diff --git a/docs/decision-services-alignment-answer.md b/docs/decision-services-alignment-answer.md index 5e932b5..3e155c4 100644 --- a/docs/decision-services-alignment-answer.md +++ b/docs/decision-services-alignment-answer.md @@ -4,8 +4,8 @@ **Answers:** hub message 59390db6 (net-kingdom), proposal `net-kingdom/docs/proposals/2026-10-31-decision-services-alignment-review.md` (commit b764561), sections 3, 4.4, 5 (S3) and open question 6.4. -**Status:** owner answer; design only. No API, schema or deployment change is made with this -document. Implementation is proposed as `workplans/STATE-WP-0101-decision-evidence-links.md`. +**Status:** owner answer; founder decisions 1-3 recorded 2026-11-01 (section 8.1), decision 4 +open. No API, schema or deployment change is made with this document. Implementation is proposed as `workplans/STATE-WP-0101-decision-evidence-links.md`. ## 1. Answer in short @@ -96,8 +96,9 @@ attached. The vocabulary grows by owner change, not free form. | MCP `resolve_decision` | as today | gets the same 409 from the API | same | Who sets the class: the creator, at creation or later by raising it. Doctrine for which class a -question needs comes from gate-house (S5). Until S5, the hub suggests a floor only for the existing -financial/legal auto-escalation keywords (C1 minimum). Linking a decision to a task with +question needs comes from gate-house (GH-DEC-2026-026, accepted 2026-11-01: C3 is reserved and is +refused by the hub). The hub sets no keyword-based floor (section 8.1, decision 3); the existing +financial/legal auto-escalation does not set a class. Linking a decision to a task with `needs_human: true` does not by itself raise the class. The existing review-contract gate keeps applying on both resolve routes. @@ -208,6 +209,26 @@ against the cluster's service-account issuer JWKS. 4. **Retirement disposition:** confirm the decisions capability is "keep, move to hub-core" so this work is not stranded. +### 8.1 Founder answers (2026-11-01) + +Given by the founder on 2026-11-01 in the net-kingdom session and relayed by the net-kingdom +coordinator; recorded here as relayed, not as C1 evidence. + +1. **Pull.** "The hub worker fetches outcomes": the existing STATE-WP-0096 dispatch worker reads + the outcome from informed-decision with its existing token and posts it to one new route that + accepts only the hub's own ServiceAccount, verified by TokenReview. informed-decision gets no + hub credential. +2. **Accepted, implied by decision 1.** The pull option was presented as needing a cluster-level + `system:auth-delegator` grant for the API's ServiceAccount; accepting it accepts enforced token + checks on this one route ahead of STATE-WP-0100 phase 3. The grant itself is a founder-run live + step (railiance-cluster); nothing in this repository applies it. +3. **Moot.** Gate-house doctrine GH-DEC-2026-026 (decision classes C0-C3, reliance as the C2 + trigger, C3 reserved and not usable) was accepted by the founder the same day. The hub sets no + keyword-based class floor; classes are declared by the creator under that doctrine. The + existing financial/legal auto-escalation stays as it is and does not set a class. +4. **Not decided; open.** The keep/move disposition of the decisions capability remains with the + founder. The implementation stays small and portable (section 6) so either answer is served. + ## 9. Asks of other owners - **informed-decision:** an outcome read for a submitter's own memos returning the record in diff --git a/workplans/STATE-WP-0101-decision-evidence-links.md b/workplans/STATE-WP-0101-decision-evidence-links.md index bf9dad9..9254f19 100644 --- a/workplans/STATE-WP-0101-decision-evidence-links.md +++ b/workplans/STATE-WP-0101-decision-evidence-links.md @@ -4,11 +4,11 @@ type: workplan title: "Decision classes, evidence links and informed-decision write-back (S3)" domain: infotech repo: state-hub -status: proposed +status: active owner: claude-code topic_slug: infotech created: "2026-10-31" -updated: "2026-10-31" +updated: "2026-11-01" flavor: implementation related: [STATE-WP-0096, STATE-WP-0100, NK-WP-0056] state_hub_workstream_id: "d2cf5147-df84-5de7-8fb3-f9b8e3e2cdb3" @@ -33,6 +33,21 @@ Waiting on the founder: the four questions in section 8 of the design (pull vs p enforced route with TokenReview, class floor before gate-house S5, retirement disposition of the decisions capability). Record the answers in the design document. +2026-11-01, founder decisions relayed by the net-kingdom coordinator from the net-kingdom session, +recorded in section 8.1 of the design: + +- Decision 1, pull: the dispatch worker fetches outcomes with its existing token and posts them to + one new route that accepts only the hub's own ServiceAccount via TokenReview; informed-decision + gets no hub credential. +- Decision 2, accepted (implied by decision 1): enforced token checks on this one route ahead of + STATE-WP-0100 phase 3, including the `system:auth-delegator` grant for the API's ServiceAccount. + The grant is a founder-run live step. +- Decision 3, moot: gate-house GH-DEC-2026-026 (C0-C3, reliance as the C2 trigger, C3 reserved) + was accepted the same day. No keyword class floor. +- **Decision 4, retirement disposition (keep, move to hub-core): not decided, left open.** T01 + stays in `wait` on this question only. T02 and T03 depend on decisions 1-3 alone (the schema and + route are portable by design, section 6), so they proceed. + ## Schema, read model and text-resolution refusals ```task @@ -42,7 +57,7 @@ priority: high state_hub_task_id: "67e64f95-4869-5aef-9f44-5fcc688a1012" ``` -Prerequisite: T01. Additive Alembic migration (`decision_class`, `memo_id`, `approval_id`, +Prerequisite: T01 decisions 1-3 (recorded 2026-11-01). Additive Alembic migration (`decision_class`, `memo_id`, `approval_id`, `resolution_source`, `resolution_evidence`, `evidence_refs`, CHECK constraints, partial unique index on `memo_id`). Optional fields on `DecisionRead`; typed `evidence_refs` validation. Refuse text resolution, resolving PATCH fields, class lowering and resolved creation for C1/C2 with 409 @@ -57,7 +72,7 @@ priority: high state_hub_task_id: "fed28083-1eda-5f99-abf7-39c02b45988e" ``` -Prerequisite: T02 and the RBAC decision in T01. `POST /decisions/{id}/resolve-evidence` with +Prerequisite: T02 and the RBAC decision in T01 (decision 2, accepted 2026-11-01). `POST /decisions/{id}/resolve-evidence` with `link` and `resolve` modes, projected-token verification (audience `state-hub-decision-writeback`, exact subject allowlist), outcome record validation per section 5.2, idempotency on `(decision_id, memo_id)`, progress event and enriched resolved event. Tests use