Decision services alignment S3: owner answer and STATE-WP-0101 (proposed)

Accept S3 with adaptations: write-back via the dispatch worker to one
authenticated route, hub status is never execution authority, kept
portable for retirement. 6.4: typed columns for enforced fields plus
typed evidence_refs for the rest.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196

workplans/STATE-WP-0101-decision-evidence-links.md

@@ -0,0 +1,87 @@
+---
+id: STATE-WP-0101
+type: workplan
+title: "Decision classes, evidence links and informed-decision write-back (S3)"
+domain: infotech
+repo: state-hub
+status: proposed
+owner: claude-code
+topic_slug: infotech
+created: "2026-10-31"
+updated: "2026-10-31"
+flavor: implementation
+related: [STATE-WP-0096, STATE-WP-0100, NK-WP-0056]
+---
+
+Proposed from hub message 59390db6 (net-kingdom, decision services alignment, S3). Design and
+owner answer: `docs/decision-services-alignment-answer.md`. Hub decisions become the index of open
+questions; C1/C2 decisions are resolved only by informed-decision evidence carried by the private
+memo dispatch worker; C0 and legacy decisions stay as today. Nothing executes on hub decision
+status. Kept small and portable because State Hub is in retirement.
+
+## Founder decisions on the design
+
+```task
+id: STATE-WP-0101-T01
+status: wait
+priority: high
+```
+
+Waiting on the founder: the four questions in section 8 of the design (pull vs push, first
+enforced route with TokenReview, class floor before gate-house S5, retirement disposition of the
+decisions capability). Record the answers in the design document.
+
+## Schema, read model and text-resolution refusals
+
+```task
+id: STATE-WP-0101-T02
+status: wait
+priority: high
+```
+
+Prerequisite: T01. Additive Alembic migration (`decision_class`, `memo_id`, `approval_id`,
+`resolution_source`, `resolution_evidence`, `evidence_refs`, CHECK constraints, partial unique
+index on `memo_id`). Optional fields on `DecisionRead`; typed `evidence_refs` validation. Refuse
+text resolution, resolving PATCH fields, class lowering and resolved creation for C1/C2 with 409
+`evidence_required`. Tests for C0/legacy unchanged behaviour and every refusal in section 4.
+
+## Authenticated evidence route
+
+```task
+id: STATE-WP-0101-T03
+status: wait
+priority: high
+```
+
+Prerequisite: T02 and the RBAC decision in T01. `POST /decisions/{id}/resolve-evidence` with
+`link` and `resolve` modes, projected-token verification (audience
+`state-hub-decision-writeback`, exact subject allowlist), outcome record validation per section
+5.2, idempotency on `(decision_id, memo_id)`, progress event and enriched resolved event. Tests use
+a fake token reviewer; no live token.
+
+## Dispatch worker: outcome pull and write-back
+
+```task
+id: STATE-WP-0101-T04
+status: wait
+priority: high
+```
+
+Prerequisite: T03 and informed-decision's outcome read (owner: informed-decision). Replace the
+free-text resolution payload in `memo_forwarding` with the outcome record and `memo_id`
+correlation; link at enqueue; pull outcomes for the worker's own memos; keep retry and conflict
+ledger. Rewrite `tests/test_memo_forwarding.py` resolution cases.
+
+## Deployment candidate and first classed decision
+
+```task
+id: STATE-WP-0101-T05
+status: wait
+priority: medium
+```
+
+Prerequisite: T04 and cluster prerequisites (auth-delegator binding, second projected audience,
+NetworkPolicy egress worker to API and API ingress from worker). Server dry-run of changed
+objects; live rollout is a separate founder-approved change. Acceptance: one real C1 decision
+resolved by founder answer in informed-decision with stored evidence, and a text resolve of it
+refused.