coulomb/informed-decision
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Persist review evidence and deliver audit records transactionally

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc
This commit is contained in:
tegwick 2026-09-10 23:27:19 +02:00
parent 0e48355b9f
commit 2cc32168ac
14 changed files with 1474 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

33
SCOPE.md
View file

@ -6,11 +6,11 @@
## Status — 2026-09-10
**The domain core, browser sign-in shell and Approval Engine HTTP adapter
are implemented. The approval surface is not deployed.**
**The domain core, browser sign-in shell, Approval Engine HTTP adapter,
durable evidence store and Audit Core delivery adapter are implemented. The approval surface is not deployed.**
What exists and is tested (206 tests, including the explicit real-engine
component suite; 100 were present before browser integration):
What exists and is tested (258 tests, including explicit checks against the
actual Approval Engine and Audit Core implementations with synthetic identities):
- layer and stance declarations — `layer.yaml`, `pep-stance.yaml`,
`informed_decision/stance.py`, with published-equals-shipped asserted;
@ -19,22 +19,31 @@ component suite; 100 were present before browser integration):
- the **domain core**: `memo.py` (the Decision Memo, its versions and the
binding document), `presentation.py` (the sole writer of `view_hash`),
`disposition.py` (the verb vocabulary and guards `G_NOAGENT`, `G_STEP`,
`G_PRES`, `G_ACK`, `G_REASONS`, `G_SEALED`), `provenance.py` (claim routes,
`G_PRES`, `G_ACTOR`, `G_ACK`, `G_REASONS`, `G_SEALED`), `provenance.py` (claim routes,
A-16), `evidence.py` (the local outbox and commitment records);
- `approval_client.py` — the seam to `approval-engine` plus a fake;
- `oidc.py` and `web.py` — public-client PKCE sign-in, verified human/MFA
profile, bounded server-side sessions, protected cookies and CSRF sign-out;
- `approval_http.py` and `http_transport.py` — get-by-id and human-entry
transport, declared-control checks, real entry correlation, no consume route
or automatic mutation retry. This adapter has no public browser mutation route.
or automatic mutation retry. This adapter has no public browser mutation route;
- `store.py` / `records.py` — private durable packet/memo/presentation/
disposition storage, append-only acknowledgments, transactional outbox and
submission correlation, safe reservation and backup/restore;
- `audit.py` — idempotent Audit Core delivery, bounded retry/blocked states,
explicit per-class count/time-basis comparison. Heartbeats are generated
without hiding undelivered evidence; host scheduling remains pending.
Remaining: durable memo/presentation/disposition storage and transactional
evidence outbox, entitlement-before-render integration, L3 review/acknowledgment/
binding UI, independent audit delivery and native deployment proof. The existing
`Outbox` is in memory. Browser sessions are ephemeral, with no approval state.
Remaining: admitted policy package/caller and entitlement-before-render
integration, L3 review/acknowledgment/binding UI, policy observation persistence,
visible unresolved-entry recovery, scheduled independent audit delivery and
native deployment/custody proof. The legacy `evidence.Outbox` remains an
in-memory test double; the new `Store` supplies durable atomicity. Browser
sessions are ephemeral, with no approval state.
`/readyz` returns 503 until the protected approval path is connected.
The origin `decisions.coulomb.social` still serves an nginx placeholder.
See [browser-authentication.md](docs/browser-authentication.md).
See [browser-authentication.md](docs/browser-authentication.md) and
[durable-review-evidence.md](docs/durable-review-evidence.md).
`INFD-WP-0001-T08` remains open for the live end-to-end proof, which is gated on
`APPROVAL-WP-0002-T01` and a deployed `approval-engine`.
@ -82,7 +91,7 @@ trail.
- The unreachable-engine stance map, built to v0.8 obligation 3, with
published-equals-shipped asserted by test (`tests/test_layer_conformance.py`).
**Built as domain operations; durable HTTP integration remains:**
**Built as domain operations with durable custody; protected HTTP integration remains:**
- The presentation record: what was rendered, to whom, when, in which locale and
UI release.