Proposal: Mutation-Bound Enforcement Continuity as a Companion Conformance Layer

[QueBallSharken]

The distinction that emerged in the multi-attestation thread is worth naming explicitly in its own artifact.

A system can be strong at attestation correctness and still be partial at mutation-bound enforcement continuity.

That separation matters because current receipt / attestation work is getting much better at proving things like:

• who signed
• what was evaluated
• what condition set was used
• what another verifier can recompute offline
• when a verdict existed

But that is still not the same as proving that the same governing admissibility condition remained mechanically binding all the way to the true mutation authority.

Proposed separation

1. Attestation correctness

Did the issuer correctly evaluate, serialize, sign, and expose a verifiable verdict?

2. Enforcement continuity

Did the consumer preserve the same governing constraint from signed verdict to irreversible effect?

A system can be strong on (1) and partial on (2) at the same time.

Why this needs its own artifact

Without an explicit companion layer, there is a risk of collapsing:

• proof that a correct decision was made
  into
• proof that only that decision could reach the final actuator

Those are not the same claim.

Proposed proof obligations

I think a minimal continuity profile should require evidence for at least:

• object continuity — the thing mutated is the same thing that was attested
• constraint continuity — scope / target / amount / delegation bounds did not widen in transit
• temporal continuity — the verdict was still fresh at mutation time
• authority continuity — revocation or policy drift did not invalidate the path before execution
• executor continuity — the actual mutation-capable component enforced the same bound condition, not just an upstream gate

Proposed evidence split

This also suggests a cleaner evidence model:

• attestation evidence — signed verdict, condition hash, block / time, policy snapshot
• transport evidence — what moved between components, whether it was transformed, widened, retried, or remapped
• mutation evidence — what exact payload reached the irreversible primitive, and whether mismatches failed closed

Candidate minimal fixtures

A small fixture pack or conformance profile could test cases like:

1. stale verdict at mutation time
   valid at check time, invalid at execution time

2. parameter widening in transit
   approved target / scope / amount differs from executed one

3. async retry after drift
   queued action replays after policy or delegation changed

4. proxy / executor mismatch
   receipt-valid upstream decision, but downstream mutation component is not enforcing the same bound condition

5. object substitution
   attestation covers object A, irreversible mutation hits object B through remap / alias

Possible outputs

Rather than a single merged verdict, this layer could support classifications like:

• receipt-strong / mutation-unknown
• receipt-strong / mutation-partial
• receipt-strong / mutation-strong

Question

What is the minimal useful shape of this companion layer?

• a spec-adjacent conformance profile
• a fixture pack / test suite
• governance descriptors with executable mappings
• some combination of the above

My view is that keeping this layer explicit would sharpen interoperability without overloading attestation specs themselves.