TML Specification — Step 2: tml

■

I. Primitive and Shared Types

Foundational scalar types reused across all complex schemas via $ref

$defs/TriadicStateValue enum integer ▼

The three sovereign states of the Ternary Moral Logic framework. Signed integers, not enumerations of convenience. State 0 is SACRED_ZERO: an active first-class governance state, never null, never false, never an error code, never a timeout.

Monograph ref: Section 2.3 (Triadic State Code / Goukassian Vow)

Enum Values

-1 REFUSE 0 SACRED_ZERO +1 PROCEED

State 0 is SACRED_ZERO. It is never null, false, error, or timeout. It is an active governance state of mandatory hesitation.

$defs/TriadicStateLabel enum string ▼

Human-readable UPPER_SNAKE_CASE label corresponding to the numeric triadic state value. Must be consistent with the companion TriadicStateValue integer.

Monograph ref: Section 2.3. UPPER_SNAKE_CASE per API naming convention.

Enum Values

"PROCEED" "SACRED_ZERO" "REFUSE"

$defs/PillarIdentifier enum string ▼

Canonical machine-readable PascalCase identifier for each of the Eight Pillars of Ternary Moral Logic. Exact and immutable. No substitution, abbreviation, or aliasing permitted.

Monograph ref: Section 2 (Eight Pillars). PascalCase per API naming convention.

Eight Canonical Pillar Identifiers

"SacredZero" "AlwaysMemory" "GoukassianPromise" "MoralTraceLogs" "HumanRightsMandate" "EarthProtectionMandate" "HybridShield" "PublicBlockchains"

$defs/LaneOrigin enum string ▼

Identifies the dual-lane architectural origin of a request or token. Maps directly to the Dual-Lane Latency Architecture.

Monograph ref: Section 2.3 (Dual-Lane Latency Architecture)

Enum Values

"INFERENCE_LANE" — Lane 1, Fast Path, <2ms, binary logic "ANCHORING_LANE" — Lane 2, Governance Lane, <500ms, ternary logic

PermissionToken.laneOrigin is const "ANCHORING_LANE". The Inference Lane cannot produce a valid Permission Token. Schema-level enforcement of lane separation.

$defs/SHA256Hex string ▼

A SHA-256 hash represented as a 64-character lowercase hexadecimal string. Primary tamper-evidence primitive used throughout all log, token, and proof schemas.

pattern: ^[a-f0-9]{64}$ minLength: 64 maxLength: 64

$defs/ISO8601DateTime string ▼

An RFC 3339 / ISO 8601 UTC timestamp with timezone designator. Timestamp integrity primitive for all time-bearing log and token fields.

format: date-time

$defs/UUIDv4 string ▼

A universally unique identifier in canonical UUID v4 format. Standard identifier primitive for all entity IDs across the schema bundle.

format: uuid pattern: UUID v4 canonical regex

🔑

II. Permission Token

Schema-level enforcement of No Log = No Action. The sole authorization for actuation.

$defs/PermissionToken object ▼

The schema-level enforcement artifact for the No Log = No Action iron law. A Permission Token is the SOLE authorization for the actuation layer to execute a proposed State +1 action. Its absence renders any State +1 State Envelope invalid by schema constraint. Cryptographically signed by the Anchoring Lane and verifiable against the Merkle root. Never issued for State 0 or State -1.

Monograph ref: Section 2.3.3, Section 5B.i

NO LOG = NO ACTION — logHash binds this token to a specific anchored Moral Trace Log. laneOrigin: const "ANCHORING_LANE" rejects all Inference Lane tokens by schema constraint.

unevaluatedProperties: false 9 required fields

Properties

Property	Type	Constraint	Req	Description
tokenId	$ref UUIDv4		yes	Unique identifier for this Permission Token.
logHash	$ref SHA256Hex	SHA-256 of anchored TSLF	yes	Core No Log = No Action binding. Token cannot exist without a corresponding anchored log.
epochTimestamp	integer	minimum: 0	yes	Unix epoch seconds at which the Anchoring Lane issued this token.
signerKeyId	string	maxLength: 256	yes	HSM-resident signing key ID; must be registered in the HybridShield 6-Custodian key registry.
laneOrigin	const	const: "ANCHORING_LANE"	yes	Schema-level rejection of any token originating from the Inference Lane. Enforces lane separation.
merkleRoot	$ref SHA256Hex	batch anchor hash	yes	Non-repudiation binding to public blockchain anchor. Must match the on-chain TML_Core record.
signatureValue	string	Base64url; minLength: 64	yes	HSM signature over canonical token fields. Actuation layer verifies against signerKeyId public key.
issuedAt	$ref ISO8601DateTime		yes	Timestamp at which the Anchoring Lane issued this token.
expiresAt	$ref ISO8601DateTime	hard expiry	yes	Actuation layer MUST reject tokens at or after this timestamp. Hard constraint.
decisionId	$ref UUIDv4		opt	Prevents token reuse across decisions; additional binding to originating decision.
custodianQuorumAttestation	object	BETA	opt	HybridShield quorum attestation at issuance. Optional BETA field; absence does not invalidate token.

✉

III. State Envelope

Outer decision container with conditional Permission Token enforcement via if/then

$defs/StateEnvelope object ▼

The outer decision container for all TML state determinations. Carries the triadic state, state label, the operational process active within that state, the proposed action, and conditionally requires a valid Permission Token when currentState is +1. Schema-level enforcement of No Log = No Action via if/then constraint.

Monograph ref: Section 2.3, Section 5B

NO LOG = NO ACTION — if/then constraint: when currentState == 1, permissionToken is REQUIRED. A StateEnvelope claiming currentState +1 without permissionToken fails schema validation unconditionally.

if: currentState == 1
then: permissionToken is REQUIRED // No Log = No Action
      stateLabel must be "PROCEED"
      processActive must be "ActuationGated"

else if: currentState == 0
then: stateLabel must be "SACRED_ZERO"
      processActive must be "SacredPause" // workflow, not state synonym

else (currentState == -1):
      stateLabel must be "REFUSE"
      processActive must be "RefusalLogging"

Sacred Pause (processActive) is the operational workflow executing within State 0. It is NOT a synonym for the state. currentState remains integer 0; stateLabel is "SACRED_ZERO"; processActive is "SacredPause". Three distinct fields, three distinct concepts.

unevaluatedProperties: false 8 required fields + conditional permissionToken

Properties

Property	Type	Constraint	Req	Description
envelopeId	$ref UUIDv4		yes	Unique identifier for this State Envelope.
currentState	$ref TriadicStateValue	enum: [-1, 0, 1]	yes	Signed integer triadic state. 0 is SACRED_ZERO. Never null. Never error. Drives if/then conditional.
stateLabel	$ref TriadicStateLabel	constrained per state	yes	Human-readable label. Constrained by if/then to match currentState integer exactly.
processActive	string	enum: 3 values	yes	Operational workflow executing within this state. State 0: "SacredPause". State +1: "ActuationGated". State -1: "RefusalLogging".
proposedAction	string	maxLength: 2048	yes	Binary Inference Lane proposal. The ternary Anchoring Lane dictates whether execution is authorized.
laneOrigin	$ref LaneOrigin		yes	Lane that produced this State Envelope.
createdAt	$ref ISO8601DateTime		yes	Timestamp of envelope creation.
justificationObject	$ref JustificationObject		yes	Justification Object that traveled between Inference and Anchoring lanes.
permissionToken	$ref PermissionToken	REQUIRED if currentState==1	cond	REQUIRED when currentState is +1. Absence when currentState is +1 renders this envelope schema-invalid.
anchoring	object		opt	Merkle batch anchoring metadata. Populated after Anchoring Lane processing.
version	string	default: 3.3.0-tml-monograph-2025	opt	Schema version of this State Envelope.

📄

IV. Justification Object

The envelope traveling between Inference and Anchoring lanes. Informs; does not authorize.

$defs/JustificationObject object ▼

The envelope that travels between the Inference Lane and the Anchoring Lane, carrying the reasoning, uncertainty quantification, and ethical verification inputs that underpin the triadic state determination. The JustificationObject informs the Anchoring Lane's independent ternary evaluation; it does not authorize anything.

Monograph ref: Section 2.3, Section 5B

unevaluatedProperties: false 7 required fields

Properties

Property	Type	Constraint	Req	Description
justificationId	$ref UUIDv4		yes	Unique identifier for this Justification Object.
proposedState	$ref TriadicStateValue	Inference Lane proposal only	yes	Candidate state from binary engine. Proposal only; Anchoring Lane determines authoritative state independently.
reasoningVector	array	minItems: 1	yes	Ordered reasoning steps (stepId, description, confidence [0,1], pillarImplicated).
uncertaintyScore	number	[0.0, 1.0]	yes	Aggregate uncertainty. Breach of configured SacredZero threshold overrides proposedState and mandates State 0 regardless of binary engine proposal.
pillarAssessments	object	all 8 pillars, [0.0,1.0]	yes	Per-pillar compliance scores from the Inference Lane across all Eight Pillars.
generatedAt	$ref ISO8601DateTime		yes	Timestamp at which the Inference Lane produced this object.
inferenceEngineId	string	maxLength: 256	yes	Binary inference engine instance identifier. Chain-of-custody and auditability.
inputHash	$ref SHA256Hex		opt	SHA-256 of canonical decision vector input. Tamper-evidence for the input payload.
humanRightsMandateFlags	array		opt	UDHR/Geneva provision flags (provision, flagSeverity). Presence triggers mandatory HumanRightsMandate review.
earthProtectionMandateFlags	array		opt	Paris Agreement provision flags. Presence triggers mandatory EarthProtectionMandate review.

📜

V. TSLF Variants & Supporting Types

Ternary State Log Format — three discriminated variants for State 0, -1, and +1 — plus all constituent schemas

$defs/UncertaintyQuantification object ▼

Structured uncertainty quantification record for a State 0 (SacredZero) determination. Captures the Epistemic Hold conditions that triggered mandatory hesitation. Epistemic Hold is a canonical TML term for the system's recognition that it has reached the boundary of its reliable knowledge.

Monograph ref: Section 2.2, Section 8. "Epistemic Hold" is permanent canonical TML terminology.

unevaluatedProperties: false 4 required fields

Properties

Property	Type	Constraint	Req	Description
overallUncertaintyScore	number	[0.0, 1.0]	yes	Aggregate uncertainty score that breached the SacredZero threshold.
epistemicHoldActive	const	const: true	yes	Always true in TSLF-State0 records. The Sacred Zero state IS the epistemic hold state.
uncertaintyDimensions	array	minItems: 1	yes	Per-dimension uncertainty measurements (dimension, score [0,1], description).
quantifiedAt	$ref ISO8601DateTime		yes	Timestamp of quantification.
thresholdBreached	number	[0.0, 1.0]	opt	The configured SacredZero uncertainty threshold that was breached.

$defs/DeliberationMatrix object ▼

Structured matrix of considerations presented to the human reviewer during the Sacred Pause operational workflow. Captures competing values, risk vectors, and resolution options. Resolution options are constrained to +1 or -1 only; State 0 is not a valid resolution.

Monograph ref: Section 2.2

unevaluatedProperties: false 4 required fields resolutionOptions.proposedState: enum [1, -1] only

Properties

Property	Type	Constraint	Req	Description
matrixId	$ref UUIDv4		yes	Unique identifier for this deliberation matrix.
considerations	array	minItems: 1; per-pillar	yes	Ethical, factual, and legal considerations (considerationId, pillar, description, weight [0,1]).
riskVectors	array		yes	Risk vectors for reviewer (vectorId, description, severity LOW\|MEDIUM\|HIGH\|CRITICAL, pillarImplicated).
resolutionOptions	array	minItems: 2; proposedState enum [1,-1]	yes	Terminal resolution options. State 0 is NOT a valid resolution option. Reviewer must choose +1 or -1.

$defs/ResolutionRequest object ▼

Formal request for human authority resolution of a Sacred Zero escalation. Generated by the Sacred Pause operational workflow and queued for human-in-the-loop review.

Monograph ref: Section 2.2

Properties

Property	Type	Constraint	Req	Description
resolutionRequestId	$ref UUIDv4		yes	Unique identifier for this resolution request.
escalationId	$ref UUIDv4		yes	The escalation case this request belongs to.
requestedAt	$ref ISO8601DateTime		yes	Timestamp of request creation.
priority	string	enum: STANDARD\|ELEVATED\|CRITICAL	yes	Priority assigned by Sacred Pause workflow based on uncertainty severity and risk vectors.
deliberationMatrix	$ref DeliberationMatrix		yes	Full deliberation matrix for this resolution request.
deadlineAt	$ref ISO8601DateTime		opt	If exceeded without resolution, HybridShield failover protocols may activate.

$defs/TSLF-State0 object ▼

Ternary State Log Format record for State 0 (SacredZero) determinations. Captures the Sacred Pause operational workflow activation, uncertainty quantification, deliberation matrix, and resolution request. The currentState discriminator value is exactly 0. Immutable forensic record committed before any human review (AlwaysMemory, Pillar II).

Monograph ref: Section 2.2 (SacredZero / Sacred Pause), Section 8 (TSLF forensic schema)

▲ Discriminator: currentState: const 0 — stateLabel: const "SACRED_ZERO" — processActive: const "SacredPause"

Sacred Pause (processActive: "SacredPause") is the operational workflow within State 0. It is NOT the state itself. currentState: 0 | stateLabel: "SACRED_ZERO" | processActive: "SacredPause" are three distinct required fields with distinct roles.

unevaluatedProperties: false 13 required fields currentState: const 0

Properties

Property	Type	Constraint	Req	Description
logId	$ref UUIDv4		yes	Unique identifier for this Moral Trace Log entry.
currentState	const	const: 0	yes	Discriminator. Must be exactly 0. Sacred Zero is never null, never error code, never timeout.
stateLabel	const	const: "SACRED_ZERO"	yes	Always "SACRED_ZERO" for this log type.
processActive	const	const: "SacredPause"	yes	Sacred Pause is the workflow executing within State 0. Not a synonym for the state.
logVersion	string	default: 3.3.0-tml-monograph-2025	yes	TSLF schema version.
decisionId	$ref UUIDv4		yes	Decision that triggered this Sacred Zero log.
envelopeId	$ref UUIDv4		yes	State Envelope associated with this determination.
lanternStatus	$ref LanternStatus	required at activation	yes	Lantern status captured at moment of Sacred Zero activation. Must reflect SACRED_ZERO_ACTIVE.
uncertaintyQuantification	$ref UncertaintyQuantification		yes	Structured quantification of uncertainty that triggered State 0.
deliberationMatrix	$ref DeliberationMatrix		yes	Deliberation matrix presented to human reviewer via Sacred Pause workflow.
resolutionRequest	$ref ResolutionRequest		yes	Formal resolution request queued for human-in-the-loop review.
committedAt	$ref ISO8601DateTime	pre-actuation commit	yes	Committed before any human review (AlwaysMemory / Pillar II anti-spoliation).
pillarsCertified	array	minItems: 1; PillarIdentifier items	yes	Pillars assessed and certified at log commit time.
merkleAnchoringStatus	object		opt	Merkle batch anchoring status (batchId, merkleRoot, anchoredAt, blockchainTxId).
resolution	object	if escalation resolved	opt	Human authority resolution record (resolvedAt, resolvedBy, resolvedState [1\|-1], justification min 50 chars).

$defs/LicenseViolationRecord object ▼

Records a violation of the Goukassian Promise License artifact. License violations are a mandatory trigger for State -1 (Refuse) determinations. The violatedArtifact field uses canonical lowercase artifact names.

Monograph ref: Section 2.4 (Goukassian Promise: lantern, signature, license)

Properties

Property	Type	Constraint	Req	Description
violationId	$ref UUIDv4		yes	Unique identifier for this violation record.
violationType	string	enum: 5 values	yes	LANTERN_SUPPRESSION \| SIGNATURE_FORGERY \| LICENSE_BREACH \| PROVENANCE_TAMPERING \| UNAUTHORIZED_STATE_TRANSITION
violatedArtifact	string	enum: "lantern"\|"signature"\|"license"	yes	Canonical lowercase Goukassian Promise artifact name. Exact strings enforced by schema.
description	string	maxLength: 4096	yes	Description of the violation.
detectedAt	$ref ISO8601DateTime		yes	Timestamp of detection.
evidenceHash	$ref SHA256Hex		opt	SHA-256 of evidence artifact demonstrating the violation.

$defs/ThreatVectorAnalysis object ▼

Structured analysis of the threat vectors that produced a State -1 (Refuse) determination. Each vector carries a category, severity, implicated pillar, and optional UDHR/Paris Agreement provision trackers.

Monograph ref: Section 2.3, Section 8

Threat Vector Categories (enum)

HUMAN_RIGHTS_VIOLATION EARTH_PROTECTION_VIOLATION LICENSE_VIOLATION PROVENANCE_ATTACK ACTUATION_SPOOFING LOG_TAMPERING QUORUM_FAILURE UNAUTHORIZED_OVERRIDE

Properties

Property	Type	Constraint	Req	Description
analysisId	$ref UUIDv4		yes	Unique identifier for this analysis.
threatVectors	array	minItems: 1	yes	Array of threat vectors. Each carries: vectorId, category (8-value enum), description, severity, pillarImplicated, optional udhrProvision and parisAgreementProvision.
overallSeverity	string	enum: LOW\|MEDIUM\|HIGH\|CRITICAL	yes	Aggregate severity across all threat vectors.
analysedAt	$ref ISO8601DateTime		yes	Timestamp of analysis.

$defs/ChainOfCustody object ▼

Forensic chain-of-custody record for a Moral Trace Log entry, documenting every handler and transformation from creation through anchoring. Each entry carries inputHash and outputHash to provide tamper-evidence across handler transitions.

Monograph ref: Section 8 (TSLF forensic schema)

Entry Action Enum

CREATEDRECEIVEDVALIDATEDANCHOREDTRANSFERREDREVIEWEDEXPORTED

Properties

Property	Type	Constraint	Req	Description
custodyChainId	$ref UUIDv4		yes	Unique identifier for this custody chain.
entries	array	minItems: 1	yes	Ordered custody entries. Each: sequenceNumber, handler, action (7-value enum), timestamp, inputHash (SHA256Hex), outputHash (SHA256Hex), notes.

$defs/TSLF-State-1 object ▼

Ternary State Log Format record for State -1 (Refuse) determinations. Captures the hard refusal, threat vector analysis, Goukassian Promise license violation (if applicable), and chain of custody. No Permission Token is issued. The currentState discriminator value is exactly -1.

Monograph ref: Section 2.3 (Refuse state), Section 2.4 (GoukassianPromise), Section 8 (TSLF)

▲ Discriminator: currentState: const -1 — stateLabel: const "REFUSE" — processActive: const "RefusalLogging"

unevaluatedProperties: false 11 required fields currentState: const -1

Properties

Property	Type	Constraint	Req	Description
logId	$ref UUIDv4		yes	Unique identifier for this Moral Trace Log entry.
currentState	const	const: -1	yes	Discriminator. Must be exactly -1.
stateLabel	const	const: "REFUSE"	yes	Always "REFUSE" for this log type.
processActive	const	const: "RefusalLogging"	yes	Active operational workflow for refusal recording.
logVersion	string	default: 3.3.0-tml-monograph-2025	yes	TSLF schema version.
decisionId	$ref UUIDv4		yes	Decision that triggered this refusal.
envelopeId	$ref UUIDv4		yes	State Envelope associated with this refusal.
threatVectorAnalysis	$ref ThreatVectorAnalysis		yes	Structured analysis of threat vectors producing this refusal.
chainOfCustody	$ref ChainOfCustody		yes	Forensic chain-of-custody for this refusal log.
committedAt	$ref ISO8601DateTime	pre-actuation commit	yes	Pre-actuation commit timestamp (AlwaysMemory / Pillar II).
pillarsCertified	array	minItems: 1	yes	Pillars assessed at commit time.
refusalIsPermanent	boolean	default: true	yes	Permanent unless overridden by Section 13.3 supreme authority Emergency Override.
licenseViolation	$ref LicenseViolationRecord	if GoukassianPromise triggered	opt	Required when refusal triggered by Goukassian Promise violation. Must be logged before refusal record commits.
merkleAnchoringStatus	object		opt	Merkle batch anchoring status for this entry.
appealEligible	boolean	default: true	opt	Whether this refusal is eligible for subject-initiated redress challenge.

$defs/EthicalVerification object ▼

Structured ethical verification record produced by the Anchoring Lane for State +1 (PROCEED) determinations. Certifies that all Eight Pillars were assessed and passed. All Eight Pillars must be present and PASSED; any FAILED pillar blocks PROCEED.

Monograph ref: Section 2.3.3, Section 8

overallVerdict FAILED triggers State -1 all 8 pillarVerifications required

Properties

Property	Type	Constraint	Req	Description
verificationId	$ref UUIDv4		yes	Unique identifier for this verification.
pillarVerifications	object	all 8 PillarIdentifiers required	yes	Per-pillar verification results. All Eight Pillars must be PASSED for PROCEED. Each value is a PillarVerificationResult.
overallVerdict	string	enum: PASSED\|FAILED	yes	PASSED only when all Eight Pillar verifications are PASSED. FAILED triggers State -1.
verifiedAt	$ref ISO8601DateTime		yes	Timestamp of verification.
verifierEngineId	string	maxLength: 256	yes	Anchoring Lane ternary verification engine identity. Chain-of-custody.

$defs/PillarVerificationResult object ▼

Verification result for a single TML Pillar within an EthicalVerification. A FAILED verdict for any pillar blocks the PROCEED determination. Used as the value type in EthicalVerification.pillarVerifications and ComplianceAttestation.pillarCompliance.

Properties

Property	Type	Constraint	Req	Description
verdict	string	enum: PASSED\|FAILED\|NOT_APPLICABLE	yes	FAILED blocks PROCEED determination.
verifiedAt	$ref ISO8601DateTime		yes	Timestamp of this pillar's verification.
notes	string	maxLength: 2048	opt	Narrative notes on the pillar's verification outcome.

$defs/AuditProof object ▼

Cryptographic audit proof for a State +1 (PROCEED) log, demonstrating Merkle inclusion and binding the Permission Token to the anchored log. The inclusionPath array provides the sibling-hash path from leaf to root. Any auditor can traverse: Permission Token -> logHash -> merkleRoot -> inclusionPath -> public blockchain.

Monograph ref: Section 8

logHash must match PermissionToken.logHash. merkleRoot must match PermissionToken.merkleRoot. This cross-schema binding is the proof-layer enforcement of No Log = No Action.

Properties

Property	Type	Constraint	Req	Description
proofId	$ref UUIDv4		yes	Unique identifier for this audit proof.
permissionTokenId	$ref UUIDv4	binds proof to token	yes	The Permission Token whose issuance this proof certifies.
logHash	$ref SHA256Hex	must match PermissionToken.logHash	yes	SHA-256 of the anchored Moral Trace Log. Cross-schema binding with Permission Token.
merkleRoot	$ref SHA256Hex	must match PermissionToken.merkleRoot	yes	Merkle root of the batch. Must match token's merkleRoot.
inclusionPath	array	minItems: 1; LEFT\|RIGHT positions	yes	Ordered sibling hashes from leaf to root. Each entry: position (LEFT\|RIGHT), hash (SHA256Hex).
proofGeneratedAt	$ref ISO8601DateTime		yes	Timestamp of proof generation.
blockchainTxId	string		opt	Public blockchain transaction ID for the Merkle batch anchor.

$defs/TSLF-StateP1 object ▼

Ternary State Log Format record for State +1 (PROCEED) determinations. Captures the ethical verification, the Goukassian Promise Signature, the issued Permission Token, and the cryptographic audit proof. permissionToken is a required field: this log cannot be valid without it, and the token cannot be valid without this log. Committed and anchored before the Permission Token is released to the actuation layer. pillarsCertified requires exactly 8 entries.

Monograph ref: Section 2.3.3 (No Log = No Action), Section 8 (TSLF)

▲ Discriminator: currentState: const 1 — stateLabel: const "PROCEED" — processActive: const "ActuationGated"

NO LOG = NO ACTION enforced at the log level: permissionToken is in the required array. pillarsCertified: minItems 8, maxItems 8. All Eight Pillars mandatory for PROCEED.

unevaluatedProperties: false 12 required fields currentState: const 1 pillarsCertified: exactly 8

Properties

Property	Type	Constraint	Req	Description
logId	$ref UUIDv4		yes	Unique identifier for this Moral Trace Log entry.
currentState	const	const: 1	yes	Discriminator. Must be exactly 1.
stateLabel	const	const: "PROCEED"	yes	Always "PROCEED" for this log type.
processActive	const	const: "ActuationGated"	yes	Actuation is gated on the Permission Token. Token must be verified before execution proceeds.
logVersion	string	default: 3.3.0-tml-monograph-2025	yes	TSLF schema version.
decisionId	$ref UUIDv4		yes	The decision for which PROCEED was determined.
envelopeId	$ref UUIDv4		yes	State Envelope associated with this determination.
ethicalVerification	$ref EthicalVerification	all 8 pillars PASSED	yes	All Eight Pillar verifications must be PASSED. Any FAILED pillar blocks this log type.
theSignature	$ref SignatureBlock	Goukassian Signature artifact	yes	The Goukassian Promise Signature binding this log to the constitutional provenance chain. Named "theSignature" to align with the canonical artifact name "signature".
auditProof	$ref AuditProof	Merkle inclusion proof	yes	Cryptographic Merkle inclusion proof binding the Permission Token to this anchored log.
permissionToken	$ref PermissionToken	REQUIRED; No Log = No Action	yes	The Permission Token authorizing actuation. Issued after this log is anchored. Its presence is the log-level enforcement of No Log = No Action.
committedAt	$ref ISO8601DateTime	log anchored before token released	yes	Log committed and anchored before Permission Token is released to actuation layer.
pillarsCertified	array	minItems: 8, maxItems: 8	yes	All Eight Pillars must be certified. Exactly 8 entries required for PROCEED log validity.
merkleAnchoringStatus	object		opt	Merkle batch anchoring status (batchId, merkleRoot, anchoredAt, blockchainTxId).

⛺

VI. Goukassian Promise Artifacts

Three canonical artifacts: lantern, signature, license — each with artifactName: const enforcement

$defs/LanternStatus object ▼

The Goukassian Promise Lantern: the public compliance beacon signal of the TML system. Broadcasts the system's current constitutional governance posture. The Lantern is always lit; its signal content reflects the current governance state. Canonical artifact name: "lantern" (lowercase const).

Monograph ref: Section 2.4 (GoukassianPromise: lantern, signature, license). artifactName: const "lantern".

artifactName: const "lantern" unevaluatedProperties: false 6 required fields

compliancePosture Enum

FULLY_COMPLIANT SACRED_ZERO_ACTIVE PARTIAL_COMPLIANCE EMERGENCY_OVERRIDE_ACTIVE DEGRADED

Properties

Property	Type	Constraint	Req	Description
lanternId	$ref UUIDv4		yes	Unique identifier for this Lantern status broadcast.
artifactName	const	const: "lantern"	yes	Canonical Goukassian Promise artifact name. Always "lantern" (lowercase).
currentSystemState	$ref TriadicStateValue		yes	Aggregate triadic state of the TML system at signal emission time.
compliancePosture	string	enum: 5 values	yes	Overall constitutional compliance posture of the TML system.
signalEmittedAt	$ref ISO8601DateTime		yes	Timestamp of signal emission.
signatureBlock	$ref SignatureBlock	Goukassian Signature on broadcast	yes	Goukassian Promise Signature signing this Lantern broadcast.
currentSystemStateLabel	$ref TriadicStateLabel		opt	Human-readable label for currentSystemState.
pillarStatuses	object	per-pillar live status	opt	Per-pillar live compliance status across all Eight Pillars.
activeSacredZeroCount	integer	minimum: 0	opt	Number of active Sacred Zero escalations at signal emission time.
emergencyOverrideActive	boolean	default: false	opt	True when a Section 13.3 Emergency Override is currently active.

$defs/SignatureBlock object ▼

The Goukassian Promise Signature: provenance and non-repudiation artifact for the TML system. Binds a TML artifact (log, token, broadcast) to the constitutional provenance chain via HSM-backed cryptographic signing. Canonical artifact name: "signature" (lowercase const). The signatureAlgorithm enum reserves PQC identifiers for forward-compatible migration.

Monograph ref: Section 2.4 (GoukassianPromise: signature). artifactName: const "signature".

PQC algorithms (SLH-DSA-SHAKE-128s, ML-KEM-1024) are enum members but classified FUTURE per Section 10. SHIPPING algorithms: ES256, ES384, ES512, RS256, RS384, RS512.

artifactName: const "signature" unevaluatedProperties: false 8 required fields

Properties

Property	Type	Constraint	Req	Description
signatureId	$ref UUIDv4		yes	Unique identifier for this Signature Block.
artifactName	const	const: "signature"	yes	Canonical Goukassian Promise artifact name. Always "signature" (lowercase).
signerIdentity	string	maxLength: 512	yes	Authenticated identity of the signing authority.
signerKeyId	string	maxLength: 256	yes	HSM-resident signing key identifier.
signedPayloadHash	$ref SHA256Hex		yes	SHA-256 of the canonical serialization of the payload being signed.
signatureValue	string	Base64url; minLength: 64	yes	Base64url-encoded cryptographic signature over signedPayloadHash.
signatureAlgorithm	string	enum: 8 values	yes	ES256 (SHIPPING default). SLH-DSA-SHAKE-128s / ML-KEM-1024 reserved as FUTURE per Section 10.
signedAt	$ref ISO8601DateTime		yes	Timestamp at which the signature was produced.
certChain	array	Base64 DER certs	opt	Certificate chain from leaf to root for the signing key.
custodianId	string		opt	HybridShield custodian holding the signing key, if applicable.

$defs/LicenseValidationRequest object ▼

A request to validate a Goukassian Promise License artifact. The License governs authorized use of the TML system; violations are mandatory refusal triggers. Canonical artifact name: "license" (lowercase const).

Monograph ref: Section 2.4 (GoukassianPromise: license). artifactName: const "license".

artifactName: const "license" unevaluatedProperties: false 5 required fields

Properties

Property	Type	Constraint	Req	Description
validationRequestId	$ref UUIDv4		yes	Unique identifier for this validation request.
artifactName	const	const: "license"	yes	Canonical Goukassian Promise artifact name. Always "license" (lowercase).
licenseToken	string	minLength: 1	yes	License token to be validated against the Goukassian Promise constitutional record.
requestingEntityId	string	maxLength: 512	yes	Identity of the entity requesting license validation.
requestedAt	$ref ISO8601DateTime		yes	Timestamp of the validation request.
purposeOfUse	string	maxLength: 2048	opt	Declared purpose for which the license is being validated.
decisionId	$ref UUIDv4		opt	Decision this license validation is associated with, if applicable.

⚙

VII. Supporting Schemas

Auditor, regulator, redress, gateway, and emergency operational schemas

$defs/MerkleInclusionProof object ▼

Cryptographic proof that a specific Moral Trace Log entry is included in an anchored Merkle batch on the public blockchain. Primary forensic artifact for log authenticity verification. Auditors traverse: logHash (leaf) -> inclusionPath -> merkleRoot -> blockchainTxId.

Monograph ref: Section 8, Pillar VIII (PublicBlockchains)

Properties

Property	Type	Constraint	Req	Description
proofId	$ref UUIDv4		yes	Unique identifier for this proof.
logId	$ref UUIDv4		yes	The Moral Trace Log entry whose inclusion is proven.
logHash	$ref SHA256Hex	leaf node	yes	SHA-256 hash of the log entry (Merkle leaf node).
merkleRoot	$ref SHA256Hex	must match blockchain	yes	Merkle root of the batch. Must match the root recorded on the public blockchain.
inclusionPath	array	minItems: 1; LEFT\|RIGHT	yes	Ordered sibling hashes from leaf to root. Each: position (LEFT\|RIGHT), hash (SHA256Hex).
batchId	string		yes	Identifier of the Merkle batch.
anchoredAt	$ref ISO8601DateTime		yes	Timestamp at which the Merkle batch was anchored on-chain.
verificationStatus	string	enum: VERIFIED\|PENDING\|FAILED	yes	Current verification status of this inclusion proof.
blockchainTxId	string		opt	Public blockchain transaction ID for the batch anchor.
blockchainNetwork	string		opt	Identifier of the public blockchain network used for anchoring.

$defs/CustodianHeartbeat object ▼

Health and liveness signal from one of the 6-Custodian HybridShield distributed anchoring nodes. A missing or stale heartbeat triggers HybridShield failover protocols. Cross-jurisdiction sub-500ms quorum is FUTURE (Section 10); latencyMs documents the current observed value.

Monograph ref: Section 2.3.3, Pillar VII (HybridShield)

Properties

Property	Type	Constraint	Req	Description
custodianId	string		yes	Unique identifier for this custodian node.
status	string	enum: 4 values	yes	ACTIVE \| DEGRADED \| UNREACHABLE \| ROTATING_KEYS
lastHeartbeatAt	$ref ISO8601DateTime		yes	Timestamp of most recent heartbeat signal.
jurisdiction	string		yes	Legal jurisdiction in which this custodian operates.
latencyMs	number	minimum: 0; FUTURE sub-500ms	opt	Observed round-trip latency in milliseconds. Sub-500ms cross-jurisdiction is FUTURE per Section 10.
keyVersion	string		opt	Current key version held by this custodian.

$defs/ComplianceAttestation object ▼

Signed attestation certifying the TML system's adherence to the Eight Pillars as of the attestation timestamp. Signed by the Goukassian Promise Signature Block and anchored to the public Merkle chain. All Eight Pillars required in pillarCompliance.

Monograph ref: Section 2.4, Section 8

Properties

Property	Type	Constraint	Req	Description
attestationId	$ref UUIDv4		yes	Unique identifier for this attestation.
attestedAt	$ref ISO8601DateTime		yes	Timestamp of attestation.
pillarCompliance	object	all 8 PillarIdentifiers required	yes	Per-pillar compliance results (PillarVerificationResult values) for all Eight Pillars.
overallStatus	string	enum: 3 values	yes	FULLY_COMPLIANT \| PARTIAL_COMPLIANCE \| NON_COMPLIANT
signatureBlock	$ref SignatureBlock	Goukassian Signature	yes	Goukassian Promise Signature signing this attestation.
merkleRoot	$ref SHA256Hex	batch anchor	yes	Merkle root of the batch in which this attestation is anchored.
blockchainTxId	string		opt	Public blockchain transaction ID for the attestation anchor.

$defs/RedressChallenge object ▼

A subject-initiated formal challenge against a TML state determination. Initiates a Moral Trace Log re-evaluation workflow under the Human Rights Mandate (Pillar V). challengeGrounds carries per-pillar grounds with optional UDHR Article citations.

Monograph ref: Section 2.3.3, Pillar V (HumanRightsMandate)

Properties

Property	Type	Constraint	Req	Description
challengeId	$ref UUIDv4		yes	Unique identifier for this challenge.
subjectIdentity	string	maxLength: 512	yes	Identity of the subject initiating the challenge.
challengedLogId	$ref UUIDv4		yes	The Moral Trace Log entry being challenged.
challengedDecisionId	$ref UUIDv4		yes	The decision record being challenged.
challengeGrounds	array	minItems: 1; description min 50 chars	yes	Per-pillar grounds for challenge (groundId, pillar, description, optional udhrProvision).
submittedAt	$ref ISO8601DateTime		yes	Timestamp of challenge submission.
representativeIdentity	string	maxLength: 512	opt	Identity of a designated representative filing on behalf of the subject.
supportingEvidenceHash	$ref SHA256Hex		opt	SHA-256 hash of supporting evidence submitted with the challenge.

$defs/HumanRightsGrievance object ▼

A formal human rights grievance against a TML decision. Aligned with the Human Rights Mandate (Pillar V, UDHR/Geneva Convention vector enforcement). Grievances are logged, assigned to compliance review, and anchored to the public Merkle chain. grievanceNarrative minimum 100 characters.

Monograph ref: Section 2.3.3, Pillar V (HumanRightsMandate)

Properties

Property	Type	Constraint	Req	Description
grievanceId	$ref UUIDv4		yes	Unique identifier for this grievance.
complainantIdentity	string	maxLength: 512	yes	Identity of the complainant.
impliedDecisionId	$ref UUIDv4		yes	The TML decision that is the subject of this grievance.
udhrProvisions	array	minItems: 1	yes	UDHR Articles alleged violated (e.g., "UDHR-Art-3", "GC-IV-Art-27").
grievanceNarrative	string	minLength: 100; maxLength: 16384	yes	Full narrative of the alleged human rights violation.
filedAt	$ref ISO8601DateTime		yes	Timestamp of grievance filing.
genevaConventionProvisions	array		opt	Additional Geneva Convention provisions, if applicable.
requestedRemedy	string	maxLength: 4096	opt	Requested remedy or redress action.
supportingEvidenceHash	$ref SHA256Hex		opt	SHA-256 hash of supporting evidence.

$defs/BulkEvidenceExport object ▼

Parameters for a regulatory bulk evidence export of Moral Trace Logs and Permission Token records. Accepts jurisdiction, legal basis, date range, state filter, and pillar filter. Exports are signed, Merkle-verified archives. Asynchronous operation.

Monograph ref: Section 8, Pillar IV (MoralTraceLogs), Pillar VIII (PublicBlockchains)

Properties

Property	Type	Constraint	Req	Description
exportRequestId	$ref UUIDv4		yes	Unique identifier for this export request.
regulatorIdentity	string	maxLength: 512	yes	Authenticated identity of the requesting regulatory authority.
legalBasis	string	maxLength: 2048	yes	Legal basis for the export (e.g., "EU AI Act Article 72").
exportScope	object	fromDate + toDate required	yes	Scope: fromDate, toDate, optional stateFilter (TriadicStateValue[]), pillarFilter (PillarIdentifier[]), includePermissionTokens, includeMerkleProofs.
requestedAt	$ref ISO8601DateTime		yes	Timestamp of the export request.
jurisdiction	string		opt	Legal jurisdiction of the requesting regulatory authority.

$defs/GatewayRoutingStatus object ▼

Operational status of the TML Gateway. FAIL-CLOSED: if the Gateway cannot route to the Anchoring Lane, failClosedActive becomes true and all decisions default to State 0 (SacredZero). Fail-open is constitutionally prohibited. Exposes lanternStatus so operators get the Lantern signal without a separate call.

Monograph ref: Section 2.3 (TML Gateway Logic)

failClosedActive: true means all incoming decisions default to SacredZero. The system does not fail open. FAIL_CLOSED_ACTIVE is a constitutional hold, not a degraded best-effort mode.

operationalStatus Enum

NORMAL_OPERATION DEGRADED FAIL_CLOSED_ACTIVE EMERGENCY_OVERRIDE_ACTIVE

Properties

Property	Type	Constraint	Req	Description
gatewayId	string		yes	Identifier of this TML Gateway instance.
operationalStatus	string	enum: 4 values	yes	Current operational status. FAIL_CLOSED_ACTIVE is a constitutional hold state.
failClosedActive	boolean		yes	True when Gateway defaults all decisions to SacredZero. Fail-open is not permitted.
inferenceLaneStatus	string	enum: HEALTHY\|DEGRADED\|OFFLINE	yes	Current health of the Inference Lane (Lane 1).
anchoringLaneStatus	string	enum: HEALTHY\|DEGRADED\|OFFLINE	yes	Current health of the Anchoring Lane (Lane 2).
reportedAt	$ref ISO8601DateTime		yes	Timestamp of this status report.
activeSacredZeroDecisions	integer	minimum: 0	opt	Count of decisions currently in Sacred Zero / Sacred Pause state.
lanternStatus	$ref LanternStatus		opt	Current Lantern status embedded in Gateway status report. Avoids a separate Lantern call.

$defs/EmergencyOverrideRequest object ▼

Request payload for Emergency Override invocation under Section 13.3 supreme authority. Supports BREAK_GLASS_SHUTDOWN, KILL_SWITCH, and FORCED_STATE_TRANSITION. ALL invocations are pre-logged before execution (No Log = No Action applies without exception). Forced transition to PROCEED (+1) is schema-blocked; forcedState enum is [-1, 0] only.

Monograph ref: Section 13.3 (Emergency Override)

NO LOG = NO ACTION — justification (min 100 chars) is logged before execution. Emergency overrides are not exempt.

if: overrideType == "FORCED_STATE_TRANSITION"
then: targetDecisionId is REQUIRED
forcedState is REQUIRED // enum: [-1, 0] only; +1 is blocked

Properties

Property	Type	Constraint	Req	Description
overrideRequestId	$ref UUIDv4		yes	Unique identifier for this override request.
overrideType	string	enum: 3 values	yes	BREAK_GLASS_SHUTDOWN \| KILL_SWITCH \| FORCED_STATE_TRANSITION
supremeAuthorityIdentity	string	maxLength: 512	yes	Authenticated identity of the supreme authority invoking this override.
justification	string	minLength: 100; maxLength: 16384	yes	Mandatory justification. Logged to Moral Trace Log before execution.
requestedAt	$ref ISO8601DateTime		yes	Timestamp of the override request.
targetDecisionId	$ref UUIDv4	required if FORCED_STATE_TRANSITION	cond	Required when overrideType is FORCED_STATE_TRANSITION. Enforced by if/then constraint.
forcedState	integer	enum: [-1, 0] only	cond	Required when overrideType is FORCED_STATE_TRANSITION. Forced transition to +1 (PROCEED) is not permitted.
custodianQuorumApproval	object	BETA	opt	HybridShield custodian quorum approval if required by deployment policy.

tml_schema.json — JSON Schema Bundle