Deliverables C and D · "Ternary Logic" (TL) Governance API
Smart Contract ABI and EIP-712 Typed Data
ABI: function signatures, events, custom errors, struct types only — no Solidity source ·
tl_abi.json ·
eip712_typed_data.json
TL_Ledger_Core.sol
TL_Ledger_Core
function
anchorMerkleRoot
(bytes32 merkleRoot, uint256 batchTimestamp, CustodianQuorumAttestation[] attestations)
Anchors a Merkle root on-chain. Requires HybridShield custodian quorum. Emits MerkleRootAnchored.
| Parameter | Type | Note |
|---|---|---|
| merkleRoot | bytes32 | SHA-256 root of TGLF batch |
| batchTimestamp | uint256 | Unix epoch of batch |
| attestations | CustodianQuorumAttestation[] | operationType: 0 (ANCHOR_MERKLE) |
reverts QuorumNotMet
function
registerPermissionToken
(bytes32 tokenId, bytes32 logHash, bytes32 laneOriginHash, bytes32 merkleRoot, ...)
NL=NA Layer 5 enforcement. Registers a Permission Token on-chain. Reverts NLNAViolation if logHash is not provably included in an anchored Merkle root via verifyMerkleInclusion, or if laneOriginHash does not equal keccak256("AUDIT_LANE").
| Parameter | Type | Note |
|---|---|---|
| logHash | bytes32 | Layer 5 — must be in anchored Merkle root |
| laneOriginHash | bytes32 | Layer 2 — must equal keccak256("AUDIT_LANE") |
| merkleRoot | bytes32 | Previously anchored root |
reverts NLNAViolation(violationReason)
0=MERKLE_NOT_FOUND, 1=INVALID_LANE_ORIGIN
view
verifyPermissionToken
(bytes32 tokenId) → (bool valid, uint8 revocationStatus, int256 remainingLifetimeMs)
Read-only verification of Permission Token validity, revocation status, and remaining lifetime. Actuation layer calls this before firing.
pure
verifyMerkleInclusion
(bytes32 logHash, bytes32[] proofPath, bytes32 merkleRoot) → bool
Pure function. Verifies a log hash is included in a Merkle root given a proof path. Used internally by registerPermissionToken (NL=NA Layer 5) and exposed for external auditor verification.
function
activateEpistemicHoldSystemWide
(bytes32 triggerLogHash, CustodianQuorumAttestation[] attestations)
Activates system-wide Epistemic Hold. Requires custodian quorum attestation (operationType: 1). Emits EpistemicHoldActivated.
reverts QuorumNotMet
function
resolveEpistemicHoldSystemWide
(uint8 resolvedState, bytes32 resolutionLogHash, CustodianQuorumAttestation[] attestations)
Resolves system-wide Epistemic Hold. resolvedState uint8: 0=REFUSE, 1=PROCEED. State 0 (Epistemic Hold) is not a valid resolution. Reverts InvalidResolutionState for any other value.
reverts InvalidResolutionState
State 0 constitutionally prohibited as resolution
function
executeEmergencyOverride
(uint8 overrideType, uint8 forcedState, bytes32 justificationLogHash, ...)
Break-glass override. Logged before execution — audit trail exists before state change. forcedState uint8: 0=EpistemicHold, 255=Refuse. Proceed (+1) is constitutionally blocked and will revert. Emits EmergencyOverrideExecuted.
| forcedState value | Meaning |
|---|---|
| 0 | EpistemicHold (State 0) |
| 255 | Refuse (State −1) |
| any other | reverts UnauthorizedOverride — Proceed blocked |
function
revokePermissionToken
(bytes32 tokenId, uint8 revocationReason, bytes32 revocationMerkleRoot)
Revokes a previously registered Permission Token. revocationMerkleRoot anchors the revocation on-chain. Revocation reasons: 0=EMERGENCY_OVERRIDE, 1=TRI_CAMERAL_DECISION.
Events — TL_Ledger_Core
eventMerkleRootAnchored(bytes32 merkleRoot, uint256 batchTimestamp, uint256 blockNumber)
Emitted when a Merkle root batch is anchored on-chain. batchTimestamp is the off-chain epoch of the batch; blockNumber is the on-chain confirmation block.
eventPermissionTokenRegistered(bytes32 tokenId, bytes32 logHash, bytes32 merkleRoot, uint256 expiresAt)
Emitted when a Permission Token is successfully registered. logHash and merkleRoot are the NL=NA Layer 4/5 binding fields.
eventEpistemicHoldActivated(bytes32 triggerLogHash, uint256 activatedAt)
Emitted on system-wide Epistemic Hold activation. All downstream actuation gates must observe this event and halt.
eventEpistemicHoldResolved(uint8 resolvedState, bytes32 resolutionLogHash, uint256 resolvedAt)
Emitted on resolution. resolvedState 0=REFUSE, 1=PROCEED. Never emitted with State 0 (Epistemic Hold) as resolved state.
eventEmergencyOverrideExecuted(uint8 overrideType, uint8 forcedState, bytes32 justificationLogHash)
Emitted BEFORE state change — audit log precedes execution. This ordering is constitutional: the log exists before the action fires.
eventLanternStatusBroadcast(bytes32 lanternHash, uint8 compliancePosture, uint256 broadcastAt)
Goukassian Principle Lantern public beacon. compliancePosture uint8 maps to LanternStatus.compliancePosture enum.
Custom Errors
errorNLNAViolation(uint8 violationReason)
violationReason: 0=MERKLE_NOT_FOUND (logHash not in anchored root), 1=INVALID_LANE_ORIGIN (laneOriginHash ≠ keccak256("AUDIT_LANE")). Terminal NL=NA Layer 5 enforcement.
errorEpistemicHoldActive()
Reverted when a state-mutating operation is attempted while system-wide Epistemic Hold is active.
errorQuorumNotMet(uint8 provided, uint8 required)
HybridShield custodian quorum insufficient for the requested operation type.
errorInvalidResolutionState(uint8 attempted)
Reverted when resolveEpistemicHoldSystemWide is called with a value other than 0 (REFUSE) or 1 (PROCEED). State 0 is constitutionally prohibited as a resolution target.
errorUnauthorizedOverride()
Reverted when executeEmergencyOverride is called with forcedState targeting +1 (Proceed). Constitutionally blocked.
errorTokenExpired(bytes32 tokenId, uint256 expiredAt)
Reverted when an actuation attempt references a Permission Token past its expiresAt timestamp. No grace period.
ITL_Validator.sol
ITL_Validator
function
verifyEconomicRightsCompliance
(uint256[3] baselIiiVector, uint256[2] fatfVector, uint256[4] ioscoVector)
Verifies Basel III + FATF + IOSCO compliance vectors. Returns compliant bool, violationCode bytes32, and forcedState uint8 (0=EPISTEMIC_HOLD, 255=REFUSE). Emits EconomicRightsMandateViolationDetected on non-compliance.
| Vector | Elements |
|---|---|
| baselIiiVector | [0] lcr (scaled 1e18), [1] nsfr (scaled 1e18), [2] capitalRatio |
| fatfVector | [0] sanctionsHit bool, [1] sarRequired bool |
| ioscoVector | [0] layering, [1] spoofing, [2] washTrading, [3] crossMarket |
function
verifySustainableCapitalCompliance
(uint256 carbonFootprintVerified, uint256 greenBondEligibility, uint256 esgScore)
Verifies Paris Agreement and ESG compliance. Emits SustainableCapitalMandateViolationDetected on non-compliance.
function
verifyGoukassianLicense
(bytes32 licenseHash, uint8 violatedArtifact, bytes32 agentSignature)
Verifies Goukassian Principle license compliance. violatedArtifact ordinals: 1=lantern, 2=signature, 3=license. Emits GoukassianLicenseViolationDetected on violation.
function
recordMandateViolation
(uint8 mandateId, bytes32 violationHash, uint256 timestamp)
Records a mandate violation immutably on-chain. mandateId: 0=No Spy, 1=No Weapon, 2=No Switch Off. These three mandates are beyond all governance bodies' authority to suspend.
EIP-712 Domain Separator
EIP712Domain
name"TLGovernance"
version"1.0.0"
chainId1 (placeholder — deployment-specific)
verifyingContractplaceholder — deployment-specific
saltkeccak256("TL_API_SALT_V1_0_0") — placeholder
EIP-712 Primary Types
GovernanceTraceLog
currentStateint8 — preserves signed triadic semantics. int8(0) ≠ bool false.
logHashbytes32
merkleRootbytes32
epochTimestampuint256
PermissionToken
laneOriginbytes32 — must equal keccak256("AUDIT_LANE")
logHashbytes32 — NL=NA Layer 4 binding
merkleRootbytes32 — NL=NA Layer 4 binding
EmergencyOverride
forcedStateuint8 — 255=Refuse(−1), 0=EpistemicHold(0). Proceed (+1) blocked.
overrideTypeuint8
GoukassianSignatureAttestation
artifactNamebytes32 — keccak256("signature")
signatureAlgorithmIduint8 — slots 6 (SLH-DSA-SHAKE-128s) and 7 (ML-KEM-1024) reserved FUTURE
Canonical Hash Registry
canonicalArtifactNameHashes
keccak256("lantern")0x... (see eip712_typed_data.json)
keccak256("signature")0x... (see eip712_typed_data.json)
keccak256("license")0x... (see eip712_typed_data.json)
canonicalMandateHashes
keccak256("No Spy")0x... (see eip712_typed_data.json)
keccak256("No Weapon")0x... (see eip712_typed_data.json)
keccak256("No Switch Off")0x... (see eip712_typed_data.json)
laneOriginHash (NL=NA Layer 2)
keccak256("AUDIT_LANE")0x... (see eip712_typed_data.json) — registerPermissionToken reverts NLNAViolation on mismatch