Propose external audit exploration mode

dev/ACTIVE_TASK.json

@@ -1,5 +1,5 @@
 {
-  "task_file": "dev/tasks/DEV-000093-learning-evidence-integrity.json",
-  "task_id": "DEV-000093",
+  "task_file": "dev/tasks/ARCH-000011-external-audit-exploration-proposal.json",
+  "task_id": "ARCH-000011",
   "task_revision": 1
 }

dev/tasks/ARCH-000011-external-audit-exploration-proposal.json

@@ -0,0 +1,41 @@
+{
+  "task_id": "ARCH-000011",
+  "task_revision": 1,
+  "architecture_revision": "generation-1",
+  "base_repo_revision": "6f8c4e2bc7d4f86cad3fc0e773c8c580b19a29ee",
+  "risk_tier": "E",
+  "intent": "Produce a proposal-only architecture decision for a test Exploration profile with independent external audit, preserving useful local research and evidence while moving review visibility outside Domovoy without creating a direct model-to-world path.",
+  "requirement_ids": ["FD-009", "FD-015", "FD-017", "FD-018", "FD-019", "FD-025", "INV-AUTH-001", "INV-EPI-001", "INV-PROJ-001", "USER-EXTERNAL-AUDIT-WITH-EXPLORATION-FREEDOM"],
+  "allowed_change_scope": {
+    "modules": [],
+    "paths": [
+      "docs/EXTERNAL_AUDIT_EXPLORATION_PROPOSAL.md",
+      "dev/ACTIVE_TASK.json",
+      "dev/tasks/ARCH-000011-external-audit-exploration-proposal.json"
+    ]
+  },
+  "forbidden_change_scope": {
+    "paths": ["architecture/**", "ci/**", ".gitea/**", "contracts/**", "modules/**", "adapters/**", "cmd/**", "database/**", "deploy/**", "security/**", "tests/**"]
+  },
+  "allowed_architecture_delta": {
+    "new_cross_module_dependencies": 0,
+    "new_canonical_owners": 0,
+    "new_privileges": 0,
+    "new_third_party_dependencies": 0,
+    "new_database_owner_roles": 0
+  },
+  "contracts": {
+    "consume": ["FD-009 model output boundary", "existing Work/Capability/Epistemics/Commit ownership", "existing transactional outbox direction"],
+    "may_change": []
+  },
+  "semantic_owner": "proposal-only; no architectural decision, runtime behavior, audit deployment, or execution privilege is accepted by this task",
+  "canonical_state": [],
+  "state_transitions": [],
+  "side_effects_and_privileges": ["select this proposal in the active task pointer", "no runtime action, provider call, credential handling, deployment, canonical mutation, or external action"],
+  "persistence_and_migrations": [],
+  "failure_retry_restart": ["proposal specifies reviewer loss as a non-failure for read-only exploration and a pending state for gated proposals", "no automatic execution or retry is introduced"],
+  "assumptions": ["the user's explicit instruction authorizes analysis and proposal only, not removal of secret isolation, canonical history, authority validation, or commit/executor ownership", "external audit is independent observation rather than a competing executor", "docker-test remains prohibited"],
+  "acceptance_scenarios": ["proposal defines useful local behavior during provider loss", "proposal separates canonical owners, audit projection, reviewer evidence and executor", "proposal defines audit outage and unknown-outcome semantics", "proposal identifies staged implementation and explicit decisions required", "no production behavior or protected architecture artifact changes"],
+  "required_tests": ["task schema", "architecture preflight", "exact diff scope", "documentation review", "CI"],
+  "terminal_gap_states": ["BLOCKED_BY_ARCHITECTURE_GAP", "BLOCKED_BY_SPEC_GAP", "BLOCKED_BY_CONFLICT"]
+}

docs/EXTERNAL_AUDIT_EXPLORATION_PROPOSAL.md

@@ -0,0 +1,114 @@
+# External audit and exploration proposal
+
+Status: proposal only
+Task: ARCH-000011
+Date: 2026-08-22
+
+## Problem
+
+When an external cognitive provider is unavailable, Domovoy must still remain
+useful: understand an ordinary request, inspect its own approved diagnostic
+surface, formulate hypotheses, compare recovery options, preserve evidence and
+explain the next practical action.  A local cognitive path must not collapse
+into canned availability notices merely because a stronger provider is absent.
+
+The testing goal is wider internal freedom for research and learning, paired
+with stronger independent observation of actions.  It is not a request for an
+unattributed path from model output to external mutation.
+
+## Recommended decision: `exploration-with-external-audit-v1`
+
+1. Introduce a test-only **Exploration profile**.  It authorizes Domovoy to
+   reason over available local context, run allowlisted read-only diagnostics,
+   create hypotheses and alternatives, record non-secret evidence, and return
+   a concrete recovery or research plan.
+2. The profile must prefer semantic intent and current situation over a second
+   keyword parser.  Missing capability is itself a topic to investigate: the
+   response must state what is unavailable, what was observed, what can still
+   be done locally, and the smallest next action.
+3. Exploration output is provisional.  It may become a typed Work plan,
+   Capability gap, or ActionProposal only through the existing semantic owner;
+   it is never an implicit external action.
+4. Each proposed state-changing or external action emits a compact, redacted,
+   append-only audit event.  An independently deployed audit consumer builds a
+   rebuildable projection containing: action/proposal identity, source
+   situation and intent references, requested capability, evidence references,
+   declared scope, outcome state, and external-review verdict.
+5. The external reviewer may return `ALLOW`, `REVIEW_REQUIRED`, or `STOP` as a
+   signed/attributed observation.  For configured action classes, Commit uses
+   the current `ALLOW` observation as an additional precondition before it
+   authorizes execution.  The reviewer never receives executor credentials and
+   cannot execute an action itself.
+6. If the reviewer is unavailable, all exploratory and read-only work remains
+   available.  A state-changing action configured for review remains a typed
+   pending proposal; it is not silently executed and not reclassified as a
+   failure.
+7. Secrets, raw credentials, and full private payloads do not enter the audit
+   stream.  Audit receives stable references, classifications, hashes and
+   redacted summaries only.  Audit data is a derived projection, never the
+   canonical owner of decisions, authority or outcomes.
+
+## Responsibilities
+
+| Concern | Owner | Role |
+| --- | --- | --- |
+| Intent, plan and durable decision | `work` | Canonical semantic owner. |
+| Hypothesis, observation and evidence | `epistemics` | Canonical evidence owner. |
+| Capability gap and cognitive selection | `capability` | Registry and selection owner. |
+| Proposal, authorization and execution | `commit` | Only privileged path to a real external action. |
+| Audit projection and reviewer evidence | external audit deployment | Independent, rebuildable consumer; no executor authority. |
+
+## What becomes freer in testing
+
+- The local cognitive path answers ordinary conversation and configuration
+  inventory requests from its typed local context.
+- Provider loss starts a recovery investigation rather than a generic refusal.
+- It may inspect approved health, model registry, capability health, recent
+  non-secret evidence and local deployment diagnostics.
+- It may generate several alternatives, rank them with stated uncertainty and
+  propose the smallest reversible experiment.
+- It may create a reviewable Work/Capability proposal through the normal owner
+  boundary.
+
+## What remains an invariant
+
+- No raw secret crosses into cognition, audit, logs or a provider.
+- Model/advisory output does not directly mutate canonical state or call an
+  executor.
+- Every external mutation remains attributable, revision-checked and
+  reconcilable; `UNKNOWN_OUTCOME` remains distinct from success and failure.
+- Audit cannot rewrite canonical history, impersonate a principal, or acquire
+  broader authority than the action it observes.
+
+## Delivery slices after acceptance
+
+1. Add typed semantic routes for ordinary local conversation, configuration
+   inventory and provider-recovery investigation; remove duplicate raw-text
+   routing from Work and the cognitive gateway.
+2. Register the built-in local route in capability telemetry so selection and
+   use observations have one source of truth.
+3. Add owner-local evidence/decision persistence needed to connect a proposal
+   to its alternatives and review result.
+4. Publish redacted outbox events and implement an external audit projection,
+   including rebuild and outage tests.
+5. Add a Commit precondition that consumes an attributed external `ALLOW`
+   observation for specifically configured action classes; test `STOP`,
+   reviewer outage and `UNKNOWN_OUTCOME` recovery.
+
+## Alternatives rejected
+
+- **Disable every internal boundary:** removes the evidence and attribution
+  needed for meaningful external review, and permits a model to mutate the
+  world without a recoverable decision record.
+- **Audit process calls the executor directly:** makes an observer a competing
+  authority and breaks the Commit boundary.
+- **Only log after execution:** detects incidents too late to control actions.
+- **One global analytics database as source of truth:** violates canonical
+  ownership; the audit view must remain rebuildable from owner events.
+
+## Explicit acceptance required
+
+Before implementation, accept the recommended decision and choose the first
+review-governed action class.  The initial implementation can safely enable
+the Exploration profile and audit-only observation first; execution gating
+must not be inferred for every future capability.