Your timing stack delivers time. GAL-2 adds a governed application layer: the GAL-2 API creates GAL-2 Time, the GAL-2 Node makes it locally consumable, and the Time Contract governs when it is safe to use.
Keep your timing stack. Install the GAL-2 Node. Connect the application once.
GAL-2 Node
GAL-2 Node makes GAL-2 Time locally consumable without replacing your existing timing infrastructure.
The GAL-2 API creates GAL-2 Time. The Node receives that governed trajectory, maintains the local application-consumption path, and exposes the Time Contract, shared-memory publication, and SDK Provider interfaces. The Time Contract governs whether the enrolled application should use that time.
The protected GAL-2 system creates the upstream governed GAL-2 trajectory.
The Node makes GAL-2 Time locally consumable beside the enrolled application.
The application receives an explicit safety decision before time becomes trusted state.
Current Release
The current signed limited release is available for Linux ARM64. macOS Apple Silicon is the next planned native Node platform.
Product Architecture
GAL-2 Node sits beside the application. It does not replace NTP, PTP, GNSS, chrony, grandmasters, timing appliances, atomic references, or the host system clock.
Creates GAL-2 Time and delivers it to an entitled Node.
Maintains the local consumption surface, continuity state, uncertainty, recovery behavior, SHM, and Provider delivery.
Tells the enrolled application whether the current GAL-2 publication is safe to consume.
What the Node does
GAL-2 Node centralizes the application-facing continuity logic that software would otherwise have to build and audit itself.
Makes GAL-2 Time available locally instead of requiring every application read to call the upstream API.
When fresh upstream synchronization is unavailable, the Node may continue from the last valid GAL-2 state under declared policy.
Makes continuity risk explicit instead of presenting stale application time as though nothing changed.
Fresh GAL-2 synchronization can return directly to LIVE when safe, or pass through controlled REJOIN when reconciliation is required.
When safe consumption can no longer be justified, the protected path refuses instead of silently accepting unsafe time.
GAL-2 Node does not discipline or steer the host system clock. Non-enrolled workloads continue using their existing timing path.
Local Consumption
Inspect application-facing state locally through http://127.0.0.1:9095/contract .
Node-managed SHM provides a low-overhead local publication path for enrolled consumers.
Applications can consume through the Node-supplied Provider and receive GAL-2 Time or an explicit typed unsafe/error result.
curl -s http://127.0.0.1:9095/contract | python3 -m json.tool
Time Contract
The Time Contract exposes the decision and the context behind it: GAL-2 Time, safety, validity, reason, continuity state, uncertainty, holdover age, sequence, and lineage.
{
"gal2_time": "...",
"safe_to_consume": true,
"mode": "LIVE",
"reason": "fresh_api_sync",
"valid_until": "...",
"uncertainty_ms": ...,
"holdover_age_sec": ...,
"monotonic_sequence": ...,
"source_lineage": [...]
}
Application logic should not infer safety from mode alone. The Time Contract's safe_to_consume decision governs the enrolled GAL-2 application path.
Continuity
HOLDOVER is not raw host time and it is not naive timestamp continuation. The Node continues from the last valid GAL-2 state only while declared policy permits it. When that justification ends, the protected path fails closed.
Policy
The standard Node profile defines bounded operational policy. Customer deployments may select a stricter operational response based on their application, risk, or compliance requirements.
Standard declared soft continuity boundary.
Standard maximum declared policy boundary, subject to safety and uncertainty.
Standard Node synchronization cadence.
The 72-hour hard limit does not mean GAL-2 promises that safe_to_consume will remain true for 72 hours. The contract may become unsafe earlier if the active policy can no longer justify consumption.
Installation
Normal LIVE operation requires active GAL-2 API access. Backend entitlement determines service access.
Install the signed Linux ARM64 Node beside your application and configure its API credentials securely.
Use the Time Contract, SHM, or SDK Provider instead of silently committing raw host time on the protected path.
Backend entitlement decides access. The Time Contract independently decides whether current GAL-2 Time is safe for the application to consume.
Signed Release
Signed limited release for Linux ARM64. Verify the release identity and signing key before installation.
080a17dc6f477a6a707e78efe14412d3a0f15d38cc2829cda0ddd9bf8024ac6b
802C 8978 FF85 7550 60B6 D6BC 8AB8 59E4 D705 822F
Product Boundary
It is the local application-consumption layer between GAL-2 Time and enrolled software.
The existing operating-system clock and timing stack remain untouched.
Existing timing infrastructure remains in place. GAL-2 adds a separate governed application path.
The protected Provider path returns GAL-2 Time when justified or explicit unsafe/error behavior when it is not.
GAL-2 Node
Install the GAL-2 Node. Connect the application once. Let the Time Contract govern what happens before time becomes state.