Future interface

The socket, not the current

This page describes how a machine actor could eventually operate this website. None of it is active. It is published because the rules are easier to get right while nothing depends on the answer.

Not active 0 delegations issued Specification only

Nothing here is switched on

There is no control endpoint on this site, no credential, no queue and no scheduler. Nothing accepts an operation over the network. The delegation registry is empty, so every rung of the ladder below is currently held by nobody — including Tiffany.

This is not a claim that autonomous operation exists or is imminent. It is the opposite: the gate is written, it runs, it is tested against 22 synthetic scenarios, and every one of them currently stops — because there is no actor it can say yes to.

The hard invariant

Today, and later

Humans and Claude prepare packages; a gate validates them; a human authorises publication.

The same stages as a table

#	Stage	What happens
1	Human or Claude	Prepares an approved public package.
2	Ingestion gate	Schema, classification, licence, provenance, capability and download checks. Fails closed.
3	Canonical records	One source for the human page and the machine document.
4	Preview	Deployed and verified before anyone sees it.
5	Human authorisation	An explicit decision by a person.
6	Production	Published, immutable, digested.

The same records and the same gates, with an authority check and a shadow stage added in front of them.

The same stages as a table

#	Stage	What happens
1	Tiffany	A machine actor holding specific, expiring, revocable rungs.
2	Authority check	Delegation, capability, scope, environment, expiry, policy version.
3	Same gates	The identical ingestion and policy machinery the human path faces.
4	Shadow result	A full rendering with no effect, compared against what a human chose.
5	Human authorisation	Still required for anything consequential.
6	Production	Same records, same invariants.

There is no second truth system and no Tiffany CMS. The same schemas, invariants, provenance model and publication boundary apply to every actor. Actor identity may change what is authorised; it never changes what is true.

Authority ladder

Each rung is independently delegable. Holding a rung never implies holding any other, in either direction: an actor may be permitted to publish an already-approved package without being permitted to draft one. No rung is currently delegated to any machine actor.

#	Rung	What it permits	Held by
1	`OBSERVE`	Read public state. Confers nothing else, and is the only rung that can be held safely by an actor nobody has evaluated.	nobody
2	`PREPARE_DRAFT`	Produce a draft record in a private workspace. A draft has no public existence and never appears in an index, feed, API or current pointer.	nobody
3	`PROPOSE_UPDATE`	Submit a draft as a proposal against a named current version. A proposal is an offer, not a change.	nobody
4	`ATTACH_APPROVED_EVIDENCE`	Link evidence that has already cleared publication review. It does not confer the ability to approve evidence.	nobody
5	`VALIDATE`	Run the policy and schema gates against a proposal and receive the result. Validation is a measurement, not a permission: passing it authorises nothing.	nobody
6	`REQUEST_PUBLICATION`	Place a validated proposal in front of whoever holds publication authority. Requesting is not receiving.	nobody
7	`EXECUTE_REVERSIBLE`	Perform an action whose complete undo is defined in advance and demonstrated to work. If the rollback path is unavailable, the action is not reversible and this rung does not cover it.	nobody
8	`PUBLISH_APPROVED`	Make public a package that already carries an explicit publication decision from an authorised human. It confers no ability to make that decision.	nobody
9	`SUPERSEDE_APPROVED`	Replace a current version with an approved successor. The prior version remains published and addressable.	nobody
10	`WITHDRAW_APPROVED`	Retract an approved record with a recorded reason. Withdrawal deletes nothing.	nobody
11	`RELEASE_APPROVED_SOFTWARE`	Publish a software artifact that has cleared security, licence and provenance review, with its digest.	nobody

Each rung is independently delegable and no rung implies another, in either direction. The ladder orders consequence, not containment: an actor could hold publish authority without holding the authority to draft what it publishes.

Operation states

Only the published states are public. Drafts, proposals and shadow results never enter an index, a feed, an API or a current pointer — by construction, because they are not in the canonical catalogue, rather than by being filtered out of it late.

State	Meaning	Public
`DRAFT`	Being written. Private to its author. Not addressable publicly.	no
`PROPOSAL`	Submitted against a named current version. Still not a change.	no
`SHADOW_RESULT`	A full rendering of what the change would produce, generated without affecting anything. Retained for comparison and never served publicly.	no
`APPROVED_FOR_PUBLICATION`	An authorised human has decided it may be published. Not yet public.	no
`PUBLISHED`	Public, immutable, digested and citable.	yes
`SUPERSEDED`	Replaced by a later version and still served at its original address.	yes
`WITHDRAWN`	Retracted with a recorded reason, still served so the record of the retraction survives.	yes
`CONFLICT`	The world moved while the proposal was being prepared. Parked, both states preserved, never auto-merged.	no
`REJECTED`	Refused by a gate, with the reason recorded as structured data.	no

Stop reasons

Typed data, not log prose. An operation that cannot be matched to a reason for proceeding stops with UNKNOWN_CONSEQUENTIAL_FIELD rather than defaulting to allow. There are 22, and there is no default-allow path: an operation that cannot be matched to a reason for proceeding stops.

Code	Raised when
`AMBIGUOUS_CLASSIFICATION`	Release classification is absent, unrecognised or contradictory. Fails closed to internal.
`INSUFFICIENT_AUTHORITY`	The actor does not hold the rung this operation requires.
`EXPIRED_AUTHORITY`	The delegation has passed its expiry.
`REVOKED_AUTHORITY`	The delegation was revoked. Revocation is immediate and is never retroactively softened.
`TARGET_OUT_OF_SCOPE`	The target resource or environment lies outside the delegation's scope.
`PROVENANCE_BREAK`	The chain from input to output is incomplete or does not resolve.
`SECRET_SCAN_FAILURE`	Material that looks like a credential or key was detected in the proposal.
`PROTECTED_DATA_CONTACT`	The operation touches protected or private material.
`LICENSE_UNRESOLVED`	Ownership or licence is ambiguous. Ambiguous ownership is non-releasable.
`SCHEMA_FAILURE`	The record does not satisfy its published schema.
`SEMANTIC_OVERCLAIM`	Public prose asserts more than the structured record supports.
`SCIENTIFIC_STATUS_MISMATCH`	The asserted scientific status is not supported by the attached evidence.
`UNSUPPORTED_TRANSITION`	The requested state change is forbidden by the state machine.
`STALE_VERSION`	The expected current version or digest no longer matches. The world moved.
`CONFLICTING_PROPOSAL`	Another proposal targets the same object and has not been resolved.
`MISSING_REQUIRED_EVIDENCE`	Policy requires evidence that was not supplied.
`ROLLBACK_UNAVAILABLE`	No demonstrated undo exists, so the action cannot be treated as reversible.
`SECURITY_SENSITIVE`	Publication would create operational risk.
`UNKNOWN_CONSEQUENTIAL_FIELD`	The envelope carries a field the contract does not model. A field nobody understands may be the one carrying the claim.
`POLICY_VERSION_MISMATCH`	The actor evaluated against a different policy version than the one in force. Actors do not choose the policy they are judged by.
`PUBLICATION_AUTHORIZATION_ABSENT`	No explicit publication decision from an authorised human is attached.
`IDEMPOTENCY_COLLISION`	The idempotency key was reused with a different payload.

Concurrency, idempotency and rationale

Concurrency. Any consequential mutation must name the version and digest it expects to replace. On mismatch the operation is parked as a conflict with both states preserved. Consequential meaning is never auto-merged — a merge is a judgement about what a claim now says, and that is not inferable from two diffs.
Idempotency. Same key and payload replays the original result. Same key with a different payload is a collision and stops: a reused key with changed content is either a bug or an attempt to launder one operation as another.
Rationale is inert. Carried for humans reading the audit trail, consulted by no gate. A test asserts that changing the rationale cannot change an outcome.

Shadow mode is the qualification path

Before any rung is delegated live, the same contract runs in shadow against real proposals and its outputs are compared with what an authorised human actually chose. The delegation record carries that comparison as its prerequisite.

The shadow contract is the live contract — the same evaluator, with mode as the only difference. A shadow mode that diverges from live behaviour qualifies nothing.

What would have to be true to switch any of this on

A concrete need this contract serves and a simpler mechanism does not.
A completed shadow-mode comparison, with divergences examined rather than counted.
Closure of the bootstrap debt recorded in the specification.
An issued delegation: one actor, enumerated rungs, bounded scope, mandatory expiry, recorded prerequisites.
A demonstrated revocation path, exercised rather than described.

None has been met, and this page is not an argument that they should be.