Core Types
TLState integer SHIPPING EpistemicHold (I)
Three-state enumeration. +1=Proceed, 0=Epistemic Hold, −1=Refuse. State 0 is never null, false, error, timeout, pending, or retry. State −1 canonical label is Refuse. Halt prohibited.
ConstraintValueNote
enum[-1, 0, 1]Signed integer. NL=NA Layer 1 if/then evaluates on this field.
typeintegerNever boolean. int8(0) ≠ bool false.
TLStateLabel string SHIPPING EpistemicHold (I)
Human-readable PascalCase label paired with TLState integer.
ConstraintValue
enum["Proceed", "EpistemicHold", "Refuse"]
PillarIdentifier string enum SHIPPING All Pillars
Canonical machine-readable identifiers for the Eight Pillars. Used in x-tl-pillar annotations on every endpoint.
ValuePillar
EpistemicHoldPillar I
ImmutableLedgerPillar II
GoukassianPrinciplePillar III
DecisionLogsPillar IV
EconomicRightsAndTransparencyMandatePillar V
SustainableCapitalAllocationMandatePillar VI
HybridShieldPillar VII
AnchorsPillar VIII
StateEnvelope object SHIPPING EpistemicHold (I)
Canonical TL response wrapper. NL=NA Layer 1: permissionToken REQUIRED when currentState==1 (if/then). GovernancePause is workflow name, not state synonym. unevaluatedProperties: false prevents bypass.
PropertyRequiredTypeNL=NANote
currentStaterequiredTLStateLayer 1if/then evaluates on this field
stateLabelrequiredTLStateLabelLayer 1const per state branch
proposedActionrequiredstringminLength: 1
processActiverequiredstringGovernancePause (0) | ProceedAuthorized (1) | RefusalPermanent (−1)
permissionTokenif currentState==1PermissionTokenLayer 1Required when +1. Constitutionally prohibited on 0 or −1.
escrowRecordif currentState==0EscrowRecordRequired when 0.
traceIdUUIDv4Echoes X-TL-Trace-Id header
NL=NA Schemas
PermissionToken object SHIPPING ImmutableLedger (II)
NL=NA cryptographic enforcement artifact. laneOrigin const "AUDIT_LANE" — Inference Lane tokens are schema-invalid. maxLifetimeMs maximum 300000 aligned with DLLA Audit Lane 300ms ceiling. Actuation layer MUST reject expired tokens — no grace period.
PropertyTypeNL=NANote
tokenIdUUIDv4Layers 2,3,4,5
logHashSHA256HexLayers 4, 5MUST match AuditProof.logHash
laneOriginconst "AUDIT_LANE"Layer 2Schema-invalid for any other value
merkleRootSHA256HexLayers 4, 5MUST match AuditProof.merkleRoot. Layer 5: registerPermissionToken reverts NLNAViolation if logHash not in root.
expiresAtISO8601DateTimeHard expiration. No grace period.
maxLifetimeMsintegermaximum: 300000 (DLLA Audit Lane ceiling)
revocationStatusenumACTIVE | REVOKED_BY_EMERGENCY | REVOKED_BY_TRI_CAMERAL
custodianQuorumAttestationstringBETA Token valid without it for SHIPPING.
AuditProof object SHIPPING ImmutableLedger (II)
NL=NA Layer 4: logHash and merkleRoot MUST match PermissionToken fields. Cross-reference is the cryptographic link between Audit Lane log commitment and Permission Token issuance.
PropertyNL=NANote
logHashLayer 4MUST = PermissionToken.logHash
merkleRootLayer 4MUST = PermissionToken.merkleRoot
merkleProofPathLayer 5Full Merkle inclusion proof
NLNAAuditToken object SHIPPING ImmutableLedger (II)
Audit lane completion token. Non-MT deployments MUST use sentinel value "NULL_PUF_DEPLOYMENT" for pufAttestation. Architecture B compensating controls: software enforcement active.
PropertyNote
pufAttestationNon-MT: use sentinel "NULL_PUF_DEPLOYMENT" · FUTURE: FULL_PUF
laneStatusenum: pending | committed | anchored
Epistemic Hold Schemas
EscrowRecord object SHIPPING EpistemicHold (I)
Single authoritative definition of all Epistemic Hold response fields. Created at hold initiation. Immutable. heldState const 0.
PropertyRequiredNote
escrowIdrequiredUUIDv4
heldStaterequiredconst: 0
holdRationalerequiredrationale · uncertaintyScore [0,1] · pillarImplicated
resolutionDeadlinerequiredTerminal state must be +1 or −1. State 0 invalid.
immutableLogHashrequiredSHA256Hex
requiredConditionsrequiredarray minItems: 1 — each with conditionId, description, met bool
windowComparatorReadingrequiredSHIPPING: softwareEnforcementActive · FUTURE: resistanceRangeOhm
TGLF_State0 object SHIPPING EpistemicHold (I)
TGLF record for Epistemic Hold. currentState const 0. stateLabel const "EpistemicHold". processActive const "GovernancePause" — workflow name, not state synonym.
TGLF_StateNeg1 object SHIPPING ImmutableLedger (II)
TGLF record for Refuse. stateLabel const "Refuse" — Halt prohibited. refusalIsPermanent default true. No Permission Token issued.
TGLF_StateP1 object SHIPPING ImmutableLedger (II)
TGLF record for Proceed. permissionToken REQUIRED (NL=NA Layer 3). pillarsCertified minItems 8, maxItems 8 — all Eight Pillars must be certified.
PropertyNL=NA
permissionTokenLayer 3 — REQUIRED
pillarsCertifiedLayer 3 — minItems 8, maxItems 8
auditProofLayer 4
Governance Schemas
GoukassianPrincipleBlock object SHIPPING GoukassianPrinciple (III)
Three Goukassian Principle artifacts. Required on every POST /decisions, POST /audit-logs, and POST /evaluate/* request. artifactName const values are canonical lowercase.
ArtifactartifactName constKey Field
lantern"lantern"lanternHash (SHA256Hex)
signature"signature"agentSignature (Ed25519Hex)
license"license"licenseScope (string[])
LanternStatus object SHIPPING GoukassianPrinciple (III)
Goukassian Principle Lantern status. artifactName const "lantern". compliancePosture includes EPISTEMIC_HOLD_ACTIVE — reflecting constitutional state, not error. pillarStatuses reflects all 8 pillars.
SignatureBlock object SHIPPING GoukassianPrinciple (III)
artifactName const "signature". SHIPPING: ES256 (default) or Ed25519. SLH-DSA-SHAKE-128s (id 6) and ML-KEM-1024 (id 7) are FUTURE-reserved. SHIPPING MUST NOT emit values 6 or 7.
TriCameralApproval object SHIPPING HybridShield (VII)
Technical Council (9 members, proposal rights). Stewardship Custodians (11 members, binding veto). Smart Contract Treasury (automatic execution, no admin key).
BodytotalMembers (const)Authority
technicalCouncilVotes9Proposal rights only
stewardshipCustodianVotes11Binding veto — vetoExercised: true blocks constitutionally
smartContractTreasuryExecutionAutomatic. No admin key. No human override.
EmergencyOverrideRequest object SHIPPING HybridShield (VII)
NL=NA without exception. forcedState enum [−1, 0] only. Forced +1 constitutionally blocked. forcedStateExpiresAt required for FORCED_STATE_TRANSITION.
overrideTypeConstraint
BREAK_GLASS_SHUTDOWNSystem-wide halt
KILL_SWITCHPermanent State −1
FORCED_STATE_TRANSITIONRequires targetDecisionId + forcedStateExpiresAt
Infrastructure Schemas
EKRRecord object SHIPPING HybridShield (VII)
Ephemeral Key Rotation record. HKDF-SHA3-256 key destruction achieves GDPR Article 17 cryptographic erasure. hkdfSha3256Confirmed: true field confirms the algorithm was used.
SuccessionDeclaration object SHIPPING Anchors (VIII)
Notarized, timestamped, anchored governance continuity instrument. Expiry triggers SUCCESSION_DECLARATION_EXPIRED_ERROR. validUntil field establishes constitutional deadline.
TLProblemDetail object SHIPPING All Pillars
RFC 7807 application/problem+json with mandatory TL extensions. x-tl-state never omitted on any error response.
Error Code
GHOST_GOVERNANCE_DETECTED_ERROR
NLNA_VIOLATION_ERROR
EPISTEMIC_HOLD_TIMEOUT_ERROR
LANTERN_FORFEIT_ERROR
PILLAR_VIOLATION_ERROR
SUCCESSION_DECLARATION_EXPIRED_ERROR
SUCCESSION_DECLARATION_REQUIRED_ERROR
QUORUM_NOT_MET_ERROR
TRI_CAMERAL_VETO_ERROR
REGULATORY_COMPLIANCE_ERROR
LICENSE_SCOPE_EXCEEDED_ERROR
WINDOW_COMPARATOR_FAILURE_ERROR
DECISION_LOG_VIOLATION_ERROR
MetricsSummary object SHIPPING DecisionLogs (IV)
System-wide metrics. ghostGovernanceDetectionRate reflects all 8 Pillars. stateDistribution.proceed + .epistemicHold + .refuse covers all constitutional states.