informed-decision/WORK-RECORDS.md

23 lines
1.6 KiB
Markdown
Raw Normal View History

# Work Records — informed-decision
> Generated by `statehub fix-consistency` (CUST-WP-0061-T04, work-record
> stage 3). Do not edit by hand — edit the source file/block listed for
> each record and re-run fix-consistency to refresh this index. Archived
> workplans are omitted; closed decisions/intakes/engagements stay listed
> so recently-resolved work is still visible. [auto]
| Kind | ID | Status | Lane | Source |
| --- | --- | --- | --- | --- |
Promote schema and canonicalizer out of history; add EvidenceModel (T06) Verified the three published hashes reproduce byte for byte before promoting anything, then moved the schema, canonicalizer and vectors into governed assets. history/20260909-initial-exploration/ is untouched and stays the provenance record. - schemas/, informed_decision/, tests/vectors/ populated; the reference canonicalizer's ad-hoc __main__ block replaced by a real `python -m informed_decision` entry point. - tests/test_canonicalize.py — 20 tests, all green. Published vectors, all four isolation properties, canonical-form round-trip, key sorting, and a provenance test asserting the governed fixtures have not drifted from history/. - docs/specs/EvidenceModel.md — the two hashes, the split and why it exists, the four isolation properties, the presentation record, the bundle, and the relationship to audit-core. - pyproject.toml, Makefile. One test of mine was wrong on first run: it scanned for ", " to assert no insignificant whitespace, which fires on prose inside a brief. Replaced with a canonical round-trip comparison, which is the property actually meant. The canonicalizer was correct. EvidenceModel leads with what the model does NOT claim — no proof of comprehension, no proof of reading (deliberately, since the alternative is surveillance), no survival of a compromised surface, and audit-core's inherited bound that a hash chain cannot prove a record was never sent. T06 stays progress: the SCOPE.md rewrite is gated on the T02 ruling. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V3W1dQG7GFFM9d94jFx7iR Assistant: claude-code Assistant-Model: opus Assistant-Process: 1565372@bnt-lap001 Assistant-Session: 16bb2f25-b34c-49ef-8e94-5fec3567a568
2026-09-09 14:16:28 +02:00
| workplan | INFD-WP-0001 | active | — | workplans/INFD-WP-0001-founding-specs-and-approver-ui-ownership.md |
| task | INFD-WP-0001-T01 | done | — | workplans/INFD-WP-0001-founding-specs-and-approver-ui-ownership.md |
Architecture Blueprint and rewritten SCOPE; close T05 and T06 T05 written after the ruling rather than before it, which was the point of gating it. GH-DEC-2026-012 limit 3 did most of the shaping: the evidence copy must reach audit-core independently of this component, because here the actor being audited and the evidence source are the same. Booked as four binding implementation consequences plus O-02, which must be resolved before T08 ships — "we will add the independent path later" is how limit 3 becomes limit-3-in-principle. Other constraints fixed in the blueprint: presentation/ is the only writer of view_hash; the approval-engine client exposes no validity cache; a fail-closed outcome is never recorded as an approver's decline, since the human made none; the assurance shape is cited from key-cape's contract rather than restated so it cannot drift; and no polling loop may synthesise the inbox approval-engine refuses to provide. T06 closed with the SCOPE.md rewrite the ruling unblocked. It carries a "What this repository does not claim" section, because a scope file listing only capabilities overstates them: the decision path is not validated while GH-DEC-2026-010 is open, the residual is not closed, view_hash is not inside the approval entry, and nothing is deployed. Two open items block the remainder. O-01, the human token tenant, blocks T07 and is not ours alone to decide. O-02, the independent evidence path, blocks T08. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V3W1dQG7GFFM9d94jFx7iR Assistant: claude-code Assistant-Model: opus Assistant-Process: 1565372@bnt-lap001 Assistant-Session: 16bb2f25-b34c-49ef-8e94-5fec3567a568
2026-09-09 22:29:06 +02:00
| task | INFD-WP-0001-T02 | done | — | workplans/INFD-WP-0001-founding-specs-and-approver-ui-ownership.md |
| task | INFD-WP-0001-T03 | done | — | workplans/INFD-WP-0001-founding-specs-and-approver-ui-ownership.md |
| task | INFD-WP-0001-T04 | done | — | workplans/INFD-WP-0001-founding-specs-and-approver-ui-ownership.md |
Close INFD-IN-0001; design the independent evidence path; track both blockers Housekeeping the ruling left behind, plus the one piece of blocked work that was substantially ours to move. INFD-IN-0001 closed with its resolution recorded, matching approval-engine's IN-0002 form. It was still open after GH-DEC-2026-012 answered it. INFD-IN-0003 and docs/evidence-path-design.md take up O-02, which was sitting in the blueprint as "mechanism unchosen". Read independence and the local transactional outbox are settled and not in question. The real question is what travels, and it is sharper for us than for approval-engine because a presentation record carries the brief and packet material actually shown to a human. Three candidates with costs; proposal is commitment-only for Stage 1 — hashes, principal, timestamps, acks, co-referenced approval id — which discharges limit 3 and removes our ability to alter the record, while leaving us able to erase the content. That residual is declared alongside the existing compromised-surface one rather than papered over. Deliberately not proposing the full binding document unilaterally: it would put commercial and personal material into the audit fabric under retention and export entitlements designed for audit events. That is a meaningful change in what audit-core holds and is its owner's to accept, not ours to assume. The third option, a separate evidence store, is refused here because that store has no owner and inventing one routes around the §16 decision against stronger archival custody. Cadence declared and its form argued rather than copied: approval-engine's heartbeat answer suits genuinely low-volume classes, but ours are mixed — presentations are one per render, while dispositions and stance applications are low-volume and are the security-relevant ones. Reconciliation per class as primary, heartbeat for the low-volume classes. Depends on AUDIT-WP-0009 T04/T06; declared, not claimed operating. INFD-IN-0002 files the tenant blocker as a tracked record rather than leaving it in message threads and a blueprint footnote. T07 and T08 now name their blocking intakes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V3W1dQG7GFFM9d94jFx7iR Assistant: claude-code Assistant-Model: opus Assistant-Process: 1565372@bnt-lap001 Assistant-Session: 16bb2f25-b34c-49ef-8e94-5fec3567a568
2026-09-09 23:19:27 +02:00
| task | INFD-WP-0001-T05 | done | — | workplans/INFD-WP-0001-founding-specs-and-approver-ui-ownership.md |
| task | INFD-WP-0001-T06 | done | — | workplans/INFD-WP-0001-founding-specs-and-approver-ui-ownership.md |
| task | INFD-WP-0001-T07 | todo | — | workplans/INFD-WP-0001-founding-specs-and-approver-ui-ownership.md |
| task | INFD-WP-0001-T08 | todo | — | workplans/INFD-WP-0001-founding-specs-and-approver-ui-ownership.md |
| intake | INFD-IN-0001 | closed | blue | intakes/intakes.md |
| intake | INFD-IN-0002 | open | blue | intakes/intakes.md |
| intake | INFD-IN-0003 | open | blue | intakes/intakes.md |