# CIRCUIT BREAKER SPEC -- Isolation Verifier Response Layer

**Purpose:** State model for Layer 4. Source: Nygard, *Release It!* 2nd ed., Stability Patterns. Implemented for the four-classification response used in I1-I4.

---

## State Machine

Three states per breaker:
- **Closed:** Normal. Assertions evaluate; calls dispatch.
- **Open:** Violation recorded within scope. Calls refuse at call site. No retry, no silent fallback.
- **Half-Open:** Operator acknowledged classification + submitted repair record. A probe tick is permitted. Pass -> Closed; fail -> Open.

**No time-based auto-close.** Auto-close would allow transient violations to self-heal without classification + repair record.

---

## Breaker Scopes

- **Subsystem breaker** (`isolation_breaker_open{plugin,surface}`): violation affects one plugin on one surface (I1/I2/I3) without crossing RAM <-> Evaluator. Only that plugin-surface is blocked.
- **Global breaker** (`isolation_breaker_open{global}`): violation is doctrinal-breach OR integrity-breaking. Blocks ALL Evaluator operations.
- **Verifier self-check breaker** (`isolation_verifier_self_check`): opens when the verifier fails its own chaos self-check (Layer 5 silent-success). Verifier cannot certify any downstream operation.

**Classification -> scope:**
| Classification | Scope |
|---|---|
| Recoverable | Subsystem |
| Blocking | Subsystem |
| Doctrinal-breach | Global |
| Integrity-breaking | Global |

---

## Fail-Fast Contract

On any violation, atomically:
1. Log full state (event, plugin, surface, classification, baseline reference, diff, timestamp).
2. Trip matching breaker (Closed -> Open).
3. Refuse originating call at call site; return violation-reason. No retry, no silent fallback.
4. Publish SLI per Google SRE conventions (`isolation_breaker_open` with labels `plugin`, `surface`, or `global=true`).
5. Increment violation-rate counter; rate-based alarms fire at configurable thresholds.
6. Refuse all Evaluator operations whose scope intersects the open breaker's scope.

**No silent fallback** means: if the verifier cannot evaluate an invariant (primitive unavailable, baseline missing, evidence log broken), that state IS a violation. An unsure verifier = no guarantee = failed guarantee.

---

## Reset Protocol

Reset (Open -> Half-Open -> Closed) requires ALL of:
1. Recorded classification of the violation by an operator.
2. Repair record describing root-cause remediation.
3. Signed reset event, included in the Isolation Verification Report.
4. Successful probe tick. I4 probe = full Merkle recompute. I1/I2/I3 probe = invariant evaluation against a representative call pattern.
5. No silent rebaseline. I4 reset does NOT silently re-snapshot; rebaseline requires its own operator signature and is itself baseline-tracked.

Reset attempts without classification + repair are logged as sycophancy-attempt audit events. NEVER rule: a breaker does not reset because the operator says it is convenient.

---

## SLI / SLO

- **SLI:** `isolation_invariant_pass_rate{invariant_id,plugin,surface}` = fraction of ticks in the recent window that passed.
- **SLO:** 100% pass-rate; any breach consumes error budget.
- **Alarm:** Fires when violation count in the sliding window exceeds threshold (default: any violation).
- **Breaker-state SLI:** `isolation_breaker_state{scope}` emitted continuously so downstream components block on it.

Error-budget semantics are for operational reporting only. They do NOT soften enforcement. The breaker still opens on the first violation regardless of remaining budget.

---

## Audit Log

Every breaker event: `breaker_id`, `scope`, `state_transition`, `timestamp`, `violation_reference`, `actor`, `signature` (required for resets). Baseline-tracked; tampering caught at next I4 recompute.
