docs: record accepted phase-2 foundation contract

2026-09-06 02:23:15 -05:00
parent 69d1bb3aa4
commit 44f257cb06
16 changed files with 21849 additions and 0 deletions
@@ -0,0 +1,66 @@
+"""Author-only executable examples of proposed rules, using synthetic facts.
+
+Not an authenticator, reference resolver, sandbox, process observer, or runtime
+validator. Input facts are fixture assumptions, never evidence of real state.
+"""
+
+
+def evaluate(case):
+    kind, data = case['kind'], case['input']
+    if kind == 'reference':
+        target = data['target']
+        return bool(target and not data['pruned'] and all(
+            target[key] == data['reference'][key]
+            for key in ('kind', 'id', 'scope', 'revision', 'digest')
+        ))
+    if kind == 'permission':
+        if not data['authenticated'] or not data['intentCurrent']:
+            return False
+        required = ['agent', 'project', 'workspace', 'execution']
+        if data['assigned']:
+            required += ['mission', 'task']
+        elif data['operation'] not in ['work.read', 'file.read']:
+            return False
+        layers = data['layers']
+        return all(name in layers and layers[name] is not None
+                   and data['operation'] in layers[name] for name in required)
+    if kind == 'path':
+        path = data['path'].split('/')
+        if any(part in ('', '.', '..') for part in path):
+            return False
+        return any(grant is None or path[:len(grant.split('/'))] == grant.split('/')
+                   for grant in data['grants'])
+    if kind == 'acceptance':
+        return (data['reviewerAuthorized'] and data['reviewer'] not in data['authors']
+                and bool(data['requiredCriteria'])
+                and set(data['requiredCriteria']) == set(data['verifiedCriteria']))
+    if kind == 'claim':
+        # Read events as externally supplied observations. This never observes a process.
+        active, uncertain, audit, generation = False, False, True, 1
+        answers = []
+        for event in data['events']:
+            op = event['operation']
+            if op == 'audit-failed':
+                audit = False
+            elif op == 'audit-restored':
+                audit = True
+            elif op == 'uncertain-effects':
+                uncertain = True
+            elif op == 'verified-stopped-and-reconciled':
+                if audit:
+                    active, uncertain = False, False
+                    generation += 1
+            elif op == 'engine-idle':
+                pass  # Not proof that commands/processes have stopped.
+            elif op == 'launch':
+                allowed = audit and not active and not uncertain
+                answers.append(allowed)
+                if allowed:
+                    active = True
+            elif op == 'input':
+                answers.append(audit and active and not uncertain
+                               and event['generation'] == generation)
+            else:
+                raise ValueError(op)
+        return answers
+    raise ValueError(kind)