Skip to main content
AI SYNDICATE
← Back to Docs

Minimal Compliant Implementation

This page defines the smallest system that satisfies INV-1 through INV-6 without optional compliance paths.

INV-1INV-2INV-3INV-4INV-5INV-6

Spec Drift Warning

Changes to implementation that violate invariant mappings invalidate compliance with v1.0. Implementations MUST preserve invariant-to-component, invariant-to-artifact, and invariant-to-verification-step mapping.

Compliance Assertion

  • • Defines the smallest topology that satisfies INV-1 through INV-6 under explicit assumptions only.

Non-Compliance Results In

  • • Removing any required component or weakening any assumption invalidates compliance.

Scope Warning

Invariant Mapping: ALL INVARIANTS

This implementation satisfies invariants under defined assumptions only. Production environments require additional controls for key custody, runtime hardening, network isolation, deployment change control, and operational health checks.

Minimum Required Components

Invariant Mapping: ALL INVARIANTS

  • • One Gate instance enforcing the execution boundary.
  • • One Control Plane instance capable of issuing signed approval envelopes.
  • • One Execution Layer instance rejecting direct unauthenticated execution.
  • • One Audit System capable of attributable, tamper-evident logging.
  • • One strongly consistent nonce store for replay prevention.

Minimum Request -> Approval -> Execution -> Audit Flow

Invariant Mapping: ALL INVARIANTS

  • • Step 1: Client sends signed request with timestamp and nonce to Gate.
  • • Step 2: Gate verifies signature, timestamp, and nonce.
  • • Step 3: Gate invokes Control Plane for policy evaluation.
  • • Step 4: Control Plane returns signed approval envelope with bounded parameters.
  • • Step 5: Gate validates approval envelope and parameter bounds.
  • • Step 6: Execution Layer executes only approved parameters.
  • • Step 7: Audit System records request, approval, and execution or denial outcome.

Compliance Evidence

  • • End-to-end trace for one successful execution.
  • • End-to-end trace for one denied execution.
  • • Verification artifact bundle covering both cases.

Verification Linkage

INV-1..INV-6

Artifact: /public/verify-fail-closed/v1.0/

Check: Minimal topology produces complete verification bundle

Verification step: verify.sh: full run