These are tested properties and stated limits, not a warranty. The software is MIT licensed and comes with no warranty. Each objective below is a property of the author's canonical line: it is checked by a test that must fail when the property is broken, and the run that produced this page passed. A copy is free under the MIT licence; it keeps these objectives only while its own run of the same tests still passes with no check removed or weakened.
From run 2026-11-01T00:57:19.330Z · node v18.19.1 · real-browser checks judged 5, skipped 0 · record sha256 d0cf871e1fcbec32. Reproduce (bim-compiler repository, Node 18+, no network): node scripts/witness_terms.js --json out.json; how to read it: docs/TermsHowToVerify.md.
Who decides what enters the canonical line, and how a copy keeps these objectives: GOVERNANCE.md.
| Property | Where it closes |
|---|
| Property | Checked by | Broken on purpose, and refused |
|---|---|---|
| LEDGER signed / STATEMENT a statement edited after signing, or signed by an outside key, is refused | witness_comm_plantrust.js witness_team_publish.js (browser) | edited-after-signing refused outside signer refused page: unsigned set refused page: set edited after signing refused (bad-signature) page: outside key refused |
| trusted keys the backup key replaces a lost primary; a non-admin or stale statement cannot change the list | witness_comm_plantrust.js witness_comm_policy.js witness_team_publish.js (browser) | backup recovers lost primary non-admin refused stale replay refused page: non-admin publish refused on both devices |
| STATEMENT (rule in force) a claim stays judged by the rule in force when it was made; a later statement never rewrites it | witness_comm_executors.js witness_comm_settrust.js witness_team_executors.js (browser) | Complete under old map stays refused after {} set published under the old list still loads after rotation page: refused SET_STATUS stays refused after {} |
| BUNDLE (Complete) a Complete by the wrong role is refused on every device, the consequences with it | witness_comm_executors.js witness_team_executors.js (browser) | status op refused not-executor everywhere group consequence refused with it page: clicked CL refused at fold, order unchanged |
| LEDGER convergent devices with the same history agree; a stale copy is not taken in | witness_comm_cl3_store.js witness_comm_cl5_conflict.js witness_team_base.js (browser) | same order on every device stale save refused (ReQuery) page: same refusal on A and B page: base-row-missing refused on both devices |
| VISIT (offline / interrupted) no connection or a lying pipe sends nothing and loses nothing; the later Visit sends everything once | witness_terms_visit.js | dead pipe: nothing lost liar pipe caught by read-back checkers fail on doctored state |
| VISIT (voluntary, once) one Visit sends everything once; a second sends nothing | witness_terms_visit.js witness_comm_cl3_store.js | third Visit sends nothing incremental fetch is 0 |
| ACK sent → seen → refused is visible on the sender | witness_comm_cl3_store.js witness_terms_visit.js witness_team_so.js (browser) | sent then SEEN by peers refused shown on the sender with a reason counter fails with the refused claim removed page: chip shows seen/refused/waiting/last visit page: unsent DocAction shows local-only warning |
| BUNDLE (version skew) newer waits, older waits for a rule, retired is ignored | witness_comm_versions.js witness_team_versions.js (browser) | 18 mutants killed page: newer op parked needs-upgrade page: same op without sv merged (control) page: tampered set refused |
| LOCAL NUMBERING (LEDGER) with Team, two stations (login users with a Search Key) never issue the same document number: OrgValue-UserValue-n each; another station's or a typed number is refused at fold TEAMWORK §48.11b-§48.11d. Legacy arm: the pilot's own WS-login run == the twin replay (D20, scripts/bridge/out/docno_station_legacy.json). Limits: an author not bound to an AD_User is not judged at fold (counted); two users sharing a Search Key share a series | witness_docno_till.js (ootb) witness_docno_till.js (ootb) | same user on two devices collides (control) shipped plain sequence collides (control) another station's / typed number refused at fold on every device new format refused until its edit is in the log user preference cannot change the station 4 mutants killed legacy pilot (real WS logins) numbers the same at every position demo station never numbers Org--n |
| VISIT (bounded) Visit #1 download stays bounded as the team grows: each device lists and downloads only its own mailbox, not every other device's bundle TEAMWORK §45.2/§45.8 F1 per-device mailboxes (bim-ootb #2477; witness common/tests/witness_f1_mailbox.js, mutants run by the witness itself). Measured edge Visit #1 download 384 / 386 / 388 B at N=10/100/1000 (W-SCALE-STAR: build/scriptor/f1_mailboxes/scale_star_F1_final_engine_{10,100}.log, scale_star_F1_engine_1000.log; was 367 KB / 4.5 MB / 45.8 MB). Stated limits: the identity/roster floor on a first-ever Visit is not bounded (identity ops reach everyone); withholding of one mailbox bundle now shows as a gap (per-mailbox sequence, §45.11 / bim-ootb #2486; was a parked op); an old app in a new star space silently misses mailbox mail; the GitHub listing is still O(N) calls | witness_f1_mailbox.js (ootb) | fetched objects flat in N (3 -> 12) CONTROL pre-F1 engine: the same measure grows with N CONTROL pre-F1: station 1 held foreign DOWN ops (now none) station 1 never GETs another mailbox CONTROL pre-F1 relay gate refuses the mailbox name 7 mutants killed |
| RELAY (sealing) in a mailbox (star) space each station's mail is sealed to its pair (that station + head office): another member holding the team key reads none of it, the relay reads none of it, and a withheld mailbox bundle shows as a gap TEAMWORK §45.11 (bim-ootb #2486, #2498; witness common/tests/witness_read_scope.js, 10 mutants run by the witness itself; RED first on the F1 engine: FAIL judged=39 fails=13). Stated limits: the relay still sees metadata (author, box, counts, timing, sizes); in a mailbox space a checkpoint publishes no state (bim-ootb #2498, so no laned record id or verdict is readable with the team key) — the cost: a light client there folds instead of adopting a checkpoint; an insider holding a pair key can leak it; office spaces and spaces founded before F1 keep the team-wide key (unchanged by design) | witness_read_scope.js (ootb) witness_f1_mailbox.js (ootb) | a modified member opens 0 of another station's mail CONTROL team key only: the same member opens all of it a rogue key for another pair is never sealed to revoked device opens 0 after the rekey withheld middle bundle is a gap withheld last bundle is a gap (signed head) CONTROL F1 engine: the same withholding shows no gap no key yet: held, never sent under the team key all mutants killed |
| trusted keys (roles + threshold) a key may only do what its role allows; a rotation or publication needs the declared number of DISTINCT valid keys; a device clock never expires anything TEAMWORK §46.5 versioning Stage 2 (bim-ootb #2473; witness erp/tests/witness_team_keys.js, 9 mutants run by the witness, L1 legacy-fold arm needs KW_OLD = common/comm before #2473, built by the runner with git archive) | witness_team_keys.js (ootb) | rotate-only key cannot publish publish-only key cannot rotate one signature under T=2 refused duplicate signer counted once forged cosignature refused far-future device clock expires nothing far-future device clock moves no anchor legacy log folds to identical verdicts (L1 judged, not INCONCLUSIVE) |
Generated by scripts/terms_objectives_page.js from the record above; nothing on this page is typed by hand.