Initial project import

2026-08-14 09:40:51 +03:00
parent 00040e5ce4
commit d7099bf80d
146 changed files with 30509 additions and 1055 deletions
@@ -0,0 +1,55 @@
+# Evidence and safety rules
+
+## Evidence levels
+
+| Level | Meaning | Permitted use |
+|---|---|---|
+| Observed | Read from live SQL once | Diagnosis only |
+| Reproduced | Seen in independent before/after saves | Decoder rule candidate |
+| Round-trip proven | Decode → unchanged encode returns identical bytes | Safe read/transform component |
+| Activation proven | A human Configurator applied it and active SQL verified it | Controlled `upo_test` writer component |
+
+No rule may be promoted because a name, suffix, or payload shape “looks right”.
+
+## Codec boundary
+
+The configuration-storage specification is the adapter's sole authority for
+decoding and encoding. A writer is enabled only when the relevant version of
+that specification defines every changed byte and every dependent integrity
+atom, and round-trip evidence proves the encoder. Any remaining opaque atom is
+preserved byte-for-byte; if a requested edit requires changing it, the write is
+unsupported until the specification is extended by a controlled experiment.
+
+## Allowed mutation boundary
+
+- The adapter runtime uses SQL only.
+- `upo_test` may receive controlled writes to `ConfigSave` and
+  `ConfigCASSave` only.
+- `Config`, `ConfigCAS`, and application data are never direct write targets.
+- A write must have a live target resolution, optimistic SHA-1 precondition,
+  reversible evidence, atomic transaction, and readback verification.
+- Repository coordination is a separate policy; an adapter marker is not a
+  native repository lock.
+
+## Exact edits
+
+For BSL fragment replacement, provide one of:
+
+- an old fragment occurring exactly once;
+- a larger unique surrounding fragment;
+- a proven structural container path/offset plus original SHA-1.
+
+If a fragment occurs zero or more than once, do not choose arbitrarily. Return
+the count and candidate contexts. Deletion follows the same rule.
+
+## What an agent must report
+
+Every proposal and applied result must state:
+
+- active and saved layers used;
+- public target and SQL evidence retained internally;
+- original and new SHA-1 values;
+- paired files changed;
+- exact-match count;
+- rollback reference;
+- Configurator refresh guidance.