Doctrine v1.2

Evidence before action.

Mullusi defines a governed foundation for high-risk symbolic work before execution is claimed. Every public claim must carry a declared evidence state, proof boundary, release lineage, and rollback path.

See Proof Boundaries View Foundation Route Contact
Evidence State

PublishableWithBoundary

Architecture

Verified

The doctrine matches the Mullusi public architecture, platform map, and governance philosophy.

Runtime

AwaitingEvidence

Runtime conformance stays pending until signed witness endpoints close.

Release

Reversible

Every public release requires snapshot reference, superseded lineage, and rollback policy.

Invariants

Mullusi Doctrine v1.2

Claim and proof
  1. No claim without declared evidence state.
  2. No proof without boundary.
  3. No verdict without trace.
  4. No user-visible simplification that cannot be reversed to its full trace.
Action and consequence
  1. No action without governance.
  2. No material consequence without re-governance when context, authority, risk, or dependency state changes.
  3. No speed, deadline, demo, sales pressure, or investor pressure may mutate evidence state.
Boundary and release
  1. No boundary transition without governance, witness, and lineage.
  2. No protected internal surface may be made public without governed promotion.
  3. No release without reversible judgment, snapshot reference, and superseded-by lineage.
Governance surface
  1. No complexity exposed unless it increases user value.
  2. The governance layer is itself a hardened, threat-modeled surface.
  3. This doctrine is itself versioned, evidence-bound, and reversible.
Proof Boundaries Appendix

What the public site proves

Verified

Public surface

mullusi.com is the company and product routing surface.

Verified

Doctrine posture

Doctrine v1.2 is evidence-bound and reversible.

AwaitingEvidence

Runtime conformance

/health, /gateway/witness, and /runtime/conformance must publish signed witness evidence.

Private

Protected internals

Private source, operator routes, and recovery records remain outside the public surface.

Release Surface

Publication contract

release_surface := {
  surface_id,
  version,
  owner,
  claim,
  evidence_state,
  proof_boundary_ref,
  authority_ref,
  promotion_source,
  snapshot_ref,
  witness_ref,
  threat_model_ref,
  consequence_scope,
  re_governance_triggers,
  supersedes,
  superseded_by,
  rollback_policy,
  public_notice_required,
  created_at
}
publish(surface):
  require evidence_state
  require proof_boundary_ref
  require authority_ref
  require snapshot_ref

  if evidence_state == "VerifiedRuntime":
    require signed witness_ref

  if surface is public:
    require threat_model_ref
    require rollback_policy
    require public_notice_required decision

  if surface supersedes another public claim:
    require supersedes
    require superseded_by update on old surface
    require public notice when claim meaning changes

  return PublishableWithBoundary or GovernanceBlocked(reason)
Material Consequence

Re-governance triggers

Trigger Why it matters Required posture
Context change Prior verdict may no longer bind the active situation. Re-check before material consequence.
Authority change Actor, permission, or policy authority may have shifted. Block until authority is re-established.
Risk class change Low-risk proposal can become high-consequence during execution. Escalate evidence state and proof boundary.
Dependency change External service, data source, or route may drift. Re-evaluate against current dependency state.
Timeout Evidence can expire before execution finishes. Require fresh snapshot and witness reference.
Threat Model

Minimum public-surface threats

Threat

Evidence state inflation

Threat

Protected surface promotion

Threat

Stale claim reuse

Threat

Missing superseded_by lineage

Threat

Unsigned witness substitution

Threat

Deadline pressure override

Threat

Rollback erasure

Response

Fail closed when evidence, authority, or lineage is missing.

Rollback

Lineage-preserving rollback

rollback(surface_id):
  old_surface.superseded_by := new_surface.surface_id
  preserve old claim
  mark old evidence_state as superseded / deprecated / rejected
  publish notice if public claim changed
  notify dependent consumers if they relied on the old claim
Status

Resolution trace

STATUS:
  Completeness: 96%
  Self-attested invariants: evidence boundary, material consequence trigger, public/private boundary, reversible release, rollback lineage, threat model minimum
  Open issues: runtime witness endpoints remain AwaitingEvidence
  Next action: close signed runtime witness endpoints before any VerifiedRuntime claim