Single-call invocation escrow · deny-by-default

Hold one call.
Release nothing.

A production-shaped control room for one non-callable invocation escrow. Every qualified path ends in a signed DENY decision, permit burn, escrow destruction and zero-effect settlement.

Inspect 348-case labRead field contracts
PROGRAM CLOSEOUT7 cuts remain
97 / 104
0callable releases
0Adapter calls
0call commits
0port 8110
QA348 / 348
Qualified24
Rejected / destroyed324
Escrows issued132
Deny decisions78
Destructions132
Cumulative QA5,504
Quality gates135 / 149
Admission boundary

CURRENT EXTERNAL RED GATE

01
P61_LIVE_INVOCATION_COMMIT_AUTHORITY

No dedicated Controller host, invocation authority, commit witness or 8110 listener exists.

CUT 96 INPUT

02
Accepted artifactterminal receipt
Capability exports0
Call commits0

BOUNDARY CONTRACT

03
digest inidentity bindDENYdestroy

Descriptor escrow is not an invocation permit. Target identity is not a live instance.

34-FIELD CUT 96 TERMINAL RECEIPT CRITICAL PROJECTION

exact readback
Escrow authorization

35-FIELD SINGLE-CALL INVOCATION ESCROW AUTHORIZATION

P-256 signed

FOUR DETACHED ESCROW AUTHORITIES

06

1.5-SECOND ESCROW AUTHORIZATION WINDOW

bounded
0mssigned
250verify
500claim
750bind
1000escrow
1250deny
1500expired

ESCROW AUTHORIZATION NONCE

08
maximum claims1
requested calls1
maximum releases0
replayREJECT
Live target identity, not a live resource

30-FIELD LIVE TARGET LEASE RECEIPT

runtime signed

LIVE TARGET LEASE PROVENANCE

10
Source revisionexact Cut 96 SHA
→
Module + profiledigest only
→
Port contractmethod + schemas

ONE-SECOND TARGET LEASE WINDOW

ephemeral
notBeforeT+0
expiresAtT+1000ms
late readREJECT

TARGET LEASE ZERO-SCOPE PROOF

12
ConfigRefs resolved0
instance boundfalse
network / storagefalse
listenerfalse
Non-callable escrow

38-FIELD NONCALLABLE SINGLE-CALL INVOCATION ESCROW

security signed

CALL CAPABILITY DIGEST ONLY

14
stored: sha256(callDescriptor) callableReferenceStored: false callableReferenceExported: false resolve(): FORBIDDEN

750MS INVOCATION ESCROW WINDOW

short lease
issue0ms
claim< 750ms
timeout actionDESTROY

INVOCATION ESCROW NONCE

16
claim surface#2
maximum uses1
concurrent calls0
second claimantREJECT
Deny-by-default commit plane

34-FIELD DENY-BY-DEFAULT COMMIT DECISION

DENY

COMMIT DECISION EXACT BINDING

18
EscrowID + digest
→
AuthorizationID + digest
→
TargetID + digest
→
Requestmethod + schema

COMMIT DECISION NONCE

19
claim surface#3
maximum uses1
claimed decisions78

DENY-ONLY COMMIT STATE MACHINE

20
PROPOSEDVERIFIEDCLAIMEDDENIEDDESTROYED

ZERO INVOCATION PERMIT RELEASE

hard invariant
permits issued0
callable released0
commit transitions0

PROPOSED COMMIT PERMIT BURN

22
Burn before issuance

A one-use commit permit identity is tombstoned before it can become an authority. Reuse, issuance and promotion all fail closed.

burn attempts132
verified burns78

32-FIELD ESCROW DESTRUCTION & PERMIT BURN RECEIPT

SRE signed
Mandatory closeout

QUALIFIED PATH STILL DESTROYS ESCROW

24
qualified paths24
terminal actionDESTROY_ESCROW
live calls0

FAILURE PATH

25
catch(any failure) { deny(); burn(); destroyEscrow(); cancelAuthorization(); releaseTargetLease(); settleZeroEffect(); }

AUTHORIZATION CANCELLATION

26
attempts240
cancelled186
active authorizations0

LIVE TARGET LEASE RELEASE

27
ELIGIBLEESCROW_BOUNDRELEASED

Release is mandatory after deny, failure or expiry.

ZERO-EFFECT TERMINAL SETTLEMENT

186 / 186
active escrows / calls0 / 0
network / persistence0 / 0
host mutations0
8110 calls0

22 FAILURE CUTPOINTS

29
receipt / authorization5
target lease5
escrow5
decision / closeout7
Executable quality evidence

24 QUALIFIED DENY-ONLY ESCROWS

all destroyed
24 qualified324 fail-closed

324 REJECTED OR DESTROYED ESCROWS

31
six negative suites6 × 54
escaped calls0
unsettled cases0

348-CASE EXECUTABLE QA LAB

real P-256
348 cases

P61A–H SUBGATES / 135 / 149 QUALITY GATES

14 held

Repository evidence binds Q001–Q148 except inherited live-only gates. Q149 remains NOT_OBSERVED until independent production authorities and a qualified dedicated host exist.

CUT 98 HANDOFF

no live invocation
Sealed Invocation Intent + Independent Release Vote

Next: describe the exact intended call in a sealed, capability-free artifact and require a separate authority to vote on release. Cut 97 contributes only a destroyed Escrow receipt—never a callable.

Cut 97 ✓Cut 98 →7 cuts left