Temporal Integrity

This file captures the §7 chapter draft assembled on 2026-06-19. It is a working draft, not final publication copy. Final tone calibration is deferred to a later outreach pass.

Temporal Integrity is the third of the five structural prerequisites (ZTG-0a through ZTG-0e). Observability records what happened and Replayability reconstructs it; both presuppose that the when of a decision — and the state it was evaluated against — is itself trustworthy. ZTG-0c establishes that presupposition. A governance decision is meaningful only relative to a definite instant and a coherent state at that instant; if time can drift, roll back, or be supplied by the governed system, every time-bounded guarantee and every replay loses its anchor.

Operational Questions

ZTG-0c sits in the prerequisite range that serves replayability and evidence coupling, and it is what those properties stand on. Replay (ZTG-0b) reconstructs a decision as of decision-time; that phrase has no content unless decision-time is a definite, trustworthy instant against a definite state — which is exactly what ZTG-0c supplies. ZTG-0c also conditions governance continuity (ZTG-0e): the ordering of governance events across policy changes depends on a coherent temporal and causal account of which event preceded which. And it underwrites admissibility: a decision is only independently checkable if when it was made, and against what, can be trusted rather than asserted.

Normative

Every governance decision MUST be evaluated at a defined instant, against a coherent state as of that instant, using time obtained from a source the governed reasoning system does not control. The instant, the state, and the time source are jointly the temporal context of the decision, and all three MUST be recorded under ZTG-0a so the decision can be replayed under ZTG-0b.

Decision-Time

Each governance decision has a single decision-time: the instant at which the boundary evaluates the proposed action against policy. Decision-time is established by the architecture, not chosen by the reasoning system, and it is the reference instant for every time-dependent input to the decision — policy effective dates, credential validity windows, rate and quota windows, and the state snapshot defined below. An architecture that evaluates different inputs of a single decision against different instants does not have a well-defined decision-time and does not satisfy ZTG-0c.

Trusted Time Source

Time MUST come from a source whose integrity is attestable, that advances monotonically, and whose skew is bounded and recorded. The reasoning system MUST NOT originate, supply, or influence the time a decision is evaluated against.

The structural reason is the same one ZTG-1 invokes to refuse memory-to-policy bootstrap: a governance input that the governed subject controls is not a governance input. A system that can set its own clock can defeat every time-bounded policy — presenting an expired credential as valid, acting outside a permitted window, or replaying a stale authorization — without the policy ever being wrong. Monotonicity prevents silent rollback, which would otherwise allow a later event to be presented as earlier; bounded, recorded skew makes the residual uncertainty in "now" an audited quantity rather than an open one. Best-effort wall-clock time supplied without these properties does not satisfy ZTG-0c, because rollback and unbounded drift remain available as manipulation vectors.

Point-in-Time State Consistency

A decision MUST be evaluated against a coherent temporal cut: a single, consistent snapshot of every governance-relevant input — policy version, identity state, surface and sub-surface registry, harm-class and ceiling declarations, and prior governance state — drawn as of decision-time. The inputs to one decision MUST NOT be assembled from different instants.

Point-in-time consistency, not mere freshness, is the requirement. A set of individually-current inputs drawn from slightly different moments may correspond to no single real state of the system, and a decision evaluated against such a set cannot be faithfully replayed, because there is no coherent "world as of decision-time" to reconstruct. The snapshot is what ZTG-0b replay reconstructs; ZTG-0c is the requirement that such a snapshot exists and is coherent.

No Stale, Future, or Temporally Inconsistent Inputs

The boundary MUST NOT evaluate against stale policy, future state, or temporally inconsistent inputs. This is the requirement ZTG-1 names in its ZTG-0c composition clause, stated here as a prerequisite in its own right. Stale inputs evaluate a decision against a world that has already changed; future state evaluates it against a world that does not yet exist; temporally inconsistent inputs evaluate it against a world that never existed. Each breaks the correspondence between the decision and a definite state, and each is a ZTG-0c violation independent of whether the resulting verdict happens to be acceptable.

Temporal Order and Causal Order

The system MUST maintain a coherent account of the order of governance events, and that account MUST be reconcilable with recorded time. Where recorded wall-clock time and the logical append order of ZTG-0a disagree, the logical/causal order is authoritative for governance sequencing, and the disagreement MUST be detectable and recorded as a temporal-integrity fault rather than silently resolved. A timestamp that would place a later-appended event before an earlier one is evidence of clock failure or manipulation, not a tiebreak to absorb. Recorded time locates events; causal order sequences them; ZTG-0c requires the two to be consistent and requires inconsistency to surface.

Time-Bounded Authority

Where authority is time-bounded — credentials that expire, policies with effective and expiry dates, authorizations valid only within a window — the bound MUST be evaluated against trusted decision-time, never against time asserted by or derivable from the reasoning system. The expiry of authority is a governance fact; it cannot depend on a clock the governed system can move.

Conformance Criteria

A conforming implementation can: establish a single decision-time per decision from a non-model source; demonstrate that time advances monotonically and that skew is bounded and recorded; evaluate each decision against a coherent point-in-time snapshot and demonstrate the snapshot is reconstructable for replay; reject or refuse on stale, future, or temporally inconsistent inputs; detect and record disagreement between recorded time and causal order; and evaluate time-bounded authority against trusted time only.

Further Considerations

The distributed-systems grounding. Concurrency theory established decades ago that a distributed system has no free, globally-shared "now": independent components cannot share a perfect instantaneous clock, so coherent reasoning about order must be constructed rather than assumed. Lamport's happens-before relation makes causal order — not wall-clock time — the reliable account of what preceded what, and the consistent-global-snapshot result shows that a coherent system-wide state "as of an instant" is something a distributed system must deliberately capture, not something it can read off a clock. ZTG-0c is these results applied to governance. Its insistence that causal order is authoritative on conflict, and that a decision evaluate against a deliberately-captured coherent snapshot rather than a bag of individually-fresh inputs, is not over-engineering; it is what the distributed character of any real governed system requires. A governance architecture that assumed a perfect global clock would be assuming away a problem the field proved is not assumable.

Time as an attack surface. Most governance bypasses that route through time do not require defeating policy; they require defeating the clock. Backdating an action into a permitted window, presenting an expired credential under a rolled-back clock, or reordering events to manufacture a favorable causal story are all attacks on temporal integrity, not on the policy logic. This is why ZTG-0c treats the time source as a trust boundary as serious as identity or policy: the weakest link in a time-bounded guarantee is usually the time, not the bound.

Relationship to replayability. ZTG-0c and ZTG-0b are tightly coupled. The point-in-time snapshot ZTG-0c requires is precisely the object ZTG-0b replays, and the decision-time ZTG-0c fixes is the reference instant ZTG-0b reconstructs against. ZTG-0b's requirement to pin the policy and engine "in effect at decision-time" is well-defined only because ZTG-0c defines decision-time and the coherent state at it. The two prerequisites should be read together: ZTG-0c establishes the temporal anchor, ZTG-0b reconstructs from it.

Relationship to observability. ZTG-0c's guarantees are only auditable because ZTG-0a records them: the decision-time, the time-source check (TIME_SOURCE_CHECKED), the recorded skew, and any detected time/order inconsistency are all governance-relevant events. ZTG-0c says what must be true of time; ZTG-0a is why an auditor can confirm it was.

Bounded skew is a parameter, not a softening. Requiring skew to be bounded and recorded is not a relaxation of the trusted-time requirement; it is the honest form of it. No physical clock is exact, so the conformant move is to bound the uncertainty and record it, making "now" an audited interval rather than a false point. Choosing the bound is a deployment decision; having a bound, and recording it, is the requirement.

Loss of temporal integrity and Stasis. When the system cannot establish trusted decision-time, cannot obtain a coherent snapshot, or detects a time/order inconsistency it cannot resolve, it has lost a precondition for sound governance decisions. Consistent with the boundary's fail-closed posture, the correct response is to refuse rather than to proceed against uncertain time, and sustained loss of temporal integrity is a candidate Stasis (ZTG-2) trigger. The precise trigger semantics belong to the ZTG-2 chapter; ZTG-0c establishes that degraded temporal integrity is a refuse-not-proceed condition.

How We Do It

Constable establishes decision-time and a coherent snapshot from infrastructure the agent runtime cannot reach, and reconciles recorded time against the monotonic log.

Trusted time service. Constable draws decision-time from a time service outside the agent runtime, attested and monotonic, with a configured skew bound. The agent runtime has no path to set, advance, or roll back this clock. Each decision records its decision-time, the time-source attestation, and the skew bound in effect, emitting a TIME_SOURCE_CHECKED event under ZTG-0a.

Snapshot pinning. At decision-time the gate pins a coherent snapshot of policy bundle version, identity state, surface registry, and prior governance state, and evaluates against that snapshot rather than against live values that may move during evaluation. The pinned snapshot is the same object the ZTG-0b replay harness reloads, which is what lets a replay correspond to the world as of decision-time rather than to a later state.

Order reconciliation with the Monotonic Logger. The append-only Monotonic Logger provides causal/append order; recorded wall-clock timestamps provide time. Constable reconciles the two and treats a timestamp that contradicts append order as a temporal-integrity fault — recorded, surfaced, and, where unresolved, routed to refusal. Causal order is authoritative for sequencing governance events; wall-clock time locates them.

Time-bounded checks. Credential expiry, policy effective and expiry dates, and windowed authorizations are evaluated against trusted decision-time only. No time-bounded check consults a clock value supplied through the agent runtime or derived from model output.

Conformance tests. Constable's internal testing for ZTG-0c includes: non-model-time tests confirming the agent runtime cannot influence decision-time; monotonicity and rollback tests confirming the clock cannot be moved backward silently; skew-bound tests confirming skew is bounded and recorded; snapshot-coherence tests confirming a decision's inputs derive from one cut and replay against it; staleness and future-state tests confirming such inputs are refused; and time/order reconciliation tests confirming timestamp-versus-append conflicts are detected and surfaced. The protocol is documented in the conformance verification specification referenced in §22.

Draft Flags

• Stasis (ZTG-2) trigger on temporal-integrity loss. ZTG-0c states that degraded temporal integrity is a refuse-not-proceed condition and a candidate Stasis trigger; the trigger semantics must be set when ZTG-2 is drafted. Flag for ZTG-2.
• Ordering relationship with ZTG-0e (Governance Consistency). ZTG-0c makes causal order authoritative for sequencing; ZTG-0e governs consistency of governance state across changes. Confirm the two agree on how governance-state transitions are ordered relative to decision events once ZTG-0e is drafted.
• Reciprocal with §6 (ZTG-0b). ZTG-0b's "policy and engine in effect at decision-time" is defined against this chapter's decision-time and snapshot. This is the agreement §6's draft flag asked for; keep the two definitions in sync if either is revised.
• Snapshot mechanism is asserted, not specified. ZTG-0c requires a coherent point-in-time snapshot but does not specify isolation mechanism (e.g., MVCC-style versioning vs. lock-based). That is an implementation choice; flagged so a later pass decides whether ZTG-0c should say anything normative about acceptable mechanisms or leave it entirely to implementations.
• §22 Conformance Verification is referenced but not yet captured in this workspace.
• The chapter is substantively complete but likely needs final tone calibration for publication register.