"} + if seed_projection(before) != seed_projection(after) and action not in recognized_seed_actions: + errors.append("SeedStateChangesOnlyByRecognizedTransition") - if action == "ObserveInvalidMaterial" and before != after: - errors.append("InvalidMaterialStutter") - if action == "ObserveNonAuthoritativeInput" and before != after: - errors.append("NonAuthoritativeInputsStutter") + if action == "ObserveConflict" and seed_projection(before) != seed_projection(after): + errors.append("ConflictObservationPreservesSeedState") return sorted(set(errors)) def main() -> int: parser = argparse.ArgumentParser() - parser.add_argument("--depth", type=int, default=5) + parser.add_argument( + "--depth", + type=int, + default=None, + help="Optional diagnostic depth bound. Omit for exhaustive finite-state saturation.", + ) parser.add_argument("--output", type=Path) args = parser.parse_args() @@ -249,15 +224,19 @@ def main() -> int: transitions = 0 failures: list[dict[str, object]] = [] terminal_states = 0 + max_depth_seen = 0 + truncated = False while queue: state, depth = queue.popleft() + max_depth_seen = max(max_depth_seen, depth) errors = state_errors(state) if errors: failures.append({"state": repr(state), "errors": errors}) continue terminal_states += sum(resolution_of(state, rid) in TERMINALS for rid in IDS) - if depth >= args.depth: + if args.depth is not None and depth >= args.depth: + truncated = True continue for action, successor in successors(state): transitions += 1 @@ -276,9 +255,12 @@ def main() -> int: seen.add(successor) queue.append((successor, depth + 1)) + saturated = args.depth is None and not truncated report = { - "document_type": "aset-seed-minimal-kernel-bounded-model-check", - "depth": args.depth, + "document_type": "aset-seed-minimal-kernel-finite-model-check", + "depth_limit": args.depth, + "max_depth_reached": max_depth_seen, + "saturated": saturated, "states": len(seen), "transitions": transitions, "terminal_states": terminal_states, @@ -294,10 +276,11 @@ def main() -> int: json.dumps(report, sort_keys=True, indent=2) + "\n", encoding="utf-8" ) - print(f"MODEL_CHECK_STATES={report['states']}") + print(f"MODEL_CHECK_STATES={len(seen)}") print(f"MODEL_CHECK_TRANSITIONS={transitions}") print(f"MODEL_CHECK_TERMINAL_STATES={terminal_states}") print(f"MODEL_CHECK_FORMAL_PROPERTIES={len(FORMAL_PROPERTIES)}") + print("MODEL_CHECK_SATURATED=" + ("true" if saturated else "false")) print("MODEL_CHECK_VERDICT=" + report["verdict"]) return 0 if not failures else 1 diff --git a/tools/run_canon_tla_refinement.py b/tools/run_canon_tla_refinement.py index 5535c36..30f9ba8 100755 --- a/tools/run_canon_tla_refinement.py +++ b/tools/run_canon_tla_refinement.py @@ -60,9 +60,21 @@ def main() -> int: errors.append("canon-to-TLA refinement integrity check failed") proof_text = PROOF_PATH.read_text(encoding="utf-8") if PROOF_PATH.is_file() else "" - if "EXTENDS SeedCanonProjection, TLAPS" not in proof_text: + if "EXTENDS SeedResolution, TLAPS" not in proof_text: errors.append( - "refinement proof module does not import SeedCanonProjection and TLAPS" + "refinement proof module does not import SeedResolution and TLAPS" + ) + if ( + re.search( + r"^Canon\s*==\s*INSTANCE\s+SeedCanonProjection\s*$", + proof_text, + flags=re.MULTILINE, + ) + is None + ): + errors.append( + "refinement proof module does not explicitly instantiate " + "standalone SeedCanonProjection" ) if ( re.search( diff --git a/tools/run_invariant_mutations.py b/tools/run_invariant_mutations.py index 4318284..9fb3047 100755 --- a/tools/run_invariant_mutations.py +++ b/tools/run_invariant_mutations.py @@ -47,7 +47,7 @@ def apply_operator(operator: str, result: dict[str, Any]) -> dict[str, Any]: elif operator in { "ignore_binding_mismatch", "trust_remote_authority", - "accept_cyclic_grant", + "authority_evidence_creates_recognition", "external_input_authorizes", "invalid_material_allows", }: diff --git a/tools/run_tlaps.py b/tools/run_tlaps.py index 88a4404..850c02d 100755 --- a/tools/run_tlaps.py +++ b/tools/run_tlaps.py @@ -22,9 +22,8 @@ "SpecImpliesAlwaysSeedStateSafety", "SpecImpliesRequestsAppendOnly", "SpecImpliesTerminalRecordsImmutable", - "SpecImpliesCanonicalStateChangesOnlyByRecognizedTransition", - "SpecImpliesInvalidMaterialStutter", - "SpecImpliesNonAuthoritativeInputsStutter", + "SpecImpliesSeedStateChangesOnlyByRecognizedTransition", + "SpecImpliesConflictObservationPreservesSeedState", ) diff --git a/tools/seed_resolution_oracle.py b/tools/seed_resolution_oracle.py index 2e2a267..176f615 100755 --- a/tools/seed_resolution_oracle.py +++ b/tools/seed_resolution_oracle.py @@ -36,7 +36,6 @@ def empty_store() -> dict[str, list[dict[str, Any]]]: "requests": [], "records": [], "authority_bindings": [], - "authority_grants": [], } @@ -57,10 +56,6 @@ def authority_binding_valid(binding: dict[str, Any]) -> bool: return valid_digest(binding, "authority_binding_digest") -def grant_valid(grant: dict[str, Any]) -> bool: - return valid_digest(grant, "grant_digest") - - def request_valid(request: dict[str, Any]) -> bool: binding = request.get("binding") return ( @@ -80,58 +75,49 @@ class AuthorityVerdict: reason: str -def authority_proof_valid( +def authority_recognition_valid( store: dict[str, list[dict[str, Any]]], request: dict[str, Any], record: dict[str, Any], ) -> AuthorityVerdict: - bindings = indexed(store["authority_bindings"], "authority_binding_digest") - root = bindings.get(request["initial_authority_binding_digest"]) - if root is None or not authority_binding_valid(root): + """Validate the Seed-level Authority recognition boundary. + + Seed does not interpret delegation chains. Concrete signatures, grant chains, + federation proofs and other evidence may justify an Authority recognition, + but the canonical kernel consumes only the already-recognized exact-binding + result represented by a valid ResolutionAuthorityBinding. + """ + bindings = [ + item + for item in store["authority_bindings"] + if authority_binding_valid(item) + ] + by_digest = {item["authority_binding_digest"]: item for item in bindings} + root = by_digest.get(request["initial_authority_binding_digest"]) + if root is None: return AuthorityVerdict(False, "LOCAL_AUTHORITY_BINDING_INVALID") + binding = request["binding"] - if ( - root.get("context_id") != binding.get("context_id") - or root.get("policy_epoch") != binding.get("policy_epoch") - or root.get("binding_digest") != binding.get("binding_digest") - ): + exact = ( + root.get("context_id") == binding.get("context_id") + and root.get("policy_epoch") == binding.get("policy_epoch") + and root.get("binding_digest") == binding.get("binding_digest") + ) + if not exact: return AuthorityVerdict(False, "LOCAL_AUTHORITY_BINDING_MISMATCH") - current = root.get("authority_id") target = record.get("authority_id") - proof = record.get("authority_proof_digests") - if not isinstance(proof, list): - return AuthorityVerdict(False, "AUTHORITY_PROOF_INVALID") - if current == target: - return AuthorityVerdict(not proof, "LOCAL_ROOT_AUTHORITY" if not proof else "UNEXPECTED_AUTHORITY_PROOF") - if not root.get("delegation_allowed"): - return AuthorityVerdict(False, "DELEGATION_NOT_ALLOWED") - - grants = indexed(store["authority_grants"], "grant_digest") - seen = {current} - previous_digest: str | None = None - for position, grant_digest in enumerate(proof): - grant = grants.get(grant_digest) - if grant is None or not grant_valid(grant): - return AuthorityVerdict(False, "AUTHORITY_GRANT_INVALID") - if grant.get("binding_digest") != binding.get("binding_digest"): - return AuthorityVerdict(False, "AUTHORITY_GRANT_BINDING_MISMATCH") - if grant.get("issuer_authority_id") != current: - return AuthorityVerdict(False, "AUTHORITY_GRANT_CHAIN_MISMATCH") - if grant.get("previous_grant_digest") != previous_digest: - return AuthorityVerdict(False, "AUTHORITY_GRANT_PREDECESSOR_MISMATCH") - subject = grant.get("subject_authority_id") - if subject in seen: - return AuthorityVerdict(False, "AUTHORITY_GRANT_CYCLE") - if position < len(proof) - 1 and not grant.get("delegation_allowed"): - return AuthorityVerdict(False, "DELEGATION_NOT_ALLOWED") - seen.add(subject) - current = subject - previous_digest = grant_digest - - if current != target: - return AuthorityVerdict(False, "AUTHORITY_PROOF_TARGET_MISMATCH") - return AuthorityVerdict(True, "DELEGATED_AUTHORITY") + target_bindings = [item for item in bindings if item.get("authority_id") == target] + if not target_bindings: + return AuthorityVerdict(False, "TERMINAL_AUTHORITY_UNRECOGNIZED") + if not any( + item.get("context_id") == binding.get("context_id") + and item.get("policy_epoch") == binding.get("policy_epoch") + and item.get("binding_digest") == binding.get("binding_digest") + for item in target_bindings + ): + return AuthorityVerdict(False, "TERMINAL_AUTHORITY_BINDING_MISMATCH") + return AuthorityVerdict(True, "EXACT_BINDING_AUTHORITY_RECOGNIZED") def record_valid( @@ -149,7 +135,10 @@ def record_valid( return False, "REQUEST_DIGEST_MISMATCH" if record.get("binding_digest") != request["binding"].get("binding_digest"): return False, "BINDING_MISMATCH" - authority = authority_proof_valid(store, request, record) + evidence = record.get("authority_evidence_digests") + if not isinstance(evidence, list) or not all(isinstance(item, str) for item in evidence): + return False, "AUTHORITY_EVIDENCE_INVALID" + authority = authority_recognition_valid(store, request, record) if not authority.valid: return False, authority.reason return True, authority.reason diff --git a/tools/validate_seed_canon.py b/tools/validate_seed_canon.py index f7aef5e..14f05e8 100644 --- a/tools/validate_seed_canon.py +++ b/tools/validate_seed_canon.py @@ -87,6 +87,9 @@ def main() -> int: ] if kinds != expected_kinds: errors.append("transition_catalogue") + roles = [item.get("role") for item in model["transitions"]] + if roles != ["STATE_TRANSITION", "STATE_TRANSITION", "OBSERVER"]: + errors.append("transition_roles") if model["resolution_algebra"] != { "values": ["UNKNOWN", "ALLOW", "BLOCK"], "derived": "UNKNOWN", @@ -109,6 +112,15 @@ def main() -> int: schema_paths = [ROOT / item["path"] for item in protocol["schemas"]] if protocol["schema_count"] != len(protocol["schemas"]): errors.append("protocol_schema_count") + active_dir = ROOT / "seed/canonical/protocol/schemas" + physical_schemas = {path.resolve() for path in active_dir.glob("*.json")} + declared_schemas = {path.resolve() for path in schema_paths} + if physical_schemas != declared_schemas: + errors.append( + "protocol_schema_surface:" + f"undeclared={sorted(path.name for path in physical_schemas - declared_schemas)}:" + f"missing={sorted(path.name for path in declared_schemas - physical_schemas)}" + ) for item, path in zip(protocol["schemas"], schema_paths, strict=True): if not path.is_file() or digest(path) != item["sha256"]: errors.append("protocol_schema_digest:" + item["name"]) From 395c69d62896e151eff9e748d183451ccf1c1fd0 Mon Sep 17 00:00:00 2001 From: Dzmitry Prychyna Date: Fri, 7 Aug 2026 09:51:46 -0300 Subject: [PATCH 4/4] refactor(seed): close final semantic legacy gaps --- MANIFEST.json | 199 +++++++------ audit/ACTIVE_AUDIT_INDEX.json | 10 +- audit/ACTIVE_AUDIT_INDEX.md | 2 +- .../PDCA-18-SEED-FINAL-SEMANTIC-CLEANUP.json | 43 +++ audit/PDCA-18-SEED-FINAL-SEMANTIC-CLEANUP.md | 43 +++ audit/REFACTORING_LOG.md | 8 + docs/architecture/SEED_ROLE.md | 8 +- docs/architecture/SEED_STATE_MINIMIZATION.md | 5 +- docs/generated/en/ASET_Seed_Next.md | 32 +-- .../en/ASET_Seed_Resolution_0.3-alpha.1.md | 32 +-- docs/generated/pt-BR/ASET_Seed_Next.md | 32 +-- .../pt-BR/ASET_Seed_Resolution_0.3-alpha.1.md | 32 +-- docs/generated/ru/ASET_Seed_Next.md | 32 +-- .../ru/ASET_Seed_Resolution_0.3-alpha.1.md | 32 +-- docs/repository/BLACK_BOX_AUDIT_METHOD.md | 67 +++-- docs/repository/CI_ASSURANCE.md | 2 +- seed/canonical/CANON_PACKAGE.json | 40 +-- seed/canonical/README.md | 15 +- .../assurance/canon-tla-refinement.json | 56 ++-- .../assurance/invariant-coverage.json | 112 ++++---- .../assurance/proof-traceability.json | 4 +- .../assurance/verification-registry.json | 8 +- .../cases/positive/RES-POS-004.json | 2 +- .../conformance/conformance-profile.json | 2 +- .../conformance/model-based-conformance.json | 6 +- ...hority-conflict-and-operation-semantics.md | 57 ++++ seed/canonical/formal/README.md | 10 +- seed/canonical/formal/SeedCanonProjection.tla | 18 +- .../formal/SeedCanonRefinementProofs.tla | 5 +- seed/canonical/formal/SeedResolution.cfg | 7 +- seed/canonical/formal/SeedResolution.tla | 39 ++- .../canonical/formal/SeedResolutionProofs.tla | 23 +- .../migration/CANON_CHANGE_DECLARATION.json | 6 +- .../schemas/canon-tla-refinement.schema.json | 92 +++--- .../schemas/invariant-coverage.schema.json | 264 ++++++++++++------ seed/canonical/schemas/seed-model.schema.json | 160 +++++------ seed/canonical/source/seed-model.json | 142 +++++----- tests/test_canonical_model.py | 11 +- tests/test_ci_assurance.py | 17 +- tests/test_invariant_coverage.py | 4 +- tools/blackbox_documentation_audit.py | 1 + tools/build_canon_package.py | 1 + tools/check_assurance_traceability.py | 25 +- tools/check_canon_compatibility.py | 10 +- tools/check_canon_tla_refinement.py | 18 +- tools/check_invariant_coverage.py | 18 +- tools/generate_canon_tla_projection.py | 32 +-- tools/generate_editions.py | 14 +- tools/model_check_seed.py | 23 +- tools/validate_seed_canon.py | 16 +- 50 files changed, 1072 insertions(+), 765 deletions(-) create mode 100644 audit/PDCA-18-SEED-FINAL-SEMANTIC-CLEANUP.json create mode 100644 audit/PDCA-18-SEED-FINAL-SEMANTIC-CLEANUP.md create mode 100644 seed/canonical/decisions/ADR-010-unify-authority-conflict-and-operation-semantics.md diff --git a/MANIFEST.json b/MANIFEST.json index a3f5fbe..c651be0 100644 --- a/MANIFEST.json +++ b/MANIFEST.json @@ -188,13 +188,13 @@ }, { "path": "audit/ACTIVE_AUDIT_INDEX.json", - "sha256": "sha256:9990eedf03b0b6f95911df34d6cca15e966204abdc12918f62937f07e2be0a18", - "size_bytes": 2781 + "sha256": "sha256:bea24b466c100fd0152f17fb987543534855ca2b89e95af1d25c89ffed3e1773", + "size_bytes": 2887 }, { "path": "audit/ACTIVE_AUDIT_INDEX.md", - "sha256": "sha256:0199cd878c49cba04ea5e49c871d1c4801b7336ea8b7965af731a5bbd44be647", - "size_bytes": 1248 + "sha256": "sha256:e39f20ad45eb4b1d2bc7c7a0b3a95917589d666da9cf405e58af0ae83a7dca24", + "size_bytes": 1363 }, { "path": "audit/FINDING_CLOSURE_MATRIX.json", @@ -226,6 +226,16 @@ "sha256": "sha256:e8b83960c74d002991e2a8f5ae55570a8eee83a0f2115a97e0ed98646973c269", "size_bytes": 903 }, + { + "path": "audit/PDCA-18-SEED-FINAL-SEMANTIC-CLEANUP.json", + "sha256": "sha256:a324d126b6ae9860de5c2a7d89fb55faaace17c4e1d823bbbe47efb45ef14eb0", + "size_bytes": 2140 + }, + { + "path": "audit/PDCA-18-SEED-FINAL-SEMANTIC-CLEANUP.md", + "sha256": "sha256:9d2320b93110c3b8dbd61c956cde68e5b5f45534ad7d28d4363f6fc03fb1fb27", + "size_bytes": 1346 + }, { "path": "audit/PDCA_HISTORY.md", "sha256": "sha256:25ab54577ab863b1d31fcfd34d8c38052381d2822352f2dc35dcbd065679e1c4", @@ -248,8 +258,8 @@ }, { "path": "audit/REFACTORING_LOG.md", - "sha256": "sha256:1957c107f0fc9c71de5bdbd37b96c071742c854e52529ee1bce91b39a920f778", - "size_bytes": 2371 + "sha256": "sha256:80297d41a3e043b14f0bcbcb85cccab17ac1cc6b1347c35fd0a6060450d737f1", + "size_bytes": 3063 }, { "path": "audit/pdca/PDCA-05-RC12-CANON.md", @@ -313,13 +323,13 @@ }, { "path": "docs/architecture/SEED_ROLE.md", - "sha256": "sha256:d5f3f88f91959131304988f264932f1373c7527cda2cbf16c259d3877acd7989", - "size_bytes": 1615 + "sha256": "sha256:a3496eb393c5bc24e8145777f8eab19c2c127067d9425370c5337c1ba5413c34", + "size_bytes": 1742 }, { "path": "docs/architecture/SEED_STATE_MINIMIZATION.md", - "sha256": "sha256:73c0f19ed820dc44e34624f6e4f1829972437ba90a8fc439f563ca7d23e75058", - "size_bytes": 1570 + "sha256": "sha256:2608e9c1e5ef2925983d9735d9c41818fae1b50535cb046b06ee81a067704f24", + "size_bytes": 1674 }, { "path": "docs/architecture/TERMINAL_COMMITMENT_ACCUMULATION.md", @@ -338,13 +348,13 @@ }, { "path": "docs/generated/en/ASET_Seed_Next.md", - "sha256": "sha256:b348604389008b45d1eebcbf93214040c5b18d63614fa62b12f77231d13ee8b2", - "size_bytes": 11273 + "sha256": "sha256:cc8db0a091b1b7065ea50583e2190b0325b59efdc6dfe2e47e1ae64df5e6c656", + "size_bytes": 11789 }, { "path": "docs/generated/en/ASET_Seed_Resolution_0.3-alpha.1.md", - "sha256": "sha256:b348604389008b45d1eebcbf93214040c5b18d63614fa62b12f77231d13ee8b2", - "size_bytes": 11273 + "sha256": "sha256:cc8db0a091b1b7065ea50583e2190b0325b59efdc6dfe2e47e1ae64df5e6c656", + "size_bytes": 11789 }, { "path": "docs/generated/pt-BR/ASET_Seed_0.1-rc12.md", @@ -353,13 +363,13 @@ }, { "path": "docs/generated/pt-BR/ASET_Seed_Next.md", - "sha256": "sha256:1998e820c3144e2303fc0e330a00b489a41f6b83301686f81871334b3dcbf1e7", - "size_bytes": 12022 + "sha256": "sha256:c89f8dfa3303c3d7d7f3626ec9ce55b6a85076786cb6d9ee5f5bca6919c4f5b2", + "size_bytes": 12541 }, { "path": "docs/generated/pt-BR/ASET_Seed_Resolution_0.3-alpha.1.md", - "sha256": "sha256:1998e820c3144e2303fc0e330a00b489a41f6b83301686f81871334b3dcbf1e7", - "size_bytes": 12022 + "sha256": "sha256:c89f8dfa3303c3d7d7f3626ec9ce55b6a85076786cb6d9ee5f5bca6919c4f5b2", + "size_bytes": 12541 }, { "path": "docs/generated/ru/ASET_Seed_0.1-rc12.md", @@ -368,13 +378,13 @@ }, { "path": "docs/generated/ru/ASET_Seed_Next.md", - "sha256": "sha256:f5ee3f5db4a02c6ccd3182af886a6efbe6cbf8c5b531a283c9260cefeda917d0", - "size_bytes": 15982 + "sha256": "sha256:adea55c232c339a2107e4d7c408c8bf85d9fe7dc7e7be2a5a571da341e042dac", + "size_bytes": 16760 }, { "path": "docs/generated/ru/ASET_Seed_Resolution_0.3-alpha.1.md", - "sha256": "sha256:f5ee3f5db4a02c6ccd3182af886a6efbe6cbf8c5b531a283c9260cefeda917d0", - "size_bytes": 15982 + "sha256": "sha256:adea55c232c339a2107e4d7c408c8bf85d9fe7dc7e7be2a5a571da341e042dac", + "size_bytes": 16760 }, { "path": "docs/implementation/CROSS_IMPLEMENTATION_CONFORMANCE_PLAN.md", @@ -383,8 +393,8 @@ }, { "path": "docs/repository/BLACK_BOX_AUDIT_METHOD.md", - "sha256": "sha256:cdfad9ef4666388cae31cc6dff7baa494e79bda6caa4e38805e0083d624b6846", - "size_bytes": 2144 + "sha256": "sha256:3247376ca38a64eeca193c12b27a1ea47d2ccd271599ae528c42f3b5038a726a", + "size_bytes": 2246 }, { "path": "docs/repository/BRANCH_PROTECTION.md", @@ -393,8 +403,8 @@ }, { "path": "docs/repository/CI_ASSURANCE.md", - "sha256": "sha256:e233f5f4ce76e4b156e85d18edba23f70bd785a83f3a08c85f2b747e29c4092e", - "size_bytes": 3304 + "sha256": "sha256:f1d57be6d4f9a27bc8eaac526f605e263be96184d205fd71a277e19d626aa967", + "size_bytes": 3308 }, { "path": "docs/repository/DEPENDENCY_POLICY.md", @@ -468,23 +478,23 @@ }, { "path": "seed/canonical/CANON_PACKAGE.json", - "sha256": "sha256:58455e83e101e7a112a521c66cd68e56312227cfbf2accdbf668eba493d17942", - "size_bytes": 13241 + "sha256": "sha256:b2066da2be27e2f673c97fafebee1bcfc70f92e212b5bbba0c7b39baab505785", + "size_bytes": 13446 }, { "path": "seed/canonical/README.md", - "sha256": "sha256:dd873b7b201da02d7b9ea6f8e1f219b6c6ca31eca1c6c44be42af0d0cf4399cb", - "size_bytes": 2556 + "sha256": "sha256:3f1228ba583b6eef52f4a6ee2c6cf12564f99daae5191f77039453eb6895e4b4", + "size_bytes": 2672 }, { "path": "seed/canonical/assurance/canon-tla-refinement.json", - "sha256": "sha256:2095b62595d056c8a5a3b0700239a0211417979e4d5f2b4a535df0827017371b", - "size_bytes": 6791 + "sha256": "sha256:22884e71f1a484a8a7b00f708188191783505a71d1b2d15ad73cca67510099a5", + "size_bytes": 6876 }, { "path": "seed/canonical/assurance/invariant-coverage.json", - "sha256": "sha256:2d89e21d092bf4d340e271dc3bcba2d7df618c4c4b41e67beb626f518cdb163b", - "size_bytes": 15093 + "sha256": "sha256:0ffed8e2b1351928d9921c96bab4d8225504cf77e7298a0c8a603b66ac71e2c7", + "size_bytes": 15101 }, { "path": "seed/canonical/assurance/limitations.json", @@ -493,8 +503,8 @@ }, { "path": "seed/canonical/assurance/proof-traceability.json", - "sha256": "sha256:043bb3b1717d0c41123d326dc9b1d8dcae1cdde78c7ebf2d2ae26e79d2248eaf", - "size_bytes": 6966 + "sha256": "sha256:eaa97bb7aa9b09554ef4b1624dacac219a8a6ee24fdb8809cf203d1badffb0a2", + "size_bytes": 6972 }, { "path": "seed/canonical/assurance/repository-release-gates.json", @@ -503,8 +513,8 @@ }, { "path": "seed/canonical/assurance/verification-registry.json", - "sha256": "sha256:b4bb28e5a8965e984013ad7408522749cfef3008c913a518f455fefda7136187", - "size_bytes": 9717 + "sha256": "sha256:cc5f2c5b4ce0c9e466bb63779c1199817859e4d65d6df204acfaa3619b1f819c", + "size_bytes": 9722 }, { "path": "seed/canonical/conformance/cases/negative/RES-NEG-001.json", @@ -603,8 +613,8 @@ }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-004.json", - "sha256": "sha256:dcf5f81b0e60f2aa0c157aab5297177d3f082544d64a54081d83e9d7d6093763", - "size_bytes": 2888 + "sha256": "sha256:b7407ed453ab3dd20d36ab3dd540d7c9c0c002df8821c40455b181b425093eef", + "size_bytes": 2906 }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-005.json", @@ -633,7 +643,7 @@ }, { "path": "seed/canonical/conformance/conformance-profile.json", - "sha256": "sha256:aabbf317e0c51a1a1f1021dfbd0b2981c3dcf1142b89eb6a1bbfb1c7e1e9dcd6", + "sha256": "sha256:8b5aaa3b5890315f001ee68257c9a316d1523000db26ddd9b112fd16456f2cf4", "size_bytes": 12423 }, { @@ -643,8 +653,8 @@ }, { "path": "seed/canonical/conformance/model-based-conformance.json", - "sha256": "sha256:db4b3f9e76aff7e8ef3a87f02ae748bb4f718428370306454eb94b9dcc6212b4", - "size_bytes": 1453 + "sha256": "sha256:5cae29741da3488563cf026a04c9918d26d48fcd58db65607c25beb8c8705c08", + "size_bytes": 1577 }, { "path": "seed/canonical/decisions/ADR-001-semantic-canon-authority.md", @@ -691,35 +701,40 @@ "sha256": "sha256:fdb642c8f306d2136345e19c3650c22805f63139ac93d8f81f6773aa249881a0", "size_bytes": 2604 }, + { + "path": "seed/canonical/decisions/ADR-010-unify-authority-conflict-and-operation-semantics.md", + "sha256": "sha256:e9757a2879f7e6ce6c9b087212dbcc4cf2c74085f6b1e09be5fdfd4a7b236078", + "size_bytes": 2609 + }, { "path": "seed/canonical/formal/README.md", - "sha256": "sha256:38ef56c859221204201f3bed365f810bc383ca1fb257328ea6b774a67fe7ff82", - "size_bytes": 2373 + "sha256": "sha256:88d6c9a655bfe61b057bc09af68d7ffa528fa61d7cac4ac6971cd33681a113d4", + "size_bytes": 2492 }, { "path": "seed/canonical/formal/SeedCanonProjection.tla", - "sha256": "sha256:b7265eb707795b592c678842f764a5bfa7ce303bdc66f55f858366e20d64eb4e", - "size_bytes": 4377 + "sha256": "sha256:b3bf0555abba2fc9e817d1c3e97b93d62af933edfb9c7f5e7eec4502445447f5", + "size_bytes": 4246 }, { "path": "seed/canonical/formal/SeedCanonRefinementProofs.tla", - "sha256": "sha256:46ef7336b86d066ee531eb2c43873d9b6e1622dd48632b9af08ea6f412cf6338", - "size_bytes": 3391 + "sha256": "sha256:522338cc774f1f473d20130630e01aec6b66a2ac971ffed113b8a91d654b72ad", + "size_bytes": 3334 }, { "path": "seed/canonical/formal/SeedResolution.cfg", - "sha256": "sha256:b4ee7fb775fbf8909fded4e7b2086b8022e1412e648e21f470c464a625f690c0", - "size_bytes": 706 + "sha256": "sha256:bee70a11c1bde1e0b7aaa0acefbe5a4137bdcd5c3fbea254a3d8a1999086f1b7", + "size_bytes": 657 }, { "path": "seed/canonical/formal/SeedResolution.tla", - "sha256": "sha256:1c53b058d738e074c2a9de96fe27d8d7dd384d3ffa52f3bb95f7732908d66276", - "size_bytes": 7417 + "sha256": "sha256:1c0ebb27ed52da289f0981dcb11b61b6a7fc5c4a030ba434ae0b1d53b286b926", + "size_bytes": 7318 }, { "path": "seed/canonical/formal/SeedResolutionProofs.tla", - "sha256": "sha256:bcb4652249d66cbcb16f7c5a4538ad3bc2c31ef7d37b49fd27328eff6a6725f9", - "size_bytes": 21892 + "sha256": "sha256:3d6bdada8c1c0f93c247eb5c5b4df895e793c174768270138f2d6e6176990ad7", + "size_bytes": 21965 }, { "path": "seed/canonical/migration/ALPHA2_TO_0.3_ALPHA1.md", @@ -733,8 +748,8 @@ }, { "path": "seed/canonical/migration/CANON_CHANGE_DECLARATION.json", - "sha256": "sha256:4eb176ddb006c0957a2bf1d79685fd86b263b89500cc53df919193ec91459bf8", - "size_bytes": 820 + "sha256": "sha256:2bc5d60abed02040dd41c79db86aa23cbf206bf81df8193f771ceb9b8a29541c", + "size_bytes": 824 }, { "path": "seed/canonical/migration/RC11_TO_RC12_SEMANTIC_COVERAGE.json", @@ -873,8 +888,8 @@ }, { "path": "seed/canonical/schemas/canon-tla-refinement.schema.json", - "sha256": "sha256:17b142a998bbc8dd7b82b61c54d75e0c0e735211f35f90312565b78a4e7758e5", - "size_bytes": 6776 + "sha256": "sha256:ccd44d46cd3e9075fd439ead6a08cf3685d62bdea7f76d7ab2a736b579706069", + "size_bytes": 6772 }, { "path": "seed/canonical/schemas/conformance-profile.schema.json", @@ -893,8 +908,8 @@ }, { "path": "seed/canonical/schemas/invariant-coverage.schema.json", - "sha256": "sha256:e7ec1a6577df2519ca49f8c682588d68d767f9d28ab3301a6280221100ddc5b3", - "size_bytes": 3836 + "sha256": "sha256:9831e12343697216eac28a82b29baeb160a360e4e0126fcb356d904227b69ded", + "size_bytes": 4846 }, { "path": "seed/canonical/schemas/proof-traceability.schema.json", @@ -923,8 +938,8 @@ }, { "path": "seed/canonical/schemas/seed-model.schema.json", - "sha256": "sha256:1f1a727764b5d0138951f76fac1ab1155f4ba67c92f21aa8a21f7ef105bf9f94", - "size_bytes": 8807 + "sha256": "sha256:d454d6bc54aa8247ed35ab64d56c8702ba889243bb81f600a8edfbd9ee4fda89", + "size_bytes": 8805 }, { "path": "seed/canonical/shapes/seed.shacl.ttl", @@ -933,8 +948,8 @@ }, { "path": "seed/canonical/source/seed-model.json", - "sha256": "sha256:c43ca7b642a11c3ab140884a6bbff34bbd741f5cb905e6a779c860c813998fcf", - "size_bytes": 40151 + "sha256": "sha256:1fed5dc95045a287b3e9b8b4ea011a7b977729158f3360ed9a8a7e7e6ba1b4b0", + "size_bytes": 41799 }, { "path": "seed/canonical/terminology/foreign-terms.json", @@ -1913,13 +1928,13 @@ }, { "path": "tests/test_canonical_model.py", - "sha256": "sha256:a31ea5918db6c34161996edbe3a1ea11fe664aa311134c13ed92f35a6e25ea4e", - "size_bytes": 1451 + "sha256": "sha256:bfff1d731981bdef1855639d4b946a4f0a53c6217faf901a004e5277c5cb7d3c", + "size_bytes": 1546 }, { "path": "tests/test_ci_assurance.py", - "sha256": "sha256:d9339a902b4c78bf0b2d9d5dce3d705b2dce0a58f51a9c45f7efceaddd87c8f6", - "size_bytes": 9353 + "sha256": "sha256:e6d44a7bf9790e4c99262025ec3f487377760c2928f45d5319729a52456261f3", + "size_bytes": 9410 }, { "path": "tests/test_implementation_conformance_protocol.py", @@ -1928,8 +1943,8 @@ }, { "path": "tests/test_invariant_coverage.py", - "sha256": "sha256:6d5fa8bf5a6affef1b398cf5ac12a77148c3520ba25e11eff8301b89ba9668b9", - "size_bytes": 1744 + "sha256": "sha256:959ff3e0099523719c54a6f621180bb4d40cdc425c8af437e0f6baa0a02cd437", + "size_bytes": 1742 }, { "path": "tests/test_minimal_resolution_kernel.py", @@ -1963,13 +1978,13 @@ }, { "path": "tools/blackbox_documentation_audit.py", - "sha256": "sha256:a8108fcf9241d2c3c419f456439259e6079d76d9994113c493576a9ebd0edc08", - "size_bytes": 4125 + "sha256": "sha256:ac6d7ef36c3114fedad8f5a168a6fb036b763a2190ac0f68dc6fd233ffdc52d2", + "size_bytes": 4181 }, { "path": "tools/build_canon_package.py", - "sha256": "sha256:ec71afc2e51b342694d061e6117360602aebde4ac2c74799b85a9dfda255e2fd", - "size_bytes": 4372 + "sha256": "sha256:f79501e64c6bd95eebad7411e2d487a9c27a2c866b2b54d72ea84a004752ebd0", + "size_bytes": 4464 }, { "path": "tools/build_release.py", @@ -1978,23 +1993,23 @@ }, { "path": "tools/check_assurance_traceability.py", - "sha256": "sha256:7a4076a25b2e73af9244f1bb8e9d57ffede103a454c36dec028a415ed36ecbc6", - "size_bytes": 10419 + "sha256": "sha256:35e94c96b60bb19fd6c872a7d36ff707deca79443463656303a6c9e4ec01df8c", + "size_bytes": 10421 }, { "path": "tools/check_canon_compatibility.py", - "sha256": "sha256:d1130da7274498255176d3a7b637822efb9f94591912309d6146ac45b80e8ce4", - "size_bytes": 5702 + "sha256": "sha256:0961ef11c7ef67fbbc6b90a4529294a12fe80c86269c59236a3add23c8b09d97", + "size_bytes": 5916 }, { "path": "tools/check_canon_tla_refinement.py", - "sha256": "sha256:95a6a771244177f7e4fe83921baadd11170c4b6967fc39d6238a1a87a5e3c02b", - "size_bytes": 8989 + "sha256": "sha256:1e5dcdd478bc88ce1e7b2a972b5d135b3089b12d47f2c626e42def0f95b7d0e9", + "size_bytes": 8977 }, { "path": "tools/check_invariant_coverage.py", - "sha256": "sha256:bc578d83ebe432c16f5649de077fec276ec0f8e0df8239bb9663c03077c1841f", - "size_bytes": 7231 + "sha256": "sha256:c0bb0fc214239214bf1b7c3f472405253b69033122ebe7fe0d3e5e30e8b25d0d", + "size_bytes": 7211 }, { "path": "tools/check_language.py", @@ -2008,13 +2023,13 @@ }, { "path": "tools/generate_canon_tla_projection.py", - "sha256": "sha256:fb0bc3d79d0d8e4c7bffa4a1f5ab6c76b45bb621adae8ef4367958e9a7b16127", - "size_bytes": 9119 + "sha256": "sha256:f92535d146281802918d438169c477f6daeceec29d77142e7bfbfe7eb710d20a", + "size_bytes": 8992 }, { "path": "tools/generate_editions.py", - "sha256": "sha256:0052acde2f7f4855071c424f8ddc3aead530bd2e59ebef0a5213d67a4f1c04a6", - "size_bytes": 5814 + "sha256": "sha256:085e795b3913bcf5cb5be5751292de6a321b6cf6744cd1cdea2f77813024f616", + "size_bytes": 5805 }, { "path": "tools/generate_project_metadata.py", @@ -2043,8 +2058,8 @@ }, { "path": "tools/model_check_seed.py", - "sha256": "sha256:40411d867950450af17bbdf5f4db47c83916c6edb65a45fb565d26d7fbbe67be", - "size_bytes": 9720 + "sha256": "sha256:a5fa0f1808a562d6a774daccbab5a244517f6261a0e8d68f3d5952fe635fcb3d", + "size_bytes": 9693 }, { "path": "tools/production_gate.py", @@ -2128,8 +2143,8 @@ }, { "path": "tools/validate_seed_canon.py", - "sha256": "sha256:39100a61aef4cfed479a9a91a98e7312976bb31970c32aa2fa9e90a093b1d87d", - "size_bytes": 7891 + "sha256": "sha256:d340da0aef7c9f94537dd4a8558e786d90b921b53f58d6544981252726ae777d", + "size_bytes": 8201 }, { "path": "tools/verify_frozen_release.py", @@ -2137,7 +2152,7 @@ "size_bytes": 1035 } ], - "files_count": 427, + "files_count": 430, "manifest_scope": "all repository regular files except MANIFEST.json, Git metadata, virtual environments, caches and dist", "package": "ASET-Seed-0.3.0-alpha.1-Minimal-Strong-Core", "repository_root": "ASET" diff --git a/audit/ACTIVE_AUDIT_INDEX.json b/audit/ACTIVE_AUDIT_INDEX.json index 8f0c17a..c7f4b20 100644 --- a/audit/ACTIVE_AUDIT_INDEX.json +++ b/audit/ACTIVE_AUDIT_INDEX.json @@ -1,6 +1,6 @@ { "active_candidate": { - "canon_package_digest": "sha256:392ff8e36eecb2bf6cfa9a6cbc76117025a4c7d8a170e8ddf562f1ea5df27d38", + "canon_package_digest": "sha256:0e1518c4ff6bd6b0da71089bfe5e1a9802929016c8ec2547024a1a0e2b84a19d", "extension_separation": "COMPLETE", "implementation_precedence": "NONE", "repository_role": "OPEN_IMPLEMENTATION_NEUTRAL_SPECIFICATION", @@ -11,8 +11,8 @@ "audit/PDCA-15-EXTENSION-EXTRACTION-CLOSURE.json", "audit/PDCA-15-EXTENSION-EXTRACTION-CLOSURE.md", "audit/REFACTORING_LOG.md", - "audit/PDCA-17-INVARIANT-CLOSURE.json", - "audit/PDCA-17-INVARIANT-CLOSURE.md" + "audit/PDCA-18-SEED-FINAL-SEMANTIC-CLEANUP.json", + "audit/PDCA-18-SEED-FINAL-SEMANTIC-CLEANUP.md" ], "classification_rules": [ "Only active_controlling_records may support static claims about the current implementation-neutral candidate.", @@ -55,7 +55,9 @@ "audit/pdca/PDCA-11-PREFREEZE-BLOCKER-CLOSURE.md", "audit/pdca/PDCA-12-FINAL-PREFREEZE-ASSURANCE.md", "audit/pdca/PDCA-13-PROJECT-METADATA-AND-DOCUMENTATION-GENERATION.md", - "audit/pdca/PDCA-14-SEED-SEMANTIC-NUCLEUS.md" + "audit/pdca/PDCA-14-SEED-SEMANTIC-NUCLEUS.md", + "audit/PDCA-17-INVARIANT-CLOSURE.json", + "audit/PDCA-17-INVARIANT-CLOSURE.md" ], "index_exclusions": [ "audit/README.md", diff --git a/audit/ACTIVE_AUDIT_INDEX.md b/audit/ACTIVE_AUDIT_INDEX.md index 60beb03..27f0527 100644 --- a/audit/ACTIVE_AUDIT_INDEX.md +++ b/audit/ACTIVE_AUDIT_INDEX.md @@ -6,7 +6,7 @@ This index separates the current implementation-neutral Seed candidate from hist The current candidate is Seed `0.3.0-alpha.1`. Its machine identity is [`seed/canonical/CANON_PACKAGE.json`](../seed/canonical/CANON_PACKAGE.json), and its repository claim boundary is [`REPOSITORY_STATUS.json`](../REPOSITORY_STATUS.json). -Static controlling records are listed in [`ACTIVE_AUDIT_INDEX.json`](ACTIVE_AUDIT_INDEX.json). Candidate-specific executable evidence is generated under `dist/` by [`tools/repository_release_gate.py`](../tools/repository_release_gate.py). The active assurance line additionally requires complete invariant coverage and zero surviving semantic mutations as defined by [`PDCA-17-INVARIANT-CLOSURE.md`](PDCA-17-INVARIANT-CLOSURE.md). +Static controlling records are listed in [`ACTIVE_AUDIT_INDEX.json`](ACTIVE_AUDIT_INDEX.json). Candidate-specific executable evidence is generated under `dist/` by [`tools/repository_release_gate.py`](../tools/repository_release_gate.py). The active assurance line is controlled by [`PDCA-18-SEED-FINAL-SEMANTIC-CLEANUP.md`](PDCA-18-SEED-FINAL-SEMANTIC-CLEANUP.md), which requires role-classified operation coverage, saturated finite-state exploration, zero surviving semantic mutations, TLC/TLAPS closure and standalone canon-to-TLA refinement. ## Historical records diff --git a/audit/PDCA-18-SEED-FINAL-SEMANTIC-CLEANUP.json b/audit/PDCA-18-SEED-FINAL-SEMANTIC-CLEANUP.json new file mode 100644 index 0000000..62dda41 --- /dev/null +++ b/audit/PDCA-18-SEED-FINAL-SEMANTIC-CLEANUP.json @@ -0,0 +1,43 @@ +{ + "act": { + "freeze_rule": "After this cleanup, further Seed changes should strengthen assurance or fix demonstrated semantic defects; new capabilities belong in extensions.", + "release_rule": "The exact candidate must pass canon validation, saturated finite-state exploration, semantic mutations, operation coverage, TLC, TLAPS, standalone canon-to-TLA refinement and the repository release gate." + }, + "candidate": "ASET-SEED-RESOLUTION-CANON-0.3-ALPHA1", + "check": { + "required_results": { + "canon_operations": "3 = 2 state transitions + 1 observer", + "invariants": "12/12", + "requirements": "12/12", + "semantic_mutations": "13/13 killed", + "standalone_projection": "V5 parity + TLAPS refinement proof", + "tlaps": "REQUIRED_BY_RELEASE_GATE", + "tlc": "REQUIRED_BY_RELEASE_GATE" + } + }, + "cycle_id": "PDCA-18", + "do": { + "changes": [ + "unified request and terminal Authority admission under RecognizedAuthorityBindings", + "restricted conflict observation to already accepted terminal resolutions", + "renamed terminal uniqueness to AcceptedTerminalUnique and strengthened conflict semantics as ConflictSound", + "replaced the machine-canon transitions catalogue with a role-classified operations catalogue", + "moved operation identifiers from SEED-TX-* to SEED-OP-*", + "advanced the standalone canon-to-TLA projection profile to V5", + "updated active black-box audit methodology and made that methodology part of the audited documentation surface", + "recorded the cleanup in ADR-010 and the active audit line" + ] + }, + "document_type": "aset-pdca-seed-final-semantic-cleanup", + "plan": { + "constraints": [ + "do not add new Seed capabilities", + "preserve implementation neutrality", + "preserve the wire-level single AuthorityBinding semantics", + "preserve historical RC11/RC12 evidence as non-controlling history" + ], + "objective": "Remove the final formal/wire and terminology mismatches from the Seed 0.3 minimal resolution kernel." + }, + "schema_version": 1, + "verdict": "FINAL_SEMANTIC_CLEANUP_DEFINED" +} diff --git a/audit/PDCA-18-SEED-FINAL-SEMANTIC-CLEANUP.md b/audit/PDCA-18-SEED-FINAL-SEMANTIC-CLEANUP.md new file mode 100644 index 0000000..707b194 --- /dev/null +++ b/audit/PDCA-18-SEED-FINAL-SEMANTIC-CLEANUP.md @@ -0,0 +1,43 @@ +# PDCA-18 — Seed final semantic cleanup + +## Plan + +Remove the remaining mismatches between the active machine canon, wire +semantics and formal model without adding new Seed capabilities. + +## Do + +The candidate: + +- uses one `RecognizedAuthorityBindings` relation for both request and terminal + admission; +- admits conflict observation only for an already accepted terminal resolution; +- distinguishes `AcceptedTerminalUnique` from external conflicting valid + material and expresses the latter through `ConflictSound`; +- publishes three role-classified operations, not three transitions; +- uses `SEED-OP-*` identifiers for two state transitions and one observer; +- advances the standalone canon projection to profile V5; +- replaces the obsolete RC12 runtime black-box methodology with the actual + active specification-repository audit boundary. + +## Check + +The exact candidate is required to close: + +```text +requirements = 12/12 +invariants = 12/12 +operations = 3/3 +semantic mutations killed = 13/13 +finite model saturated = true +TLC = PASS +TLAPS = PASS +canon-to-TLA refinement = PASS +repository release gate = PASS +``` + +## Act + +Once those gates pass, Seed 0.3 should be treated as semantically stabilized. +Further capability growth belongs in extensions; further Seed changes should +be limited to demonstrated defects or assurance strengthening. diff --git a/audit/REFACTORING_LOG.md b/audit/REFACTORING_LOG.md index 47ceee0..c639949 100644 --- a/audit/REFACTORING_LOG.md +++ b/audit/REFACTORING_LOG.md @@ -24,3 +24,11 @@ - Rephrased the active System Composition environment invariant so that it binds an externally committed assurance-toolchain and dependency closure without prescribing Python or any implementation runtime. - Replaced Python-specific environment descriptions in active component and system verification cases with implementation-neutral assurance-toolchain descriptions; frozen rc11 source evidence remains unchanged. - Linked the separate non-normative [`aset-python-sqlite`](https://github.com/attractor-set/aset-python-sqlite) reference implementation from all curated root README editions and the roadmap without granting it semantic precedence. + +## Seed final semantic cleanup + +- Unified request and terminal admission under one `RecognizedAuthorityBindings` relation to match the single wire AuthorityBinding semantics. +- Restricted conflict observation to already accepted terminal resolutions, eliminating impossible pre-terminal conflict states. +- Distinguished accepted terminal uniqueness from external valid conflict material through `AcceptedTerminalUnique` and `ConflictSound`. +- Reclassified the machine-canon catalogue as three operations: two state transitions and one observer, with `SEED-OP-*` identifiers. +- Advanced the standalone canon-to-TLA projection to V5 and updated the active audit methodology and evidence line. diff --git a/docs/architecture/SEED_ROLE.md b/docs/architecture/SEED_ROLE.md index d0ae67a..e228c8f 100644 --- a/docs/architecture/SEED_ROLE.md +++ b/docs/architecture/SEED_ROLE.md @@ -13,8 +13,7 @@ conflict observations, policy results or cryptographic proofs. ## Environment and observers -Conflict is environment state because an independently established conflict -between valid terminal records changes the derived resolution to `UNKNOWN`. +Conflict is environment state because additional distinct valid terminal material for an already accepted terminal resolution changes the derived resolution to `UNKNOWN`. Conflict observation is not admissible before an accepted terminal record exists. `EVALUATE_RESOLUTION` is a pure observer and never mutates Seed-owned state. Invalid, malformed or non-authoritative material has no Seed state slot. It may @@ -23,10 +22,7 @@ Authority, `ALLOW` or a conflict by mere presence. ## Authority boundary -Seed requires an exact-binding Authority to be explicitly recognized by the -local Context. How that recognition is established—signature, certificate, -delegation chain, hardware root, external verifier or another mechanism—is a -profile concern. Opaque evidence references are not Authority by themselves. +Seed consumes one exact-binding Authority-recognition relation for both request registration and terminal submission. How recognition is established—signature, certificate, delegation mechanism, hardware root, external verifier or another mechanism—is a profile concern. Opaque evidence references are not Authority by themselves. ## Outside Seed diff --git a/docs/architecture/SEED_STATE_MINIMIZATION.md b/docs/architecture/SEED_STATE_MINIMIZATION.md index 1275c28..3b1ff79 100644 --- a/docs/architecture/SEED_STATE_MINIMIZATION.md +++ b/docs/architecture/SEED_STATE_MINIMIZATION.md @@ -7,7 +7,7 @@ environment dimension: 1. `requestMeta` — partial map of admitted request metadata; 2. `terminalMeta` — partial map of accepted terminal metadata; -3. `conflicts` — environment observation state. +3. `conflicts` — environment observation state constrained to accepted terminal requests. `seedVars == <>`; conflict is deliberately excluded from Seed-owned state. @@ -34,8 +34,7 @@ separate provenance refinement is specified and proved. Invalid/non-authoritative material has no artificial stutter action. It remains outside the abstract state machine. The executable admission boundary verifies -that it cannot create accepted state. Valid conflict observation is modeled -separately as environment state and is proved not to mutate Seed-owned state. +that it cannot create accepted state. Valid conflict observation is modeled separately as environment state, is admissible only after an accepted terminal record exists, and is proved not to mutate Seed-owned state. No Merkle tree, MMR, signature algorithm or accumulator is introduced into the Seed core. diff --git a/docs/generated/en/ASET_Seed_Next.md b/docs/generated/en/ASET_Seed_Next.md index a9e0495..f0f1c3f 100644 --- a/docs/generated/en/ASET_Seed_Next.md +++ b/docs/generated/en/ASET_Seed_Next.md @@ -4,7 +4,7 @@ **Status:** `MINIMAL_STRONG_CORE_ALPHA` -**Canonical model SHA-256:** `sha256:54c46e46d4e6b5870353bb0ed229310f60583e9acd11798b655bdd837c8dba74` +**Canonical model SHA-256:** `sha256:d8fde8f21b6524b2442151505f8bf4aec29e17be4a17d2409021ad594597b203` > This edition is derived from the machine canon. @@ -98,7 +98,7 @@ Predicate: `resolution_domain` ### `ASET-SEED-REQ-004` -An exact bound effect MUST be permitted if and only if the unique valid terminal ResolutionRecord is ALLOW. +An exact bound effect MUST be permitted if and only if the accepted authoritative terminal ResolutionRecord is ALLOW and no valid terminal conflict is observed. Modality: `MUST` @@ -108,7 +108,7 @@ Predicate: `allow_only` ### `ASET-SEED-REQ-005` -UNKNOWN and BLOCK MUST prohibit the effect. Missing or ambiguous valid terminal state, or failure to establish a valid terminal record, MUST resolve to UNKNOWN. Invalid or non-authoritative material MUST NOT override an otherwise unique valid terminal record. +UNKNOWN and BLOCK MUST prohibit the effect. Missing accepted terminal state, failure to establish an authoritative terminal record, or observation of additional conflicting valid terminal material MUST resolve to UNKNOWN. Invalid or non-authoritative material MUST NOT override an otherwise authoritative accepted terminal record. Modality: `MUST` @@ -148,11 +148,11 @@ Predicate: `inputs_non_authoritative` ### `ASET-SEED-REQ-009` -At most one valid terminal record MAY exist for one resolution_id; conflicting terminal records MUST fail closed as UNKNOWN. +Seed-owned state MUST accept at most one terminal record for one resolution_id. Observation of additional distinct valid terminal material for an already accepted terminal resolution MUST fail closed as UNKNOWN without replacing the accepted record. -Modality: `MAY` +Modality: `MUST` -Predicate: `terminal_unique` +Predicate: `accepted_terminal_unique` `verification`: `ASET-VERIFY-DECLARATIVE-STATE-VALIDATION`, `ASET-VERIFY-PORTABLE-CASES`, `ASET-VERIFY-BOUNDED-MODEL`, `ASET-VERIFY-INVARIANT-COVERAGE`, `ASET-VERIFY-SEMANTIC-MUTATIONS` @@ -189,39 +189,39 @@ Predicate: `implementation_neutral` ## Invariants - `SEED-INV-001` — Every valid derived resolution is UNKNOWN, ALLOW or BLOCK. -- `SEED-INV-002` — Effect permission is true if and only if the unique valid terminal record is ALLOW. +- `SEED-INV-002` — Effect permission is true if and only if the accepted authoritative terminal record is ALLOW and no valid terminal conflict is observed. - `SEED-INV-003` — UNKNOWN and BLOCK never permit an effect. - `SEED-INV-004` — Every request and terminal record preserves one exact binding digest. - `SEED-INV-005` — Every valid terminal record uses an Authority explicitly recognized for the exact local binding. - `SEED-INV-006` — Authority evidence is non-authoritative until exact-binding Authority recognition succeeds; opaque proof material cannot create or expand Authority by itself. - `SEED-INV-007` — External statements and evidence are outside Seed-owned canonical state unless accepted by a recognized Seed transition. -- `SEED-INV-008` — At most one valid terminal record exists for one resolution_id. -- `SEED-INV-009` — Conflicting valid terminal records yield UNKNOWN. Invalid or non-authoritative material cannot create ALLOW, create a conflict, or override an otherwise unique valid terminal record. +- `SEED-INV-008` — Seed-owned state accepts at most one terminal record for one resolution_id. +- `SEED-INV-009` — A conflict observation is valid only for a resolution_id that already has an accepted terminal record. Additional conflicting valid terminal material yields UNKNOWN; invalid or non-authoritative material cannot create ALLOW, create a conflict, or replace the accepted record. - `SEED-INV-010` — Resolution records are append-only, immutable and content-addressed. - `SEED-INV-011` — Only recognized Seed state transitions may change Seed-owned canonical state; environment observations and observer operations do not mutate that state. - `SEED-INV-012` — Reconsideration uses a fresh resolution_id linked by an immutable content-addressed commitment to a previously recognized terminal ResolutionRecord; predecessor object retention is not required. -## Transitions +## Operations -### `SEED-TX-001` — `REGISTER_REQUEST` +### `SEED-OP-001` — `REGISTER_REQUEST` - `payload_schema`: `seed/canonical/protocol/schemas/payload-register-request.schema.json` -- `authority_rule`: The initial Authority binding must be locally rooted and exactly match the request binding. +- `authority_rule`: The Authority must be explicitly recognized for the exact request binding. - `binding_rule`: The request contains one canonical exact binding and a fresh resolution_id. For reconsideration, previous_terminal_record_digest must be a recognized immutable terminal-record commitment; predecessor object presence in retained storage is not required. - `created_artifacts`: `ResolutionRequest` -### `SEED-TX-002` — `SUBMIT_RESOLUTION` +### `SEED-OP-002` — `SUBMIT_RESOLUTION` - `payload_schema`: `seed/canonical/protocol/schemas/payload-submit-resolution.schema.json` -- `authority_rule`: The record Authority must be explicitly recognized for the exact request binding. Concrete signatures, delegation chains and proof construction are external validation mechanisms. +- `authority_rule`: The Authority must be explicitly recognized for the exact request binding. Concrete signatures, credentials, delegation mechanisms and proof construction are external validation mechanisms. - `binding_rule`: The record request_digest and binding_digest must exactly match the registered request. - `created_artifacts`: `ResolutionRecord` -### `SEED-TX-003` — `EVALUATE_RESOLUTION` +### `SEED-OP-003` — `EVALUATE_RESOLUTION` - `payload_schema`: `seed/canonical/protocol/schemas/operation.schema.json` - `authority_rule`: Evaluation creates no Authority and accepts no external statement as a resolution. -- `binding_rule`: Evaluation observes one resolution_id without mutating Seed-owned state. It derives UNKNOWN when no unique valid terminal record is established; invalid or non-authoritative material cannot override a unique valid record. +- `binding_rule`: Evaluation observes one resolution_id without mutating Seed-owned state. It derives UNKNOWN when no authoritative accepted terminal result is established or when additional conflicting valid terminal material is observed; invalid or non-authoritative material cannot override an otherwise authoritative accepted terminal result. - `created_artifacts`: `ResolutionEvaluation` ## Implementation boundary diff --git a/docs/generated/en/ASET_Seed_Resolution_0.3-alpha.1.md b/docs/generated/en/ASET_Seed_Resolution_0.3-alpha.1.md index a9e0495..f0f1c3f 100644 --- a/docs/generated/en/ASET_Seed_Resolution_0.3-alpha.1.md +++ b/docs/generated/en/ASET_Seed_Resolution_0.3-alpha.1.md @@ -4,7 +4,7 @@ **Status:** `MINIMAL_STRONG_CORE_ALPHA` -**Canonical model SHA-256:** `sha256:54c46e46d4e6b5870353bb0ed229310f60583e9acd11798b655bdd837c8dba74` +**Canonical model SHA-256:** `sha256:d8fde8f21b6524b2442151505f8bf4aec29e17be4a17d2409021ad594597b203` > This edition is derived from the machine canon. @@ -98,7 +98,7 @@ Predicate: `resolution_domain` ### `ASET-SEED-REQ-004` -An exact bound effect MUST be permitted if and only if the unique valid terminal ResolutionRecord is ALLOW. +An exact bound effect MUST be permitted if and only if the accepted authoritative terminal ResolutionRecord is ALLOW and no valid terminal conflict is observed. Modality: `MUST` @@ -108,7 +108,7 @@ Predicate: `allow_only` ### `ASET-SEED-REQ-005` -UNKNOWN and BLOCK MUST prohibit the effect. Missing or ambiguous valid terminal state, or failure to establish a valid terminal record, MUST resolve to UNKNOWN. Invalid or non-authoritative material MUST NOT override an otherwise unique valid terminal record. +UNKNOWN and BLOCK MUST prohibit the effect. Missing accepted terminal state, failure to establish an authoritative terminal record, or observation of additional conflicting valid terminal material MUST resolve to UNKNOWN. Invalid or non-authoritative material MUST NOT override an otherwise authoritative accepted terminal record. Modality: `MUST` @@ -148,11 +148,11 @@ Predicate: `inputs_non_authoritative` ### `ASET-SEED-REQ-009` -At most one valid terminal record MAY exist for one resolution_id; conflicting terminal records MUST fail closed as UNKNOWN. +Seed-owned state MUST accept at most one terminal record for one resolution_id. Observation of additional distinct valid terminal material for an already accepted terminal resolution MUST fail closed as UNKNOWN without replacing the accepted record. -Modality: `MAY` +Modality: `MUST` -Predicate: `terminal_unique` +Predicate: `accepted_terminal_unique` `verification`: `ASET-VERIFY-DECLARATIVE-STATE-VALIDATION`, `ASET-VERIFY-PORTABLE-CASES`, `ASET-VERIFY-BOUNDED-MODEL`, `ASET-VERIFY-INVARIANT-COVERAGE`, `ASET-VERIFY-SEMANTIC-MUTATIONS` @@ -189,39 +189,39 @@ Predicate: `implementation_neutral` ## Invariants - `SEED-INV-001` — Every valid derived resolution is UNKNOWN, ALLOW or BLOCK. -- `SEED-INV-002` — Effect permission is true if and only if the unique valid terminal record is ALLOW. +- `SEED-INV-002` — Effect permission is true if and only if the accepted authoritative terminal record is ALLOW and no valid terminal conflict is observed. - `SEED-INV-003` — UNKNOWN and BLOCK never permit an effect. - `SEED-INV-004` — Every request and terminal record preserves one exact binding digest. - `SEED-INV-005` — Every valid terminal record uses an Authority explicitly recognized for the exact local binding. - `SEED-INV-006` — Authority evidence is non-authoritative until exact-binding Authority recognition succeeds; opaque proof material cannot create or expand Authority by itself. - `SEED-INV-007` — External statements and evidence are outside Seed-owned canonical state unless accepted by a recognized Seed transition. -- `SEED-INV-008` — At most one valid terminal record exists for one resolution_id. -- `SEED-INV-009` — Conflicting valid terminal records yield UNKNOWN. Invalid or non-authoritative material cannot create ALLOW, create a conflict, or override an otherwise unique valid terminal record. +- `SEED-INV-008` — Seed-owned state accepts at most one terminal record for one resolution_id. +- `SEED-INV-009` — A conflict observation is valid only for a resolution_id that already has an accepted terminal record. Additional conflicting valid terminal material yields UNKNOWN; invalid or non-authoritative material cannot create ALLOW, create a conflict, or replace the accepted record. - `SEED-INV-010` — Resolution records are append-only, immutable and content-addressed. - `SEED-INV-011` — Only recognized Seed state transitions may change Seed-owned canonical state; environment observations and observer operations do not mutate that state. - `SEED-INV-012` — Reconsideration uses a fresh resolution_id linked by an immutable content-addressed commitment to a previously recognized terminal ResolutionRecord; predecessor object retention is not required. -## Transitions +## Operations -### `SEED-TX-001` — `REGISTER_REQUEST` +### `SEED-OP-001` — `REGISTER_REQUEST` - `payload_schema`: `seed/canonical/protocol/schemas/payload-register-request.schema.json` -- `authority_rule`: The initial Authority binding must be locally rooted and exactly match the request binding. +- `authority_rule`: The Authority must be explicitly recognized for the exact request binding. - `binding_rule`: The request contains one canonical exact binding and a fresh resolution_id. For reconsideration, previous_terminal_record_digest must be a recognized immutable terminal-record commitment; predecessor object presence in retained storage is not required. - `created_artifacts`: `ResolutionRequest` -### `SEED-TX-002` — `SUBMIT_RESOLUTION` +### `SEED-OP-002` — `SUBMIT_RESOLUTION` - `payload_schema`: `seed/canonical/protocol/schemas/payload-submit-resolution.schema.json` -- `authority_rule`: The record Authority must be explicitly recognized for the exact request binding. Concrete signatures, delegation chains and proof construction are external validation mechanisms. +- `authority_rule`: The Authority must be explicitly recognized for the exact request binding. Concrete signatures, credentials, delegation mechanisms and proof construction are external validation mechanisms. - `binding_rule`: The record request_digest and binding_digest must exactly match the registered request. - `created_artifacts`: `ResolutionRecord` -### `SEED-TX-003` — `EVALUATE_RESOLUTION` +### `SEED-OP-003` — `EVALUATE_RESOLUTION` - `payload_schema`: `seed/canonical/protocol/schemas/operation.schema.json` - `authority_rule`: Evaluation creates no Authority and accepts no external statement as a resolution. -- `binding_rule`: Evaluation observes one resolution_id without mutating Seed-owned state. It derives UNKNOWN when no unique valid terminal record is established; invalid or non-authoritative material cannot override a unique valid record. +- `binding_rule`: Evaluation observes one resolution_id without mutating Seed-owned state. It derives UNKNOWN when no authoritative accepted terminal result is established or when additional conflicting valid terminal material is observed; invalid or non-authoritative material cannot override an otherwise authoritative accepted terminal result. - `created_artifacts`: `ResolutionEvaluation` ## Implementation boundary diff --git a/docs/generated/pt-BR/ASET_Seed_Next.md b/docs/generated/pt-BR/ASET_Seed_Next.md index 1d6d520..9d904b3 100644 --- a/docs/generated/pt-BR/ASET_Seed_Next.md +++ b/docs/generated/pt-BR/ASET_Seed_Next.md @@ -4,7 +4,7 @@ **Status:** `MINIMAL_STRONG_CORE_ALPHA` -**SHA-256 do modelo canônico:** `sha256:54c46e46d4e6b5870353bb0ed229310f60583e9acd11798b655bdd837c8dba74` +**SHA-256 do modelo canônico:** `sha256:d8fde8f21b6524b2442151505f8bf4aec29e17be4a17d2409021ad594597b203` > Esta edição é derivada do cânone legível por máquina. @@ -98,7 +98,7 @@ Predicado: `resolution_domain` ### `ASET-SEED-REQ-004` -Um efeito exatamente vinculado DEVE ser permitido se, e somente se, o único ResolutionRecord terminal válido for ALLOW. +Um efeito exatamente vinculado DEVE ser permitido se, e somente se, o ResolutionRecord terminal autoritativo aceito for ALLOW e nenhum conflito terminal válido for observado. Modalidade: `MUST` @@ -108,7 +108,7 @@ Predicado: `allow_only` ### `ASET-SEED-REQ-005` -UNKNOWN e BLOCK DEVEM proibir o efeito. Estado terminal válido ausente ou ambíguo, ou falha em estabelecer um registro terminal válido, DEVE resultar em UNKNOWN. Material inválido ou não autoritativo NÃO DEVE substituir um registro terminal válido e único. +UNKNOWN e BLOCK DEVEM proibir o efeito. Estado terminal aceito ausente, falha em estabelecer um registro terminal autoritativo ou observação de material terminal válido conflitante adicional DEVE resultar em UNKNOWN. Material inválido ou não autoritativo NÃO DEVE substituir um registro terminal autoritativo já aceito. Modalidade: `MUST` @@ -148,11 +148,11 @@ Predicado: `inputs_non_authoritative` ### `ASET-SEED-REQ-009` -No máximo um registro terminal válido PODE existir para um resolution_id; registros terminais conflitantes DEVEM falhar de modo fechado como UNKNOWN. +O estado pertencente ao Seed DEVE aceitar no máximo um registro terminal para um resolution_id. A observação de material terminal válido distinto adicional para uma resolução terminal já aceita DEVE falhar de modo fechado como UNKNOWN sem substituir o registro aceito. -Modalidade: `MAY` +Modalidade: `MUST` -Predicado: `terminal_unique` +Predicado: `accepted_terminal_unique` `verification`: `ASET-VERIFY-DECLARATIVE-STATE-VALIDATION`, `ASET-VERIFY-PORTABLE-CASES`, `ASET-VERIFY-BOUNDED-MODEL`, `ASET-VERIFY-INVARIANT-COVERAGE`, `ASET-VERIFY-SEMANTIC-MUTATIONS` @@ -189,39 +189,39 @@ Predicado: `implementation_neutral` ## Invariantes - `SEED-INV-001` — Toda resolução derivada válida é UNKNOWN, ALLOW ou BLOCK. -- `SEED-INV-002` — A permissão do efeito é verdadeira se, e somente se, o único registro terminal válido for ALLOW. +- `SEED-INV-002` — A permissão de efeito é verdadeira se, e somente se, o registro terminal autoritativo aceito for ALLOW e nenhum conflito terminal válido for observado. - `SEED-INV-003` — UNKNOWN e BLOCK nunca permitem um efeito. - `SEED-INV-004` — Toda solicitação e registro terminal preservam um único digest exato de vinculação. - `SEED-INV-005` — Todo registro terminal válido usa uma Authority explicitamente reconhecida para a vinculação local exata. - `SEED-INV-006` — Evidência de Authority é não autoritativa até que o reconhecimento de Authority com vinculação exata seja bem-sucedido; material de prova opaco não pode criar ou ampliar Authority por si só. - `SEED-INV-007` — Declarações externas e Evidence ficam fora do estado canônico pertencente ao Seed, salvo quando aceitas por uma transição reconhecida do Seed. -- `SEED-INV-008` — Existe no máximo um registro terminal válido para um resolution_id. -- `SEED-INV-009` — Registros terminais válidos conflitantes resultam em UNKNOWN. Material inválido ou não autoritativo não pode criar ALLOW, criar conflito nem substituir um registro terminal válido e único. +- `SEED-INV-008` — O estado pertencente ao Seed aceita no máximo um registro terminal para um resolution_id. +- `SEED-INV-009` — Uma observação de conflito só é válida para um resolution_id que já possua um registro terminal aceito. Material terminal válido conflitante adicional resulta em UNKNOWN; material inválido ou não autoritativo não pode criar ALLOW, criar conflito nem substituir o registro aceito. - `SEED-INV-010` — Registros de resolução são append-only, imutáveis e endereçados por conteúdo. - `SEED-INV-011` — Somente transições de estado reconhecidas do Seed podem alterar o estado canônico pertencente ao Seed; observações do ambiente e operações de observador não alteram esse estado. - `SEED-INV-012` — A reconsideração usa um resolution_id novo vinculado por um compromisso imutável e endereçado por conteúdo a um ResolutionRecord terminal previamente reconhecido; a retenção do objeto predecessor não é obrigatória. -## Transições +## Operações -### `SEED-TX-001` — `REGISTER_REQUEST` +### `SEED-OP-001` — `REGISTER_REQUEST` - `payload_schema`: `seed/canonical/protocol/schemas/payload-register-request.schema.json` -- `authority_rule`: The initial Authority binding must be locally rooted and exactly match the request binding. +- `authority_rule`: The Authority must be explicitly recognized for the exact request binding. - `binding_rule`: The request contains one canonical exact binding and a fresh resolution_id. For reconsideration, previous_terminal_record_digest must be a recognized immutable terminal-record commitment; predecessor object presence in retained storage is not required. - `created_artifacts`: `ResolutionRequest` -### `SEED-TX-002` — `SUBMIT_RESOLUTION` +### `SEED-OP-002` — `SUBMIT_RESOLUTION` - `payload_schema`: `seed/canonical/protocol/schemas/payload-submit-resolution.schema.json` -- `authority_rule`: The record Authority must be explicitly recognized for the exact request binding. Concrete signatures, delegation chains and proof construction are external validation mechanisms. +- `authority_rule`: The Authority must be explicitly recognized for the exact request binding. Concrete signatures, credentials, delegation mechanisms and proof construction are external validation mechanisms. - `binding_rule`: The record request_digest and binding_digest must exactly match the registered request. - `created_artifacts`: `ResolutionRecord` -### `SEED-TX-003` — `EVALUATE_RESOLUTION` +### `SEED-OP-003` — `EVALUATE_RESOLUTION` - `payload_schema`: `seed/canonical/protocol/schemas/operation.schema.json` - `authority_rule`: Evaluation creates no Authority and accepts no external statement as a resolution. -- `binding_rule`: Evaluation observes one resolution_id without mutating Seed-owned state. It derives UNKNOWN when no unique valid terminal record is established; invalid or non-authoritative material cannot override a unique valid record. +- `binding_rule`: Evaluation observes one resolution_id without mutating Seed-owned state. It derives UNKNOWN when no authoritative accepted terminal result is established or when additional conflicting valid terminal material is observed; invalid or non-authoritative material cannot override an otherwise authoritative accepted terminal result. - `created_artifacts`: `ResolutionEvaluation` ## Limite da implementação diff --git a/docs/generated/pt-BR/ASET_Seed_Resolution_0.3-alpha.1.md b/docs/generated/pt-BR/ASET_Seed_Resolution_0.3-alpha.1.md index 1d6d520..9d904b3 100644 --- a/docs/generated/pt-BR/ASET_Seed_Resolution_0.3-alpha.1.md +++ b/docs/generated/pt-BR/ASET_Seed_Resolution_0.3-alpha.1.md @@ -4,7 +4,7 @@ **Status:** `MINIMAL_STRONG_CORE_ALPHA` -**SHA-256 do modelo canônico:** `sha256:54c46e46d4e6b5870353bb0ed229310f60583e9acd11798b655bdd837c8dba74` +**SHA-256 do modelo canônico:** `sha256:d8fde8f21b6524b2442151505f8bf4aec29e17be4a17d2409021ad594597b203` > Esta edição é derivada do cânone legível por máquina. @@ -98,7 +98,7 @@ Predicado: `resolution_domain` ### `ASET-SEED-REQ-004` -Um efeito exatamente vinculado DEVE ser permitido se, e somente se, o único ResolutionRecord terminal válido for ALLOW. +Um efeito exatamente vinculado DEVE ser permitido se, e somente se, o ResolutionRecord terminal autoritativo aceito for ALLOW e nenhum conflito terminal válido for observado. Modalidade: `MUST` @@ -108,7 +108,7 @@ Predicado: `allow_only` ### `ASET-SEED-REQ-005` -UNKNOWN e BLOCK DEVEM proibir o efeito. Estado terminal válido ausente ou ambíguo, ou falha em estabelecer um registro terminal válido, DEVE resultar em UNKNOWN. Material inválido ou não autoritativo NÃO DEVE substituir um registro terminal válido e único. +UNKNOWN e BLOCK DEVEM proibir o efeito. Estado terminal aceito ausente, falha em estabelecer um registro terminal autoritativo ou observação de material terminal válido conflitante adicional DEVE resultar em UNKNOWN. Material inválido ou não autoritativo NÃO DEVE substituir um registro terminal autoritativo já aceito. Modalidade: `MUST` @@ -148,11 +148,11 @@ Predicado: `inputs_non_authoritative` ### `ASET-SEED-REQ-009` -No máximo um registro terminal válido PODE existir para um resolution_id; registros terminais conflitantes DEVEM falhar de modo fechado como UNKNOWN. +O estado pertencente ao Seed DEVE aceitar no máximo um registro terminal para um resolution_id. A observação de material terminal válido distinto adicional para uma resolução terminal já aceita DEVE falhar de modo fechado como UNKNOWN sem substituir o registro aceito. -Modalidade: `MAY` +Modalidade: `MUST` -Predicado: `terminal_unique` +Predicado: `accepted_terminal_unique` `verification`: `ASET-VERIFY-DECLARATIVE-STATE-VALIDATION`, `ASET-VERIFY-PORTABLE-CASES`, `ASET-VERIFY-BOUNDED-MODEL`, `ASET-VERIFY-INVARIANT-COVERAGE`, `ASET-VERIFY-SEMANTIC-MUTATIONS` @@ -189,39 +189,39 @@ Predicado: `implementation_neutral` ## Invariantes - `SEED-INV-001` — Toda resolução derivada válida é UNKNOWN, ALLOW ou BLOCK. -- `SEED-INV-002` — A permissão do efeito é verdadeira se, e somente se, o único registro terminal válido for ALLOW. +- `SEED-INV-002` — A permissão de efeito é verdadeira se, e somente se, o registro terminal autoritativo aceito for ALLOW e nenhum conflito terminal válido for observado. - `SEED-INV-003` — UNKNOWN e BLOCK nunca permitem um efeito. - `SEED-INV-004` — Toda solicitação e registro terminal preservam um único digest exato de vinculação. - `SEED-INV-005` — Todo registro terminal válido usa uma Authority explicitamente reconhecida para a vinculação local exata. - `SEED-INV-006` — Evidência de Authority é não autoritativa até que o reconhecimento de Authority com vinculação exata seja bem-sucedido; material de prova opaco não pode criar ou ampliar Authority por si só. - `SEED-INV-007` — Declarações externas e Evidence ficam fora do estado canônico pertencente ao Seed, salvo quando aceitas por uma transição reconhecida do Seed. -- `SEED-INV-008` — Existe no máximo um registro terminal válido para um resolution_id. -- `SEED-INV-009` — Registros terminais válidos conflitantes resultam em UNKNOWN. Material inválido ou não autoritativo não pode criar ALLOW, criar conflito nem substituir um registro terminal válido e único. +- `SEED-INV-008` — O estado pertencente ao Seed aceita no máximo um registro terminal para um resolution_id. +- `SEED-INV-009` — Uma observação de conflito só é válida para um resolution_id que já possua um registro terminal aceito. Material terminal válido conflitante adicional resulta em UNKNOWN; material inválido ou não autoritativo não pode criar ALLOW, criar conflito nem substituir o registro aceito. - `SEED-INV-010` — Registros de resolução são append-only, imutáveis e endereçados por conteúdo. - `SEED-INV-011` — Somente transições de estado reconhecidas do Seed podem alterar o estado canônico pertencente ao Seed; observações do ambiente e operações de observador não alteram esse estado. - `SEED-INV-012` — A reconsideração usa um resolution_id novo vinculado por um compromisso imutável e endereçado por conteúdo a um ResolutionRecord terminal previamente reconhecido; a retenção do objeto predecessor não é obrigatória. -## Transições +## Operações -### `SEED-TX-001` — `REGISTER_REQUEST` +### `SEED-OP-001` — `REGISTER_REQUEST` - `payload_schema`: `seed/canonical/protocol/schemas/payload-register-request.schema.json` -- `authority_rule`: The initial Authority binding must be locally rooted and exactly match the request binding. +- `authority_rule`: The Authority must be explicitly recognized for the exact request binding. - `binding_rule`: The request contains one canonical exact binding and a fresh resolution_id. For reconsideration, previous_terminal_record_digest must be a recognized immutable terminal-record commitment; predecessor object presence in retained storage is not required. - `created_artifacts`: `ResolutionRequest` -### `SEED-TX-002` — `SUBMIT_RESOLUTION` +### `SEED-OP-002` — `SUBMIT_RESOLUTION` - `payload_schema`: `seed/canonical/protocol/schemas/payload-submit-resolution.schema.json` -- `authority_rule`: The record Authority must be explicitly recognized for the exact request binding. Concrete signatures, delegation chains and proof construction are external validation mechanisms. +- `authority_rule`: The Authority must be explicitly recognized for the exact request binding. Concrete signatures, credentials, delegation mechanisms and proof construction are external validation mechanisms. - `binding_rule`: The record request_digest and binding_digest must exactly match the registered request. - `created_artifacts`: `ResolutionRecord` -### `SEED-TX-003` — `EVALUATE_RESOLUTION` +### `SEED-OP-003` — `EVALUATE_RESOLUTION` - `payload_schema`: `seed/canonical/protocol/schemas/operation.schema.json` - `authority_rule`: Evaluation creates no Authority and accepts no external statement as a resolution. -- `binding_rule`: Evaluation observes one resolution_id without mutating Seed-owned state. It derives UNKNOWN when no unique valid terminal record is established; invalid or non-authoritative material cannot override a unique valid record. +- `binding_rule`: Evaluation observes one resolution_id without mutating Seed-owned state. It derives UNKNOWN when no authoritative accepted terminal result is established or when additional conflicting valid terminal material is observed; invalid or non-authoritative material cannot override an otherwise authoritative accepted terminal result. - `created_artifacts`: `ResolutionEvaluation` ## Limite da implementação diff --git a/docs/generated/ru/ASET_Seed_Next.md b/docs/generated/ru/ASET_Seed_Next.md index 958cbcb..78dcca3 100644 --- a/docs/generated/ru/ASET_Seed_Next.md +++ b/docs/generated/ru/ASET_Seed_Next.md @@ -4,7 +4,7 @@ **Статус:** `MINIMAL_STRONG_CORE_ALPHA` -**SHA-256 канонической модели:** `sha256:54c46e46d4e6b5870353bb0ed229310f60583e9acd11798b655bdd837c8dba74` +**SHA-256 канонической модели:** `sha256:d8fde8f21b6524b2442151505f8bf4aec29e17be4a17d2409021ad594597b203` > Эта редакция выводится из машинного канона. @@ -98,7 +98,7 @@ ResolutionBinding ДОЛЖЕН содержать точные context_id, state ### `ASET-SEED-REQ-004` -Точно связанный эффект ДОЛЖЕН быть разрешён тогда и только тогда, когда единственная действительная терминальная ResolutionRecord имеет значение ALLOW. +Точно связанный эффект ДОЛЖЕН быть разрешён тогда и только тогда, когда принятая авторитетная терминальная ResolutionRecord имеет значение ALLOW и не наблюдается действительный терминальный конфликт. Модальность: `MUST` @@ -108,7 +108,7 @@ ResolutionBinding ДОЛЖЕН содержать точные context_id, state ### `ASET-SEED-REQ-005` -UNKNOWN и BLOCK ДОЛЖНЫ запрещать эффект. Отсутствие или неоднозначность действительного терминального состояния либо невозможность установить действительную терминальную запись ДОЛЖНЫ давать UNKNOWN. Недействительный или неавторитетный материал НЕ ДОЛЖЕН переопределять уже установленную единственную действительную терминальную запись. +UNKNOWN и BLOCK ДОЛЖНЫ запрещать эффект. Отсутствие принятого терминального состояния, невозможность установить авторитетную терминальную запись либо наблюдение дополнительного конфликтующего действительного терминального материала ДОЛЖНЫ давать UNKNOWN. Недействительный или неавторитетный материал НЕ ДОЛЖЕН переопределять уже принятую авторитетную терминальную запись. Модальность: `MUST` @@ -148,11 +148,11 @@ Evidence, результаты проверки, выводы ИИ, резуль ### `ASET-SEED-REQ-009` -Для одного resolution_id МОЖЕТ существовать не более одной действительной терминальной записи; конфликтующие терминальные записи ДОЛЖНЫ давать fail-closed UNKNOWN. +Принадлежащее Seed состояние ДОЛЖНО принимать не более одной терминальной записи для одного resolution_id. Наблюдение дополнительного отличающегося действительного терминального материала для уже принятого терминального разрешения ДОЛЖНО давать fail-closed UNKNOWN без замены принятой записи. -Модальность: `MAY` +Модальность: `MUST` -Предикат: `terminal_unique` +Предикат: `accepted_terminal_unique` `verification`: `ASET-VERIFY-DECLARATIVE-STATE-VALIDATION`, `ASET-VERIFY-PORTABLE-CASES`, `ASET-VERIFY-BOUNDED-MODEL`, `ASET-VERIFY-INVARIANT-COVERAGE`, `ASET-VERIFY-SEMANTIC-MUTATIONS` @@ -189,39 +189,39 @@ Evidence, результаты проверки, выводы ИИ, резуль ## Инварианты - `SEED-INV-001` — Каждое допустимое производное разрешение принадлежит UNKNOWN, ALLOW или BLOCK. -- `SEED-INV-002` — Разрешение эффекта истинно тогда и только тогда, когда единственная действительная терминальная запись равна ALLOW. +- `SEED-INV-002` — Разрешение эффекта истинно тогда и только тогда, когда принятая авторитетная терминальная запись имеет значение ALLOW и не наблюдается действительный терминальный конфликт. - `SEED-INV-003` — UNKNOWN и BLOCK никогда не разрешают эффект. - `SEED-INV-004` — Каждый запрос и терминальная запись сохраняют один точный digest связки. - `SEED-INV-005` — Каждая действительная терминальная запись использует Authority, явно признанную для точной локальной связки. - `SEED-INV-006` — Доказательный материал Authority неавторитетен до успешного точного признания Authority; непрозрачный proof material не может сам по себе создать или расширить полномочие. - `SEED-INV-007` — Внешние утверждения и Evidence находятся вне принадлежащего Seed канонического состояния, пока не приняты признанным переходом Seed. -- `SEED-INV-008` — Для одного resolution_id существует не более одной действительной терминальной записи. -- `SEED-INV-009` — Конфликтующие действительные терминальные записи дают UNKNOWN. Недействительный или неавторитетный материал не может создать ALLOW, создать конфликт или переопределить единственную действительную терминальную запись. +- `SEED-INV-008` — Принадлежащее Seed состояние принимает не более одной терминальной записи для одного resolution_id. +- `SEED-INV-009` — Наблюдение конфликта допустимо только для resolution_id, у которого уже есть принятая терминальная запись. Дополнительный конфликтующий действительный терминальный материал даёт UNKNOWN; недействительный или неавторитетный материал не может создать ALLOW, создать конфликт или заменить принятую запись. - `SEED-INV-010` — Записи разрешения являются append-only, неизменяемыми и контентно-адресуемыми. - `SEED-INV-011` — Только признанные переходы состояния Seed могут изменять принадлежащее Seed каноническое состояние; наблюдения среды и observer-операции его не изменяют. - `SEED-INV-012` — Пересмотр использует свежий resolution_id, связанный неизменяемым контентно-адресуемым коммитментом с ранее признанной терминальной ResolutionRecord; хранение объекта-предшественника не требуется. -## Переходы +## Операции -### `SEED-TX-001` — `REGISTER_REQUEST` +### `SEED-OP-001` — `REGISTER_REQUEST` - `payload_schema`: `seed/canonical/protocol/schemas/payload-register-request.schema.json` -- `authority_rule`: The initial Authority binding must be locally rooted and exactly match the request binding. +- `authority_rule`: The Authority must be explicitly recognized for the exact request binding. - `binding_rule`: The request contains one canonical exact binding and a fresh resolution_id. For reconsideration, previous_terminal_record_digest must be a recognized immutable terminal-record commitment; predecessor object presence in retained storage is not required. - `created_artifacts`: `ResolutionRequest` -### `SEED-TX-002` — `SUBMIT_RESOLUTION` +### `SEED-OP-002` — `SUBMIT_RESOLUTION` - `payload_schema`: `seed/canonical/protocol/schemas/payload-submit-resolution.schema.json` -- `authority_rule`: The record Authority must be explicitly recognized for the exact request binding. Concrete signatures, delegation chains and proof construction are external validation mechanisms. +- `authority_rule`: The Authority must be explicitly recognized for the exact request binding. Concrete signatures, credentials, delegation mechanisms and proof construction are external validation mechanisms. - `binding_rule`: The record request_digest and binding_digest must exactly match the registered request. - `created_artifacts`: `ResolutionRecord` -### `SEED-TX-003` — `EVALUATE_RESOLUTION` +### `SEED-OP-003` — `EVALUATE_RESOLUTION` - `payload_schema`: `seed/canonical/protocol/schemas/operation.schema.json` - `authority_rule`: Evaluation creates no Authority and accepts no external statement as a resolution. -- `binding_rule`: Evaluation observes one resolution_id without mutating Seed-owned state. It derives UNKNOWN when no unique valid terminal record is established; invalid or non-authoritative material cannot override a unique valid record. +- `binding_rule`: Evaluation observes one resolution_id without mutating Seed-owned state. It derives UNKNOWN when no authoritative accepted terminal result is established or when additional conflicting valid terminal material is observed; invalid or non-authoritative material cannot override an otherwise authoritative accepted terminal result. - `created_artifacts`: `ResolutionEvaluation` ## Граница реализации diff --git a/docs/generated/ru/ASET_Seed_Resolution_0.3-alpha.1.md b/docs/generated/ru/ASET_Seed_Resolution_0.3-alpha.1.md index 958cbcb..78dcca3 100644 --- a/docs/generated/ru/ASET_Seed_Resolution_0.3-alpha.1.md +++ b/docs/generated/ru/ASET_Seed_Resolution_0.3-alpha.1.md @@ -4,7 +4,7 @@ **Статус:** `MINIMAL_STRONG_CORE_ALPHA` -**SHA-256 канонической модели:** `sha256:54c46e46d4e6b5870353bb0ed229310f60583e9acd11798b655bdd837c8dba74` +**SHA-256 канонической модели:** `sha256:d8fde8f21b6524b2442151505f8bf4aec29e17be4a17d2409021ad594597b203` > Эта редакция выводится из машинного канона. @@ -98,7 +98,7 @@ ResolutionBinding ДОЛЖЕН содержать точные context_id, state ### `ASET-SEED-REQ-004` -Точно связанный эффект ДОЛЖЕН быть разрешён тогда и только тогда, когда единственная действительная терминальная ResolutionRecord имеет значение ALLOW. +Точно связанный эффект ДОЛЖЕН быть разрешён тогда и только тогда, когда принятая авторитетная терминальная ResolutionRecord имеет значение ALLOW и не наблюдается действительный терминальный конфликт. Модальность: `MUST` @@ -108,7 +108,7 @@ ResolutionBinding ДОЛЖЕН содержать точные context_id, state ### `ASET-SEED-REQ-005` -UNKNOWN и BLOCK ДОЛЖНЫ запрещать эффект. Отсутствие или неоднозначность действительного терминального состояния либо невозможность установить действительную терминальную запись ДОЛЖНЫ давать UNKNOWN. Недействительный или неавторитетный материал НЕ ДОЛЖЕН переопределять уже установленную единственную действительную терминальную запись. +UNKNOWN и BLOCK ДОЛЖНЫ запрещать эффект. Отсутствие принятого терминального состояния, невозможность установить авторитетную терминальную запись либо наблюдение дополнительного конфликтующего действительного терминального материала ДОЛЖНЫ давать UNKNOWN. Недействительный или неавторитетный материал НЕ ДОЛЖЕН переопределять уже принятую авторитетную терминальную запись. Модальность: `MUST` @@ -148,11 +148,11 @@ Evidence, результаты проверки, выводы ИИ, резуль ### `ASET-SEED-REQ-009` -Для одного resolution_id МОЖЕТ существовать не более одной действительной терминальной записи; конфликтующие терминальные записи ДОЛЖНЫ давать fail-closed UNKNOWN. +Принадлежащее Seed состояние ДОЛЖНО принимать не более одной терминальной записи для одного resolution_id. Наблюдение дополнительного отличающегося действительного терминального материала для уже принятого терминального разрешения ДОЛЖНО давать fail-closed UNKNOWN без замены принятой записи. -Модальность: `MAY` +Модальность: `MUST` -Предикат: `terminal_unique` +Предикат: `accepted_terminal_unique` `verification`: `ASET-VERIFY-DECLARATIVE-STATE-VALIDATION`, `ASET-VERIFY-PORTABLE-CASES`, `ASET-VERIFY-BOUNDED-MODEL`, `ASET-VERIFY-INVARIANT-COVERAGE`, `ASET-VERIFY-SEMANTIC-MUTATIONS` @@ -189,39 +189,39 @@ Evidence, результаты проверки, выводы ИИ, резуль ## Инварианты - `SEED-INV-001` — Каждое допустимое производное разрешение принадлежит UNKNOWN, ALLOW или BLOCK. -- `SEED-INV-002` — Разрешение эффекта истинно тогда и только тогда, когда единственная действительная терминальная запись равна ALLOW. +- `SEED-INV-002` — Разрешение эффекта истинно тогда и только тогда, когда принятая авторитетная терминальная запись имеет значение ALLOW и не наблюдается действительный терминальный конфликт. - `SEED-INV-003` — UNKNOWN и BLOCK никогда не разрешают эффект. - `SEED-INV-004` — Каждый запрос и терминальная запись сохраняют один точный digest связки. - `SEED-INV-005` — Каждая действительная терминальная запись использует Authority, явно признанную для точной локальной связки. - `SEED-INV-006` — Доказательный материал Authority неавторитетен до успешного точного признания Authority; непрозрачный proof material не может сам по себе создать или расширить полномочие. - `SEED-INV-007` — Внешние утверждения и Evidence находятся вне принадлежащего Seed канонического состояния, пока не приняты признанным переходом Seed. -- `SEED-INV-008` — Для одного resolution_id существует не более одной действительной терминальной записи. -- `SEED-INV-009` — Конфликтующие действительные терминальные записи дают UNKNOWN. Недействительный или неавторитетный материал не может создать ALLOW, создать конфликт или переопределить единственную действительную терминальную запись. +- `SEED-INV-008` — Принадлежащее Seed состояние принимает не более одной терминальной записи для одного resolution_id. +- `SEED-INV-009` — Наблюдение конфликта допустимо только для resolution_id, у которого уже есть принятая терминальная запись. Дополнительный конфликтующий действительный терминальный материал даёт UNKNOWN; недействительный или неавторитетный материал не может создать ALLOW, создать конфликт или заменить принятую запись. - `SEED-INV-010` — Записи разрешения являются append-only, неизменяемыми и контентно-адресуемыми. - `SEED-INV-011` — Только признанные переходы состояния Seed могут изменять принадлежащее Seed каноническое состояние; наблюдения среды и observer-операции его не изменяют. - `SEED-INV-012` — Пересмотр использует свежий resolution_id, связанный неизменяемым контентно-адресуемым коммитментом с ранее признанной терминальной ResolutionRecord; хранение объекта-предшественника не требуется. -## Переходы +## Операции -### `SEED-TX-001` — `REGISTER_REQUEST` +### `SEED-OP-001` — `REGISTER_REQUEST` - `payload_schema`: `seed/canonical/protocol/schemas/payload-register-request.schema.json` -- `authority_rule`: The initial Authority binding must be locally rooted and exactly match the request binding. +- `authority_rule`: The Authority must be explicitly recognized for the exact request binding. - `binding_rule`: The request contains one canonical exact binding and a fresh resolution_id. For reconsideration, previous_terminal_record_digest must be a recognized immutable terminal-record commitment; predecessor object presence in retained storage is not required. - `created_artifacts`: `ResolutionRequest` -### `SEED-TX-002` — `SUBMIT_RESOLUTION` +### `SEED-OP-002` — `SUBMIT_RESOLUTION` - `payload_schema`: `seed/canonical/protocol/schemas/payload-submit-resolution.schema.json` -- `authority_rule`: The record Authority must be explicitly recognized for the exact request binding. Concrete signatures, delegation chains and proof construction are external validation mechanisms. +- `authority_rule`: The Authority must be explicitly recognized for the exact request binding. Concrete signatures, credentials, delegation mechanisms and proof construction are external validation mechanisms. - `binding_rule`: The record request_digest and binding_digest must exactly match the registered request. - `created_artifacts`: `ResolutionRecord` -### `SEED-TX-003` — `EVALUATE_RESOLUTION` +### `SEED-OP-003` — `EVALUATE_RESOLUTION` - `payload_schema`: `seed/canonical/protocol/schemas/operation.schema.json` - `authority_rule`: Evaluation creates no Authority and accepts no external statement as a resolution. -- `binding_rule`: Evaluation observes one resolution_id without mutating Seed-owned state. It derives UNKNOWN when no unique valid terminal record is established; invalid or non-authoritative material cannot override a unique valid record. +- `binding_rule`: Evaluation observes one resolution_id without mutating Seed-owned state. It derives UNKNOWN when no authoritative accepted terminal result is established or when additional conflicting valid terminal material is observed; invalid or non-authoritative material cannot override an otherwise authoritative accepted terminal result. - `created_artifacts`: `ResolutionEvaluation` ## Граница реализации diff --git a/docs/repository/BLACK_BOX_AUDIT_METHOD.md b/docs/repository/BLACK_BOX_AUDIT_METHOD.md index 4b63ee1..f750ed4 100644 --- a/docs/repository/BLACK_BOX_AUDIT_METHOD.md +++ b/docs/repository/BLACK_BOX_AUDIT_METHOD.md @@ -1,19 +1,52 @@ # Black-box audit method -The final `Check` step of every PDCA cycle evaluates only the deterministic repository snapshot and the public runtime interface. It does not trust internal pass records or import the repository validator. - -## Documentation black-box boundary - -The snapshot auditor performs 28 independent checks: archive safety and CRC; exact manifest scope and hashes; license and citation; claim boundaries; mandatory gates and findings; frozen and expanded rc11 byte identity; requirements, traceability and conformance inventories; strict JSON; Python syntax; generated multilingual parity; migration completeness; required documents and local links; terminology and secret scanning; workflows; Git byte preservation; rc12 canon counts; canonical/runtime schema identity; installable runtime presence; bounded-profile exclusions; formal projection; absence of implicit effect adapters; residual limitations; and complete production-gate registration. - -## Runtime black-box boundary - -The runtime auditor extracts the built snapshot and uses only `python -m aset_seed`. It verifies durable initialization, fail-closed invalid proof handling, accepted signed transition commit, replay idempotency, process-reopen validation, database and audit health, consistent semantic backup, exact-content HMAC binding, invalid identifier handling, corrupt-state isolation, and audit-tampering detection. - -## Adversarial step - -The mutation harness rebuilds a valid manifest after each malicious change. It must still reject removal or drift of required documents, generated editions, frozen rc11 bytes, Git byte policy, migration coverage, runtime files, protocol schemas, formal model, limitation records and release gates; it also rejects a secret marker, readiness overclaim, open blocking finding, and implicit network/effect import. - -Any failed mandatory check forms a finding for the next PDCA cycle. A cycle may close only with zero failed black-box checks and zero open blocking findings. - -The final documentation audit also verifies that technical freeze readiness is explicit while owner approval and exact-byte freeze remain pending. +The active black-box audit evaluates the exact repository snapshot from public +repository artifacts and deterministic commands. It does not treat historical +runtime evidence as controlling evidence for Seed 0.3. + +## Active documentation boundary + +`tools/blackbox_documentation_audit.py` checks the curated active documentation +surface, generated multilingual Seed editions, language navigation, the active +audit classification, implementation-neutrality claims, and prohibited legacy +runtime/readiness claims. Every file under `audit/` must be classified as +active, historical, or explicitly excluded by `ACTIVE_AUDIT_INDEX.json`. + +The method document itself is part of the active documentation surface so that +the description of the gate cannot silently diverge from the gate. + +## Canon and assurance boundary + +The repository release gate independently requires: + +- deterministic repository-view parity; +- machine-canon and canon-package validation; +- exhaustive finite-state saturation for the published finite fixture; +- semantic mutation closure; +- requirement/invariant/operation coverage; +- assurance and proof traceability; +- standalone canon-to-TLA projection parity; +- TLC model checking; +- TLAPS safety proofs; +- TLAPS canon-to-TLA behavioral-equivalence proof; +- specification tests, lint/sanity checks, archive construction and manifest + parity. + +These checks establish consistency and the declared safety properties of the +exact candidate snapshot. They do not establish implementation production +readiness, cryptographic security, factual truth of external evidence, or +correctness of mechanisms intentionally outside the Seed boundary. + +## Historical evidence + +RC11/RC12 runtime, SQLite, HMAC, permit, outcome, membership and related audit +records are preserved as historical evidence. They are non-controlling for the +active Seed 0.3 minimal resolution-recognition semantics unless explicitly +listed as active by `ACTIVE_AUDIT_INDEX.json`. + +## Failure rule + +Any mandatory failing gate or unclassified active audit artifact is a blocking +finding for the candidate snapshot. A candidate may be treated as release-gate +closed only when the aggregate repository release gate passes for that exact +snapshot. diff --git a/docs/repository/CI_ASSURANCE.md b/docs/repository/CI_ASSURANCE.md index c7a856c..2dcdfe7 100644 --- a/docs/repository/CI_ASSURANCE.md +++ b/docs/repository/CI_ASSURANCE.md @@ -86,7 +86,7 @@ The canon-to-TLA theorem is scoped to the declared abstraction profile. It does - equivalence of every natural-language sentence; - concrete Binding/digest construction; -- concrete Authority-recognition evidence, signature or delegation-chain construction; +- concrete Authority-recognition evidence, signature or delegation-mechanism construction; - implementation refinement or production readiness; - liveness; - cryptographic primitive security; diff --git a/seed/canonical/CANON_PACKAGE.json b/seed/canonical/CANON_PACKAGE.json index 54cb356..f28fc64 100644 --- a/seed/canonical/CANON_PACKAGE.json +++ b/seed/canonical/CANON_PACKAGE.json @@ -6,11 +6,11 @@ "files": [ { "path": "seed/canonical/source/seed-model.json", - "sha256": "sha256:c43ca7b642a11c3ab140884a6bbff34bbd741f5cb905e6a779c860c813998fcf" + "sha256": "sha256:1fed5dc95045a287b3e9b8b4ea011a7b977729158f3360ed9a8a7e7e6ba1b4b0" }, { "path": "seed/canonical/schemas/seed-model.schema.json", - "sha256": "sha256:1f1a727764b5d0138951f76fac1ab1155f4ba67c92f21aa8a21f7ef105bf9f94" + "sha256": "sha256:d454d6bc54aa8247ed35ab64d56c8702ba889243bb81f600a8edfbd9ee4fda89" }, { "path": "seed/canonical/protocol/protocol-profile.json", @@ -26,7 +26,7 @@ }, { "path": "seed/canonical/conformance/conformance-profile.json", - "sha256": "sha256:aabbf317e0c51a1a1f1021dfbd0b2981c3dcf1142b89eb6a1bbfb1c7e1e9dcd6" + "sha256": "sha256:8b5aaa3b5890315f001ee68257c9a316d1523000db26ddd9b112fd16456f2cf4" }, { "path": "seed/canonical/schemas/conformance-profile.schema.json", @@ -46,23 +46,23 @@ }, { "path": "seed/canonical/conformance/model-based-conformance.json", - "sha256": "sha256:db4b3f9e76aff7e8ef3a87f02ae748bb4f718428370306454eb94b9dcc6212b4" + "sha256": "sha256:5cae29741da3488563cf026a04c9918d26d48fcd58db65607c25beb8c8705c08" }, { "path": "seed/canonical/assurance/verification-registry.json", - "sha256": "sha256:b4bb28e5a8965e984013ad7408522749cfef3008c913a518f455fefda7136187" + "sha256": "sha256:cc5f2c5b4ce0c9e466bb63779c1199817859e4d65d6df204acfaa3619b1f819c" }, { "path": "seed/canonical/assurance/invariant-coverage.json", - "sha256": "sha256:2d89e21d092bf4d340e271dc3bcba2d7df618c4c4b41e67beb626f518cdb163b" + "sha256": "sha256:0ffed8e2b1351928d9921c96bab4d8225504cf77e7298a0c8a603b66ac71e2c7" }, { "path": "seed/canonical/schemas/invariant-coverage.schema.json", - "sha256": "sha256:e7ec1a6577df2519ca49f8c682588d68d767f9d28ab3301a6280221100ddc5b3" + "sha256": "sha256:9831e12343697216eac28a82b29baeb160a360e4e0126fcb356d904227b69ded" }, { "path": "seed/canonical/assurance/proof-traceability.json", - "sha256": "sha256:043bb3b1717d0c41123d326dc9b1d8dcae1cdde78c7ebf2d2ae26e79d2248eaf" + "sha256": "sha256:eaa97bb7aa9b09554ef4b1624dacac219a8a6ee24fdb8809cf203d1badffb0a2" }, { "path": "seed/canonical/schemas/proof-traceability.schema.json", @@ -70,11 +70,11 @@ }, { "path": "seed/canonical/assurance/canon-tla-refinement.json", - "sha256": "sha256:2095b62595d056c8a5a3b0700239a0211417979e4d5f2b4a535df0827017371b" + "sha256": "sha256:22884e71f1a484a8a7b00f708188191783505a71d1b2d15ad73cca67510099a5" }, { "path": "seed/canonical/schemas/canon-tla-refinement.schema.json", - "sha256": "sha256:17b142a998bbc8dd7b82b61c54d75e0c0e735211f35f90312565b78a4e7758e5" + "sha256": "sha256:ccd44d46cd3e9075fd439ead6a08cf3685d62bdea7f76d7ab2a736b579706069" }, { "path": "seed/canonical/assurance/limitations.json", @@ -98,23 +98,23 @@ }, { "path": "seed/canonical/formal/SeedResolution.tla", - "sha256": "sha256:1c53b058d738e074c2a9de96fe27d8d7dd384d3ffa52f3bb95f7732908d66276" + "sha256": "sha256:1c0ebb27ed52da289f0981dcb11b61b6a7fc5c4a030ba434ae0b1d53b286b926" }, { "path": "seed/canonical/formal/SeedResolutionProofs.tla", - "sha256": "sha256:bcb4652249d66cbcb16f7c5a4538ad3bc2c31ef7d37b49fd27328eff6a6725f9" + "sha256": "sha256:3d6bdada8c1c0f93c247eb5c5b4df895e793c174768270138f2d6e6176990ad7" }, { "path": "seed/canonical/formal/SeedCanonProjection.tla", - "sha256": "sha256:b7265eb707795b592c678842f764a5bfa7ce303bdc66f55f858366e20d64eb4e" + "sha256": "sha256:b3bf0555abba2fc9e817d1c3e97b93d62af933edfb9c7f5e7eec4502445447f5" }, { "path": "seed/canonical/formal/SeedCanonRefinementProofs.tla", - "sha256": "sha256:46ef7336b86d066ee531eb2c43873d9b6e1622dd48632b9af08ea6f412cf6338" + "sha256": "sha256:522338cc774f1f473d20130630e01aec6b66a2ac971ffed113b8a91d654b72ad" }, { "path": "seed/canonical/formal/SeedResolution.cfg", - "sha256": "sha256:b4ee7fb775fbf8909fded4e7b2086b8022e1412e648e21f470c464a625f690c0" + "sha256": "sha256:bee70a11c1bde1e0b7aaa0acefbe5a4137bdcd5c3fbea254a3d8a1999086f1b7" }, { "path": "seed/canonical/migration/ALPHA2_TO_0.3_ALPHA1_CHANGE_DECLARATION.json", @@ -140,9 +140,13 @@ "path": "seed/canonical/decisions/ADR-009-seed-state-environment-observer-and-authority-boundary.md", "sha256": "sha256:fdb642c8f306d2136345e19c3650c22805f63139ac93d8f81f6773aa249881a0" }, + { + "path": "seed/canonical/decisions/ADR-010-unify-authority-conflict-and-operation-semantics.md", + "sha256": "sha256:e9757a2879f7e6ce6c9b087212dbcc4cf2c74085f6b1e09be5fdfd4a7b236078" + }, { "path": "seed/canonical/migration/CANON_CHANGE_DECLARATION.json", - "sha256": "sha256:4eb176ddb006c0957a2bf1d79685fd86b263b89500cc53df919193ec91459bf8" + "sha256": "sha256:2bc5d60abed02040dd41c79db86aa23cbf206bf81df8193f771ceb9b8a29541c" }, { "path": "seed/canonical/migration/WIRE_V2_TO_V3.md", @@ -270,7 +274,7 @@ }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-004.json", - "sha256": "sha256:dcf5f81b0e60f2aa0c157aab5297177d3f082544d64a54081d83e9d7d6093763" + "sha256": "sha256:b7407ed453ab3dd20d36ab3dd540d7c9c0c002df8821c40455b181b425093eef" }, { "path": "seed/canonical/conformance/cases/positive/RES-POS-005.json", @@ -295,6 +299,6 @@ ], "implementation_precedence": "NONE", "normative_source": "seed/canonical/source/seed-model.json", - "package_digest": "sha256:392ff8e36eecb2bf6cfa9a6cbc76117025a4c7d8a170e8ddf562f1ea5df27d38", + "package_digest": "sha256:0e1518c4ff6bd6b0da71089bfe5e1a9802929016c8ec2547024a1a0e2b84a19d", "schema_version": 2 } diff --git a/seed/canonical/README.md b/seed/canonical/README.md index cca6a99..3df3f2e 100644 --- a/seed/canonical/README.md +++ b/seed/canonical/README.md @@ -5,11 +5,12 @@ ASET Seed is a local resolution-recognition kernel. Resolution = UNKNOWN | ALLOW | BLOCK EffectPermitted(r) iff ResolutionOf(r) = ALLOW -A valid terminal `ALLOW` or `BLOCK` is immutable and exact-binding. `UNKNOWN` -is derived when no unique valid terminal record can be established or when -valid terminal material conflicts. Invalid or non-authoritative material cannot -create Authority, create `ALLOW`, create a valid conflict, or override an -otherwise unique valid terminal record. +An accepted terminal `ALLOW` or `BLOCK` is immutable and exact-binding. +`UNKNOWN` is derived when no authoritative accepted terminal record is +established or when additional distinct valid terminal material conflicts with +an accepted terminal resolution. Invalid or non-authoritative material cannot +create Authority, create `ALLOW`, create a valid conflict, or replace an +accepted authoritative terminal record. Seed normatively defines: @@ -17,7 +18,7 @@ Seed normatively defines: - fresh request identity and reconsideration commitment; - exact-binding local Authority recognition as an admission boundary; - immutable content-addressed terminal records; -- terminal uniqueness and fail-closed evaluation; +- accepted-terminal uniqueness, conflict soundness and fail-closed evaluation; - implementation-neutral observable semantics. Concrete policy evaluation, evidence acquisition, signatures, delegation-chain @@ -41,7 +42,7 @@ conflict observation cannot mutate Seed-owned state. The active assurance surface contains: - 12 canonical requirements and 12 canonical invariants; -- 3 canonical operations: two state transitions and one observer; +- 3 canonical operations (`SEED-OP-001..003`): two state transitions and one observer; - 25 portable conformance cases; - 13 semantic mutations; - 14 TLA/TLC properties: 10 state invariants and 4 temporal properties; diff --git a/seed/canonical/assurance/canon-tla-refinement.json b/seed/canonical/assurance/canon-tla-refinement.json index d5df439..6a0fa3a 100644 --- a/seed/canonical/assurance/canon-tla-refinement.json +++ b/seed/canonical/assurance/canon-tla-refinement.json @@ -5,7 +5,7 @@ "id": "OPAQUE_BINDING" }, { - "description": "RequestAuthorityBindings and TerminalAuthorityBindings represent already-recognized exact-binding Authority facts. Concrete signatures, delegation chains, federation proof material and their validation are external to Seed.", + "description": "RecognizedAuthorityBindings represents already-recognized exact-binding Authority facts shared by request registration and terminal submission. Concrete signatures, credentials, delegation mechanisms, federation proof material and their validation are external to Seed.", "id": "AUTHORITY_RECOGNITION_BOUNDARY" }, { @@ -13,11 +13,11 @@ "id": "TERMINAL_COMMITMENT_ORACLE" }, { - "description": "Conflict is modeled separately from Seed-owned state because an independently established conflicting valid terminal record changes the derived resolution while not mutating accepted request or terminal state.", + "description": "Conflict is environment state and may be observed only for a resolution_id with an already accepted terminal record; additional distinct valid terminal material changes the derived resolution to UNKNOWN without mutating accepted Seed state.", "id": "ENVIRONMENT_CONFLICT_STATE" } ], - "claim_boundary": "The proof establishes behavioral equivalence between SeedResolution.tla and a standalone TLA+ projection generated from the exact machine-readable Seed model under ASET-SEED-CANON-TLA-PROJECTION-V4. The generated projection does not import or extend SeedResolution; the proof explicitly instantiates the independent projection onto the target state. Opaque Binding construction, concrete Authority-recognition evidence, terminal-commitment provenance, cryptographic primitives, implementation refinement, liveness and natural-language completeness remain outside this proof boundary. The deterministic generator remains part of the assurance trusted computing base.", + "claim_boundary": "The proof establishes behavioral equivalence between SeedResolution.tla and a standalone TLA+ projection generated from the exact machine-readable Seed model under ASET-SEED-CANON-TLA-PROJECTION-V5. The generated projection does not import or extend SeedResolution; the proof explicitly instantiates the independent projection onto the target state. Opaque Binding construction, concrete Authority-recognition evidence, terminal-commitment provenance, cryptographic primitives, implementation refinement, liveness and natural-language completeness remain outside this proof boundary. The deterministic generator remains part of the assurance trusted computing base.", "document_type": "aset-canon-tla-refinement", "excluded_claims": [ "natural-language-text equivalence", @@ -33,7 +33,7 @@ "generator": "tools/generate_canon_tla_projection.py", "module": "SeedCanonProjection", "path": "seed/canonical/formal/SeedCanonProjection.tla", - "profile": "ASET-SEED-CANON-TLA-PROJECTION-V4" + "profile": "ASET-SEED-CANON-TLA-PROJECTION-V5" }, "invariant_coverage": [ { @@ -85,6 +85,26 @@ "status": "PARTIAL_TERMINAL_COMMITMENT_ABSTRACTION" } ], + "operation_coverage": [ + { + "id": "SEED-OP-001", + "kind": "REGISTER_REQUEST", + "status": "PROVED_IN_DECLARED_PROJECTION", + "tla_action": "RegisterRequest" + }, + { + "id": "SEED-OP-002", + "kind": "SUBMIT_RESOLUTION", + "status": "PROVED_IN_DECLARED_PROJECTION", + "tla_action": "SubmitResolution" + }, + { + "id": "SEED-OP-003", + "kind": "EVALUATE_RESOLUTION", + "status": "OBSERVER_EQUIVALENCE_PROVED", + "tla_action": "EvaluateResolution" + } + ], "proof": { "final_theorem": "SeedResolutionBehaviorallyEquivalentToCanonProjection", "module": "seed/canonical/formal/SeedCanonRefinementProofs.tla", @@ -134,7 +154,7 @@ }, { "id": "ASET-SEED-REQ-009", - "predicate": "terminal_unique", + "predicate": "accepted_terminal_unique", "status": "PROVED_IN_DECLARED_PROJECTION" }, { @@ -167,32 +187,12 @@ "source_model": { "model_id": "ASET-SEED-RESOLUTION-CANON-0.3-ALPHA1", "path": "seed/canonical/source/seed-model.json", - "sha256": "sha256:c43ca7b642a11c3ab140884a6bbff34bbd741f5cb905e6a779c860c813998fcf", + "sha256": "sha256:1fed5dc95045a287b3e9b8b4ea011a7b977729158f3360ed9a8a7e7e6ba1b4b0", "version": "0.3.0-alpha.1" }, "target_model": { "module": "SeedResolution", "path": "seed/canonical/formal/SeedResolution.tla", - "sha256": "sha256:1c53b058d738e074c2a9de96fe27d8d7dd384d3ffa52f3bb95f7732908d66276" - }, - "transition_coverage": [ - { - "id": "SEED-TX-001", - "kind": "REGISTER_REQUEST", - "status": "PROVED_IN_DECLARED_PROJECTION", - "tla_action": "RegisterRequest" - }, - { - "id": "SEED-TX-002", - "kind": "SUBMIT_RESOLUTION", - "status": "PROVED_IN_DECLARED_PROJECTION", - "tla_action": "SubmitResolution" - }, - { - "id": "SEED-TX-003", - "kind": "EVALUATE_RESOLUTION", - "status": "OBSERVER_EQUIVALENCE_PROVED", - "tla_action": "EvaluateResolution" - } - ] + "sha256": "sha256:1c0ebb27ed52da289f0981dcb11b61b6a7fc5c4a030ba434ae0b1d53b286b926" + } } diff --git a/seed/canonical/assurance/invariant-coverage.json b/seed/canonical/assurance/invariant-coverage.json index ac3dc5d..6113c9a 100644 --- a/seed/canonical/assurance/invariant-coverage.json +++ b/seed/canonical/assurance/invariant-coverage.json @@ -23,10 +23,10 @@ "conformance_case_required": true, "formal_property_required": true, "invariants_complete": true, + "operations_complete": true, "orphan_evidence_forbidden": true, "requirements_complete": true, - "semantic_mutation_required": true, - "transitions_complete": true + "semantic_mutation_required": true }, "document_type": "aset-seed-invariant-coverage", "invariants": [ @@ -140,7 +140,7 @@ "RES-NEG-015" ], "formal_properties": [ - "TerminalUnique" + "AcceptedTerminalUnique" ], "id": "SEED-INV-008", "semantic_mutations": [ @@ -156,7 +156,7 @@ ], "formal_properties": [ "FailClosed", - "ConflictUnknown", + "ConflictSound", "ExternalMaterialNonAuthoritative" ], "id": "SEED-INV-009", @@ -392,6 +392,54 @@ } ], "normative": true, + "operations": [ + { + "id": "SEED-OP-001", + "negative_cases": [ + "RES-NEG-001", + "RES-NEG-002", + "RES-NEG-003", + "RES-NEG-004", + "RES-NEG-011", + "RES-NEG-012", + "RES-NEG-013" + ], + "positive_cases": [ + "RES-POS-001", + "RES-POS-008" + ] + }, + { + "id": "SEED-OP-002", + "negative_cases": [ + "RES-NEG-005", + "RES-NEG-006", + "RES-NEG-007", + "RES-NEG-008", + "RES-NEG-009", + "RES-NEG-010", + "RES-NEG-016" + ], + "positive_cases": [ + "RES-POS-002", + "RES-POS-003", + "RES-POS-004", + "RES-POS-005", + "RES-POS-007" + ] + }, + { + "id": "SEED-OP-003", + "negative_cases": [ + "RES-NEG-014", + "RES-NEG-015" + ], + "positive_cases": [ + "RES-POS-006", + "RES-POS-009" + ] + } + ], "requirements": [ { "conformance_cases": [ @@ -474,7 +522,7 @@ ], "formal_properties": [ "FailClosed", - "ConflictUnknown" + "ConflictSound" ], "id": "ASET-SEED-REQ-005", "invariants": [ @@ -547,8 +595,8 @@ "RES-NEG-015" ], "formal_properties": [ - "TerminalUnique", - "ConflictUnknown" + "AcceptedTerminalUnique", + "ConflictSound" ], "id": "ASET-SEED-REQ-009", "invariants": [ @@ -610,53 +658,5 @@ ] } ], - "schema_version": 1, - "transitions": [ - { - "id": "SEED-TX-001", - "negative_cases": [ - "RES-NEG-001", - "RES-NEG-002", - "RES-NEG-003", - "RES-NEG-004", - "RES-NEG-011", - "RES-NEG-012", - "RES-NEG-013" - ], - "positive_cases": [ - "RES-POS-001", - "RES-POS-008" - ] - }, - { - "id": "SEED-TX-002", - "negative_cases": [ - "RES-NEG-005", - "RES-NEG-006", - "RES-NEG-007", - "RES-NEG-008", - "RES-NEG-009", - "RES-NEG-010", - "RES-NEG-016" - ], - "positive_cases": [ - "RES-POS-002", - "RES-POS-003", - "RES-POS-004", - "RES-POS-005", - "RES-POS-007" - ] - }, - { - "id": "SEED-TX-003", - "negative_cases": [ - "RES-NEG-014", - "RES-NEG-015" - ], - "positive_cases": [ - "RES-POS-006", - "RES-POS-009" - ] - } - ] + "schema_version": 1 } diff --git a/seed/canonical/assurance/proof-traceability.json b/seed/canonical/assurance/proof-traceability.json index c545a14..3670c3b 100644 --- a/seed/canonical/assurance/proof-traceability.json +++ b/seed/canonical/assurance/proof-traceability.json @@ -135,7 +135,7 @@ "formal_projection": [ { "kind": "STATE_INVARIANT", - "operator": "TerminalUnique", + "operator": "AcceptedTerminalUnique", "proof_theorem": "SpecImpliesAlwaysSeedStateSafety" } ], @@ -153,7 +153,7 @@ "formal_projection": [ { "kind": "STATE_INVARIANT", - "operator": "ConflictUnknown", + "operator": "ConflictSound", "proof_theorem": "SpecImpliesAlwaysSeedStateSafety" } ], diff --git a/seed/canonical/assurance/verification-registry.json b/seed/canonical/assurance/verification-registry.json index e25cf71..566a917 100644 --- a/seed/canonical/assurance/verification-registry.json +++ b/seed/canonical/assurance/verification-registry.json @@ -91,7 +91,7 @@ { "engine": "TLA_TLC", "kind": "STATE_INVARIANT", - "name": "TerminalUnique", + "name": "AcceptedTerminalUnique", "projection_status": "STRUCTURAL_BY_CONSTRUCTION", "seed_invariants": [ "SEED-INV-008" @@ -103,7 +103,7 @@ { "engine": "TLA_TLC", "kind": "STATE_INVARIANT", - "name": "ConflictUnknown", + "name": "ConflictSound", "projection_status": "BOUNDED_ABSTRACTION", "seed_invariants": [ "SEED-INV-009" @@ -244,12 +244,12 @@ } ], "normative": true, - "schema_version": 4, - "transition_case_policy": { + "operation_case_policy": { "declared_exceptions": [], "require_negative_case": true, "require_positive_case": true }, + "schema_version": 4, "verification_methods": [ { "evidence": "seed/canonical/conformance/conformance-profile.json", diff --git a/seed/canonical/conformance/cases/positive/RES-POS-004.json b/seed/canonical/conformance/cases/positive/RES-POS-004.json index 1a170e8..ad8cbf6 100644 --- a/seed/canonical/conformance/cases/positive/RES-POS-004.json +++ b/seed/canonical/conformance/cases/positive/RES-POS-004.json @@ -19,7 +19,7 @@ } }, "case_id": "RES-POS-004", - "description": "Record ALLOW through one exact-binding Authority grant.", + "description": "Record ALLOW through an independently recognized exact-binding Authority.", "expected": { "accepted": true, "code": "RESOLUTION_RECORDED", diff --git a/seed/canonical/conformance/conformance-profile.json b/seed/canonical/conformance/conformance-profile.json index 90af44d..f9b6626 100644 --- a/seed/canonical/conformance/conformance-profile.json +++ b/seed/canonical/conformance/conformance-profile.json @@ -279,7 +279,7 @@ }, "path": "seed/canonical/conformance/cases/positive/RES-POS-004.json", "polarity": "positive", - "sha256": "sha256:dcf5f81b0e60f2aa0c157aab5297177d3f082544d64a54081d83e9d7d6093763" + "sha256": "sha256:b7407ed453ab3dd20d36ab3dd540d7c9c0c002df8821c40455b181b425093eef" }, { "case_id": "RES-POS-005", diff --git a/seed/canonical/conformance/model-based-conformance.json b/seed/canonical/conformance/model-based-conformance.json index 53abf70..cb5c32b 100644 --- a/seed/canonical/conformance/model-based-conformance.json +++ b/seed/canonical/conformance/model-based-conformance.json @@ -1,14 +1,14 @@ { "document_type": "aset-model-based-conformance", "model": { - "command_set": "REGISTER_REQUEST and SUBMIT_RESOLUTION are state transitions; EVALUATE_RESOLUTION is a pure observer.", + "command_set": "REGISTER_REQUEST and SUBMIT_RESOLUTION are state transitions; EVALUATE_RESOLUTION is a pure observer. Together they form the three-operation Seed interface.", "formal_projection": "seed/canonical/formal/SeedResolution.tla", "state_set": "Seed-owned request/terminal metadata plus separate environment conflict observations satisfying the active minimal Seed invariants.", "transition_relation": "delta(seed_state, environment_state, operation) mutates Seed-owned state only for recognized REGISTER_REQUEST or SUBMIT_RESOLUTION operations; conflict observation changes only environment state; EVALUATE_RESOLUTION observes without mutation." }, "normative": true, "profile_boundary": "Policy evaluation, evidence acquisition, workflow, enforcement, federation, storage and cryptographic mechanisms are extension or implementation responsibilities.", - "resolution_obligation": "UNKNOWN is derived when no unique valid terminal record can be established or valid terminal material conflicts. Invalid/non-authoritative material cannot override an otherwise unique valid record. Only ALLOW permits the effect.", + "resolution_obligation": "UNKNOWN is derived when no authoritative accepted terminal record is established or additional conflicting valid terminal material is observed for an accepted terminal resolution. Invalid/non-authoritative material cannot override an accepted authoritative record. Only ALLOW permits the effect.", "schema_version": 3, - "transition_boundary_obligation": "Only recognized Seed state transitions may change Seed-owned state. Environment conflict observation and observer operations do not mutate Seed-owned state; invalid/unrecognized material cannot become accepted state by mere presence." + "state_change_boundary_obligation": "Only recognized Seed state transitions may change Seed-owned state. Environment conflict observation and observer operations do not mutate Seed-owned state; invalid/unrecognized material cannot become accepted state by mere presence." } diff --git a/seed/canonical/decisions/ADR-010-unify-authority-conflict-and-operation-semantics.md b/seed/canonical/decisions/ADR-010-unify-authority-conflict-and-operation-semantics.md new file mode 100644 index 0000000..c12561e --- /dev/null +++ b/seed/canonical/decisions/ADR-010-unify-authority-conflict-and-operation-semantics.md @@ -0,0 +1,57 @@ +# ADR-010 — Unify Authority recognition, conflict admissibility and operation semantics + +## Status + +Accepted. Refines ADR-009 for the active Seed 0.3 alpha model. Historical +artifacts are not rewritten. + +## Context + +After the deep semantic cleanup, three residual mismatches remained between the +machine canon, wire semantics and formal abstraction: + +1. the formal model exposed separate request and terminal Authority-recognition + relations although the wire model has one exact-binding AuthorityBinding + type and one recognition store; +2. environment conflict observation was allowed before any terminal record had + been accepted, although concrete conflict requires additional distinct valid + terminal material for an existing terminal resolution; +3. `EVALUATE_RESOLUTION` was correctly modeled as an observer but remained + stored under a machine-canon collection named `transitions` with a + `SEED-TX-*` identifier. + +The phrase “at most one valid terminal record exists” also conflated globally +observed valid material with the single terminal record accepted into Seed-owned +state. + +## Decision + +The active Seed model uses: + +- one immutable `RecognizedAuthorityBindings` relation for exact-binding + Authority recognition in both request registration and terminal submission; +- conflict observation only for a `resolution_id` already present in + `TerminalRequests` and not already conflicted; +- `AcceptedTerminalUnique` for the structural single terminal cell in + Seed-owned state; +- `ConflictSound` for the rule that conflict state is a subset of accepted + terminal requests and always derives `UNKNOWN`; +- a machine-canon `operations` catalogue with identifiers `SEED-OP-001` through + `SEED-OP-003`, containing two `STATE_TRANSITION` operations and one + `OBSERVER` operation; +- standalone canon-to-TLA projection profile + `ASET-SEED-CANON-TLA-PROJECTION-V5`. + +## Consequences + +- formal Authority admission now matches the single wire AuthorityBinding + semantics instead of introducing an unexpressed terminal-only privilege; +- impossible pre-request/pre-terminal conflict states are no longer reachable; +- the finite model reports only states reachable under the concrete conflict + boundary; +- accepted terminal uniqueness no longer claims that additional valid external + terminal material cannot exist; such material is represented by conflict; +- generated documentation describes three operations rather than three + transitions; +- this is a breaking machine-canon shape change inside the 0.3 alpha line and + is explicitly declared as such by the canon change declaration. diff --git a/seed/canonical/formal/README.md b/seed/canonical/formal/README.md index 50b4109..27038c2 100644 --- a/seed/canonical/formal/README.md +++ b/seed/canonical/formal/README.md @@ -19,15 +19,11 @@ state dimensions. `Requests` and `TerminalRequests` are partial-map domains. ## Authority and external-material boundary -`RequestAuthorityBindings` and `TerminalAuthorityBindings` are immutable -abstract recognition relations. They mean that Authority recognition has -already succeeded for an exact binding; the formal model does not interpret -signatures, credentials or delegation chains. +`RecognizedAuthorityBindings` is the single immutable abstract recognition relation. It means that Authority recognition has already succeeded for an exact binding and is used consistently by both request registration and terminal submission; the formal model does not interpret signatures, credentials or delegation mechanisms. Invalid or non-authoritative material has no state variable and no artificial transition. It cannot enter accepted state by construction of the admission -boundary. The TLA model covers conflict between valid terminal material as an -environment observation. +boundary. The TLA model covers additional distinct valid terminal material as an environment observation only after a terminal record has already been accepted. ## Checked properties @@ -46,7 +42,7 @@ The final TLAPS theorem surface is: ## Canon-to-TLA relation `SeedCanonProjection.tla` is generated under -`ASET-SEED-CANON-TLA-PROJECTION-V4` as a **standalone module**. It does not +`ASET-SEED-CANON-TLA-PROJECTION-V5` as a **standalone module**. It does not `EXTEND` or instantiate `SeedResolution`. `SeedCanonRefinementProofs.tla` explicitly instantiates the standalone projection onto the handwritten model and proves evaluator and behavioral equivalence. diff --git a/seed/canonical/formal/SeedCanonProjection.tla b/seed/canonical/formal/SeedCanonProjection.tla index a330264..b5b7140 100644 --- a/seed/canonical/formal/SeedCanonProjection.tla +++ b/seed/canonical/formal/SeedCanonProjection.tla @@ -4,10 +4,10 @@ EXTENDS FiniteSets (* GENERATED FILE. DO NOT EDIT. Source: seed/canonical/source/seed-model.json -Source SHA-256: sha256:c43ca7b642a11c3ab140884a6bbff34bbd741f5cb905e6a779c860c813998fcf -Projection profile: ASET-SEED-CANON-TLA-PROJECTION-V4 +Source SHA-256: sha256:1fed5dc95045a287b3e9b8b4ea011a7b977729158f3360ed9a8a7e7e6ba1b4b0 +Projection profile: ASET-SEED-CANON-TLA-PROJECTION-V5 -V4 is a standalone projection. It does not EXTEND or import SeedResolution. +V5 is a standalone projection. It does not EXTEND or import SeedResolution. The refinement proof explicitly instantiates this model onto the target state. Seed-owned state is requestMeta + terminalMeta. Conflict is environment state. EVALUATE_RESOLUTION is a pure observer and is not part of CanonNext. @@ -15,16 +15,14 @@ EVALUATE_RESOLUTION is a pure observer and is not part of CanonNext. CONSTANTS ResolutionIds, Bindings, Authorities, TerminalCommitments, RecognizedTerminalCommitments, NoCommitment, - RequestAuthorityBindings, TerminalAuthorityBindings + RecognizedAuthorityBindings ASSUME ResolutionIds # {} ASSUME Bindings # {} ASSUME Authorities # {} ASSUME RecognizedTerminalCommitments \subseteq TerminalCommitments ASSUME NoCommitment \notin TerminalCommitments -ASSUME RequestAuthorityBindings \subseteq Authorities \X Bindings -ASSUME TerminalAuthorityBindings \subseteq Authorities \X Bindings -ASSUME RequestAuthorityBindings \subseteq TerminalAuthorityBindings +ASSUME RecognizedAuthorityBindings \subseteq Authorities \X Bindings CanonResolutions == {"UNKNOWN", "ALLOW", "BLOCK"} CanonTerminalResolutions == {"ALLOW", "BLOCK"} @@ -63,7 +61,7 @@ CanonRegisterRequest(r, b, a, previous) == /\ r \in ResolutionIds \ CanonRequests /\ b \in Bindings /\ a \in Authorities - /\ <> \in RequestAuthorityBindings + /\ <> \in RecognizedAuthorityBindings /\ \/ previous = NoCommitment \/ previous \in RecognizedTerminalCommitments /\ requestMeta' = @@ -77,7 +75,7 @@ CanonSubmitResolution(r, b, a, value) == /\ r \in CanonRequests /\ b = CanonRequestBinding(r) /\ a \in Authorities - /\ <> \in TerminalAuthorityBindings + /\ <> \in RecognizedAuthorityBindings /\ value \in CanonTerminalResolutions /\ r \notin CanonTerminalRequests /\ r \notin conflicts @@ -89,7 +87,7 @@ CanonSubmitResolution(r, b, a, value) == /\ UNCHANGED <> CanonObserveConflict(r) == - /\ r \in ResolutionIds + /\ r \in CanonTerminalRequests \ conflicts /\ conflicts' = conflicts \cup {r} /\ UNCHANGED CanonSeedVars diff --git a/seed/canonical/formal/SeedCanonRefinementProofs.tla b/seed/canonical/formal/SeedCanonRefinementProofs.tla index eff57bb..e81de5a 100644 --- a/seed/canonical/formal/SeedCanonRefinementProofs.tla +++ b/seed/canonical/formal/SeedCanonRefinementProofs.tla @@ -2,7 +2,7 @@ EXTENDS SeedResolution, TLAPS (* -Behavioral equivalence proof for projection profile V4. +Behavioral equivalence proof for projection profile V5. SeedCanonProjection is standalone and does not import SeedResolution. The instance below explicitly maps the generated projection constants and state @@ -18,8 +18,7 @@ Canon == INSTANCE SeedCanonProjection TerminalCommitments <- TerminalCommitments, RecognizedTerminalCommitments <- RecognizedTerminalCommitments, NoCommitment <- NoCommitment, - RequestAuthorityBindings <- RequestAuthorityBindings, - TerminalAuthorityBindings <- TerminalAuthorityBindings, + RecognizedAuthorityBindings <- RecognizedAuthorityBindings, requestMeta <- requestMeta, terminalMeta <- terminalMeta, conflicts <- conflicts diff --git a/seed/canonical/formal/SeedResolution.cfg b/seed/canonical/formal/SeedResolution.cfg index 2eaa677..436ee6e 100644 --- a/seed/canonical/formal/SeedResolution.cfg +++ b/seed/canonical/formal/SeedResolution.cfg @@ -5,8 +5,7 @@ CONSTANTS TerminalCommitments = {c1, c2} RecognizedTerminalCommitments = {c1, c2} NoCommitment = noCommitment - RequestAuthorityBindings <- TLC_RequestAuthorityBindings - TerminalAuthorityBindings <- TLC_TerminalAuthorityBindings + RecognizedAuthorityBindings <- TLC_RecognizedAuthorityBindings SPECIFICATION Spec INVARIANTS @@ -17,8 +16,8 @@ INVARIANTS TerminalBindingDerived RequestAuthorityRecognized TerminalAuthorityRecognized - TerminalUnique - ConflictUnknown + AcceptedTerminalUnique + ConflictSound FreshReconsideration PROPERTIES RequestsAppendOnly diff --git a/seed/canonical/formal/SeedResolution.tla b/seed/canonical/formal/SeedResolution.tla index 944556a..6fbdbb6 100644 --- a/seed/canonical/formal/SeedResolution.tla +++ b/seed/canonical/formal/SeedResolution.tla @@ -3,16 +3,14 @@ EXTENDS FiniteSets CONSTANTS ResolutionIds, Bindings, Authorities, TerminalCommitments, RecognizedTerminalCommitments, NoCommitment, - RequestAuthorityBindings, TerminalAuthorityBindings + RecognizedAuthorityBindings ASSUME ResolutionIds # {} ASSUME Bindings # {} ASSUME Authorities # {} ASSUME RecognizedTerminalCommitments \subseteq TerminalCommitments ASSUME NoCommitment \notin TerminalCommitments -ASSUME RequestAuthorityBindings \subseteq Authorities \X Bindings -ASSUME TerminalAuthorityBindings \subseteq Authorities \X Bindings -ASSUME RequestAuthorityBindings \subseteq TerminalAuthorityBindings +ASSUME RecognizedAuthorityBindings \subseteq Authorities \X Bindings Resolutions == {"UNKNOWN", "ALLOW", "BLOCK"} TerminalResolutions == {"ALLOW", "BLOCK"} @@ -31,13 +29,10 @@ TLC_Authority2 == CHOOSE a \in Authorities \ {TLC_Authority1} : TRUE TLC_Binding1 == CHOOSE b \in Bindings : TRUE TLC_Binding2 == CHOOSE b \in Bindings \ {TLC_Binding1} : TRUE -TLC_RequestAuthorityBindings == +TLC_RecognizedAuthorityBindings == {<>, - <>} - -TLC_TerminalAuthorityBindings == - TLC_RequestAuthorityBindings \cup - {<>} + <>, + <>} (* Seed-owned state and environment state are deliberately separated. @@ -75,7 +70,7 @@ RegisterRequest(r, b, a, previous) == /\ r \in ResolutionIds \ Requests /\ b \in Bindings /\ a \in Authorities - /\ <> \in RequestAuthorityBindings + /\ <> \in RecognizedAuthorityBindings /\ \/ previous = NoCommitment \/ previous \in RecognizedTerminalCommitments /\ requestMeta' = @@ -89,7 +84,7 @@ SubmitResolution(r, b, a, value) == /\ r \in Requests /\ b = RequestBinding(r) /\ a \in Authorities - /\ <> \in TerminalAuthorityBindings + /\ <> \in RecognizedAuthorityBindings /\ value \in TerminalResolutions /\ r \notin TerminalRequests /\ r \notin conflicts @@ -102,7 +97,7 @@ SubmitResolution(r, b, a, value) == (* Environment transition: it changes only environment state. *) ObserveConflict(r) == - /\ r \in ResolutionIds + /\ r \in TerminalRequests \ conflicts /\ conflicts' = conflicts \cup {r} /\ UNCHANGED seedVars @@ -141,6 +136,7 @@ TypeOK == /\ DOMAIN terminalMeta \subseteq ResolutionIds /\ terminalMeta \in [DOMAIN terminalMeta -> TerminalMetaType] /\ conflicts \subseteq ResolutionIds + /\ conflicts \subseteq TerminalRequests ResolutionDomain == \A r \in ResolutionIds : ResolutionOf(r) \in Resolutions @@ -153,7 +149,7 @@ AllowSoundness == /\ r \in TerminalRequests /\ TerminalResolution(r) = "ALLOW" /\ <> - \in TerminalAuthorityBindings + \in RecognizedAuthorityBindings FailClosed == \A r \in ResolutionIds : @@ -167,20 +163,21 @@ TerminalBindingDerived == RequestAuthorityRecognized == \A r \in Requests : \E a \in Authorities : - <> \in RequestAuthorityBindings + <> \in RecognizedAuthorityBindings TerminalAuthorityRecognized == \A r \in TerminalRequests : /\ r \in Requests /\ <> - \in TerminalAuthorityBindings + \in RecognizedAuthorityBindings (* One keyed terminal metadata cell makes multiple accepted terminals unrepresentable. *) -TerminalUnique == +AcceptedTerminalUnique == terminalMeta \in [DOMAIN terminalMeta -> TerminalMetaType] -ConflictUnknown == - \A r \in conflicts : ResolutionOf(r) = "UNKNOWN" +ConflictSound == + /\ conflicts \subseteq TerminalRequests + /\ \A r \in conflicts : ResolutionOf(r) = "UNKNOWN" FreshReconsideration == \A r \in Requests : @@ -198,8 +195,8 @@ SeedStateSafety == /\ TerminalBindingDerived /\ RequestAuthorityRecognized /\ TerminalAuthorityRecognized - /\ TerminalUnique - /\ ConflictUnknown + /\ AcceptedTerminalUnique + /\ ConflictSound /\ FreshReconsideration InductiveInvariant == diff --git a/seed/canonical/formal/SeedResolutionProofs.tla b/seed/canonical/formal/SeedResolutionProofs.tla index ab4b9a1..77487d0 100644 --- a/seed/canonical/formal/SeedResolutionProofs.tla +++ b/seed/canonical/formal/SeedResolutionProofs.tla @@ -68,11 +68,11 @@ THEOREM FailClosedByEvaluator == PROOF BY DEF FailClosed, EffectPermitted -THEOREM ConflictUnknownFromTypeOK == - TypeOK => ConflictUnknown +THEOREM ConflictSoundFromTypeOK == + TypeOK => ConflictSound PROOF BY ConflictedResolutionIsUnknown - DEF TypeOK, ConflictUnknown + DEF TypeOK, ConflictSound THEOREM ResolutionDomainPointwise == ASSUME TypeOK, @@ -106,10 +106,10 @@ PROOF BY ResolutionDomainPointwise DEF ResolutionDomain -THEOREM TerminalUniqueFromTypeOK == - TypeOK => TerminalUnique +THEOREM AcceptedTerminalUniqueFromTypeOK == + TypeOK => AcceptedTerminalUnique PROOF - BY DEF TypeOK, TerminalUnique + BY DEF TypeOK, AcceptedTerminalUnique THEOREM AllowSoundnessPointwise == ASSUME TerminalBindingDerived, @@ -122,7 +122,7 @@ THEOREM AllowSoundnessPointwise == /\ r \in TerminalRequests /\ TerminalResolution(r) = "ALLOW" /\ <> - \in TerminalAuthorityBindings + \in RecognizedAuthorityBindings PROOF <1>1. /\ r \in Requests @@ -132,7 +132,7 @@ PROOF BY AllowResolutionCharacterization <1>2. <> - \in TerminalAuthorityBindings + \in RecognizedAuthorityBindings BY <1>1 DEF TerminalAuthorityRecognized <1>3. QED BY <1>1, <1>2 @@ -150,8 +150,8 @@ PROOF BY ResolutionDomainFromTypeOK, AllowSoundnessFromStructuralInvariants, FailClosedByEvaluator, - TerminalUniqueFromTypeOK, - ConflictUnknownFromTypeOK + AcceptedTerminalUniqueFromTypeOK, + ConflictSoundFromTypeOK DEF InductiveInvariant, SeedStateSafety THEOREM InitImpliesTypeOK == @@ -220,6 +220,7 @@ PROOF TypeOK, RegisterRequest, Requests, + TerminalRequests, RequestMetaType, TerminalMetaType @@ -423,7 +424,7 @@ THEOREM ObserveConflictPreservesTypeOK == \A r \in ResolutionIds : TypeOK /\ ObserveConflict(r) => TypeOK' PROOF - BY DEF TypeOK, ObserveConflict, seedVars + BY DEF TypeOK, ObserveConflict, seedVars, TerminalRequests THEOREM ObserveConflictPreservesTerminalBindingDerived == \A r \in ResolutionIds : diff --git a/seed/canonical/migration/CANON_CHANGE_DECLARATION.json b/seed/canonical/migration/CANON_CHANGE_DECLARATION.json index 998d023..d6f84dd 100644 --- a/seed/canonical/migration/CANON_CHANGE_DECLARATION.json +++ b/seed/canonical/migration/CANON_CHANGE_DECLARATION.json @@ -1,10 +1,10 @@ { - "candidate_model_sha256": "sha256:c43ca7b642a11c3ab140884a6bbff34bbd741f5cb905e6a779c860c813998fcf", + "candidate_model_sha256": "sha256:1fed5dc95045a287b3e9b8b4ea011a7b977729158f3360ed9a8a7e7e6ba1b4b0", "change_class": "BREAKING", "change_kind": "SEMANTIC_SIMPLIFICATION", - "decision_ref": "seed/canonical/decisions/ADR-009-seed-state-environment-observer-and-authority-boundary.md", + "decision_ref": "seed/canonical/decisions/ADR-010-unify-authority-conflict-and-operation-semantics.md", "document_type": "aset-canon-change-declaration", - "rationale": "Seed 0.3 deep-refactors the active resolution core: exact-binding Authority recognition replaces grant-chain semantics, Seed-owned state is separated from environment conflict state, evaluation is an observer, invalid/non-authoritative material cannot override a unique valid terminal record, and the canon-to-TLA projection is standalone.", + "rationale": "Seed 0.3 final semantic cleanup unifies exact-binding Authority recognition, constrains conflict observation to accepted terminal resolutions, distinguishes accepted-terminal uniqueness from external conflict material, and replaces the legacy transitions catalogue with three role-classified operations under a standalone V5 canon-to-TLA projection.", "schema_version": 1, "supersession_ref": "seed/canonical/migration/ALPHA2_TO_0.3_ALPHA1_CHANGE_DECLARATION.json" } diff --git a/seed/canonical/schemas/canon-tla-refinement.schema.json b/seed/canonical/schemas/canon-tla-refinement.schema.json index 07868da..c8335e9 100644 --- a/seed/canonical/schemas/canon-tla-refinement.schema.json +++ b/seed/canonical/schemas/canon-tla-refinement.schema.json @@ -17,6 +17,42 @@ ], "type": "object" }, + "operationCoverage": { + "additionalProperties": false, + "properties": { + "id": { + "pattern": "^SEED-OP-[0-9]{3}$", + "type": "string" + }, + "kind": { + "enum": [ + "REGISTER_REQUEST", + "SUBMIT_RESOLUTION", + "EVALUATE_RESOLUTION" + ] + }, + "status": { + "enum": [ + "PROVED_IN_DECLARED_PROJECTION", + "OBSERVER_EQUIVALENCE_PROVED" + ] + }, + "tla_action": { + "enum": [ + "RegisterRequest", + "SubmitResolution", + "EvaluateResolution" + ] + } + }, + "required": [ + "id", + "kind", + "tla_action", + "status" + ], + "type": "object" + }, "requirementCoverage": { "additionalProperties": false, "properties": { @@ -69,42 +105,6 @@ "PARTIAL_TERMINAL_COMMITMENT_ABSTRACTION", "META_OUTSIDE_BEHAVIORAL_MODEL" ] - }, - "transitionCoverage": { - "additionalProperties": false, - "properties": { - "id": { - "pattern": "^SEED-TX-[0-9]{3}$", - "type": "string" - }, - "kind": { - "enum": [ - "REGISTER_REQUEST", - "SUBMIT_RESOLUTION", - "EVALUATE_RESOLUTION" - ] - }, - "status": { - "enum": [ - "PROVED_IN_DECLARED_PROJECTION", - "OBSERVER_EQUIVALENCE_PROVED" - ] - }, - "tla_action": { - "enum": [ - "RegisterRequest", - "SubmitResolution", - "EvaluateResolution" - ] - } - }, - "required": [ - "id", - "kind", - "tla_action", - "status" - ], - "type": "object" } }, "$id": "https://github.com/attractor-set/ASET/raw/main/seed/canonical/schemas/canon-tla-refinement.schema.json", @@ -146,7 +146,7 @@ "const": "seed/canonical/formal/SeedCanonProjection.tla" }, "profile": { - "const": "ASET-SEED-CANON-TLA-PROJECTION-V4" + "const": "ASET-SEED-CANON-TLA-PROJECTION-V5" } }, "required": [ @@ -165,6 +165,14 @@ "minItems": 12, "type": "array" }, + "operation_coverage": { + "items": { + "$ref": "#/$defs/operationCoverage" + }, + "maxItems": 3, + "minItems": 3, + "type": "array" + }, "proof": { "additionalProperties": false, "properties": { @@ -266,14 +274,6 @@ "module" ], "type": "object" - }, - "transition_coverage": { - "items": { - "$ref": "#/$defs/transitionCoverage" - }, - "maxItems": 3, - "minItems": 3, - "type": "array" } }, "required": [ @@ -288,7 +288,7 @@ "resolution_algebra_fields", "requirement_coverage", "invariant_coverage", - "transition_coverage", + "operation_coverage", "abstractions", "excluded_claims", "claim_boundary" diff --git a/seed/canonical/schemas/invariant-coverage.schema.json b/seed/canonical/schemas/invariant-coverage.schema.json index 66ad8c1..755e7e0 100644 --- a/seed/canonical/schemas/invariant-coverage.schema.json +++ b/seed/canonical/schemas/invariant-coverage.schema.json @@ -1,113 +1,211 @@ { - "$schema": "https://json-schema.org/draft/2020-12/schema", + "$defs": { + "coverageEntry": { + "additionalProperties": false, + "properties": { + "conformance_cases": { + "$ref": "#/$defs/nonEmptyStrings" + }, + "formal_properties": { + "$ref": "#/$defs/nonEmptyStrings" + }, + "id": { + "minLength": 1, + "type": "string" + }, + "invariants": { + "items": { + "pattern": "^SEED-INV-[0-9]{3}$", + "type": "string" + }, + "type": "array" + }, + "semantic_mutations": { + "$ref": "#/$defs/nonEmptyStrings" + } + }, + "required": [ + "id", + "formal_properties", + "conformance_cases", + "semantic_mutations" + ], + "type": "object" + }, + "nonEmptyStrings": { + "items": { + "minLength": 1, + "type": "string" + }, + "minItems": 1, + "type": "array" + } + }, "$id": "https://github.com/attractor-set/ASET/raw/main/seed/canonical/schemas/invariant-coverage.schema.json", - "type": "object", + "$schema": "https://json-schema.org/draft/2020-12/schema", "additionalProperties": false, - "required": [ - "document_type", - "schema_version", - "normative", - "coverage_policy", - "requirements", - "invariants", - "transitions", - "mutation_catalog", - "claim_boundary" - ], "properties": { - "document_type": {"const": "aset-seed-invariant-coverage"}, - "schema_version": {"const": 1}, - "normative": {"const": true}, + "claim_boundary": { + "additionalProperties": false, + "properties": { + "covered": { + "$ref": "#/$defs/nonEmptyStrings" + }, + "not_claimed": { + "$ref": "#/$defs/nonEmptyStrings" + } + }, + "required": [ + "covered", + "not_claimed" + ], + "type": "object" + }, "coverage_policy": { - "type": "object", "additionalProperties": false, + "properties": { + "conformance_case_required": { + "const": true + }, + "formal_property_required": { + "const": true + }, + "invariants_complete": { + "const": true + }, + "operations_complete": { + "const": true + }, + "orphan_evidence_forbidden": { + "const": true + }, + "requirements_complete": { + "const": true + }, + "semantic_mutation_required": { + "const": true + } + }, "required": [ "requirements_complete", "invariants_complete", - "transitions_complete", + "operations_complete", "formal_property_required", "conformance_case_required", "semantic_mutation_required", "orphan_evidence_forbidden" ], - "properties": { - "requirements_complete": {"const": true}, - "invariants_complete": {"const": true}, - "transitions_complete": {"const": true}, - "formal_property_required": {"const": true}, - "conformance_case_required": {"const": true}, - "semantic_mutation_required": {"const": true}, - "orphan_evidence_forbidden": {"const": true} - } + "type": "object" }, - "requirements": { - "type": "array", - "minItems": 12, - "items": {"$ref": "#/$defs/coverageEntry"} + "document_type": { + "const": "aset-seed-invariant-coverage" }, "invariants": { - "type": "array", + "items": { + "$ref": "#/$defs/coverageEntry" + }, "minItems": 12, - "items": {"$ref": "#/$defs/coverageEntry"} + "type": "array" }, - "transitions": { - "type": "array", - "minItems": 3, + "mutation_catalog": { "items": { - "type": "object", "additionalProperties": false, - "required": ["id", "positive_cases", "negative_cases"], "properties": { - "id": {"pattern": "^SEED-TX-[0-9]{3}$", "type": "string"}, - "positive_cases": {"$ref": "#/$defs/nonEmptyStrings"}, - "negative_cases": {"$ref": "#/$defs/nonEmptyStrings"} - } - } - }, - "mutation_catalog": { - "type": "array", + "case_ids": { + "items": { + "type": "string" + }, + "type": "array" + }, + "description": { + "minLength": 1, + "type": "string" + }, + "id": { + "pattern": "^SEED-MUT-[0-9]{3}$", + "type": "string" + }, + "operator": { + "minLength": 1, + "type": "string" + }, + "seed_invariants": { + "items": { + "pattern": "^SEED-INV-[0-9]{3}$", + "type": "string" + }, + "type": "array" + }, + "seed_requirements": { + "items": { + "pattern": "^ASET-SEED-REQ-[0-9]{3}$", + "type": "string" + }, + "type": "array" + } + }, + "required": [ + "id", + "operator", + "description", + "case_ids", + "seed_invariants", + "seed_requirements" + ], + "type": "object" + }, "minItems": 13, + "type": "array" + }, + "normative": { + "const": true + }, + "operations": { "items": { - "type": "object", "additionalProperties": false, - "required": ["id", "operator", "description", "case_ids", "seed_invariants", "seed_requirements"], "properties": { - "id": {"pattern": "^SEED-MUT-[0-9]{3}$", "type": "string"}, - "operator": {"type": "string", "minLength": 1}, - "description": {"type": "string", "minLength": 1}, - "case_ids": {"type": "array", "items": {"type": "string"}}, - "seed_invariants": {"type": "array", "items": {"pattern": "^SEED-INV-[0-9]{3}$", "type": "string"}}, - "seed_requirements": {"type": "array", "items": {"pattern": "^ASET-SEED-REQ-[0-9]{3}$", "type": "string"}} - } - } + "id": { + "pattern": "^SEED-OP-[0-9]{3}$", + "type": "string" + }, + "negative_cases": { + "$ref": "#/$defs/nonEmptyStrings" + }, + "positive_cases": { + "$ref": "#/$defs/nonEmptyStrings" + } + }, + "required": [ + "id", + "positive_cases", + "negative_cases" + ], + "type": "object" + }, + "minItems": 3, + "type": "array" }, - "claim_boundary": { - "type": "object", - "additionalProperties": false, - "required": ["covered", "not_claimed"], - "properties": { - "covered": {"$ref": "#/$defs/nonEmptyStrings"}, - "not_claimed": {"$ref": "#/$defs/nonEmptyStrings"} - } - } - }, - "$defs": { - "nonEmptyStrings": { - "type": "array", - "minItems": 1, - "items": {"type": "string", "minLength": 1} + "requirements": { + "items": { + "$ref": "#/$defs/coverageEntry" + }, + "minItems": 12, + "type": "array" }, - "coverageEntry": { - "type": "object", - "additionalProperties": false, - "required": ["id", "formal_properties", "conformance_cases", "semantic_mutations"], - "properties": { - "id": {"type": "string", "minLength": 1}, - "invariants": {"type": "array", "items": {"pattern": "^SEED-INV-[0-9]{3}$", "type": "string"}}, - "formal_properties": {"$ref": "#/$defs/nonEmptyStrings"}, - "conformance_cases": {"$ref": "#/$defs/nonEmptyStrings"}, - "semantic_mutations": {"$ref": "#/$defs/nonEmptyStrings"} - } + "schema_version": { + "const": 1 } - } + }, + "required": [ + "document_type", + "schema_version", + "normative", + "coverage_policy", + "requirements", + "invariants", + "operations", + "mutation_catalog", + "claim_boundary" + ], + "type": "object" } diff --git a/seed/canonical/schemas/seed-model.schema.json b/seed/canonical/schemas/seed-model.schema.json index 1b6b44d..d73d410 100644 --- a/seed/canonical/schemas/seed-model.schema.json +++ b/seed/canonical/schemas/seed-model.schema.json @@ -161,6 +161,84 @@ "model_id": { "const": "ASET-SEED-RESOLUTION-CANON-0.3-ALPHA1" }, + "operations": { + "items": { + "additionalProperties": false, + "properties": { + "authority_rule": { + "minLength": 1, + "type": "string" + }, + "binding_rule": { + "minLength": 1, + "type": "string" + }, + "created_artifacts": { + "items": { + "type": "string" + }, + "minItems": 1, + "type": "array" + }, + "from_resolution": { + "enum": [ + null, + "UNKNOWN" + ], + "type": [ + "string", + "null" + ] + }, + "id": { + "pattern": "^SEED-OP-[0-9]{3}$", + "type": "string" + }, + "kind": { + "enum": [ + "REGISTER_REQUEST", + "SUBMIT_RESOLUTION", + "EVALUATE_RESOLUTION" + ] + }, + "payload_schema": { + "type": "string" + }, + "role": { + "enum": [ + "STATE_TRANSITION", + "OBSERVER" + ] + }, + "terminal": { + "type": "boolean" + }, + "to_resolution": { + "enum": [ + "UNKNOWN", + "ALLOW_OR_BLOCK", + "DERIVED" + ] + } + }, + "required": [ + "id", + "kind", + "payload_schema", + "from_resolution", + "to_resolution", + "authority_rule", + "binding_rule", + "created_artifacts", + "role", + "terminal" + ], + "type": "object" + }, + "maxItems": 3, + "minItems": 3, + "type": "array" + }, "predecessor": { "const": "ASET-SEED-RESOLUTION-CANON-0.2-ALPHA2" }, @@ -281,89 +359,11 @@ "type": "object" }, "schema_version": { - "const": 4 + "const": 5 }, "status": { "const": "MINIMAL_STRONG_CORE_ALPHA" }, - "transitions": { - "items": { - "additionalProperties": false, - "properties": { - "authority_rule": { - "minLength": 1, - "type": "string" - }, - "binding_rule": { - "minLength": 1, - "type": "string" - }, - "created_artifacts": { - "items": { - "type": "string" - }, - "minItems": 1, - "type": "array" - }, - "from_resolution": { - "enum": [ - null, - "UNKNOWN" - ], - "type": [ - "string", - "null" - ] - }, - "id": { - "pattern": "^SEED-TX-[0-9]{3}$", - "type": "string" - }, - "kind": { - "enum": [ - "REGISTER_REQUEST", - "SUBMIT_RESOLUTION", - "EVALUATE_RESOLUTION" - ] - }, - "payload_schema": { - "type": "string" - }, - "role": { - "enum": [ - "STATE_TRANSITION", - "OBSERVER" - ] - }, - "terminal": { - "type": "boolean" - }, - "to_resolution": { - "enum": [ - "UNKNOWN", - "ALLOW_OR_BLOCK", - "DERIVED" - ] - } - }, - "required": [ - "id", - "kind", - "payload_schema", - "from_resolution", - "to_resolution", - "authority_rule", - "binding_rule", - "created_artifacts", - "role", - "terminal" - ], - "type": "object" - }, - "maxItems": 3, - "minItems": 3, - "type": "array" - }, "version": { "const": "0.3.0-alpha.1" } @@ -381,7 +381,7 @@ "concepts", "requirements", "invariants", - "transitions", + "operations", "protocol_profile_ref", "conformance_profile_ref", "assurance", diff --git a/seed/canonical/source/seed-model.json b/seed/canonical/source/seed-model.json index e0af6d8..f59c8fb 100644 --- a/seed/canonical/source/seed-model.json +++ b/seed/canonical/source/seed-model.json @@ -194,9 +194,9 @@ ], "id": "SEED-INV-002", "texts": { - "en": "Effect permission is true if and only if the unique valid terminal record is ALLOW.", - "pt-BR": "A permissão do efeito é verdadeira se, e somente se, o único registro terminal válido for ALLOW.", - "ru": "Разрешение эффекта истинно тогда и только тогда, когда единственная действительная терминальная запись равна ALLOW." + "en": "Effect permission is true if and only if the accepted authoritative terminal record is ALLOW and no valid terminal conflict is observed.", + "pt-BR": "A permissão de efeito é verdadeira se, e somente se, o registro terminal autoritativo aceito for ALLOW e nenhum conflito terminal válido for observado.", + "ru": "Разрешение эффекта истинно тогда и только тогда, когда принятая авторитетная терминальная запись имеет значение ALLOW и не наблюдается действительный терминальный конфликт." }, "verification": [ "ASET-VERIFY-DECLARATIVE-STATE-VALIDATION", @@ -302,9 +302,9 @@ ], "id": "SEED-INV-008", "texts": { - "en": "At most one valid terminal record exists for one resolution_id.", - "pt-BR": "Existe no máximo um registro terminal válido para um resolution_id.", - "ru": "Для одного resolution_id существует не более одной действительной терминальной записи." + "en": "Seed-owned state accepts at most one terminal record for one resolution_id.", + "pt-BR": "O estado pertencente ao Seed aceita no máximo um registro terminal para um resolution_id.", + "ru": "Принадлежащее Seed состояние принимает не более одной терминальной записи для одного resolution_id." }, "verification": [ "ASET-VERIFY-DECLARATIVE-STATE-VALIDATION", @@ -320,9 +320,9 @@ ], "id": "SEED-INV-009", "texts": { - "en": "Conflicting valid terminal records yield UNKNOWN. Invalid or non-authoritative material cannot create ALLOW, create a conflict, or override an otherwise unique valid terminal record.", - "pt-BR": "Registros terminais válidos conflitantes resultam em UNKNOWN. Material inválido ou não autoritativo não pode criar ALLOW, criar conflito nem substituir um registro terminal válido e único.", - "ru": "Конфликтующие действительные терминальные записи дают UNKNOWN. Недействительный или неавторитетный материал не может создать ALLOW, создать конфликт или переопределить единственную действительную терминальную запись." + "en": "A conflict observation is valid only for a resolution_id that already has an accepted terminal record. Additional conflicting valid terminal material yields UNKNOWN; invalid or non-authoritative material cannot create ALLOW, create a conflict, or replace the accepted record.", + "pt-BR": "Uma observação de conflito só é válida para um resolution_id que já possua um registro terminal aceito. Material terminal válido conflitante adicional resulta em UNKNOWN; material inválido ou não autoritativo não pode criar ALLOW, criar conflito nem substituir o registro aceito.", + "ru": "Наблюдение конфликта допустимо только для resolution_id, у которого уже есть принятая терминальная запись. Дополнительный конфликтующий действительный терминальный материал даёт UNKNOWN; недействительный или неавторитетный материал не может создать ALLOW, создать конфликт или заменить принятую запись." }, "verification": [ "ASET-VERIFY-DECLARATIVE-STATE-VALIDATION", @@ -393,6 +393,50 @@ "pt-BR" ], "model_id": "ASET-SEED-RESOLUTION-CANON-0.3-ALPHA1", + "operations": [ + { + "authority_rule": "The Authority must be explicitly recognized for the exact request binding.", + "binding_rule": "The request contains one canonical exact binding and a fresh resolution_id. For reconsideration, previous_terminal_record_digest must be a recognized immutable terminal-record commitment; predecessor object presence in retained storage is not required.", + "created_artifacts": [ + "ResolutionRequest" + ], + "from_resolution": null, + "id": "SEED-OP-001", + "kind": "REGISTER_REQUEST", + "payload_schema": "seed/canonical/protocol/schemas/payload-register-request.schema.json", + "role": "STATE_TRANSITION", + "terminal": false, + "to_resolution": "UNKNOWN" + }, + { + "authority_rule": "The Authority must be explicitly recognized for the exact request binding. Concrete signatures, credentials, delegation mechanisms and proof construction are external validation mechanisms.", + "binding_rule": "The record request_digest and binding_digest must exactly match the registered request.", + "created_artifacts": [ + "ResolutionRecord" + ], + "from_resolution": "UNKNOWN", + "id": "SEED-OP-002", + "kind": "SUBMIT_RESOLUTION", + "payload_schema": "seed/canonical/protocol/schemas/payload-submit-resolution.schema.json", + "role": "STATE_TRANSITION", + "terminal": true, + "to_resolution": "ALLOW_OR_BLOCK" + }, + { + "authority_rule": "Evaluation creates no Authority and accepts no external statement as a resolution.", + "binding_rule": "Evaluation observes one resolution_id without mutating Seed-owned state. It derives UNKNOWN when no authoritative accepted terminal result is established or when additional conflicting valid terminal material is observed; invalid or non-authoritative material cannot override an otherwise authoritative accepted terminal result.", + "created_artifacts": [ + "ResolutionEvaluation" + ], + "from_resolution": null, + "id": "SEED-OP-003", + "kind": "EVALUATE_RESOLUTION", + "payload_schema": "seed/canonical/protocol/schemas/operation.schema.json", + "role": "OBSERVER", + "terminal": false, + "to_resolution": "DERIVED" + } + ], "predecessor": "ASET-SEED-RESOLUTION-CANON-0.2-ALPHA2", "protocol_profile_ref": "seed/canonical/protocol/protocol-profile.json", "publication": { @@ -437,6 +481,11 @@ "pt-BR": "Esta edição é derivada do cânone legível por máquina.", "ru": "Эта редакция выводится из машинного канона." }, + "operations": { + "en": "Operations", + "pt-BR": "Operações", + "ru": "Операции" + }, "predicate": { "en": "Predicate", "pt-BR": "Predicado", @@ -452,11 +501,6 @@ "pt-BR": "Status", "ru": "Статус" }, - "transitions": { - "en": "Transitions", - "pt-BR": "Transições", - "ru": "Переходы" - }, "version": { "en": "Version", "pt-BR": "Versão", @@ -538,9 +582,9 @@ "source": "ASET Seed 0.3 minimal strong core", "subject": "ASET Seed", "texts": { - "en": "An exact bound effect MUST be permitted if and only if the unique valid terminal ResolutionRecord is ALLOW.", - "pt-BR": "Um efeito exatamente vinculado DEVE ser permitido se, e somente se, o único ResolutionRecord terminal válido for ALLOW.", - "ru": "Точно связанный эффект ДОЛЖЕН быть разрешён тогда и только тогда, когда единственная действительная терминальная ResolutionRecord имеет значение ALLOW." + "en": "An exact bound effect MUST be permitted if and only if the accepted authoritative terminal ResolutionRecord is ALLOW and no valid terminal conflict is observed.", + "pt-BR": "Um efeito exatamente vinculado DEVE ser permitido se, e somente se, o ResolutionRecord terminal autoritativo aceito for ALLOW e nenhum conflito terminal válido for observado.", + "ru": "Точно связанный эффект ДОЛЖЕН быть разрешён тогда и только тогда, когда принятая авторитетная терминальная ResolutionRecord имеет значение ALLOW и не наблюдается действительный терминальный конфликт." }, "verification": [ "ASET-VERIFY-DECLARATIVE-STATE-VALIDATION", @@ -558,9 +602,9 @@ "source": "ASET Seed 0.3 minimal strong core", "subject": "ASET Seed", "texts": { - "en": "UNKNOWN and BLOCK MUST prohibit the effect. Missing or ambiguous valid terminal state, or failure to establish a valid terminal record, MUST resolve to UNKNOWN. Invalid or non-authoritative material MUST NOT override an otherwise unique valid terminal record.", - "pt-BR": "UNKNOWN e BLOCK DEVEM proibir o efeito. Estado terminal válido ausente ou ambíguo, ou falha em estabelecer um registro terminal válido, DEVE resultar em UNKNOWN. Material inválido ou não autoritativo NÃO DEVE substituir um registro terminal válido e único.", - "ru": "UNKNOWN и BLOCK ДОЛЖНЫ запрещать эффект. Отсутствие или неоднозначность действительного терминального состояния либо невозможность установить действительную терминальную запись ДОЛЖНЫ давать UNKNOWN. Недействительный или неавторитетный материал НЕ ДОЛЖЕН переопределять уже установленную единственную действительную терминальную запись." + "en": "UNKNOWN and BLOCK MUST prohibit the effect. Missing accepted terminal state, failure to establish an authoritative terminal record, or observation of additional conflicting valid terminal material MUST resolve to UNKNOWN. Invalid or non-authoritative material MUST NOT override an otherwise authoritative accepted terminal record.", + "pt-BR": "UNKNOWN e BLOCK DEVEM proibir o efeito. Estado terminal aceito ausente, falha em estabelecer um registro terminal autoritativo ou observação de material terminal válido conflitante adicional DEVE resultar em UNKNOWN. Material inválido ou não autoritativo NÃO DEVE substituir um registro terminal autoritativo já aceito.", + "ru": "UNKNOWN и BLOCK ДОЛЖНЫ запрещать эффект. Отсутствие принятого терминального состояния, невозможность установить авторитетную терминальную запись либо наблюдение дополнительного конфликтующего действительного терминального материала ДОЛЖНЫ давать UNKNOWN. Недействительный или неавторитетный материал НЕ ДОЛЖЕН переопределять уже принятую авторитетную терминальную запись." }, "verification": [ "ASET-VERIFY-DECLARATIVE-STATE-VALIDATION", @@ -633,14 +677,14 @@ { "area": "minimal resolution-recognition kernel", "id": "ASET-SEED-REQ-009", - "modality": "MAY", - "predicate": "terminal_unique", + "modality": "MUST", + "predicate": "accepted_terminal_unique", "source": "ASET Seed 0.3 minimal strong core", "subject": "ASET Seed", "texts": { - "en": "At most one valid terminal record MAY exist for one resolution_id; conflicting terminal records MUST fail closed as UNKNOWN.", - "pt-BR": "No máximo um registro terminal válido PODE existir para um resolution_id; registros terminais conflitantes DEVEM falhar de modo fechado como UNKNOWN.", - "ru": "Для одного resolution_id МОЖЕТ существовать не более одной действительной терминальной записи; конфликтующие терминальные записи ДОЛЖНЫ давать fail-closed UNKNOWN." + "en": "Seed-owned state MUST accept at most one terminal record for one resolution_id. Observation of additional distinct valid terminal material for an already accepted terminal resolution MUST fail closed as UNKNOWN without replacing the accepted record.", + "pt-BR": "O estado pertencente ao Seed DEVE aceitar no máximo um registro terminal para um resolution_id. A observação de material terminal válido distinto adicional para uma resolução terminal já aceita DEVE falhar de modo fechado como UNKNOWN sem substituir o registro aceito.", + "ru": "Принадлежащее Seed состояние ДОЛЖНО принимать не более одной терминальной записи для одного resolution_id. Наблюдение дополнительного отличающегося действительного терминального материала для уже принятого терминального разрешения ДОЛЖНО давать fail-closed UNKNOWN без замены принятой записи." }, "verification": [ "ASET-VERIFY-DECLARATIVE-STATE-VALIDATION", @@ -723,58 +767,14 @@ "ALLOW", "BLOCK" ], - "unknown_semantics": "No unique valid terminal ResolutionRecord is established for the exact request binding, or conflicting valid terminal records are observed.", + "unknown_semantics": "No authoritative accepted terminal ResolutionRecord is established for the exact request binding, or additional conflicting valid terminal material is observed for an accepted terminal resolution.", "values": [ "UNKNOWN", "ALLOW", "BLOCK" ] }, - "schema_version": 4, + "schema_version": 5, "status": "MINIMAL_STRONG_CORE_ALPHA", - "transitions": [ - { - "authority_rule": "The initial Authority binding must be locally rooted and exactly match the request binding.", - "binding_rule": "The request contains one canonical exact binding and a fresh resolution_id. For reconsideration, previous_terminal_record_digest must be a recognized immutable terminal-record commitment; predecessor object presence in retained storage is not required.", - "created_artifacts": [ - "ResolutionRequest" - ], - "from_resolution": null, - "id": "SEED-TX-001", - "kind": "REGISTER_REQUEST", - "payload_schema": "seed/canonical/protocol/schemas/payload-register-request.schema.json", - "role": "STATE_TRANSITION", - "terminal": false, - "to_resolution": "UNKNOWN" - }, - { - "authority_rule": "The record Authority must be explicitly recognized for the exact request binding. Concrete signatures, delegation chains and proof construction are external validation mechanisms.", - "binding_rule": "The record request_digest and binding_digest must exactly match the registered request.", - "created_artifacts": [ - "ResolutionRecord" - ], - "from_resolution": "UNKNOWN", - "id": "SEED-TX-002", - "kind": "SUBMIT_RESOLUTION", - "payload_schema": "seed/canonical/protocol/schemas/payload-submit-resolution.schema.json", - "role": "STATE_TRANSITION", - "terminal": true, - "to_resolution": "ALLOW_OR_BLOCK" - }, - { - "authority_rule": "Evaluation creates no Authority and accepts no external statement as a resolution.", - "binding_rule": "Evaluation observes one resolution_id without mutating Seed-owned state. It derives UNKNOWN when no unique valid terminal record is established; invalid or non-authoritative material cannot override a unique valid record.", - "created_artifacts": [ - "ResolutionEvaluation" - ], - "from_resolution": null, - "id": "SEED-TX-003", - "kind": "EVALUATE_RESOLUTION", - "payload_schema": "seed/canonical/protocol/schemas/operation.schema.json", - "role": "OBSERVER", - "terminal": false, - "to_resolution": "DERIVED" - } - ], "version": "0.3.0-alpha.1" } diff --git a/tests/test_canonical_model.py b/tests/test_canonical_model.py index aade692..70c5efc 100644 --- a/tests/test_canonical_model.py +++ b/tests/test_canonical_model.py @@ -12,9 +12,14 @@ def test_localization_is_complete(): def test_minimal_resolution_algebra_is_exact(): algebra=model()['resolution_algebra']; assert algebra['values']==['UNKNOWN','ALLOW','BLOCK']; assert algebra['stored_terminal']==['ALLOW','BLOCK']; assert algebra['effect_permitted_if']=='ALLOW' def test_operations_are_minimal(): - transitions=model()['transitions'] - assert [item['kind'] for item in transitions]==['REGISTER_REQUEST','SUBMIT_RESOLUTION','EVALUATE_RESOLUTION'] - assert [item['role'] for item in transitions]==['STATE_TRANSITION','STATE_TRANSITION','OBSERVER'] + operations=model()['operations'] + assert [item['kind'] for item in operations]==[ + 'REGISTER_REQUEST','SUBMIT_RESOLUTION','EVALUATE_RESOLUTION' + ] + assert [item['role'] for item in operations]==['STATE_TRANSITION','STATE_TRANSITION','OBSERVER'] + assert [item['id'] for item in operations]==[ + 'SEED-OP-001','SEED-OP-002','SEED-OP-003' + ] def test_protocol_directory_contains_only_active_profile_schemas(): profile=json.loads((ROOT/'seed/canonical/protocol/protocol-profile.json').read_text(encoding='utf-8')) diff --git a/tests/test_ci_assurance.py b/tests/test_ci_assurance.py index 2a7697d..286b5fc 100644 --- a/tests/test_ci_assurance.py +++ b/tests/test_ci_assurance.py @@ -124,8 +124,9 @@ def test_seed_resolution_tla_uses_valid_operator_tokens(): assert r"/\\" not in specification assert "Range(" not in specification assert "VARIABLES\n requestMeta,\n terminalMeta,\n conflicts" in specification - assert "RequestAuthorityBindings" in specification - assert "TerminalAuthorityBindings" in specification + assert "RecognizedAuthorityBindings" in specification + assert "RequestAuthorityBindings" not in specification + assert "TerminalAuthorityBindings" not in specification assert "observedInputs" not in specification assert "invalidMaterial" not in specification assert "terminalBinding," not in specification @@ -144,11 +145,11 @@ def test_seed_resolution_tlc_treats_terminal_states_as_intended_quiescence(): configuration = (ROOT / "seed/canonical/formal/SeedResolution.cfg").read_text( encoding="utf-8" ) - assert "TerminalUnique ==" in specification + assert "AcceptedTerminalUnique ==" in specification + assert r"r \in TerminalRequests \ conflicts" in specification assert "CHECK_DEADLOCK FALSE" in configuration - assert "RequestAuthorityBindings <- TLC_RequestAuthorityBindings" in configuration - assert "TerminalAuthorityBindings <- TLC_TerminalAuthorityBindings" in configuration - assert r"RequestAuthorityBindings \subseteq TerminalAuthorityBindings" in specification + assert "RecognizedAuthorityBindings <- TLC_RecognizedAuthorityBindings" in configuration + assert r"RecognizedAuthorityBindings \subseteq Authorities \X Bindings" in specification def test_active_audit_index_tracks_active_canon_package(): @@ -180,7 +181,7 @@ def test_canon_tla_refinement_relation_is_complete_and_mandatory(): assert len(relation["requirement_coverage"]) == 12 assert len(relation["invariant_coverage"]) == 12 - assert len(relation["transition_coverage"]) == 3 + assert len(relation["operation_coverage"]) == 3 assert len(relation["resolution_algebra_fields"]) == 7 assert relation["proof"]["final_theorem"] == ( "SeedResolutionBehaviorallyEquivalentToCanonProjection" @@ -188,7 +189,7 @@ def test_canon_tla_refinement_relation_is_complete_and_mandatory(): projection = (ROOT / "seed/canonical/formal/SeedCanonProjection.tla").read_text(encoding="utf-8") assert "EXTENDS SeedResolution" not in projection assert "INSTANCE SeedResolution" not in projection - assert "V4 is a standalone projection" in projection + assert "V5 is a standalone projection" in projection assert len(gates["gates"]) >= 26 diff --git a/tests/test_invariant_coverage.py b/tests/test_invariant_coverage.py index f4827da..3df3c92 100644 --- a/tests/test_invariant_coverage.py +++ b/tests/test_invariant_coverage.py @@ -21,8 +21,8 @@ def test_coverage_closes_exact_canonical_sets() -> None: assert {item["id"] for item in coverage["invariants"]} == { item["id"] for item in model["invariants"] } - assert {item["id"] for item in coverage["transitions"]} == { - item["id"] for item in model["transitions"] + assert {item["id"] for item in coverage["operations"]} == { + item["id"] for item in model["operations"] } diff --git a/tools/blackbox_documentation_audit.py b/tools/blackbox_documentation_audit.py index 3909837..40c665f 100755 --- a/tools/blackbox_documentation_audit.py +++ b/tools/blackbox_documentation_audit.py @@ -16,6 +16,7 @@ ROOT / "docs/repository/PRODUCTION_READINESS.md", ROOT / "docs/repository/OPERATIONS_RUNBOOK.md", ROOT / "docs/repository/RELEASE_PROCESS.md", + ROOT / "docs/repository/BLACK_BOX_AUDIT_METHOD.md", ROOT / "audit/README.md", ROOT / "audit/ACTIVE_AUDIT_INDEX.md", ROOT / "EXTENSIONS.md", diff --git a/tools/build_canon_package.py b/tools/build_canon_package.py index a13fe0c..88f126f 100644 --- a/tools/build_canon_package.py +++ b/tools/build_canon_package.py @@ -43,6 +43,7 @@ "seed/canonical/decisions/ADR-007-reconsideration-commitments-and-bounded-retention.md", "seed/canonical/decisions/ADR-008-normalize-seed-state-by-construction.md", "seed/canonical/decisions/ADR-009-seed-state-environment-observer-and-authority-boundary.md", + "seed/canonical/decisions/ADR-010-unify-authority-conflict-and-operation-semantics.md", "seed/canonical/migration/CANON_CHANGE_DECLARATION.json", "seed/canonical/migration/WIRE_V2_TO_V3.md", ] diff --git a/tools/check_assurance_traceability.py b/tools/check_assurance_traceability.py index ca34806..8a09748 100755 --- a/tools/check_assurance_traceability.py +++ b/tools/check_assurance_traceability.py @@ -201,28 +201,29 @@ def main() -> int: f"formal requirement coverage incomplete: missing={sorted(requirement_ids - formal_requirement_coverage)}" ) - transition_counts: dict[str, Counter[str]] = {} + operation_counts: dict[str, Counter[str]] = {} for entry in profile["cases"]: case = load(ROOT / entry["path"]) kind = case.get("candidate", {}).get("kind") if not isinstance(kind, str): errors.append(f"case {entry['case_id']} has no candidate kind") continue - transition_counts.setdefault(kind, Counter())[entry["polarity"]] += 1 + operation_counts.setdefault(kind, Counter())[entry["polarity"]] += 1 - declared_kinds = {item["kind"] for item in model["transitions"]} - if set(transition_counts) - declared_kinds: + declared_kinds = {item["kind"] for item in model["operations"]} + if set(operation_counts) - declared_kinds: errors.append( - f"cases reference undeclared transition kinds: {sorted(set(transition_counts) - declared_kinds)}" + "cases reference undeclared operation kinds: " + f"{sorted(set(operation_counts) - declared_kinds)}" ) - policy = registry["transition_case_policy"] + policy = registry["operation_case_policy"] exceptions = { - (item["transition_kind"], item["missing_polarity"]): item + (item["operation_kind"], item["missing_polarity"]): item for item in policy.get("declared_exceptions", []) } for kind in sorted(declared_kinds): - counts = transition_counts.get(kind, Counter()) + counts = operation_counts.get(kind, Counter()) for polarity, required in ( ("positive", policy.get("require_positive_case", False)), ("negative", policy.get("require_negative_case", False)), @@ -232,7 +233,7 @@ def main() -> int: and counts[polarity] == 0 and (kind, polarity) not in exceptions ): - errors.append(f"transition {kind} has no {polarity} conformance case") + errors.append(f"operation {kind} has no {polarity} conformance case") report = { "document_type": "aset-assurance-traceability-report", @@ -244,11 +245,11 @@ def main() -> int: "tla_temporal_properties": cfg["PROPERTIES"], "formal_seed_requirements_covered": sorted(formal_requirement_coverage), "formal_seed_invariants_covered": sorted(formal_invariant_coverage), - "transition_case_counts": { + "operation_case_counts": { key: dict(sorted(value.items())) - for key, value in sorted(transition_counts.items()) + for key, value in sorted(operation_counts.items()) }, - "declared_transition_coverage_exceptions": list(exceptions.values()), + "declared_operation_coverage_exceptions": list(exceptions.values()), "tlaps_proof_module": ("seed/canonical/formal/SeedResolutionProofs.tla"), "tlaps_final_theorems": list(TLAPS_FINAL_THEOREMS), "errors": errors, diff --git a/tools/check_canon_compatibility.py b/tools/check_canon_compatibility.py index 4a23fa9..9e35044 100755 --- a/tools/check_canon_compatibility.py +++ b/tools/check_canon_compatibility.py @@ -108,7 +108,12 @@ def main() -> int: "concepts": compare_group(approved, candidate, "concepts", "id"), "requirements": compare_group(approved, candidate, "requirements", "id"), "invariants": compare_group(approved, candidate, "invariants", "id"), - "transitions": compare_group(approved, candidate, "transitions", "kind"), + "operations": compare_group( + {"operations": approved.get("operations", approved.get("transitions", []))}, + {"operations": candidate.get("operations", candidate.get("transitions", []))}, + "operations", + "kind", + ), } ignored = { "assurance", @@ -122,7 +127,8 @@ def main() -> int: key for key in set(approved) | set(candidate) if key not in ignored - and key not in {"concepts", "requirements", "invariants", "transitions"} + and key + not in {"concepts", "requirements", "invariants", "operations", "transitions"} and approved.get(key) != candidate.get(key) ) report: dict[str, Any] = { diff --git a/tools/check_canon_tla_refinement.py b/tools/check_canon_tla_refinement.py index a1d49b3..50b5bb5 100755 --- a/tools/check_canon_tla_refinement.py +++ b/tools/check_canon_tla_refinement.py @@ -140,16 +140,16 @@ def main() -> int: "SUBMIT_RESOLUTION": "SubmitResolution", "EVALUATE_RESOLUTION": "EvaluateResolution", } - expected_transitions = [ + expected_operations = [ (item["id"], item["kind"], action_by_kind[item["kind"]]) - for item in model["transitions"] + for item in model["operations"] ] - actual_transitions = [ + actual_operations = [ (item["id"], item["kind"], item["tla_action"]) - for item in relation["transition_coverage"] + for item in relation["operation_coverage"] ] - if actual_transitions != expected_transitions: - errors.append("transition coverage differs from machine canon") + if actual_operations != expected_operations: + errors.append("operation coverage differs from machine canon") if set(relation["resolution_algebra_fields"]) != set(model["resolution_algebra"]): errors.append("resolution algebra field coverage differs from machine canon") @@ -166,7 +166,7 @@ def main() -> int: projection_text = PROJECTION_PATH.read_text(encoding="utf-8") if PROJECTION_PATH.is_file() else "" if "EXTENDS SeedResolution" in projection_text or "INSTANCE SeedResolution" in projection_text: errors.append("generated projection depends on target SeedResolution module") - if "V4 is a standalone projection" not in projection_text: + if "V5 is a standalone projection" not in projection_text: errors.append("standalone projection marker missing") generator = subprocess.run( @@ -195,7 +195,7 @@ def main() -> int: ), "requirements_classified": len(actual_requirements), "invariants_classified": len(actual_invariants), - "transitions_classified": len(actual_transitions), + "operations_classified": len(actual_operations), "resolution_algebra_fields_classified": len( relation["resolution_algebra_fields"] ), @@ -219,7 +219,7 @@ def main() -> int: ) print(f"CANON_TLA_INVARIANTS={len(actual_invariants)}/{len(expected_invariants)}") print( - f"CANON_TLA_TRANSITIONS={len(actual_transitions)}/{len(expected_transitions)}" + f"CANON_TLA_OPERATIONS={len(actual_operations)}/{len(expected_operations)}" ) print( "CANON_TLA_RESOLUTION_ALGEBRA=" diff --git a/tools/check_invariant_coverage.py b/tools/check_invariant_coverage.py index d8024dc..4794fc6 100755 --- a/tools/check_invariant_coverage.py +++ b/tools/check_invariant_coverage.py @@ -34,14 +34,14 @@ def main() -> int: requirement_ids = {item["id"] for item in model["requirements"]} invariant_ids = {item["id"] for item in model["invariants"]} - transition_ids = {item["id"] for item in model["transitions"]} + operation_ids = {item["id"] for item in model["operations"]} case_entries = {item["case_id"]: item for item in profile["cases"]} formal_names = {item["name"] for item in registry["formal_properties"]} mutation_ids = {item["id"] for item in coverage["mutation_catalog"]} covered_requirements = {item["id"] for item in coverage["requirements"]} covered_invariants = {item["id"] for item in coverage["invariants"]} - covered_transitions = {item["id"] for item in coverage["transitions"]} + covered_operations = {item["id"] for item in coverage["operations"]} if covered_requirements != requirement_ids: errors.append( f"requirement coverage mismatch: missing={sorted(requirement_ids-covered_requirements)} " @@ -52,10 +52,10 @@ def main() -> int: f"invariant coverage mismatch: missing={sorted(invariant_ids-covered_invariants)} " f"extra={sorted(covered_invariants-invariant_ids)}" ) - if covered_transitions != transition_ids: + if covered_operations != operation_ids: errors.append( - f"transition coverage mismatch: missing={sorted(transition_ids-covered_transitions)} " - f"extra={sorted(covered_transitions-transition_ids)}" + f"operation coverage mismatch: missing={sorted(operation_ids-covered_operations)} " + f"extra={sorted(covered_operations-operation_ids)}" ) referenced_formal: set[str] = set() @@ -79,7 +79,7 @@ def main() -> int: if invariant_id not in invariant_ids: errors.append(f"{entry['id']} references unknown invariant {invariant_id}") - for entry in coverage["transitions"]: + for entry in coverage["operations"]: for case_id in entry["positive_cases"]: if case_id not in case_entries or case_entries[case_id]["polarity"] != "positive": errors.append(f"{entry['id']} invalid positive case {case_id}") @@ -114,8 +114,8 @@ def main() -> int: "requirements_covered": len(covered_requirements & requirement_ids), "invariants_total": len(invariant_ids), "invariants_covered": len(covered_invariants & invariant_ids), - "transitions_total": len(transition_ids), - "transitions_covered": len(covered_transitions & transition_ids), + "operations_total": len(operation_ids), + "operations_covered": len(covered_operations & operation_ids), "formal_properties": len(formal_names), "conformance_cases": len(case_entries), "semantic_mutations": len(mutation_ids), @@ -129,7 +129,7 @@ def main() -> int: print(f"INVARIANT_COVERAGE_REQUIREMENTS={report['requirements_covered']}/{report['requirements_total']}") print(f"INVARIANT_COVERAGE_INVARIANTS={report['invariants_covered']}/{report['invariants_total']}") - print(f"INVARIANT_COVERAGE_TRANSITIONS={report['transitions_covered']}/{report['transitions_total']}") + print(f"INVARIANT_COVERAGE_OPERATIONS={report['operations_covered']}/{report['operations_total']}") print(f"INVARIANT_COVERAGE_FORMAL_PROPERTIES={report['formal_properties']}") print(f"INVARIANT_COVERAGE_CONFORMANCE_CASES={report['conformance_cases']}") print(f"INVARIANT_COVERAGE_MUTATIONS={report['semantic_mutations_killed']}/{report['semantic_mutations']}") diff --git a/tools/generate_canon_tla_projection.py b/tools/generate_canon_tla_projection.py index 421d0f0..3506837 100755 --- a/tools/generate_canon_tla_projection.py +++ b/tools/generate_canon_tla_projection.py @@ -12,7 +12,7 @@ RELATION_PATH = ROOT / "seed/canonical/assurance/canon-tla-refinement.json" OUTPUT_PATH = ROOT / "seed/canonical/formal/SeedCanonProjection.tla" -EXPECTED_PROFILE = "ASET-SEED-CANON-TLA-PROJECTION-V4" +EXPECTED_PROFILE = "ASET-SEED-CANON-TLA-PROJECTION-V5" EXPECTED_REQUIREMENT_PREDICATES = [ "binding_exact", "request_fresh", @@ -22,15 +22,15 @@ "local_authority", "authority_recognition_boundary", "inputs_non_authoritative", - "terminal_unique", + "accepted_terminal_unique", "record_immutable", "reconsider_fresh", "implementation_neutral", ] -EXPECTED_TRANSITIONS = [ - ("SEED-TX-001", "REGISTER_REQUEST", "STATE_TRANSITION"), - ("SEED-TX-002", "SUBMIT_RESOLUTION", "STATE_TRANSITION"), - ("SEED-TX-003", "EVALUATE_RESOLUTION", "OBSERVER"), +EXPECTED_OPERATIONS = [ + ("SEED-OP-001", "REGISTER_REQUEST", "STATE_TRANSITION"), + ("SEED-OP-002", "SUBMIT_RESOLUTION", "STATE_TRANSITION"), + ("SEED-OP-003", "EVALUATE_RESOLUTION", "OBSERVER"), ] EXPECTED_INVARIANTS = [f"SEED-INV-{index:03d}" for index in range(1, 13)] @@ -73,10 +73,10 @@ def validate_inputs(model: dict[str, Any], relation: dict[str, Any]) -> None: invariants = [item["id"] for item in model["invariants"]] if invariants != EXPECTED_INVARIANTS: errors.append("unsupported invariant catalogue") - transitions = [ - (item["id"], item["kind"], item["role"]) for item in model["transitions"] + operations = [ + (item["id"], item["kind"], item["role"]) for item in model["operations"] ] - if transitions != EXPECTED_TRANSITIONS: + if operations != EXPECTED_OPERATIONS: errors.append("unsupported operation catalogue") algebra = model["resolution_algebra"] @@ -111,7 +111,7 @@ def render(model: dict[str, Any], relation: dict[str, Any]) -> str: Source SHA-256: {source_sha} Projection profile: {profile} -V4 is a standalone projection. It does not EXTEND or import SeedResolution. +V5 is a standalone projection. It does not EXTEND or import SeedResolution. The refinement proof explicitly instantiates this model onto the target state. Seed-owned state is requestMeta + terminalMeta. Conflict is environment state. EVALUATE_RESOLUTION is a pure observer and is not part of CanonNext. @@ -119,16 +119,14 @@ def render(model: dict[str, Any], relation: dict[str, Any]) -> str: CONSTANTS ResolutionIds, Bindings, Authorities, TerminalCommitments, RecognizedTerminalCommitments, NoCommitment, - RequestAuthorityBindings, TerminalAuthorityBindings + RecognizedAuthorityBindings ASSUME ResolutionIds # {{}} ASSUME Bindings # {{}} ASSUME Authorities # {{}} ASSUME RecognizedTerminalCommitments \subseteq TerminalCommitments ASSUME NoCommitment \notin TerminalCommitments -ASSUME RequestAuthorityBindings \subseteq Authorities \X Bindings -ASSUME TerminalAuthorityBindings \subseteq Authorities \X Bindings -ASSUME RequestAuthorityBindings \subseteq TerminalAuthorityBindings +ASSUME RecognizedAuthorityBindings \subseteq Authorities \X Bindings CanonResolutions == {tla_set(algebra["values"])} CanonTerminalResolutions == {tla_set(algebra["stored_terminal"])} @@ -167,7 +165,7 @@ def render(model: dict[str, Any], relation: dict[str, Any]) -> str: /\ r \in ResolutionIds \ CanonRequests /\ b \in Bindings /\ a \in Authorities - /\ <> \in RequestAuthorityBindings + /\ <> \in RecognizedAuthorityBindings /\ \/ previous = NoCommitment \/ previous \in RecognizedTerminalCommitments /\ requestMeta' = @@ -181,7 +179,7 @@ def render(model: dict[str, Any], relation: dict[str, Any]) -> str: /\ r \in CanonRequests /\ b = CanonRequestBinding(r) /\ a \in Authorities - /\ <> \in TerminalAuthorityBindings + /\ <> \in RecognizedAuthorityBindings /\ value \in CanonTerminalResolutions /\ r \notin CanonTerminalRequests /\ r \notin conflicts @@ -193,7 +191,7 @@ def render(model: dict[str, Any], relation: dict[str, Any]) -> str: /\ UNCHANGED <> CanonObserveConflict(r) == - /\ r \in ResolutionIds + /\ r \in CanonTerminalRequests \ conflicts /\ conflicts' = conflicts \cup {{r}} /\ UNCHANGED CanonSeedVars diff --git a/tools/generate_editions.py b/tools/generate_editions.py index 4946444..cf406d7 100644 --- a/tools/generate_editions.py +++ b/tools/generate_editions.py @@ -90,18 +90,18 @@ def render(model: dict, language: str) -> str: lines.extend([f'## {headings["invariants"][language]}', ""]) for invariant in model["invariants"]: lines.append(f'- `{invariant["id"]}` — {invariant["texts"][language]}') - lines.extend(["", f'## {headings["transitions"][language]}', ""]) - for transition in model["transitions"]: + lines.extend(["", f'## {headings["operations"][language]}', ""]) + for operation in model["operations"]: lines.extend( [ - f'### `{transition["id"]}` — `{transition["kind"]}`', + f'### `{operation["id"]}` — `{operation["kind"]}`', "", - f'- `payload_schema`: `{transition["payload_schema"]}`', - f'- `authority_rule`: {transition["authority_rule"]}', - f'- `binding_rule`: {transition["binding_rule"]}', + f'- `payload_schema`: `{operation["payload_schema"]}`', + f'- `authority_rule`: {operation["authority_rule"]}', + f'- `binding_rule`: {operation["binding_rule"]}', "- `created_artifacts`: " + ", ".join( - f"`{item}`" for item in transition["created_artifacts"] + f"`{item}`" for item in operation["created_artifacts"] ), "", ] diff --git a/tools/model_check_seed.py b/tools/model_check_seed.py index a75b19f..420c641 100755 --- a/tools/model_check_seed.py +++ b/tools/model_check_seed.py @@ -14,8 +14,7 @@ TERMINALS = ("ALLOW", "BLOCK") NO_COMMITMENT = -1 RECOGNIZED_TERMINAL_COMMITMENTS = frozenset({0, 1}) -REQUEST_AUTHORITY_BINDINGS = frozenset({(0, 0), (1, 1)}) -TERMINAL_AUTHORITY_BINDINGS = frozenset({(0, 0), (1, 1), (1, 0)}) +RECOGNIZED_AUTHORITY_BINDINGS = frozenset({(0, 0), (1, 1), (1, 0)}) STATE_PROPERTIES = ( "TypeOK", @@ -25,8 +24,8 @@ "TerminalBindingDerived", "RequestAuthorityRecognized", "TerminalAuthorityRecognized", - "TerminalUnique", - "ConflictUnknown", + "AcceptedTerminalUnique", + "ConflictSound", "FreshReconsideration", ) TEMPORAL_PROPERTIES = ( @@ -83,7 +82,7 @@ def successors(state: State) -> Iterable[tuple[str, State]]: for rid in IDS: if rid in requests: continue - for binding, _authority in REQUEST_AUTHORITY_BINDINGS: + for _authority, binding in RECOGNIZED_AUTHORITY_BINDINGS: yield ( "RegisterRequest", State( @@ -105,7 +104,7 @@ def successors(state: State) -> Iterable[tuple[str, State]]: for rid, (binding, _previous) in requests.items(): if rid in records or rid in state.conflicts: continue - for authority, proof_binding in TERMINAL_AUTHORITY_BINDINGS: + for authority, proof_binding in RECOGNIZED_AUTHORITY_BINDINGS: if proof_binding != binding: continue for value in TERMINALS: @@ -118,7 +117,7 @@ def successors(state: State) -> Iterable[tuple[str, State]]: ), ) - for rid in IDS: + for rid in records: if rid not in state.conflicts: yield ( "ObserveConflict", @@ -139,19 +138,19 @@ def state_errors(state: State) -> list[str]: if not set(records).issubset(requests): errors.append("TerminalBindingDerived") if len(records) != len(state.records): - errors.append("TerminalUnique") + errors.append("AcceptedTerminalUnique") for _rid, (binding, _previous) in requests.items(): if not any( authority in AUTHORITIES - and (authority, binding) in REQUEST_AUTHORITY_BINDINGS + and (authority, binding) in RECOGNIZED_AUTHORITY_BINDINGS for authority in AUTHORITIES ): errors.append("RequestAuthorityRecognized") for rid, (authority, _value) in records.items(): request = requests.get(rid) - if request is None or (authority, request[0]) not in TERMINAL_AUTHORITY_BINDINGS: + if request is None or (authority, request[0]) not in RECOGNIZED_AUTHORITY_BINDINGS: errors.append("TerminalAuthorityRecognized") for rid in IDS: @@ -167,7 +166,7 @@ def state_errors(state: State) -> list[str]: or rid in state.conflicts or record is None or record[1] != "ALLOW" - or (record[0], request[0]) not in TERMINAL_AUTHORITY_BINDINGS + or (record[0], request[0]) not in RECOGNIZED_AUTHORITY_BINDINGS ): errors.append("AllowSoundness") @@ -175,7 +174,7 @@ def state_errors(state: State) -> list[str]: errors.append("FailClosed") if rid in state.conflicts and value != "UNKNOWN": - errors.append("ConflictUnknown") + errors.append("ConflictSound") for _rid, (_binding, previous) in requests.items(): if previous == NO_COMMITMENT: diff --git a/tools/validate_seed_canon.py b/tools/validate_seed_canon.py index 14f05e8..a03c8ee 100644 --- a/tools/validate_seed_canon.py +++ b/tools/validate_seed_canon.py @@ -79,17 +79,17 @@ def main() -> int: ids = [item["id"] for item in model[group]] if len(ids) != len(set(ids)): errors.append("duplicate:" + group) - kinds = [item["kind"] for item in model["transitions"]] + kinds = [item["kind"] for item in model["operations"]] expected_kinds = [ "REGISTER_REQUEST", "SUBMIT_RESOLUTION", "EVALUATE_RESOLUTION", ] if kinds != expected_kinds: - errors.append("transition_catalogue") - roles = [item.get("role") for item in model["transitions"]] + errors.append("operation_catalogue") + roles = [item.get("role") for item in model["operations"]] if roles != ["STATE_TRANSITION", "STATE_TRANSITION", "OBSERVER"]: - errors.append("transition_roles") + errors.append("operation_roles") if model["resolution_algebra"] != { "values": ["UNKNOWN", "ALLOW", "BLOCK"], "derived": "UNKNOWN", @@ -210,7 +210,13 @@ def main() -> int: print(f"SEED_CONCEPTS={len(model['concepts'])}") print(f"SEED_REQUIREMENTS={len(model['requirements'])}") print(f"SEED_INVARIANTS={len(model['invariants'])}") - print(f"SEED_TRANSITIONS={len(model['transitions'])}") + print(f"SEED_OPERATIONS={len(model['operations'])}") + state_transition_count = sum( + item.get("role") == "STATE_TRANSITION" for item in model["operations"] + ) + observer_count = sum(item.get("role") == "OBSERVER" for item in model["operations"]) + print(f"SEED_STATE_TRANSITIONS={state_transition_count}") + print(f"SEED_OBSERVERS={observer_count}") print(f"SEED_CONFORMANCE_CASES={profile['case_count']}") print("SEED_CANON_VALIDATION=PASS") return 0