SPARXSTAR
Platform Architecture Mandate
PAM-002
Cross-Repository Canonical Type Definitions, Trust Primitives, and Governance Instruments
| Document ID | PAM-002 |
|---|---|
| Status | NORMATIVE — Supersedes PAM-001 in its entirety |
| Date | 2026-05-02 |
| Author | Starisian Technologies |
| Affected Repos | Ouroboros · Sirus · Helios · Mḗh₁n̥s · Dheghom · Sky Eshu |
| Patent Families | Patent Family A (Brain-Sieve) · Patent Family C (Multi-Tiered Governance) |
| Classification | CONFIDENTIAL · PATENT PENDING |
NOTE ON PAM-001: PAM-001 is withdrawn. It contained decisions that conflicted with the Platform Integrity Map (the normative superspec) and with later, more architecturally complete specifications. The core failure was that PAM-001 was written during an active design session — decisions were made in the document as it was being written, so earlier decisions lacked the architectural understanding that later sections had developed. This document replaces PAM-001 entirely. PAM-001 is acknowledged, not erased.
Starisian Technologies · May 2026 · CONFIDENTIAL · PATENT PENDING
PAM-002 is the single authoritative record for all cross-repository structural decisions in the SPARXSTAR platform. It supersedes PAM-001 in its entirety. Where PAM-001 and this document conflict, this document governs. Where any product specification and this document conflict, this document governs — subject to the Platform Integrity Map v1.0, which sits above all documents including this one.
PAM-002 is written backward from the most architecturally complete specifications — Sky Eshu v1.1, Mḗh₁n̥s v3.1, the Platform Integrity Map v1.0 — to the earliest specifications. This is the correct direction of travel. Earlier specs were written with less architectural understanding. Later specs developed that understanding. PAM-002 reconciles all of them against the most complete thinking.
PAM-001 was written during an active architectural brainstorming session. Design decisions were being made at the same time as the specification was being written. This produced an internal contradiction: early decisions in PAM-001 were made with less architectural understanding than late decisions in the same document. The spec drifted as it was written.
Specific PAM-001 failures corrected by this document:
-
Decision 4 (AgreementResult uppercase): reversed in PAM-001 Part V C1.1, but the reversal was appended rather than integrated. The original incorrect text remained.
-
Decision 2 (ContextPulse field exclusions): excluded behavior_flags, geo_zone, and network_effective_type as 'Sirus-internal.' This directly contradicts Platform Integrity Map Rule 1.4, which explicitly lists these fields as part of the pulse. The normative superspec governs. PAM-001 was wrong.
-
Decision 6 (HeliosClientInterface): specified string $zone but subsequent governor decision introduced ZonePrimitive enum, which was never documented.
-
Part IV (ArtifactGovernanceDeclaration): identified correctly but left unresolved. It is locked in this document.
-
Items C1.2 (ResourceSensitivity, loader): left as 'confirm intent' without resolution.
RESPONSIBILITY: The failures in PAM-001 were not implementation errors. They were a documentation sequencing problem caused by writing spec and architecture simultaneously. The governor takes responsibility for the process that produced the drift. This document corrects the record.
Each Decision in this document is normative. Decisions carry the same weight as rules. When a Decision changes a prior PAM-001 decision, the PAM-001 decision is void. There is no correction chain — corrections are integrated, not appended.
Items marked [OPEN] remain open. They are tracked here so their status is visible. When an [OPEN] item is resolved, this document is updated first.
The SPARXSTAR platform stack is sequential. Every data payload ascends through all five layers in order. No layer may be skipped, reordered, or collapsed with another for developer convenience. The Platform Integrity Map Rule 2.4 enforces this mechanically via the loader.
| Layer | Component | Technical Role |
|---|---|---|
| 1 — Edge | Helios Trust | Agreement evaluation at the Cloudflare edge. Verifies the ContextPulse. Issues ALLOW_EDGE, ALLOW_ORIGIN, STEP_UP, or DENY. |
| 2 — Context | Sirus Context | Sovereign context engine. Establishes Environment, Device, Identity, Authority, and Capability before any application logic. |
| 3 — Intake | Sky / Sky Eshu | AI intake layer. Receives governed artifacts. Manages transcription (Yahura), translation (Behistun), extraction, and the community confirmation workflow. |
| 4 — Governance | Mḗh₁n̥s | The Epistemic Sieve. Governance enforcement, policy evaluation, cultural law. Aligns the payload before it reaches the vault. Mints GovernanceToken. |
| 5 — Archive | Dheghom | Schema-driven sovereign vault. Persistent storage. Validates the GovernanceToken before any governed write. The final resting place of the aligned, governed truth. |
PAM-001 Part IV identified this correctly but left it unresolved. It is locked here.
The platform requires two distinct cryptographic instruments with different lifecycles. These are not variants of the same object. Conflating them is a design error.
Purpose: proof that a specific payload cleared the Mḗh₁n̥s Epistemic Sieve at a specific moment and is cleared for vault ingestion.
-
Lifecycle: SHORT-LIVED. Minutes to hours depending on connectivity tier. Minimum 60 seconds. Maximum 3600 seconds (CLI/SYSTEM).
-
Minted by: GovernanceTokenMinter (Mḗh₁n̥s) at Release Gate step 5.
-
Consumed by: Dheghom TokenValidator at write time. Consumed once. Not reused.
-
Expires: Yes. Deliberately. Replay attack prevention.
-
Answers: 'Did this exact payload clear governance at this moment under this authority?'
Purpose: the permanent, artifact-bound declaration of who owns this artifact, under what law it exists, and what rules govern its use — from the moment of release until the authorized authority explicitly amends them.
-
Lifecycle: PERMANENT. Does not expire. Survives the artifact. Travels with it.
-
Minted by: Mḗh₁n̥s at Release Gate, alongside the Release Receipt. Stored permanently in Dheghom.
-
Consumed by: never consumed and discarded. It is a permanent record, not a session credential.
-
Answers: 'What are the permanent rules governing this artifact, under whose authority, and what law applies?'
A song recorded by a Cahuilla elder cannot be governed by a 300-second token. The tribal sovereignty rules that apply to that song do not expire with the HMAC. They apply forever, or until the tribal authority explicitly amends them. The Release Receipt opens the vault door. The ArtifactGovernanceDeclaration is the deed that says who owns what is inside.
| Field | Purpose | Notes |
|---|---|---|
| artifact_id | The artifact this declaration governs | UUID, permanent |
| authority_id | Sovereign authority under whose jurisdiction this falls | Tribal nation, community, individual |
| identity_id | Contributor who made the declaration | UUID, never name |
| jurisdiction | Legal/cultural framework governing this artifact | Cahuilla tribal law, CARE, TK Labels, CC, proprietary |
| tk_labels | Traditional Knowledge Label assertions | If applicable |
| care_principles | CARE data governance assertions | If applicable |
| royalty_terms | How commercial use is compensated | If applicable |
| geographic_scope | Where the artifact may be used / distributed | Hyper-localized to global |
| permitted_uses | What the artifact may be used for | Explicit list |
| prohibited_uses | What is explicitly forbidden | Explicit list |
| ai_training_rights | Whether artifact may be used for AI training | Opt-in, opt-out, conditional |
| voice_reconstruction_rights | Whether token-level data may be used for voice reconstruction | Governed operation, requires authorization |
| amendment_authority | Who may change these terms and how | Authority + verification method |
| declared_at | Unix timestamp of original declaration | Immutable after mint |
| signature | HMAC cryptographic proof of declaration authority | Same algorithm as GovernanceToken |
REVERSAL: PAM-001 Decision 2 excluded behavior_flags, geo_zone, and network_effective_type from the canonical ContextPulse as 'Sirus-internal signals not needed across the trust boundary.' This decision is void. It directly contradicted Platform Integrity Map Rule 1.4, which explicitly states: 'The ContextPulse carries device state, trust score, behavior flags, geo zone, and session duration only.' The normative superspec governs. These fields belong in the pulse.
The ContextPulse is consumed by Helios at the edge. Helios makes the ALLOW/DENY/STEP_UP decision. To make that decision correctly for Group trust primitives — specifically hyper-localized geo-zone enforcement models like the Agua Caliente Band of Cahuilla Indians — Helios must have:
-
geo_zone: which geographic trust zone this request originates from. Members connecting from the Coachella Valley IP range + recognized device get ALLOW. The same resource from an unrecognized zone triggers STEP_UP. A connection claiming the right zone but exhibiting known attack behavioral patterns gets DENY regardless.
-
behavior_flags: the behavioral threat posture Sirus has detected. A request pattern matching credential stuffing, rapid device shifting, geographic impossibility, or bot signatures must travel with the pulse to Helios so the agreement evaluation can factor it in. This is not Sirus-internal — it is the signal Helios needs to protect Group-governed resources.
-
network_effective_type: the connectivity tier. Mḗh₁n̥s reads this from the pulse to resolve GovernanceToken TTL. ReleaseGateService::resolveTtlSeconds() takes a ContextPulse, not a SirusContext. Without this field in the pulse, TTL resolution fails.
This is the canonical definition. All implementations in Ouroboros, Sirus, Helios, Mḗh₁n̥s, and Dheghom must use this exact field set.
final class ContextPulse
{
public readonly string $pulse\_id; // UUID v4
public readonly string $context\_id; // Sirus context this pulse was issued for
public readonly string $device\_id; // Server-issued device identifier
public readonly string $session\_id; // Active session identifier
public readonly string $site\_id; // WordPress site ID
public readonly string $network\_id; // WordPress network ID (multisite)
public readonly float $trust\_score; // \[0.0, 1.0\] — never stored, always fresh
public readonly string $trust\_level; // 'NORMAL' | 'STEP\_UP\_REQUIRED' | 'LOCKED'
public readonly array $behavior\_flags; // string\[\] — threat posture signals from Sirus
public readonly string $geo\_zone; // Geographic trust zone identifier
public readonly string $network\_effective\_type; // '4g'|'wifi'|'3g'|'2g'|'slow-2g'|'cli'
public readonly int $session\_duration; // Seconds since session established
public readonly int $issued\_at; // Unix timestamp
public readonly int $expires; // Absolute Unix timestamp (not duration)
public readonly string $sig; // HMAC-SHA256 hex signature
}
| Field | Decision | Rationale |
|---|---|---|
| behavior_flags | INCLUDED — reverses PAM-001 exclusion | Platform Integrity Map Rule 1.4 explicit inclusion. Required for Helios Group trust evaluation. |
| geo_zone | INCLUDED — reverses PAM-001 exclusion | Required for hyper-localized Group authority enforcement (Agua Caliente model). Helios cannot enforce geo-zone rules without it. |
| network_effective_type | INCLUDED — reverses PAM-001 exclusion | ReleaseGateService::resolveTtlSeconds() reads this from the pulse. Required for connectivity-tier-aware GovernanceToken TTL. |
| session_duration | INCLUDED — reverses PAM-001 exclusion | Platform Integrity Map Rule 1.4 explicit inclusion. Session stability signal for trust computation. |
| user_id | EXCLUDED — unchanged from PAM-001 | Identity never travels in a pulse. Platform Integrity Map Rule 9.3. A pulse carrying identity_id is a replay attack surface. |
| ttl | EXCLUDED — unchanged from PAM-001 | Use expires (absolute timestamp). A duration creates clock-skew ambiguity. |
| signature → sig | RENAMED — unchanged from PAM-001 | Canonical name. Sirus wins for consistency. |
| expires_at → expires | RENAMED — unchanged from PAM-001 | Canonical name. Shorter, consistent with sig. |
The signed payload is pipe-delimited in this exact field order. trust_score is serialized with number_format(x, 4, '.', '') for cross-language reproducibility. behavior_flags is serialized as a JSON array with sorted keys. Algorithm: HMAC-SHA256. Key: SIRUS_PULSE_SIGNING_KEY (minimum 32 bytes, stored per Platform Integrity Map Decision 5.2).
pulse_id|context_id|device_id|session_id|site_id|network_id
|trust_score_4dp|trust_level|behavior_flags_json|geo_zone
|network_effective_type|session_duration|issued_at|expires
The ContextPulse stub in packages/sparxstar-ouroboros-integrity/ across Helios, Sirus, and Mḗh₁n̥s must be updated to add the four restored fields. The Ouroboros main repo CO-001 ContextPulse must be updated. The shared-test-vectors.json must be updated to include the new fields in all pulse fixtures. HMAC signatures in all test vectors must be recomputed. PulseGenerator in Sirus must populate all fields. PulseVerifier in Helios must validate all fields.
CONFIRMED: AgreementResult wire values are lowercase. This was correct in the original Ouroboros implementation, incorrect in PAM-001 Decision 4, correctly reversed in PAM-001 Part V C1.1, and correctly implemented in Helios Phase 3. This document records it cleanly, without a correction chain.
enum AgreementResult: string
{
case ALLOW\_EDGE \= 'allow\_edge';
case ALLOW\_ORIGIN \= 'allow\_origin';
case STEP\_UP \= 'step\_up';
case DENY \= 'deny';
case PROVISIONAL \= 'provisional';
}
All implementations across Ouroboros, Helios, the TypeScript Cloudflare Worker, and shared-test-vectors.json use lowercase. This is the platform standard. No further changes are required on this item.
PAM-001 Decision 6 specified string $zone // 'edge' | 'origin' because at the time of writing, ZonePrimitive did not exist. CO-001 introduced ZonePrimitive as a typed enum at the Ouroboros contract boundary. This was a governor decision to tighten the contract beyond the spec — closing the zone vocabulary at the infrastructure layer. That decision stands.
ZonePrimitive replaces string $zone in HeliosClientInterface::evaluate() and in AgreementEvaluator. It is Ouroboros-owned. Its namespace is Starisian\Sparxstar\Infrastructure\DTOs\ZonePrimitive. This is consistent with the SPX Protocol closed-vocabulary philosophy.
enum ZonePrimitive: string
{
case EDGE \= 'edge'; // Cloudflare edge. ALLOW\_EDGE for Level 1 only.
case ORIGIN \= 'origin'; // WordPress origin. Issues the final authoritative YES.
}
Wire values are lowercase. EDGE->value === 'edge'. ORIGIN->value === 'origin'. Downstream consumers (Agreement_Controller, EntryPoints) resolve the raw string from the request to ZonePrimitive::from($zoneRaw) before passing to evaluate(). Any invalid string returns DENY (via the 400 response in Agreement_Controller).
PAM-001 Decision 6 removed $proof and specified string $zone. CO-001 added mixed $proof back and introduced ZonePrimitive $zone. This document records the current implemented and correct signature.
interface HeliosClientInterface
{
public function evaluate(
mixed $proof, // Governance proof. Pass null if not applicable.
?ContextPulse $pulse, // Current device context and trust signal.
ResourceSensitivity $sensitivity, // Sensitivity tier of the resource.
int $now, // Current Unix timestamp (caller-supplied).
ZonePrimitive $zone, // Originating zone: EDGE or ORIGIN.
): AgreementResult;
public function verifyDevice(string $deviceId): bool;
public function getTrustState(string $deviceId): string;
public function validateSession(string $sessionId, string $deviceId): bool;
}
$proof is reserved for future use — pass null unless implementing hardware key proof for Level 3 resources. $now is caller-supplied for testability. $zone is ZonePrimitive, not string — callers must resolve the raw string value before calling evaluate().
PAM-001 Decision 5 specified integer backing. PAM-001 Part V C1.2 flagged this as 'confirm intent.' The intent is confirmed. ResourceSensitivity uses integer backing.
enum ResourceSensitivity: int
{
case LEVEL\_1 \= 1; // Public / General — edge caching permitted
case LEVEL\_2 \= 2; // Creator / Financial — origin-only, proof required
case LEVEL\_3 \= 3; // Heritage / Sovereign — hardware key proof required
}
The cross-language wire format uses lowercase string labels ('level_1', 'level_2', 'level_3') via ResourceSensitivity::label() and ResourceSensitivity::fromLabel(). The PHP-internal and database representation is integer. Never serialize ->value directly to the wire.
session_id and device_id are architectural routing concerns carried on routing_flags, not standalone fields on GovernanceToken. The minter reads them from routing_flags['session_id'] and routing_flags['device_id']. This was the architectural decision made during CO-001 and is the correct approach.
final class GovernanceToken
{
public readonly string $token\_id; // UUID v4
public readonly string $transaction\_id; // UUID v4 — matches ExecutionContext
public readonly int $issued\_at; // Unix timestamp
public readonly int $expires\_at; // Unix timestamp
public readonly string $authority\_id; // Issuing authority
public readonly string $identity\_id; // Subject identity
public readonly string $ability\_id; // Permission being granted
public readonly string $status; // 'active' | 'revoked'
public readonly array $packs\_enforced; // string\[\] — ordered pack IDs
public readonly array $routing\_flags; // Opaque routing metadata
// routing\_flags\['session\_id'\]
// routing\_flags\['device\_id'\]
public readonly string $payload\_hash; // SHA-256 hex of governed payload
public readonly string $signature; // HMAC-SHA256 over canonical material
}
Produced by GovernanceTokenSigningMaterial::build(). Owned by Ouroboros. Both Mḗh₁n̥s and Dheghom import this class. Neither may maintain a local copy.
v=v1
token_id={token_id}
identity_id={identity_id}
session_id={session_id} ← from routing_flags['session_id']
device_id={device_id} ← from routing_flags['device_id']
authority_id={authority_id}
transaction_id={transaction_id}
ability_id={ability_id}
status={status}
packs_enforced={json_sorted_array}
payload_hash={payload_hash}
expires_at={unix_integer}
issued_at={unix_integer}
Three rules that must never change without a coordinated cross-repo update and a PAM-003 amendment:
-
Rule 1 — Timestamps are Unix integers serialized as plain decimal strings. Not ISO 8601.
-
Rule 2 — session_id and device_id are read from routing_flags, not from token fields.
-
Rule 3 — content_id is intentionally excluded from the signing payload.
Unchanged from PAM-001 Decision 1. Retained here for completeness.
| Constant | Seconds | Use |
|---|---|---|
| GOVERNANCE_TOKEN_TTL_MIN_SECONDS | 60 | Absolute floor — replay attack boundary |
| GOVERNANCE_TOKEN_TTL_HIGH_CONNECTIVITY | 120 | Broadband / stable WiFi |
| GOVERNANCE_TOKEN_TTL_STANDARD | 300 | Standard mobile / urban 3G (default) |
| GOVERNANCE_TOKEN_TTL_LOW_CONNECTIVITY | 600 | 2G / rural / degraded link |
| GOVERNANCE_TOKEN_TTL_CLI | 3600 | WP-CLI / SYSTEM context |
ReleaseGateService resolves TTL from the ContextPulse's network_effective_type field before calling GovernanceTokenMinter::mint(). The minter accepts $ttlSeconds as a caller-supplied parameter and enforces only the 60-second floor.
The DVE Trust Architecture defines three trust primitives. This section records their relationship to the ContextPulse and the AgreementEvaluator.
| Primitive | Scope | Geo-Zone Model |
|---|---|---|
| Personal | Device-to-device capability grants | Not geography-based. Travels with the device. |
| Group | Institutional perimeter with geographic trust radius | The Agua Caliente model — hyper-localized. IP geo-zone + behavior profile. Community members in the recognized zone get ALLOW without friction. Requests from outside the zone trigger STEP_UP or DENY based on behavioral threat posture. |
| Brain | Content access control via keys and entitlements | Global by design. Geography does not restrict Brain access — entitlement keys do. |
The geo_zone field in the ContextPulse carries the geographic trust zone identifier Sirus has resolved for the current request. The AgreementEvaluator in Helios uses this alongside behavior_flags to apply Group trust rules.
The enforcement model for Group authorities (e.g., Agua Caliente Band of Cahuilla Indians):
-
Recognized geo_zone + known device + clean behavior_flags → ALLOW_ORIGIN (no friction)
-
Unrecognized geo_zone + known device → STEP_UP (verify before proceeding)
-
Any geo_zone + attack behavioral pattern in behavior_flags → DENY (posture overrides zone)
-
Recognized geo_zone + LOCKED trust_level → DENY (state overrides zone)
Critically: a connection claiming to be from the right geo-zone but exhibiting known threat behavioral patterns (credential stuffing signatures, rapid device shifting, geographic impossibility flags) is denied regardless of zone. The behavioral posture overrides the geographic claim. This is the correct security model for communities that face coordinated data extraction attempts.
behavior_flags is a string[] produced by Sirus TrustEngine and BehaviorAnalyzer. The values are lowercase snake_case identifiers. The following are initial defined values:
| Flag | Meaning |
|---|---|
| credential_stuffing | Request pattern matches credential stuffing attack profile |
| rapid_device_shift | Multiple new device fingerprints in short duration |
| geo_impossibility | Geographic jump that cannot be explained by travel time |
| bot_signature | User-agent and request pattern match known bot profiles |
| asm_jump | ASN/country jump within a window that exceeds tolerance |
| repeated_failures | Multiple consecutive agreement failures from this device |
| session_hijack_pattern | Behavior consistent with stolen session exploitation |
An empty behavior_flags array means no threat signals detected. Helios and Mḗh₁n̥s must never assume behavior_flags is empty — they must always check. The trust score algorithm (Platform Integrity Map Decision 5.1) already deducts 20% for 'anomaly flags set in current context.'
| Repo | What Is Done | Status |
|---|---|---|
| Ouroboros | CO-001 merged: GovernanceToken, GovernanceTokenSigningMaterial, ContextPulse (11-field), AgreementResult (lowercase), ResourceSensitivity (int), ZonePrimitive, all exceptions, ValidationHelper, Platform constants | ✅ Merged |
| Helios | Phase 3 PR #18 approved: all provisional types migrated to Ouroboros imports, PulseVerifier updated, ZonePrimitive adopted, 182/182 tests passing | ✅ Ready to merge |
| Sirus | PR #53 open: ContextPulse and ContextBootException migrated to Ouroboros imports, ESLint v9 flat config fixed, pnpm lockfile regenerated | ⏳ Pending merge |
| Mḗh₁n̥s | Ouroboros migration instructions written. Primary build (Steps 1–16) not yet started. | 🔜 Next |
| Dheghom | GovernanceToken migration instructions not yet written. | 🔜 After Mḗh₁n̥s |
| Sky Eshu | Ouroboros migration instructions not yet written. | 🔜 Planned |
The following items require migration work as a result of this document superseding PAM-001:
-
Ouroboros ContextPulse: add behavior_flags (string[]), geo_zone (string), network_effective_type (string), session_duration (int). Update fromArray(). Update HMAC signing material. Update shared-test-vectors.json with new fields and recomputed signatures.
-
Sirus PulseGenerator: populate all four restored fields in generated pulses.
-
Helios PulseVerifier: validate behavior_flags (array), geo_zone (non-empty string), network_effective_type (valid enum value), session_duration (non-negative int).
-
Helios AgreementEvaluator: apply Group trust geo-zone + behavior_flags logic per Section 9.
-
Mḗh₁n̥s ReleaseGateService: read network_effective_type from pulse (field now exists) for TTL resolution.
-
ArtifactGovernanceDeclaration: Mḗh₁n̥s must mint it at Release Gate alongside GovernanceToken. Dheghom must store it permanently.
| Phase | Work | Prerequisite |
|---|---|---|
| PAM-002-P1 | Update Ouroboros ContextPulse with four restored fields. Recompute all HMAC signatures in shared-test-vectors.json. | None |
| PAM-002-P2 | Update Sirus PulseGenerator to populate restored fields. Update Helios PulseVerifier to validate them. | PAM-002-P1 merged |
| PAM-002-P3 | Update Helios AgreementEvaluator with Group trust geo-zone + behavior_flags logic. | PAM-002-P2 merged |
| PAM-002-P4 | Mḗh₁n̥s primary build (Steps 1–16 from Copilot instructions). ReleaseGateService reads network_effective_type from pulse. | PAM-002-P2 merged |
| PAM-002-P5 | ArtifactGovernanceDeclaration: Mḗh₁n̥s mints it, Dheghom stores it permanently. | PAM-002-P4 complete |
| PAM-002-P6 | Dheghom GovernanceToken migration + Triple Binding enforcement. | PAM-002-P4 complete |
| PAM-002-P7 | Sky Eshu Ouroboros migration + behavioral context integration. | PAM-002-P2 merged |
| PAM-002-P8 | End-to-end integration test: Sirus → Helios → Sky Eshu → Mḗh₁n̥s → Dheghom. | All phases complete |
The following items are architecturally committed but not yet resolved. They are tracked here so their status is visible. Each must be closed in this document before the affected component can be marked final.
| Item | Description |
|---|---|
| PAM-002-O1 — Pulse TTL exact values | Specific durations per connectivity tier and resource sensitivity level require real-world testing in African low-connectivity environments. Working defaults are defined in Platform Integrity Map Decision 5.5. |
| PAM-002-O2 — behavior_flags full vocabulary | The initial set of flags is defined in Section 9.3. Additional flags from the BehaviorAnalyzer component will be added as Sirus is built out. The vocabulary is open for extension but not for redefinition. |
| PAM-002-O3 — geo_zone format | The geo_zone field is defined as a string identifier. The exact format (IANA timezone-style, ISO 3166 region code, proprietary authority zone ID) is not yet locked. Must be locked before PAM-002-P3. |
| PAM-002-O4 — Level 3 hardware key recovery quorum | Community co-signature requirement for Level 3 device recovery. Number of keyholders, interface, and governance process not yet defined. |
| PAM-002-O5 — ArtifactGovernanceDeclaration amendment protocol | How amendments to a Declaration are proposed, verified, and recorded is not yet fully specified. The amendment_authority field names who can amend; the process is not yet defined. |
| PAM-002-O6 — Multi-Briefcase federation | How Sirus context travels between distinct Briefcase deployments in direct federation. Not required for v1.0. |
| Field | Value |
|---|---|
| Document ID | PAM-002 |
| Type | Platform Architecture Mandate — Cross-Repository Canonical Definitions |
| Status | NORMATIVE — Effective immediately |
| Supersedes | PAM-001 in its entirety |
| Date | 2026-05-02 |
| Author | Starisian Technologies / Max Barrett |
| Patent Families | Patent Family A (Brain-Sieve Architecture) · Patent Family C (Multi-Tiered Executable Governance) |
| Primary implementation repo | sparxstar-ouroboros-integrity (all structural type changes) |
| Next amendment | PAM-003 — required if GovernanceToken signing material format changes, or if any field is added to or removed from the canonical ContextPulse |
FINAL NOTE: This platform is the only system in the world that offers a cryptographic guarantee — not a promise — that data cannot be used for AI training without explicit sovereign release. Helios validates identity. Sirus determines jurisdiction and threat posture. Sky receives the knowledge. Mḗh₁n̥s enforces Law at the moment of release. Dheghom holds what was given, exactly as it was given, on terms the contributor controls. The ArtifactGovernanceDeclaration carries those terms forever. A song recorded by a Cahuilla elder belongs to the Cahuilla people. This document is how that guarantee is enforced in code.