{ "schema": "concresca.interoperability-protocols.v016", "site_version": "0.28.0-wip", "as_of": "2026-08-31", "truth_boundary": "Technical-governance proposal. It is not a deployed cross-project protocol and does not create Eviulon or Evulgare authority.", "governance_assurance_boundary": { "governance_plane": [ "law", "rights", "jurisdiction", "institution", "authorized purpose", "review authority", "constitutional limits" ], "assurance_plane": [ "identity", "attestation", "authority freshness", "purpose compatibility", "software/model version", "configuration", "evidence integrity", "uncertainty", "runtime compliance", "recovery", "provenance" ], "rule": "A technically valid command can be constitutionally invalid; a constitutionally valid command can fail technical assurance." }, "stack": [ { "id": "G0", "name": "IDENTITY", "question": "Who is communicating?" }, { "id": "G1", "name": "AUTHENTICATION", "question": "Can the sender prove control of the asserted identity?" }, { "id": "G2", "name": "AUTHORITY", "question": "What source authorizes the institution?" }, { "id": "G3", "name": "JURISDICTION", "question": "Over what subject and matter does that authority apply?" }, { "id": "G4", "name": "PURPOSE", "question": "Why is this request being made?" }, { "id": "G5", "name": "DATA SCOPE", "question": "What minimum data may cross the boundary?" }, { "id": "G6", "name": "EPISTEMIC TYPE", "question": "Observation, inference, prediction, allegation, corroborated evidence or adjudicated fact?" }, { "id": "G7", "name": "ACTION SCOPE", "question": "What may the receiver do?" }, { "id": "G8", "name": "TEMPORAL SCOPE", "question": "When does authority/evidence expire?" }, { "id": "G9", "name": "RIGHTS IMPACT", "question": "Which rights are affected?" }, { "id": "G10", "name": "TECHNICAL ASSURANCE", "question": "Are model, software, policy, configuration, evidence and runtime conditions attested?" }, { "id": "G11", "name": "EXECUTION", "question": "What bounded transition is actually permitted?" }, { "id": "G12", "name": "APPEAL", "question": "How is the decision challenged?" }, { "id": "G13", "name": "STAY", "question": "Can downstream consequences be paused?" }, { "id": "G14", "name": "RESTORATION", "question": "How are reversed consequences repaired?" }, { "id": "G15", "name": "AUDIT", "question": "What provenance remains?" }, { "id": "G16", "name": "REVOCATION", "question": "How is authority withdrawn?" } ], "constitutional_message_envelope": { "required_fields": [ "message_id", "message_type", "issuer", "institution", "authority_source", "jurisdiction", "purpose", "subject", "data_scope", "epistemic_type", "requested_action", "rights_affected", "severity_ceiling", "effective_time", "expiration", "emergency_status", "policy_version", "model_version", "software_configuration_version", "evidence_package", "uncertainty_state", "assurance_requirements", "appeal_route", "stay_state", "restoration_obligations", "audit_reference", "signature", "previous_message_relationship" ], "rule": "No high-impact message becomes executable merely because it is syntactically valid or correctly signed." }, "request_lifecycle": [ "REQUEST", "AUTHENTICATE", "VERIFY_AUTHORITY", "VERIFY_JURISDICTION", "VERIFY_PURPOSE", "MINIMIZE_DATA", "PRESERVE_EPISTEMIC_TYPE", "TEST_EVIDENCE", "TECHNICAL_ASSURANCE", "RIGHTS_GATE", "AUTHORIZE", "EXECUTE", "RECORD", "REVIEW", "APPEAL", "RESTORE_OR_EXPIRE" ], "states": [ "PROPOSED", "AUTHORITY_VERIFIED", "EVIDENCE_VERIFIED", "REVIEW_READY", "AUTHORIZED", "EXECUTED", "CHALLENGED", "STAYED", "APPEALED", "REVERSED", "RESTORATION_PENDING", "RESTORED", "EXPIRED", "REVOKED" ], "runbooks": [ { "id": "RB01", "name": "Receive high-impact external request", "trigger": "Operational trigger for receive high-impact external request.", "authorized_actors": [ "institutional authority owner", "independent reviewer where required" ], "inputs": [ "request or event", "authority record", "current policy/model/configuration versions", "relevant evidence and provenance" ], "preconditions": [ "identity/authentication separated from authority", "jurisdiction and purpose declared" ], "authority_checks": [ "source current", "scope sufficient", "not expired/revoked" ], "jurisdiction_checks": [ "subject matter", "data scope", "action scope" ], "evidence_checks": [ "epistemic type preserved", "freshness/provenance explicit", "unknowns remain explicit" ], "rights_gates": [ "affected right named", "least-restrictive and least-irreversible alternatives considered" ], "actions": [ "execute only bounded permitted transition", "record complete provenance" ], "prohibited_actions": [ "scope expansion by implementation", "silent type-casting", "irreversible downstream propagation during unresolved stay" ], "escalation": "Challenge, stay or independent review when a constitutional or assurance gate fails.", "time_limits": "Use explicit expiry/TTL appropriate to the authority; no permanent emergency inference.", "logging": "Append decision, versions, evidence references, gate outcomes and reviewer identity.", "appeal": "Expose review route and preserve stay state.", "restoration": "Propagate correction and require acknowledgement where downstream effects exist.", "fail_safe_state": "SAFE_HOLD / ABSTAIN / REQUIRE_REVIEW as appropriate; this is a design proposal, not a current production command." }, { "id": "RB02", "name": "Verify authority", "trigger": "Operational trigger for verify authority.", "authorized_actors": [ "institutional authority owner", "independent reviewer where required" ], "inputs": [ "request or event", "authority record", "current policy/model/configuration versions", "relevant evidence and provenance" ], "preconditions": [ "identity/authentication separated from authority", "jurisdiction and purpose declared" ], "authority_checks": [ "source current", "scope sufficient", "not expired/revoked" ], "jurisdiction_checks": [ "subject matter", "data scope", "action scope" ], "evidence_checks": [ "epistemic type preserved", "freshness/provenance explicit", "unknowns remain explicit" ], "rights_gates": [ "affected right named", "least-restrictive and least-irreversible alternatives considered" ], "actions": [ "execute only bounded permitted transition", "record complete provenance" ], "prohibited_actions": [ "scope expansion by implementation", "silent type-casting", "irreversible downstream propagation during unresolved stay" ], "escalation": "Challenge, stay or independent review when a constitutional or assurance gate fails.", "time_limits": "Use explicit expiry/TTL appropriate to the authority; no permanent emergency inference.", "logging": "Append decision, versions, evidence references, gate outcomes and reviewer identity.", "appeal": "Expose review route and preserve stay state.", "restoration": "Propagate correction and require acknowledgement where downstream effects exist.", "fail_safe_state": "SAFE_HOLD / ABSTAIN / REQUIRE_REVIEW as appropriate; this is a design proposal, not a current production command." }, { "id": "RB03", "name": "Challenge jurisdiction", "trigger": "Operational trigger for challenge jurisdiction.", "authorized_actors": [ "institutional authority owner", "independent reviewer where required" ], "inputs": [ "request or event", "authority record", "current policy/model/configuration versions", "relevant evidence and provenance" ], "preconditions": [ "identity/authentication separated from authority", "jurisdiction and purpose declared" ], "authority_checks": [ "source current", "scope sufficient", "not expired/revoked" ], "jurisdiction_checks": [ "subject matter", "data scope", "action scope" ], "evidence_checks": [ "epistemic type preserved", "freshness/provenance explicit", "unknowns remain explicit" ], "rights_gates": [ "affected right named", "least-restrictive and least-irreversible alternatives considered" ], "actions": [ "execute only bounded permitted transition", "record complete provenance" ], "prohibited_actions": [ "scope expansion by implementation", "silent type-casting", "irreversible downstream propagation during unresolved stay" ], "escalation": "Challenge, stay or independent review when a constitutional or assurance gate fails.", "time_limits": "Use explicit expiry/TTL appropriate to the authority; no permanent emergency inference.", "logging": "Append decision, versions, evidence references, gate outcomes and reviewer identity.", "appeal": "Expose review route and preserve stay state.", "restoration": "Propagate correction and require acknowledgement where downstream effects exist.", "fail_safe_state": "SAFE_HOLD / ABSTAIN / REQUIRE_REVIEW as appropriate; this is a design proposal, not a current production command." }, { "id": "RB04", "name": "Respond with minimum necessary data", "trigger": "Operational trigger for respond with minimum necessary data.", "authorized_actors": [ "institutional authority owner", "independent reviewer where required" ], "inputs": [ "request or event", "authority record", "current policy/model/configuration versions", "relevant evidence and provenance" ], "preconditions": [ "identity/authentication separated from authority", "jurisdiction and purpose declared" ], "authority_checks": [ "source current", "scope sufficient", "not expired/revoked" ], "jurisdiction_checks": [ "subject matter", "data scope", "action scope" ], "evidence_checks": [ "epistemic type preserved", "freshness/provenance explicit", "unknowns remain explicit" ], "rights_gates": [ "affected right named", "least-restrictive and least-irreversible alternatives considered" ], "actions": [ "execute only bounded permitted transition", "record complete provenance" ], "prohibited_actions": [ "scope expansion by implementation", "silent type-casting", "irreversible downstream propagation during unresolved stay" ], "escalation": "Challenge, stay or independent review when a constitutional or assurance gate fails.", "time_limits": "Use explicit expiry/TTL appropriate to the authority; no permanent emergency inference.", "logging": "Append decision, versions, evidence references, gate outcomes and reviewer identity.", "appeal": "Expose review route and preserve stay state.", "restoration": "Propagate correction and require acknowledgement where downstream effects exist.", "fail_safe_state": "SAFE_HOLD / ABSTAIN / REQUIRE_REVIEW as appropriate; this is a design proposal, not a current production command." }, { "id": "RB05", "name": "Receive conflicting orders", "trigger": "Operational trigger for receive conflicting orders.", "authorized_actors": [ "institutional authority owner", "independent reviewer where required" ], "inputs": [ "request or event", "authority record", "current policy/model/configuration versions", "relevant evidence and provenance" ], "preconditions": [ "identity/authentication separated from authority", "jurisdiction and purpose declared" ], "authority_checks": [ "source current", "scope sufficient", "not expired/revoked" ], "jurisdiction_checks": [ "subject matter", "data scope", "action scope" ], "evidence_checks": [ "epistemic type preserved", "freshness/provenance explicit", "unknowns remain explicit" ], "rights_gates": [ "affected right named", "least-restrictive and least-irreversible alternatives considered" ], "actions": [ "execute only bounded permitted transition", "record complete provenance" ], "prohibited_actions": [ "scope expansion by implementation", "silent type-casting", "irreversible downstream propagation during unresolved stay" ], "escalation": "Challenge, stay or independent review when a constitutional or assurance gate fails.", "time_limits": "Use explicit expiry/TTL appropriate to the authority; no permanent emergency inference.", "logging": "Append decision, versions, evidence references, gate outcomes and reviewer identity.", "appeal": "Expose review route and preserve stay state.", "restoration": "Propagate correction and require acknowledgement where downstream effects exist.", "fail_safe_state": "SAFE_HOLD / ABSTAIN / REQUIRE_REVIEW as appropriate; this is a design proposal, not a current production command." }, { "id": "RB06", "name": "Activate Constitutional Circuit Breaker", "trigger": "Operational trigger for activate constitutional circuit breaker.", "authorized_actors": [ "institutional authority owner", "independent reviewer where required" ], "inputs": [ "request or event", "authority record", "current policy/model/configuration versions", "relevant evidence and provenance" ], "preconditions": [ "identity/authentication separated from authority", "jurisdiction and purpose declared" ], "authority_checks": [ "source current", "scope sufficient", "not expired/revoked" ], "jurisdiction_checks": [ "subject matter", "data scope", "action scope" ], "evidence_checks": [ "epistemic type preserved", "freshness/provenance explicit", "unknowns remain explicit" ], "rights_gates": [ "affected right named", "least-restrictive and least-irreversible alternatives considered" ], "actions": [ "execute only bounded permitted transition", "record complete provenance" ], "prohibited_actions": [ "scope expansion by implementation", "silent type-casting", "irreversible downstream propagation during unresolved stay" ], "escalation": "Challenge, stay or independent review when a constitutional or assurance gate fails.", "time_limits": "Use explicit expiry/TTL appropriate to the authority; no permanent emergency inference.", "logging": "Append decision, versions, evidence references, gate outcomes and reviewer identity.", "appeal": "Expose review route and preserve stay state.", "restoration": "Propagate correction and require acknowledgement where downstream effects exist.", "fail_safe_state": "SAFE_HOLD / ABSTAIN / REQUIRE_REVIEW as appropriate; this is a design proposal, not a current production command." }, { "id": "RB07", "name": "Issue Machine Writ of Stay", "trigger": "Operational trigger for issue machine writ of stay.", "authorized_actors": [ "institutional authority owner", "independent reviewer where required" ], "inputs": [ "request or event", "authority record", "current policy/model/configuration versions", "relevant evidence and provenance" ], "preconditions": [ "identity/authentication separated from authority", "jurisdiction and purpose declared" ], "authority_checks": [ "source current", "scope sufficient", "not expired/revoked" ], "jurisdiction_checks": [ "subject matter", "data scope", "action scope" ], "evidence_checks": [ "epistemic type preserved", "freshness/provenance explicit", "unknowns remain explicit" ], "rights_gates": [ "affected right named", "least-restrictive and least-irreversible alternatives considered" ], "actions": [ "execute only bounded permitted transition", "record complete provenance" ], "prohibited_actions": [ "scope expansion by implementation", "silent type-casting", "irreversible downstream propagation during unresolved stay" ], "escalation": "Challenge, stay or independent review when a constitutional or assurance gate fails.", "time_limits": "Use explicit expiry/TTL appropriate to the authority; no permanent emergency inference.", "logging": "Append decision, versions, evidence references, gate outcomes and reviewer identity.", "appeal": "Expose review route and preserve stay state.", "restoration": "Propagate correction and require acknowledgement where downstream effects exist.", "fail_safe_state": "SAFE_HOLD / ABSTAIN / REQUIRE_REVIEW as appropriate; this is a design proposal, not a current production command." }, { "id": "RB08", "name": "Process emergency authority", "trigger": "Operational trigger for process emergency authority.", "authorized_actors": [ "institutional authority owner", "independent reviewer where required" ], "inputs": [ "request or event", "authority record", "current policy/model/configuration versions", "relevant evidence and provenance" ], "preconditions": [ "identity/authentication separated from authority", "jurisdiction and purpose declared" ], "authority_checks": [ "source current", "scope sufficient", "not expired/revoked" ], "jurisdiction_checks": [ "subject matter", "data scope", "action scope" ], "evidence_checks": [ "epistemic type preserved", "freshness/provenance explicit", "unknowns remain explicit" ], "rights_gates": [ "affected right named", "least-restrictive and least-irreversible alternatives considered" ], "actions": [ "execute only bounded permitted transition", "record complete provenance" ], "prohibited_actions": [ "scope expansion by implementation", "silent type-casting", "irreversible downstream propagation during unresolved stay" ], "escalation": "Challenge, stay or independent review when a constitutional or assurance gate fails.", "time_limits": "Use explicit expiry/TTL appropriate to the authority; no permanent emergency inference.", "logging": "Append decision, versions, evidence references, gate outcomes and reviewer identity.", "appeal": "Expose review route and preserve stay state.", "restoration": "Propagate correction and require acknowledgement where downstream effects exist.", "fail_safe_state": "SAFE_HOLD / ABSTAIN / REQUIRE_REVIEW as appropriate; this is a design proposal, not a current production command." }, { "id": "RB09", "name": "Process successful appeal", "trigger": "Operational trigger for process successful appeal.", "authorized_actors": [ "institutional authority owner", "independent reviewer where required" ], "inputs": [ "request or event", "authority record", "current policy/model/configuration versions", "relevant evidence and provenance" ], "preconditions": [ "identity/authentication separated from authority", "jurisdiction and purpose declared" ], "authority_checks": [ "source current", "scope sufficient", "not expired/revoked" ], "jurisdiction_checks": [ "subject matter", "data scope", "action scope" ], "evidence_checks": [ "epistemic type preserved", "freshness/provenance explicit", "unknowns remain explicit" ], "rights_gates": [ "affected right named", "least-restrictive and least-irreversible alternatives considered" ], "actions": [ "execute only bounded permitted transition", "record complete provenance" ], "prohibited_actions": [ "scope expansion by implementation", "silent type-casting", "irreversible downstream propagation during unresolved stay" ], "escalation": "Challenge, stay or independent review when a constitutional or assurance gate fails.", "time_limits": "Use explicit expiry/TTL appropriate to the authority; no permanent emergency inference.", "logging": "Append decision, versions, evidence references, gate outcomes and reviewer identity.", "appeal": "Expose review route and preserve stay state.", "restoration": "Propagate correction and require acknowledgement where downstream effects exist.", "fail_safe_state": "SAFE_HOLD / ABSTAIN / REQUIRE_REVIEW as appropriate; this is a design proposal, not a current production command." }, { "id": "RB10", "name": "Propagate restoration", "trigger": "Operational trigger for propagate restoration.", "authorized_actors": [ "institutional authority owner", "independent reviewer where required" ], "inputs": [ "request or event", "authority record", "current policy/model/configuration versions", "relevant evidence and provenance" ], "preconditions": [ "identity/authentication separated from authority", "jurisdiction and purpose declared" ], "authority_checks": [ "source current", "scope sufficient", "not expired/revoked" ], "jurisdiction_checks": [ "subject matter", "data scope", "action scope" ], "evidence_checks": [ "epistemic type preserved", "freshness/provenance explicit", "unknowns remain explicit" ], "rights_gates": [ "affected right named", "least-restrictive and least-irreversible alternatives considered" ], "actions": [ "execute only bounded permitted transition", "record complete provenance" ], "prohibited_actions": [ "scope expansion by implementation", "silent type-casting", "irreversible downstream propagation during unresolved stay" ], "escalation": "Challenge, stay or independent review when a constitutional or assurance gate fails.", "time_limits": "Use explicit expiry/TTL appropriate to the authority; no permanent emergency inference.", "logging": "Append decision, versions, evidence references, gate outcomes and reviewer identity.", "appeal": "Expose review route and preserve stay state.", "restoration": "Propagate correction and require acknowledgement where downstream effects exist.", "fail_safe_state": "SAFE_HOLD / ABSTAIN / REQUIRE_REVIEW as appropriate; this is a design proposal, not a current production command." }, { "id": "RB11", "name": "Revoke authority", "trigger": "Operational trigger for revoke authority.", "authorized_actors": [ "institutional authority owner", "independent reviewer where required" ], "inputs": [ "request or event", "authority record", "current policy/model/configuration versions", "relevant evidence and provenance" ], "preconditions": [ "identity/authentication separated from authority", "jurisdiction and purpose declared" ], "authority_checks": [ "source current", "scope sufficient", "not expired/revoked" ], "jurisdiction_checks": [ "subject matter", "data scope", "action scope" ], "evidence_checks": [ "epistemic type preserved", "freshness/provenance explicit", "unknowns remain explicit" ], "rights_gates": [ "affected right named", "least-restrictive and least-irreversible alternatives considered" ], "actions": [ "execute only bounded permitted transition", "record complete provenance" ], "prohibited_actions": [ "scope expansion by implementation", "silent type-casting", "irreversible downstream propagation during unresolved stay" ], "escalation": "Challenge, stay or independent review when a constitutional or assurance gate fails.", "time_limits": "Use explicit expiry/TTL appropriate to the authority; no permanent emergency inference.", "logging": "Append decision, versions, evidence references, gate outcomes and reviewer identity.", "appeal": "Expose review route and preserve stay state.", "restoration": "Propagate correction and require acknowledgement where downstream effects exist.", "fail_safe_state": "SAFE_HOLD / ABSTAIN / REQUIRE_REVIEW as appropriate; this is a design proposal, not a current production command." }, { "id": "RB12", "name": "Respond to compromised institution", "trigger": "Operational trigger for respond to compromised institution.", "authorized_actors": [ "institutional authority owner", "independent reviewer where required" ], "inputs": [ "request or event", "authority record", "current policy/model/configuration versions", "relevant evidence and provenance" ], "preconditions": [ "identity/authentication separated from authority", "jurisdiction and purpose declared" ], "authority_checks": [ "source current", "scope sufficient", "not expired/revoked" ], "jurisdiction_checks": [ "subject matter", "data scope", "action scope" ], "evidence_checks": [ "epistemic type preserved", "freshness/provenance explicit", "unknowns remain explicit" ], "rights_gates": [ "affected right named", "least-restrictive and least-irreversible alternatives considered" ], "actions": [ "execute only bounded permitted transition", "record complete provenance" ], "prohibited_actions": [ "scope expansion by implementation", "silent type-casting", "irreversible downstream propagation during unresolved stay" ], "escalation": "Challenge, stay or independent review when a constitutional or assurance gate fails.", "time_limits": "Use explicit expiry/TTL appropriate to the authority; no permanent emergency inference.", "logging": "Append decision, versions, evidence references, gate outcomes and reviewer identity.", "appeal": "Expose review route and preserve stay state.", "restoration": "Propagate correction and require acknowledgement where downstream effects exist.", "fail_safe_state": "SAFE_HOLD / ABSTAIN / REQUIRE_REVIEW as appropriate; this is a design proposal, not a current production command." }, { "id": "RB13", "name": "Handle network partition", "trigger": "Operational trigger for handle network partition.", "authorized_actors": [ "institutional authority owner", "independent reviewer where required" ], "inputs": [ "request or event", "authority record", "current policy/model/configuration versions", "relevant evidence and provenance" ], "preconditions": [ "identity/authentication separated from authority", "jurisdiction and purpose declared" ], "authority_checks": [ "source current", "scope sufficient", "not expired/revoked" ], "jurisdiction_checks": [ "subject matter", "data scope", "action scope" ], "evidence_checks": [ "epistemic type preserved", "freshness/provenance explicit", "unknowns remain explicit" ], "rights_gates": [ "affected right named", "least-restrictive and least-irreversible alternatives considered" ], "actions": [ "execute only bounded permitted transition", "record complete provenance" ], "prohibited_actions": [ "scope expansion by implementation", "silent type-casting", "irreversible downstream propagation during unresolved stay" ], "escalation": "Challenge, stay or independent review when a constitutional or assurance gate fails.", "time_limits": "Use explicit expiry/TTL appropriate to the authority; no permanent emergency inference.", "logging": "Append decision, versions, evidence references, gate outcomes and reviewer identity.", "appeal": "Expose review route and preserve stay state.", "restoration": "Propagate correction and require acknowledgement where downstream effects exist.", "fail_safe_state": "SAFE_HOLD / ABSTAIN / REQUIRE_REVIEW as appropriate; this is a design proposal, not a current production command." }, { "id": "RB14", "name": "Handle cross-border conflict", "trigger": "Operational trigger for handle cross-border conflict.", "authorized_actors": [ "institutional authority owner", "independent reviewer where required" ], "inputs": [ "request or event", "authority record", "current policy/model/configuration versions", "relevant evidence and provenance" ], "preconditions": [ "identity/authentication separated from authority", "jurisdiction and purpose declared" ], "authority_checks": [ "source current", "scope sufficient", "not expired/revoked" ], "jurisdiction_checks": [ "subject matter", "data scope", "action scope" ], "evidence_checks": [ "epistemic type preserved", "freshness/provenance explicit", "unknowns remain explicit" ], "rights_gates": [ "affected right named", "least-restrictive and least-irreversible alternatives considered" ], "actions": [ "execute only bounded permitted transition", "record complete provenance" ], "prohibited_actions": [ "scope expansion by implementation", "silent type-casting", "irreversible downstream propagation during unresolved stay" ], "escalation": "Challenge, stay or independent review when a constitutional or assurance gate fails.", "time_limits": "Use explicit expiry/TTL appropriate to the authority; no permanent emergency inference.", "logging": "Append decision, versions, evidence references, gate outcomes and reviewer identity.", "appeal": "Expose review route and preserve stay state.", "restoration": "Propagate correction and require acknowledgement where downstream effects exist.", "fail_safe_state": "SAFE_HOLD / ABSTAIN / REQUIRE_REVIEW as appropriate; this is a design proposal, not a current production command." }, { "id": "RB15", "name": "Handle model-version incompatibility", "trigger": "Operational trigger for handle model-version incompatibility.", "authorized_actors": [ "institutional authority owner", "independent reviewer where required" ], "inputs": [ "request or event", "authority record", "current policy/model/configuration versions", "relevant evidence and provenance" ], "preconditions": [ "identity/authentication separated from authority", "jurisdiction and purpose declared" ], "authority_checks": [ "source current", "scope sufficient", "not expired/revoked" ], "jurisdiction_checks": [ "subject matter", "data scope", "action scope" ], "evidence_checks": [ "epistemic type preserved", "freshness/provenance explicit", "unknowns remain explicit" ], "rights_gates": [ "affected right named", "least-restrictive and least-irreversible alternatives considered" ], "actions": [ "execute only bounded permitted transition", "record complete provenance" ], "prohibited_actions": [ "scope expansion by implementation", "silent type-casting", "irreversible downstream propagation during unresolved stay" ], "escalation": "Challenge, stay or independent review when a constitutional or assurance gate fails.", "time_limits": "Use explicit expiry/TTL appropriate to the authority; no permanent emergency inference.", "logging": "Append decision, versions, evidence references, gate outcomes and reviewer identity.", "appeal": "Expose review route and preserve stay state.", "restoration": "Propagate correction and require acknowledgement where downstream effects exist.", "fail_safe_state": "SAFE_HOLD / ABSTAIN / REQUIRE_REVIEW as appropriate; this is a design proposal, not a current production command." } ], "interoperability_paradox": "The better institutions communicate, the easier universal cross-context surveillance may become. Interoperate authority, appeal, revocation, restoration and necessary evidence—not the whole human being." }