RFC-ATF-7: Agent Trust Fabric — System Configuration Governance Contract. Closing the Emergent Harm Gap: Configuration-Level Governance, Emergent Harm Boundaries, and System Convergence Receipts

RFC-ATF-7 specifies the System Configuration Governance Contract (SCGC) layer of the Agent Trust Fabric — the seventh RFC in the ATF Open Standard series published by OMNIX QUANTUM LTD. RFC-ATF-7 answers the structural question that no prior RFC in the series addresses: who governs the configuration that produces the sessions? Session-level governance proves that each session was governed — it cannot prove that the system of sessions was governed. When harm emerges from configuration-level interaction — feedback loops, dependency propagation, cross-agent effects — session-level receipts are necessary but not sufficient. This is the Emergent Harm Gap, formally articulated by Greggory Don Butler (TA-14). Three protocol artifacts are introduced: System Configuration Governance Contract (SCGC): A PQC-sealed (ML-DSA-65) artifact issued before any session begins, declaring the complete governance posture of the configuration in six canonical blocks: STD (topology), DPM (dependencies), IFL (interaction logic), CEP (escalation policies), EHB (emergent harm boundaries), TCW (temporal/version window). A single config_fingerprint = SHA3-256(sorted block hashes) provides tamper-evident identity of the entire configuration's governance posture. Invariants SCGC-INV-001, 003, 004, 005. Session Configuration Binding (SCB): An append-only cryptographic link between each OGR session and its parent SCGC, fail-closed at session start. Binding is rejected if the SCGC is not SEALED, expired, or belongs to a different organization. A binding_hash = SHA3-256(scgc_id ‖ session_id ‖ runtime_config_hash ‖ timestamp) prevents replay attacks. Fingerprint divergence auto-records a CRITICAL drift event. Invariants SCGC-INV-002, 005. System Convergence Receipt (SCR): The closing artifact aggregating all bound sessions, CTCHC behavioral attestations, MIVP mandate certifications, and drift events into a single PQC-signed, Merkle-rooted system-level verdict: SYSTEM_CONVERGENT | SYSTEM_WARNING | SYSTEM_HALTED | SYSTEM_INDETERMINATE. Verdict is deterministic from evidence (SCGC-INV-010). Race condition eliminated: converge() always recomputes from current evidence (R-005). Invariants SCGC-INV-008, 009, 010. The primary differentiator is the Emergent Harm Envelope (EHE): a set of predicates defined over INTERACTIONS between sessions, tools, and components — not over any individual session's behavior. Any EHB breach is cryptographically irrefutable, auto-escalates to SYSTEM_HALTED permanently (SCGC-INV-007), and cannot be overridden by any operator action or API call. No equivalent artifact exists in any published AI governance standard as of June 2026. Adversarial audit: SCGC-AUDIT-V2 (2026-06-08) — 15 attack vectors (A1–A15, including 5 VC interoperability vectors from RFC-ATF-8) — 53/53 PASS, 0 FAIL. 7 findings identified and remediated in V1 (including 3 HIGH/CRITICAL): fingerprint re-verification on read (SCGC-INV-011), Merkle re-verification on read (SCGC-INV-012), PQC fail-closed enforcement (SCGC-INV-013), SCR race condition elimination. 13 new invariants are introduced (SCGC-INV-001 through SCGC-INV-013), bringing the total ATF invariant count to 119 formally specified invariants across 21 protocol families. An implementation complying with RFC-ATF-1 through RFC-ATF-7 is designated ATF-SCGC-Compliant — the seventh compliance tier in the ATF stack. Compliance hierarchy: ATF-ID-Compliant → ATF-RGC-Compliant → ATF-ELP-Compliant → ATF-AGV-Compliant → ATF-CGL-Compliant → ATF-BEV-Compliant (106 inv.) → ATF-SCGC-Compliant (119 inv.) Persistence schema: 5 new PostgreSQL tables — atf_scgc_contracts · atf_scgc_components · atf_scgc_session_bindings · atf_scgc_drift_events · atf_scgc_convergence_receipts (all auto-created via CREATE TABLE IF NOT EXISTS). Regulatory alignment: EU AI Act Art. 9 (risk management), Art. 12 (record-keeping), Art. 13 (transparency) · NIST AI RMF GOVERN 1.1, GOVERN 6.2 · ISO/IEC 42001 §6.1, §9.1. Related ADR: ADR-213 (System Configuration Governance Contract). Implementation: omnix_core/govern/scgc_engine.py (1,244 lines). Test suite: tests/test_scgc.py (47 tests, all PASS).