Lifecycle and
authority.

Formal lifecycle

CE-CTRL-01 Proposed → Intent Ready → Execution Authorized → Candidate Produced → Evidence Complete → Admitted → Deploying → Observed → Outcome Reviewed → Closed or Superseded

CE-LIFE-01 Each transition has a named accountable owner, an authenticated caller, an expected revision and a finite registered timeout. A stale caller revision rejects the operation. A blocked/expired operation preserves the accepted state, records the failure and escalates; it cannot turn into automatic approval. Reversibility means a new authorized compensating action or revision, never erasure of accepted history. Superseding live work requires an explicit operational handoff.

Assurance classes

CE-ASSURE-01 Publication evidence E0/E1/E2/E3/X describes provenance and evaluation quality. The independent-assurance dimension uses A0/A1/A2/A3 to avoid assigning incompatible meanings to those labels.

CE-ASSURE-01 Independence covers identity, write permissions, policy ownership, credentials, execution environment, test data and release authority. A class label is not an attestation. Protected owners review the actual configuration, collect receipts and test denied effects. Diverse models alone cannot replace independent human-reviewed oracles or establish uncorrelated errors. Confidence and catch rates apply to a declared sample and scope, not universal correctness.

Normative contract semantics

CE-DEF-01 Record schema 0.2 expands owner, invariant, behavior, constraint, data, credential, budget and evidence fields. Each invariant has severity, oracle, owner, frequency, applicability, confidence scope and failure consequence. Existential/non-waivable safety constraints cannot be waived. Outcome hypotheses remain distinct from hard release conditions. The package contains closed structural schemas plus migration notes; passing JSON validation does not prove cross-record semantics or authority.

CE-CTRL-01 Evidence Contracts declare required checks, expected results/tolerances, independent owners, retry/flake policy, blind spots and post-deployment signals. Candidate-specific exact digests, observed results and signed run receipts belong in Evidence Bundles. A protected manifest binds them to the policy and exact Intent/Execution revisions. This avoids treating a requirement that checks should pass as proof that they ran.

CE-CTRL-01 Execution boundaries cover tools, egress, data classes, secrets, dependency/build rules, time/token/compute/financial budgets and indirect effects through scripts, symlinks and delegated services. A path allowlist by itself is insufficient. Full invariants, accepted record resolution and indirect mutation enforcement still need real integration.

Authorization boundaries

CE-CTRL-01 Separation of duties is the canonical term. A generation principal may modify its candidate only within an accepted Execution boundary. No uncontrolled mutation/delegation/impersonation/build path may reach protected verification policy, evidence signing, admission authority or production effects without crossing an independently controlled authorization boundary.

CE-CTRL-01 Model principals and resources separately, with explicit write/execute-as/assume/delegate/impersonate/token/invoke capabilities, expiration and reviewed boundary controllers. Include build workers, CI, administrators, service roles and emergency access. A differently named principal with equivalent transitive access is not independent. Read access alone is not a protected mutation path.

CE-LIFE-01 The local analyzer computes reachable protected nodes and witness paths in a supplied fresh graph. A nominal boundary is ineffective if generation can reach its controller. Unknown capabilities and stale snapshots fail closed. A no-path report applies only to the supplied graph; it cannot establish that a cloud/IAM export is complete or authentic. Configure authenticated exporters, event-driven checks and scheduled rechecks in the real system before claiming continuous enforcement.

Exceptions and recovery

CE-GOV-01 Exceptions name requester/independent approver, exact waived control and artifact/environment, reason, finite expiry, compensating controls, monitoring, audit, revocation action, retrospective and follow-up owner. Protected policy must allow that control and bound its TTL. Self-admission, history rewriting and declared non-waivable invariants are excluded. Expiry invalidates promotion and requires actual external credential revocation.

[E0] CE-PILOT-01 Retain the earlier independent-review cap of 48 elapsed hours. A real integration sets the deadline to satisfy both that cap and its two-working-day calendar; the local model checks the elapsed cap and does not implement a business-calendar service. The local model reports expired exceptions, required revocations and overdue reviews. It does not revoke external IAM credentials or create a tamper-proof remote audit record. Production requires automatic expiry/revocation and observable independent review.

Traceability and invalidation

CE-TRACE-01 Stable immutable references connect Customer evidence → Intent revision → Decision → Execution → Candidate → Evidence Bundle → Admission → Deployment → Production signal → Outcome review. References form a graph rather than one enormous editable document. Accepted changes append events and explicit supersession; record content is never silently overwritten.

CE-CTRL-01 The local projector checks record digests and the event hash chain, reports dangling/orphaned relationships, computes current/superseded status, expires evidence and invalidates downstream records after material changes. A trusted external checkpoint is required to detect history truncation/rewrite. A single-writer in-memory model is not a durable transactional multi-user store.

CE-CTRL-01 Role-filtered projections omit hidden node identities and hidden edges. The caller must authenticate the principal and provide independently verified roles; raw-log access and storage/API authorization remain external. Generated tracker/document views should carry source IDs, revisions and digests, with access appropriate to their audience. Bidirectional links must not leak inaccessible evidence.

Run the constructed model

[E0] CE-LIFE-01 Run node --test control-kernel.test.mjs and node control-demo.mjs from the reference package. The demo uses a fixed synthetic clock and constructed outcomes, checks the state path and graph projections, and issues no deployment authority. The published model report is E0, not production or pilot evidence.

CE-CTRL-01 The CLI provides node control-kernel.mjs authority graph.json, trace history.json and exceptions exceptions.json. Nonzero status reports declared prohibited paths, history/orphan defects or invalid/expired exceptions. Inputs are trusted-controller data models, not a source of real-world authorization. The lifecycle API reuses signed-envelope verification from the earlier preflight at verification/admission; it still needs protected record resolution, identity, runner and actuator services.

Staged hardening and readiness

[E0] CE-PILOT-01 The suggested twelve-week order is a planning sequence, not a scheduled or completed pilot. First restore claim credibility, then formalize semantics, then implement and observe real boundaries, and only then interpret experimental outcomes.

Independent implementation exit

CE-STATUS-01 An independent adopter must reproduce the state/permission/expiry/invalidation behaviors from the specification, resolve ambiguities as versioned corrections, and exercise real denied effects before production autonomy. That study and a completed controlled pilot remain absent. The model is not operationally complete merely because local tests pass.