Privileged Access Provisioning — history

The dated record of how Privileged Access Provisioning got here, moved out of the spec on 2026-10-21 because a reader does not need it to use the spec today. The spec keeps every section spec-format.md requires and its Deleted: tombstones; everything smaller is in git log -- compositions/privileged-access-provisioning.md.

Decisions

Entries that record a migration rather than a turn the pattern took.

• 2026-09-23 — Rewritten in GRACE lang v0.61; forty-four of forty-five open Ledger lines closed by the rules that now own them. Chose: Composes, Composition state, Capability requirement — which takes the prose’s Configuration and Logic confinement both — Primitive policy, Action wiring, Wiring decision and Reconciliation as the surfaces, with Provisioning cascade and Scope vocabulary kept as the page’s own; the prose’s Behavior section distributed to the rules that own each claim; invariant numbers 1 through 10 unchanged; the checks renumbered Check 1.1 through Check 6.5; Non-goals and Edge cases split, with Clock semantics, Concurrency, Expiry and Multi-use capabilities under the second. The choices the lines left open, made by standing rules: the credential checked before the request is resolved, closing the unauthenticated existence oracle and declaring the authenticated residual (2026-08-28-j); the exercise ordered before its provisioning event declared lawful rather than gated, since a delivered token is lawful access (2026-08-28-h); the session check stated existentially, since the record names the principal and no session identifier (2026-08-28-m); the decision event and the credential check kept, with what each adds stated — the request-keyed record and the second registry (2026-08-28-n); the one-credential-two-registries assumption declared (2026-08-28-a); the blank-reason denial’s entry closed by a recovery record carrying the reason, or by the horizon (2026-08-28-c); a chain found under a request already Withdrawn closed and reported, not recorded (2026-08-27-p); the substrate’s refusals over a possibly committed decision routed to an evaluation entry (2026-08-26-b); a read_chain refusal inside the evaluation answered with the decision and an evaluation entry (2026-08-26-a); the token’s deadline restated as Capability’s reading plus the remaining ttl, since allocate takes a duration (2026-08-27-j). The rest took their prescribed fixes — the terminal-event walk from the tail, read_record’s real arms, the chain shape validated at intake, the token resolved by Capability’s read on the token with redeem not called on a miss, the credential second in every signature, the third Permissions call site, the cascading-revocation qualifier carried, Provisioned advancing to Revoked, the provisioning event carrying the redemption count and the expiry instant, the chain-less skip, the counts, the examples’ quorum vocabulary, material and Assignment attribution. Over: the prose spec. Because: the migration plan, and the standing rule that a migration closes a line only where a rule now owns what the line asked for. The model line stays open (2026-08-29-a).