Python can request. It cannot define the authority.

This experiment narrows the runtime claim to one operation: publishing exact bytes for one object at one expected version.

12 + 4

Executable checks

HTTP self-test covers publication, replay, stale version, forged intent, malformed input, and receipts. Unit tests cover transaction rollback, reopen survival, authority mismatch, and concurrent replay.

Governed operation

The experiment does not generalize from publication to arbitrary filesystem or network effects.

Private keys at requester

The authority signs the intent before the requester sees it. The service verifies with a public key.

State transition

available intent
  exact content digest
  expected version
  valid signature
  -> durable prepared record
  -> atomic current pointer
  -> committed receipt

replay, altered content, forged authority, stale version
  -> refused before publication

What this establishes

A precise local guarantee.

Within this service model, every committed publication carries the signed object, exact content, and expected predecessor version named by its intent. The current executable evidence is 12 HTTP self-test checks plus 4 transaction tests.

The reference service is still Python. The experiment does not prove Python, the cryptography library, the filesystem, the operating system, crash behavior on every platform, or container isolation. It shows the right shape of the claim and gives the next refinement target a testable boundary.

Next refinement

Move the effect authority behind the process boundary.

Run the service with the governed volume and authority verifier. Give the Python requester only a Unix socket. Then replace the reference service with a small compiled effect daemon and prove the transition correspondence.

The full experiment source and tests are kept with the Site source under closure-experiment/. The published main page cites the current deployment-hardening run separately, because that evidence belongs to DARM Guard commit 8e4a045.