From 545e85529802eb2b7b54add57cecddbc79b64497 Mon Sep 17 00:00:00 2001 From: Mikhail Date: Sat, 22 Aug 2026 02:49:51 +0300 Subject: [PATCH] Propose external audit exploration mode --- dev/ACTIVE_TASK.json | 4 +- ...1-external-audit-exploration-proposal.json | 41 +++++++ docs/EXTERNAL_AUDIT_EXPLORATION_PROPOSAL.md | 114 ++++++++++++++++++ 3 files changed, 157 insertions(+), 2 deletions(-) create mode 100644 dev/tasks/ARCH-000011-external-audit-exploration-proposal.json create mode 100644 docs/EXTERNAL_AUDIT_EXPLORATION_PROPOSAL.md diff --git a/dev/ACTIVE_TASK.json b/dev/ACTIVE_TASK.json index 5329ff2..0ae8dcd 100644 --- a/dev/ACTIVE_TASK.json +++ b/dev/ACTIVE_TASK.json @@ -1,5 +1,5 @@ { - "task_file": "dev/tasks/DEV-000093-learning-evidence-integrity.json", - "task_id": "DEV-000093", + "task_file": "dev/tasks/ARCH-000011-external-audit-exploration-proposal.json", + "task_id": "ARCH-000011", "task_revision": 1 } diff --git a/dev/tasks/ARCH-000011-external-audit-exploration-proposal.json b/dev/tasks/ARCH-000011-external-audit-exploration-proposal.json new file mode 100644 index 0000000..27d2a80 --- /dev/null +++ b/dev/tasks/ARCH-000011-external-audit-exploration-proposal.json @@ -0,0 +1,41 @@ +{ + "task_id": "ARCH-000011", + "task_revision": 1, + "architecture_revision": "generation-1", + "base_repo_revision": "6f8c4e2bc7d4f86cad3fc0e773c8c580b19a29ee", + "risk_tier": "E", + "intent": "Produce a proposal-only architecture decision for a test Exploration profile with independent external audit, preserving useful local research and evidence while moving review visibility outside Domovoy without creating a direct model-to-world path.", + "requirement_ids": ["FD-009", "FD-015", "FD-017", "FD-018", "FD-019", "FD-025", "INV-AUTH-001", "INV-EPI-001", "INV-PROJ-001", "USER-EXTERNAL-AUDIT-WITH-EXPLORATION-FREEDOM"], + "allowed_change_scope": { + "modules": [], + "paths": [ + "docs/EXTERNAL_AUDIT_EXPLORATION_PROPOSAL.md", + "dev/ACTIVE_TASK.json", + "dev/tasks/ARCH-000011-external-audit-exploration-proposal.json" + ] + }, + "forbidden_change_scope": { + "paths": ["architecture/**", "ci/**", ".gitea/**", "contracts/**", "modules/**", "adapters/**", "cmd/**", "database/**", "deploy/**", "security/**", "tests/**"] + }, + "allowed_architecture_delta": { + "new_cross_module_dependencies": 0, + "new_canonical_owners": 0, + "new_privileges": 0, + "new_third_party_dependencies": 0, + "new_database_owner_roles": 0 + }, + "contracts": { + "consume": ["FD-009 model output boundary", "existing Work/Capability/Epistemics/Commit ownership", "existing transactional outbox direction"], + "may_change": [] + }, + "semantic_owner": "proposal-only; no architectural decision, runtime behavior, audit deployment, or execution privilege is accepted by this task", + "canonical_state": [], + "state_transitions": [], + "side_effects_and_privileges": ["select this proposal in the active task pointer", "no runtime action, provider call, credential handling, deployment, canonical mutation, or external action"], + "persistence_and_migrations": [], + "failure_retry_restart": ["proposal specifies reviewer loss as a non-failure for read-only exploration and a pending state for gated proposals", "no automatic execution or retry is introduced"], + "assumptions": ["the user's explicit instruction authorizes analysis and proposal only, not removal of secret isolation, canonical history, authority validation, or commit/executor ownership", "external audit is independent observation rather than a competing executor", "docker-test remains prohibited"], + "acceptance_scenarios": ["proposal defines useful local behavior during provider loss", "proposal separates canonical owners, audit projection, reviewer evidence and executor", "proposal defines audit outage and unknown-outcome semantics", "proposal identifies staged implementation and explicit decisions required", "no production behavior or protected architecture artifact changes"], + "required_tests": ["task schema", "architecture preflight", "exact diff scope", "documentation review", "CI"], + "terminal_gap_states": ["BLOCKED_BY_ARCHITECTURE_GAP", "BLOCKED_BY_SPEC_GAP", "BLOCKED_BY_CONFLICT"] +} diff --git a/docs/EXTERNAL_AUDIT_EXPLORATION_PROPOSAL.md b/docs/EXTERNAL_AUDIT_EXPLORATION_PROPOSAL.md new file mode 100644 index 0000000..4bf9741 --- /dev/null +++ b/docs/EXTERNAL_AUDIT_EXPLORATION_PROPOSAL.md @@ -0,0 +1,114 @@ +# External audit and exploration proposal + +Status: proposal only +Task: ARCH-000011 +Date: 2026-08-22 + +## Problem + +When an external cognitive provider is unavailable, Domovoy must still remain +useful: understand an ordinary request, inspect its own approved diagnostic +surface, formulate hypotheses, compare recovery options, preserve evidence and +explain the next practical action. A local cognitive path must not collapse +into canned availability notices merely because a stronger provider is absent. + +The testing goal is wider internal freedom for research and learning, paired +with stronger independent observation of actions. It is not a request for an +unattributed path from model output to external mutation. + +## Recommended decision: `exploration-with-external-audit-v1` + +1. Introduce a test-only **Exploration profile**. It authorizes Domovoy to + reason over available local context, run allowlisted read-only diagnostics, + create hypotheses and alternatives, record non-secret evidence, and return + a concrete recovery or research plan. +2. The profile must prefer semantic intent and current situation over a second + keyword parser. Missing capability is itself a topic to investigate: the + response must state what is unavailable, what was observed, what can still + be done locally, and the smallest next action. +3. Exploration output is provisional. It may become a typed Work plan, + Capability gap, or ActionProposal only through the existing semantic owner; + it is never an implicit external action. +4. Each proposed state-changing or external action emits a compact, redacted, + append-only audit event. An independently deployed audit consumer builds a + rebuildable projection containing: action/proposal identity, source + situation and intent references, requested capability, evidence references, + declared scope, outcome state, and external-review verdict. +5. The external reviewer may return `ALLOW`, `REVIEW_REQUIRED`, or `STOP` as a + signed/attributed observation. For configured action classes, Commit uses + the current `ALLOW` observation as an additional precondition before it + authorizes execution. The reviewer never receives executor credentials and + cannot execute an action itself. +6. If the reviewer is unavailable, all exploratory and read-only work remains + available. A state-changing action configured for review remains a typed + pending proposal; it is not silently executed and not reclassified as a + failure. +7. Secrets, raw credentials, and full private payloads do not enter the audit + stream. Audit receives stable references, classifications, hashes and + redacted summaries only. Audit data is a derived projection, never the + canonical owner of decisions, authority or outcomes. + +## Responsibilities + +| Concern | Owner | Role | +| --- | --- | --- | +| Intent, plan and durable decision | `work` | Canonical semantic owner. | +| Hypothesis, observation and evidence | `epistemics` | Canonical evidence owner. | +| Capability gap and cognitive selection | `capability` | Registry and selection owner. | +| Proposal, authorization and execution | `commit` | Only privileged path to a real external action. | +| Audit projection and reviewer evidence | external audit deployment | Independent, rebuildable consumer; no executor authority. | + +## What becomes freer in testing + +- The local cognitive path answers ordinary conversation and configuration + inventory requests from its typed local context. +- Provider loss starts a recovery investigation rather than a generic refusal. +- It may inspect approved health, model registry, capability health, recent + non-secret evidence and local deployment diagnostics. +- It may generate several alternatives, rank them with stated uncertainty and + propose the smallest reversible experiment. +- It may create a reviewable Work/Capability proposal through the normal owner + boundary. + +## What remains an invariant + +- No raw secret crosses into cognition, audit, logs or a provider. +- Model/advisory output does not directly mutate canonical state or call an + executor. +- Every external mutation remains attributable, revision-checked and + reconcilable; `UNKNOWN_OUTCOME` remains distinct from success and failure. +- Audit cannot rewrite canonical history, impersonate a principal, or acquire + broader authority than the action it observes. + +## Delivery slices after acceptance + +1. Add typed semantic routes for ordinary local conversation, configuration + inventory and provider-recovery investigation; remove duplicate raw-text + routing from Work and the cognitive gateway. +2. Register the built-in local route in capability telemetry so selection and + use observations have one source of truth. +3. Add owner-local evidence/decision persistence needed to connect a proposal + to its alternatives and review result. +4. Publish redacted outbox events and implement an external audit projection, + including rebuild and outage tests. +5. Add a Commit precondition that consumes an attributed external `ALLOW` + observation for specifically configured action classes; test `STOP`, + reviewer outage and `UNKNOWN_OUTCOME` recovery. + +## Alternatives rejected + +- **Disable every internal boundary:** removes the evidence and attribution + needed for meaningful external review, and permits a model to mutate the + world without a recoverable decision record. +- **Audit process calls the executor directly:** makes an observer a competing + authority and breaks the Commit boundary. +- **Only log after execution:** detects incidents too late to control actions. +- **One global analytics database as source of truth:** violates canonical + ownership; the audit view must remain rebuildable from owner events. + +## Explicit acceptance required + +Before implementation, accept the recommended decision and choose the first +review-governed action class. The initial implementation can safely enable +the Exploration profile and audit-only observation first; execution gating +must not be inferred for every future capability. -- 2.54.0