orchestrata_ultimate.kernel.pam

Reference › orchestrata_ultimate › kernel › pam

PAM++ enforcement subsystem (decomposed from pam_enforcer).

The PAM++ enforcement subsystem of the kernel package. PAM++ decides authority, ownership, boundary and permission questions about volks by querying Prolog rules in the pam module, and manages the escalations that result when volks conflict. It was split out of a single pam_enforcer module, which remains as the shim pam_enforcer. It serves SPEC-001 story US-003, with the multi-hop escalation tied to story US-005. The curated kernel page shows it beside the other governance engine.

The parts:

• types holds the status enums and result dataclasses that every other module shares.
• enforcer holds PAMEnforcer with validate_authority, check_ownership, enforce_boundary, check_permission, the two delegation methods and the violation log.
• escalation holds EscalationManager, which detects conflicts, builds escalation paths and tracks resolution and timeouts, and MultiHopEscalationManager, which delegates multi-hop work to the governance escalation handler.
• init re-exports the public names.

Control flows from a caller to PAMEnforcer, which sends a query through the Prolog bridge in an executor and converts the answer to a typed result; a failed query counts as a denial, and denials are logged as violations. When a conflict is detected, EscalationManager asks Prolog for the path and priority, creates an EscalationResult and notifies the first authority, falling back to the orchestrator alias U:Ox. The package has no process entry point; callers import the classes. Start with enforcer. The governance package's own decision engine is described at policy_engine.

4 modules, 1,323 lines of code.

Modules

Dependency diagram