TENIR Governance

TENIR-Gov 5.7.0 · Interactive Architecture & Evidence

An evidence-led walkthrough of the published release, bounded single-host execution and remaining questions. Explore the conceptual architecture and three browser simulations; no animation invokes the actual kernel or an external provider.

TENIR-Gov · v5.7.0 Single-host SQLite WAL External 81/81 reported
CREDIBILITY · EXACT SOURCE

Proof first. Claims second.

This is a bounded traceability record. Test results do not certify a production deployment.

01 · RELEASE ID
TENIR-Gov v5.7.0

47ef67e3efc5f3008896a7d88bebf929fa0a98f0
Published release and PyPI publication observed on 24 October 2026.

Source ↗
02 · RELEASE CI
1,286 PASS · exact tag

Python 3.12, Ubuntu. The 81 Raft tests are part of the total and not additive. One warning. No exact-source 96% coverage or latency SLA proven.

Workflow ↗
03 · EXTERNAL REPRODUCTION REPORTED
Harv Banning · 81 / 81

Reported by email 26 Oct 2026, macOS 26.6.2, Python 3.12.7, pytest 8.4.2, pysyncobj 0.3.17, cryptography 50.0.2. First attempt: 20 passes, 61 setup errors due to missing cryptography. Rerun: 81 passed / 0 failed / 0 skipped in 282.08 seconds, no source changes.

Reported file raft-5.7.0-rerun.log; SHA-256 0e0cbafda8c90735bf277d783d69ce91df36c5abcad26ac81de4a2d82fe7ff03. User-supplied email and pytest excerpt agree; raw file checksum not independently verified here. Loopback only, no C3 cross-host claim.

5.7.0 deployment limits

Single-host only, requiring verified manifest, durable operation registry and SQLite WAL local budget. FM-20 PySyncObj pickle transport still open; production Raft/multi-host disabled. No guarantee of external exactly-once provider effects, physical multi-host C3 or independent certification. Profile S commit authority is opt-in, off by default.

Deployment boundaries ↗
Architecture · The Resolution Model

Five Levels from Business Rule to Machine Execution

The five-level REG+ model is a conceptual design, not a claim that each depicted component is deployed. A business intention may be translated into a substantive rule, resolved into a profile, decomposed into invariants, and only then executed by the runtime. The diagram describes possible responsibilities and outputs; implementation and evidence depend on the deployment.

0
Business Rule
The normative intention expressed by the business — e.g., "Never double-execute a payment." Complete in its own register, but not executable.
Functional Team
1
Regulatory Constraint
The compliance mapping — e.g., "EU AI Act Art. 12 (traceability), ISO 42001 A.6.7 (audit trail)."
Compliance
2
Act of Mediation (Translation)
Business Intention + Architectural Hypotheses = Substantive Rule. The architect translates intent into a machine-resolvable contract.
Governance Architect
3
Standard (REG Core & REG+)
The substantive rule is resolved into a Profile (σ), then decomposed into atomic Invariants (I*). REG+ publishes the profile; REG Core defines the invariant language.
REG+ Catalog
4
Runtime (TENIR-Gov)
Evaluate() reads invariants, Commit() mutates state, Record() produces proof. The membrane enforces — it does not legislate.
The Membrane
Signals · The Raw Material

Four Families of Structural Signals

Signals are the raw facts the engine reads. Each family has a distinct origin and a distinct level of trust. A signal from S1 is declarative (may be false). S2 is observed. S3 needs independently verified custody and evidence before external attestation may be claimed; S4 is historical. Caller-controlled signing keys alone cannot establish provider truth.

S1
Transition Signals
From the Passage (τ) proposed by the caller
Declarative
agent_id, action_type, amount, target_realm, idempotency_key
S2
Business State Signals
From the MembraneState (s) — read from the registry
Observed
resource.available, agent.authority_score, quarantine_active
S3
Infrastructure Signals
From assurance adapters — independent signing authority and provider evidence required
Attested
HYPOTHESIS_VERIFIED, HYPOTHESIS_WEAKENED, HYPOTHESIS_VIOLATED
S4
Historical Signals
From the DurableOperationRegistry — persisted execution trace
Historical
state=DISPATCHING, budget_committed=true, hold_record.tau_k_remaining
Pipeline · Signal to Verdict

The 8-Step Transformation Chain

The pipeline is a conceptual composition of implemented and proposed modules. Not every step is independently evidenced by the release suite. Click Animate to explore the diagram, not to execute TENIR-Gov.

1
Level 0 → 1 · Normalization
S1+S2+S3+S4 → Normalized Signals
Raw signals are aggregated into a vector of constraint coordinates. If a coordinate is absent, it is never filled with a favorable default — it is marked unmeasured and becomes a gate reason.
coordinates{} + unmeasured_axes[]
2
Level 1 → 2a · Scoring
Coordinates → Score S
The Scoring Kernel computes S = K / (P × V + ε). The score is continuous — two passages with close scores produce the same verdict if thresholds are the same. The score is NOT the verdict.
scoring_result{ s_score, decision, rationale }
3
Level 1 → 2b · Invariants
Signals → Discrete Results per Invariant
Each invariant I_n is evaluated independently. No invariant reads the score. No invariant is affected by another's verdict. This is what makes the verdict reconstructible: an auditor sees which invariant failed, not just that the system said HARD_VETO.
membrane_result{ checks: [CheckResult...] }
4
Level 2 → 3 · Composition
Score + Invariants + S3 → Composed Verdict
Three layers: (4a) Lattice composition — if either HARD_VETO → HARD_VETO, else HOLD, else FLAG, else PASS. (4b) Signal reactions from profile σ. (4c) Signal freshness — stale signals are ignored or promoted to FLAG per σ strategy.
composed_decision ∈ {PASS, FLAG, HOLD, HARD_VETO}
5
Level 3 → 4 · Commit
Verdict → Local Commit / Conditional Dispatch
On 5.7.0, local budget transactions use SQLite WAL within one host. Dispatch to an external provider is a separate authority boundary. A late effect after RELEASED causes compensation accounting, not an actual reversal at the provider.
commit_trace{ result, pre_hash, post_hash }
6
Level 4 → 5 · Record
All Artifacts → EvidenceRecord
The reference evidence schema illustrates traceability. Actual signature custody, provider effects, cryptographic independence and deployed configuration each require their own validation.
EvidenceRecord (reference schema)
7
Level 5 → 6 · Assessment
EvidenceRecord → τ⁻¹ + EVP
Post-hoc evaluation: (7a) τ⁻¹ Partial Tau Inversion classifies reversibility into five classes. (7b) EVP (Intended Value Preservation) measures gross, net, and ratio. τ⁻¹ and EVP do not imply each other — a transition can be IRREVERSIBLE with excellent EVP.
assessment{ tau_class, evp_gross, evp_net, evp_ratio }
Click animate to walk through each step
Adjudication · The Double Kernel

Continuous Score × Discrete Invariants

The Double-Kernel is NOT structural vs. substantive. It separates the continuous (Scoring Kernel: S = K/(P·V+ε)) from the discrete (Transition Membrane: invariants). The composition of both produces the verdict. The score and the invariants are independent in the composition.

Kernel 1 · Continuous
Scoring Kernel
S = K / (P × V + ε)
  • K Capacity (from State)
  • P Pressure (from Passage)
  • V Velocity / Volatility (from Passage)
  • ε Stability floor (10⁻⁶)

S > τ_pass → PASS · τ_block < S ≤ τ_pass → FLAG · S ≤ τ_block → HARD_VETO

Kernel 2 · Discrete
Transition Membrane
I₁ ∧ I₂ ∧ ... ∧ I₉
  • I1 single-use-permit
  • I2 commit-binding
  • I3 terminality
  • I4 only-dispatch-produces-effects
  • I6 no-admission-under-quarantine
  • I7 delegation-integrity
  • I8 aggregate-budget
  • I9 trajectory-temporal-consistency
Composition Lattice
IF either HARD_VETO → HARD_VETO
ELSE IF either HOLD → HOLD
ELSE IF either FLAG → FLAG (but budget_util > 0.85 may escalate to HOLD)
ELSE → PASS

A high score (S = 0.9) does not guarantee PASS — an invariant can produce HARD_VETO alone. Conversely, a low score (S = 0.4) does not force HARD_VETO if invariants pass — the verdict will be FLAG, not HARD_VETO. The score and the invariants are independent in the composition.

Agent Model · CAVE

The CAVE Matrix — Click to Explore

Control · Aim · Veto · Epistemics. The canonical diagnostic framework for agentive situations. Click any cell to see the detailed interrogation.

C
Control
Who actually holds the levers?
A
Aim
Is the declared objective aligned?
V
Veto
Does the right to stop still exist?
E
Epistemics
Is the source of reality intact?
Control
Who detains the actual levers — not formally, but really? Who can accelerate, slow down, stop? The question is not about org charts or stated authority. It is about the effective capacity to act. In an agentive system, control can be silently colonized by speed: the human still signs the form, but the machine has already determined what is on it.
The veto humain devient une illusion quand la justification épistémique elle-même a été générée par la machine — à une vitesse excédant toute capacité de vérification. On ne peut pas opposer un veto à ce qu'on a délégué à l'oracle.
REG+ design / v5.7.0 tested scope

Local budget integrity. Distributed claims are separate.

The conceptual contract describes C1 linearizability, C2 liveness, C3 cross-host fault tolerance and invariant I8. The 5.7.0 bounded deployment path uses SQLite WAL local atomic accounting. Raft tests use local loopback: C3 is not proven for physical multi-host infrastructure.

I8 · aggregate budget
Σ(reserved) + Σ(committed) ≤ capacity

Local conservation in scoped transactions. Does not establish atomicity with the external provider.

SQLite WAL · single host

Atomic local reservation/budget transactions, subject to verified manifest and durable registry, not inter-host or cross-provider transactions.

Local I8 testedC3 not claimed
Raft · loopback tests only

81/81 tests independently reproduced as reported. FM-20 pickle is open, production multi-host rejected in 5.7.0. No physical C3 cross-host claim.

Loopback test PASSProduction disabled
Runtime · Operation Lifecycle

The Operation State Machine

Every operation passes through a defined lifecycle. Click any state to see its meaning. The critical transitions: RESERVED → DISPATCHING → CONFIRMED|FAILED, with uncertainty states (UNKNOWN, HOLD, ESCALATED) for when the provider cannot confirm the outcome.

CREATED
→
RESERVED
→
DISPATCHING
→
CONFIRMED
|
FAILED
UNCERTAINTY STATES
UNKNOWN
HOLD
ESCALATED
CREATED
The operation has been created but no budget has been reserved yet. The passage (τ) has been submitted to the membrane but Evaluate() has not yet been called.
Record integrity ≠ external effect

Evidence must have its own authority.

The EvidenceRecord concept separates inputs, policy/version identity, governance verdicts, local commit transitions, recovery and integrity. A decision log is not a provider-side receipt. A caller-held signing key does not prove independent custody.

Inputs & policy
Source, policy version, context, deployment manifest and payload binding — not a guarantee that external input values are true.
Local state
Governor state, reservation, HOLD and UNKNOWN outcome. UNKNOWN is not FAILED.
Commit record
Local SQLite transactions and accounting. Compensation is not automatic reversal of provider effects.
External proof
Requires independent custody, provider-specific evidence and verified trust. No universal v5.7.0 provider effect attestation.
Illustrative browser models · no live runtime

Three Interactive Use Cases

All three scenarios are JavaScript-only illustrations. They do not run the 5.7.0 SQLite WAL backend, connect to external providers, or execute real consensus. The resulting logs are synthetic.

Use Case 1 · Financial Mandate Enforcement
Browser budget simulator

Three AI agents propose trades against a shared $100M mandate. Each agent operates independently but all draw from the same ceiling. Watch how the aggregate budget invariant prevents over-commitment.

$100M
Capacity
$100M
Available
$0
Reserved
$0
Committed
I8: Σ(reserved) + Σ(committed) = $0M ≤ $100M ✓
--:--SYSMandate initialized: capacity=$100M, available=$100M
Use Case 2 · Cloud Infrastructure Budget Governance
Browser budget simulator

A DevOps team deploys 12 autonomous agents consuming from a shared $50K monthly cloud budget. Each agent must reserve before making API calls. The CFO needs to evaluate whether local budget accounting remains bounded; real provider spend is not verified by this simulation. This simulator includes reconciliation for uncertain operations (timeouts).

$50K
Capacity
$50K
Available
$0
Reserved
$0
Committed
I8: Σ(reserved) + Σ(committed) = $0K ≤ $50K ✓
--:--SYSCloud budget initialized: capacity=$50K, available=$50K
Use Case 3 · Multi-Agent Procurement Coordination
Synthetic Raft · browser only

Multiple departments issue purchase orders against a shared $2M quarterly procurement envelope. Three nodes drawn in the browser illustrate a failover idea; this is not physical cross-host evidence. Simulate a node crash to see the cluster maintain quorum.

$2M
Capacity
$2M
Available
$0
Reserved
$0
Committed
I8: Σ(reserved) + Σ(committed) = $0M ≤ $2M ✓
dc1 (leader)
dc2 (follower)
dc3 (follower)
Quorum: 2/3 ✓
--:--SYSRaft cluster initialized: 3 nodes, quorum=2, capacity=$2M
Source · standards · conformance

Know which repository demonstrates what.

The runnable implementation, proposed standards and test harnesses serve distinct roles. A successful test in one does not establish conformity of another deployed stack.

skiredj-prog/tenir_governance
Published runtime v5.7.0
Exact tag 47ef67e3; 1,286 full-suite PASS, including 81 Raft tests. Release deployment boundary: single-host.
skiredj-prog/reg-conformance
Proposed REG standard and vectors
Design contracts, structures and test vectors. Conformance is deployment-specific; a schema or test harness does not confer certification.
Independent testing
Reported external rerun
Harv Banning reports 81/81 local loopback Raft tests passed, 282.08 seconds, on macOS/Python 3.12.7. No physical cross-host environment.
Published v5.7.0 · evidence boundaries

What changed. What remains open.

The original 5.6 defect inventory was historical. This list reflects the published 5.7.0 release and subsequent documentary scoping.

FIXED
Late external effects after RELEASED no longer silently mutate RELEASED → COMMITTED. Compensation accounting does not reverse the external payment.
TESTED
Bounded single-host SQLite WAL budget, positive finite amounts, deterministic replicated inputs and payload binding are included in exact-tag tests.
BOUND
Production requires a verified deployment manifest, durable operation registry and guarded single-host startup. Installation is not readiness.
OPEN
FM-20 PySyncObj pickle command transport unresolved. Raft production and multi-host hard-disabled; no physical C3.
OPEN
Unknown provider outcomes remain unresolved until independent reconciliation. No exactly-once external effects or safe blind retry.
OPEN
Independent connector signing custody, provider truth and human authorization require their own evidence. Local hashes alone are insufficient.
UNPROVEN
No exact-tag 96% code coverage, generic latency SLA, regulatory certification, physical cross-host C3 or universal production guarantee.