NK-WP-0057 proposed: decision routing by component responsibility (founder, decision c9bedd9c)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 523928@bnt-lap001
Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350

WORK-RECORDS.md

@@ -54,6 +54,7 @@
 | workplan | NK-WP-0054 | active | — | workplans/NK-WP-0054-service-identity-policy.md |
 | workplan | NK-WP-0055 | active | — | workplans/NK-WP-0055-security-platform-production-readiness.md |
 | workplan | NK-WP-0056 | proposed | — | workplans/NK-WP-0056-bounded-executor-path.md |
+| workplan | NK-WP-0057 | proposed | — | workplans/NK-WP-0057-decision-routing-by-responsibility.md |
 | task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md |
 | task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md |
 | task | NK-WP-ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md |
@@ -364,6 +365,10 @@
 | task | NK-WP-0056-T19 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
 | task | NK-WP-0056-T20 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
 | task | NK-WP-0056-T21 | done | — | workplans/NK-WP-0056-bounded-executor-path.md |
+| task | NK-WP-0057-T01 | todo | — | workplans/NK-WP-0057-decision-routing-by-responsibility.md |
+| task | NK-WP-0057-T02 | todo | — | workplans/NK-WP-0057-decision-routing-by-responsibility.md |
+| task | NK-WP-0057-T03 | todo | — | workplans/NK-WP-0057-decision-routing-by-responsibility.md |
+| task | NK-WP-0057-T04 | todo | — | workplans/NK-WP-0057-decision-routing-by-responsibility.md |
 | intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
 | intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md |
 | intake | NET-IN-0001 | open | — | intakes/intakes.md |

workplans/NK-WP-0057-decision-routing-by-responsibility.md

@@ -0,0 +1,152 @@
+---
+id: NK-WP-0057
+type: workplan
+title: "Decision routing by component responsibility"
+domain: infotech
+repo: net-kingdom
+status: proposed
+flavor: design
+owner: claude
+topic_slug: netkingdom
+created: "2026-11-05"
+updated: "2026-11-05"
+related:
+  - NK-WP-0056
+  - NK-WP-0054
+---
+
+# NK-WP-0057 — Decision routing by component responsibility
+
+Intake from the founder's decision on 2026-11-05 (State Hub `c9bedd9c`).
+
+## Why
+
+NK-WP-0056-T06 found that informed-decision routes every memo for review group `net-kingdom-admins` to one fixed
+recipient. That recipient was `platform-root` (`deploy/lifecycle/review-groups.json`), and access-engine's list rule
+then shows the memo to that person only.
+
+As a result, the pilot's admission named `admin` as approver, but only `platform-root` could see the memo. The
+executor correctly refused the `platform-root` approval.
+
+The founder chose `admin` as the interim recipient (informed-decision `77161fe`). The founder also asked to design:
+
+- **who routes decisions, and how;**
+- **from component responsibilities:** which scope or intent a decision touches, and where the overall
+  responsibility lands when several apply;
+- **the boundary of what informed-decision provides** for routing, as distinct from what it should only receive.
+
+Today the routing is implicit and lives in several places:
+
+- the memo's `review_group`, which the submitter chooses;
+- informed-decision's group → one subject registry;
+- access-engine's review policy (`review_recipient`, group membership, MFA);
+- the admission's `approval.approvers` and the executor's `approver_subjects` map;
+- approval-engine's `binding.principal`;
+- gate-house's decision classes C0–C3 (GH-DEC-2026-026).
+
+No one artifact says who must decide what, or why.
+
+## Constraints already decided (not reopened here)
+
+- **Identity model (founder, 2026-10-24):**
+  - `platform-root` is build-mode only and not used in production;
+  - `admin` is the production platform administrator;
+  - `tegwick` builds.
+- **Decision classes C0–C3 (GH-DEC-2026-026, accepted 2026-11-01):** anything a service executes on the strength of
+  a decision is C2 (aal2, a bound approval).
+- **Approval binding:** approval-engine binds actor, principal, target and digest. A human-control approval needs
+  human entries, and the actor never approves its own request.
+- **The State Hub is a read model.** Work structure and decisions originate in repositories (ADR-001).
+
+## Tasks
+
+### Responsibility inventory
+
+```task
+id: NK-WP-0057-T01
+status: todo
+priority: medium
+assignee: claude-code
+```
+
+For every component that requests, presents, approves or consumes decisions, record:
+
+- what it is responsible for (scope and intent), from its `SCOPE.md`/`INTENT.md`, `docs/responsibility-map.md` and the
+  service-identity declarations;
+- which decisions it raises today, and where each one is routed now.
+
+Cover at least:
+
+- the bounded executor and its admissions;
+- State Hub decision records;
+- CCRs in railiance-platform;
+- SecurityCase acceptance;
+- informed-decision's own intake;
+- gate-house doctrine.
+
+**Done when:** an inventory table with sources, and the list of routing points in use today (file, owner, what it
+decides), is in `docs/proposals/`.
+
+### Routing model
+
+```task
+id: NK-WP-0057-T02
+status: todo
+priority: medium
+assignee: claude-code
+depends_on: [NK-WP-0057-T01]
+```
+
+Design how a decision finds its decider:
+
+- **Responsibility, not group names.** Derive the responsible party from the scopes and intents the decision touches,
+  and its weight from C0–C3.
+- **Overlaps.** When several responsibilities apply, decide where the overall responsibility lands, and how the
+  other parties take part (co-approval, consult, informed).
+- **Ownership of the act.** Settle who does the routing: the submitter, a router component, informed-decision, or
+  canon resolved at intake. Settle how an admission's approvers, approval-engine's principal and the memo recipient
+  are kept consistent by construction, not by matching configuration.
+- **Production identities.** A routable decider is a production identity (`admin`), never `platform-root`.
+  Break-glass is the exception, and it is explicit.
+
+**Done when:** a proposed standard or ADR with worked examples is ready for founder review. The examples: this pilot,
+a CCR, a State Hub decision record, and one overlap case.
+
+### informed-decision boundary
+
+```task
+id: NK-WP-0057-T03
+status: todo
+priority: medium
+assignee: claude-code
+depends_on: [NK-WP-0057-T02]
+```
+
+Define what informed-decision must provide for routing and what it must not own. It must provide, for example:
+
+- recipient resolution from a routing input;
+- a visible "to be assigned" state;
+- refusal of an unroutable memo, instead of a silent default.
+
+It must not own, for example, the responsibility model itself, or group membership. The answer goes to informed-decision
+as an owner request; its owner answers in its repository.
+
+**Done when:** the boundary is written into the T02 proposal, and informed-decision's owner answer is recorded.
+
+### Founder decision and follow-through
+
+```task
+id: NK-WP-0057-T04
+status: todo
+priority: medium
+assignee: claude-code
+needs_human: true
+intervention_note: "Founder accepts or amends the routing model and the informed-decision boundary."
+depends_on: [NK-WP-0057-T02, NK-WP-0057-T03]
+```
+
+The founder accepts or amends the model. Follow-through workplans are opened in the owning repositories
+(informed-decision, access-engine policy, the executor and its admissions, State Hub dispatch). The interim routing of
+`net-kingdom-admins` to `admin` is retired or confirmed.
+
+**Done when:** the founder's decision is recorded, and the follow-through workplans exist.