From 74d33a46f7362efee9b97511ff8e74f050059798 Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 5 Nov 2026 08:24:53 +0100 Subject: [PATCH] NK-WP-0057 proposed: decision routing by component responsibility (founder, decision c9bedd9c) Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 523928@bnt-lap001 Assistant-Session: 6c737afb-9c14-4152-9f02-477214b9c350 --- WORK-RECORDS.md | 5 + ...0057-decision-routing-by-responsibility.md | 152 ++++++++++++++++++ 2 files changed, 157 insertions(+) create mode 100644 workplans/NK-WP-0057-decision-routing-by-responsibility.md diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 5ec5194..8cd58cd 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -54,6 +54,7 @@ | workplan | NK-WP-0054 | active | — | workplans/NK-WP-0054-service-identity-policy.md | | workplan | NK-WP-0055 | active | — | workplans/NK-WP-0055-security-platform-production-readiness.md | | workplan | NK-WP-0056 | proposed | — | workplans/NK-WP-0056-bounded-executor-path.md | +| workplan | NK-WP-0057 | proposed | — | workplans/NK-WP-0057-decision-routing-by-responsibility.md | | task | NK-WP-ADHOC-2026-07-02-T01 | done | — | workplans/ADHOC-2026-07-02.md | | task | NK-WP-ADHOC-2026-07-02-T02 | done | — | workplans/ADHOC-2026-07-02.md | | task | NK-WP-ADHOC-2026-08-14-T01 | done | — | workplans/ADHOC-2026-08-14.md | @@ -364,6 +365,10 @@ | task | NK-WP-0056-T19 | done | — | workplans/NK-WP-0056-bounded-executor-path.md | | task | NK-WP-0056-T20 | done | — | workplans/NK-WP-0056-bounded-executor-path.md | | task | NK-WP-0056-T21 | done | — | workplans/NK-WP-0056-bounded-executor-path.md | +| task | NK-WP-0057-T01 | todo | — | workplans/NK-WP-0057-decision-routing-by-responsibility.md | +| task | NK-WP-0057-T02 | todo | — | workplans/NK-WP-0057-decision-routing-by-responsibility.md | +| task | NK-WP-0057-T03 | todo | — | workplans/NK-WP-0057-decision-routing-by-responsibility.md | +| task | NK-WP-0057-T04 | todo | — | workplans/NK-WP-0057-decision-routing-by-responsibility.md | | intake | NK-IN-0001 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | | intake | NK-IN-0002 | closed | blue | docs/intakes/activity-core-ops-sso-operators.md | | intake | NET-IN-0001 | open | — | intakes/intakes.md | diff --git a/workplans/NK-WP-0057-decision-routing-by-responsibility.md b/workplans/NK-WP-0057-decision-routing-by-responsibility.md new file mode 100644 index 0000000..a48d080 --- /dev/null +++ b/workplans/NK-WP-0057-decision-routing-by-responsibility.md @@ -0,0 +1,152 @@ +--- +id: NK-WP-0057 +type: workplan +title: "Decision routing by component responsibility" +domain: infotech +repo: net-kingdom +status: proposed +flavor: design +owner: claude +topic_slug: netkingdom +created: "2026-11-05" +updated: "2026-11-05" +related: + - NK-WP-0056 + - NK-WP-0054 +--- + +# NK-WP-0057 — Decision routing by component responsibility + +Intake from the founder's decision on 2026-11-05 (State Hub `c9bedd9c`). + +## Why + +NK-WP-0056-T06 found that informed-decision routes every memo for review group `net-kingdom-admins` to one fixed +recipient. That recipient was `platform-root` (`deploy/lifecycle/review-groups.json`), and access-engine's list rule +then shows the memo to that person only. + +As a result, the pilot's admission named `admin` as approver, but only `platform-root` could see the memo. The +executor correctly refused the `platform-root` approval. + +The founder chose `admin` as the interim recipient (informed-decision `77161fe`). The founder also asked to design: + +- **who routes decisions, and how;** +- **from component responsibilities:** which scope or intent a decision touches, and where the overall + responsibility lands when several apply; +- **the boundary of what informed-decision provides** for routing, as distinct from what it should only receive. + +Today the routing is implicit and lives in several places: + +- the memo's `review_group`, which the submitter chooses; +- informed-decision's group → one subject registry; +- access-engine's review policy (`review_recipient`, group membership, MFA); +- the admission's `approval.approvers` and the executor's `approver_subjects` map; +- approval-engine's `binding.principal`; +- gate-house's decision classes C0–C3 (GH-DEC-2026-026). + +No one artifact says who must decide what, or why. + +## Constraints already decided (not reopened here) + +- **Identity model (founder, 2026-10-24):** + - `platform-root` is build-mode only and not used in production; + - `admin` is the production platform administrator; + - `tegwick` builds. +- **Decision classes C0–C3 (GH-DEC-2026-026, accepted 2026-11-01):** anything a service executes on the strength of + a decision is C2 (aal2, a bound approval). +- **Approval binding:** approval-engine binds actor, principal, target and digest. A human-control approval needs + human entries, and the actor never approves its own request. +- **The State Hub is a read model.** Work structure and decisions originate in repositories (ADR-001). + +## Tasks + +### Responsibility inventory + +```task +id: NK-WP-0057-T01 +status: todo +priority: medium +assignee: claude-code +``` + +For every component that requests, presents, approves or consumes decisions, record: + +- what it is responsible for (scope and intent), from its `SCOPE.md`/`INTENT.md`, `docs/responsibility-map.md` and the + service-identity declarations; +- which decisions it raises today, and where each one is routed now. + +Cover at least: + +- the bounded executor and its admissions; +- State Hub decision records; +- CCRs in railiance-platform; +- SecurityCase acceptance; +- informed-decision's own intake; +- gate-house doctrine. + +**Done when:** an inventory table with sources, and the list of routing points in use today (file, owner, what it +decides), is in `docs/proposals/`. + +### Routing model + +```task +id: NK-WP-0057-T02 +status: todo +priority: medium +assignee: claude-code +depends_on: [NK-WP-0057-T01] +``` + +Design how a decision finds its decider: + +- **Responsibility, not group names.** Derive the responsible party from the scopes and intents the decision touches, + and its weight from C0–C3. +- **Overlaps.** When several responsibilities apply, decide where the overall responsibility lands, and how the + other parties take part (co-approval, consult, informed). +- **Ownership of the act.** Settle who does the routing: the submitter, a router component, informed-decision, or + canon resolved at intake. Settle how an admission's approvers, approval-engine's principal and the memo recipient + are kept consistent by construction, not by matching configuration. +- **Production identities.** A routable decider is a production identity (`admin`), never `platform-root`. + Break-glass is the exception, and it is explicit. + +**Done when:** a proposed standard or ADR with worked examples is ready for founder review. The examples: this pilot, +a CCR, a State Hub decision record, and one overlap case. + +### informed-decision boundary + +```task +id: NK-WP-0057-T03 +status: todo +priority: medium +assignee: claude-code +depends_on: [NK-WP-0057-T02] +``` + +Define what informed-decision must provide for routing and what it must not own. It must provide, for example: + +- recipient resolution from a routing input; +- a visible "to be assigned" state; +- refusal of an unroutable memo, instead of a silent default. + +It must not own, for example, the responsibility model itself, or group membership. The answer goes to informed-decision +as an owner request; its owner answers in its repository. + +**Done when:** the boundary is written into the T02 proposal, and informed-decision's owner answer is recorded. + +### Founder decision and follow-through + +```task +id: NK-WP-0057-T04 +status: todo +priority: medium +assignee: claude-code +needs_human: true +intervention_note: "Founder accepts or amends the routing model and the informed-decision boundary." +depends_on: [NK-WP-0057-T02, NK-WP-0057-T03] +``` + +The founder accepts or amends the model. Follow-through workplans are opened in the owning repositories +(informed-decision, access-engine policy, the executor and its admissions, State Hub dispatch). The interim routing of +`net-kingdom-admins` to `admin` is retired or confirmed. + +**Done when:** the founder's decision is recorded, and the follow-through workplans exist.