GAL-2™ Application Time Governance

Governed Time for Application State

Your timing stack delivers time. GAL-2 adds a governed application layer: the GAL-2 API creates GAL-2 Time, the GAL-2 Node makes it locally consumable, and the Time Contract governs when it is safe to use.

GAL-2 API creates GAL-2 Time GAL-2 Node makes it locally consumable Time Contract governs its use

Keep your timing stack. Install the GAL-2 Node. Connect the application once.

Checking GAL-2 API status…

GAL-2 Node

v1.0.0-rc10 · Limited Release · Linux ARM64

Governed time, local to your application.

GAL-2 Node makes GAL-2 Time locally consumable without replacing your existing timing infrastructure.

The GAL-2 API creates GAL-2 Time. The Node receives that governed trajectory, maintains the local application-consumption path, and exposes the Time Contract, shared-memory publication, and SDK Provider interfaces. The Time Contract governs whether the enrolled application should use that time.

01 · API Creates GAL-2 Time

The protected GAL-2 system creates the upstream governed GAL-2 trajectory.

02 · Node Makes it local

The Node makes GAL-2 Time locally consumable beside the enrolled application.

03 · Time Contract Governs its use

The application receives an explicit safety decision before time becomes trusted state.

Current Release

GAL-2 Node v1.0.0-rc10

The current signed limited release is available for Linux ARM64. macOS Apple Silicon is the next planned native Node platform.

Platform Linux ARM64
Time Contract 1.2.0-contract-rc.4
Release integrity GPG signed
Next platform macOS Apple Silicon

Product Architecture

Keep your timing stack.

GAL-2 Node sits beside the application. It does not replace NTP, PTP, GNSS, chrony, grandmasters, timing appliances, atomic references, or the host system clock.

Upstream

GAL-2 API

Creates GAL-2 Time and delivers it to an entitled Node.

Local

GAL-2 Node

Maintains the local consumption surface, continuity state, uncertainty, recovery behavior, SHM, and Provider delivery.

Application boundary

Time Contract

Tells the enrolled application whether the current GAL-2 publication is safe to consume.

What the Node does

Stop rebuilding timing-failure handling in every application.

GAL-2 Node centralizes the application-facing continuity logic that software would otherwise have to build and audit itself.

01

Local delivery

Makes GAL-2 Time available locally instead of requiring every application read to call the upstream API.

02

Bounded HOLDOVER

When fresh upstream synchronization is unavailable, the Node may continue from the last valid GAL-2 state under declared policy.

03

Uncertainty

Makes continuity risk explicit instead of presenting stale application time as though nothing changed.

04

Controlled recovery

Fresh GAL-2 synchronization can return directly to LIVE when safe, or pass through controlled REJOIN when reconciliation is required.

05

Fail closed

When safe consumption can no longer be justified, the protected path refuses instead of silently accepting unsafe time.

06

Host non-interference

GAL-2 Node does not discipline or steer the host system clock. Non-enrolled workloads continue using their existing timing path.

Local Consumption

One Node. Multiple application-facing surfaces.

Time Contract

Inspect application-facing state locally through http://127.0.0.1:9095/contract .

Shared Memory

Node-managed SHM provides a low-overhead local publication path for enrolled consumers.

SDK Provider

Applications can consume through the Node-supplied Provider and receive GAL-2 Time or an explicit typed unsafe/error result.

curl -s http://127.0.0.1:9095/contract | python3 -m json.tool

Time Contract

The application gets more than a timestamp.

The Time Contract exposes the decision and the context behind it: GAL-2 Time, safety, validity, reason, continuity state, uncertainty, holdover age, sequence, and lineage.

{
  "gal2_time": "...",
  "safe_to_consume": true,
  "mode": "LIVE",
  "reason": "fresh_api_sync",
  "valid_until": "...",
  "uncertainty_ms": ...,
  "holdover_age_sec": ...,
  "monotonic_sequence": ...,
  "source_lineage": [...]
}

safe_to_consume is authoritative.

Application logic should not infer safety from mode alone. The Time Contract's safe_to_consume decision governs the enrolled GAL-2 application path.

Continuity

Explicit behavior when conditions change.

LIVE Fresh GAL-2 synchronization is available and consumption is governed under the active policy.
HOLDOVER The Node continues from the last valid GAL-2 state under bounded policy while uncertainty grows.
REJOIN Controlled reconciliation when fresh GAL-2 synchronization returns and reconciliation is required.
FAIL_CLOSED The protected path refuses consumption when GAL-2 can no longer justify that the publication is safe.

No silent raw host-time fallback.

HOLDOVER is not raw host time and it is not naive timestamp continuation. The Node continues from the last valid GAL-2 state only while declared policy permits it. When that justification ends, the protected path fails closed.

Policy

Strict by default. Stricter when your workload requires it.

The standard Node profile defines bounded operational policy. Customer deployments may select a stricter operational response based on their application, risk, or compliance requirements.

Soft holdover 6 hours

Standard declared soft continuity boundary.

Hard holdover 72 hours

Standard maximum declared policy boundary, subject to safety and uncertainty.

API polling 30 seconds

Standard Node synchronization cadence.

Policy boundary

The 72-hour hard limit does not mean GAL-2 promises that safe_to_consume will remain true for 72 hours. The contract may become unsafe earlier if the active policy can no longer justify consumption.

Installation

Install the Node. Connect the application once.

Step 01

Get GAL-2 API access

Normal LIVE operation requires active GAL-2 API access. Backend entitlement determines service access.

Step 02

Install GAL-2 Node

Install the signed Linux ARM64 Node beside your application and configure its API credentials securely.

Step 03

Connect the application

Use the Time Contract, SHM, or SDK Provider instead of silently committing raw host time on the protected path.

Step 04

Let the contract decide

Backend entitlement decides access. The Time Contract independently decides whether current GAL-2 Time is safe for the application to consume.

Signed Release

Download GAL-2 Node.

GAL-2 Node v1.0.0-rc10 · Linux ARM64

Signed limited release for Linux ARM64. Verify the release identity and signing key before installation.

Public handoff SHA-256 080a17dc6f477a6a707e78efe14412d3a0f15d38cc2829cda0ddd9bf8024ac6b
Release signing fingerprint 802C 8978 FF85 7550 60B6 D6BC 8AB8 59E4 D705 822F

Product Boundary

GAL-2 Node is not another clock.

It is the local application-consumption layer between GAL-2 Time and enrolled software.

Does not discipline the host clock

The existing operating-system clock and timing stack remain untouched.

Does not replace NTP / PTP / GNSS

Existing timing infrastructure remains in place. GAL-2 adds a separate governed application path.

Does not silently fall back

The protected Provider path returns GAL-2 Time when justified or explicit unsafe/error behavior when it is not.

GAL-2 Node

Keep your timing stack.

Install the GAL-2 Node. Connect the application once. Let the Time Contract govern what happens before time becomes state.