Abstract

This publication discloses Structural Review-Gate Stubs, a software design in which a security-critical capability ships to production as a typed, fail-closed throwing stub whose activation gate is the presence of a vetted provisioning artifact — an injected cryptographic handle, a parseable asymmetric signing key, or a genuine payment secret — and not a boolean feature flag or an environment toggle. When the artifact is absent, malformed, or a deploy-time placeholder, the capability's dangerous operation is not merely disabled; the safe-looking fallback branch does not exist in the code. Attempting the operation raises a single typed gate error carrying a stable gate identifier, which a transport boundary maps to an honest HTTP 503 with the authorization decision computed but issuance deferred. The consequence is a property we call capability-by-provisioning: dangerous paths are provably unexecutable until an operator provisions a real, reviewed artifact, while the surrounding code deploys, type-checks, imports cleanly, and passes code review as ordinary production code. Gate state is observable non-secretly via boolean readiness surfaces. We ground the disclosure in three concrete gates — a license-key hasher that refuses without a vetted key-derivation handle, an Ed25519 entitlement-token signer whose sign/verify/publish methods throw until a real key loads, and a Stripe-style money path that 503s on placeholder secrets while always verifying webhook signatures within a replay window — and we provide a clean-room, dependency-free, offline-runnable reference implementation, a data model, a worked example, a prior-art delta, and enabling claims.

Creative Commons License

Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 License.

Download

Share

COinS