Policy and installation posture

Platform owns installation posture as opaque, versioned environment-state documents. Policy declares airgap-seal:installation through Platform’s owner API and reads airgap-seal and time-anchor from its own environment_state catalog replica. The Policy tenant remains request/audit context; it does not select a separate seal.

/system/airgap/seal, /system/airgap/unseal, and the governance toggle retain the airgap:seal operator gate. Platform independently enforces class custody using the same operator’s bearer or previously validated router identity envelope. Preserving declarations first read the current owner document, so the caller must also hold envstate:read or its airgap:status:read alias. Missing read permission fails the operation before PUT; there is no privilege fallback. No privileged service identity replaces the caller. Platform:BaseAddress must point to the direct Platform owner service, which validates the forwarded proof. Missing delegation or owner refusal is an error, never a successful local write.

The mutation response comes from Platform’s acknowledgment and carries custodyScope and its accepted version. Subsequent status reads show the local replica’s observed version and can lag until the next drain; the mutation does not pretend replication is synchronous. Only explicit write preparation reads Platform, preserving the latest owner configuration instead of copying a stale local replica. An unreadable owner document refuses the write. As with the owner’s full-document PUT contract, this read-then-PUT is not an atomic field merge; no new compare-and-swap contract is claimed.

Enable Catalog:Replication:EnvironmentState:Enabled with FeedBaseAddress and AuthTenant, and configure the existing Authority client with catalog:replicate. The feed uses service credentials only for catalog replication. Enforcement/status reads never call Platform. A replica outage is distinct from measured absence; status returns unavailable rather than inventing unsealed posture. A measured absence preserves the configured bootstrap policy. A replicated unseal cannot weaken a locally configured seal.

Signed bundle import remains the sanctioned ingress. A declared seal activates freshness checks against the separate time-anchor document and the seal’s budget. Fresh and warning anchors admit, warning is logged, and breached/missing/unreadable anchors refuse. Unreadable posture keeps signed ingress available when the local bootstrap policy is unsealed, with a warning; trust verification remains required. Status and governance projections report declaration state, not fabricated proof verification. Declare verified time with stella airgap time-anchor declare; airgap:seal alone cannot declare the trusted-time class through a seal request.

Migration 010_retire_policy_sealed_mode_state.sql locks and removes the empty Policy predecessor table. It refuses operator rows and uses dependency-restricting drop behavior. Existing migrations remain unchanged. A runtime rollout carrying this migration requires the reviewed posture-retirement window; source/test preparation does not authorize a live schema change.

Re-sealing preserves the owner’s current policy hash when the request omits it, including the governance toggle; an explicitly supplied hash replaces it. Current owner reads and acknowledgments must contain an object state with an explicit boolean seal value. A malformed HTTP200 response is not an absent document. The owner transport refuses redirects, keeping delegated identity proof bound to the configured owner address.

The Console’s Policy governance page separates the last accepted declaration from Policy’s observed installation state. It shows both versions and keeps local sealed configuration effective after an accepted unseal. Failed reads show an unavailable state with a retry action. The toggle does not collect reason, trust-root or allowed-source settings that its backend does not save. Temporary override controls remain unavailable until an owning runtime supports them. Declaration status is not cryptographic verification.