Source observations
A meter, scanner, or governance system may supply records. Their authenticity, completeness and units are not established simply because JSON exists.
PAYGOD / REAL POLICY PACKS
Where a Kernel becomes useful
Different domains. Different policy inputs. The same canonical decision and portable evidence architecture. These are source-linked, executable Packs with synthetic test fixtures—not live institutional integrations.
Inspectable source: Only the canonical PayGod Kernel repository is linked as the public technical asset. The three existing Packs are implemented and unit-tested; none is labeled production-ready. This page does not claim that the browser runs the Kernel or that synthetic fixtures represent live measurements.
01 / ARCHITECTURE
One infrastructure, several decision contexts
The Kernel does not measure emissions, scan dependencies, or certify controls. It evaluates admitted input against a declared Pack, produces decision artifacts, and lets a separate recipient verify the bundle's integrity.
Evidence admission
A relying workflow must check the required fields and source conditions. WITHHELD / NOT RUN is an orchestration outcome, not a Kernel verdict.
Policy Pack evaluation
The same code path evaluates a declared Pack's rules. The first matching rule produces a scoped ALLOW, DENY, or FLAG policy outcome.
Manifest, receipt and ledger
The Kernel can package decision-linked artifacts; its independent verifier checks integrity and bindings, not physical truth or legal authority.
Independent verification
A recipient checks the transferred bundle and separately decides whether the source, mandate and other conditions justify reliance.
What stays constant: the Pack and its input change by domain; the canonical decision path and integrity-verification contract do not.
02 / THREE DOMAIN EXAMPLES
Real Packs, declared test fixtures
Every illustrated outcome is backed by a fixture in the canonical repository. Expand a case to read the rule; this page does not invoke the Kernel.
01 / Environmental reportingIMPLEMENTED PACK · SYNTHETIC TESTS
GHG Scope 1 & 2
Does a previously calculated emissions report contain the evidence and methodological references required by a narrowly defined rule set?
Fixture input
Synthetic inventory: reporting year 2025 · Scope 1: 100,000 kgCO₂e · Scope 2: 50,000 kgCO₂e
Cases published in tests/cases.yaml
DENYEvidence references omitted⌄
Rule: deny-missing-evidence. Published test expectation, not a live evaluation in this page.
FLAGEmission factor references omitted⌄
Rule: flag-missing-emission-factors. Published test expectation, not a live evaluation in this page.
ALLOWAll reference fields supplied⌄
Rule: allow-complete. Published test expectation, not a live evaluation in this page.
The Pack evaluates presence of evidence, methodology and emission-factor references. It does not read meters, calculate emissions or attest reporting accuracy.
Boundary: An ALLOW does not prove the inventory is correct. The current general CLI run does not automatically enforce the Pack's embedded input schema.
02 / Software supply chainIMPLEMENTED PACK · SYNTHETIC TESTS
Critical CVE
How can a declared policy respond consistently to an externally produced vulnerability scan?
Fixture input
Synthetic scan: unpatched CVSS 9.8 (98 × 0.1), or CVSS 7.5 (75 × 0.1), or low severity
Cases published in tests/cases.yaml
DENYUnpatched critical vulnerability, cvss_score_x10 = 98⌄
Rule: block-critical-cve. Published test expectation, not a live evaluation in this page.
FLAGUnpatched high vulnerability, cvss_score_x10 = 75⌄
Rule: warn-high-cve. Published test expectation, not a live evaluation in this page.
ALLOWLow-severity vulnerability, cvss_score_x10 = 32⌄
Rule: allow-clean-artifact. Published test expectation, not a live evaluation in this page.
Rules deny unpatched critical scores ≥90, flag high scores 70–89, and allow the clean/low fixture.
SECURITY LIMITATION (v1): This historical Pack can incorrectly
allow a still-affected native Trivy finding with Status=fixed: Trivy means a fix is available, not necessarily installed. Do not use this Pack as a Trivy-based production release gate. See Issue #116. It does not invoke a vulnerability scanner or establish source completeness, authenticity or permission to deploy.03 / Information security governanceIMPLEMENTED PACK · SYNTHETIC TESTS
ISO 27001 Policy Review
How can a defined A.5.1 policy-review rule be applied to an inventory of required information-security policies?
Fixture input
Synthetic policy ISMS-POL-001 · required: true · last_reviewed_days: 20 / 200 / 400
Cases published in tests/cases.yaml
DENYRequired policy has no evidence reference⌄
Rule: deny-required-policy-missing-evidence. Published test expectation, not a live evaluation in this page.
FLAGRequired policy last reviewed 200 days ago⌄
Rule: flag-policy-near-overdue. Published test expectation, not a live evaluation in this page.
ALLOWRequired policy reviewed 30 days ago with evidence reference⌄
Rule: allow-compliant. Published test expectation, not a live evaluation in this page.
Rules deny missing evidence or overdue reviews, flag reviews nearing the local threshold and allow the well-formed compliant test fixture.
Boundary: This is not ISO certification. The approved_by_role field is asserted input, not a verified identity or an institutional approval witness.
03 / VALUE & LIMITS
Why this matters for the project
The shared asset is not three separate products. It is a reusable deterministic policy-and-evidence path that developers can inspect, compare and extend. Its future institutional value remains a hypothesis until real parties test and rely on it.
Source-of-truth rule
Only the canonical PayGod Kernel repository is linked as the public technical asset. The three existing Packs are implemented and unit-tested; none is labeled production-ready. This page does not claim that the browser runs the Kernel or that synthetic fixtures represent live measurements.
Kernel README ↗Verifier contract ↗Scope and boundaries
Executable Pack ≠ complete input admission. Portable integrity ≠ truth of the source. A matching signature ≠ delegated authority. A policy ALLOW ≠ operational release. Independent institutional acceptance must be established separately.
Evidence Admission ADR ↗Verified claims ↗Stop-Build ↗Pack contributions, acceptance rules, and contributor benefit arrangements are potential future governance work—not an open intake or promise today.