01must proveProposed | Handlers may be Lambda functions, declarative rules or built-ins; HTTPS targets are unavailable, target properties are kind-specific and secret-free, and Lambda defaults its qualifier to live. | validation | api, service | test |
02must proveProposed | Code-handler management requires extension-handlers manage, while rule authors may use extension-rules manage alone. | permission | api | test |
03must proveProposed | Handler secrets remain write-only in secret storage, handler deletion schedules their removal and a bound handler cannot be deleted. | invariant | service | test |
04must proveProposed | Handlers use registered points, unique workspace names and timeouts within every implemented point’s ceiling, with a rule supplied only for rule handlers. | validation | service | test |
05must proveProposed | Saving a rule checks every implemented point’s current contract, binding checks the selected version and invalid rules identify each problem without writes. | validation | service | test |
06must proveProposed | Bindings require a live registered point, a permitted and correctly identified scope, an implementing handler, an allowed failure policy with a note for overrides, a usable newly selected contract version and a forward effective window. | validation | api, service | test |
07must proveProposed | Binding lifecycle permits draft activation, shadow or disable, enabled-shadow interchange, disabled return to draft or use and disable from any state; registration alone orphans bindings, which can only be disabled, and edits require the version read. | lifecycle | service | test |
08must proveProposed | A single-answer point permits at most one enabled or shadow binding at a given scope. | invariant | service, database | test |
09must proveProposed | Resolution chooses the enabled binding at the most specific applicable scope then lowest priority, reports ties as configuration errors, ignores expired windows and reports shadow separately; no winner uses the point default. | calculation | service | test |
10must proveProposed | Handler testing validates input against its contract and executes rule handlers with test invocation history, while code-handler tests report unavailable transport and record no execution. | policy | service | test |
11must proveProposed | Record facts are true or false when available, unknown for missing values or refused queries and false for absent records, evaluated as system for the same person within the workspace with request-local caching. | calculation | service | test |
12must proveProposed | Invocation readers see newest-first workspace runs filtered by point, handler, outcome, purpose and time, with captured references exposed only while capture is enabled. | permission | api, service | test |
13Proposed | Handler and binding changes enter security history by changed field name without target or secret values. | invariant | service | test |