spec: silent mode MUST NOT block a policy deny (breaking, 30-day comment) #421

Breaking change proposal, opening the 30-day comment period under GOVERNANCE.md. Comments close no earlier than 2026-10-25.

What changes. Section 4.3 of the v0.2 draft says that in silent mode a policy deny MUST NOT block the action, and the audit chain MUST record every would-have-denied decision. The text is in #408. It follows the #28 behavior and the ruling on #143.

What breaks. v0.9.0 and v0.10.0 described silent as evaluated and enforced, under the same eat_profile. A producer that followed that text and blocks on deny in silent mode no longer conforms. A silent record does not say which meaning it was written under.

What implementers do. A producer that blocks on deny and suppresses operational logs should record advisory, which section 4.3 now states is not weaker than silent. A producer that allows on deny keeps silent. Consumers should not read a silent record written before adoption as evidence that denied actions were blocked.

Unchanged. enforce remains the default, silent still requires explicit configuration, and schema constraints and wire format do not change.

Classification raised by @lywinged in review of #408.