System architecture

GAL-2 is organized as a modular temporal governance architecture. Public interfaces expose governed outputs and contract behavior. Internal modules coordinate correction, routing, pacing, coherence, and operational continuity without exposing protected implementation details.

Theoretical foundation

GAL-2 is built on a fractal-based theoretical framework that treats time as a governed system property, not merely as a raw hardware signal. The model informs how GAL-2 reasons about continuity, correction, bounded behavior, and safe consumption under degraded or changing timing conditions.

Public documentation focuses on observable behavior and integration semantics. GAL-2 does not publish the protected formula, internal correction implementation, or backend decision logic. The current external product surface is the Time Contract, not a directly callable mathematical formula.

Conceptual flow, public-safe:

input:
  upstream reference context
  last known good GAL-2 state
  local daemon state
  policy limits

internal:
  protected GAL-2 correction and continuity logic
  mode transition logic
  validity and lineage evaluation

output:
  gal2_time
  safe_to_consume
  valid_until
  mode
  reason
  monotonic_sequence
  source_lineage

Installation and integration

GAL-2 is designed to integrate alongside existing timing infrastructure, including GNSS, NTP, PTP, chrony, cloud systems, and enterprise timing stacks. It does not require customers to remove their existing reference layer.

The recommended integration pattern is to run the local GAL-2 Time Contract daemon near the application. Protected application workflows call the local /contract endpoint and use gal2_time only when the contract allows consumption.

curl -s http://127.0.0.1:9095/contract | python3 -m json.tool

Time Contract response

The Time Contract returns governed time and runtime semantics. gal2_time appears first because it is the output the application consumes. The remaining fields explain whether that output is safe, why, until when, and through what lineage.

{
  "gal2_time": "2026-05-14T16:20:30.123456Z",
  "reference_time": "2026-05-14T16:20:30.120000Z",
  "safe_to_consume": true,
  "valid_until": "2026-05-14T16:21:00.123456Z",
  "mode": "LIVE",
  "health": "green",
  "reason": "fresh_api_sync",
  "monotonic_sequence": 1842,
  "source_lineage": ["gal2_api", "gal2_daemon", "contract_v1"]
}

Core fields

Mode behavior

Integration rule

GAL-2 protects consumers of the Time Contract. If an application reads raw system time through another side path and uses it for protected commits, that behavior is outside the GAL-2 protection boundary.

contract = get_time_contract()

if contract.safe_to_consume and current_time() <= contract.valid_until:
    commit_with_timestamp(contract.gal2_time)
else:
    block_or_defer_protected_operation(contract.mode, contract.reason)

API and configuration boundary

Public endpoints are designed for contract consumption, observability, and integration. They do not expose protected correction logic, tuning parameters, private formulas, or authoritative backend decision mechanisms.

Primary local endpoint:
GET http://127.0.0.1:9095/contract

Common local checks:
GET http://127.0.0.1:9095/status
GET http://127.0.0.1:9095/health

On macOS RC3.1, the expected local configuration path is:

/usr/local/gal2/config/daemon.env

Laboratory and validation evidence

GAL-2 validation focuses on application-facing behavior: monotonicity for contract consumers, bounded holdover, controlled rejoin, fail-closed semantics, source lineage, and auditable evidence. Public evidence should not be read as a claim that GAL-2 replaces certified metrology references or improves upstream physical precision.

Performance and benchmarks

GAL-2 performance should be evaluated per deployment. Public benchmark summaries should avoid unsupported precision claims. Serious pilots should measure local daemon latency, contract-call p50 and p95, false-positive rate, holdover behavior, rejoin timeline, and raw application versus GAL-2-aware application behavior under the same impairment.

Comparative analysis

GAL-2 operates in a different layer than traditional synchronization systems. UTC, GNSS, NTP, PTP, chrony, grandmasters, and atomic references help define, discipline, or distribute time. GAL-2 governs how applications consume time before it becomes state.

• UTC and national timing references: provide civil and reference time, but do not define application consumption behavior during local failure, partition, stale reference, or recovery events.
• GNSS: provides high-value timing reference, but can be degraded, jammed, spoofed, unavailable, or operationally unsuitable for direct application trust.
• NTP and chrony: discipline system time, but do not provide application-facing validity, reason, lineage, holdover policy, controlled rejoin, or fail-closed semantics.
• PTP and grandmasters: distribute precise time in controlled environments, but do not replace the need for application-boundary consumption governance.
• GAL-2 Time Contract: provides governed gal2_time and contract semantics so protected applications can continue within policy, rejoin under control, or fail closed.

Real-world use cases

GAL-2 is designed for systems where time becomes state and unsafe timestamps can cause operational, financial, forensic, or distributed-system damage.

Security

GAL-2 is designed to work with modern enterprise security practices and controlled deployment models. Production serving requires a valid API key. Public interfaces expose contract behavior while protected core logic remains server-side.

• Transport security: deployments should use encrypted transport and standard secure networking practices.
• Access control: API access is key-gated and should be integrated with controlled provisioning and rotation practices.
• Integrity: evaluator releases should be distributed with hashes, signatures where available, and clear release scope.
• Protected core: mathematical formulas, backend correction logic, private keys, and internal authority mechanisms are not shipped in public documentation.
• Roadmap attestation: signed Time Contract responses should be described only when implemented and verified.

Standards and compliance boundary

GAL-2 is designed to operate alongside established timing and networking standards. It does not replace NTP, PTP, GNSS, UTC, chrony, atomic clocks, grandmasters, timing receivers, or national metrology references.

For regulated or critical environments, GAL-2 should be evaluated through controlled pilots, documented policies, evidence packages, and separate written agreements before any production-critical use.

Maintenance and versioning

GAL-2 releases should evolve through controlled versioning. Frozen releases should not be modified silently. Any change to schema, behavior, installer, package, signing, daemon semantics, or public contract fields should create a new release marker.

• RC3.1: Limited Availability evaluator release for technical pilots, architecture review, and controlled non-production evaluation.
• Future contract versions: may add stronger attestation, upstream signatures, local audit chain hashes, policy profiles, and expanded validation evidence.
• Deployment policy: customers should define protected operations, false-positive tolerance, fail-closed behavior, and fallback rules before production decisions.

Glossary

• GAL-2: Global Alignment Layer 2, the temporal governance architecture behind the Time Contract.
• Fractal Time: GAL-2's conceptual foundation for governed temporal continuity and correction.
• Time Contract: Runtime object that exposes governed time and consumption semantics to applications.
• gal2_time: The governed timestamp applications consume through GAL-2.
• safe_to_consume: Whether gal2_time is safe under current policy, mode, validity, and lineage.
• HOLDOVER: Bounded continuity from last known good state when upstream reference is unavailable or degraded.
• REJOIN: Controlled reconciliation when the upstream reference returns.
• FAIL_CLOSED: State where GAL-2 can no longer justify safe consumption and protected operations should not proceed through the contract path.
• Temporal Circuit Breaker: Commercial framing for GAL-2 as the layer that prevents unsafe time from silently becoming committed application state.