Skip to content

RECEIVED COPY — authored cross-fence (RTOpacks side), relayed by Tim 2026-07-01. Original of record lives in the RTOpacks repo. Per FENCE-PROTOCOL-01 §4 this copy is never edited and never promoted into home canon; local force comes from UCCA-FENCE-RULING-RECORD-01 (our matching record).

title: FENCE-RULING-RECORD — conformer/gate custody + adapter warranty (rulings at the relay) doc_id: FENCE-RULING-RECORD-01 status: FILED RTOpacks-side (our record of two relay rulings, per FENCE-PROTOCOL-01 §4). UCCA files its own matching record; the warranty ruling is engine terms of service and its binding home is UCCA-side canon — this doc records it, does not own it. layer: crossing record (RTOpacks original) canonical: false authored: 2026-07-01 NYC — architect record of Tim's in-session rulings relates_to: UCCA-ASSESSMENT-RTOPACKS-BRIEF-01-ADDENDUM-01 §A-6 (the crossing this answers); RTOPACKS-ENGINE-BRIEF-01 (B-4, D-1, D-3); FENCE-PROTOCOL-01; ENGINE-BENCH-CONTRACT-01 §5

Fence Ruling Record — 2026-07-01

Two rulings made by Tim at the relay, recorded our side. Plus one protocol gap noted for the next crossing.

Ruling 1 — Conformer and gate, both sides (closes addendum A-6)

The sender conforms; the receiver verifies.

  • The conformer/adapter is RTOpacks-side software. It holds all VET domain knowledge (TGA units, AQF, packaging rules, SRTOs clauses), translates our corpus to triumvirate shape, validates semantically, signs, and submits. Cloudflare-first applies to it as to everything else our side (no local dependency).
  • The gate is engine-side. It independently verifies conformance — structure, schema version, signature — before ingestion. Malformed jobs bounce whole.
  • Two independent checks of two different kinds; the trust boundary sits exactly on the corporate boundary. Raw regulated corpus never leaves our jurisdiction; only the translated, hashed, signed triumvirate crosses.

Lifecycle note: ruling record now; an RTOpacks ADR mints only at build proof (the adapter exercised to terminal effect against the live gate), per ADR-STATUS-LIFECYCLE.

Ruling 2 — The gate is the warranty boundary (closes A-6's open sub-question)

The addendum left open "who authors and certifies adapter software" as a DPA term. Ruled:

  • UCCA supplies a reference adapter/conformer best-effort, as-is — published code, free-form, like any vendor's SDK. UCCA cannot and does not warrant its application, because deployment context, corpus quality, and translation fidelity live on the client's side of the fence, invisible to the engine by design (B-2, B-4).
  • The client warrants its own translation — semantic fidelity of the triumvirate it submits — regardless of whether it wired in the reference code or built its own to the published gate spec. Using UCCA's free code does not transfer the warranty.
  • UCCA warrants from the gate forwards. Once a job passes structural verification and is ingested, engine behaviour over it — provenance completeness, envelope integrity, the never-sign property — is UCCA's warranty.

One line: no warranty before the gate; full warranty after it. The warranty boundary, trust boundary, and corporate boundary are the same line. This is engine terms of service — it binds every client, not just us — so its canonical home is UCCA-side. We record it here as Client One acknowledging the terms: as our own adapter's builders, we warrant our translation, and we accept that using any supplied reference code changes nothing about that.

Jimmy's eyes owed: the liability wording when this becomes a real DPA clause. The model is settled; the drafting is a commercial-legal task, no build dependency.

Protocol gap — the parent assessment has not crossed

ADDENDUM-01 states "the parent assessment's fourteen verdicts stand," but UCCA-ASSESSMENT-RTOPACKS-BRIEF-01 has never crossed as a filed artefact. Per FENCE-PROTOCOL-01 §1, if it matters enough to cross, it is a document — verdicts that live only in a session are not on the record. Request to the engine side: file the parent (if not already filed) and cross a copy, so our received-copy set is complete and the addendum has something to be an addendum of. Carried with the next relay; not a new crossing in itself.

Two rulings recorded, one gap flagged. The conformer is ours, the gate is theirs, and the warranty changes hands at the same line the trust does. Nothing here blocks the input-path build.