Skip to content

CAPABILITY_BOUNDARIES.md

Latest commit

 

History

History
52 lines (39 loc) · 2.53 KB

CAPABILITY_BOUNDARIES.md

File metadata and controls

52 lines (39 loc) · 2.53 KB
Raw

Capability boundaries

Simulation_Invariant records what was observed and verified inside a bounded cycle. It does not turn that evidence into authority over the source.

Current surfaces

Surface Platform boundary What it establishes Authority
simulation-invariant monitor Windows and POSIX A read-only environment coverage packet for the selected root and exclusions None
simulation-invariant inspect Windows and POSIX A bounded byte presentation and hash-bound presentation receipt None
Presentation and evidence verification Windows and POSIX Structural, hash, range, and chain checks declared by each verifier None
Candidate observation, copying, and patching Tested according to each component's declared platform properties A disposable candidate can be compared with bound source and expected tree states Candidate only
Full bounded-candidate executor Linux/POSIX with mount, network, and PID namespace support Declared tests ran against the approved candidate input while the named executor properties held None
Wheel and console command Python 3.10+ on Windows and Linux CI The package builds, installs, and exposes the existing dispatcher None

Platform-specific tests skip when a required property cannot be established. A skip records an unavailable check; it is not a successful verification.

Status meanings

  • VALIDATED_CANDIDATE closes one candidate-validation cycle. It does not mean accepted, promoted, deployed, merged, or written to the source.
  • STOP means no further action remains inside the current bounded task. New evidence can start a later task.
  • PASS applies only to the checks named by the receipt that carries it.
  • STALE, UNKNOWN, BLOCKED, and FAILED cannot be interpreted as acceptance.

Every result is bound to its recorded source identity, policy, inputs, and observation moment. A later environmental difference requires a new check.

Explicitly absent

The project currently provides no:

  • live source writer;
  • promotion or deployment command;
  • package-publishing workflow;
  • autonomous permission escalation;
  • inherited acceptance, truth, or semantic-understanding authority;
  • guarantee that a validated candidate remains current after its final bound observation.

The bounded-candidate result therefore retains:

write_authority=NONE
promotion_authority=NONE

Humans or external systems may make later decisions, but those decisions are separate evidence and require their own explicit contract.