Your timing stack delivers time. GAL-2 adds a governed application layer: the GAL-2 API creates GAL-2 Time, the GAL-2 Node makes it locally consumable, and the Time Contract governs when it is safe to use.
Keep your timing stack. Install the GAL-2 Node. Connect the application once.
GAL-2 Node
GAL-2 Node makes GAL-2 Time locally consumable without replacing your existing timing infrastructure.
The Protected Core creates GAL-2 Time. The GAL-2 API delivers that trajectory to the Node. The Node maintains the local application-consumption path and exposes the Time Contract, shared-memory publication, and SDK Provider interfaces. The Time Contract governs whether the enrolled application should use that time.
The Protected Core creates the upstream GAL-2 Time trajectory.
The Node makes GAL-2 Time locally consumable beside the enrolled application.
The application receives an explicit safety decision before time becomes trusted state.
Current Release
RC11 is available as a technical evaluation release for Linux ARM64 and macOS Apple Silicon. A Linux AMD64 / x86_64 evaluator package is also available for approved independent technical evaluation and reproducibility testing.
Product Architecture
GAL-2 Node sits beside the application. It does not replace NTP, PTP, GNSS, chrony, grandmasters, timing appliances, atomic references, or the host system clock.
The Protected Core creates GAL-2 Time and the GAL-2 API delivers it to an entitled Node.
Maintains the local consumption surface, continuity state, uncertainty, recovery behavior, SHM, and Provider delivery.
Tells the enrolled application whether the current GAL-2 publication is safe to consume.
What the Node does
GAL-2 Node centralizes the application-facing continuity logic that software would otherwise have to build and audit itself.
Makes GAL-2 Time available locally instead of requiring every application read to call the upstream API.
When fresh upstream synchronization is unavailable, the Node may continue from the last valid GAL-2 state under declared policy.
Makes continuity risk explicit instead of presenting stale application time as though nothing changed.
Fresh GAL-2 synchronization can return directly to LIVE when safe, or pass through controlled REJOIN when reconciliation is required.
When safe consumption can no longer be justified, the protected path refuses instead of silently accepting unsafe time.
GAL-2 Node does not discipline or steer the host system clock. Non-enrolled workloads continue using their existing timing path.
Local Consumption
Inspect application-facing state locally through http://127.0.0.1:9095/contract .
Node-managed SHM provides a low-overhead local publication path for enrolled consumers.
Applications can consume through the Node-supplied Provider and receive GAL-2 Time or an explicit typed unsafe/error result.
curl -s http://127.0.0.1:9095/contract | python3 -m json.tool
Time Contract
The Time Contract exposes the decision and the context behind it: GAL-2 Time, safety, validity, reason, continuity state, uncertainty, holdover age, sequence, and lineage.
{
"gal2_time": "...",
"safe_to_consume": true,
"mode": "LIVE",
"reason": "fresh_api_sync",
"valid_until": "...",
"uncertainty_ms": ...,
"holdover_age_sec": ...,
"monotonic_sequence": ...,
"source_lineage": [...]
}
Application logic should not infer safety from mode alone. The Time Contract's safe_to_consume decision governs the enrolled GAL-2 application path.
Continuity
HOLDOVER is not raw host time and it is not naive timestamp continuation. The Node continues from the last valid GAL-2 state only while declared policy permits it. When that justification ends, the protected path fails closed.
Policy
The standard Node profile defines bounded operational policy. Customer deployments may select a stricter operational response based on their application, risk, or compliance requirements.
Standard declared soft continuity boundary.
Standard maximum declared policy boundary, subject to safety and uncertainty.
The protected path refuses consumption when active policy can no longer justify safe use.
The 72-hour hard limit does not mean GAL-2 promises that safe_to_consume will remain true for 72 hours. The contract may become unsafe earlier if the active policy can no longer justify consumption.
Installation
Normal LIVE operation requires active GAL-2 API access. Backend entitlement determines service access.
Install the appropriate RC11 technical evaluation package for Linux ARM64 or macOS Apple Silicon and configure its API credentials securely.
Use the Time Contract, SHM, or SDK Provider instead of silently committing raw host time on the protected path.
Backend entitlement decides access. The Time Contract independently decides whether current GAL-2 Time is safe for the application to consume.
RC11 Release Packages
Technical evaluation packages are available for Linux ARM64 and macOS Apple Silicon. A Linux AMD64 / x86_64 evaluator package is available for approved independent technical evaluation. Verify package identity before installation.
c4b9f928c80b6ecd06f71cd5809fb13e72d0c852c9c52d3b0b2158a46b660e97
5b082fcdc0c2a59fb669266ef1848d9247c75d35fd7421a72d2b115c1d11830a
d452a276af1bf4bd2abb11dfa01f14f22f7c72f36eda9a3019c4269ef36ef553
802C 8978 FF85 7550 60B6 D6BC 8AB8 59E4 D705 822F
Product Boundary
It is the local application-consumption layer between GAL-2 Time and enrolled software.
The existing operating-system clock and timing stack remain untouched.
Existing timing infrastructure remains in place. GAL-2 adds a separate governed application path.
The protected Provider path returns GAL-2 Time when justified or explicit unsafe/error behavior when it is not.
GAL-2 Node
Install the GAL-2 Node. Connect the application once. Let the Time Contract govern what happens before time becomes state.