From cf0b3ca9a58da78514a85c32844431faed775091 Mon Sep 17 00:00:00 2001 From: Raul Salvat Date: Sat, 7 Mar 2026 22:26:17 +0000 Subject: [PATCH 1/2] define push implementation descent authority --- ...H_PUSH_IMPLEMENTATION_DESCENT_AUTHORITY.md | 38 +++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 docs/governance/OSOH_PUSH_IMPLEMENTATION_DESCENT_AUTHORITY.md diff --git a/docs/governance/OSOH_PUSH_IMPLEMENTATION_DESCENT_AUTHORITY.md b/docs/governance/OSOH_PUSH_IMPLEMENTATION_DESCENT_AUTHORITY.md new file mode 100644 index 0000000..86a3c5a --- /dev/null +++ b/docs/governance/OSOH_PUSH_IMPLEMENTATION_DESCENT_AUTHORITY.md @@ -0,0 +1,38 @@ +# OSOH Push Implementation Descent Authority + +## Purpose +Authorize the controlled descent from Level 5 governance into the minimum lower-level MVP work required to realize Sentinel push telemetry without violating constitutional invariants. + +## Authorized Descent Target +The next descent is authorized only for bounded MVP realization of Sentinel push telemetry into OSOH. + +## Authorized Implementation Objects +1. Sentinel deployment event sender +2. Sentinel heartbeat event sender +3. OSOH ingest URL wiring +4. OSOH ingest token wiring +5. OSOH site identity wiring +6. bounded server-side secret handling +7. proof that push events enter OSOH as telemetry-only evidence + +## Constitutional Constraints During Descent +- Sentinel remains external monitored surface +- push remains telemetry only +- credential remains ingest-only +- activation remains blocked +- hybrid verification remains required +- OSOH remains final authority + +## Forbidden Outcomes During Descent +- no trust transfer +- no activation by configuration alone +- no activation by push alone +- no broader credential scope +- no operator or control-plane privilege grant +- no constitutional reclassification of Sentinel + +## Return Requirement +After implementation, the resulting slice must be reviewable against Level 5 invariants before any further descent. + +## Phase Completion Marker +This phase is complete when the implementation descent authority is explicitly bounded, scoped, constrained, and return-reviewable. From c476d804c5ea2629d13aac44c0899a94b3ebe4d9 Mon Sep 17 00:00:00 2001 From: Raul Salvat Date: Sat, 7 Mar 2026 22:26:46 +0000 Subject: [PATCH 2/2] define push implementation descent authority done definition --- ...ATION_DESCENT_AUTHORITY_DONE_DEFINITION.md | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 docs/governance/OSOH_PUSH_IMPLEMENTATION_DESCENT_AUTHORITY_DONE_DEFINITION.md diff --git a/docs/governance/OSOH_PUSH_IMPLEMENTATION_DESCENT_AUTHORITY_DONE_DEFINITION.md b/docs/governance/OSOH_PUSH_IMPLEMENTATION_DESCENT_AUTHORITY_DONE_DEFINITION.md new file mode 100644 index 0000000..95daa78 --- /dev/null +++ b/docs/governance/OSOH_PUSH_IMPLEMENTATION_DESCENT_AUTHORITY_DONE_DEFINITION.md @@ -0,0 +1,21 @@ +# OSOH Push Implementation Descent Authority — Done Definition + +## Done Definition + +### Condition 1 — Descent Target Is Explicit +Only bounded Sentinel push telemetry realization is authorized for the next lower-level MVP work. + +### Condition 2 — Authorized Objects Are Fixed +The permitted objects remain limited to deployment sender, heartbeat sender, ingest URL wiring, ingest token wiring, site identity wiring, bounded secret handling, and telemetry-entry proof. + +### Condition 3 — Constitutional Constraints Remain Active +Externality, telemetry-only interpretation, ingest-only credential scope, fail-closed handling, hybrid dependency, and OSOH final authority remain binding during descent. + +### Condition 4 — Forbidden Outcomes Remain Blocked +No trust transfer, no activation by configuration, no activation by push alone, no broader credential scope, and no control-plane privilege expansion are allowed. + +### Condition 5 — Return Review Remains Mandatory +The completed push slice must be reviewed back against Level 5 constitutional invariants before further descent or expansion. + +## Phase Completion Marker +This phase is complete when the lower-level implementation authority is fully bounded, fixed in scope, constitutionally constrained, outcome-limited, and review-returnable.