Time should not be consumed blindly.
GAL-2 gives enrolled applications an explicit governed time-consumption decision before protected state commits. The GAL-2 API creates GAL-2 Time, GAL-2 Node makes it locally consumable, and the Time Contract governs whether the application should use it.
The current Time Contract policy
The Time Contract converts Node state into an explicit application-facing decision. The application does not have to independently implement API reachability handling, holdover calculation, uncertainty growth, recovery logic, or backward-step handling for the enrolled GAL-2 path.
GAL-2 API
Creates and delivers GAL-2 Time from the protected upstream GAL-2 system to an entitled Node.
GAL-2 Node
Makes GAL-2 Time locally consumable and manages bounded continuity, uncertainty, recovery, local publication, SHM, and SDK Provider access.
Time Contract
Governs whether the enrolled application may consume the current GAL-2 publication before time becomes committed state.
Default policy profile
GAL-2 ships with a declared default policy profile. These values are operational policy boundaries, not universal physical constants and not external metrology guarantees.
The 72-hour boundary is not a promise to consume for 72 hours.
safe_to_consume remains authoritative. GAL-2 may become non-consumable before the hard holdover limit if validity, uncertainty, continuity, integrity, or another declared policy requirement can no longer be justified.
Customer policy profiles
The default policy is not intended to force every workload into the same operational risk envelope. A customer may select a stricter operational response and configure that policy once for the protected Node path.
Your operational requirements can make GAL-2 stricter.
A deployment may require earlier refusal, shorter continuity windows, tighter acceptance thresholds, or other stricter Time Contract behavior than the standard profile.
This allows the GAL-2 consumption boundary to be aligned with an application's internal risk, operational, or compliance requirements without changing the underlying GAL-2 architecture.
Standards and compliance boundary
Customer policy customization does not by itself constitute certification against a named industry or regulatory standard. A specific standard should be mapped to its exact requirements and validated against the deployed GAL-2 policy profile before a compliance claim is made.
From timestamp to decision
In ordinary software, time is often treated as a raw value. GAL-2 adds an explicit decision boundary: should this enrolled application consume GAL-2 Time before committing state?
Observable state
Freshness, last valid GAL-2 state, API reachability, validity, latency, continuity state, uncertainty, recovery state, sequence, and source lineage.
Policy evaluation
GAL-2 Node evaluates whether continued consumption is justified under the active Time Contract policy.
Application decision
The enrolled workload receives GAL-2 Time together with safe_to_consume , mode, reason, validity, uncertainty, sequence, and lineage.
Local consumption surfaces
GAL-2 Node makes the governed upstream trajectory locally consumable. Applications can integrate through the supported local interfaces instead of calling the upstream API for every application time read.
Time Contract
Local contract observability at http://127.0.0.1:9095/contract .
SHM
Local shared-memory publication for low-overhead consumption and Provider integration.
SDK Provider
Application-facing Provider path that returns GAL-2 Time when valid or an explicit typed unsafe/error result when consumption cannot be justified.
Fields applications should inspect
Current continuity behavior
The Time Contract makes continuity state explicit. safe_to_consume remains the authority for whether the protected application path may proceed.
Recovery does not always require REJOIN
When fresh synchronization returns and the incoming GAL-2 trajectory can be accepted without reconciliation, recovery may return directly to LIVE . REJOIN is used when controlled reconciliation is actually required.
How protected applications use it
contract = gal2_provider.read()
if contract.safe_to_consume:
commit_state(timestamp = contract.gal2_time)
else:
block_or_defer(
mode = contract.mode,
reason = contract.reason
)
Policy decision, not clock perfection
safe_to_consume is a Time Contract policy decision, not a claim of absolute clock perfection. It means the current GAL-2 publication is consumable under the active declared policy and observed Node state.
Operational boundaries
IXOYE advisory witness boundary
IXOYE belongs to the broader GAL-2 / IXOYE Time vision, but its application-side authority remains deliberately limited.
Advisory observer
IXOYE can provide an out-of-band witness or coherence view of observed GAL-2 state.
Not a fallback source
IXOYE does not replace GAL-2 Time when upstream service is unavailable.
No policy authority
IXOYE does not decide safe_to_consume .
GAL-2 governs. IXOYE observes.
IXOYE is advisory-only. It is not the GAL-2 Time source, not a fallback time source, and not the authority that determines safe application consumption.
RC5.8 evaluator policy evidence
The RC5.8 Time Contract evaluator remains part of the public GAL-2 evidence lineage. The dashboard, contract example, formal modes, IXOYE witness surface, and exact RC5.8 policy values below describe that historical evaluator generation and are preserved as evidence of the architecture's development.
Historical dashboard boundary
This dashboard did not govern time and did not change GAL-2 policy. It read the historical local /contract and /witness surfaces to display policy and witness state. Dashboard ERROR was not a Time Contract mode.
Historical RC5.8 contract example
This example is intentionally preserved because it documents the public RC5.8 evaluator contract surface. It should not be represented as an RC10 runtime response.
{
"schema": "gal2-daemon-time-contract-v1",
"version": "1.2.0-contract-rc.3",
"service": "gal2d-rc5-ixoye-witness",
"gal2_time": "2026-06-20T16:13:56.515332Z",
"utc_time": "2026-06-20T16:13:56.515332Z",
"safe_to_consume": true,
"mode": "LIVE",
"health": "green",
"reason": "fresh_api_sync",
"valid_until": "2026-06-20T16:14:39.717231Z",
"valid_until_basis": "last_good_sync_plus_contract_live_valid_sec",
"last_good_sync": "2026-06-20T16:13:54.717231+00:00",
"cache_age_seconds": 1.762,
"api_latency_ms": 719.454,
"monotonic_sequence": 7657,
"monotonic_sequence_semantics": "per_contract_serve",
"policy": {
"contract_live_valid_sec": 45.0,
"contract_max_api_latency_ms": 5000.0,
"contract_holdover_soft_sec": 21600.0,
"contract_holdover_hard_sec": 259200.0,
"contract_rejoin_guard_sec": 10.0
},
"uncertainty_ms": 719.503,
"uncertainty_ms_basis":
"conservative_model_v1_not_external_metrology_validated",
"source_lineage": [
"gal2_api",
"gal2_daemon_rc3_base",
"rc4_72h_holdover_policy",
"rc5_ixoye_witness_contract"
],
"witness_ref": {
"discovery": "/witness",
"enabled": true,
"layer": "IXOYE",
"policy": "advisory_only",
"role": "out_of_band_attestation",
"effect_on_safe_to_consume": "none"
}
}
Historical RC5.8 formal modes
These mode names are preserved exactly as part of the RC5.8 evaluator evidence. They describe that Time Contract generation and should not be rewritten retroactively.
RC5.8 evidence stays RC5.8 evidence.
The historical presence of DEGRADED as a formal RC5.8 mode is not being removed or rewritten. Historical artifacts retain the semantics and results they actually demonstrated.
Historical RC5.8 IXOYE witness
RC5.8 exposed an advisory IXOYE witness endpoint at http://127.0.0.1:9095/witness . That artifact remains useful evidence of the witness boundary.
Observed state
IXOYE could observe contract version, mode, safety decision, sequence, freshness, and other exposed contract state.
Evidence surface
Historical witness output could expose observer and attestation metadata associated with the observed contract state.
Authority boundary
IXOYE did not source time, act as fallback, govern policy, or decide safe_to_consume .
Witness, not authority.
GAL-2 governed. IXOYE observed. Presence in source lineage or dashboard state did not give IXOYE governance authority over the Time Contract.
Operational goal
Raw time keeps moving even when application risk changes. GAL-2 makes the consumption decision explicit: continue while justified, hold over within bounded policy, recover under controlled rules, or fail closed before unsafe time becomes committed application state. The default policy is strict, and customer deployments may select a stricter operational response when their application or risk requirements demand it.