Proposed standard · REG · frozen drafts
The standard
Runtime Execution Governance (REG) proposes requirements for the boundary where an action may become an effect, and the evidence that goes with it. The architecture that implements them remains separate.
Sources and reading context
RFC-0 through RFC-7 in reg-conformance; spec.md v0.3.1; KB3, posture and execution kept separate
Simplified public rendering, read on 19 October 2026. KB3: enacted, active doctrinal rendering line. It renders meaning; it is not the code, and not a constitution. KB2: prior rendering line. This site certifies no implementation. Read the detailed status →
On this page
In one sentence
REG is a proposed set of rules for deciding whether a consequential action may proceed and for recording that decision. It is not a certification, not a customer installation, and not proof that an external provider produced the expected effect.
What this page helps separate
- The proposal: the RFCs describe what a system should check.
- The software: TENIR-Gov is a published implementation with a precise scope.
- The evidence: tests and simulations show only what they actually covered.
- The external reality: a local authorisation does not by itself confirm an effect at the provider.
The mantra of RFC-0, dated 3 October 2026, status “Proposed Standard (Frozen Draft)”, is: “The agent proposes. The membrane decides. Authorised / Admissible.” The text’s declared origin is the convergence of TENIR-Gov, CCEAF, and CommitGate. The public repositories that were read do not document CCEAF or CommitGate beyond that line.
What REG is not. It is not KB3, not the prior rendering line, and not TENIR 2.0. KB3 is the enacted, active doctrinal rendering line, outside the code. REG is the execution standard. TENIR-Gov should align to KB3; it does not constitute it. A PASS disposition is not the NORMAL posture. An execution mode — shadow-passive, shadow-critical, enforce — is not a posture either: if it appears, it is a separate field. The symbol τ of the TAU bundle is not the τ of the proposed transition, nor the window τ_K.
RFC-0 lexicon
- Execution boundary. Where a consequential action may become an external effect.
- Consequential action. Whatever modifies external state, moves value, or produces an effect that is not trivially reversible. In doubt, it is consequential.
- Membrane. The surface that intercepts those actions before the boundary. The word is technical in the RFCs. It is not a synonym of the TENIR posture.
- Fail-closed. Under uncertainty, timeout, or failure, the action is blocked.
Three independent dimensions compose admissibility: standing (does the actor still have authority), structure (is the action compatible with the state), and commit (can the decision become exactly this effect without losing its integrity). The standard does not impose a sequential pipeline. If dispositions conflict, the most restrictive governs. HARD_VETO governs all.
| Disposition | Instruction |
|---|---|
| PASS | Allow, bounded by valid_until and by state drift. A PASS is not permanent. |
| FLAG | Allow only under an explicit condition or supervision. Never a bare allow. |
| HOLD | Suspend. Starts the τ_K window. |
| HARD_VETO | Refuse for this evaluation. Produces a signed refusal receipt. |
Lifecycle and τ_K
- Pre-execution: the request carries intent, target, expected effects, and a state snapshot.
- Conditional authorisation: verdict and grant envelope.
- Supervised execution: if a HARD_VETO occurs, execution halts or moves to a safe state.
- Closure: an evidence manifest anchors the cycle.
τ_K is the maximum window for human resolution of a HOLD. RFC-0 says it is derived from existing service-level agreements. It is not invented. On expiry, the pre-declared policy applies. The default is fail-closed. A degraded mode is admitted only if it was declared and preserves the invariant.
RFC-2 fixes S = K / (P × V + ε) as the reference model of structural admissibility, with other models permitted if they satisfy the epistemic, invariant, and conservatism constraints. Uncertainty contracts the admissible region. Absence of proof that an invariant holds is not proof that it holds. In that RFC, V is volatility and irreversibility, not the velocity named by the prior rendering line. KB3 does not collapse the two names.
The series
| RFC | Title | Status in the tree |
|---|---|---|
| RFC-0 | Constitution of the standard | v0.2, frozen, 3 October 2026 |
| RFC-1 | Grant envelope and protocol | v0.1, frozen |
| RFC-2 | Structural admissibility | v0.1, frozen |
| RFC-3 | Standing and authority continuity | v0.1, frozen |
| RFC-4 | Commit and execution proof | v0.2, frozen, 2 October 2026 |
| RFC-5 | Liveness and operationalisation | v0.1, frozen |
| RFC-6 | Security, transport, cryptography | v0.1, frozen |
| RFC-7 | Conformance suite | v0.1, frozen |
RFC-0 separates a normative obligation from implementation status. If the reference has not yet engineered an obligation, it is marked as an implementation gap. It does not rewrite the obligation. The file spec.md is titled “REG Conformance Spec — v0.3.1” (29 September 2026). The runner describes itself as “v0.3.2”. The latest commit message that was read says “v0.5.0”. Three labels coexist. This site does not merge them into one version.
The manuscript Governing the Unobserved, v7.1 of 12 October 2026, is a working paper. It studies the membrane after admission, when the effect may remain unobserved. It claims neither general safety under concurrency nor certification of a production gateway. Version DOI: 10.5281/zenodo.23314839. Concept DOI: 10.5281/zenodo.23270928.