Evidence-Bound Scientific-Service Authorization: V8 Three-Host Validation Protocol and Local Preflight Artifact
Abstract
This is a PRE-EXECUTION PROTOCOL and local preflight artifact, NOT a completed three-host validation result. The archived local smoke test executed 25 checks successfully on a single host with two localhost service processes. A separate local role-scoping test was reported as 13/13 successful during artifact preparation. The archive reports physical_separation_asserted=false and the same local host identity for the authority, sink, and worker. No three-independent-host execution and no OPA-engine comparison result is included. This record must not be cited as evidence of multi-host security, distributed consensus, deployment safety, operational scientific validity, or physical-actuation guarantees. This research software deposit specifies a planned three-host validation protocol for evidence-bound authorization of scientific-service outputs. It includes a manual GitHub Actions workflow intended to run the authoritative gateway, external effect sink, and worker on three separately hosted virtual machines connected by an isolated Tailscale overlay, together with mutual TLS service identities, Ed25519 delivery grants, per-role endpoint checks, a receiver stop/restart recovery scenario, negative controls, and a proposed Open Policy Agent predicate-comparison job. The bundle contains research source code, configurations, a manually triggered CI workflow, local smoke-test output, instructions, and a SHA-256 manifest. CI test identities are disposable research fixtures. The source-product HMAC remains a shared test mechanism. A stopped receiver service is not equivalent to an arbitrary network partition, and no Byzantine-fault or production secret-custody claim is made. Related unpublished work addresses bounded, acknowledgement-relative revocation and protected external effects. Future remote validation results, if obtained, will be archived separately with their original logs, machine identities, environment, source revision, failure records, and integrity hashes.
