Securing governance transitions behind human compliance supervisors and Ed25519 cryptographic signatures.
When modifications or new statutory rules are ingested, Canon generates an immutable evidence package. A qualified compliance officer or safety maintainer inspects the diffs, verifies legal obligations, and signs off using an Ed25519 hardware keypair.
- Step
- 02 / 05
- Engine
- Canon
- Stage
- Approve
The Approval step enforces human-in-the-loop governance for all critical invariant transitions. The generated evidence package contains full before-and-after diffs, regulatory citations, and risk scores, sealing the approved state inside an append-only ledger.
Built Canon Evidence Package Generator and Ed25519 signing interface powering admin.animuslab.dev sovereign node whitelist cockpit.
# Canon Approval & Signing Command
$ canon approve --draft=".canon/drafts/owasp_llm_v2.json" \
--signer="compliance-officer-01@bank.internal" \
--keypair="~/.ssh/id_ed25519_gov" \
--reason="Satisfies EU AI Act Article 12 v2 Log Mandates"
[OK] Evidence Package #EV-9801 Sealed. Signature: ed25519:8f9a2b...What this stage produces.
- 01
Evidence Packages: Generating comprehensive diff reports detailing rules modified, added, or deleted.
- 02
Attributed Audit Records: Binding supervisor keypair signatures to approved governance state changes.
- 03
Hash-Chained Ledger: Preventing history rewriting by chaining approval records sequentially in GOVERNANCE.lock.
- 04
Regulatory Attestation: Attaching legal justification metadata to every approved invariant update.
What cannot be negotiated.
Article IV Governance First: No machine code execution rule can be modified without explicit signed human authorization.
Non-Repudiation: Every approval is tied to a verified cryptographic Ed25519 keypair.
Governance Floor: Approval can only raise security severity levels, never silently lower them.