Two-phase Release Quorum
& Non-callable Execution Permit

Live boundary

Current external red gate

01 / 36

First missing authorityP63_LIVE_EXECUTION_PERMIT_ACTIVATION_AUTHORITY

Observed runtime

0 × :8110

:8100 is the documentation portal only

Decision

HOLD_QUORUM

repository qualification ≠ production activation

Upstream

Cut 98 input: capability-free only

02 / 36

Cut 98 terminalVote revoked
Intent destroyed

Exact readback38 critical fields
digest equality

Acceptidentity + facts
no capabilities

Reject inheritanceIntent · Vote · Target
payload · callable

Contract

Boundary contract

03 / 36

accepted Intent capability0

accepted Vote capability0

accepted callable0

accepted release approval0

Architectural rule

Proposal may describe one call, but cannot cause one. Every downstream artifact binds immutable digests and explicitly repeats zero-release limits.

Upstream schema

38-field Cut 98 terminal receipt critical projection

04 / 36

Responsibility map

Six detached signing authorities

05 / 36

The upstream reader is a seventh policy authority but signs no Cut 99 release artifact. Six signed artifacts use six distinct owners and keys.

Phase one

42-field capability-free Release Proposal

06 / 36

Exact binding

Proposal binding graph

07 / 36

Cut 98 digestsource revision
transaction · lease

Target digestidentity-only profile
no object reference

Descriptor#1 · runner-control
reserve

Request digestsrequest + payload
no payload bytes

Scope fence2 votes required
0 releases

Freshness

1,000ms Proposal window

08 / 36

T+000

Proposal starts

T+250

Reference evaluation pointinside all four windows

T+1000

Hard expiryno grace, renewal or replay path

Replay defense

Phase-one Proposal nonce

09 / 36

Claim surfaceproposalId + nonce

Maximum claims

1

Observed candidate claims

256

256 / 256 atomic claims

Runtime identity

34-field Target Execution Profile

10 / 36

Provenance

Target Profile provenance chain

11 / 36

Layer	Bound fact	Disallowed	Evidence
Source	revision + Cut 98 digest	mutable branch	EXACT
Adapter	adapter + module + profile digest	loaded module object	EXACT
Config	snapshot digest	plaintext config refs	DIGEST
Runtime	execution epoch 99	instance / listener / callable	IDENTITY ONLY

Freshness

800ms Target Profile window

12 / 36

Window relationship

Target expires 200ms before Proposal

The shorter identity window ensures a Proposal cannot outlive a stale target description and silently reuse it.

Zero scope

Target Profile contains identity, not a target

13 / 36

Config refs

0

Instance bound

false

Callable bound

false

Listener bound

false

Phase two · voter A

38-field Security HOLD Quorum Vote

14 / 36

CLASS · SECURITYPHASE_TWO_SECURITYVOTE · HOLDAPPROVAL · 0

Phase two · voter B

38-field Independent HOLD Quorum Vote

15 / 36

CLASS · INDEPENDENTPHASE_TWO_INDEPENDENTVOTE · HOLDPERMIT · 0

Separation proof

Two voters cannot collapse into one identity

16 / 36

Security voterSECURITY_RELEASE_QUORUM_VOTE_AUTHORITY

owner: security-release-vote
key: p63-security-release-vote

≠ × 4

Independent voterINDEPENDENT_RELEASE_QUORUM_VOTE_AUTHORITY

owner: independent-release-vote
key: p63-independent-release-vote

AuthorityDISTINCT

OwnerDISTINCT

Key refDISTINCT

Class + nonceDISTINCT

Freshness

750ms independent Vote windows

17 / 36

Security Vote

own signature · own nonce · own expiry

Independent Vote

own signature · own nonce · own expiry

Replay defense

Two Vote nonces, two atomic claims

18 / 36

Vote claim attempts

280

Vote claims

280

Cross-voter nonce reuse

0

Decision engine

HOLD-only Quorum state machine

19 / 36

PROPOSAL_CLAIMED1 call described
0 callable

SECURITY_HOLDsigned + claimed

INDEPENDENT_HOLDsigned + claimed

HOLD_QUORUM2 / 2 facts
0 approval

ACTIVATIONunreachable
authority absent

Digest graph

Quorum exact binding

20 / 36

Vote binding	Security	Independent
Proposal digest	EXACT	EXACT
Target Profile digest	EXACT	EXACT
Request + payload digest	EXACT	EXACT
Port / method / schema	EXACT	EXACT
Activation authority	NOT OBSERVED	NOT OBSERVED

Fact artifact

40-field Non-callable Execution Permit

21 / 36

Permit is deliberately non-operative. Its name does not grant execution. The closed schema requires maximumInvocations=0 and executionAllowed=false.

Freshness

500ms Permit window

22 / 36

Shortest artifact window

500ms, then hard expiry

Even inside the window, the Permit cannot invoke. Expiry limits fact reuse; the zero-capability schema limits action.

Replay defense

Non-callable Permit nonce

23 / 36

Issue attempts

140

Valid permits

82

Atomic claims

82 / 82

Capability proof

Why the Permit is non-callable

24 / 36

maximumInvocations

0

executionAllowed

false

callable reference

false

payload stored

false

network allowed

false

persistence allowed

false

commit allowed

false

active calls

0

Effect fence

Zero release approval and zero execution

25 / 36

release approvals0

invocation permits issued0

callable exports0

production authorizations0

Adapter invocations0

call commits0

network / persistence0 / 0

port 8110 calls0

Mandatory closeout

Permit revocation precedes every activation transition

26 / 36

Permit claimedfact artifact only

Revokebefore activation
no grace path

Destroy Proposaldigest custody ends

Release Targetidentity profile ends

Settle zeroall active counts 0

Terminal evidence

34-field Permit revocation & Proposal destruction Receipt

27 / 36

Qualified path

Qualified still means revoke and destroy

28 / 36

Receipt exact38 / 38

Proposal + Targetsignatures valid

Two HOLD Votesdetached + claimed

Permitnon-callable

Closeoutrevoked · destroyed
settled zero

24 qualified cases prove governance closure, not production execution.

Failure path

Every post-claim failure converges on the same closeout

29 / 36

Before Proposal claim

reject · no active Proposal · no cleanup authority created

After Proposal claim

cancel · revoke if present · destroy · release · settle

Closeout evidence invalid

remain fail-closed; never infer activation from missing evidence

Runtime cleanup

Target Profile release

30 / 36

Profiles read back

198

Production instances

0

Callable handles

0

Retained profiles

0

Terminal truth

Zero-effect settlement ledger

31 / 36

Counter	Attempts	Settled / closed	Active after
Proposal cancellation	256	198 evidenced	0
Closeout	256	198 target-valid	0
Settlement	198	198	0
Production effect	0	0	0

Failure architecture

24 deterministic failure cutpoints

32 / 36

Qualified cohort

24 qualified held Quorums

33 / 36

Two Votes

24 × 2

Permits claimed

24

Permits revoked

24

Production calls

0

Rejected cohort

348 rejected or revoked Proposals

34 / 36

Receipt integrity

58

reject before Proposal

Proposal signature / claim

58

reject before claim

Target Profile

58

cleanup after claim

Two-Vote Quorum

58

no Permit issue

Non-callable Permit

58

invalid Permit rejected

Closeout Receipt

58

evidence remains fail-closed

Executable QA

372-case two-phase Quorum lab

35 / 36

Program handoff

P63A–I / 141 of 157 quality gates / Cut 100

36 / 36

Repository-bound gates

141 / 157

Live gates held

16

Machine interfaces

248

Cut 100 handoff

One-shot Execution Activation Preflight + Mandatory Abort Latch. Cut 99 hands off only a capability-free HOLD_QUORUM terminal receipt; no Permit capability, callable, payload, Target object or release approval crosses the boundary.