Repository navigation
Conversation
Adds qsl.decision_review.v1, qsl.operation.v1, audit-event and risk-tier binding definitions plus the decision inbox server_time fields the new read endpoints return.
Extracts decision identity, revision, transition, actionability and receipt fields into decision_contract.js, adds closed risk-tier policy bindings, and projects them onto canonical inbox items. Inbox payloads now carry schema_version and server_time.
Adds GET /api/decisions/:id, POST /api/decisions/:id/actions, GET /api/operations/:id and GET /api/audit-events. Writes require the current revision and an Idempotency request id, reject expired or ineligible decisions, and replay identical requests instead of recording a second decision.
Adds an end-to-end validation for the decision review, action, operation and audit-event routes, and compares inbox payloads without their per-request server_time.
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
Effective tier in the risk-tier binding projection was hard-coded to null. It now comes from an explicit runtime readback observation and stays null with reason code effective_tier_not_observed when no observation exists. The tier is never derived from the approved policy: ARCHITECTURE.md 4.4 requires selected, approved and effective policy to be displayed separately, and section 3.2 states runtime readback independently establishes effective state. No observed-tier source is wired into the console yet, so production reads still report null plus the reason code, and effective_derived_from_approved is a false constant in the contract.
Reject a reused operation id with a different intent instead of replaying the recorded decision, and echo the operation identity in the result.
The cockpit now returns every declarative tier policy (tier id, composer_mdd_multiple, promotion_size_scale) from the inbox and the decision review. The catalog is projected from the single risk_tiers.js source, so no numbers are duplicated. Each entry stays labeled owner intent only: executable false, activation_status not_connected, no_order true and execution_authority_granted false. An unknown tier still resolves to null rather than a numeric default, and effective.tier behavior is unchanged.
This was referenced Nov 1, 2026
Co-Authored-By: Codex <noreply@openai.com>
Co-Authored-By: Codex <noreply@openai.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
AI assistance
OpenAI Codex.
What changed
Add decision review/action, operation and audit APIs, versioned envelopes, opaque inbox pagination, and selected/approved/observed risk-tier projections. Revision checks and request replay preserve existing owner-intent boundaries:
no_order: trueandexecution_authority_granted: false.Move the duplicate promotion-authority read correction from #1020 into this base so its own JavaScript validation can pass. The regression keeps the single-read assertion and checks the projected authority fields. #1020 retains the Bash 3 compatibility change; #1018 adds audit pagination and runtime readback.
Patch development dependencies to Vite 7.3.7, undici 7.30.1 and sharp 0.35.5 without changing runtime authority or upgrading Miniflare. Effective tier remains unknown without observed evidence; declarative tier parameters do not authorize execution.
How verified