coulomb/informed-decision
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add recipient-scoped review discovery and settle initial lifecycle contracts

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a10780-6d41-7952-9718-dfbc1f41236f
This commit is contained in:
tegwick 2026-10-05 01:03:05 +02:00
parent dfcef879d0
commit da2c5a720f
9 changed files with 224 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

11
docs/specs/DecisionLifecycleService.md
View file

@ -163,8 +163,9 @@ document supersedes their exclusion of agent collaboration and human authoring
for the new increment, while preserving human-only dispositions and the evidence
and engine boundaries. L0 and L2 compatibility remain required.
Open implementation contracts: workload identity beyond cluster service accounts;
publication audience policy and any later anonymous publication; source connector
set and retention; non-approval L2 binding integration. T02 must make these
explicit before implementation depends on them. None authorizes a production
rollout or changes external owners' contracts by declaration.
Initial implementation choices are explicit in `LifecycleAdmissionBoundary.md`:
only the admitted cluster workload, authenticated publication, caller-supplied
research provenance, append-only retention, organizational human approval, and
no optional Hub outcome write-back. External identities, anonymous publication,
source connectors/retention controls and non-approval binding are expansion work
under INFD-WP-0008, not hidden prerequisites or enabled production capabilities.

33
docs/specs/LifecycleAdmissionBoundary.md Normal file
View file

@ -0,0 +1,33 @@
# Lifecycle admission and evidence boundary
2026-10-05; INFD-WP-0007-T02. This closes the implementation choices for the
initial production audience. Expansion is tracked separately; these limits are
observable behavior, not an implied grant to extend another owner's interface.
| Concern | Implemented contract |
| --- | --- |
| Human identity | KeyCape-authenticated net-kingdom-admins, tenant:platform; twelve-hour MFA authoring/list window, fifteen-minute review/read/act window |
| Agent identity | Kubernetes TokenReview for the registered State Hub service account with a separate lifecycle audience; unknown and external bearer identities refused |
| Publication | Explicit subject/group audience on an exact revision, authorized by Access Engine; not anonymous or indexed publicly; successor revisions require republication |
| Research | Caller retrieves evidence externally and submits reference, retrieval time, digest and summary; the service does not fetch URLs or attest their truth |
| Evaluation | Attributed assessment, uncertainty and source-event references constrained to the same record/revision/tenant |
| Retention | Append-only revisions, sources, comments, evaluations and binding evidence in the durable store; no automatic purge, mutable source replacement or source connector credentials |
| Documents | Digest-verified bytes supplied through the bounded API; the browser adds short text documents with optional required acknowledgments as new revisions |
| Review | Organizational English approval profile using the existing shared schema and native Approval Engine; recipient from the configured review group, initially platform-root |
| Discovery | Lifecycle workspace uses per-record lifecycle policy. Review overview uses its own list decision; attribute discovery requires the immutable named recipient plus verified native requester, human-control flag and digest |
| Human acceptance | Existing protected review surface, fresh policy/read/act decisions, exact revision/presentation and required acknowledgments; no agent binding route |
| Non-approval profiles | Discussion drafts may be authored and refined, but cannot create an approval review. L0/L2 core schema compatibility does not enable new production disposition profiles |
| Hub write-back | Notification/dispatcher delivery is admitted; optional automatic resolution write-back remains disabled and cannot imply permission to execute |
Identity verification stays in KeyCape/TokenReview; authorization stays in Access
Engine. The headless application service is shared by browser and private API.
Client-supplied research descriptions and evaluation conclusions remain claims
with attribution, not machine-verified facts. Packet bytes are retained so an
external URL changing cannot alter a past presentation.
No finite retention duration, deletion mechanism, new connector, external agent
identity or non-approval signing semantics is invented here. Those product
extensions require their own owner contracts and delivery evidence under
INFD-WP-0008. The existing source/evaluation and organizational approval workflows
provide all nine initial lifecycle operations without per-decision infrastructure
changes.

7
docs/specs/LifecycleFoundationContract.md
View file

@ -2,7 +2,8 @@
2026-10-04; `INFD-WP-0007-T02/T03`. This is the internal persistence slice of
`DecisionLifecycleService.md`. The protected application interface built on this
slice is documented in `LifecycleServiceContract.md`; HTTP exposure is pending.
slice is documented in `LifecycleServiceContract.md`; the deployed private HTTP
adapter is specified in `LifecycleHTTPContract.md`.
## Implemented boundary
@ -16,8 +17,8 @@ Each call carries `Attribution(tenant, Actor(subject, kind))` from its trusted
caller. This is audit attribution, not an authentication assertion. Like `Store`,
the repository is an internal persistence interface: the application/API
layer must authenticate callers and enforce current access-engine authorization
before invoking it. Supplying a tenant string is not an access grant. No route
or runtime configuration exposes these operations in this increment.
before invoking it. Supplying a tenant string is not an access grant. The deployed application adapters authenticate and authorize these operations;
this internal persistence interface is never exposed directly.
## Commands and reads

9
docs/specs/LifecycleWorkspaceDelivery.md
View file

@ -78,3 +78,12 @@ The lifecycle workspace discovers authorized records and exposes their outcomes.
A later change to legacy overview discovery needs an Access Engine contract,
not a consumer-side policy bypass. Broader binding profiles, external identities,
source connectors and optional Hub write-back remain T02/T05 work.
## Named-recipient review discovery — source continuation
The adapter now carries retained intake facts and the immutable memo recipient
for list decisions. It verifies native approval requester, human control and
binding digest before the PDP call. Access Engine compact-sitting v13 checks the
recipient and existing class/submitter/group admission with the twelve-hour list
window; read and act remain separate fifteen-minute decisions. Missing evidence
hides that row. This continuation requires the matching owner pin at release.