saphan refusal-class

saphan refusal-class

Ratify a refusal class, and read every class's ratification state

saphan refusal-class

Subcommands

saphan refusal-class ratify

Record a HUMAN ratification of one or more refusal classes (append-only, signed)

saphan refusal-class ratify <class-value>... [flags]

Record the owner's decision that a named refusal class is a legitimate ground for refusing, with a mandatory --ground, signed by the workspace key, appended to refusal_class_ratification.

A class is named by its VALUE ("gate-integrity"), never by its Go name ("RefusalClassGateIntegrity"): at the moment of a ratification the Go constant MAY NOT EXIST YET, because a class is routinely ratified BEFORE it is implemented. The Go spelling is refused by name, with the right value printed — never accepted silently as a synonym.

Ratifying a class that is not in the generated table is ADMITTED, on purpose. It is not an error and not a warning: it is a DEBT, and refusal-class status renders it as ratified · not-yet-implemented until the constant lands.

N classes named in one gesture are N ACTS IN THE RECORD — one signed row each, provenance per class, never one collective row. Admission is all-or-nothing: if any named class is refused, NOTHING is written.

APPEND-ONLY. There is no amend, no edit, no update and no delete. A ratification that turns out wrong is corrected by a LATER ratification that says so.

saphan dry-run refusal-class ratify runs the SAME validation the real write runs (ratify.Check, the identical seam the writer calls — a seam that takes no store handle at all and therefore cannot write) and writes NOTHING: no row, no signature. An inadmissible act refuses with the IDENTICAL reason text a real write would print; an admissible act prints the rows that would be inserted, then exits 0.

Options

saphan refusal-class status

Project EVERY refusal class as ratified·implemented, ratified·not-yet-implemented, or implemented·unratified

saphan refusal-class status

Join what the CODE says (the generated class table) with what the RECORD says (the ratification log) and give every class exactly one of three states. None of the three is silence.

ratified · implemented a ratification row exists AND the class is a Go constant in the generated table ratified · not-yet-implemented a ratification row exists, the constant does not — a DEBT, and a visible one implemented · unratified the constant exists, nobody ever decided anything about it — the other debt, and the one nobody sees without being shown

The reader walks the UNION of both sides, never one of them: a projection built from the ratification rows alone would render an empty log exactly like a fully ratified fleet. That is the gap this family already lived through once — "census pinned 55, live source had grown to 62 with nobody having decided anything about the gap".

Signatures are judged when a workspace key is present in this session; without one, every row reads unjudged — an absence of judgment, never a pass. Debt is not an error: unratified and not-yet-implemented classes exit 0. A ratification row whose SIGNATURE does not hold up exits 2.

EVERY row is judged, not just the latest of each class. The two questions are kept apart: what a class SAYS is its latest row, because a wrong ratification is corrected by a LATER one — but whether the LOG IS INTACT is asked of all of them, superseded rows included. So a class can read ratified · implemented with the row it names verifying, and the reader will still say the log does not hold up, name the offending row by id and position, and exit 2.