# Phase 0.8 future bounded-observation permission template

Status: **TEMPLATE ONLY — NOT AUTHORIZED**.

This file is not permission. Empty, `null`, zero, missing, ambiguous, expired,
or inconsistent input means `STOP`. Copying, editing, signing, or committing
the template does not itself authorize a connection, transfer, or execution.
Authorization can exist only through a new exact statement from Jens in the
active task after the proposed method and its complete effect contract have
been reviewed.

The template may describe only a separately named bounded-observation phase.
It cannot authorize installation, rollback creation, lifecycle execution,
autoload, retry, graphics work, or RetroArch work.

## Machine-readable default state

The validator requires every authority value below to remain `false` in the
repository template and every request-specific field to remain unfilled.

<!-- BEGIN PHASE08_BOUNDED_OBSERVATION_TEMPLATE -->
```json
{
  "template_only": true,
  "authorized": false,
  "execution_authorized": false,
  "transfer_authorized": false,
  "installation_authorized": false,
  "lifecycle_authorized": false,
  "automatic_retry": false,
  "required_fields": {
    "exact_user_statement": null,
    "authorization_date": null,
    "expiration_time": null,
    "device_identity": null,
    "exact_purpose": null,
    "exact_observations": null,
    "method_or_collector_id": null,
    "source_commit": null,
    "collector_file_size": null,
    "collector_sha256": null,
    "firmware_gate": null,
    "maximum_runtime_ms": null,
    "maximum_execution_count": null,
    "maximum_transfer_count": null,
    "network_behavior": null,
    "output_channel": null,
    "allowed_volatile_effects": null,
    "prohibited_persistent_effects": null,
    "stop_criteria": null,
    "cleanup_requirements": null,
    "reporting_requirements": null,
    "explicit_installation_exclusion": null,
    "explicit_lifecycle_probe_exclusion": null,
    "explicit_autoload_and_retry_exclusion": null,
    "explicit_graphics_and_retroarch_exclusion": null,
    "revocation_method": null,
    "manual_confirmation_template_does_not_authorize": null
  },
  "fixed_exclusions": {
    "installation": true,
    "lifecycle_probe": true,
    "autoload": true,
    "automatic_retry": true,
    "gnm": true,
    "videoout": true,
    "sdl": true,
    "retroarch": true
  }
}
```
<!-- END PHASE08_BOUNDED_OBSERVATION_TEMPLATE -->

## Required human review fields

Every field below must be supplied in a later review package. Do not fill it
in this repository template.

- Exact user statement:
- Authorization date and timezone:
- Expiration time and timezone:
- Device identity:
- Exact purpose:
- Exact observations:
- Method or collector ID:
- Source repository and commit:
- Collector filename:
- Collector byte size:
- Collector SHA-256:
- Exact firmware gate:
- Maximum runtime:
- Maximum execution count:
- Maximum transfer count:
- Network behavior, addresses, ports, direction, and connection count:
- Output channel and maximum output:
- Exhaustive allowed volatile effects:
- Exhaustive forbidden persistent and functional effects:
- STOP criteria:
- Cleanup requirements:
- Reporting and raw-evidence requirements:
- Explicit installation exclusion:
- Explicit lifecycle-probe exclusion:
- Explicit autoload and retry exclusion:
- Explicit GNM, VideoOut, SDL, and RetroArch exclusion:
- Revocation method and immediate-stop behavior:
- Manual confirmation that this template is not authorization:

No artifact ID, filename, size, SHA-256, path, ABI, syscall, loader contract,
transport, or execution mechanism is implied by these empty fields.

## Mandatory future effect boundary

A future request must enumerate every allowed category-C volatile effect
before authorization. All category-A persistent mutations and category-B
functional mutations remain prohibited unless a different, explicitly
mutating phase is designed and separately authorized.

Unknown behavior, an unspecified effect, an identity mismatch, a partial
dataset, a timeout, an expired authorization, a count overrun, an unexpected
log, or cleanup uncertainty means immediate `STOP` with no automatic retry.

The approved observation count, transfer count, and execution count—if any—
must be literal bounded integers. No value carries into rollback preparation,
installation, lifecycle testing, graphics, or RetroArch.

## Revocation

Jens may revoke a later authorization at any time before or during the
authorized window. Revocation, ambiguity, interruption, or conflicting
instructions causes fail-closed stop. Revocation never triggers cleanup that
was not already explicitly reviewed and authorized.