MARK V CONFORMANCE — SHALL STATEMENTS + SAMPLE VECTORS (WIP 0.2.0)
================================================================================
Supersedes: shall-v0.1.txt (0.1.1) for SPEC_VERSION 0.2.x
Cross-check: RFC draft, ball-fsm, sync-lifecycle, hitl-fsm,
  openapi/mark-v-station-v0.2.yaml, design/AUTH_BOUNDARY_V1.md, BLAST_POLICY_V1.md
Ball process: Define · Design · Deploy
Law: Create No Victims; features never redefine CORE; victim-trace target 0

AUTH BOUNDARY (M5-CONF-012) — NORMATIVE
  An execution allowlist SHALL NOT by itself establish ALLOWLIST grant provenance.
  A station SHALL separately establish the requested operation is classified LOW_BLAST
    under the station's normative blast policy before ALLOWLIST may serve as grant provenance.
  UNKNOWN or unclassified blast SHALL NOT be implicitly treated as LOW_BLAST.
  HIGH_BLAST SHALL require CATCHER grant provenance.
  Authority (Catcher/PWS grant) SHALL NOT be confused with execution permission for every mechanism.

PROFILE_MINIMAL
  SHALL load tip fields sync_code + silicon_rev before claiming sync
  SHALL treat features as non-authoritative over CORE law
  SHALL refuse to store secrets in MU body
  SHALL support append-only audit events (file or API)

PROFILE_STATION
  SHALL expose organ map for BIOS CORE HABITS MU SU ROLODEX FORGES
  SHALL implement SU distinct from MU
  SHALL implement MU as durable tagged permanent memory beyond session
  SHOULD separate Live Ball records from Touchdown lineage artifacts (ball/README_LINEAGE.md)

PROFILE_MESH
  SHALL use allowlisted message verbs only (no free SQL)
  SHALL advertise sync_code on send when known
  SHALL NOT place portal tokens in MU bodies/logs

PROFILE_SPAA
  SHALL NOT run LLM mind on idle heartbeat poll
  SHALL use Execution Allowlist for mechanism (class+path+interpreter)
  SHALL apply Blast Policy before ALLOWLIST provenance
  SHALL separate HITL ACK from NODE_READY if glass present

HITL (if glass)
  SHALL NOT clobber cpq_current on ACK (last_ack only)
  SHALL distinguish ACK, INGESTED, NODE_READY

BALL / GRANT
  SHALL treat Ball as grant-scoped work object
  SHALL NOT perform high-blast EXEC unless grant_provenance = CATCHER
    (and Ball authorized state when Ball is tracked)
  SHALL record grant_provenance when entering GRANTED: CATCHER | ALLOWLIST
  SHALL reject illegal Ball transitions; state unchanged
  SHALL bind Ball to objective_id when ORDS packet exists
  SHOULD implement phase DEFINE | DESIGN | DEPLOY
  READY (sync) SHALL NOT alone mean high-blast executable

DECODER RING
  SHOULD record DecoderRingProbe results
  SHOULD treat MELD_FAIL as SEMANTIC_DRIFT caution even if wire OK

VICTIM / LAW
  SHALL target victim-trace = 0
  SHALL NOT treat Create No Victims as rewritable by FEATURE

--------------------------------------------------------------------------------
SAMPLE VECTORS
--------------------------------------------------------------------------------
V-ALLOWLIST-LOW-POS
  Given: operation is execution-allowlisted AND authoritatively LOW_BLAST
  Expect: execution may proceed; grant_provenance candidate = ALLOWLIST

V-ALLOWLIST-HIGH-NEG
  Given: operation is execution-allowlisted AND HIGH_BLAST AND Ball not CATCHER-granted
  Expect: execution MUST NOT occur

V-ALLOWLIST-UNKNOWN-NEG
  Given: operation is execution-allowlisted AND blast = UNKNOWN
  Expect: station MUST NOT infer LOW_BLAST; ALLOWLIST provenance MUST NOT be awarded

V-MU-SECRET-NEG
  Input: MU create with secrets in body
  Expect: reject; no store

V-CORE-FEATURE-NEG
  Input: feature redefines Create No Victims
  Expect: NON-CONFORMANT

V-HITL-ACK-POS
  Given: ACK while cpq_current active
  Expect: last_ack written; cpq_current body unchanged

V-BALL-HIGHBLAST-NEG
  Given: Ball not CATCHER-authorized for high-blast
  When: high-blast EXEC
  Then: no execution; audit preferred

V-BALL-ILLEGAL-TRANSITION-NEG
  Given: PROPOSED
  When: transition TOUCHDOWN
  Then: reject; state remains PROPOSED

V-BALL-GRANT-PROVENANCE-POS
  Given: SCOPED enters GRANTED via Catcher
  Expect: grant_provenance = CATCHER; audit can answer why

V-BALL-OBJECTIVE-BIND
  Given: ORDS objective_id O exists and Ball B authorized for O
  Expect: B.objective_id = O through transitions

V-BALL-GRACE-TTL (if GRACE)
  TTL valid → resume; expired → BLOCKED/PARKED with audit

V-SYNC-CONFIRM-POS
  High-blast without tip load → SYNC_CONFIRM or DEGRADED (not silent READY exec)

V-SYNC-ABSENCE
  MessageSend without sync_code → documented absence policy (inherit|reject|DEGRADED), not silent success without policy

V-DR-MU-1
  Probe: what never in MU body → secrets/tokens

END shall-v0.2.0
================================================================================