From d1081bb70ebf9d9535989f1ad44d0ef09946e1a6 Mon Sep 17 00:00:00 2001 From: Mikhail Date: Sun, 16 Aug 2026 20:01:20 +0300 Subject: [PATCH] architecture: accept creator advisory boundary --- .../ADR-0006-creator-advisory-boundary.md | 31 +++++++++++++++++++ architecture/adrs/README.md | 2 ++ dev/ACTIVE_TASK.json | 4 +-- ...08-accept-cognitive-advisory-boundary.json | 23 ++++++++++++++ docs/COGNITIVE_PROVIDER_PROPOSAL.md | 2 +- 5 files changed, 59 insertions(+), 3 deletions(-) create mode 100644 architecture/adrs/ADR-0006-creator-advisory-boundary.md create mode 100644 dev/tasks/ARCH-000008-accept-cognitive-advisory-boundary.json diff --git a/architecture/adrs/ADR-0006-creator-advisory-boundary.md b/architecture/adrs/ADR-0006-creator-advisory-boundary.md new file mode 100644 index 0000000..7ab7b51 --- /dev/null +++ b/architecture/adrs/ADR-0006-creator-advisory-boundary.md @@ -0,0 +1,31 @@ +# ADR-0006 — Creator advisory boundary + +Status: Accepted +Date: 2026-08-16 +Accepted under: ARCH-000008 + +## Decision + +1. The first cognitive product slice is `creator-advisory-v1`: ephemeral advisory text for an authenticated Creator. +2. Advisory output is non-canonical, has no tools or Executor access, and cannot create or mutate any semantic object or external state. +3. The provider-neutral request/response boundary, data-denial rules, isolation, telemetry and promotion lifecycle are those specified by `docs/COGNITIVE_PROVIDER_PROPOSAL.md`. +4. Initial hard limits are: user message 16 KiB; at most 8 context excerpts; each excerpt 8 KiB; combined context 48 KiB; response 16 KiB; request timeout 30 seconds; at most 2 concurrent requests per Principal; at most 20 accepted requests per Principal per rolling hour. +5. Context sensitivity is fail closed. Only explicitly selected `PUBLIC` or `PRIVATE_ALLOWED` excerpts may enter the gateway; `SECRET`, `UNKNOWN` and omitted classifications are rejected. +6. V1 has no server-side advisory conversation persistence, provider memory, automatic context crawling, automatic retries, tool calls or conversion of an answer into an ActionProposal. +7. The deterministic fake remains the initial and test binding. External provider egress is disabled until a later accepted decision names the provider/API/model family and its retention/training/data-egress policy. +8. A real provider binding cannot promote unless all deterministic boundary/safety tests pass, its evaluation corpus is recorded, and the Creator explicitly enables a fixed binding revision. A new model revision never inherits promotion. + +## Consequences + +- Provider-neutral gateway contracts and a fake adapter may now be implemented without canonical storage or new privileges. +- Cognitive worker continues with no database role and no Commit/Executor credentials. +- Provider-specific HTTP, credentials, outbound network access, production activation and content egress remain prohibited until separately accepted. +- Loss of cognition affects only advisory availability; Continuity, Commit and existing Creator commands remain correct. + +## Revisit triggers + +- A concrete provider/API/model is selected. +- Conversation persistence or provider memory is requested. +- Advisory text should become a typed command candidate. +- Context must be compiled automatically from canonical owners. +- Limits or cost controls need production adjustment. diff --git a/architecture/adrs/README.md b/architecture/adrs/README.md index 574265d..e617bac 100644 --- a/architecture/adrs/README.md +++ b/architecture/adrs/README.md @@ -3,3 +3,5 @@ Accepted architecture decisions live here. Normal implementation tasks may read but not create/change accepted ADRs unless explicitly authorized. Use `ADR-XXXX-title.md` with: problem, evidence, alternatives, decision, rationale, consequences, validity conditions, revisit triggers, migration/rollback, status. + +Current decisions include `ADR-0006-creator-advisory-boundary.md`, the fail-closed provider-neutral advisory boundary. diff --git a/dev/ACTIVE_TASK.json b/dev/ACTIVE_TASK.json index ce53ef5..b5c2917 100644 --- a/dev/ACTIVE_TASK.json +++ b/dev/ACTIVE_TASK.json @@ -1,5 +1,5 @@ { - "task_file": "dev/tasks/ARCH-000007-cognitive-provider-proposal.json", - "task_id": "ARCH-000007", + "task_file": "dev/tasks/ARCH-000008-accept-cognitive-advisory-boundary.json", + "task_id": "ARCH-000008", "task_revision": 1 } diff --git a/dev/tasks/ARCH-000008-accept-cognitive-advisory-boundary.json b/dev/tasks/ARCH-000008-accept-cognitive-advisory-boundary.json new file mode 100644 index 0000000..41e72da --- /dev/null +++ b/dev/tasks/ARCH-000008-accept-cognitive-advisory-boundary.json @@ -0,0 +1,23 @@ +{ + "task_id": "ARCH-000008", + "task_revision": 1, + "architecture_revision": "generation-1", + "base_repo_revision": "78862ffe05f162fd397b688c3baefc0ad3a56a21", + "risk_tier": "E", + "intent": "Accept the provider-neutral Creator advisory boundary from ARCH-000007 with fail-closed no-egress defaults, fixed initial limits, no persistence/tools/actions, and no selected external provider.", + "requirement_ids": ["FD-001", "FD-009", "FD-023", "FD-025", "INV-EPI-001", "USER-CONTINUATION-AFTER-ARCH-000007"], + "allowed_change_scope": {"modules": [], "paths": ["architecture/adrs/ADR-0006-creator-advisory-boundary.md", "architecture/adrs/README.md", "docs/COGNITIVE_PROVIDER_PROPOSAL.md", "dev/ACTIVE_TASK.json", "dev/tasks/ARCH-000008-accept-cognitive-advisory-boundary.json"]}, + "forbidden_change_scope": {"paths": ["architecture/ARCHITECTURE_CONSTITUTION.md", "architecture/architecture-registry.yaml", "architecture/architecture-registry.json", "architecture/CORE_SEMANTIC_MODEL_V1.md", "ci/**", ".gitea/**", "contracts/**", "modules/**", "adapters/**", "cmd/**", "database/**", "deploy/**", "security/**", "tests/**"]}, + "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0}, + "contracts": {"consume": ["ARCH-000007 proposal", "existing authenticated Creator session"], "may_change": []}, + "semantic_owner": "architecture decision only; cognitive worker owns no canonical semantics", + "canonical_state": [], + "state_transitions": [], + "side_effects_and_privileges": ["accept ADR-0006", "no provider call, credential, deployment or runtime mutation"], + "persistence_and_migrations": [], + "failure_retry_restart": ["external egress remains disabled until a provider decision", "advisory requests are ephemeral and never retried automatically", "provider absence returns explicit unavailable state"], + "assumptions": ["the user's continuation after receiving ARCH-000007 accepts the recommended advisory-only boundary", "provider choice and external data egress remain unaccepted, so fail closed", "docker-test remains prohibited"], + "acceptance_scenarios": ["ADR accepts provider-neutral contract and deterministic limits", "no external provider or data egress is accepted", "no canonical persistence, tools or automatic actions are permitted", "fake gateway implementation becomes authorized under a separate task", "real adapter remains blocked until provider/data policy acceptance"], + "required_tests": ["task schema", "architecture preflight", "exact diff scope", "independent protected-path review", "CI"], + "terminal_gap_states": ["BLOCKED_BY_ARCHITECTURE_GAP", "BLOCKED_BY_CONFLICT"] +} diff --git a/docs/COGNITIVE_PROVIDER_PROPOSAL.md b/docs/COGNITIVE_PROVIDER_PROPOSAL.md index 4f36c1f..410b0a4 100644 --- a/docs/COGNITIVE_PROVIDER_PROPOSAL.md +++ b/docs/COGNITIVE_PROVIDER_PROPOSAL.md @@ -1,6 +1,6 @@ # Cognitive provider proposal — Creator advisory V1 -Status: proposal only. It does not authorize implementation, provider traffic, credentials, deployment or architecture changes. +Status: advisory boundary accepted by `ADR-0006`. Provider traffic, credentials, external data egress and deployment remain unaccepted. ## 1. Product slice -- 2.54.0