Documentation
Technical documentation index
This index covers protocol concepts, the status labels used across the site, and the architecture documents behind each component. It does not describe APIs, SDKs, schemas, commands, integrations, or error codes; none are published.
Concepts
Protocol concepts and terminology
- Consequential action
- An operation whose effect matters outside the requesting process: a deployment, a payment, a change to policy or keys, a message sent, a file altered. Vallum governs consequential actions, not every instruction.
- Principal
- Any identity that can make a request: a human, an agent, or a service. Every principal is authenticated before its request is evaluated.
- Authority
- The legitimate, scoped right to have a consequential action performed. Authority originates with a human grant and is never self-asserted.
- Authorization Handshake
- The exchange in which a principal presents an intent and Vallum establishes that scoped authority exists for it, producing an authorization record.
- Policy
- Explicit, versioned rules that map an authorized intent and its evidence to ALLOW or BLOCK.
- Policy decision
- The deterministic evaluation of a request against policy. Identical inputs produce identical outputs.
- Policy-enforcement point
- The named component placed in front of a consequential effect. On BLOCK it stops the effect; on ALLOW it permits the effect within scope.
- Evidence
- Verifiable inputs a policy requires, such as artifact provenance or target state. Evidence must be present, fresh, consistent, and verifiable to count.
- Provenance
- A cryptographically verifiable chain showing where an artifact or record came from and that it has not been altered.
- Fail closed
- When required security state is missing, stale, ambiguous, inconsistent, unavailable, or unverifiable, the decision is BLOCK.
- Trust root
- The anchor from which all authority and key material in a deployment derives. Changes require governed human approval.
- Containment
- Revocation, quarantine, and blast-radius limitation applied to a principal or artifact pending governed human review.
- Recovery
- Restoration of a known-good state from preserved evidence under human control.
- Deployment profile
- One of Home Computer, Business, or Enterprise. Profiles vary in scale and layered controls, not in decision semantics.
Status labels
Status-label definitions
Every architecture component and document carries exactly one of these labels.
- CANONICAL TARGET
- Part of the intended Vallum architecture; the agreed design that implementation must satisfy. Does not mean implemented. Implementation maturity is reported separately on the development status page.
- PROVISIONAL
- A design that is expected to change before it becomes canonical. Do not rely on its details.
- BLOCKED
- Work on this item cannot advance until a named dependency or finding is resolved.
- UNKNOWN
- The current state has not been established. Treat as unqualified.
- IMPLEMENTED — EVIDENCE REQUIRED
- Code exists, but the evidence needed to qualify it has not been produced or preserved. Not a claim of production readiness.
Architecture documents
Document index
Documents marked draft are unverified, carry a noindex directive, and are excluded from the sitemap.
- Identity and admissionDraft · noindex
Principal identity, admission scope, and the no-anonymous-path rule.
CANONICAL TARGET - Authorization HandshakeDraft · noindex
Intent presentation, scoped authority, and the authorization record.
CANONICAL TARGET - Policy decisionDraft · noindex
Deterministic evaluation, policy versioning, and fail-closed semantics.
CANONICAL TARGET - Policy-enforcement pointDraft · noindex
Named enforcement in front of consequential effects; placement per profile.
CANONICAL TARGET - Evidence verification and provenanceDraft · noindex
Evidence requirements and the structure of decision records.
CANONICAL TARGET - Revocation, quarantine, containment, and recoveryDraft · noindex
Withdrawal of authority, isolation, and human-controlled restoration.
CANONICAL TARGET - Trust-root and key lifecycleDraft · noindex
Establishment, rotation, retirement, and governed change of the trust root.
CANONICAL TARGET