Status Summary
The protected recovery source ledger records each accepted workflow path and required check, but validation reinterprets every historical entry through the current qualification/policy.json. A legitimate later rename of a component qualification workflow or required check therefore invalidates previously accepted evidence before the reconciler can admit a qualified successor, leaving control-plane source qualification and scheduled authority reconciliation blocked.
How to fix
Bind every accepted source identity to the immutable qualification contract that applied when it was accepted, such as an exact policy revision or digest. Validate historical run and check evidence against that retained contract, and apply the current protected policy only when admitting a new successor. Preserve exact repository, protected branch, source commit, workflow bytes, run, check, and ancestry validation.
Acceptance Criteria
- A regression starts with an identity accepted under policy A, changes the protected qualification workflow or check through policy B, and admits a policy-B-qualified successor without reinterpreting the policy-A evidence.
- Missing, altered, ambiguous, or unresolvable historical policy bindings fail closed.
- A new successor that satisfies only an obsolete policy is rejected.
- Unchanged-policy reconciliation and current Waterline source history remain valid.
Delete when
Delete when historical identities are verified against their exact retained qualification contracts and a current policy change cannot strand otherwise valid recovery authority reconciliation.
Status Summary
The protected recovery source ledger records each accepted workflow path and required check, but validation reinterprets every historical entry through the current
qualification/policy.json. A legitimate later rename of a component qualification workflow or required check therefore invalidates previously accepted evidence before the reconciler can admit a qualified successor, leaving control-plane source qualification and scheduled authority reconciliation blocked.How to fix
Bind every accepted source identity to the immutable qualification contract that applied when it was accepted, such as an exact policy revision or digest. Validate historical run and check evidence against that retained contract, and apply the current protected policy only when admitting a new successor. Preserve exact repository, protected branch, source commit, workflow bytes, run, check, and ancestry validation.
Acceptance Criteria
Delete when
Delete when historical identities are verified against their exact retained qualification contracts and a current policy change cannot strand otherwise valid recovery authority reconciliation.