# GAL-2 Daemon Time Contract v1 RC2

Status: Production local install validated  
Version: 1.0.0-contract-rc2  
Endpoint: http://127.0.0.1:9095/contract  
Production daemon path: /usr/local/gal2/bin/gal2d.py  
Production daemon SHA256: 00f70b4fccd17699e90928006dc42f49632e6cfa111fbab267a0ed710261b864

## 1. What this is

GAL-2 Daemon Time Contract v1 RC2 is a local application-facing time contract.

It does not replace the existing timing stack.

It does not replace GNSS, PTP, NTP, Timebeat, OSA, TAP, chrony, or any reference-grade clock source.

It protects the consumer side.

The daemon consumes and reconciles with the production GAL-2 API, where the protected fractal core lives. The local daemon then exposes a contract that applications can read before trusting time.

Safe positioning:

Precision protects the reference. GAL-2 protects the consumer.

## 2. Core idea

Raw time answers the question:

What time is it?

GAL-2 Time Contract answers the operational question:

Is this time safe for the application to consume right now?

## 3. Required API relationship

The daemon must touch the production GAL-2 API.

The protected fractal logic lives inside the API. The daemon does not replace the API and does not invent GAL-2 Time locally.

When the API is reachable, the daemon anchors and reconciles with it.

When the API is not reachable, the daemon enters a governed local continuity mode using the last good GAL-2 state.

When connectivity returns, the daemon reconciles and re-enters through controlled recovery behavior.

## 4. Production endpoint

Local endpoint:

http://127.0.0.1:9095/contract

Legacy endpoints still available:

http://127.0.0.1:9095/status  
http://127.0.0.1:9095/health  
http://127.0.0.1:9095/now  

## 5. Contract fields

The /contract endpoint exposes:

- schema
- version
- mode
- daemon_mode
- safe_to_consume
- reason
- health
- gal2_time
- utc_time
- monotonic_sequence
- last_good_sync
- cache_age_seconds
- api_latency_ms
- local_receive_time
- local_serve_time
- valid_until
- operational_bound_ms
- rejoin_state
- rejoin_guard_active
- last_recovery_holdover_age_sec
- slew_remaining_sec
- request_id
- quota_status
- source_lineage
- policy

## 6. Contract modes

LIVE

The daemon has a fresh API sync and the contract is currently green.

HOLDOVER

The API is temporarily unreachable, but the daemon has a valid cached GAL-2 state within policy.

DEGRADED

The daemon still has usable continuity, but the condition is no longer ideal. Example: holdover has passed the soft threshold but has not exceeded the hard fail-closed threshold.

REJOIN

The daemon is recovering after outage or stale holdover and is reconciling with the GAL-2 API. This may include guarded recovery or controlled slew behavior.

FAIL_CLOSED

The contract says applications should not consume the time. This occurs when policy requires a hard stop, such as expired holdover, missing usable state, or quota exhaustion.

WARMING

The daemon is not ready yet because no usable GAL-2 cache or API-derived state exists.

## 7. safe_to_consume

safe_to_consume is a policy-derived field.

It is not a marketing boolean.

Applications should treat it as the primary application-facing decision field.

Recommended application behavior:

If safe_to_consume is true:
The application may consume gal2_time within the limits exposed by the contract.

If safe_to_consume is false:
The application should not trust gal2_time for state transitions, ordering, settlement, TTL, audit, or critical decisions.

## 8. valid_until

valid_until tells the application how long the current contract decision remains valid.

Applications should not keep using a stale contract past valid_until.

## 9. monotonic_sequence

monotonic_sequence increases every time /contract is served.

This lets a client verify that the local contract surface itself is progressing and not going backward.

## 10. source_lineage

Expected source_lineage:

["gal2_api", "gal2_daemon", "contract_v1"]

Meaning:

gal2_api:
The protected production API where GAL-2 Time is generated and reconciled.

gal2_daemon:
The local continuity and policy layer.

contract_v1:
The application-facing contract exposed to the consuming system.

## 11. Validated production install

Final production validation:

FINAL_PRODUCTION_RC2_CONTRACT_VALIDATION=PASS  
FINAL_CONTRACT_MODE=LIVE  
FINAL_CONTRACT_SAFE=True  
FINAL_CONTRACT_REASON=fresh_api_sync  

Production HTTP status:

/status HTTP 200  
/health HTTP 200  
/now HTTP 200  
/contract HTTP 200  

## 12. Evidence bundle

Production seal bundle:

outputs/GAL2_Production_RC2_Install_Seal_20260430.tar.gz

Bundle SHA256:

116f953c0d37a1d4fb55fe295ec8da016309b4c94c9438b56881279c8bae9666

Production seal note:

notes/PRODUCTION_RC2_INSTALL_SEAL.md

Seal note SHA256:

9a0c5e37d5a58cdd10554e942e3f189e15c35f01367127d34851e31d5c68ce6b

## 13. Customer API key model

Each paying customer receives a separate GAL-2 API key.

The daemon uses the customer key through GAL2_API_KEY.

The key must not be hardcoded into public source, documentation, logs, or bundles.

The daemon should load the key from protected local environment configuration, such as:

/etc/gal2/daemon.env

## 14. What IXOYE means for this RC2

IXOYE is not required for RC2 to function.

RC2 proves the local application-facing Time Contract pattern using the production GAL-2 API.

IXOYE can later strengthen public witness, independent verification, proofs, and external trust posture.

For RC2, the required chain is:

GAL-2 API -> GAL-2 Daemon -> Time Contract v1

## 15. Safe external language

Use this:

GAL-2 exposes an application-facing Time Contract that lets software decide whether time is safe to consume under live, degraded, holdover, recovery, or fail-closed conditions.

Use this:

Keep your timing stack. Add GAL-2.

Use this:

Precision protects the reference. GAL-2 protects the consumer.

Avoid saying:

GAL-2 replaces atomic clocks.

Avoid saying:

GAL-2 replaces PTP.

Avoid saying:

GAL-2 proves formal metrology accuracy.

Avoid saying:

GAL-2 eliminates all timing risk.

## 16. Strategic summary

GAL-2 Time Contract v1 RC2 turns GAL-2 from a time API plus daemon into an application-facing temporal safety layer.

The value is not only the timestamp.

The value is the governed decision around the timestamp.

