{"rfc":38,"draft":7,"source_sha256":"c078e1b5a279cb92b8226c6ad42686ed060d1994ad6d95ddaac3b1f8e8a1ca32","candidate_occurrences":[{"source_locator":"RFC-AI-38:D7:L22:O1","line":22,"token":"MUST NOT","text":"2.3 A successful verified storage-interface response closes the routine file-save verification obligation. Workers MUST NOT initiate an additional whole-file download, parent-directory inventory or repeated hash check so","classification":"UNCLASSIFIED_WORD_OCCURRENCE"},{"source_locator":"RFC-AI-38:D7:L60:O1","line":60,"token":"MUST","text":"5.2 Provider adapters MUST document whether they can (a) accept an upload checksum, (b) return an independently calculated digest with upload result, (c) obtain one via metadata and (d) perform a targeted content read. R","classification":"UNCLASSIFIED_WORD_OCCURRENCE"},{"source_locator":"RFC-AI-38:D7:L98:O1","line":98,"token":"MUST","text":"## MUST-DESIGN CRITERIA — CEO-DIRECTED PROPOSED FUTURE SYSTEM","classification":"UNCLASSIFIED_WORD_OCCURRENCE"},{"source_locator":"RFC-AI-38:D7:L99:O1","line":99,"token":"MUST","text":"MUST-38-01: MUST treat direct canonical saves through StorageInterface as safe by design through independently enforced simple logic, hardware/physics-grounded limits, atomicity and verified commit; do not require unsafe","classification":"UNCLASSIFIED_WORD_OCCURRENCE"},{"source_locator":"RFC-AI-38:D7:L99:O2","line":99,"token":"MUST","text":"MUST-38-01: MUST treat direct canonical saves through StorageInterface as safe by design through independently enforced simple logic, hardware/physics-grounded limits, atomicity and verified commit; do not require unsafe","classification":"UNCLASSIFIED_WORD_OCCURRENCE"},{"source_locator":"RFC-AI-38:D7:L100:O1","line":100,"token":"MUST","text":"MUST-38-02: MUST call GetUTCDateNow() for commit timestamps and freshness instead of direct worker host-clock reads.","classification":"UNCLASSIFIED_WORD_OCCURRENCE"},{"source_locator":"RFC-AI-38:D7:L100:O2","line":100,"token":"MUST","text":"MUST-38-02: MUST call GetUTCDateNow() for commit timestamps and freshness instead of direct worker host-clock reads.","classification":"UNCLASSIFIED_WORD_OCCURRENCE"},{"source_locator":"RFC-AI-38:D7:L101:O1","line":101,"token":"MUST","text":"MUST-38-03: MUST distinguish transport acceptance, operation commitment and independently verified final bytes, with reconciliation before retrying uncertain effects.","classification":"UNCLASSIFIED_WORD_OCCURRENCE"},{"source_locator":"RFC-AI-38:D7:L101:O2","line":101,"token":"MUST","text":"MUST-38-03: MUST distinguish transport acceptance, operation commitment and independently verified final bytes, with reconciliation before retrying uncertain effects.","classification":"UNCLASSIFIED_WORD_OCCURRENCE"},{"source_locator":"RFC-AI-38:D7:L106:O1","line":106,"token":"MUST","text":"## ADDITIONAL MUST-DESIGN CRITERIA — 2026-11-02 (PROPOSED, NOT IMPLEMENTED)","classification":"UNCLASSIFIED_WORD_OCCURRENCE"},{"source_locator":"RFC-AI-38:D7:L108:O1","line":108,"token":"MUST","text":"MUST: StorageInterface MUST physically/deterministically prohibit stale owner writes, unqualified source evidence, conflict overrides, fake receipts, duplicate uncertain commits and claiming cross-service completion from","classification":"UNCLASSIFIED_WORD_OCCURRENCE"},{"source_locator":"RFC-AI-38:D7:L108:O2","line":108,"token":"MUST","text":"MUST: StorageInterface MUST physically/deterministically prohibit stale owner writes, unqualified source evidence, conflict overrides, fake receipts, duplicate uncertain commits and claiming cross-service completion from","classification":"UNCLASSIFIED_WORD_OCCURRENCE"},{"source_locator":"RFC-AI-38:D7:L109:O1","line":109,"token":"MUST","text":"MUST consider the concrete literal behavior of competent AI workers and enforce required hard safeguards by simple, separately running Interface logic where an actual boundary exists. MUST not delegate Interface internal","classification":"UNCLASSIFIED_WORD_OCCURRENCE"},{"source_locator":"RFC-AI-38:D7:L109:O2","line":109,"token":"MUST","text":"MUST consider the concrete literal behavior of competent AI workers and enforce required hard safeguards by simple, separately running Interface logic where an actual boundary exists. MUST not delegate Interface internal","classification":"UNCLASSIFIED_WORD_OCCURRENCE"},{"source_locator":"RFC-AI-38:D7:L109:O3","line":109,"token":"MUST","text":"MUST consider the concrete literal behavior of competent AI workers and enforce required hard safeguards by simple, separately running Interface logic where an actual boundary exists. MUST not delegate Interface internal","classification":"UNCLASSIFIED_WORD_OCCURRENCE"},{"source_locator":"RFC-AI-38:D7:L112:O1","line":112,"token":"MUST","text":"REQ-AI-38-TRANSFER-001: If ALL expected bytes have not been received, transport MUST retry missing bytes until complete or retain explicit unresolved failure; no partial transfer can be marked complete. Transport owns by","classification":"UNCLASSIFIED_WORD_OCCURRENCE"},{"source_locator":"RFC-AI-38:D7:L113:O1","line":113,"token":"MUST","text":"REQ-AI-38-IDEMPOTENCY-002: A timeout after a write is NOT proof of failed commit. StorageInterface MUST reconcile exact provider ID, expected revision, actual content and independent observed commit before repeating effe","classification":"UNCLASSIFIED_WORD_OCCURRENCE"},{"source_locator":"RFC-AI-38:D7:L113:O2","line":113,"token":"MUST","text":"REQ-AI-38-IDEMPOTENCY-002: A timeout after a write is NOT proof of failed commit. StorageInterface MUST reconcile exact provider ID, expected revision, actual content and independent observed commit before repeating effe","classification":"UNCLASSIFIED_WORD_OCCURRENCE"},{"source_locator":"RFC-AI-38:D7:L114:O1","line":114,"token":"MUST NOT","text":"REQ-AI-38-SAGA-003: A confirmed save MUST NOT imply publication, approval or entire business completion. Multi-Interface orchestration separately records committed effects, compensations where safe and explicit UNKNOWN; ","classification":"UNCLASSIFIED_WORD_OCCURRENCE"},{"source_locator":"RFC-AI-38:D7:L118:O1","line":118,"token":"MUST","text":"REQUIRED FUTURE BEHAVIOR: Transport MUST retry when the entire expected byte payload has not been received; StorageInterface alone owns provider persistence, conditional revision and duplicate-effect reconciliation. A po","classification":"UNCLASSIFIED_WORD_OCCURRENCE"},{"source_locator":"RFC-AI-38:D7:L118:O2","line":118,"token":"MUST","text":"REQUIRED FUTURE BEHAVIOR: Transport MUST retry when the entire expected byte payload has not been received; StorageInterface alone owns provider persistence, conditional revision and duplicate-effect reconciliation. A po","classification":"UNCLASSIFIED_WORD_OCCURRENCE"},{"source_locator":"RFC-AI-38:D7:L118:O3","line":118,"token":"MUST","text":"REQUIRED FUTURE BEHAVIOR: Transport MUST retry when the entire expected byte payload has not been received; StorageInterface alone owns provider persistence, conditional revision and duplicate-effect reconciliation. A po","classification":"UNCLASSIFIED_WORD_OCCURRENCE"}],"status":"DERIVED_WORD_LOCATOR_NOT_NORMATIVE"}