Appendix C: Protocol and Object Model
This appendix specifies references, closure, and authority boundaries among artifacts and authority events—not serialization, transport, storage, service boundaries, or classes. Implementations may distribute responsibilities while preserving these invariants.
Appendix B remains the vocabulary reference. This view shows artifact history, transition control, and the boundary between evidence and authority.
The Relationship at a Glance
flowchart TD
P["Mission proposal"] --> B["Binding"]
B --> M["Bound Mission Object<br/>exact Mission identity"]
M --> R["Semantic + policy review"]
R --> A["Activation decision<br/>references exact Mission identity"]
A --> RR["Run Record opened<br/>references Activation, Mission, baseline"]
RR --> F["Preflight<br/>verification recorded"]
F -->|"ready"| X["Bounded execution<br/>attempts or steps, effects,<br/>findings, pre-closure decisions recorded"]
F -->|"cannot proceed"| T["Terminal result<br/>Run Record sealed"]
X --> T
T -->|"complete, when applicable"| O{"Supported output<br/>declared type + handoff"}
O -->|"Terrain proposal"| AR["Admission request"]
AR --> AD["Admission decision"]
O -->|"Map or policy proposal"| OR["Adoption request"]
OR --> OD["Adoption decision"]
O -->|"checked report"| D["Report delivery"]
O -->|"supported child output"| C["Local acceptance<br/>under parent Mission"]
A -.-> L["Ledger relationships"]
RR -.-> L
AD -.-> L
OD -.-> L
Binding produces the exact identity reviewed for Activation. Activation authorizes it, not a mutable lookalike. The Run Record opens before Preflight, whose result is retained whether execution proceeds or stops. Preflight verifies that the identity and dependencies remain present, intact, and executable. Attempts and steps accumulate in the record; they are not independent authority-bearing objects.
A terminal result seals the record. A complete run
identifies any declared terminal output and handoff. Terrain proposals
proceed only to Admission; Map or policy proposals only to Adoption.
Reports and child outputs follow report delivery or local acceptance.
Support grants no external authority.
Artifacts, References, and Authority
| Artifact or event | Produced or controlled by | Exact references | Mutation or closure rule | Authority consequence |
|---|---|---|---|---|
| Mission proposal | Human or assistive drafter | Adopted sources and proposed workflow, policy, checks, effects, budgets, and handoff; references may be symbolic | Mutable until Binding; a later edit requires a new identity and review | None; it proposes a work contract |
| Bound Mission Object | Binding mechanism outside drafter and runner control | Immutable identities for authority sources, baseline, checks or check-validation protocols, policy bundle, workflow or template, and runtime | Content-addressed and fixed for one run; a change creates a new identity | Defines the authority that Activation may authorize |
| Activation decision | Authorized identity or adopted policy | Exact bound Mission identity and approval basis | Recorded as a separate event; it does not edit the Mission | Authorizes that Mission identity to run once |
| Run Record | Protected runtime under the activated Mission | Mission identity, Activation decision, baseline, Preflight result, Context Packet, candidates, budgets, and retained evidence | Opened before Preflight, logically append-only, and sealed with one terminal result | Records the run but grants no authority |
| Preflight verification | Mechanism outside candidate authority | Authorized Mission identity and its bound dependencies | Recorded in the open Run Record; verifies presence, integrity, and executability; it cannot select, replace, change, or rebind | None; failure prevents execution from proceeding and seals the
record blocked or failed |
| Attempt or step entries | Workflow runtime | Parent Run Record, order, inputs, outputs, candidate identity, effects, and budget use | Appended as Run Record contents; never separate authority | None; they reconstruct execution |
| Validator findings or reports | Declared Validators | Candidate and configuration identities, checked property, check or protocol identity, and observations used | Retained with the Run Record; later correction adds evidence rather than rewriting history | Supply evidence only |
| Policy-bound decision | Judge or adopted decision rule | Applicable findings and evidence, policy identity, budgets, permitted transition, and any exact exception authorization used | Recorded before closure as part of the Run Record | Routes refinement, stopping, or proposal closure within existing authority |
| Supported candidate or output | Candidate producer creates the output; policy-bound decision and terminal closure establish support | Exact output identity, declared output type and handoff, and
supporting sealed complete Run Record |
A changed output is new and unsupported | Eligible only for its declared handoff; support alone grants no external authority |
| Admission decision | Mission Gate and authorized Admission path | Exact Terrain candidate, sealed Run Record, current base and policy, effects, evidence, required approvals, and any exact exception authorization used | Appended after closure; denial or approval does not reopen the Run Record | Approval makes that candidate effective in Terrain; denial leaves Terrain unchanged |
| Adoption decision | Authorized adopting identity or policy | Exact Map or policy proposal, sealed Run Record, current authority, and required approvals | Appended after closure; it cannot revise the Mission or its history | Approval makes that exact proposal authoritative; denial preserves current authority |
| Ledger relationship | Protected append interface and evidence sink | Stable identities for Activation, Run Records, attempts, effects, findings, decisions, terminal results, Admission, and Adoption, with sequence and predecessor references | Append-only under the sink and trust-root assumptions; linked records extend history | Establishes reconstructable continuity, not authority |
Closure Before Consequence
Pre-closure findings and policy-bound decisions govern the active
run. They may require refinement, stop execution, or support proposal
closure; a discrepancy may make the run failed.
Admission and Adoption re-evaluate whether a supported output may
change Terrain or authority under current state. A stale base, changed
policy, missing approval, or contradictory record may deny the request
while the run remains sealed complete. The Ledger appends
the later decision; it does not revise history.
Proposal closure records what the run established. Admission or Adoption records what later authority allowed to become consequential.
Invariants
- Mission authority cannot change during execution.
- A Run Record cannot authorize execution.
- Validator evidence cannot admit or adopt anything.
completecannot imply Admission.- Admission cannot change Map or policy authority.
- Adoption cannot retroactively modify a Mission.
- Preflight cannot rebind.
- A later authority event references sealed history rather than reopening it.