E03 — Complete rejecting certificate pipeline

Authored design — 2026-09-15. Section 4. This cascade elaborates the existing checklist item. It is not a dispatch, implementation receipt or completion verdict. Work outside WM-01–14 still requires Joe’s explicit greenlight; having a cascade is necessary but not permission.

Section 3/4 index · Exact TODO · Cascade JSON

Situation and design problem

A trustworthy certificate pipeline must reject false claims and positively validate authentic complete evidence. A truthful negative certificate proves detection, not qualification.

Governing checklist snapshot

E03 — Complete rejecting certificate pipeline. PARTIAL: typed attestation/generator machinery exists. Complete existing worklist F11 certificate acquisition/adapter, source binding, semantic predicates, rejecting controls and end-to-end tamper tests. A complete record of failures is useful but is not positive validation.

This is the checklist’s dated evidence account, not a new deployment census. Existing source/test evidence keeps its bounded credit. The acceptance obligation above governs this design.

Pattern applications

E03-1 — Acquire the required F11 inputs

Pattern: wm-qualifying-run/complete-acquisition-universe

Use the existing worklist F11 acquisition/adapter obligation, with its complete source/evidence universe. Keep that mission distinct from checklist WM-11 policy inference. Produce admitted inputs or named missing members.

E03-2 — Bind semantics to certificate fields

Pattern: wm-qualifying-run/certificate-and-world-must-meet

Map each run predicate to the authentic observation, source/model identity and independent review it asserts. Bind generator and checker versions; well-typed fields cannot replace evidence that the event occurred.

E03-3 — Exercise the rejecting path end to end

Pattern: wm-qualifying-run/negative-result-keeps-its-meaning

Tamper with source, subject, model, occurrence, mandatory-edge and independence fields at acquisition and generated-certificate boundaries. Require rejection for the intended semantic condition, not merely malformed syntax.

E03-4 — Compute and independently check the result

Pattern: wm-qualifying-run/certificate-and-world-must-meet

Run the formal checker on the emitted certificate, retain its inputs, output and relevant axiom/build evidence, and obtain independent review. Positive validation needs a complete authentic qualifying subject; generated false certificates remain negative results.

Composition and interfaces

Each node’s stated artifact is the input or constraint for the related node below. These are design dependencies, not a claim that a runtime scheduler automatically fires patterns. Existing WM producers are reused through the linked contracts; no second implementation is implied.

Retain the actual subject, source/model revision, task/occurrence, cutoff, producer and consumer for each interface. A missing field is a named gap; a default that changes the meaning is not an adapter. Reuse existing records where they satisfy these obligations. If a new component is indispensable, identify its exact TODO/cascade clause before seeking a separately bounded implementation instruction.

Worked situation

A certificate correctly says an edge never fired. It is an honest and useful output. Renaming its successful computation a qualifying run would reverse the substantive result.

This is a distinguishing design example, not a claimed production experiment.

Implementation sequence and closure evidence

1. Bind the first application to the actual source, task and authority. Resolve the decisions below before their dependent change; do not reproduce a known gap merely to claim activity.
2. Implement only the specifically dispatched producer/consumer change from the middle applications. Retain the meaningful pre-change failure and relevant post-change controls; do not start a general infrastructure project.
3. Acquire the final application’s evidence and independent review. Compare it against every clause of the exact TODO, identifying any still-open dependency. Source, tests, serving state, ordinary use and whole-run validation receive different credit.

Distinguishing controls: Use missing commission, stale source hash, forged reviewer, cross-run edge, omitted required input and changed generated predicate. Keep a valid complete control separate from fabricated production evidence.

Closure rule: every part of the quoted obligation must be supported by the indicated artifacts and actual connections. A useful rejection proves the rejecting boundary only. One accepted subclause does not tick the whole item. A bellback must supply the exact reviewed subject, executed checks, independent verdict and remaining clauses.

Dependencies and authority boundaries

E02 · R9 · TRACE · E04 · E05

No synthetic positive run or reconstructed preimage may satisfy the production claim. A blocked positive case stays open.

Dependency links describe required interfaces; they do not authorize work on those items. No implementation outside the existing TODO list is approved. Publication does not select a numerical law, settle an unresolved operator ruling or authorize a run.

Pattern and source scope

All seeded patterns are applied above. The JSON pins their source bytes and the governing checklist/rulings. Historical formulas, thresholds and examples in a pattern remain scoped examples unless the governing contract adopts them. This draft adds no pattern-library entries and claims no independent semantic ratification.