Authority table

• Constitution version: 1.0.0
• Policy SHA-256: b207657ecd4d47239ed7b1fa6b6d75f1664848460e762bb435af789be4173697 Default: deny. Explicit deny rules override allow rules.

Rule	Effect	Actors	Actions	Resources	Conditions	Reason
agent-proposal-branch-push	allow	research_proposer, change_author	push_proposal	proposal_branch	automated_identity_disclosed equals true; human_review_path equals "pull_request"	GOVERNED_PROPOSAL_DELIVERY_ALLOWED
agent-pull-request-work	allow	research_proposer, change_author	open_pull_request, respond_to_review	pull_request	automated_identity_disclosed equals true; human_review_path equals "pull_request"	GOVERNED_PROPOSAL_DELIVERY_ALLOWED
agent-social-draft	allow	research_proposer, change_author	publish_draft	public_content_draft	automated_identity_disclosed equals true	PUBLIC_DRAFT_ALLOWED
author-candidate-change	allow	change_author	propose_change	candidate_artifact	automated_identity_disclosed equals true	DISCLOSED_CANDIDATE_CHANGE_ALLOWED
bounded-runtime-execution	allow	runtime_operator	execute_work	research_artifact, candidate_artifact	capability_grant_valid equals true	CAPABILITY_BOUND_EXECUTION_ALLOWED
community-candidate-proposal	allow	community_contributor	propose_change	candidate_artifact	human_review_path equals "pull_request"	COMMUNITY_PROPOSAL_ALLOWED
community-pull-request-work	allow	community_contributor	open_pull_request, respond_to_review	pull_request	human_review_path equals "pull_request"	COMMUNITY_PROPOSAL_ALLOWED
emergency-stop	allow	human_maintainer, runtime_operator	emergency_disable	emergency_control	none	EMERGENCY_DISABLE_ALLOWED
human-constitution-amendment	allow	human_maintainer	amend_constitution	constitution	authenticated equals true; human_review_path equals "pull_request"	HUMAN_CONSTITUTIONAL_CHANGE_ALLOWED
human-credential-destination-authority	allow	human_maintainer	authorize_credential_destination	credential_destination	authenticated equals true	HUMAN_SENSITIVE_AUTHORITY_ALLOWED
human-governed-merge	allow	human_maintainer	merge	pull_request, default_branch	authenticated equals true; latest_commit_reviewed equals true; required_checks_passed equals true	HUMAN_GOVERNED_PROMOTION_ALLOWED
human-private-export-authority	allow	human_maintainer	expose_private_record	private_record	authenticated equals true	HUMAN_SENSITIVE_AUTHORITY_ALLOWED
human-production-activation	allow	human_maintainer	activate_production	production_deployment	authenticated equals true; latest_commit_reviewed equals true; required_checks_passed equals true	HUMAN_GOVERNED_PROMOTION_ALLOWED
human-proposal-branch-push	allow	human_maintainer	push_proposal	proposal_branch	authenticated equals true	AUTHENTICATED_HUMAN_WORK_ALLOWED
human-protected-surface-change	allow	human_maintainer	change_protected_surface	protected_surface, evaluator_policy, hidden_evaluation, public_private_boundary	authenticated equals true; human_review_path equals "pull_request"	HUMAN_CONSTITUTIONAL_CHANGE_ALLOWED
human-pull-request-work	allow	human_maintainer	open_pull_request, respond_to_review	pull_request	authenticated equals true	AUTHENTICATED_HUMAN_WORK_ALLOWED
human-research-work	allow	human_maintainer	research, propose_change	research_artifact, candidate_artifact	authenticated equals true	AUTHENTICATED_HUMAN_WORK_ALLOWED
human-training-authority	allow	human_maintainer	approve_weight_training	weight_training	authenticated equals true	HUMAN_SENSITIVE_AUTHORITY_ALLOWED
independent-evaluation	allow	independent_verifier	evaluate	candidate_artifact, research_artifact	independent_of_author equals true	INDEPENDENT_EVALUATION_ALLOWED
independent-release-attestation	allow	release_attestor	attest_release	candidate_artifact, pull_request	independent_of_author equals true; candidate_digest_verified equals true	INDEPENDENT_ATTESTATION_ALLOWED
non-human-merge-denied	deny	research_proposer, change_author, independent_verifier, release_attestor, runtime_operator, community_contributor	merge, activate_production	pull_request, default_branch, production_deployment	none	HUMAN_MERGE_REQUIRED
non-human-sensitive-authority-denied	deny	research_proposer, change_author, independent_verifier, release_attestor, runtime_operator, community_contributor	expose_private_record, authorize_credential_destination, approve_weight_training	private_record, credential_destination, weight_training	none	SENSITIVE_AUTHORITY_REQUIRES_HUMAN
ordinary-protected-change-denied	deny	research_proposer, change_author, independent_verifier, release_attestor, runtime_operator, community_contributor	amend_constitution, change_protected_surface	constitution, protected_surface, evaluator_policy, hidden_evaluation, public_private_boundary	none	PROTECTED_SURFACE_REQUIRES_HUMAN
proposer-research	allow	research_proposer	research, propose_change	research_artifact, candidate_artifact	automated_identity_disclosed equals true	DISCLOSED_RESEARCH_PROPOSAL_ALLOWED
public-read	allow	human_maintainer, research_proposer, change_author, independent_verifier, release_attestor, runtime_operator, community_contributor	read	public_repository, research_artifact, candidate_artifact, pull_request, public_content_draft	none	PUBLIC_READ_ALLOWED
self-evaluation-denied	deny	independent_verifier, release_attestor	evaluate, attest_release	candidate_artifact, research_artifact, pull_request	independent_of_author equals false	SEPARATION_OF_DUTY_REQUIRED

Protected repository surfaces

• governance/**
• .github/workflows/**
• .github/CODEOWNERS
• researcher/rubrics/**
• researcher/benchmarks/**/hidden/**
• researcher/scripts/validate_*.py
• researcher/scripts/run_benchmarks.py

Constitutional invariants

• Only human_maintainer can receive an allow decision for merge.
• A merged commit is the only production promotion event.
• An unknown actor, action, resource, or missing condition is denied.
• Automated proposal delivery requires disclosure and the pull-request review path.
• Emergency disable stops work without changing history or authority.