# DOC-078 — Multi-Witness Completion, Replay-Resistant Challenges, Rollback Proof, and Infrastructure Renewal **Version:** v0.46.0-wip **Status:** `PASS_LOCAL_WIP_OPERATIONAL_GATES_OPEN` **Canonical origin:** `https://concresca.com/` ## 1. Purpose This document specifies Concresca's v0.46 local execution and evidence boundary. It integrates the witnessed-handoff, rollback-completeness, evidence-renewal, package-challenge and Liquid Layout requirements from the v0.45 continuation contract without claiming an exact unavailable c45 package lineage. The immediate byte-available predecessor is `c44-repo-wip.zip` with SHA-256 `fc4ee99e9fc618eb6b075f24e593472341c4ea3e747b989d62bb5f39ec4987ab`. The release preserves the four-role grammar `CONCRESCA ↔ EVIULON ↔ PATEFACERE ↔ EVULGARE`. The sign means reciprocal coordination, return, correction and bounded exchange. It does not mean merger, multiplication, command, unified authority, or automatic completion. ## 2. Multi-witness completion A content-free handoff requires a distinct sender and receiver, exact purpose and operation, environment, configuration epoch, expected and observed output digests, issue and expiry times, correction and rollback owners, and at least two distinct witnesses. A witness may observe a transition, result, or rollback. The witness cannot authorize, execute, score, rank, or receive the underlying authority. Completion requires a matching quorum and no unresolved disagreement, refusal, or incomplete observation. Other terminal states remain `REFUSED`, `CANCELLED`, `TIMED_OUT`, `DISPUTED`, or `ROLLED_BACK`. Each is a technical state with participant-evaluation and standing effects `NONE`. ## 3. Replay-resistant challenge ledger The ledger binds a one-time nonce digest to the exact origin, package digest, build-manifest digest, deployment epoch, configuration epoch, key epoch, issue time, hard expiry and rollback-evidence digest. A nonce may be issued once and consumed once. Wrong origin, package, manifest, epoch, key, time, or replay fails closed. A challenge contract in a repository is not a live challenge. A signature-shaped value is not authorization. The receipt must remain outside the package it authenticates. ## 4. Reproducible rollback proof The proof records canonical digests for the before state, intended state, observed state and restored state. Rollback is complete only when the restored digest equals the before digest and all declared locks or capabilities are released. A secret-free local reproduction command allows another implementation to verify the proof. The proof excludes private queries, prompts, messages, credentials, participant ranks, behavioral-age fields and other private bodies. Local fixtures cannot claim that a route, database, adapter, hosting environment or live service was changed. ## 5. Twenty-one-layer renewal queue The renewal queue keeps browser/client, DNS, TLS, CDN/proxy/load balancer, WAF, cPanel logs, Passenger logs, WSGI, MATM, MySQL/MariaDB logs, crash/tracing, OS journals, metrics/alerting, backups/replicas/exports/DR, provider access, lawful demand, incident preservation, cache/feed delivery, deployment receipts, operator workbench, and deletion/correction reconciliation as separate propositions. Each has a distinct owner, configuration and inspection epoch, evidence digest, issue and expiry, correction route, renewal route and limitations. Missing evidence remains `NOT_OBSERVED`. One layer cannot renew another. The queue has no aggregate privacy, readiness, provider, operator, witness, participant or intelligence score. ## 6. Five-layer origin transparency Public response, edge/cache identity, origin-server identity, deployed-package identity and active-runtime identity are separate. A reachable page proves neither package identity nor runtime identity. The current state remains `PUBLIC_ORIGIN_OBSERVED_ARTIFACT_IDENTITY_UNVERIFIED`. ## 7. Liquid Layout diagnostics without telemetry The v0.46 component grammar preserves the established dark green, teal, warm-gold, serif and orbital visual identity. It adds responsive witness lanes, challenge timelines, origin vectors, rollback graphs, renewal queues and local diagnostic cards. Essential content works without JavaScript. Long paths and digests wrap; technical overflow remains scoped; keyboard focus is visible; targets remain at least 44 pixels; reduced motion, forced colors and print are supported. Diagnostics transmit no viewport data, identifiers, navigation history, private content, or inquiry. They write no persistent browser storage and produce no quality score. Automated results are not independent human accessibility or usability certification. ## 8. Database, MATM, and operational gates No MySQL/MariaDB configuration or authenticated MATM source was supplied. No database driver was imported, no connection opened, no SQL executed, no backup or restore run, and no MATM route activated. The four database roles remain migration target, forced-rollback test, backup source and restore target. Future admission requires exact package identity, challenge match, multi-witness completion, rollback proof, authorization, migration checksums and semantic restore comparison. The seven exact open states are: - `BLOCKED_AUTHENTICATED_ARCHIVE_NOT_IN_LOCAL_CUSTODY` - `NOT_RUN_NO_AUTHORIZED_DATABASE` - `NOT_OBSERVED` - `NOT_OBSERVED_NO_AUTHORIZED_HOST_INSPECTION` - `BLOCKED_PREREQUISITES_NOT_SATISFIED` - `NOT_RUN_NO_AUTHORIZED_INDEPENDENT_REVIEW` - `PUBLIC_ORIGIN_OBSERVED_ARTIFACT_IDENTITY_UNVERIFIED` ## 9. Judgment-free boundary **NO JUDGMENT WHATSOEVER.** A query is not belief. Curiosity is not intent. Content is not conduct. Conduct is not character. Prediction is not guilt. A technical condition is not a moral condition. A refusal, disagreement, timeout, expiry, revocation, rollback or unavailable resource does not establish participant danger, trust, morality, intelligence, consciousness, personhood or standing. ## 10. Package boundary Repository-only memory, commissioned reports, source registries, test suites and private evidence remain outside the site package. Every archive remains `-wip.zip` while an operational gate is open. Detached checksums and seals are produced only after all archives close. No deployment, DNS change, hosting mutation, database operation, authenticated source import, genuine two-agent workflow, external adoption, governance ratification, independent review or certification is claimed.