{"row":{"id":"ADR-134","title":"Trust is a rung, never a word: declared · discovered · observed on every access lane","file":"adr-134-trust-is-a-rung-never-a-word.md","status":"accepted","date":"2026-09-04","cites":0,"supersedes":[],"superseded_by":[],"layers":["L0","L2","L3","L4"],"tags":["architecture","access","trust","one-door"],"room":true},"pin":{"release_tag":"v0.118.7","commit":"f3a31a6ee00766e4b010379c535bca994631d637"}}

[{"k":"h","depth":1,"text":"ADR-134 · Trust is a rung, never a word","id":"adr-134--trust-is-a-rung-never-a-word"},{"k":"list","ordered":false,"items":[[{"k":"text","text":"Status: accepted"}],[{"k":"text","text":"Date: 2026-09-04"}],[{"k":"text","text":"Deciders: the one-door program (OD-F8)"}],[{"k":"text","text":"Related: ADR-128 (settlement · unknown cost ≠ zero), ADR-132 (identity · idempotency · protocol), #1253"}]]},{"k":"h","depth":2,"text":"Context","id":"context"},{"k":"p","inline":[{"k":"text","text":"The access plan names the path that serves a model ("},{"k":"code","text":"access"},{"k":"text","text":" · "},{"k":"code","text":"chosen"},{"k":"text","text":" · "},{"k":"code","text":"billing"},{"k":"text","text":" · "},{"k":"code","text":"pinned"},{"k":"text","text":" · the rejected and outranked candidates) and every door carries the same row. What no row said was how far that path's IDENTITY is proven. A harness seat is admitted by PATH presence (#1253 measured an eight-line fake "},{"k":"code","text":"codex"},{"k":"text","text":" believed with full user rights); an API key in the environment is a key, not a working one until something dials; a keyless local server is a profile line until it is pinged. The human lines said « seat present » and « key present · not validated » — true words, in prose, on one surface. The machine rows said nothing, and a reader could take « the seat is present » for « the seat is who it says »."}]},{"k":"h","depth":2,"text":"Decision","id":"decision"},{"k":"list","ordered":true,"items":[[{"k":"strong","text":"A rung on the plan."},{"k":"text","text":" "},{"k":"code","text":"nika_types::access::Trust { Declared, Discovered, Observed }"},{"k":"text","text":" (ordered · "},{"k":"code","text":"#[non_exhaustive]"},{"k":"text","text":") on "},{"k":"code","text":"AccessPlan.trust"},{"k":"text","text":", defaulting to the floor ("},{"k":"code","text":"Declared"},{"k":"text","text":") and raised only by evidence: "},{"k":"code","text":"Trust::from_evidence(class, configured, reachable)"},{"k":"text","text":" gives "},{"k":"code","text":"Observed"},{"k":"text","text":" to a probe that answered ("},{"k":"code","text":"doctor --ping"},{"k":"text","text":") and to the in-crate mock, "},{"k":"code","text":"Discovered"},{"k":"text","text":" to a key or a seat found on this machine, "},{"k":"code","text":"Declared"},{"k":"text","text":" to a keyless local path nobody pinged and to anything unconfigured."}],[{"k":"strong","text":"The candidate carries it, the plan inherits it."},{"k":"text","text":" The resolver never invents a rung: the chosen candidate's "},{"k":"code","text":"trust"},{"k":"text","text":" becomes the plan's; a pinned seat is "},{"k":"code","text":"discovered"},{"k":"text","text":" (the pin refuses when the binary is absent, and nothing dialed it)."}],[{"k":"strong","text":"Every wire row says it."},{"k":"text","text":" "},{"k":"code","text":"lane_rows"},{"k":"text","text":" adds "},{"k":"code","text":"trust"},{"k":"text","text":" beside "},{"k":"code","text":"billing"},{"k":"text","text":" (a refused lane says "},{"k":"code","text":"trust: null"},{"k":"text","text":": no path serves, its rejected candidates carry their own witnesses; a consumer never reads a missing key as a rung) — "},{"k":"code","text":"check --json"},{"k":"text","text":" · "},{"k":"code","text":"run --dry-run --json"},{"k":"text","text":" · the trace boot manifest · the resident's check summary — and the two human lines ("},{"k":"code","text":"check"},{"k":"text","text":"'s access rung · "},{"k":"code","text":"run"},{"k":"text","text":"'s announce) print the rung word in the same parenthesis as the class and the billing."}],[{"k":"strong","text":"`attested` is reserved, not named."},{"k":"text","text":" No path in this build proves an identity (a handshake, a hash, a signed seat); a variant nobody can reach would be a word above the proof. When #1253's confinement half lands, the enum grows additively."}]]},{"k":"h","depth":2,"text":"Consequences","id":"consequences"},{"k":"list","ordered":false,"items":[[{"k":"text","text":"A reader of any door can rank paths by proof and never mistake presence for identity; the wording tests pin that no rung is claimed above its evidence."}],[{"k":"code","text":"AccessPlan"},{"k":"text","text":" and "},{"k":"code","text":"AccessCandidate"},{"k":"text","text":" gain a field (both "},{"k":"code","text":"#[non_exhaustive]"},{"k":"text","text":" · construction goes through "},{"k":"code","text":"new"},{"k":"text","text":" + "},{"k":"code","text":"with_trust"},{"k":"text","text":"); the SDK's lane type learns "},{"k":"code","text":"trust"},{"k":"text","text":" in the 0.118 client (OD-F9)."}],[{"k":"text","text":"The confinement of seats (#1253's execution half) stays out of scope: this ADR makes the plan honest about what it knows, it does not make a fake seat harmless."}]]}]

ADR-134

Trust is a rung, never a word: declared · discovered · observed on every access lane

accepted · 2026-09-04 · L0 L2 L3 L4

ADR-134 · Trust is a rung, never a word #

Status: accepted
Date: 2026-09-04
Deciders: the one-door program (OD-F8)
Related: ADR-128 (settlement · unknown cost ≠ zero), ADR-132 (identity · idempotency · protocol), #1253

Context #

The access plan names the path that serves a model (access · chosen · billing · pinned · the rejected and outranked candidates) and every door carries the same row. What no row said was how far that path's IDENTITY is proven. A harness seat is admitted by PATH presence (#1253 measured an eight-line fake codex believed with full user rights); an API key in the environment is a key, not a working one until something dials; a keyless local server is a profile line until it is pinged. The human lines said « seat present » and « key present · not validated » — true words, in prose, on one surface. The machine rows said nothing, and a reader could take « the seat is present » for « the seat is who it says ».

Decision #

A rung on the plan. nika_types::access::Trust { Declared, Discovered, Observed } (ordered · #[non_exhaustive]) on AccessPlan.trust, defaulting to the floor (Declared) and raised only by evidence: Trust::from_evidence(class, configured, reachable) gives Observed to a probe that answered (doctor --ping) and to the in-crate mock, Discovered to a key or a seat found on this machine, Declared to a keyless local path nobody pinged and to anything unconfigured.
The candidate carries it, the plan inherits it. The resolver never invents a rung: the chosen candidate's trust becomes the plan's; a pinned seat is discovered (the pin refuses when the binary is absent, and nothing dialed it).
Every wire row says it. lane_rows adds trust beside billing (a refused lane says trust: null: no path serves, its rejected candidates carry their own witnesses; a consumer never reads a missing key as a rung) — check --json · run --dry-run --json · the trace boot manifest · the resident's check summary — and the two human lines (check's access rung · run's announce) print the rung word in the same parenthesis as the class and the billing.
`attested` is reserved, not named. No path in this build proves an identity (a handshake, a hash, a signed seat); a variant nobody can reach would be a word above the proof. When #1253's confinement half lands, the enum grows additively.

Consequences #

A reader of any door can rank paths by proof and never mistake presence for identity; the wording tests pin that no rung is claimed above its evidence.
AccessPlan and AccessCandidate gain a field (both #[non_exhaustive] · construction goes through new + with_trust); the SDK's lane type learns trust in the 0.118 client (OD-F9).
The confinement of seats (#1253's execution half) stays out of scope: this ADR makes the plan honest about what it knows, it does not make a fake seat harmless.

read at v0.118.7 · the decision record ships with the engine

Every decision, with its status This one in the repo