{
  "schema": "tiffany.systems/schema/operation-contract/1.0.0",
  "live": false,
  "notice": "FUTURE INTERFACE — NOT ACTIVE. No delegation exists, every rung of the authority ladder is currently held by nobody including Tiffany, and nothing on this site accepts an operation envelope over the network. There is no control endpoint.",
  "policy_version": "2026-09-11",
  "delegations_issued": 0,
  "invariant": "Authorisation to publish does not make content scientifically qualified. Neither does credential validity, schema validation, signature validity, a clean secret scan, Tiffany's authorship, or Tiffany's publication.",
  "authority_ladder": [
    {
      "rung": 1,
      "id": "OBSERVE",
      "label": "Observe",
      "definition": "Read public state. Confers nothing else, and is the only rung that can be held safely by an actor nobody has evaluated.",
      "held_by": null
    },
    {
      "rung": 2,
      "id": "PREPARE_DRAFT",
      "label": "Prepare draft",
      "definition": "Produce a draft record in a private workspace. A draft has no public existence and never appears in an index, feed, API or current pointer.",
      "held_by": null
    },
    {
      "rung": 3,
      "id": "PROPOSE_UPDATE",
      "label": "Propose update",
      "definition": "Submit a draft as a proposal against a named current version. A proposal is an offer, not a change.",
      "held_by": null
    },
    {
      "rung": 4,
      "id": "ATTACH_APPROVED_EVIDENCE",
      "label": "Attach approved evidence",
      "definition": "Link evidence that has already cleared publication review. It does not confer the ability to approve evidence.",
      "held_by": null
    },
    {
      "rung": 5,
      "id": "VALIDATE",
      "label": "Validate",
      "definition": "Run the policy and schema gates against a proposal and receive the result. Validation is a measurement, not a permission: passing it authorises nothing.",
      "held_by": null
    },
    {
      "rung": 6,
      "id": "REQUEST_PUBLICATION",
      "label": "Request publication",
      "definition": "Place a validated proposal in front of whoever holds publication authority. Requesting is not receiving.",
      "held_by": null
    },
    {
      "rung": 7,
      "id": "EXECUTE_REVERSIBLE",
      "label": "Execute reversible",
      "definition": "Perform an action whose complete undo is defined in advance and demonstrated to work. If the rollback path is unavailable, the action is not reversible and this rung does not cover it.",
      "held_by": null
    },
    {
      "rung": 8,
      "id": "PUBLISH_APPROVED",
      "label": "Publish approved",
      "definition": "Make public a package that already carries an explicit publication decision from an authorised human. It confers no ability to make that decision.",
      "held_by": null
    },
    {
      "rung": 9,
      "id": "SUPERSEDE_APPROVED",
      "label": "Supersede approved",
      "definition": "Replace a current version with an approved successor. The prior version remains published and addressable.",
      "held_by": null
    },
    {
      "rung": 10,
      "id": "WITHDRAW_APPROVED",
      "label": "Withdraw approved",
      "definition": "Retract an approved record with a recorded reason. Withdrawal deletes nothing.",
      "held_by": null
    },
    {
      "rung": 11,
      "id": "RELEASE_APPROVED_SOFTWARE",
      "label": "Release approved software",
      "definition": "Publish a software artifact that has cleared security, licence and provenance review, with its digest.",
      "held_by": null
    }
  ],
  "ladder_rules": [
    "each rung is independently delegable",
    "no rung implies another in either direction",
    "validation confers nothing",
    "reversible covers an action only when a demonstrated undo exists"
  ],
  "operation_states": [
    {
      "id": "DRAFT",
      "label": "Draft",
      "definition": "Being written. Private to its author. Not addressable publicly.",
      "public": false
    },
    {
      "id": "PROPOSAL",
      "label": "Proposal",
      "definition": "Submitted against a named current version. Still not a change.",
      "public": false
    },
    {
      "id": "SHADOW_RESULT",
      "label": "Shadow result",
      "definition": "A full rendering of what the change would produce, generated without affecting anything. Retained for comparison and never served publicly.",
      "public": false
    },
    {
      "id": "APPROVED_FOR_PUBLICATION",
      "label": "Approved for publication",
      "definition": "An authorised human has decided it may be published. Not yet public.",
      "public": false
    },
    {
      "id": "PUBLISHED",
      "label": "Published",
      "definition": "Public, immutable, digested and citable.",
      "public": true
    },
    {
      "id": "SUPERSEDED",
      "label": "Superseded",
      "definition": "Replaced by a later version and still served at its original address.",
      "public": true
    },
    {
      "id": "WITHDRAWN",
      "label": "Withdrawn",
      "definition": "Retracted with a recorded reason, still served so the record of the retraction survives.",
      "public": true
    },
    {
      "id": "CONFLICT",
      "label": "Conflict",
      "definition": "The world moved while the proposal was being prepared. Parked, both states preserved, never auto-merged.",
      "public": false
    },
    {
      "id": "REJECTED",
      "label": "Rejected",
      "definition": "Refused by a gate, with the reason recorded as structured data.",
      "public": false
    }
  ],
  "stop_reasons": [
    {
      "id": "AMBIGUOUS_CLASSIFICATION",
      "definition": "Release classification is absent, unrecognised or contradictory. Fails closed to internal."
    },
    {
      "id": "INSUFFICIENT_AUTHORITY",
      "definition": "The actor does not hold the rung this operation requires."
    },
    {
      "id": "EXPIRED_AUTHORITY",
      "definition": "The delegation has passed its expiry."
    },
    {
      "id": "REVOKED_AUTHORITY",
      "definition": "The delegation was revoked. Revocation is immediate and is never retroactively softened."
    },
    {
      "id": "TARGET_OUT_OF_SCOPE",
      "definition": "The target resource or environment lies outside the delegation's scope."
    },
    {
      "id": "PROVENANCE_BREAK",
      "definition": "The chain from input to output is incomplete or does not resolve."
    },
    {
      "id": "SECRET_SCAN_FAILURE",
      "definition": "Material that looks like a credential or key was detected in the proposal."
    },
    {
      "id": "PROTECTED_DATA_CONTACT",
      "definition": "The operation touches protected or private material."
    },
    {
      "id": "LICENSE_UNRESOLVED",
      "definition": "Ownership or licence is ambiguous. Ambiguous ownership is non-releasable."
    },
    {
      "id": "SCHEMA_FAILURE",
      "definition": "The record does not satisfy its published schema."
    },
    {
      "id": "SEMANTIC_OVERCLAIM",
      "definition": "Public prose asserts more than the structured record supports."
    },
    {
      "id": "SCIENTIFIC_STATUS_MISMATCH",
      "definition": "The asserted scientific status is not supported by the attached evidence."
    },
    {
      "id": "UNSUPPORTED_TRANSITION",
      "definition": "The requested state change is forbidden by the state machine."
    },
    {
      "id": "STALE_VERSION",
      "definition": "The expected current version or digest no longer matches. The world moved."
    },
    {
      "id": "CONFLICTING_PROPOSAL",
      "definition": "Another proposal targets the same object and has not been resolved."
    },
    {
      "id": "MISSING_REQUIRED_EVIDENCE",
      "definition": "Policy requires evidence that was not supplied."
    },
    {
      "id": "ROLLBACK_UNAVAILABLE",
      "definition": "No demonstrated undo exists, so the action cannot be treated as reversible."
    },
    {
      "id": "SECURITY_SENSITIVE",
      "definition": "Publication would create operational risk."
    },
    {
      "id": "UNKNOWN_CONSEQUENTIAL_FIELD",
      "definition": "The envelope carries a field the contract does not model. A field nobody understands may be the one carrying the claim."
    },
    {
      "id": "POLICY_VERSION_MISMATCH",
      "definition": "The actor evaluated against a different policy version than the one in force. Actors do not choose the policy they are judged by."
    },
    {
      "id": "PUBLICATION_AUTHORIZATION_ABSENT",
      "definition": "No explicit publication decision from an authorised human is attached."
    },
    {
      "id": "IDEMPOTENCY_COLLISION",
      "definition": "The idempotency key was reused with a different payload."
    }
  ],
  "schemas": {
    "envelope": "/api/schema/operation-envelope.schema.json",
    "delegation": "/api/schema/delegation.schema.json",
    "result": "/api/schema/operation-result.schema.json"
  },
  "concurrency": "Consequential mutation must name the expected current version and digest. On mismatch the operation is parked as a conflict; consequential meaning is never auto-merged.",
  "idempotency": "Same key and payload replays the original result. Same key with a different payload is a collision and stops.",
  "rationale_is_inert": "The rationale field is carried for humans reading the audit trail and is consulted by no gate.",
  "shadow_mode": "The same evaluator with mode as the only difference. Produces a full result and audit record with no effect. It is the intended qualification path, and a shadow mode that diverged from live behaviour would qualify nothing.",
  "specification": "https://tiffany.systems/machine-operation"
}