Bidirectional synchronization without a shared failure domain.

Current connector state

Contract published. Connector inactive.

Machine state: contract-published-connector-inactive

The Eviulon package publishes its outbound governance manifest and the expected inbound schema. It makes no unsupported claim that Patefacere is currently fetching, acknowledging, or returning data.

Two directions

Eviulon → Patefacere

Publish current public authority, architecture, policy version, effective date, canonical source routes, correction route, and privacy/authority boundaries for Patefacere to consume.

Patefacere → Eviulon

Return a privacy-minimized public statement of Patefacere release identity, accepted Eviulon governance version and hash, public capability state, public schema versions, source route, and correction notices without exposing citizen data.

Transport and verification

• Use allowlisted HTTPS origins and ordinary read-only GET requests for public manifests.
• Require a declared schema version, canonical source route, content type, bounded byte size, timeout, redirect limit, and SHA-256 statement identity.
• Send no browser cookies, private credentials, API secrets, citizen identifiers, or authorization-bearing headers through the public synchronization path.
• Store each accepted observation as an append-only, point-in-time record with retrieval time, source URL, ETag or Last-Modified value when available, bytes, and SHA-256.
• Treat remote content as evidence of what the remote publisher stated, not as self-executing legal authority.

Freshness and last-known-good

• Each side keeps a local, hash-bound last-known-good record and can continue reading its own authoritative public records during remote failure.
• A newer version is accepted only after schema, origin, hash, semantic boundary, and monotonic-version checks pass.
• Stale state is displayed explicitly with last-success time, accepted version, source, and reason; stale data is never silently represented as current.
• Patefacere should pause authority-expanding actions when the governing policy is beyond its declared maximum staleness, while preserving safe access, identity continuity, correction, and appeal paths.

Conflicts and corrections

• Eviulon governs constitutional meaning, public law, civic authority, rights, duties, and corrections to those records.
• Patefacere governs implementation fact and authoritative operational workflow state within delegated authority.
• A mismatch between governance version and operational implementation creates a review record; neither side silently overwrites the other.
• Corrections and supersessions remain append-only, reciprocal, versioned, and linked to the prior record.
• Unresolved conflicts preserve the last-known-good record and route the issue to named human or agent review rather than guessing.

Failure behavior

• Eviulon remains independently deployable and readable; it does not require Patefacere health, a shared database, remote authentication, or client-side fetches to render public governance.
• Patefacere remains independently deployable and may use its last accepted governance bundle within declared staleness limits.
• Remote failure cannot erase the local public record, citizen identity continuity, correction routes, or due-process metadata.
• No shared database or shared runtime failure can take down both public explanation and operational identity administration at once.
• A failed synchronization attempt records the failure locally and leaves the last-known-good accepted version unchanged.

Privacy and authority

• Public manifests contain no citizen records, private credentials, passport contents, private trust receipts, private keys, tokens, personal data, census totals, or passport totals.
• Aggregate census and passport statistics remain unpublished until separately authorized and privacy reviewed.
• Operational identity data remains at Patefacere and is disclosed only through authorized purpose-bound processes, not the public sync feed.
• A database row, credential, passport, trust receipt, valid signature, API response, or implementation fact cannot create sovereign authority by itself.

A successful HTTP response, valid hash, database row, credential, passport, trust receipt, or remote status statement does not create sovereign authority by itself.

Activation requirements

• A Patefacere-side implementation reviewed against this exact contract and its own protected memory.
• Allowlisted origin, schema validation, signature or hash verification, bounded networking, cache, audit, rollback, and conflict handling.
• Reciprocal tests proving no private data leakage, no shared-database dependency, no silent civic mutation, and safe stale-state behavior.
• Explicit owner authority for connector activation and a documented operator responsible for rollback.
• Production evidence from both systems before any public claim that bidirectional synchronization is live.

Machine-readable interfaces

• Synchronization contract API — Canonical contract record.
• Eviulon outbound governance manifest — Current hash-bound public governance bundle for Patefacere.
• Outbound compatibility alias — Byte-identical compatibility alias for the governance manifest.
• Patefacere reciprocal status projection — Local last-known-good public projection; explicitly unavailable until a validated reciprocal statement is imported.
• Expected Patefacere inbound schema — Schema and acceptance contract only; not live Patefacere telemetry.
• Agent discovery record — Compact orientation and operational handoff.

The expected inbound contract is a schema and acceptance boundary, not fabricated Patefacere telemetry.