Governance

Bundle lifecycle

Draft -> analyzed -> reviewed -> approved -> timelocked -> active. Every transition is a signed, journaled event; activation is epoch-gated and scoped.

A policy change is itself an operation: it flows through admission, appears in the same audit chain, and is approved through the same challenge mechanism as a large transfer. The engine loads compiled packages whose bundles carry a valid authority quorum and a matching governance activation event.

Bundles activate at epoch boundaries with explicit scope (tenant, key set, or cluster) and an optional activation window. Every key records a minimum policy version; activating a newer bundle raises it, which makes downgrade to a previously approved but weaker bundle a governance decision rather than an operational rollback.

Lifecycle states

  • Draft. Compiles and type-checks; simulation available; signatures still open.
  • Analyzed. Analyzer report attached (dead rules, coverage, semantic diff against the active bundle). Hard failures block progression.
  • Reviewed. Named reviewers signed over the package root and the analyzer report root; review signatures bind exact bytes.
  • Approved. Authority quorum reached for the change class (see Change classification).
  • Timelocked. Loosening changes wait out the configured delay; veto by an authorized risk officer returns the bundle to draft.
  • Active. Enforced from its epoch. Exactly one bundle is active per scope.
  • Retired. Superseded or expired; retained for replay forever.

Journal events

The reducer consumes typed events and emits the active bundle map per scope. Event roots are WORM-anchored with the same evidence model used by admission decisions.

Governance events
rust
PolicySchemaActivated {
    schema_root,
    version,
    epoch,
}

PolicyBundleProposed {
    package_root,
    analyzer_report_root,
    diff_class: Tightens | Loosens | Mixed | Equivalent,
    scope,
    proposed_at,
}

PolicyBundleReviewed {
    package_root,
    analyzer_report_root,
    reviewer_signatures,
    simulation_receipt_root,
}

PolicyBundleActivated {
    package_root,
    analyzer_report_root,
    diff_class,
    scope,
    epoch,
    timelock_elapsed,
    min_policy_version,
}

Activation binding

The activation event binds the bundle root, the package root, the analyzer report root, the diff classification, the epoch, and the scope. Admission verifies the binding on every load, so activation consumes the exact package and report that were approved.

Reducer checks

  • The package root equals the signed PolicyBundle.rules_root envelope field.
  • The analyzer report root is present in the package and in the review signatures.
  • The diff class in the event equals the class in the analyzer report.
  • The activation epoch is inside the declared activation window for the scope.
  • The key's min_policy_version moves forward with the activated bundle.