SSM-NET — Security, Privacy, and Ethics (9G–9I)

Focused safeguards inside manifests; incident-time minimalism; copy-ready audit checklist

9G. Policy safety in manifests
Make edges explicit, minimize flip-flop, and state operating bounds.

  • Boundary inclusivity text (MUST). Specify each cut’s edge behavior (e.g., (-0.80, +0.60]). Ambiguity causes audit failures.
  • Hysteresis (OPTIONAL but RECOMMENDED near cuts). Declare narrow buffers to avoid oscillation; document their math clearly.
  • Assumptions (SHOULD). Publish validity ranges (e.g., “sample_rate ≥ X”, “load ≤ Y”). When inputs drift outside, degrade trust (e.g., remap to “REVIEW”) instead of inferring correctness.
  • Numeric canonicality (if align public). Fix sign and decimals (e.g., +0.732000) to avoid serializer drift.
  • Lane kernel reference (non-editable). Point to the deterministic path to avoid vendor drift:
a_c := clamp(a_raw, -1+eps_a, +1-eps_a)
u   := atanh(a_c)
U  += w*u ; W += w
align := tanh( U / max(W, eps_w) )
  • Rotation principle (MUST). Any policy change ⇒ new manifest_id; do not edit bytes of prior manifests (keep them online for replay).
  • Disclosure posture. Default label-first (value+band); declare align public only if required by ecosystem policy.

9H. Minimal disclosure during incidents
Report stamped facts, not identities, and never leak hidden dials.

  • Stamped incident notes (MUST). Append a short, non-PII note chained from current HEAD; never rewrite earlier envelopes.
  • Containment first (SHOULD). Quarantine failing scopes; preserve artifacts for replay.
  • Scope-level context only. Reference scope names and manifest_id; avoid tenant/user identifiers.
  • No lane leakage. Do not include align/align_ascii in errors unless already public by policy.
  • Human UI hygiene. Show compact chips like INCIDENT • E_BODY_HASH_MISMATCH; avoid exposing internals.
  • Digest discipline (MUST). Any text used in hashing is UTF-8 NFC before computing sha256.
# continuity stamp (append-only)
SSMCLOCK1|<UTC_ISO>|nonce=<...>|sha256=<HEAD>|prev=<HEX or NONE>

9I. Provenance & Minimization Audit (copy-ready checklist)
Prove security, privacy minimization, and ethical conduct—without touching payload bytes (phi((m,a)) = m).

Scope. All active scopes across three pillars: Security provenance, Privacy minimization, Ethical obligations.
Inputs (read-only). /.well-known/ssmnet/manifest/<id>, current checkpoint (HEAD=<HEX>), latest evidence bundle (manifests.json, envelopes.jsonl, hashes.txt, checkpoint.txt, verify.sh), and a rotation log of manifest_id changes.

Security provenance — checks

# 1) Digest correctness (subset [+ body if declared])
HEAD_local := sha256( serialize(subset_fields) [+ raw_body_bytes_if_declared] )

# 2) Continuity chain equals checkpoint
walk(prev) -> final_HEAD == checkpoint.txt

# 3) Kernel determinism (if disclosure=full)
a_c := clamp(...) -> u := atanh(a_c) -> U += w*u ; W += w -> align := tanh(U / max(W, eps_w))

# tolerances
batch_vs_stream <= 1e-6
shard_merge     <= 1e-12
  • Intermediary preservation. Upstream stamps and any SSMNET-Body-Hash are forwarded byte-for-byte; only new stamps are added.

Privacy minimization — checks

  • Subset review. Canonical subset has no PII; posture = band + manifest_id.
  • Disclosure posture. Public surfaces are label-first unless disclosure=full.
  • Decimal canonicality (if full). align_ascii uses fixed sign + 6 decimals and matches recomputed float.
  • Residency/retention. Manifests stay online; evidence bundles keep the minimum needed for replay; no secrets embedded.

Ethical obligations — checks

  • Obligation encoding. Manifests declare human/agent duties per band (review windows, safe-mode timing) with explicit boundary inclusivity.
  • Actionability trace. For CRITICAL/escalatory bands, stamped timelines permit independent verification of actions within declared windows.
  • Proportionality. Disclosure level (L1/L2/L3) is the minimum needed for safety and accountability.
  • No identity drag. Bands describe system/content posture, not people.

Sampling guidance

  • Test each edge around cut boundaries (e.g., (-0.80, +0.60]).
  • Include at least one negative (single-byte flip must fail deterministically).
  • For streams, include one epoch rollover and one shard-merge sample.

Expected artifacts

  • Provenance report: scope, window, manifest pins (sha256 of manifest text), computed vs expected HEAD, parity metrics.
  • Findings: pass/fail with codes (e.g., E_BODY_HASH_MISMATCH, E_STAMP_PREV, E_ALIGN_POLICY, E_SUBSET_DECL)—each with a new stamped note.
  • Remediation plan: rotate manifest, fix serializer, adjust disclosure, update runbooks.
  • Failure handling (overlay-safe). Publish stamped incident notes; remediate forward (no retroactive edits).

Navigation
Previous: SSM-NET — Security, Privacy, and Ethics (9D–9F)
Next: SSM-NET — Federation Levels: Purpose & Levels (10.0–10B)