Bind authority dependencies to SourceOS state-integrity reports

[mdheller]

Purpose

Bind authority dependencies from the hybrid cybernetic control plane to SourceOS state-integrity and local repair posture.

Related work:

• SocioProphet/ProCybernetica#49 — hybrid cybernetic control-plane reconciliation
• SocioProphet/sociosphere#326 — authority-dependency graph
• SocioProphet/superconscious#10 — trust-surface authority-dependency bindings
• SocioProphet/policy-fabric#75 — cancellation binding contract
• SocioProphet/agentplane#157 — authority-dependency evidence contract

Background

sourceos-syncd already defines local control-plane event doctrine and the SourceOS State Integrity Report. Those contracts explain actor, authority domain, declared capability, policy decision, causal parent, privacy/retention class, invariants, diagnosis, controls, and attestation.

The missing binding is how a local SourceOS component reports whether authority dependencies are healthy, degraded, unsafe, quarantined, cancelled, or repairable.

Scope

Add a narrow binding spec and fixture, likely:

docs/specs/authority-dependency-state-integrity-binding.md
examples/authority-dependency-state-integrity-report.example.json

The binding should describe how state-integrity reports expose:

• local authority dependency refs;
• trust-surface refs;
• policy decision refs;
• affected local stores, lanes, services, or endpoints;
• diagnosis status;
• safe actions;
• blocked actions;
• cancellation or quarantine status;
• repair plan refs;
• attestation refs;
• prove-clean posture where applicable.

Acceptance criteria

• Add a binding spec that maps authority dependencies into SourceOS state-integrity reports.
• Add one example report showing a healthy dependency.
• Add one example or section showing degraded/quarantined/cancelled posture.
• Preserve SourceOS boundary: local state integrity and repair posture, not policy ownership or topology ownership.
• Cross-reference the SocioSphere authority-dependency graph and AgentPlane evidence contract.

Non-goals

• Do not make sourceos-syncd the global topology registry.
• Do not make sourceos-syncd the policy engine.
• Do not implement destructive repair in this issue.
• Do not expose raw device identifiers, credentials, or private telemetry.

Handoff note

This should stay documentation/fixture scoped until the SocioSphere and Policy Fabric authority-dependency contracts stabilize.

[mdheller]

Status (2026-07-18): Authority-dependency state-integrity binding not yet implemented. The upstream work in ProCybernetica #49, SocioSphere #326, Superconscious #10, Policy Fabric #75, and AgentPlane #157 defines the dependency contracts, but the sourceos-syncd binding spec (docs/specs/authority-dependency-state-integrity-binding.md) and fixture examples have not been added. Keeping open pending authority-dependency contract stabilization in SocioSphere and Policy Fabric.

[mdheller]

Implemented in src/sourceos_syncd/authority.py (PR #51). AuthorityReport covers 6 authority kinds: identity, policy, capability, memory, evidence, source-channel. check_authority() probes a single kind. Identity and policy authorities are flagged required=True. CLI: sourceos-syncd authority report [--device-ref] and authority check <kind>. Service endpoint: /authorityz.