ARCH-01 — Authority, identity, evidence, and platform-bootstrap architecture #821

New Issue

2026-07-22T19:39:48-05:00

jcwalker3 commented

2026-07-22 19:39:48 -05:00

Candidate architecture requiring executable validation; not yet approved, production-ready, or certified.

Parent: #820. This is an epic, not an implementation leaf — no PR closes this issue directly; it is closed when its children land.

ARCH-01 overall invariants

I1 Every authority decision is made by an authenticated caller holding a dominating grant (authority lattice). [SCHEMA] grant/dominance checks; [TRUSTED-SERVICE] caller authentication.
I2 Evidence is issuer-attested with a bound composite identity and exactly one typed subject; never free text. [SCHEMA] binding; [RUNTIME-ADAPTER] remote signature.
I3 Two actor ids from one authoritative issuer are never the same principal; equivalence merges are permanent. [SCHEMA].
I4 Bootstrap artifacts (installer, seed, initial grant, dominance policy, distinguished issuer) are immutable after installation. [SCHEMA].
I5 ARCH-01 defines no table or trigger over any later issue; downstream validity derives from live ARCH-01 status (no cached booleans).

Enforcement-label vocabulary

[SCHEMA] DB-enforced · [TRUSTED-SERVICE] service-boundary-enforced · [RUNTIME-ADAPTER] external-adapter-enforced.

Children (resolved issue numbers)

#822 — Foundation Slice A — atomic installation + actor context + authority kernel (first implementation leaf; status:ready)
#823 — Bootstrap grant succession (concurrency-safe)
#824 — Principal equivalence (conflict detection + serialized merges)
#825 — Typed evidence subjects (digest binding + immutability)
#826 — Issuer-proof adapters + immutable store generations
#827 — PostgreSQL privilege + service boundary

Definition of done (epic)

All six children merged with executable tests on their stated backends; the acceptance matrix (#837) cross-references every ARCH-01 invariant.

Known limitations / deferred

Remote issuer-signature verification is [RUNTIME-ADAPTER]. PostgreSQL parity is a distinct child (#827). Enabling any of this as a production security boundary is out of scope for these issues.

**Candidate architecture requiring executable validation; not yet approved, production-ready, or certified.** Parent: #820. **This is an epic, not an implementation leaf** — no PR closes this issue directly; it is closed when its children land. ## ARCH-01 overall invariants - I1 Every authority decision is made by an **authenticated caller** holding a **dominating** grant (authority lattice). `[SCHEMA]` grant/dominance checks; `[TRUSTED-SERVICE]` caller authentication. - I2 Evidence is **issuer-attested** with a bound composite identity and exactly one **typed subject**; never free text. `[SCHEMA]` binding; `[RUNTIME-ADAPTER]` remote signature. - I3 Two actor ids from one authoritative issuer are **never** the same principal; equivalence merges are permanent. `[SCHEMA]`. - I4 Bootstrap artifacts (installer, seed, initial grant, dominance policy, distinguished issuer) are immutable after installation. `[SCHEMA]`. - I5 ARCH-01 defines no table or trigger over any later issue; downstream validity derives from **live** ARCH-01 status (no cached booleans). ## Enforcement-label vocabulary `[SCHEMA]` DB-enforced · `[TRUSTED-SERVICE]` service-boundary-enforced · `[RUNTIME-ADAPTER]` external-adapter-enforced. ## Children (resolved issue numbers) - [ ] #822 — Foundation Slice A — atomic installation + actor context + authority kernel **(first implementation leaf; status:ready)** - [ ] #823 — Bootstrap grant succession (concurrency-safe) - [ ] #824 — Principal equivalence (conflict detection + serialized merges) - [ ] #825 — Typed evidence subjects (digest binding + immutability) - [ ] #826 — Issuer-proof adapters + immutable store generations - [ ] #827 — PostgreSQL privilege + service boundary ## Definition of done (epic) All six children merged with executable tests on their stated backends; the acceptance matrix (#837) cross-references every ARCH-01 invariant. ## Known limitations / deferred Remote issuer-signature verification is `[RUNTIME-ADAPTER]`. PostgreSQL parity is a distinct child (#827). Enabling any of this as a production security boundary is out of scope for these issues.

jcwalker3 referenced this issue

2026-07-22 19:40:54 -05:00

ARCH-01 Foundation Slice A — Atomic platform installation and authority kernel #822

jcwalker3 referenced this issue

2026-07-22 19:41:36 -05:00

ARCH-01 — Concurrency-safe platform.bootstrap grant succession #823

jcwalker3 referenced this issue

2026-07-22 19:42:25 -05:00

ARCH-01 — Principal equivalence classes, conflict detection, and serialized merges #824

jcwalker3 referenced this issue

2026-07-22 19:43:08 -05:00

ARCH-01 — Evidence attestations, typed subjects, digest binding, and immutability #825