FIG A+B+C · The governed machine — Zero Trust Governance, end to end At rest
Path
The governed machine — a Rube Goldberg apparatus of Zero Trust Governance A chain reaction carries one proposed action from a stochastic model, through Constable's intent receiver, three deterministic checks, a bolted execution boundary, an authorization-to-commit bind fixture, and a stamping evidence recorder. Failure paths end in blocked and rejected bins; the ledger only records the governed path. SDS.PRIME / PLATE 06 / SCALE · NONE Stochastic model Unsigned ? Proposal Intent receiver Observation Deterministic checks · specimen 01 Identity Policy Scope ZTG boundary Governing boundary Authorization AUTH-0427 Deploy · prod 7B31 Sealed transit Exact bind · specimen 02 Evidence recorder 9E27 Permitted Evidence · specimen 03 Blocked No execution Rejected No inheritance EXEC REQ SEALED
Constable

At rest. One proposal waits in the model. Nothing downstream may move yet — that is the first rule.

Hash-linked evidence ledger

Chain valid · 1 record
  1. 01 ACT-001 · Observe intent Observed 3F9A1D77B08C4E2A95D1F6307AB2C88E41D05F62B7A93C1E84602FD5BAA7C413

The three specimens assembled into one machine: the gate decides, the bind seals, the recorder remembers. Brass marks the governed path — the only route to execution and the only route into the ledger.

MACHINE / GOLDEN / AT REST