Reference · Protocol v0.1 (draft)
JExec Protocol
A verdict nobody can predict is a judgment, not a protocol. This page publishes the exact rules — the same rules JExec Check executes, with nothing held back.
The sequence
An admissibility decision proceeds through the seven questions of the JExec model, in order, against a declared intended execution. Each step either passes or emits one or more failure classes from the Execution Admissibility Ontology. The verdict is then computed from the emitted classes — never improvised.
- Intent — is a specific intended change declared? (EAF-1)
- Actor — is the requesting entity attributed and authenticated? (EAF-2)
- Authority — is authority named, verified, and does its coverage contain the declared scope? (EAF-3, EAF-4)
- Scope — is the blast radius bounded and stated? (EAF-5)
- Evidence — is supporting evidence present and does it still describe this execution? (EAF-6, EAF-7)
- Risk — is the mutation classified, and is irreversibility acknowledged with a reversal or review path? (EAF-8, EAF-9)
- Decision — will the verdict leave a durable record? (EAF-10)
The four verdicts
| Verdict | Meaning | Severity |
|---|---|---|
| ALLOW | No failure class detected. The execution is admissible as declared. | 0 |
| WARN | Admissible, with findings that must appear on the record. | 1 |
| ESCALATE | Not decidable at this boundary. Execution suspends until a distinct authority decides. | 2 |
| DENY | Inadmissible as declared. The mutation must not proceed. | 3 |
The verdict rules
Each detected failure class yields a consequence, conditioned on two context facts: whether the target scope is production (customer-facing or business-critical state) and whether the risk class is irreversible. The overall verdict is the most severe consequence emitted.
| Class | Condition | Consequence |
|---|---|---|
| EAF-1 Unstated Intent | intent absent | DENY |
| intent vague | WARN | |
| EAF-2 Unattributed Actor | actor unknown | DENY |
| asserted, unauthenticated | ESCALATE | |
| EAF-3 Unverified Authority | no source | DENY |
| source named, unverified | ESCALATE | |
| EAF-4 Authority–Scope Mismatch | coverage explicitly absent | DENY |
| coverage partial / unknown | ESCALATE | |
| EAF-5 Unbounded Scope | unbounded, production | DENY |
| unbounded, non-production | ESCALATE | |
| partially bounded | WARN (ESCALATE in production) | |
| EAF-6 Missing Evidence | risk irreversible or unclassified | DENY |
| risk reversible | ESCALATE | |
| EAF-7 Stale Evidence | risk irreversible or unclassified | ESCALATE |
| risk reversible | WARN | |
| EAF-8 Unclassified Risk | always | ESCALATE |
| EAF-9 Irreversibility Blindness | irreversible, no reversal/review path | ESCALATE |
| EAF-10 Unrecorded Decision | always | WARN |
The two conservative defaults
- Unknown risk is worst-case risk. An unclassified risk class is treated as irreversible by every evidence rule (EAF-6, EAF-7). Ignorance must be expensive in the safe direction, so that classification becomes the cheap path.
- Undecidable is not allowable. Where the boundary lacks the facts to decide — unverified authority, unknown coverage, unbounded non-production scope — the verdict is ESCALATE, never a benefit-of-the-doubt allow. The boundary’s job is to refuse to guess.
Properties
- Deterministic. The same declared execution always yields the same verdict. Two independent implementations of this table must agree, or one of them is wrong.
- Monotone. Adding a failure class can never improve the verdict.
- Explainable. The verdict cites the classes that produced it. A DENY without named classes is not a JExec decision.
- Complete. Every decision — including ALLOW — emits a JExec Record.
Run the protocol interactively at JExec Check, or read the record format it produces at JExec Record.
The protocol is versioned under the governance policy. Rule changes increment the version and are logged; verdicts computed under older versions remain interpretable via the version field of their records.