Define bounded local owner continuation candidate

docs/source-packets/README.md

@@ -14,6 +14,9 @@ the normal RFC, schema, profile, and fixture process.
 - [WITS v0 accountable continuation source packet](wits-v0/accountable-continuation-v0.3-draft.md)
   for HACP v0.3 candidate consumption receipts, successor invocation evidence,
   and fail-closed continuation boundaries.
+- [Local owner continuation profile candidate](wits-v0/local-owner-profile.md)
+  narrows the approved local verifier/issuer/start policy; implementation proof
+  and explicit acceptance remain separate gates.
 
 ## Boundaries
 

docs/source-packets/wits-v0/accountable-continuation-v0.3-draft.md

@@ -2,6 +2,12 @@
 
 Status: HACP v0.3 candidate source packet.
 
+The [local owner profile candidate](local-owner-profile.md) is a separately
+pinned, narrow application of the owner's verifier/issuer/start policy. It does
+not resolve policy for every possible continuation profile or establish
+implementation proof. The illustrative sketches below remain historical
+candidate shapes, not interchangeable records for that local profile.
+
 Source material:
 
 - [WITS v0 HACP source packet](../wits-v0-hacp-source-packet.md);

docs/source-packets/wits-v0/local-owner-profile-fixtures.json

@@ -0,0 +1,53 @@
+{
+  "kind": "hacp.candidate_fixture_inventory",
+  "profileId": "org.hacp.local-owner-continuation",
+  "profileVersion": "0.1-candidate",
+  "status": "required_observations_not_completed_proof",
+  "cases": [
+    { "id": "authenticated-happy-path", "expected": "one durable claim and start intent, one dry-run observation, separate result" },
+    { "id": "missing-or-wrong-authentication", "expected": "access denied before protected read, mutation or observation" },
+    { "id": "authenticated-without-human-act", "expected": "MISSING_AUTHORITY, authentication alone records no decision and enables no observation" },
+    { "id": "unrelated-or-reused-human-act", "expected": "MISSING_AUTHORITY, event must bind this decision, packet and exact action" },
+    { "id": "base-approve-without-start-work", "expected": "MISSING_AUTHORITY, approve_next_packet does not authorize candidate observation" },
+    { "id": "invalid-base-transition-or-target", "expected": "rejected by closed base schema and matrix checks, no candidate mutation" },
+    { "id": "caller-forged-issuer-or-actor", "expected": "rejected, configured identity cannot be overridden" },
+    { "id": "two-overlapping-claims", "expected": "one issuer/decision slot, one winner, competing successor denied" },
+    { "id": "same-id-different-issuer", "expected": "separate configured issuer slots; no cross-issuer access or caller reassignment" },
+    { "id": "changed-binding-replay", "expected": "conflict for changed digest/request/action/expiry/profile/successor on both replay paths" },
+    { "id": "exact-claim-retry", "expected": "identical readback only, no second start or new expiry" },
+    { "id": "legacy-id-collision", "expected": "new-profile admission denied without modifying historical receipt" },
+    { "id": "legacy-insert-races-profile-admission", "expected": "one serialized namespace outcome; collision denies candidate and no duplicate decision ID exists" },
+    { "id": "unknown-profile-or-stripped-context", "expected": "no fallback, MISSING_AUTHORITY" },
+    { "id": "unsupported-action-or-parameter", "expected": "SCOPE_CONFLICT, no observation" },
+    { "id": "missing-or-corrupt-durable-readback", "expected": "denied before start intent/observation" },
+    { "id": "absent-or-corrupt-status", "expected": "UNVERIFIED_ASSUMPTION, no observation" },
+    { "id": "status-gap-fork-truncation-or-wrong-head", "expected": "UNVERIFIED_ASSUMPTION for each history defect, no observation" },
+    { "id": "decision-expired-claim-active", "expected": "STALE_PACKET, no observation" },
+    { "id": "claim-expired-decision-active", "expected": "STALE_PACKET, no observation" },
+    { "id": "decision-revoked-claim-active", "expected": "STALE_PACKET, no observation" },
+    { "id": "claim-revoked-decision-active", "expected": "STALE_PACKET, no observation" },
+    { "id": "missing-or-malformed-expiry", "expected": "decision and claim variants rejected before admission" },
+    { "id": "claim-expiry-exceeds-decision", "expected": "rejected before claim admission" },
+    { "id": "expiry-after-lock-wait", "expected": "STALE_PACKET, no observation" },
+    { "id": "expiry-between-intent-and-handoff", "expected": "STALE_PACKET, retained intent, no observation or retry" },
+    { "id": "revocation-before-handoff", "expected": "STALE_PACKET, zero observation, serialized status order evidenced" },
+    { "id": "concurrent-revoke-start", "expected": "order visible; earlier revocation wins; no later work enabled" },
+    { "id": "two-overlapping-starts", "expected": "one durable intent and at most one dry-run observation; loser stops with retained state" },
+    { "id": "clock-rollback-or-unknown-time", "expected": "UNVERIFIED_ASSUMPTION, no observation" },
+    { "id": "wall-clock-stall-crosses-monotonic-deadline", "expected": "STALE_PACKET when monotonic deadline is reached even if wallTime remains before expiry, no observation" },
+    { "id": "restart-after-claim-before-intent", "expected": "historical readback only, HUMAN_DECISION_REQUIRED, no start or automatic continuation" },
+    { "id": "crash-after-intent-before-result", "expected": "reopen retains intent, HUMAN_DECISION_REQUIRED, no automatic observation" },
+    { "id": "lost-response-or-ambiguous-observation", "expected": "durable uncertainty, HUMAN_DECISION_REQUIRED, no automatic retry" },
+    { "id": "completed-start-replay", "expected": "historical readback only, no second observation" },
+    { "id": "store-unavailable", "expected": "ENVIRONMENT_BLOCKED, no observation" },
+    { "id": "revoked-status-reset", "expected": "rejected, terminal revocation and original slot preserved" },
+    { "id": "digest-known-answer-and-domain-mismatch", "expected": "published vector matches; omitted/changed domain and alternate preimage fail" },
+    { "id": "profile-declaration-status", "expected": "active exact-pin candidate may be explicitly selected; missing, changed, deprecated or revoked declaration is rejected" },
+    { "id": "clock-sample-shape", "expected": "only wallTime plus canonical decimal-string monotonicNanoseconds accepted; extra members and alternate numeric forms fail" },
+    { "id": "observation-digest-completed-or-uncertain", "expected": "completed binds the exact fixed observation envelope; uncertain requires null and makes no observation claim" },
+    { "id": "base-decision-companion-digest", "expected": "detached candidate domain binds the complete unchanged base record; mismatch fails without claiming a native base digest" },
+    { "id": "closed-base-record-remains-unchanged", "expected": "candidate context is separate and base schema still validates without extension fields" },
+    { "id": "unsupported-surface-no-fallback", "expected": "legacy console, provider loop, HTTP service and callback dispatch cannot invoke candidate start" }
+  ],
+  "boundary": "Inventory only; no fixture grants approval, runs a provider, launches work or proves release readiness."
+}

docs/source-packets/wits-v0/local-owner-profile-review-synthesis.md

@@ -0,0 +1,78 @@
+# Local Owner Continuation Review Synthesis
+
+Status: bounded candidate review evidence, not release approval.
+
+## Reviewed Pin
+
+- Candidate commit: `f4df7be755569f1c5f4c2ab6925fe0be62cad066`
+- Profile SHA-256: `1c358c5d058fade2723cd02e1dbd3bbb7f9134cfb7f3e3988c35051eaaf001b1`
+- Fixture inventory SHA-256: `4b954d85cac1ccd2ee9f592672599cac5104a3cac9e3e0aa80da79ebf06a02bb`
+- HACP base: `3ada8c8e86dc181df4f954204eaba2b5426f47f2`
+- who-decides reference: `99a256dd870b723b38d1b6b287dd4279f8a72fdf`
+
+Two fresh Codex review contexts independently read those exact pins. Neither
+received the other review, edited files, called providers, or mutated GitHub.
+
+## Synthesis
+
+Both reviewers found no P1. Both independently found P2 gaps in:
+
+- verification that a human act and closed-base decision authorize this exact
+  packet and action;
+- deterministic domain-separated digest preimages and record/status contracts;
+- explicit negative and concurrency observations for authority and one-shot
+  behavior.
+
+One reviewer separately classified the clock acceptance rule as a P2. The other
+called clock trust an unresolved implementation obligation rather than a
+separate finding. This is a classification difference, not evidence that the
+old rule was executable.
+
+Both agreed the bounded architecture is coherent, the guard must span durable
+intent through immediate local handoff, issuer plus decision ID is the slot,
+legacy collisions must fail closed, and no new owner decision is needed for the
+minimal repairs. Neither review established implementation, runtime proof,
+external exactly-once effects, profile conformance, release readiness, or human
+acceptance.
+
+## Disposition
+
+The follow-up candidate:
+
+- requires a valid base `start_work` human decision for the same packet and
+  exact action, and treats the dry-run as observation rather than a lifecycle
+  transition;
+- fixes the UTF-8 JCS digest envelope and known-answer vector;
+- defines a candidate-owned detached digest for the unchanged closed base
+  decision, which has no native digest declaration;
+- closes the fixed action and minimal record contracts;
+- defines initial status, predecessor ordering and authoritative heads;
+- defines local wall/monotonic clock checks with no grace period;
+- adds distinct authority, expiry, revocation, status-integrity, restart,
+  start-race, legacy-race, digest and unsupported-surface observations.
+
+Hosted review on PR #43 additionally required the RFC-0009 `active` declaration,
+closed clock-sample representation, deterministic completed/uncertain
+observation digest, and one restart rule. Those repairs retain explicit owner
+selection, use canonical decimal-string monotonic nanoseconds, assert no digest
+for an uncertain observation, and route every restart to human inspection.
+Fresh-head Codex review then identified a contradictory clock sentence; the
+final repair assigns the acquisition sample to the post-lock check and the
+second sample to the immediate pre-observation recheck.
+An additional exact-head review found that an uncorrelated monotonic sample
+could not catch a stalled wall clock. The contract now records a monotonic
+expiry deadline derived at acquisition and rejects the observation when either
+the wall expiry or monotonic deadline is reached.
+
+These dispositions preserve the approved policy. Delegation, remote trust,
+external dispatch, automatic recovery/reexecution, migration and relaxed clock
+acceptance remain unsupported and would require separate owner decisions.
+
+## Residual Risk
+
+The repaired text and inventory are specifications only. Candidate support
+still requires a same-pin implementation, executable schemas/fixtures, observed
+serialization and crash evidence, independent proof readback, and human proof
+acceptance. Two reviews from the same tool family are independent architecture
+reviews for this bounded pass; they are not a cross-tool ship gate or release
+authority.