From 5b861ef7b42c05cdba26415a1d88199b7e8fe761 Mon Sep 17 00:00:00 2001
From: Raul Salvat <salvat.raul@gmail.com>
Date: Sat, 7 Mar 2026 20:08:15 +0000
Subject: [PATCH] docs: add OSOH MVP build slice 03

---
 docs/tasks/OSOH_MVP_BUILD_SLICE_03.md | 55 +++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)
 create mode 100644 docs/tasks/OSOH_MVP_BUILD_SLICE_03.md

diff --git a/docs/tasks/OSOH_MVP_BUILD_SLICE_03.md b/docs/tasks/OSOH_MVP_BUILD_SLICE_03.md
new file mode 100644
index 0000000..7c01e4b
--- /dev/null
+++ b/docs/tasks/OSOH_MVP_BUILD_SLICE_03.md
@@ -0,0 +1,55 @@
+# OSOH MVP Build Slice 03
+
+## Slice Goal
+Extend the MVP foundation by defining the first usable ingest contract and minimal rejection behavior for monitored-surface telemetry while preserving fail-closed governance and constitutional boundary enforcement.
+
+## Slice Scope
+This slice covers:
+- minimal ingest payload contract
+- bearer-token authentication path
+- valid event acceptance baseline
+- invalid event rejection baseline
+- ingestion-only scope enforcement
+
+## Required Build Order
+
+### 1. Minimal ingest contract
+- define minimum accepted payload shape
+- require site-bound event submission
+- require event type field
+- require timestamp field
+- require payload body presence
+
+### 2. Authentication baseline
+- require bearer token on ingest requests
+- resolve token to monitored surface
+- reject missing token
+- reject unknown token
+- reject revoked token
+
+### 3. Acceptance baseline
+- accept valid in-scope payloads
+- return success response for accepted events
+- normalize accepted event structure
+- attach accepted event to monitored surface identity
+
+### 4. Rejection baseline
+- reject malformed payloads
+- reject out-of-scope submissions
+- reject inactive or unauthorized token state
+- return explicit failure response for rejected events
+
+### 5. Scope enforcement
+- preserve ingestion-only credential behavior
+- prevent credential use outside ingest path
+- prevent trust promotion through ingest success
+
+## Slice Completion Condition
+Slice 03 is complete when Sentinel can send a minimally valid authenticated ingest event that is accepted and normalized, while malformed, invalid, or unauthorized requests are fail-closed and rejected without any promotion into OSOH core trust.
+
+## Non-Negotiables
+- Sentinel remains `external_monitored_surface`
+- Sentinel does not become OSOH core
+- Sentinel does not enter first-party session trust
+- Sentinel does not enter broad first-party CORS trust
+- ingest credentials remain unique, per-site, and ingestion-only