SRA Modeled-vs-Real Manifest

Warrant signing and gate verification. The page creates a temporary Web Crypto key pair, puts the warrant's outward content into canonical form, signs it, and checks the signature against the known public key at gate check 4. The private key cannot be exported from the page. The prefix shown, ed25519: or ecdsa-p256:, names the algorithm actually used.

JSON canonicalization. A faithful subset of RFC 8785 (JCS) sorts object keys, keeps array order, rejects values that are not JSON and invalid Unicode sequences, and writes numbers the way ECMAScript does, before anything is signed or checked.

Random identifiers. Warrant, determination, gate-decision, contest, capability, public-statement, restricted-note, translation, issuer, profile, evidence and resource identifiers come from crypto.getRandomValues. Public and hidden records never share a numbering sequence.

Key custody. UI label: “The keys are created in this page and disappear when you leave. They show how signing and checking work. A real deployment needs keys held under community control in dedicated key hardware (a hardware security module or key-management service).”

Governance legitimacy. UI label: “A signature shows who signed these bytes. It does not show that the governing process was legitimate or that the claims are true.”

Principal authentication. Gate trace: “Modeled authenticated principal; no identity provider contacted.” Being authenticated is not the same as having standing.

HSM/KMS custody, key rotation and procedures for a stolen key. A public static page cannot provide hardware custody under community control, lasting issuer operations or incident response.

Authentication of governing authorities. The browser has no authoritative identity provider and no trust root for community governance. Signing a fixture cannot establish standing.

OIDC, institutional identity federation and decisions about standing. Authentication can identify who is asking; it cannot by itself confer authority to issue warrants.

DVA issuance without a computed verdict. The worksheet lists considerations with no numbers or weights. Each proposed operation stays pending (code: PENDING_GOVERNANCE) until a governing process enters its determination, and nothing adds the operations up. The browser checks the proposal's scope, the configured profile and signing authority, the issuing attestation, safe evidence rows, the disclosure posture, the path for supersession and any dependencies between operations. The guided cases derive only a permitted outward warrant from a signed, authored determination. The software never chooses a viability outcome, and interpretive comparisons are labeled as the author's analysis.

Contests scoped to one operation. A signed contest holds opaque identifiers, its scope, an interim rule, a process reference, a path to resolution, activation and review times, and a sequence number. The other gate checks still run. An irreversible disputed disclosure is held, while uncontested storage may continue. A signed contest from another governing authority listed in the configuration applies too. The model applies contests only from listed authorities; who belongs on that list is a governance question, and a potentially governing Nation missing from it is not thereby an outsider. An unsigned assertion does not activate a contest and cannot freeze a resource. When the contest's review time passes, it must be confirmed again; time never becomes consent. Resolution needs a different, newly signed warrant within the configured process scope. Closing a dispute by withdrawal is distinct from permission to resume, and a contest set to start later is not treated as already in force.

Governance entry. UI label: “An invented governing process, authorized under this example's rules, has made each determination above.”

Recognized process. The fixture treats the invented governance profile, and any authority listed as recognized, as the boundary of recognized process. An unsigned assertion does not activate a contest and cannot freeze a resource.

A real DVA convening process. The browser cannot decide who has standing, whose witnessing is required, how dissent is carried, or what must remain unnamed under community law.

Governance adjudication. The model protects the interval, but it cannot decide which witnessing is faithful, resolve a disagreement, or make a captured process legitimate. It cannot decide whether a claim from a Nation missing from the configured list needs adjudication; that belongs to the recognized process.

Separate kinds of records. DVA determinations, gate decisions, contests, public refusal statements and restricted notes live in separate in-memory structures. A gate denial and a non-digitizable determination write no refusal statement.

NDE non-recording at the shared boundary. The NDE lesson creates no shared handle, counter, object, registry entry or placeholder for the matter. An internal note, if the community chooses one, stays in a separate invented store the community holds; the “View from” panels are not access controls. Both outside queries go through the same lookup and return identical status, body, headers and byte length.

Deliberate refusal authorship. Public and restricted records each need an explicit type, text written by the governing process, profile scope, an attestation, a real signature, a random identifier and an idempotency key. No text is generated from gate results, and a missing or invalid disclosure posture creates no record.

Store separation. UI label: “This separate structure in browser memory shows only that the records are kept apart. It is not access control or secure storage.”

NDE response shape only. UI label: “Matching responses are not the whole job. In a real deployment, timing, caching, rate limits, logs and backups must also be tested by someone trying to tell the two apart; code alone cannot show this. This model shows the response shape only.”

Restricted visibility. The model labels the restricted store as an in-memory demonstration of structure, not a boundary that controls who can see it.

Separate production databases, service accounts, keys and backups. In-memory maps show that record types and write paths are kept apart, not that systems are isolated or access is controlled.

Statistical testing of NDE timing. Meaningful evidence needs a production-like service with caches, load balancers, logs, backups, rate limits, generated traffic and adversarial measurement.

Secure restricted discovery and authorization. A public browser cannot provide partner authentication, authorization, compartmented queries or lasting retention controls.

Constraint-preserving receiver compatibility. Typed rules cover permissions, prohibitions, affirmative obligations, time limits, audience boundaries, derivative rules, and retention and deletion. Exact preservation is compatible (code: COMPATIBLE). An exact signed change bound to the configured originating process, warrant, policy version, hashes and validity period can be compatible through an authorized change (AUTHORIZED_TRANSLATION). A receiver that loosens or tightens the conditions on its own is not compatible (INCOMPATIBLE), and unknown terms cannot be determined (INDETERMINATE), which never releases anything. A separate check applies the supported time, audience, permission, prohibition, derivative and retention rules to the request itself; matching declarations alone do not authorize it.

Receiver declaration. Each receiver profile is an invented declaration of the policy it accepts and the obligations it supports. A passing browser check does not show that an institution will obey once it holds the plaintext.

Receiver federation and attestation. The static model cannot establish institutional trust, inspect a remote configuration, compel legal compliance, or prevent screenshots, copying, exfiltration and bad-faith reuse. It also does not check that the governing process has currently assessed a receiver's storage, audit, deletion and return arrangements; a case can only state that it has.

Gate checks in a fixed order, failing closed. The gate runs twelve checks in order: principal (a stand-in); opaque handle and request form; supplied warrant state; real signature and trusted issuer; warrant state and time; contest for this operation; exact scope, policy and any bound file digest; receiver compatibility; community decision (a stand-in); obligations; the one-time grant; synthetic reveal. Unknown policy, malformed dates, stale revocation status, unsupported obligations, a file that does not match its approved digest, and indeterminate compatibility all stop the action.

Checks on affirmative obligations. Known obligation types are checked against what the receiver supports. Each duty names the remedy its undertaking gives for a missed due date. An obligation that has come due must carry an opaque evidence reference. One that is past due without evidence stops the action only when its remedy is a pause; when the remedy is notice, the action continues and the trace says the governing process must be told. Each unmet duty is listed once.

Grant life cycle and scope. The model issues a real signed, short-lived grant only after the earlier checks pass. Using it checks the signature, issue and expiry times, the exact resource, action, audience, workflow and purpose, any bound file digest, the binding to the governing warrant, policy and profile, the current authorization state and an in-memory record of single use. A grant never outlasts the authorization behind it. The explicit model clock and the display tell ready, used, expired and no longer valid apart from a past check. Using a grant a second time does nothing. Only a successful use reveals the placeholder content.

Community decision service. A required invented decision is bound to the action, resource, service, warrant, profile and validity period. Allowed, withheld and unavailable stay distinct, and withheld or unavailable decisions are reported as such. A supplied decision that is malformed, expired or bound to a different action or warrant is invalid evidence, and the check denies. A declared remainder alone does not trigger a call to the service; the authored determination says when one is required. No real service is contacted.

What evidence means. Opaque fixture references show the field and the due-date rule. They do not show that the evidence is true, sufficient or accepted by the community.

Transport boundary. UI label: “In a real system, a grant would be tied to the one party allowed to use it (for example with mTLS or DPoP), and using it would release the content in one step that cannot be interrupted. That needs a real service. This model shows the grant's life cycle and its scope checks.”

A real community decision service. Protected context, availability, authenticated requests, revocation and operations under community control need a service outside the static page.

Audit and evidence verification. The browser has no trusted evidence store, review process or lasting audit trail.

mTLS/DPoP, replay-resistant use across systems, and atomic key release. These need a sender, a receiver, a network protocol, lasting atomic state and protected key material.

Strict schemas in the browser and safer rendering. Unknown fields and codes fail closed in the decision model. Text you type is rendered as DOM text, never parsed as HTML. The SRA pages use a Content Security Policy that allows only external scripts and styles, with no unsafe-inline.

No stored form content. Drafts of proposals and records stay in memory. They are never written to URLs or localStorage, and they are cleared when you leave the page.

Accessibility in the browser. Native controls, labels and fieldsets, keyboard navigation, visible focus, short live status messages, reduced-motion handling, layout that reflows at narrow widths, a glossary and readable, printable case transcripts support access. These features do not establish how well people learn from the model or full conformance with assistive technology.

Status-banner preference. A session-only setting remembers whether the status banner is collapsed. It holds no form content or protected state.

Production security and full assistive-technology certification. A static review cannot replace independent penetration testing, testing across many browser and assistive-technology combinations, organizational accessibility testing, or ongoing regression monitoring.

Storage of real protected data. Explicitly prohibited. This model is not a repository, a record system or a secure processing environment.