Part VI – Appendices
5 min read

Appendix C: Protocol and Object Model

This appendix specifies references, closure, and authority boundaries among artifacts and authority events—not serialization, transport, storage, service boundaries, or classes. Implementations may distribute responsibilities while preserving these invariants.

Appendix B remains the vocabulary reference. This view shows artifact history, transition control, and the boundary between evidence and authority.

The Relationship at a Glance

flowchart TD
  P["Mission proposal"] --> B["Binding"]
  B --> M["Bound Mission Object<br/>exact Mission identity"]
  M --> R["Semantic + policy review"]
  R --> A["Activation decision<br/>references exact Mission identity"]
  A --> RR["Run Record opened<br/>references Activation, Mission, baseline"]
  RR --> F["Preflight<br/>verification recorded"]
  F -->|"ready"| X["Bounded execution<br/>attempts or steps, effects,<br/>findings, pre-closure decisions recorded"]
  F -->|"cannot proceed"| T["Terminal result<br/>Run Record sealed"]
  X --> T
  T -->|"complete, when applicable"| O{"Supported output<br/>declared type + handoff"}
  O -->|"Terrain proposal"| AR["Admission request"]
  AR --> AD["Admission decision"]
  O -->|"Map or policy proposal"| OR["Adoption request"]
  OR --> OD["Adoption decision"]
  O -->|"checked report"| D["Report delivery"]
  O -->|"supported child output"| C["Local acceptance<br/>under parent Mission"]
  A -.-> L["Ledger relationships"]
  RR -.-> L
  AD -.-> L
  OD -.-> L

Binding produces the exact identity reviewed for Activation. Activation authorizes it, not a mutable lookalike. The Run Record opens before Preflight, whose result is retained whether execution proceeds or stops. Preflight verifies that the identity and dependencies remain present, intact, and executable. Attempts and steps accumulate in the record; they are not independent authority-bearing objects.

A terminal result seals the record. A complete run identifies any declared terminal output and handoff. Terrain proposals proceed only to Admission; Map or policy proposals only to Adoption. Reports and child outputs follow report delivery or local acceptance. Support grants no external authority.

Artifacts, References, and Authority

Artifact or event Produced or controlled by Exact references Mutation or closure rule Authority consequence
Mission proposal Human or assistive drafter Adopted sources and proposed workflow, policy, checks, effects, budgets, and handoff; references may be symbolic Mutable until Binding; a later edit requires a new identity and review None; it proposes a work contract
Bound Mission Object Binding mechanism outside drafter and runner control Immutable identities for authority sources, baseline, checks or check-validation protocols, policy bundle, workflow or template, and runtime Content-addressed and fixed for one run; a change creates a new identity Defines the authority that Activation may authorize
Activation decision Authorized identity or adopted policy Exact bound Mission identity and approval basis Recorded as a separate event; it does not edit the Mission Authorizes that Mission identity to run once
Run Record Protected runtime under the activated Mission Mission identity, Activation decision, baseline, Preflight result, Context Packet, candidates, budgets, and retained evidence Opened before Preflight, logically append-only, and sealed with one terminal result Records the run but grants no authority
Preflight verification Mechanism outside candidate authority Authorized Mission identity and its bound dependencies Recorded in the open Run Record; verifies presence, integrity, and executability; it cannot select, replace, change, or rebind None; failure prevents execution from proceeding and seals the record blocked or failed
Attempt or step entries Workflow runtime Parent Run Record, order, inputs, outputs, candidate identity, effects, and budget use Appended as Run Record contents; never separate authority None; they reconstruct execution
Validator findings or reports Declared Validators Candidate and configuration identities, checked property, check or protocol identity, and observations used Retained with the Run Record; later correction adds evidence rather than rewriting history Supply evidence only
Policy-bound decision Judge or adopted decision rule Applicable findings and evidence, policy identity, budgets, permitted transition, and any exact exception authorization used Recorded before closure as part of the Run Record Routes refinement, stopping, or proposal closure within existing authority
Supported candidate or output Candidate producer creates the output; policy-bound decision and terminal closure establish support Exact output identity, declared output type and handoff, and supporting sealed complete Run Record A changed output is new and unsupported Eligible only for its declared handoff; support alone grants no external authority
Admission decision Mission Gate and authorized Admission path Exact Terrain candidate, sealed Run Record, current base and policy, effects, evidence, required approvals, and any exact exception authorization used Appended after closure; denial or approval does not reopen the Run Record Approval makes that candidate effective in Terrain; denial leaves Terrain unchanged
Adoption decision Authorized adopting identity or policy Exact Map or policy proposal, sealed Run Record, current authority, and required approvals Appended after closure; it cannot revise the Mission or its history Approval makes that exact proposal authoritative; denial preserves current authority
Ledger relationship Protected append interface and evidence sink Stable identities for Activation, Run Records, attempts, effects, findings, decisions, terminal results, Admission, and Adoption, with sequence and predecessor references Append-only under the sink and trust-root assumptions; linked records extend history Establishes reconstructable continuity, not authority

Closure Before Consequence

Pre-closure findings and policy-bound decisions govern the active run. They may require refinement, stop execution, or support proposal closure; a discrepancy may make the run failed.

Admission and Adoption re-evaluate whether a supported output may change Terrain or authority under current state. A stale base, changed policy, missing approval, or contradictory record may deny the request while the run remains sealed complete. The Ledger appends the later decision; it does not revise history.

Proposal closure records what the run established. Admission or Adoption records what later authority allowed to become consequential.

Invariants

Share