# Evolution 16 — mission contract specification

The contract is the existing `MissionSpec` (Evolution 8): objective, success criteria, prohibited outcomes, resource
scope, data classifications, participating agents, allowed action classes, required approvals, twelve budget
dimensions including `max_delegation_depth`, required evidence, environmental assumptions, failure policy, policy
versions, expiry, cancellation conditions. Evolution 16 does not add fields. It adds **versions**.

## Records

| Record | Signed by | Domain |
|---|---|---|
| Mission version | mission authority key | `CAIN42/MISSION-CONTROL/MISSION-SPEC/v1` |
| Succession `{mission_id, seq, prev_digest, new_digest, at}` | mission authority key | `CAIN42/EVOLUTION16/MISSION-SUCCESSION/v1` |
| Widening approval `{approver, mission_id, seq, prev_digest, new_digest, widened[]}` | the mission **principal's** key | `CAIN42/EVOLUTION16/MISSION-SUCCESSION-APPROVAL/v1` |
| Plan bound to the new version's digest | a plan authority key | `CAIN42/MISSION-CONTROL/MISSION-PLAN/v1` |
| Cancellation `{approver, cancel, reason}` | principal or a required approver | `…/PLAN-AMENDMENT-APPROVAL/v1/CANCEL` |

## Rules for installing a version (`update_mission`), in order

1. A cancelled mission accepts no version.
2. The new mission verifies under the pinned mission authority key and is not expired.
3. The succession verifies under the same key and names this mission and exactly this new digest.
4. The new digest was never installed before (**no rollback**, even with a fresh approval).
5. The succession names the current head and `seq = head + 1` (**compare-and-swap**; a writer on a stale base loses).
6. The new mission passes `validate_mission`.
7. `mission_id`, `tenant` and `principal` are unchanged (otherwise it is a different mission).
8. The change is classified. If anything widened, the principal's approval must verify over the **exact** computed
   list, and the principal's key must not be the mission authority's key.
9. A plan bound to the new digest verifies, has a higher version, leaves every already-started action byte-identical,
   and every not-yet-started action is inside the new contract's classes and scope.

On success: delegations are re-validated against the new contract and dropped if they no longer fit; budget already
used is carried over even above a lowered limit; admissions not yet dispatched are void and must be requested again.

## Classification (`classify_mission_update`)

| Field | Widening | Narrowing |
|---|---|---|
| `resource_scope` | a pattern not inside any old pattern | an old pattern no longer covered |
| `allowed_action_classes`, `data_classifications`, `participating_agents`, `policy_versions` | member added | member removed |
| `required_approvals`, `required_evidence`, `cancellation_conditions`, `environmental_assumptions`, `dependencies` | member **removed** | member added |
| each budget dimension | raised | lowered |
| `expires_at` | later | earlier |
| `prohibited_outcomes` | removed, or severity lowered | added |
| `objective`, `success_criteria` | any change | — |
| `failure_policy` | any change except to `ABORT` | change to `ABORT` |

`EXPANDING` if anything widened, else `RESTRICTING` if anything narrowed, else `NEUTRAL`. The classifier is
deterministic and uses no model. The verifier carries a second implementation; a test compares the two on 400 random
changes.

## What binds an action to a version

An admission records the mission digest and contract sequence in force. `execute()` refuses if the head has moved.
The `TX_INTENT` entry carries the mission digest, contract sequence, plan-action digest, canonical action digest,
authorization id and digest, and the sequence number of the decision that admitted it.

## Required behaviours and where they are tested

| Requirement | Test |
|---|---|
| stale contract | `concurrent_updates_on_a_stale_base` |
| concurrent updates | `test_concurrent_contract_updates_install_exactly_one` (6 threads) |
| replay of a request or authorization | `captured_request_replayed_after_restart`, `captured_admission_replayed_after_reconciliation` |
| version rollback | `contract_version_rollback` |
| conflicting objectives | objective or criteria change is always EXPANDING; `MissionSpec` validation already rejects a criterion that equals a prohibition |
| expired budget | existing budget ledger; carried across versions |
| missing preconditions | existing Evolution 15 rule; plus `human_retracts_an_environment_fact` (F16-02) and `evidence_older_than_its_validity` |
| cancellation races | `test_no_dispatch_is_journaled_after_a_cancellation_whatever_the_interleaving` |
| an LLM must not author policy or approve its own widening | approvals verify only under pinned human keys; `widening_update_without_the_principal` tries the authority key, an agent key and an approval for another change |

## Not specified here

Uncertainty thresholds, preconditions and postconditions per action, and human-approval rules per action are the
plan's and the supervisor's (Evolution 8 and 15) and are unchanged. There is no multi-principal mission, no quorum of
approvers and no contract negotiation between organisations.