From 3de01f8a941067c59847510cda9975e5a2a3c8a8 Mon Sep 17 00:00:00 2001 From: Mikhail Date: Sat, 22 Aug 2026 02:53:29 +0300 Subject: [PATCH] Accept external audit exploration mode --- ...DR-0018-external-audit-exploration-mode.md | 52 +++++++++++++++++++ architecture/adrs/README.md | 2 +- dev/ACTIVE_TASK.json | 4 +- ...012-accept-external-audit-exploration.json | 40 ++++++++++++++ docs/EXTERNAL_AUDIT_EXPLORATION_PROPOSAL.md | 2 +- 5 files changed, 96 insertions(+), 4 deletions(-) create mode 100644 architecture/adrs/ADR-0018-external-audit-exploration-mode.md create mode 100644 dev/tasks/ARCH-000012-accept-external-audit-exploration.json diff --git a/architecture/adrs/ADR-0018-external-audit-exploration-mode.md b/architecture/adrs/ADR-0018-external-audit-exploration-mode.md new file mode 100644 index 0000000..7838325 --- /dev/null +++ b/architecture/adrs/ADR-0018-external-audit-exploration-mode.md @@ -0,0 +1,52 @@ +# ADR-0018 — External audit and exploration mode + +Status: Accepted +Date: 2026-08-22 +Accepted under: ARCH-000012 + +## Decision + +1. Domovoy may operate in a test-only `Exploration` profile when an ordinary + local conversation or cognitive-provider recovery request is received. + Exploration permits contextual reasoning, allowlisted read-only diagnostics, + hypothesis generation, alternatives and a reversible next-step proposal. +2. Exploration is not an authority grant. It does not grant access to raw + secrets, executor credentials, a provider's unapproved data-egress path, or + direct mutation of canonical or external state. +3. Audit is an independently deployed, rebuildable projection of compact, + redacted action/proposal events. It is not a canonical owner and never + executes actions. +4. An attributed external audit verdict is an Observation. A later Commit + contract may require a current `ALLOW` Observation as an additional + precondition for explicitly configured action classes. `REVIEW_REQUIRED`, + `STOP`, missing or stale review do not authorize execution. +5. Loss of the audit deployment does not remove exploration or approved + read-only diagnostics. A review-governed external action remains a pending + proposal; it is neither executed nor silently converted to failure. +6. Audit payloads exclude raw credentials, secrets and private content. They + carry stable identifiers/references, classifications, hashes and redacted + summaries only. +7. Initial delivery is staged: first semantic local dialogue and provider + recovery, then capability-use telemetry, then audit-only projection. No + existing executor action is review-governed until a later task names its + class and recovery behavior. + +## Consequences + +- Local cognition remains useful during provider loss and can seek a recovery + plan instead of returning canned availability text. +- Higher-level external scrutiny is possible without creating a competing + executor or a second source of semantic truth. +- Commit/Executor, semantic ownership, append-only evidence and unknown + outcome semantics remain invariants, so external review has attributable + evidence to inspect. +- The first implementation task may change local semantic routing and + capability telemetry only; audit projection and Commit gating need their + own explicit contracts and failure/rebuild tests. + +## Revisit triggers + +- The first external audit projection is deployed. +- A concrete external action class is proposed for review gating. +- Audit needs a data class beyond redacted references. +- The Exploration profile needs a new privilege or canonical owner. diff --git a/architecture/adrs/README.md b/architecture/adrs/README.md index 0b9eb89..b27d69b 100644 --- a/architecture/adrs/README.md +++ b/architecture/adrs/README.md @@ -4,4 +4,4 @@ Accepted architecture decisions live here. Normal implementation tasks may read Use `ADR-XXXX-title.md` with: problem, evidence, alternatives, decision, rationale, consequences, validity conditions, revisit triggers, migration/rollback, status. -Current decisions include `ADR-0006-creator-advisory-boundary.md`, the fail-closed provider-neutral advisory boundary, and `ADR-0007-openai-advisory-binding.md`, the accepted but not yet production-enabled OpenAI binding class. +Current decisions include `ADR-0006-creator-advisory-boundary.md`, the fail-closed provider-neutral advisory boundary; `ADR-0007-openai-advisory-binding.md`, the accepted but not yet production-enabled OpenAI binding class; and `ADR-0018-external-audit-exploration-mode.md`, the staged external-audit and test Exploration profile. diff --git a/dev/ACTIVE_TASK.json b/dev/ACTIVE_TASK.json index 0ae8dcd..5e6152a 100644 --- a/dev/ACTIVE_TASK.json +++ b/dev/ACTIVE_TASK.json @@ -1,5 +1,5 @@ { - "task_file": "dev/tasks/ARCH-000011-external-audit-exploration-proposal.json", - "task_id": "ARCH-000011", + "task_file": "dev/tasks/ARCH-000012-accept-external-audit-exploration.json", + "task_id": "ARCH-000012", "task_revision": 1 } diff --git a/dev/tasks/ARCH-000012-accept-external-audit-exploration.json b/dev/tasks/ARCH-000012-accept-external-audit-exploration.json new file mode 100644 index 0000000..85bc13c --- /dev/null +++ b/dev/tasks/ARCH-000012-accept-external-audit-exploration.json @@ -0,0 +1,40 @@ +{ + "task_id": "ARCH-000012", + "task_revision": 1, + "architecture_revision": "generation-1", + "base_repo_revision": "948896c", + "risk_tier": "E", + "intent": "Accept the staged external-audit and Domovoy Exploration profile proposed by ARCH-000011, while retaining semantic ownership, redacted evidence, and the Commit/Executor boundary.", + "requirement_ids": ["ARCH-000011", "FD-009", "FD-015", "FD-017", "FD-025", "INV-AUTH-001", "INV-EPI-001", "INV-PROJ-001", "USER-CONTINUE-AFTER-ARCH-000011"], + "allowed_change_scope": { + "modules": [], + "paths": [ + "architecture/adrs/ADR-0018-external-audit-exploration-mode.md", + "architecture/adrs/README.md", + "docs/EXTERNAL_AUDIT_EXPLORATION_PROPOSAL.md", + "dev/ACTIVE_TASK.json", + "dev/tasks/ARCH-000012-accept-external-audit-exploration.json" + ] + }, + "forbidden_change_scope": { + "paths": ["architecture/ARCHITECTURE_CONSTITUTION.md", "architecture/architecture-registry.yaml", "architecture/architecture-registry.json", "architecture/CORE_SEMANTIC_MODEL_V1.md", "ci/**", ".gitea/**", "contracts/**", "modules/**", "adapters/**", "cmd/**", "database/**", "deploy/**", "security/**", "tests/**"] + }, + "allowed_architecture_delta": { + "new_cross_module_dependencies": 0, + "new_canonical_owners": 0, + "new_privileges": 0, + "new_third_party_dependencies": 0, + "new_database_owner_roles": 0 + }, + "contracts": {"consume": ["ARCH-000011 proposal", "existing Work/Epistemics/Capability/Commit ownership"], "may_change": []}, + "semantic_owner": "architecture decision only; no runtime, audit deployment, external action or canonical-state behavior is changed", + "canonical_state": [], + "state_transitions": [], + "side_effects_and_privileges": ["accept ADR-0018", "no provider call, credential handling, deployment, canonical mutation, or external action"], + "persistence_and_migrations": [], + "failure_retry_restart": ["reviewer loss keeps review-governed proposals pending", "no automatic execution or retry is accepted"], + "assumptions": ["the user's instruction 'делай' after ARCH-000011 accepts the recommended staged decision", "initial delivery has no review-governed external action class", "docker-test remains prohibited"], + "acceptance_scenarios": ["ADR defines Exploration without new authority", "audit is a redacted rebuildable projection and not an executor", "reviewer outage semantics are explicit", "implementation is staged and no runtime behavior changes in this task"], + "required_tests": ["task schema", "architecture preflight", "exact diff scope", "independent protected-path review", "CI"], + "terminal_gap_states": ["BLOCKED_BY_ARCHITECTURE_GAP", "BLOCKED_BY_CONFLICT"] +} diff --git a/docs/EXTERNAL_AUDIT_EXPLORATION_PROPOSAL.md b/docs/EXTERNAL_AUDIT_EXPLORATION_PROPOSAL.md index 4bf9741..3033f31 100644 --- a/docs/EXTERNAL_AUDIT_EXPLORATION_PROPOSAL.md +++ b/docs/EXTERNAL_AUDIT_EXPLORATION_PROPOSAL.md @@ -1,6 +1,6 @@ # External audit and exploration proposal -Status: proposal only +Status: accepted in ADR-0018 Task: ARCH-000011 Date: 2026-08-22 -- 2.54.0