emergent-security/docs/decision-runbook-integration.md

Human decisions and guided procedures in Emergent Security

Emergent Security teaches agents how to recognize a security situation and find its owner. informed-decision (the actual repository name is singular) makes a human's decision informed and attributable to a presentation. runbook-tutorials guides the procedure and records progress. Their records link together; none can replace another owner's authority.

flowchart TD
    K[Emergent Security: scope, sources, owner routing] --> Q{Human decision required?}
    Q -->|Yes: prepare one question| M[informed-decision: draft, presentation, human disposition]
    Q -->|Existing delegation suffices| P[Effect owner: current prerequisites]
    M -->|Return or discuss| D[Revise draft; decision still unresolved]
    M -->|Decline| S[Stop or revise the proposed act]
    M -->|Accepted: verify exact approval object| A[approval-engine: approval facts and consumption]
    A --> P
    P --> E[access-engine: operational PDP decision]
    E --> R[Owning procedure via runbook-tutorials]
    R --> O[Owner performs separately authorized effect]
    O --> V[Owner verification and audit evidence]
    V --> K

This is a conceptual routing diagram, not an implemented orchestration service or mandatory temporal order between all owner calls. The PEP follows its current request, claim, consumption and effect contracts. Owner-attributed plan exceptions remain exactly scoped; this diagram does not invent a new gate.

Ownership and evidence links

Record	Owner	Link retained by the handoff	What it cannot establish
Orientation receipt	emergent-security	Package version/digest, card, source status, resolved scope	Delegation, live readiness or permission
Decision Memo / presentation	informed-decision	Memo ID/version, packet hashes, presentation view_hash, distinct awareness_hash, human disposition reference	PDP allow, approval consumption, verified mandate graph or root activation
Approval object	approval-engine	Exact approval ID, binding digest, validity and consumption receipt where required	What the person was shown; automatic execution
DecisionEnvelope	access-engine	Submitted request binding, current policy/facts, lifetime and owner verification	Reusable authority after changed scope/expiry
Runbook pack/run	Procedure owner / runbook-tutorials engine	Owner path, pack digest, run ID, environment, gate/check evidence, deviations	Authenticated human approval or independent custody from a local checksum
Effect and verification	Actual executor / effect owner	Decision and approval references, effect result, checks, rollback result	Success of unobserved effects
Evidence / work tracking	audit-core / Statehub respectively	Custody receipt and live task/decision references	A missing event never happened; a work note is a runtime approval

Preserve original delegator, drafting agent, authenticated submitter, requester, represented principal, human reviewer and runtime actor as separate identities. Carry non-secret references between these records. Private packet contents stay in the owner's approved storage; they are not copied into the general knowledge package or a runbook capture. Do not join records by similar display names or substitute one digest for another.

Delivered integration

Release 0.2.0 (pilot) adds decisions and runbooks cards, startup discovery, and revision-pinned owner contracts/code. There are 14 cards, 24 owners and 69 source files. This is file review, not live capability verification.

Release 0.2.1, which clarifies withdrawn-procedure refresh and missing-event reconciliation recipients after provider evaluation. The unsigned adoption draft always binds the current corrected release. Exact-release reports and remaining closure gates are indexed in docs/evidence/2026-10-03-closure-attempt.md.

• runbooks/security-orientation/pack.yaml is a native v0.2 pack owned here. It resolves scope, prepares an unsigned question when needed, identifies the current owner procedure and records unresolved prerequisites. All steps are manual-only; no step or verification shell commands exist. A completed run means preparation only. It does not mean a human answered or any effect ran.
• docs/decisions/profile-adoption-intake.draft.json is a concrete unsigned, unsubmitted owner-format draft for the existing adoption decision. It asks only about this exact knowledge profile. Its serves.resolves is never, so it cannot automatically close the broader owner-adoption decision.
• tools/build_adoption_draft.py --check binds that draft to the current knowledge release and packet content. Rebuild after a release change and review again. The proposed knowledge-profile class and net-kingdom-admins group are not claimed as an admitted submitter route. Tests use a synthetic grant only, and separately demonstrate refusal without admission.
• Eight additional provider scenarios distinguish drafting/binding, current intake readiness, the different hashes, auto-confirm, waivers, seals, pack ownership, and returned decisions.

Existing pilot pointers load the shared package, so no repeated edits to their agent instructions are required. Previous 0.1.1 provider evidence remains historical; it is not silently relabeled as evidence for 0.2.0.

Current limits and concrete owner dependencies

Dependency	Current evidence and next step	Live work record
Automated memo submission	Informed Decision b4f6373 records local intake delivery: empty registries, notification without a URL, posed evidence, and write-back default off. state-hub d61ba32 preserves requires_new_bind, required_ack, and sealed in the dev fixture. No live submitter is registered and INFD_HUB_WRITEBACK stays unset. audit-core 70e4044 registers informed-decision.memo.posed locally and is not deployed. access-engine e85f511 adds an offline compact-sitting v8 branch with empty admit sets; the deployed image pin is unchanged. Listener deployment, workload custody, admission activation, and live rollout remain blocked. T08 still waits on the service account, grant, and T05/T06. A creating approval without a retained receipt is not retried. Keep the local draft ready and use the attended route when submission is authorized. Do not mint a submitter grant.	INFD-WP-0005 T05–T08 and T10; EMERGENT-WP-0002 T02/T09
Profile adoption	Owner review must decide accuracy/publication, class/group and the exact submission path. Drafting is already authorized; no human answer or owner assent has been fabricated.	Decision d20a9750-2b29-534e-8227-fb866581a6ca; EMERGENT-WP-0002 T02
Engine execution/index	Automatic step execution, estate index and inter-pack dependencies remain deliberately deferred. Use explicit owner pack paths. No need to implement these to use the preparation pack.	RBT-WP-0006; existing decision 1e517449-2114-4a8f-9c6b-fcdbe977378e
Runtime enforcement bridge	Pack actor/privilege/authorized_by fields and local waivers are not authenticated owner facts. No external approval/PDP gate plugin is claimed. Future execution requires an exact owner design, not a generic approved: true field.	EMERGENT-WP-0002 T06 mapping; RBT-WP-0006 T01/T06
Independent assurance and rollout	Codex, Claude, and Grok reloaded startup after resume on 0.2.4 and refused effect authority. Context compaction, governed harness proof, independent review, owner feedback, and fleet reach remain open.	EMERGENT-WP-0002 T05/T07/T08/T09/T10

Informed Decision's SCOPE explicitly retains signature-attribution, presentation-to-entry correlation and commitment-only custody gaps. This integration preserves those limits. Runbook auto-confirm can execute checks and auto-confirm manual checks, although it never executes the step command. Generic waivers, overrides and push-through remain local engine features; they cannot satisfy an external human decision. A local seal is a recomputable checksum.

Reproduce the offline checks

With the reviewed owner checkouts next to this repository:

PYTHONPATH=src python3 -m emergent_security.knowledge --repositories .. show decisions
PYTHONPATH=src python3 -m emergent_security.knowledge --repositories .. show runbooks
PYTHONPATH=../runbook-tutorials python3 -m rtut validate .
EMERGENT_OWNER_ROOT=/home/worsch python3 -m pytest tests/test_owner_links.py -q
python3 tools/build_adoption_draft.py --check

Set EMERGENT_OWNER_ROOT to the actual checkout parent on another machine. Tests load the real owner validators/engine, create run state only in temporary fixtures, and never call a live service. Owner-contract tests are explicitly skipped without the environment variable; ordinary package tests remain portable. To view the actual pack, use the owner's installed rtut ui . in this checkout. A UI session is not started or exposed by this integration.

Authoritative references: the pinned informed-decision and runbook-tutorials entries in knowledge/sources.yaml; related contracts in docs/operational-contracts.md and owner map in docs/netkingdom-integration-map.md.

Release 0.2.2 invalidates loaded knowledge after local release changes and serves the exact validated card bytes, addressing Whitehat findings WH-KNOW-001/002. The owner-reviewed Glas source correction preserves absent observed model metadata as unknown. Neither change resolves the existing human adoption or native continuity gates.

Release 0.2.3 re-pins Informed Decision's inventoried workplan at f0c60637. That note recorded the unadmitted 0.2.2 route and did not change intake code.

Release 0.2.4 reviews the later published offline intake at 15c330cc, digest 025aab4f38246219c924bc94954e70ea0e6e7f72bcaf8d4344cd599602d345c3. The decisions card recorded the empty registries, the blocked live route, and the refusal to retry a creating approval without a retained receipt. 0.2.3 Whitehat library acceptance does not extend to that seal. Fresh 0.2.4 provider probes are recorded in docs/evidence/2026-10-03-024-provider-probes.md. Earlier provider reports do not certify that seal.

Release 0.2.5 re-pins Informed Decision at b4f63732, digest 9e186dbd6f2d5eb455bca24db4b03cd866c63c4e94660430dd15f2ca9856215f. The decisions card records fresh-login/p01 acceptance, the open browser freshness error, empty registries, notification without a URL, local posed evidence, write-back left off, and boolean-preserving dev forwarding. T08 still waits on the service account and T05/T06. At that release, the unsigned draft bound this digest. 0.2.4 probes, resumes, and pilots do not certify that seal. No listener or submitter route is claimed.

Current pilot 0.2.6, digest 8d1d6a9d4d07fec7b619618de7dfe2be2254c1790f85f4198c7fe19db9751c02, keeps the b4f63732 pin. A provider switch or compaction reload goes to the session owner, and glas-harness owns that boundary. A live zone-endpoint question goes to zone-engine. The unsigned draft binds this digest and is unsubmitted. 0.2.4 route results do not certify this wording.