Security claims you can execute, not architecture you have to trust.

A Class-A approval or denial is a device-signed terminal decision over the same canonical action context; the operator cannot relabel the outcome after signing or use bearer authentication to deny a Class-A request.

A binding-moment resolution preserves approved, declined, amended, and rejected as distinct device-signed outcomes bound to the exact well-formed source envelope and action; no negative outcome authorizes the original action, and an approval authorizes only under a complete relying-party-pinned acceptance context.

A receipt cannot turn a relying-party-pinned Class-A approver key into a bare Class-B signature path by self-declaring a weaker key class.

An authentic device-signed negative human decision remains verifiable decision evidence but cannot satisfy approval, separation-of-duties, quorum, assurance, authority, action-material, or reliance predicates in the Trust Receipt verifier.

A quorum cannot count the initiator as an approver or let one device key fill two approval seats.

An authority proof is accepted only under a relying-party-pinned registry issuer and only within its action, role, policy, time, currency, amount, organization, and delegation scope.

Within an accepted delegation path, action and audience selectors can only narrow, budget dimensions and expiry cannot increase, and cycles or a leaf naming itself as an ancestor are refused. Each signed capability declares direct or cascade revocation: direct revocation blocks the named capability and future child allocation from it without retracting previously registered descendants by itself; cascade revocation also blocks later descendant reservations and child allocations. Aggregate sibling-budget conservation and immediate cascade inheritance are claimed only when parent-funded child operations, allocations, reservations, revocations, and commits share one authoritative atomic state domain with complete current ancestor state; neither property is inferred from path containment or claimed across independent stores.

A cryptographically valid packet still refuses reliance unless signed action material satisfies the relying party's pinned assurance, organization-bound authority, exact registry head and epoch floor, policy, revocation, issuer, and consumption profile.

A terminal revocation is accepted only under a pinned revoker key, for the exact well-formed target, with a valid effective instant at or before the evaluation time; once effective, it does not age out. Fresh evidence that a target is currently not revoked is a separate status input.

Outcome Binding accepts an in-bounds result only after a fully verified Trust Receipt and a pinned executor attestation bind the exact receipt identifier, complete receipt digest, action digest, and consumption nonce. The signed predicted-effects commitment is always evaluated, relying-party policy can add refusal but cannot widen it, and the result digest commits the exact inputs, checks, reasons, and outcome.

Multi-source Outcome Binding credits an independent-observer role only when the observation signature verifies under a relying-party-pinned, current Ed25519 key whose canonical key identity and declared control domain differ from every non-independent source. Relying-party source requirements can require distinct-source quorum by key and control domain, and observation-window policy binds the accepted observation interval and maximum attestation delay before reconciliation can be valid.

The Authority Document-Proof join accepts only a proof issuer, not action authority, when a relying-party-anchored continuous document chain resolves the proof key from the newest document effective at the authenticated proof time, the key has the authority-proof usage and is not revoked, the proof and document identities match, and exact registry-head and minimum-epoch pins are supplied. An older document cannot resurrect an omitted key, and a revoked rotation or proof key fails closed.

A timestamp token carries weight only when its imprint binds the expected receipt digest and its signer matches a relying-party-pinned TSA key.

An AE-CHALLENGE binds the canonical action and governing policy, is exposed only after atomic durable registration of its exact body, and is consumed on the first valid evaluation attempt across workers and restarts.

Across concurrent workers and process restarts, one receipt has at most one active reservation, and only its opaque owner token can commit or release it.

After an external executor is invoked, an exception is treated as an indeterminate effect and the approval is consumed or frozen rather than made reusable.

A pinned network-witness stream advances monotonically until two different signed statements claim the same sequence. That conflict permanently poisons the exact tenant, gate, witness, and capture-point stream; no later sequence can restore acceptance under that stream identity.

The stateful AEC execution gate pins custom component verifiers, verifier keys, human profiles, and the requirement at construction, captures the validated store and logger methods, and refuses transaction-scoped trust configuration. It reserves one non-expiring key derived only from the executor-bound canonical action digest before effect, so presenter-controlled decoy components, alternate proof forms, or post-construction method replacement cannot mint a fresh replay key for the same action. Production construction also requires an ownership-fenced durable consumption backend and a strict atomic shared-head evidence log that continues across replicas and restarts; the gate independently rehashes and exactly matches each acknowledgment, and successful atomic append readback must equal the submitted sequence, predecessor, identifier, and content.

Rx evidence artifacts reject unknown or direct patient and clinical fields, use pairwise patient references and keyed source-record commitments, export a projection rather than recursively copying the transaction, and disclose it only under a pinned audience, purpose, policy, retention, artifact, and key-scope profile.

The verify SDK canonicalizes package file modes, packs twice to byte-identical tarballs, and the publish workflow attests and publishes that exact tarball before comparing the registry copy byte-for-byte.

The Python verifier builds its wheel and source distribution twice under a pinned source epoch, attests and publishes those exact bytes, and refuses a downloaded PyPI wheel or source distribution whose bytes differ.

Every declared npm and PyPI release requires a version-bound owner dispatch and protected-environment approval or explicit recorded administrator bypass, tests source from an immutable tag on main, constructs reproducible package bytes, attests the exact artifact with security and conformance manifests, publishes through OIDC, and compares every registry artifact byte-for-byte after publication.

The Go verifier release preflights the exact workflow-dispatched main commit with read-only credentials and the module's declared minimum Go toolchain. After protected-environment approval, a separate API-only job creates the exact version tag at that commit. A final read-only job downloads only from proxy.golang.org with sum.golang.org verification, checks Path, Version, Sum, GoModSum, and the complete VCS origin tuple, and refuses unless the proxy source tree equals the tested module source.

A Model-to-Matter presentation clears at most once only when all six evidence types verify under the executor's constructor-pinned profile, bind the same exact closed action, satisfy freshness and the pinned revocation provider, and survive durable challenge and CAID-keyed action consumption. The executor recomputes the registered CAID over the same bytes as the legacy action digest, emits both identifiers in the clearance, and binds both into its signed effect statement. The production executor refuses transaction-scoped profile, store, revocation, time, and retry configuration and captures validated state methods against post-construction replacement.

EP-AEC returns satisfied=true (and an equivalent legacy allow alias) only when the relying party independently pins both its requirement and the exact executor action. Presenter labels are non-authoritative. The ep-receipt human leg requires a fresh Section 6.2 Trust Receipt with Class-A WebAuthn, a pinned approver directory, RP audience, signed WebAuthn origin allowlist, policy hash, and log key; a bare operator-signed envelope is refused. The ep-quorum leg requires a fresh exact pinned policy plus RP audience, signed WebAuthn origin allowlist, context policy, and key-to-identity-to-role directory. These predicates execute identically in JavaScript, Python, and Go.

An ep-platform-attestation AEC leg is satisfied only by a closed, verifier-signed EAT/JWT attestation result under the relying party's pinned Ed25519 key, profile, audience, nonce, exact action digest, accepted build measurement, verification time, and maximum age. Presenter-supplied keys and verifier overrides are refused. Acceptance does not claim that EMILIA appraised raw hardware evidence or independently established a TPM, TEE, secure-boot chain, or genuine device.

The public experimental Authority Program verifier accepts a signed series/parallel authority program only under relying-party-pinned program and per-organization stage keys, an independently recomputed root CAID and canonical-action digest, exact predecessor stage-receipt digests, closed native AEC and AOM results, capability narrowing, and authoritative parallel allocation proof. A valid result explicitly does not prove freshness, current revocation status, execution, or deployment.

A native mobile approval or denial is accepted only when exact relying-party-created action, presentation, decision, profile, app, enrollment, origin, and validity bytes pass the pinned Class-A WebAuthn path, independently verified platform evidence is bound to the same request, and the exact registered challenge body is consumed atomically and recorded durably.

A CAID-bound mobile action becomes executable only after its approval threshold is met; consequence authority is consumed once under a tenant-scoped operation identifier, server-random nonce, and frozen executor key. A provider timeout becomes durable INDETERMINATE and is not retry-safe. A terminal outcome is accepted only from an exact signed provider statement bound to the same operation, CAID, action digest, nonce, executor, and still-active frozen key; the database rechecks that key in the commit transaction and retains the signed statement while bounded mobile exports expose only its digest.

A regulatory mobile evidence package is accepted only when its CAID, exact action, Class-A WebAuthn signoff, presentation, policy, enrollment, receipt-log proof, signed operator execution record, and atomic audit record join under a separately provisioned relying-party trust bundle. The offline report distinguishes directly recomputed cryptographic facts from the operator's signed statements about online platform verification, one-time challenge consumption, and durable audit append.

A mobile enrollment becomes active only after the agency authorizes the authenticated caller for the named approver at issuance and completion, a WebAuthn registration adapter returns an ES256 P-256 credential under the exact RP, origin, challenge, and user-verification requirements, a platform adapter independently verifies integrity evidence over the exact enrollment binding, the challenge is consumed once, and the directory plus audit event commit atomically.

A GRACE curtailment reaches dispatch only while one canonical action is active, inside the pinned envelope, and approved by the required distinct Class-A mobile roster; post-dispatch compliance is computed only from a separately keyed meter statement, a confirmed Action State record requires that meter digest, and a compliant settlement entitlement is consumed at most once.

Inside a completely mediated licensed-custodian integration, Action Escrow reserves and requests at most one release for the exact DAB-bound milestone action only after a relying-party-pinned document mapping, distinct party agreement acceptances, exact committed completion evidence, distinct party release approvals that remain fresh at admission and immediately before the effect, authenticated funding state, and durable compare-and-swap reservation all join. When a project-system source is supplied, its complete stable snapshot digest binds the provider origin, company, project, record type and identifier, normalized payload, observation time, and non-authoritative claim boundary as a signed typed material term inside that exact action. The portable package keeps project source, document execution, agreement acceptance, release approval, and custodian effect as separate independently reverified rows.

A receipt program executes only through an already configured Gate after the relying-party-pinned CAID resolver binds the exact executor-owned action and stable operation identifier to an issuer-signed bounded capability. Gate reserves budget before provider entry and commits the operation as executed or indeterminate; a real provider deadline, response loss, invalid output, replay, action substitution, operation relabeling, transaction-scoped trust configuration, and provider mutation of Gate-owned inputs cannot reopen or bypass the consequence boundary. Only after Gate terminal evidence exists, the pinned KMS/HSM signer succeeds, and the complete certificate is appended to the atomic evidence log does the kernel return durable proof over the exact program, context, bounded result projection, step sequence, and linked Gate evidence references. Signer, certificate-log, and post-commit evidence failures preserve the durable Gate outcome without issuing contradictory proof.

For an exact Reliance Program and separately admitted action, the reference reliance risk plane verifies a separately signed loss-allocation schedule without treating it as authorization, reserves aggregate open exposure before provider invocation, preserves that exposure through invoking and indeterminate outcomes, refuses blind retry, and permits terminal closeout only through the configured independent reconciliation authority. Exact-action refusal statements, period coverage reconciliations, governed-taxonomy receipt censuses with coarse primary suppression, and signed loss-experience feeds with trusted current-head correction lineage remain non-authorizing evidence artifacts with explicit claim boundaries.