Ting/Jostoph

Watch

Fork 2

V2: The barrier watch and the grace clock #72

New issue

Open

opened 2026-08-12 16:16:24 +00:00 by agent.teyla · 1 comment

agent.teyla commented

2026-08-12 16:16:24 +00:00

Contributor

V frontier

In scope

Bao barrier state on the estate's dashboards; sealed fires a page immediately — the clock to a silent witness starts at the barrier, not at the first failed signature.
The grace clock: time remaining until the oldest signing leaf expires with Bao sealed, i.e. how long the estate can testify while blind. Leaf TTL declared as the double-duty parameter it is: leaf_ttl ≥ expected_reamorce_time, the fifth coupling, eval-checked.
Re-amorce drill recorded: each barrier reopening — routine (deploy) or recovery — is a signed record, so the succession ceremony's monthly rhythm doubles as a proven-liveness log.

Out of scope

Auto-unseal. The barrier's opening stays a human capability by current ruling; revisit deliberately, never by convenience.

Boundary

What is offsite must be what re-amorces: unseal or recovery key shares, not a root token — a token authenticates after the barrier opens and opens nothing. V4 attests this distinction on a calendar, because it is a ten-minute check with an existential difference.

Acceptance

A test barrier-seal pages within one scrape interval and starts the grace clock with the correct remaining time.
Eval fails if declared leaf TTL falls below declared re-amorce time.

Source: JOSTOPH-BACKLOG.md, Milestone V.

`V` `frontier` **In scope** - Bao barrier state on the estate's dashboards; **sealed fires a page immediately** — the clock to a silent witness starts at the barrier, not at the first failed signature. - The grace clock: time remaining until the oldest signing leaf expires with Bao sealed, i.e. how long the estate can testify while blind. Leaf TTL declared as the double-duty parameter it is: `leaf_ttl ≥ expected_reamorce_time`, the fifth coupling, eval-checked. - Re-amorce drill recorded: each barrier reopening — routine (deploy) or recovery — is a signed record, so the succession ceremony's monthly rhythm doubles as a proven-liveness log. **Out of scope** - Auto-unseal. The barrier's opening stays a human capability by current ruling; revisit deliberately, never by convenience. **Boundary** - What is offsite must be what re-amorces: unseal or recovery **key shares**, not a root token — a token authenticates after the barrier opens and opens nothing. V4 attests this distinction on a calendar, because it is a ten-minute check with an existential difference. **Acceptance** - A test barrier-seal pages within one scrape interval and starts the grace clock with the correct remaining time. - Eval fails if declared leaf TTL falls below declared re-amorce time. Source: JOSTOPH-BACKLOG.md, Milestone V.

codexo referenced this issue

2026-08-15 00:08:17 +00:00

Epic: Vedanta ceremony and custody governance #84

codexo added the

Status/Need Grooming

label

2026-08-16 12:52:31 +00:00

codexo added a new dependency

2026-08-16 13:10:15 +00:00

#84 Epic: Vedanta ceremony and custody governance

larandar referenced this issue

2026-09-20 03:49:53 +00:00

Probes: external-system facts for the frontier (#55, #71-#74) (audit G55) #127

larandar commented

2026-09-20 03:50:10 +00:00

Owner

Audit 2026-09-19/20, G55: external-system facts are bounded in umbrella probe Ting/Jostoph#127 (#127). This record probe section and result columns are named there; no implementation claim is made here.

Audit 2026-09-19/20, G55: external-system facts are bounded in umbrella probe Ting/Jostoph#127 (https://jo.et0.pw/Ting/Jostoph/issues/127). This record probe section and result columns are named there; no implementation claim is made here.

No milestone

No project

No assignees

2 participants

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Blocks

#84 Epic: Vedanta ceremony and custody governance

Ting/Jostoph

Reference

Ting/Jostoph#72

No description provided.

Rows
Columns