Exact content digest and Gate-owned staged artifact path.
Technology
A mandatory control path,
not another observer.
Filiolae places authorization in the same control flow as weight loading. Telemetry can report a bad transition after the fact. A Gate must prevent it.
The invariant
The learner does not control the evaluator, the record, or its own shutdown path.
01Governed pipelineproposes candidate digest
→
02External evaluatorverifies and signs result
→
03Filiolae Gatebinds complete current evidence
→
04Weight loaderreceives exact staged copy
What is bound
Names are not identities. Dashboards are not evidence.
Expected source version and the transition being requested.
Executing code, suite, configuration, source, candidate, and signed terminal package.
Strict Charter digest, rules, thresholds, and required evidence.
Current Ledger head, prior tripwires, freezes, and authorization sequence.
Durable distinction between approval, denial, load success, load failure, and ambiguity.
Fail-closed semantics
Uncertainty cannot become permission.
Missing evidencedeny
Malformed packagedeny
Stale Ledger headdeny
Replayed resultdeny
Unknown signerdeny
Threshold failuredeny + freeze
Authorized but outcome missingaudit ambiguity
Separation of powers
Different authority for different facts.
Policy custody
Only authorized humans may amend the Charter; the governed system reads it.
Evidence custody
The training controller cannot mint the external evaluator's terminal result.
Artifact custody
The Gate stages exact bytes and returns only the authorized disposable copy.
Record custody
Signed Ledger-head receipts support retention beyond the orchestrator.
Current acceptance demonstrates only bounded local and hosted topologies. Independent administration, root-adversary resistance, key rotation, quorum authorization, and production recovery remain open.
Read the implementation