rfc(0001): v0.3.0 closure rationale + memory provenance (closes #3, #4 refs coven-threads)

[BunsDev]

Summary

Amends RFC-0001 as a draft-only soundness update for the two accepted coven-threads flags, now versioned as draft v0.3.0 because the patch adds backward-compatible normative requirements.

Reconciliation findings

The coven-threads issue references were stale relative to current RFC-0001:

• Issue rfc(0001): v0.3.0 closure rationale + memory provenance (closes #3, #4 refs coven-threads) #3 points at an RFC §5.5 closure lemma, but RFC-0001 §5.5 is "Regression and identity probes" and contains no closure lemma. The closure/fixpoint formalism belongs to the paper/brief handoff docs, so this PR lands the RFC change as protected-surface prose in §4.1 and Gate 1 wording in §5.4.
• Issue rfc(0001): define fail-closed approval-tier compiler #4 points at RFC §4.2 predicate (iv), but RFC-0001 §4.2 has no predicate enumeration or admission-channel formalism. This PR lands the RFC change in §3.4 Persistent Memory, where continuity-bearing entries are defined, and wires it to §5.6 audit evidence.
• Follow-up: the paper/brief formalism docs may need matching updates; this PR intentionally does not edit coven-grimoire or paper-handoff material.

Exact normative additions / rewrites

Ward manifest — The policy document the authority layer currently enforces. The canonical Ward manifest is ward.toml; implementations MAY use an equivalent filename or storage form if it provides the same protected-surface declaration (§5.2).

Standard admission path — The Ward-mediated path by which continuity-bearing entries are admitted into MEMORY.md or another continuity-bearing memory surface. The standard admission path validates source attestation, records the admission in the audit log, and rejects unverified continuity claims (§3.4, §5.6).

Any entry admitted into MEMORY.md or another continuity-bearing memory surface through the standard admission path MUST carry a source attestation traceable to a prior committed Ward state or to a principal-authorized write event recorded in the audit trail (§5.6). An entry that claims continuity without such a traceable provenance chain is unverified and MUST NOT be admitted through the standard admission path. A continuity-bearing entry MUST NOT enter MEMORY.md or another continuity-bearing memory surface through any path other than the standard admission path or a principal-authorized write. An implementation claiming Property 4 provenance MUST implement the audit-log requirements in §5.6 for memory admission and principal-authorized memory writes.

The Ward manifest is not merely an ordinary protected file. The definition of the protected surface itself MUST be a member of the protected surface it defines; a protected set that does not protect its own definition is not closed under mutation. The Ward authority layer MUST reject any proposal that mutates the Ward manifest, including any proposal that would remove the Ward manifest from [protected].files. Principal-authorized Ward updates are not proposals: they occur outside the gate pipeline (§5.4) and MUST be recorded as ward_updated audit events (§5.6). A Ward update — including a principal-authorized one — that yields a [protected].files list omitting the Ward manifest yields a non-conformant Ward (§4.1), and the authority layer MUST fail closed at Gate 1.

Verifies that the Ward manifest is present in [protected].files of the currently committed Ward before processing any proposal.

An implementation claiming Property 4 provenance (§3.4) MUST define this audit log and MUST record standard memory admissions and principal-authorized memory writes in it.

event_type (proposal_submitted, proposal_approved, proposal_rejected, proposal_vetoed, ward_updated, memory_entry_admitted, principal_authorized_write)

entry_hash and source_attestation when event_type = memory_entry_admitted

principal_authorization when event_type = ward_updated or event_type = principal_authorized_write

A memory_entry_admitted event MUST include an entry_hash for the admitted memory entry and a source_attestation identifying the prior committed Ward state or principal-authorized write event that justifies admission.

Notes

• Keeps RFC-0001 status as Draft; does not promote/freeze the RFC.
• Bumps RFC-0001 draft version and current-version references to v0.3.0.
• Adds a minimal negative conformance fixture for ward.toml omitted from [protected].files.
• Records memory-entry provenance verification as a runtime/audit-log open testing gap.
• I did not add a provenance fixture because source-attestation validation is not statically checkable by the current file-level conformance suite.

Review gate

This PR must remain DRAFT. Merge is gated on Nova/Val review.

Closes OpenCoven/coven-threads#3
Closes OpenCoven/coven-threads#4

[BunsDev]

Adversarial-review fix set applied and coordinator-verified at 15f4701: standard admission path defined + complement closed, §5.6 mandatory under Property-4 provenance claims with new memory_entry_admitted/principal_authorized_write events (entry_hash + source_attestation), 'reconstructable' deleted, closure carve-out split (principal updates out-of-band, fail-closed at Gate 1 against the currently committed ward), v0.3.0 + versioned changelog. Conformance 5/5 + 10/10 READY. One reviewer note: §6.3 versioning policy wording was itself refined to make the Minor-bump reading explicit — please eyeball that alongside the normative additions. Ready for Nova/Val sign-off.

[BunsDev]

Nova-lane review package — produced by an independent fresh-context agent reviewer (session c78af921, 2026-07-21) against pinned head 15f4701. Human approval/merge authority remains with Val; this package informs, it does not simulate, the sign-off.

NOVA COHERENCE REVIEW — BLOCKING FINDINGS (1)

Scope: OpenCoven/familiar-contract PR #3, head 15f4701, reviewed against origin/main (65622c0). Full amended RFC read end-to-end; all 12 changed files diffed; artifact exercised, not just read. Nova lane: daemon-integration coherence + compatibility contract.

---

1. Evidence of independent execution

Conformance suite (bash tests/conformance/run-conformance.sh at 15f4701):

positive: 5/5 passed
negative: 10/10 failed correctly
unexpected: 0
READY

Direct validator runs:

• node validators/validate.js tests/conformance/negative/10-protected-missing-ward → exit 1 with exactly one violation: ward.toml › protected.files — ward.toml must be in the protected files list. The fixture fails for the right reason (ward self-membership), in isolation — all other properties show ✓, so the failure is not incidental.
• node validators/validate.js tests/conformance/positive/01-minimal-compliant → exit 0, ✓ PASS … v0.3.0 compliant.

Validator delta inspected: the validate.js diff is version strings only (v0.2.0→v0.3.0 at lines 469 and 503). The closure check itself (requiredProtected = ['SOUL.md','IDENTITY.md','MEMORY.md','ward.toml'], validators/validate.js:340-345) pre-exists on origin/main — verified via git show origin/main:validators/validate.js (same lines). So the new negative fixture exercises a v0.2.0-era check; the amendment adds normative prose plus one new runtime obligation (Gate 1 precondition), not new structural validation. That is coherent — §8.2 already attributes "missing protected-surface entry" to the validator — but see A-4/A-6 on what remains runtime-only.

Compatibility: all 5 positive fixtures and both in-repo examples (examples/minimal, examples/sage) already include ward.toml in [protected].files — no existing conforming familiar breaks.

---

2. BLOCKING findings

B-1. Provenance chain's second anchor is not falsifiable: principal_authorization (and ward_updated identity fields) left at SHOULD — permit-on-silence at the root of the chain

rfcs/RFC-0001-familiar-contract.md:272-285 (§5.6). The amendment correctly adds a rescuing MUST for memory_entry_admitted ("MUST include an entry_hash … and a source_attestation", :285). But §3.4's provenance disjunction (:140) terminates at one of two anchors — a prior committed Ward state (identified via ward_updated events) or a principal-authorized write event — and both anchors' evidence fields remain inside the SHOULD-level list ("Each entry SHOULD include at minimum: … principal_authorization when event_type = ward_updated or event_type = principal_authorized_write"; ward_version/ward_hash likewise SHOULD).

Consequence: a conforming implementation can record a principal_authorized_write event carrying no principal_authorization evidence, and a ward_updated event carrying no ward_hash, and every memory_entry_admitted chained to them still "verifies." That is (a) a permit-on-silence hole exactly where the amendment claims falsifiability — a downstream validator (the coven daemon / coven-threads Phase 5 audit types) cannot distinguish real from asserted principal authorization; (b) in tension with the no-simulation-of-human-approval tenet: the spec permits an audit record that asserts human authorization with no required evidence; (c) internally incoherent — the PR recognized this exact failure mode for memory_entry_admitted and MUST-ed its fields, but not for the two event types those attestations resolve to. §8.1's "humans are the trust root" covers adversarial humans, not evidence-free records of humans.

Suggested fix (one sentence in §5.6, parallel to :285):

A principal_authorized_write or ward_updated event MUST include principal_authorization, and a ward_updated event MUST include ward_version and ward_hash; a source attestation that resolves to an event lacking these fields MUST be treated as unverified.

---

3. ADVISORY findings

A-1. "claiming Property 4 provenance" is undefined and creates a conditionality mismatch. §3.4 sentences 1–3 (:140) are unconditional MUSTs; sentence 4 and §5.6 (:272) hinge on an undefined claim level ("An implementation claiming Property 4 provenance"), while §3 (:93) makes Property 4 itself mandatory for every familiar. A consistent fail-closed reading exists (no audit log ⇒ no standard admission path per §1.1:45 ⇒ principal-only writes), so this is not a hole — but the term invites a two-tier reading of a mandatory property. Fix: replace both occurrences with "An implementation that provides a standard admission path MUST implement/define …", tying the MUST to the §1.1 definition instead of an undefined claim.

A-2. "continuity-bearing" is undefined and the classification default is unstated. §1.1:45 and §3.4:140 make path-exclusivity apply only to "continuity-bearing" entries/surfaces. MEMORY.md is unconditionally covered, but for other surfaces the rejection-triggering predicate is implementer-defined — vacuously satisfiable. Also :140's "An entry that claims continuity" is silent on entries whose status is ambiguous. Fix: define "continuity-bearing" in §1.1 and add: "An entry whose continuity-bearing status cannot be determined MUST be treated as continuity-bearing." (Fail-closed classification.)

A-3. Admission-path/self-improvement-loop origin boundary — reflection laundering. §3.4 ¶2 (:138) still requires human authorization for self-improvement-loop writes to MEMORY.md; ¶3 admits attested entries through the standard admission path with no per-entry human approval. §7.3 (:340) classifies sleep-time compute as a self-improvement loop, and §8.1 (:354) names unsupervised-reflection drift as a defended threat. Nothing states whether reflection-originated entries may use the standard admission path; a valid attestation ("produced under committed Ward X") is cheap for a reflection loop, so drift could be laundered through the admission path unless origin gating is explicit. Attestation is necessary, and no text makes it sufficient — but say so. Fix: add to §3.4: "A source attestation establishes provenance, not authorization: an entry originating from a self-improvement loop MUST additionally carry explicit human authorization regardless of attestation validity; an entry of ambiguous origin MUST be treated as loop-originated."

A-4. Closure precondition is anchored only at Gate 1; no re-check at Gate 4; ward-update race unaddressed. §5.4 Gate 1 (:249) verifies manifest self-membership "before processing any proposal," and §4.1 (:165) says a non-closed Ward "MUST fail closed at Gate 1." §5.4 (:255) declares Gate 4 "the real security boundary," yet Gate 4 gets no closure re-verification — an in-flight proposal that passed Gate 1 under closed Ward X could reach Gate 4 after a principal commits non-closed Ward Y, where ward.toml ∉ [protected].files weakens the Gate-4 diff check itself. Also §9 (:380-388) does not list runtime Gate-1 closure verification as an untested gap (it is runtime-only; the fixture covers only the structural side). Fix: "The authority layer MUST NOT process new proposals (Gate 1) and MUST NOT promote in-flight proposals (Gate 4) while the currently committed Ward manifest is absent from its own [protected].files," plus a §9 bullet.

A-5. New §1.1 "Ward manifest" MAY contradicts literal MUSTs. §1.1:42 (new in this PR) permits "an equivalent filename or storage form," citing §5.2 — but §5.2 (:224) mandates a TOML document with canonical filename, §4.1 (:158-163) requires the literal string ward.toml in [protected].files, and the reference validator checks the literal filename (validate.js:340). As written, the MAY is unexercisable by any structurally conformant familiar. Fix: scope it — "the equivalent-form allowance applies to the authority layer's runtime storage of the enforced manifest; structural conformance requires the canonical ward.toml."

A-6. "Committed Ward state" and attestation verification are under-defined. "Committed" (§3.4:140, Gate 1 :249, §5.6:285) is never defined, and §1.1:45's "validates source attestation" never says against what. The falsifiability mechanism is implicitly entry_hash-matching against the append-only log, but hash algorithm/entry canonicalization are unspecified — two implementations cannot verify each other's chains. Fix: define "committed Ward state" as a (ward_version, ward_hash) pair recorded via a ward_updated event, and state: "Validation MUST confirm the referenced event or committed Ward state exists in the append-only audit log; an attestation whose referent cannot be resolved MUST be rejected."

A-7. §6.3 semver definitions were rewritten in the same PR that depends on them, undisclosed in CHANGELOG. Old Major read "Changes to the five properties or to MUST-level requirements" — under which this Property-4 amendment is arguably major; the PR changes it to "Incompatible changes…" (:308-310), retroactively legalizing its own minor bump. The new policy is the better one, and directory-level compatibility is verified (5/5 positives) — but CHANGELOG.md:18-22 lists §4.1/§5.4 and version-reference changes while omitting the §6.3 redefinition entirely. For a normative contract, a versioning-policy change must be disclosed. Fix: add a CHANGELOG "Changed" line for §6.3.

A-8. Genesis holds but only implicitly — state it. Verified satisfiable: closure is syntactic self-reference writable in one principal-authorized genesis write, which §4.1 (:165) places outside the gate pipeline (recorded as ward_updated, whose principal_authorization needs no prior ward — recursion bottoms out); an empty MEMORY.md is conformant (validate.js:419), and the first admission's "prior committed Ward state" is the genesis ward. No fail-open hole, no unsatisfiable precondition — but the RFC never makes this argument. Fix: short bootstrap note in §4.1 or §5.2.

A-9. docs/ward-deep-dive.md not updated: still "RFC-0001 v0.2.0" (:324, :362) and frames "open questions that v0.3 and beyond will need to address" — v0.3.0 now exists and shipped two items not on that list. Cross-doc drift with the five files this PR did update.

---

4. NITS

• N-1. §3.4:140 "audit trail" vs "audit log" everywhere else (§1.1:45, §5.6:272). Pick one.
• N-2. §4.1:165 cites "(§4.1)" from inside §4.1.
• N-3. tests/conformance/negative/10-protected-missing-ward/ward.toml:14-15 retains the copied comment "…and ward.toml itself. Do not remove these." while deliberately omitting it — misleading to fixture readers (validator ignores comments; verified single-violation).
• N-4. docs/faq.md:293 — a line this PR touched — retains dangling in-repo path research/synthesis/ward-spec-v0.2-draft.md (directory absent).
• N-5. rfcs/README.md citation now points at releases/tag/v0.3.0; only v0.1.0/v0.2.0 tags exist — tag on release or the canonical citation dangles.
• N-6. The PR narrative claims "'reconstructable' defined," but the term appears nowhere in the landed tree (superseded by "traceable … provenance chain"). Correct the description.

---

5. Downstream (coven-threads / daemon) spot-check

• §5.3 tiers, veto windows, and the no-auto-promote-protected rule are untouched — no drift against Phase-5 approval-path/veto typing.
• New carve-out (:165): "Principal-authorized Ward updates are not proposals: they occur outside the gate pipeline." Downstream must model ward_updated as a non-proposal transition that still triggers closure verification. This does not weaken staged-write = only-additive-outcome: it is the principal lane, not the agent lane.
• New event kinds memory_entry_admitted / principal_authorized_write are additive audit-enum extensions; memory admission is a parallel Ward-mediated path, not a staged proposal — Phase 5 must not funnel admissions through proposal gates.
• No descriptor-authoritative language introduced: Gate 1 still checks declared targets with Gates 2/4 holding materialized-diff authority — predicate-authoritative preserved. Gate 1 gains one new predicate (closure of the currently committed Ward) that the daemon's gate-1 implementation must add.

---

6. Closure-and-provenance coherence argument

The two amendments are, structurally, the same move made at two layers, and that is why they compose. Cody's closure requirement makes the policy self-grounding: the definition of the protected surface is a member of the protected surface, so no agent-lane path can mutate the authority boundary out from under itself, and the only mutation channel (principal-authorized update) is forced outside the gate pipeline, into the audit log, and into a fail-closed check at the next gate evaluation. Echo's provenance requirement makes the memory self-grounding in the same audit substrate: an admitted entry must resolve to either a committed Ward state or a principal write event — that is, memory continuity is anchored to exactly the two things the closure amendment guarantees exist and are tamper-evident. Both requirements bottom out at the same trust root (the principal, via the append-only log), and both genesis recursions terminate there: the first ward.toml needs no prior ward, and the first memory entry needs no prior entry — only the genesis ward or a principal write. Verified: no unsatisfiable precondition and no fail-open genesis path; the defaults on the agent lane are uniformly reject.

The single place the composition fails is where the two amendments meet: the audit events they share as anchors. memory_entry_admitted received MUST-level evidence (entry_hash + source_attestation), but the events those attestations resolve to — principal_authorized_write and ward_updated — kept SHOULD-level evidence fields. The provenance chain is therefore falsifiable at every link except its root, and an unevidenced root record asserting human authorization is precisely the "simulated approval" the tenets forbid. This is a one-sentence fix (B-1), and with it applied — plus the definitional tightening in A-1/A-2/A-6 — the closure and provenance amendments hold together cleanly: closure guarantees the anchors cannot be silently redefined, provenance guarantees nothing is admitted that does not trace to an anchor, and the audit log carries both.

Sign-off withheld pending B-1; everything else is wording-tier and can land in this PR or a fast-follow at the maintainers' discretion. Conformance suite, validator behavior, examples, and directory-level compatibility with all five positive fixtures are independently confirmed at 15f4701.

[BunsDev]

Fix set for the Nova coherence review (B-1 + A-1..A-9 + N-1..N-6) — head now cf5171a. Merge authority remains with Val; Nova re-review requested.

B-1 (blocking) — RESOLVED

§5.6 now closes the permit-on-silence hole at both provenance-chain anchors:

A principal_authorized_write or ward_updated event MUST include principal_authorization, and a ward_updated event MUST additionally include ward_version and ward_hash; a source attestation that resolves to an event lacking these required fields MUST be treated as unverified. Source-attestation validation MUST confirm that the referenced committed Ward state or principal-authorized write event exists in the append-only audit log; an attestation whose referent cannot be resolved MUST be rejected.

Advisories — all applied

• A-1 — "claiming Property 4 provenance" replaced with "an implementation that provides a standard admission path (§1.1)" in §3.4 and §5.6.
• A-2 — "Continuity-bearing" defined in §1.1 with fail-closed classification default ("cannot be determined MUST be treated as continuity-bearing"), restated at point of use in §3.4.
• A-3 — §3.4: "A source attestation establishes provenance, not authorization" — loop-originated entries (incl. sleep-time/reflection regimes, §7.3) additionally require explicit human authorization regardless of attestation validity; ambiguous origin treated as loop-originated.
• A-4 — Gate 4 re-verifies Ward-manifest closure ("even if it passed Gate 1 under an earlier Ward"); §9 gains a runtime-closure-verification gap bullet.
• A-5 — §1.1 equivalent-form allowance scoped to authority-layer runtime storage; structural conformance requires canonical ward.toml.
• A-6 — §1.1 defines "Committed Ward state" as the (ward_version, ward_hash) pair recorded via ward_updated; §5.6 requires attestation-referent resolution against the append-only log.
• A-7 — CHANGELOG now discloses the §6.3 semver redefinition.
• A-8 — §4.1 genesis note: recursion bottoms out at the principal; a genesis Ward including its manifest is closed from its first committed state.
• A-9 — docs/ward-deep-dive.md updated to v0.3.0 (incl. footer), open-questions horizon reframed; the v0.3-shipped items (closure + provenance) are called out.

Nits

• N-1 audit trail → audit log (§3.4). N-2 §4.1 self-citation removed. N-3 fixture comment now states the deliberate omission. N-4 faq's dangling research/synthesis/ward-spec-v0.2-draft.md repointed at docs/ward-deep-dive.md. N-5 tagged-release citation qualified until the v0.3.0 tag is cut at merge. N-6 correction for the record: the earlier PR comment claimed "'reconstructable' defined" — that term was superseded by the traceable-provenance-chain formulation and appears nowhere in the tree; the comment overstated.

Evidence

bash tests/conformance/run-conformance.sh at cf5171a: 5/5 positive, 10/10 negative, unexpected 0, READY. Fixture negative/10-protected-missing-ward still fails for exactly the ward-self-membership reason. Validator untouched — all changes are normative prose + docs.

Bead: threads-uqx.2.

[BunsDev]

Fresh-context Nova-lane re-review verdict (session a2cdc3f5, reviewer separate from fix author) — verified at cf5171a, fast-follow delta re-verified through 12ccd44. Human approval/merge authority remains with Val.

NOVA RE-REVIEW — SIGN-OFF RECOMMENDED

B-1 (blocking): RESOLVED. Chain verified closed end-to-end: event lacking required fields → attestation unverified (§5.6) → entry MUST NOT be admitted (§3.4) → path rejects unverified continuity claims (§1.1). Both provenance anchors falsifiable; genesis note does not bypass — the genesis ward_updated event still carries all three MUST fields.

All 9 advisories + 6 nits: RESOLVED (independently verified against the tree, not the fix-set comment).

Re-review surfaced 3 new findings (1 advisory, 2 nits) — all fixed in fast-follows on this branch:

• NEW-1 (advisory) — the A-3 loop-origin authorization obligation wasn't audit-falsifiable (the B-1 shape, one level up). Fixed at 9b5535e: a memory_entry_admitted event for a loop-originated entry MUST additionally include the principal_authorization required by §3.4. §3.4's fail-closed origin default propagates the field obligation automatically. Verified: doesn't contradict the §5.6 SHOULD-floor bullet list — same pattern as the pre-existing entry_hash bullet/paragraph split.
• NEW-2 (nit) — RFC §11 v0.3.0 changelog omitted the anchor-evidence MUSTs, loop-origin rule, Gate-4 re-check, and §6.3 semver redefinition. Fixed at 9b5535e; verified no overclaim.
• NEW-3 (nit) — §1.1 lowercase "requires" keyword hygiene. Fixed at 9b5535e; plus one changelog understatement tidy at 12ccd44.

Evidence (all runs executed by the reviewer, per head): conformance 5/5 positive · 10/10 negative · unexpected 0 · READY at cf5171a, 9b5535e; re-confirmed at 12ccd44. negative/10-protected-missing-ward fails with exactly one violation (ward self-membership). Validator/schemas untouched across all three commits.

Downstream (coven-threads Phase-5): §5.3 tier/veto table byte-untouched; staged-write remains the only additive agent-lane outcome (Gate-4 closure re-check only blocks); ward_updated stays a principal-lane non-proposal transition; new audit evidence fields are additive. No conflict.

Residual (future work, non-blocking): hash algorithm/entry canonicalization for cross-implementation chain verification remains unspecified (pre-noted in original review as A-6 residual).

Ready for Val: approval → merge → tag v0.3.0 (rfcs/README citation expects the tag at merge). Bead: threads-uqx.2.

[BunsDev]

Second independent fresh-context Nova-lane re-review (session e05c94cf, reviewer separate from fix author and from the re-review above) — pinned at cf5171a, post-pin delta read through 12ccd44. Posted as corroboration; human approval/merge authority remains with Val.

NOVA RE-REVIEW ×2 — CONCURRING SIGN-OFF (PASS)

Two re-reviews ran independently (parallel sessions, same claim window). Verdicts agree on every point, so this is a compact corroboration, not a second package:

• B-1: RESOLVED — anchor-evidence MUSTs verified at rfcs/RFC-0001-familiar-contract.md:291; unevidenced anchor → unverified attestation → §3.4 MUST-NOT-admit chain closes the permit-on-silence hole. All 16 original findings (B-1, A-1..A-9, N-1..N-6): RESOLVED, zero regressions — independently executed evidence (conformance 5/5 + 10/10 + READY at cf5171a, re-confirmed in a detached worktree; negative/10 fails with exactly one violation for the right reason; both examples + all 5 positive fixtures still pass; validator delta = version strings only).
• Independently surfaced the same new advisory as the review above (loop-origin authorization not audit-falsifiable — the B-1 shape one level up) before seeing 9b5535e; confirmed 9b5535e resolves it and the 12ccd44 delta is docs-only, accurate, and touches no executable artifact.
• Downstream posture concurs: predicate-authoritative preserved, staged-write stays the only additive agent-lane outcome, v020 audit-schema impact is additive (columns + two event-type tags via the existing CHECK-extension mechanism).

One nit not in the package above (non-gating, fast-follow): §1.1's standard admission path definition enumerates attestation validation, audit recording, and unverified-claim rejection — but not the §3.4 origin-gating/human-authorization check the path must now also perform. Not a contradiction (the definition cross-references §3.4, and "attestation establishes provenance, not authorization" disambiguates), but appending "and verifies explicit human authorization for loop-originated entries (§3.4)" would make the definition self-contained. Same tier: the §5.6 SHOULD-list's conditional bullets could carry "(MUST — see below)" pointers.

Process note: two commits landed mid-review-window; the pin discipline caught it and both were fully read, but future fix-sets should freeze the head once a re-review is requested.

Concur with the recommendation: ready for Val — approve → merge at 12ccd44 → cut v0.3.0 tag; fast-follow for the definitional nits + A-6 hash-canonicalization residual.

[BunsDev]

Merged + tagged. Val approval received 2026-07-21 (in-session, human gate — not simulated); squash-merged at pinned head 12ccd44 → main 710036e; annotated tag v0.3.0 cut at the merge commit (the rfcs/README.md citation now resolves). Conformance re-verified on main: 5/5 positive + 10/10 negative, READY. Stacked PR #4 retargeted to main before branch deletion. Fast-follow beads: threads-auu (§1.1/§5.6 definitional nits), threads-5vn (A-6 hash-canonicalization interop). Beads threads-3xd + threads-uqx.2 closed with evidence.

[Copilot]

Pull request overview

Updates RFC-0001 to Draft v0.3.0 with new normative language around (a) Ward-manifest closure (the manifest must protect itself) and (b) continuity-bearing memory provenance via a standard admission path and audit-log evidence, plus aligns repository documentation and the validator output with the new draft version.

Changes:

• Bumps RFC-0001 draft version references across docs and the validator from v0.2.0 → v0.3.0.
• Adds/rewrites RFC-0001 sections defining Ward-manifest closure semantics, memory-entry provenance/admission requirements, and audit-log event vocabulary/fields.
• Adds a new negative conformance fixture where ward.toml is omitted from [protected].files.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
validators/validate.js	Updates validator output strings to report v0.3.0 compliance.
tests/conformance/negative/10-protected-missing-ward/ward.toml	New negative fixture Ward missing ward.toml in [protected].files.
tests/conformance/negative/10-protected-missing-ward/SOUL.md	New negative fixture SOUL content for the case directory.
tests/conformance/negative/10-protected-missing-ward/MEMORY.md	New negative fixture MEMORY stub for the case directory.
tests/conformance/negative/10-protected-missing-ward/IDENTITY.md	New negative fixture IDENTITY stub for the case directory.
tests/conformance/negative/10-protected-missing-ward/CASE.md	Documents the intended violation and expected validator failure for the new negative case.
SPEC.md	Updates “current normative specification” pointer to RFC-0001 v0.3.0.
rfcs/RFC-0001-familiar-contract.md	Core RFC update: v0.3.0 version/date bump plus new/rewritten normative text for closure + memory provenance + audit evidence.
rfcs/README.md	Updates RFC index and citation guidance to v0.3.0.
README.md	Updates the repo’s specification badge/version reference to v0.3.0.
docs/ward-deep-dive.md	Updates version references and reframes open questions post v0.3.0 changes.
docs/faq.md	Updates FAQ references and conformance-suite negative-case count to ten.
CHANGELOG.md	Adds a 0.3.0 release section summarizing the RFC and fixture additions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.