TML Specification Architecture — Deliverable E
Constitutional Compliance Matrix
Every OpenAPI path and every JSON Schema property mapped to monograph section, TML Pillar, regulatory nexus, and implementation status
Regulatory Nexus Guard
Regulatory mappings are made only to provisions explicitly cited or unmistakably implied in the TML Constitutionalization Monograph v3.3. All other regulatory cells carry: Not directly referenced in monograph. This guard applies to EU AI Act Articles, NIST RMF Functions, ISO 42001 Clauses, and FRE 902 Rules throughout this matrix.
Regulatory mappings are made only to provisions explicitly cited or unmistakably implied in the TML Constitutionalization Monograph v3.3. All other regulatory cells carry: Not directly referenced in monograph. This guard applies to EU AI Act Articles, NIST RMF Functions, ISO 42001 Clauses, and FRE 902 Rules throughout this matrix.
Status Key:
SHIPPING — buildable with 2025 production libraries
BETA — buildable with documented tradeoffs
FUTURE — blocked by Section 10 constraint
Not directly referenced in monograph
Part 1 — OpenAPI Path Compliance
All 22 paths + 2 webhooks mapped to monograph section, pillar(s), regulatory nexus, and status
1.1 Inference Lane
| Path | Method | Operation | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|---|
| /decisions | POST | Submit Decision Vector | Section 2.3 | SacredZeroAlwaysMemory | Art. 9 (Risk Mgmt); Art. 13 (Transparency) | ID.RA-01; DE.CM-01 | Cl. 6.1.2; Cl. 8.4 | Not directly referenced | SHIPPING |
| /decisions/{decisionId} | GET | Retrieve Decision Record | Section 2.3; Section 8 | AlwaysMemoryMoralTraceLogs | Art. 13; Art. 19 (Logging) | ID.AM-03; DE.AE-02 | Cl. 8.5; Cl. 9.1 | Rule 902(11) | SHIPPING |
1.2 Anchoring Lane
| Path | Method | Operation | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|---|
| /anchoring-logs | POST | Submit Moral Trace Log; Request Permission Token | Section 2.3.3; Section 8 | AlwaysMemoryPublicBlockchainsMoralTraceLogs | Art. 12 (Record-keeping); Art. 19 | PR.DS-01; PR.DS-10; DE.CM-09 | Cl. 7.5; Cl. 8.5; Cl. 9.1 | Rule 902(11); Rule 902(13) | SHIPPING |
| /anchoring-logs/{logId} | GET | Retrieve Anchoring Log Record | Section 8 | MoralTraceLogsPublicBlockchains | Art. 12; Art. 19 | DE.AE-02; ID.AM-03 | Cl. 8.5; Cl. 9.1 | Rule 902(11) | SHIPPING |
1.3 Sacred Zero Escalation
| Path | Method | Operation | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|---|
| /sacred-zero/escalations | GET | List Sacred Zero Escalation Queue | Section 2.2 | SacredZeroHumanRightsMandate | Art. 9; Art. 14 (Human Oversight) | GV.OC-01; DE.AE-06 | Cl. 6.1.2; Cl. 8.4 | Not directly referenced | SHIPPING |
| /sacred-zero/escalations/{id} | GET | Retrieve Sacred Zero Escalation Case | Section 2.2; Section 8 | SacredZeroMoralTraceLogs | Art. 14; Art. 19 | DE.AE-02; RS.AN-03 | Cl. 8.4; Cl. 9.1 | Rule 902(11) | SHIPPING |
| /sacred-zero/escalations/{id} | PATCH | Resolve Sacred Zero Escalation (Human Review) | Section 2.2 | SacredZeroHumanRightsMandateAlwaysMemory | Art. 14; Art. 22 (Fundamental Rights Impact) | RS.AN-03; RC.RP-01 | Cl. 8.4; Cl. 10.2 | Not directly referenced | SHIPPING |
| /sacred-zero/lantern | GET | Get Current Lantern Status | Section 2.4 | GoukassianPromise | Art. 13; Art. 50 (Transparency Obligations) | GV.OC-04; ID.RA-06 | Cl. 5.2; Cl. 7.4 | Not directly referenced | SHIPPING |
1.4 Refusal State
| Path | Method | Operation | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|---|
| /refusals | POST | Record Refusal State (State -1) | Section 2.3; Section 2.4 | SacredZeroGoukassianPromiseAlwaysMemory | Art. 9; Art. 12; Art. 19 | PR.DS-01; DE.CM-01 | Cl. 6.1.2; Cl. 7.5; Cl. 8.4 | Rule 902(11) | SHIPPING |
| /refusals/license-violations | POST | Record Goukassian Promise License Violation | Section 2.4 | GoukassianPromise | Art. 9; Art. 13 | DE.CM-01; ID.RA-01 | Cl. 6.1.2; Cl. 8.4 | Not directly referenced | SHIPPING |
1.5 Emergency Override
| Path | Method | Operation | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|---|
| /emergency/override | POST | Emergency Override — Break-Glass / Kill Switch | Section 13.3 | SacredZeroAlwaysMemoryHybridShield | Art. 9; Art. 14 | RS.MA-01; RC.RP-01; GV.OC-01 | Cl. 6.1.2; Cl. 8.4; Cl. 10.2 | Not directly referenced | SHIPPING |
| /emergency/status | GET | Get Emergency Override Status | Section 13.3 | SacredZeroHybridShield | Art. 14; Art. 9 | DE.AE-06; GV.OC-01 | Cl. 8.4; Cl. 9.1 | Not directly referenced | SHIPPING |
1.6 Auditor Verification
| Path | Method | Operation | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|---|
| /audit/verifications/merkle/{root} | GET | Verify Merkle Root | Section 8 | PublicBlockchainsMoralTraceLogs | Art. 19; Art. 72 (Post-market Monitoring) | DE.AE-02; ID.AM-03 | Cl. 9.1; Cl. 9.2 | Rule 902(13) | SHIPPING |
| /audit/verifications/inclusion/{logId} | GET | Get Log Inclusion Proof | Section 8 | PublicBlockchainsMoralTraceLogsAlwaysMemory | Art. 12; Art. 19 | DE.AE-02; PR.DS-10 | Cl. 7.5; Cl. 9.1 | Rule 902(11); Rule 902(13) | SHIPPING |
| /audit/custodians/{id}/heartbeat | GET | Get Custodian Heartbeat | Section 2.3.3 | HybridShield | Art. 9; Art. 19 | ID.AM-03; DE.CM-09 | Cl. 8.5; Cl. 9.1 | Not directly referenced | SHIPPING |
| /audit/compliance/attestation | GET | Pull Compliance Attestation | Section 2.4; Section 8 | GoukassianPromisePublicBlockchainsHumanRightsMandateEarthProtectionMandate | Art. 19; Art. 22; Art. 72 | GV.OC-04; DE.AE-02 | Cl. 9.1; Cl. 9.2; Cl. 9.3 | Rule 902(11) | SHIPPING |
1.7 Redress and Appeal
| Path | Method | Operation | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|---|
| /redress/challenges | POST | Submit Subject-Initiated Redress Challenge | Section 2.3.3 | HumanRightsMandateMoralTraceLogs | Art. 26(7) (Redress); Art. 85 (Right to Explanation) | RS.AN-03; GV.OC-01 | Cl. 8.4; Cl. 10.2 | Not directly referenced | SHIPPING |
| /redress/challenges/{id} | GET | Get Redress Challenge Status | Section 2.3.3 | HumanRightsMandateMoralTraceLogs | Art. 26(7); Art. 85 | RS.AN-03; DE.AE-02 | Cl. 8.4; Cl. 9.1 | Not directly referenced | SHIPPING |
| /redress/log-reevaluation | POST | Request Moral Trace Log Re-Evaluation | Section 8 | MoralTraceLogsAlwaysMemoryHumanRightsMandate | Art. 12; Art. 26(7); Art. 85 | RS.AN-03; PR.DS-10 | Cl. 7.5; Cl. 8.4; Cl. 10.2 | Rule 902(11) | SHIPPING |
| /redress/human-rights-grievances | POST | File Human Rights Grievance | Section 2.3.3 | HumanRightsMandateAlwaysMemoryPublicBlockchains | Art. 22; Art. 85 | GV.OC-01; RS.AN-03 | Cl. 6.1.2; Cl. 8.4; Cl. 10.2 | Not directly referenced | SHIPPING |
1.8 Regulator Inspection
| Path | Method | Operation | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|---|
| /regulator/evidence-export | POST | Request Bulk Evidence Export | Section 8 | MoralTraceLogsPublicBlockchainsAlwaysMemory | Art. 72; Art. 74 (Market Surveillance) | GV.OC-05; DE.AE-02; PR.DS-01 | Cl. 9.1; Cl. 9.2; Cl. 7.5 | Rule 902(11); Rule 902(13) | SHIPPING |
| /regulator/custodian-quorum | GET | Get Cross-Jurisdiction Custodian Quorum Status | Section 2.3.3 | HybridShield | Art. 9; Art. 19 | ID.AM-03; DE.CM-09 | Cl. 8.5; Cl. 9.1 | Not directly referenced | SHIPPING (endpoint); FUTURE (sub-500ms cross-jurisdiction) |
| /regulator/timestamp-verification/{logId} | GET | Verify Qualified Timestamp for Log Entry | Section 8 | MoralTraceLogsPublicBlockchains | Art. 12; Art. 19 | PR.DS-10; DE.AE-02 | Cl. 7.5; Cl. 9.1 | Rule 902(9); Rule 902(11) | SHIPPING |
1.9 Gateway
| Path | Method | Operation | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|---|
| /gateway/status | GET | Get TML Gateway Status (Fail-Closed) | Section 2.3 | SacredZeroAlwaysMemory | Art. 9; Art. 14 | DE.CM-09; GV.OC-01 | Cl. 8.4; Cl. 8.5 | Not directly referenced | SHIPPING |
| /gateway/lane-assignment | POST | Request Lane Assignment for Decision Vector | Section 2.3 | SacredZeroAlwaysMemoryMoralTraceLogs | Art. 9; Art. 13; Art. 14 | ID.RA-01; DE.CM-01; GV.OC-01 | Cl. 6.1.2; Cl. 8.4; Cl. 8.5 | Not directly referenced | SHIPPING |
1.10 Goukassian Promise
| Path | Method | Operation | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|---|
| /goukassian/signature | GET | Get Current Goukassian Promise Signature Block | Section 2.4 | GoukassianPromise | Art. 13; Art. 50 | GV.OC-04; ID.RA-06 | Cl. 5.2; Cl. 7.4 | Rule 902(11) | SHIPPING |
| /goukassian/license/validate | POST | Validate Goukassian Promise License | Section 2.4 | GoukassianPromise | Art. 9; Art. 13 | ID.RA-01; DE.CM-01 | Cl. 6.1.2; Cl. 8.4 | Not directly referenced | SHIPPING |
1.11 Webhooks
| Webhook | Event | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|
| sacredPauseEscalation | Sacred Pause operational workflow triggers human review when State 0 activates | Section 2.2 | SacredZero | Art. 14 (Human Oversight) | DE.AE-06; RS.AN-03 | Cl. 8.4; Cl. 10.2 | Not directly referenced | SHIPPING |
| lanternStatusBroadcast | Goukassian Promise Lantern compliance beacon update broadcast to registered observers | Section 2.4 | GoukassianPromise | Art. 13; Art. 50 | GV.OC-04 | Cl. 7.4; Cl. 5.2 | Not directly referenced | SHIPPING |
Part 2 — JSON Schema Definition Compliance
Every property from every $defs schema in tml_schema.json mapped at property level
2.1 Primitive and Shared Types
| Schema | Key Property / Constraint | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|
| TriadicStateValue | enum: [-1, 0, 1]; signed integer; State 0 = SACRED_ZERO (never null/error/timeout) | Section 2.3 | SacredZero | Art. 9 | ID.RA-01 | Cl. 6.1.2 | Not directly referenced | SHIPPING |
| TriadicStateLabel | enum: ["PROCEED","SACRED_ZERO","REFUSE"]; UPPER_SNAKE_CASE | Section 2.3 | SacredZero | Art. 13 | ID.RA-01 | Cl. 6.1.2 | Not directly referenced | SHIPPING |
| PillarIdentifier | enum of 8 canonical PascalCase pillar identifiers; no aliasing permitted | Section 2 (Eight Pillars) | All Pillars | Art. 9; Art. 13 | GV.OC-04 | Cl. 6.1.2 | Not directly referenced | SHIPPING |
| LaneOrigin | enum: ["INFERENCE_LANE","ANCHORING_LANE"]; maps to Dual-Lane Architecture | Section 2.3 | SacredZeroAlwaysMemory | Art. 9 | ID.AM-03 | Cl. 8.5 | Not directly referenced | SHIPPING |
| SHA256Hex | pattern: ^[a-f0-9]{64}$; tamper-evidence primitive | Section 8 | AlwaysMemoryMoralTraceLogs | Art. 12 | PR.DS-10 | Cl. 7.5 | Rule 902(11) | SHIPPING |
| ISO8601DateTime | format: date-time; RFC 3339 UTC; timestamp integrity primitive | Section 8 | MoralTraceLogs | Art. 12 | PR.DS-10 | Cl. 7.5 | Rule 902(9) | SHIPPING |
| UUIDv4 | format: uuid; UUID v4 pattern; unique identifier primitive | Section 8 | MoralTraceLogs | Not directly referenced | Not directly referenced | Not directly referenced | Not directly referenced | SHIPPING |
2.2 Permission Token
| Property | Constraint | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|
| tokenId | $ref UUIDv4 | Section 2.3.3; Section 5B.i | AlwaysMemoryMoralTraceLogs | Art. 12 | PR.DS-01 | Cl. 7.5 | Rule 902(11) | SHIPPING |
| logHash | SHA-256 of anchored TSLF; core No Log = No Action binding | Section 2.3.3; Section 5B.i | AlwaysMemoryMoralTraceLogsPublicBlockchains | Art. 12; Art. 19 | PR.DS-10; PR.DS-01 | Cl. 7.5; Cl. 9.1 | Rule 902(11) | SHIPPING |
| epochTimestamp | integer; minimum: 0; Unix epoch seconds | Section 5B.i | AlwaysMemory | Art. 12 | PR.DS-10 | Cl. 7.5 | Rule 902(9) | SHIPPING |
| signerKeyId | HSM key; HybridShield registry reference; maxLength: 256 | Section 2.3.3; Section 5B.i | HybridShieldGoukassianPromise | Art. 9 | PR.DS-01 | Cl. 8.5 | Not directly referenced | SHIPPING |
| laneOrigin | const: "ANCHORING_LANE"; schema-level rejection of Inference Lane tokens | Section 2.3; Section 5B.i | AlwaysMemory | Art. 9 | DE.CM-01 | Cl. 8.4 | Not directly referenced | SHIPPING |
| merkleRoot | SHA256Hex; non-repudiation binding to public blockchain anchor | Section 8; Section 5B.i | PublicBlockchainsAlwaysMemory | Art. 12; Art. 19 | PR.DS-10 | Cl. 9.1 | Rule 902(13) | SHIPPING |
| signatureValue | Base64url HSM signature; non-repudiation artifact; minLength: 64 | Section 2.4; Section 5B.i | GoukassianPromiseHybridShield | Art. 9; Art. 13 | PR.DS-01 | Cl. 8.5 | Rule 902(11) | SHIPPING |
| issuedAt / expiresAt | ISO8601DateTime; expiresAt: actuation layer MUST reject expired tokens (hard constraint) | Section 5B.i | AlwaysMemory | Art. 9; Art. 12 | PR.DS-10; DE.CM-01 | Cl. 7.5; Cl. 8.4 | Rule 902(9) | SHIPPING |
| custodianQuorumAttestation | object; optional BETA field; absence does not invalidate token | Section 2.3.3 | HybridShield | Art. 9 | ID.AM-03 | Cl. 8.5 | Not directly referenced | BETA |
2.3 State Envelope
| Property | Constraint | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|
| currentState | $ref TriadicStateValue; 0 = SACRED_ZERO; never null/error; drives if/then conditional | Section 2.3 | SacredZero | Art. 9; Art. 13 | ID.RA-01 | Cl. 6.1.2 | Not directly referenced | SHIPPING |
| stateLabel | constrained per state via if/then/else; must match currentState integer | Section 2.3 | SacredZero | Art. 13 | ID.RA-01 | Cl. 6.1.2 | Not directly referenced | SHIPPING |
| processActive | State 0: const "SacredPause" (workflow, not state synonym); State +1: "ActuationGated"; State -1: "RefusalLogging" | Section 2.2 | SacredZero | Art. 9; Art. 14 | DE.CM-01 | Cl. 8.4 | Not directly referenced | SHIPPING |
| proposedAction | binary Inference Lane proposal; Anchoring Lane dictates execution; maxLength: 2048 | Section 2.3 | SacredZeroAlwaysMemory | Art. 9 | ID.RA-01 | Cl. 6.1.2 | Not directly referenced | SHIPPING |
| permissionToken | REQUIRED when currentState == 1; schema-enforced via if/then; No Log = No Action enforcement | Section 2.3.3; Section 5B.i | AlwaysMemoryMoralTraceLogs | Art. 12; Art. 19 | PR.DS-01; DE.CM-01 | Cl. 7.5; Cl. 8.4 | Rule 902(11) | SHIPPING |
| if/then constraint | currentState +1 requires permissionToken; schema-level No Log = No Action; unevaluatedProperties: false | Section 2.3.3 | AlwaysMemoryMoralTraceLogs | Art. 12; Art. 19 | PR.DS-01 | Cl. 7.5 | Rule 902(11) | SHIPPING |
| justificationObject | $ref JustificationObject; travels Inference to Anchoring lane | Section 2.3 | MoralTraceLogsAlwaysMemory | Art. 12; Art. 13 | PR.DS-01 | Cl. 7.5 | Not directly referenced | SHIPPING |
| anchoring | Merkle batch metadata; populated post-Anchoring Lane | Section 8 | PublicBlockchainsAlwaysMemory | Art. 12; Art. 19 | PR.DS-10 | Cl. 9.1 | Rule 902(13) | SHIPPING |
2.4 Justification Object
| Property | Constraint | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|
| proposedState | TriadicStateValue; Inference Lane proposal only; not authoritative | Section 2.3 | SacredZero | Art. 9 | ID.RA-01 | Cl. 6.1.2 | Not directly referenced | SHIPPING |
| reasoningVector | array; minItems: 1; ordered reasoning chain with confidence scores | Section 2.3 | MoralTraceLogs | Art. 13 (Transparency) | DE.AE-02 | Cl. 7.5 | Not directly referenced | SHIPPING |
| uncertaintyScore | [0.0, 1.0]; breach of SacredZero threshold mandates State 0 regardless of binary engine proposal | Section 2.2; Section 2.3 | SacredZero | Art. 9 | ID.RA-01 | Cl. 6.1.2 | Not directly referenced | SHIPPING |
| pillarAssessments | object; all 8 pillar scores [0.0, 1.0] from Inference Lane | Section 2.3 | All Pillars | Art. 9; Art. 13 | ID.RA-01; GV.OC-04 | Cl. 6.1.2; Cl. 9.1 | Not directly referenced | SHIPPING |
| humanRightsMandateFlags | array; UDHR/Geneva provision flags; triggers mandatory HumanRightsMandate review | Section 2.3.3 | HumanRightsMandate | Art. 22 | DE.CM-01 | Cl. 6.1.2 | Not directly referenced | SHIPPING |
| earthProtectionMandateFlags | array; Paris Agreement provision flags; triggers mandatory EarthProtectionMandate review | Section 2.3.3 | EarthProtectionMandate | Art. 22 | DE.CM-01 | Cl. 6.1.2 | Not directly referenced | SHIPPING |
| inferenceEngineId | string; chain-of-custody for binary engine instance; maxLength: 256 | Section 8 | MoralTraceLogsAlwaysMemory | Art. 12 | PR.DS-01 | Cl. 7.5 | Not directly referenced | SHIPPING |
| inputHash | SHA256Hex of decision vector; tamper-evidence for input payload | Section 8 | AlwaysMemoryMoralTraceLogs | Art. 12 | PR.DS-10 | Cl. 7.5 | Rule 902(11) | SHIPPING |
2.5 Uncertainty Quantification
| Property | Constraint | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|
| overallUncertaintyScore | [0.0, 1.0]; score that breached the SacredZero threshold | Section 2.2 | SacredZero | Art. 9 | ID.RA-01 | Cl. 6.1.2 | Not directly referenced | SHIPPING |
| epistemicHoldActive | const: true in State 0 logs; Epistemic Hold is canonical TML term | Section 2.2 | SacredZero | Art. 9; Art. 14 | ID.RA-01 | Cl. 6.1.2; Cl. 8.4 | Not directly referenced | SHIPPING |
| uncertaintyDimensions | array; minItems: 1; per-dimension scores with descriptions | Section 2.2 | SacredZero | Art. 9 | ID.RA-01 | Cl. 6.1.2 | Not directly referenced | SHIPPING |
| thresholdBreached | [0.0, 1.0]; configured SacredZero threshold value that was breached | Section 2.2 | SacredZero | Art. 9 | ID.RA-01 | Cl. 6.1.2 | Not directly referenced | SHIPPING |
2.6 Deliberation Matrix
| Property | Constraint | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|
| considerations | array; minItems: 1; per-pillar ethical, factual, and legal considerations with weights | Section 2.2 | SacredZeroAll Pillars | Art. 9; Art. 14 | RS.AN-03 | Cl. 8.4 | Not directly referenced | SHIPPING |
| riskVectors | array; severity enum: LOW|MEDIUM|HIGH|CRITICAL; pillarImplicated per vector | Section 2.2 | SacredZero | Art. 9; Art. 14 | ID.RA-01; RS.AN-03 | Cl. 6.1.2; Cl. 8.4 | Not directly referenced | SHIPPING |
| resolutionOptions | proposedState enum: [1, -1] only; State 0 is NOT a valid resolution option; minItems: 2 | Section 2.2 | SacredZeroHumanRightsMandate | Art. 14 | RS.AN-03; RC.RP-01 | Cl. 8.4; Cl. 10.2 | Not directly referenced | SHIPPING |
2.7 Resolution Request
| Property | Constraint | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|
| priority | enum: STANDARD|ELEVATED|CRITICAL; assigned by Sacred Pause workflow | Section 2.2 | SacredZero | Art. 14 | RS.AN-03 | Cl. 8.4 | Not directly referenced | SHIPPING |
| deliberationMatrix | $ref DeliberationMatrix; full matrix for human reviewer | Section 2.2 | SacredZero | Art. 14 | RS.AN-03 | Cl. 8.4 | Not directly referenced | SHIPPING |
| deadlineAt | ISO8601DateTime; HybridShield failover protocols if exceeded | Section 2.2; Section 2.3.3 | SacredZeroHybridShield | Art. 14 | RS.AN-03 | Cl. 8.4 | Not directly referenced | SHIPPING |
2.8 TSLF-State0 (Sacred Pause Log)
| Property | Constraint | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|
| currentState | const: 0; discriminator; Sacred Zero is never null/error/timeout | Section 2.2; Section 8 | SacredZero | Art. 9; Art. 13 | ID.RA-01 | Cl. 6.1.2 | Not directly referenced | SHIPPING |
| stateLabel | const: "SACRED_ZERO"; always this value for State0 logs | Section 2.2 | SacredZero | Art. 13 | ID.RA-01 | Cl. 6.1.2 | Not directly referenced | SHIPPING |
| processActive | const: "SacredPause"; workflow executing within State 0; NOT a state synonym | Section 2.2 | SacredZero | Art. 9; Art. 14 | DE.CM-01 | Cl. 8.4 | Not directly referenced | SHIPPING |
| lanternStatus | $ref LanternStatus; required; must reflect SACRED_ZERO_ACTIVE at activation | Section 2.4; Section 2.2 | GoukassianPromiseSacredZero | Art. 13 | GV.OC-04 | Cl. 5.2; Cl. 7.4 | Not directly referenced | SHIPPING |
| committedAt | pre-actuation commit; AlwaysMemory anti-spoliation; committed before any human review | Section 8 | AlwaysMemory | Art. 12; Art. 19 | PR.DS-10 | Cl. 7.5 | Rule 902(11) | SHIPPING |
| pillarsCertified | array; minItems: 1; PillarIdentifier items; assessed at commit time | Section 2; Section 8 | All Pillars | Art. 9 | GV.OC-04 | Cl. 9.1 | Not directly referenced | SHIPPING |
| resolution | resolvedState enum [1|-1] only; justification minLength: 50; logged immutably | Section 2.2 | SacredZeroHumanRightsMandateAlwaysMemory | Art. 14 | RS.AN-03; RC.RP-01 | Cl. 8.4; Cl. 10.2 | Rule 902(11) | SHIPPING |
| merkleAnchoringStatus | optional; batchId, merkleRoot, anchoredAt, blockchainTxId | Section 8 | PublicBlockchainsAlwaysMemory | Art. 12; Art. 19 | PR.DS-10 | Cl. 9.1 | Rule 902(13) | SHIPPING |
2.9 License Violation Record
| Property | Constraint | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|
| violationType | enum: 5 values incl. LANTERN_SUPPRESSION, SIGNATURE_FORGERY, LICENSE_BREACH | Section 2.4 | GoukassianPromise | Art. 9 | DE.CM-01 | Cl. 6.1.2 | Not directly referenced | SHIPPING |
| violatedArtifact | enum: "lantern"|"signature"|"license"; canonical lowercase artifact names enforced by schema | Section 2.4 | GoukassianPromise | Art. 13 | DE.CM-01 | Cl. 5.2 | Not directly referenced | SHIPPING |
| evidenceHash | SHA256Hex of evidence artifact demonstrating the violation | Section 8 | AlwaysMemoryGoukassianPromise | Art. 12 | PR.DS-10 | Cl. 7.5 | Rule 902(11) | SHIPPING |
2.10 Threat Vector Analysis
| Property | Constraint | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|
| threatVectors | array; minItems: 1; 8-category enum incl. HUMAN_RIGHTS_VIOLATION, EARTH_PROTECTION_VIOLATION | Section 2.3 | All Pillars | Art. 9; Art. 22 | ID.RA-01; DE.CM-01 | Cl. 6.1.2 | Not directly referenced | SHIPPING |
| udhrProvision per vector | UDHR Article tracking; HumanRightsMandate vector enforcement | Section 2.3.3 | HumanRightsMandate | Art. 22 | DE.CM-01 | Cl. 6.1.2 | Not directly referenced | SHIPPING |
| parisAgreementProvision per vector | Paris Agreement tracking; EarthProtectionMandate vector enforcement | Section 2.3.3 | EarthProtectionMandate | Art. 22 | DE.CM-01 | Cl. 6.1.2 | Not directly referenced | SHIPPING |
| overallSeverity | enum: LOW|MEDIUM|HIGH|CRITICAL; aggregate across all vectors | Section 2.3 | MoralTraceLogs | Art. 9 | ID.RA-01 | Cl. 6.1.2 | Not directly referenced | SHIPPING |
2.11 Chain of Custody
| Property | Constraint | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|
| entries | array; minItems: 1; action enum: CREATED|RECEIVED|VALIDATED|ANCHORED|TRANSFERRED|REVIEWED|EXPORTED | Section 8 | MoralTraceLogsAlwaysMemory | Art. 12; Art. 19 | PR.DS-01; PR.DS-10 | Cl. 7.5; Cl. 9.1 | Rule 902(11) | SHIPPING |
| inputHash / outputHash per entry | SHA256Hex; tamper-evidence across handler transitions | Section 8 | AlwaysMemoryMoralTraceLogs | Art. 12 | PR.DS-10 | Cl. 7.5 | Rule 902(11) | SHIPPING |
2.12 TSLF-State-1 (Refusal Log)
| Property | Constraint | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|
| currentState | const: -1; discriminator | Section 2.3; Section 8 | SacredZero | Art. 9; Art. 13 | ID.RA-01 | Cl. 6.1.2 | Not directly referenced | SHIPPING |
| licenseViolation | optional; required when GoukassianPromise violation triggers refusal; logged before refusal commit | Section 2.4; Section 8 | GoukassianPromiseAlwaysMemory | Art. 9; Art. 13 | DE.CM-01 | Cl. 6.1.2 | Not directly referenced | SHIPPING |
| refusalIsPermanent | boolean; default: true; permanent unless Section 13.3 supreme authority Emergency Override | Section 13.3 | SacredZeroAlwaysMemory | Art. 9 | PR.DS-01 | Cl. 8.4 | Not directly referenced | SHIPPING |
| appealEligible | boolean; default: true; subject redress right under HumanRightsMandate | Section 2.3.3 | HumanRightsMandate | Art. 26(7); Art. 85 | GV.OC-01 | Cl. 10.2 | Not directly referenced | SHIPPING |
| committedAt | pre-actuation commit; AlwaysMemory / Pillar II | Section 8 | AlwaysMemory | Art. 12 | PR.DS-10 | Cl. 7.5 | Rule 902(11) | SHIPPING |
2.13 Ethical Verification & PillarVerificationResult
| Property | Constraint | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|
| pillarVerifications | object; all 8 PillarIdentifiers required; all must be PASSED for PROCEED; each value is PillarVerificationResult | Section 2.3.3 | All Pillars | Art. 9; Art. 13 | GV.OC-04; ID.RA-01 | Cl. 6.1.2; Cl. 9.1 | Not directly referenced | SHIPPING |
| overallVerdict | enum: PASSED|FAILED; FAILED triggers State -1 | Section 2.3.3 | All Pillars | Art. 9 | ID.RA-01 | Cl. 6.1.2 | Not directly referenced | SHIPPING |
| PillarVerificationResult.verdict | enum: PASSED|FAILED|NOT_APPLICABLE; FAILED blocks PROCEED | Section 2.3.3 | All Pillars | Art. 9 | GV.OC-04 | Cl. 6.1.2 | Not directly referenced | SHIPPING |
2.14 Audit Proof
| Property | Constraint | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|
| logHash | must match PermissionToken.logHash; proof-layer No Log = No Action enforcement | Section 2.3.3; Section 8 | AlwaysMemory | Art. 12 | PR.DS-10 | Cl. 7.5 | Rule 902(11) | SHIPPING |
| merkleRoot | must match PermissionToken.merkleRoot; cross-schema binding | Section 8 | PublicBlockchains | Art. 19 | PR.DS-10 | Cl. 9.1 | Rule 902(13) | SHIPPING |
| inclusionPath | array; minItems: 1; ordered sibling hashes LEFT|RIGHT from leaf to root | Section 8 | PublicBlockchains | Art. 12; Art. 19 | PR.DS-10 | Cl. 9.1 | Rule 902(13) | SHIPPING |
2.15 TSLF-StateP1 (Proceed Log)
| Property | Constraint | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|
| currentState | const: 1; discriminator | Section 2.3; Section 8 | AlwaysMemory | Art. 9; Art. 13 | ID.RA-01 | Cl. 6.1.2 | Not directly referenced | SHIPPING |
| theSignature | $ref SignatureBlock; required; Goukassian Signature binding log to constitutional provenance | Section 2.4 | GoukassianPromise | Art. 13 | PR.DS-01 | Cl. 5.2 | Rule 902(11) | SHIPPING |
| permissionToken | REQUIRED; in required array; log-level No Log = No Action enforcement | Section 2.3.3; Section 5B.i | AlwaysMemoryMoralTraceLogs | Art. 12; Art. 19 | PR.DS-01; DE.CM-01 | Cl. 7.5; Cl. 8.4 | Rule 902(11) | SHIPPING |
| pillarsCertified | minItems: 8; maxItems: 8; all Eight Pillars mandatory for PROCEED log validity | Section 2; Section 8 | All Pillars | Art. 9 | GV.OC-04 | Cl. 9.1 | Not directly referenced | SHIPPING |
| committedAt | log anchored before Permission Token released to actuation layer | Section 8 | AlwaysMemory | Art. 12 | PR.DS-10 | Cl. 7.5 | Rule 902(11) | SHIPPING |
2.16 Lantern Status
| Property | Constraint | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|
| artifactName | const: "lantern"; canonical Goukassian Promise artifact name (lowercase) | Section 2.4 | GoukassianPromise | Art. 13 | GV.OC-04 | Cl. 5.2 | Not directly referenced | SHIPPING |
| compliancePosture | enum: 5 values incl. SACRED_ZERO_ACTIVE, EMERGENCY_OVERRIDE_ACTIVE | Section 2.4 | GoukassianPromise | Art. 13; Art. 50 | GV.OC-04 | Cl. 5.2; Cl. 7.4 | Not directly referenced | SHIPPING |
| pillarStatuses | per-pillar live compliance status across all Eight Pillars | Section 2; Section 2.4 | All Pillars | Art. 13 | GV.OC-04 | Cl. 9.1 | Not directly referenced | SHIPPING |
| signatureBlock | $ref SignatureBlock; Goukassian Promise Signature signing each Lantern broadcast | Section 2.4 | GoukassianPromise | Art. 13 | PR.DS-01 | Cl. 5.2 | Rule 902(11) | SHIPPING |
| activeSacredZeroCount | integer; minimum: 0; count at signal emission time | Section 2.2; Section 2.4 | SacredZeroGoukassianPromise | Art. 13; Art. 14 | DE.AE-06 | Cl. 8.4 | Not directly referenced | SHIPPING |
2.17 Signature Block
| Property | Constraint | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|
| artifactName | const: "signature"; canonical Goukassian Promise artifact name (lowercase) | Section 2.4 | GoukassianPromise | Art. 13 | GV.OC-04 | Cl. 5.2 | Not directly referenced | SHIPPING |
| signatureAlgorithm | ES256 = SHIPPING default; SLH-DSA-SHAKE-128s / ML-KEM-1024 = FUTURE per Section 10 | Section 2.4; Section 10 | GoukassianPromise | Art. 9 | PR.DS-01 | Cl. 8.5 | Not directly referenced | SHIPPING (ES256); FUTURE (PQC) |
| signedPayloadHash | SHA256Hex of canonical serialization of signed payload | Section 8 | AlwaysMemoryGoukassianPromise | Art. 12 | PR.DS-10 | Cl. 7.5 | Rule 902(11) | SHIPPING |
| custodianId | optional; HybridShield custodian holding the signing key | Section 2.3.3 | HybridShield | Art. 9 | ID.AM-03 | Cl. 8.5 | Not directly referenced | SHIPPING |
2.18 License Validation Request
| Property | Constraint | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|
| artifactName | const: "license"; canonical Goukassian Promise artifact name (lowercase) | Section 2.4 | GoukassianPromise | Art. 13 | GV.OC-04 | Cl. 5.2 | Not directly referenced | SHIPPING |
| licenseToken | string; minLength: 1; verifiable against Goukassian Promise constitutional record | Section 2.4 | GoukassianPromise | Art. 9 | DE.CM-01 | Cl. 6.1.2 | Not directly referenced | SHIPPING |
| requestingEntityId / purposeOfUse | identity of requesting entity; declared purpose of use; maxLength: 512 / 2048 | Section 2.4 | GoukassianPromise | Art. 13 | ID.AM-03; ID.RA-06 | Cl. 5.2; Cl. 7.4 | Not directly referenced | SHIPPING |
2.19 Merkle Inclusion Proof
| Property | Constraint | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|
| logHash | SHA256Hex; leaf node for Merkle proof | Section 8 | AlwaysMemoryPublicBlockchains | Art. 12 | PR.DS-10 | Cl. 7.5 | Rule 902(11) | SHIPPING |
| merkleRoot | SHA256Hex; must match blockchain record | Section 8 | PublicBlockchains | Art. 19 | PR.DS-10 | Cl. 9.1 | Rule 902(13) | SHIPPING |
| inclusionPath | array; minItems: 1; LEFT|RIGHT positions; ordered leaf to root | Section 8 | PublicBlockchains | Art. 19 | PR.DS-10 | Cl. 9.1 | Rule 902(13) | SHIPPING |
| verificationStatus | enum: VERIFIED|PENDING|FAILED | Section 8 | PublicBlockchains | Art. 19 | DE.AE-02 | Cl. 9.1 | Not directly referenced | SHIPPING |
2.20 Custodian Heartbeat
| Property | Constraint | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|
| status | enum: ACTIVE|DEGRADED|UNREACHABLE|ROTATING_KEYS | Section 2.3.3 | HybridShield | Art. 9 | ID.AM-03; DE.CM-09 | Cl. 8.5 | Not directly referenced | SHIPPING |
| latencyMs | number; minimum: 0; sub-500ms cross-jurisdiction = FUTURE per Section 10 | Section 2.3.3; Section 10 | HybridShield | Art. 9 | DE.CM-09 | Cl. 8.5 | Not directly referenced | SHIPPING (field); FUTURE (sub-500ms global) |
| jurisdiction | string; legal jurisdiction of custodian operation | Section 2.3.3 | HybridShield | Art. 9 | GV.OC-05 | Cl. 8.5 | Not directly referenced | SHIPPING |
2.21 Compliance Attestation
| Property | Constraint | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|
| pillarCompliance | object; all 8 PillarIdentifiers required; PillarVerificationResult values | Section 2; Section 2.4 | All Pillars | Art. 9; Art. 13 | GV.OC-04 | Cl. 9.1; Cl. 9.2; Cl. 9.3 | Not directly referenced | SHIPPING |
| overallStatus | enum: FULLY_COMPLIANT|PARTIAL_COMPLIANCE|NON_COMPLIANT | Section 2.4 | GoukassianPromise | Art. 13 | GV.OC-04 | Cl. 9.1 | Not directly referenced | SHIPPING |
| signatureBlock / merkleRoot | Goukassian Signature on attestation; anchored to public blockchain | Section 2.4; Section 8 | GoukassianPromisePublicBlockchains | Art. 13; Art. 19 | PR.DS-01; PR.DS-10 | Cl. 5.2; Cl. 9.1 | Rule 902(11); Rule 902(13) | SHIPPING |
2.22 Redress Challenge
| Property | Constraint | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|
| challengeGrounds | array; minItems: 1; description minLength: 50; per-pillar with optional UDHR Article citation | Section 2.3.3 | HumanRightsMandate | Art. 22; Art. 85 | GV.OC-01; RS.AN-03 | Cl. 6.1.2; Cl. 10.2 | Not directly referenced | SHIPPING |
| challengedLogId / challengedDecisionId | UUIDv4; identifies the specific log and decision under challenge | Section 8 | MoralTraceLogsHumanRightsMandate | Art. 12; Art. 85 | RS.AN-03 | Cl. 9.1; Cl. 10.2 | Rule 902(11) | SHIPPING |
| supportingEvidenceHash | SHA256Hex; optional; hash of supporting evidence package | Section 8 | AlwaysMemory | Art. 12 | PR.DS-10 | Cl. 7.5 | Rule 902(11) | SHIPPING |
2.23 Human Rights Grievance
| Property | Constraint | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|
| udhrProvisions | array; minItems: 1; UDHR Articles alleged violated (e.g., "UDHR-Art-3") | Section 2.3.3 | HumanRightsMandate | Art. 22 | DE.CM-01 | Cl. 6.1.2 | Not directly referenced | SHIPPING |
| genevaConventionProvisions | array; optional; Geneva Convention provisions if applicable | Section 2.3.3 | HumanRightsMandate | Art. 22 | DE.CM-01 | Cl. 6.1.2 | Not directly referenced | SHIPPING |
| grievanceNarrative | string; minLength: 100; maxLength: 16384 | Section 2.3.3 | HumanRightsMandate | Art. 85 | GV.OC-01 | Cl. 10.2 | Not directly referenced | SHIPPING |
2.24 Bulk Evidence Export
| Property | Constraint | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|
| legalBasis | string; minLength: 1; maxLength: 2048; e.g., "EU AI Act Article 72" | Section 8 | MoralTraceLogsHumanRightsMandate | Art. 72; Art. 74 | GV.OC-05 | Cl. 9.2 | Not directly referenced | SHIPPING |
| exportScope | object; fromDate + toDate required; optional stateFilter, pillarFilter, includePermissionTokens, includeMerkleProofs | Section 8 | MoralTraceLogsPublicBlockchains | Art. 72; Art. 74 | GV.OC-05; DE.AE-02 | Cl. 9.1; Cl. 9.2 | Rule 902(11); Rule 902(13) | SHIPPING |
| jurisdiction | string; optional; legal jurisdiction of requesting regulatory authority | Section 2.3.3 | HybridShield | Art. 74 | GV.OC-05 | Cl. 9.2 | Not directly referenced | SHIPPING |
2.25 Gateway Routing Status
| Property | Constraint | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|
| operationalStatus | enum incl. FAIL_CLOSED_ACTIVE; fail-open is not permitted | Section 2.3 | SacredZeroAlwaysMemory | Art. 9; Art. 14 | DE.CM-09; GV.OC-01 | Cl. 8.4; Cl. 8.5 | Not directly referenced | SHIPPING |
| failClosedActive | boolean; true when Gateway defaults all decisions to SacredZero | Section 2.3 | SacredZero | Art. 9; Art. 14 | DE.CM-09 | Cl. 8.4 | Not directly referenced | SHIPPING |
| lanternStatus | $ref LanternStatus; embedded so operators get Lantern state without separate call | Section 2.4 | GoukassianPromise | Art. 13 | GV.OC-04 | Cl. 5.2 | Not directly referenced | SHIPPING |
2.26 Emergency Override Request
| Property | Constraint | Monograph Ref | TML Pillar(s) | EU AI Act | NIST RMF | ISO 42001 | FRE 902 | Status |
|---|---|---|---|---|---|---|---|---|
| overrideType | enum: BREAK_GLASS_SHUTDOWN|KILL_SWITCH|FORCED_STATE_TRANSITION | Section 13.3 | SacredZeroAlwaysMemoryHybridShield | Art. 14 | RS.MA-01; RC.RP-01 | Cl. 8.4; Cl. 10.2 | Not directly referenced | SHIPPING |
| justification | string; minLength: 100; logged to Moral Trace Log before execution; No Log = No Action | Section 13.3 | AlwaysMemory | Art. 14 | PR.DS-01; RS.MA-01 | Cl. 8.4 | Rule 902(11) | SHIPPING |
| forcedState | enum: [-1, 0] only; forced transition to +1 (PROCEED) is schema-blocked | Section 13.3 | SacredZero | Art. 14 | RS.MA-01 | Cl. 8.4 | Not directly referenced | SHIPPING |
| custodianQuorumApproval | optional BETA; HybridShield quorum approval if required by deployment policy | Section 2.3.3; Section 13.3 | HybridShield | Art. 9; Art. 14 | GV.OC-01 | Cl. 8.4; Cl. 8.5 | Not directly referenced | BETA |
| if/then constraint | targetDecisionId and forcedState required when overrideType = FORCED_STATE_TRANSITION | Section 13.3 | AlwaysMemory | Art. 14 | RS.MA-01 | Cl. 8.4 | Not directly referenced | SHIPPING |
Part 3 — Cross-Cutting Compliance Notes
Audit verification surfaces, integrity checkpoints, canonical artifact name enforcement, and Implementation Gap summary
3.1 No Log = No Action — Five Enforcement Layers
An auditor verifying No Log = No Action must confirm all five enforcement layers below are intact across the specification. Schema constraint, cryptographic binding, log-level requirement, proof-level cross-reference, and on-chain ABI reversion are independent; bypassing one does not bypass the others.
| Layer | Artifact / Location | Enforcement Mechanism | Monograph Section |
|---|---|---|---|
| 1 — Schema (StateEnvelope) | StateEnvelope if/then constraint tml_schema.json#/$defs/StateEnvelope |
permissionToken is REQUIRED when currentState == 1. Absence renders envelope schema-invalid. unevaluatedProperties: false prevents bypass. | Section 2.3.3 |
| 2 — Schema (PermissionToken) | PermissionToken.laneOrigin tml_schema.json#/$defs/PermissionToken |
const: "ANCHORING_LANE". Schema-level rejection of all Inference Lane-originated tokens. The Inference Lane cannot produce a valid Permission Token. | Section 2.3 |
| 3 — Schema (TSLF-StateP1) | TSLF-StateP1.permissionToken tml_schema.json#/$defs/TSLF-StateP1 |
permissionToken is in the required array. pillarsCertified minItems: 8 / maxItems: 8. The Proceed log cannot be valid without the token, and the token cannot be valid without the log. | Section 5B.i |
| 4 — Schema (AuditProof) | AuditProof.logHash / merkleRoot tml_schema.json#/$defs/AuditProof |
logHash must match PermissionToken.logHash; merkleRoot must match PermissionToken.merkleRoot. Traversal path: token → logHash → merkleRoot → inclusionPath → GET /audit/verifications/merkle/{merkleRoot}. | Section 8 |
| 5 — On-Chain ABI | TML_Core.registerPermissionToken NoLogNoAction custom error tml_abi.json / TML_Core |
Reverts with NoLogNoAction error when logHash is not provably included in any anchored Merkle root. The on-chain final arbiter. Even a schema-valid token fails registration if the log is not anchored. | Section 2.3.3 |
3.2 Sacred Zero — Integrity Checkpoints
An auditor must confirm State 0 is never aliased, substituted, or represented as a null, false, error, or timeout at any of the five checkpoint locations below. These are schema-enforced const constraints; any deviation is a schema violation.
| Checkpoint | Location | Correct Value | Prohibited Values |
|---|---|---|---|
| State integer | TriadicStateValue; StateEnvelope.currentState; TSLF-State0.currentState | 0 (integer) | null, false, "HOLD", "TIMEOUT", "ERROR", undefined |
| State label | StateEnvelope.stateLabel; TSLF-State0.stateLabel | "SACRED_ZERO" | "SacredPause", "PauseState", "HOLD", "Timeout", "Error" |
| Process identifier | StateEnvelope.processActive; TSLF-State0.processActive | "SacredPause" (workflow name only; not a state alias) | Using "SacredPause" as stateLabel; using it as a substitute for State 0 |
| Epistemic Hold flag | UncertaintyQuantification.epistemicHoldActive | true (const in State 0 context) | false; absent; null |
| Resolution states | DeliberationMatrix.resolutionOptions[].proposedState; TSLF-State0.resolution.resolvedState | 1 or -1 only (terminal states) | 0 (Sacred Zero cannot resolve to another Sacred Zero) |
3.3 Goukassian Promise — Artifact Name Integrity
The canonical Goukassian Promise artifact names appear as const values in three schema properties. An auditor must confirm these are exactly the lowercase strings shown. Any variation in case, spelling, or value is a schema violation.
| Artifact | Schema | Property | const Value | Usage Context |
|---|---|---|---|---|
| Lantern | LanternStatus | artifactName | "lantern" | Public compliance beacon; required in TSLF-State0; exposed at GET /sacred-zero/lantern; lanternStatusBroadcast webhook |
| Signature | SignatureBlock | artifactName | "signature" | Provenance and non-repudiation; required in TSLF-StateP1 as theSignature; LanternStatus.signatureBlock; ComplianceAttestation.signatureBlock |
| License | LicenseValidationRequest | artifactName | "license" | Governs authorized use; validated at POST /goukassian/license/validate; violations trigger State -1 via TSLF-State-1.licenseViolation |
LicenseViolationRecord.violatedArtifact uses the same lowercase enum values: "lantern", "signature", "license". In the ABI (ITMLEnforcer), these are encoded as ordinals for on-chain compatibility: 1 = "lantern", 2 = "signature", 3 = "license".
3.4 Implementation Gap — FUTURE Features (Section 10)
All FUTURE-classified items trace to Section 10 (Implementation Gap) of the TML Constitutionalization Monograph v3.3. No endpoint or schema claims to implement any feature in this table. SHIPPING mitigations are noted; they do not close the underlying gap.
| Feature | Section 10 Blocking Constraint | SHIPPING Mitigation | Remaining Gap | Specification Artifacts Affected |
|---|---|---|---|---|
| Real-time per-token blockchain anchoring | Throughput asymmetry at global AI scale. Public blockchain TPS insufficient for per-token writes at Anchoring Lane latency. | Merkle-batched anchoring. estimatedFinalizationAt field; GET /audit/verifications/merkle/{root}; GET /audit/verifications/inclusion/{logId}. | Finalization lag between log commit and blockchain confirmation. PermissionToken valid before batch finalization; forensic auditability deferred. | POST /anchoring-logs; PermissionToken; MerkleInclusionProof; TML_Core.anchorMerkleRoot |
| Post-quantum cryptography (PQC) signature migration | HSM vendor firmware and EVM toolchain not uniformly supporting FIPS 204 (ML-DSA) / FIPS 205 (SLH-DSA) in production as of monograph version. | ES256 (ECDSA P-256) as SHIPPING default. PQC algorithm IDs reserved in SignatureBlock.signatureAlgorithm enum and EIP-712 GoukassianSignatureAttestation.signatureAlgorithmId. | Cryptographic non-repudiation chain retains long-term quantum vulnerability until HSM vendors and EVM toolchains ship PQC support. | SignatureBlock.signatureAlgorithm; eip712_typed_data.json GoukassianSignatureAttestation signatureAlgorithmId 6-7 |
| Hardware Moral Processing Units (MPUs) | No production MPU silicon. Hardware gating of the actuation bus is architecturally desirable but physically unavailable. | Dual-Lane software architecture. InferenceLaneSecurity vs AnchoringLaneSecurity. PermissionToken.laneOrigin: const "ANCHORING_LANE". GET /gateway/status failClosedActive field. | Software enforcement requires a trusted execution environment. Non-conforming implementation can bypass software constraints; hardware gating would make this physically impossible. | Entire Dual-Lane Architecture; GatewayRoutingStatus; PermissionToken.laneOrigin |
| Cross-jurisdiction custodian quorum in <500ms | Network physics. Speed-of-light minimum RTT between geographically distributed custodian nodes exceeds 500ms budget for synchronous full quorum. | Regional co-located subsets can achieve sub-500ms locally. GET /regulator/custodian-quorum reports crossJurisdictionLatencyMs. PermissionToken.custodianQuorumAttestation optional BETA field. | Full cross-jurisdictional quorum within <500ms is not achievable with current network infrastructure. Endpoint is SHIPPING; the latency target is FUTURE. | GET /regulator/custodian-quorum (x-tml-blocking-constraint annotation); PermissionToken.custodianQuorumAttestation (BETA); CustodianHeartbeat.latencyMs |
| Immutable ledger with native GDPR Article 17 compliance (Erasure Paradox) | Architectural contradiction: cryptographic immutability (AlwaysMemory) and right to erasure (Article 17) cannot both be satisfied natively by a single log store. | Cryptographic erasure: personal data encrypted per-record; key destruction renders data computationally inaccessible. This is a practical approximation under current regulatory interpretation, not native compliance. | Three remaining gaps: (1) key-destruction-as-erasure not affirmed by all EU supervisory authorities; (2) erasure key registry is a critical dependency; (3) log metadata may itself constitute personal data in some jurisdictions. | All TSLF schemas; SHA256Hex; PermissionToken.logHash; AuditProof; Cryptographic Erasure folder (TernaryLogic repo) |