Skip to content

Forward governed invocation context through v2 decision admission #1357

Closed
Closed
Forward governed invocation context through v2 decision admission#1357
Labels
area:runtimeRuntime and control-plane codebugSomething isn't workingsecuritySecurity vulnerabilities and hardening issues
Milestone
Runtime Refactor

Description

@Brad-Edwards
Brad-Edwards
opened on Sep 21, 2026

The v2 decision-surface entry point cannot forward the identity and crossing evidence accepted by ordinary governed action admission.

Acceptance criteria

  • Accept and forward the required invocation context through the public v2 path to ordinary admission, using the existing validation and authorization rules.
  • Preserve decision epoch, state cut, participant/episode, caller authority, and crossing identity. Selecting an action does not create authority or fresh evidence.
  • Verify a valid governed admission and rejection of missing, stale, mismatched, and unauthorized context through the v2 API. Retain ADR-095 disclosure, delivery, and observation distinctions.

References: Diagnosis, v2 admission.

Activity

  1. Brad-Edwards
    added this to the Runtime Refactor milestone on Sep 21, 2026
  2. Brad-Edwards
    added
    bugSomething isn't working
    securitySecurity vulnerabilities and hardening issues
    area:runtimeRuntime and control-plane code
    on Sep 21, 2026
  3. Brad-Edwards
    marked this as blocking 3 issues on Sep 21, 2026
  4. Brad-Edwards
    added
    in-progressAn agent is actively working this issue via /implement
    on Sep 24, 2026

  5. Brad-Edwards commented on Sep 24, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 24, 2026
    CollaboratorAuthor

    🛠️ Picked up by /implement - driver codex, branch 1357-forward-governed-context, 2026-09-24T01:13:20.032Z.

  6. Brad-Edwards commented on Sep 24, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 24, 2026
    CollaboratorAuthor

    gc workflow phase recorded: preflight (issue #1357). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

  7. Brad-Edwards commented on Sep 24, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 24, 2026
    CollaboratorAuthor

    gc workflow phase recorded: plan (issue #1357). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

    Plan

    • Path B, forwarding governed context: Add a regression test through the public v2 control-plane method that passes an authenticated caller identity and crossing evidence with a valid delivered selection. Confirm ordinary governed ingress admits the action and records the correct crossing identity. Reuse ParticipantSubmissionOptions.from_fields() and forward its values to admit_participant_action(); keep the existing v2 binder and its pre-mutation recheck.
    • Path B, preserved coordinates and no invented authority: Assert the v2 selection still binds the same participant, episode, decision epoch, derivation cut, view digest, and delivery; crossing identity and evidence must come from the caller. Cover missing identity/evidence, stale cut, mismatched participant/episode/action/audience, and unauthorized role or subject with rejected or denied admission and no backend action. Preserve the existing ADR-095 disclosure, delivery, observation, selection, and admission distinctions.
    • Files: Change implementations/python/packages/raes_runtime/participant_decision_surface_control_v2.py and extend implementations/python/tests/test_sem_220_participant_decision_surface_v2_runtime.py using participant_crossing_fixtures.py. Update the v2 migration note if the public call documentation needs the new context. Keep the preflight design note. No schema, policy, HTTP, or storage format change.
    • Boundary review: Existing v2 contract/binder, anchor and delivery validators, shared submission options, control-plane identity, crossing policy, mutation guard, operation receipt, and denial audit remain the owners of shape, exact-cut, authority, effect, and error handling. This avoids duplicate security rules and keeps the shared options seam for future submission fields. No credentials or evidence enter participant views, logs, diagnostics, configuration, or process arguments.
    • Verification: Observe each new regression fail on the unmodified v2 method, implement the focused forwarding change, then run the targeted v2 runtime and relevant crossing tests. Set RAES_REQUIREMENT_UID=SEM-220 for local commands because this branch has no UID. The mandatory pre-publish hook, review, CI, SonarCloud, and readiness gates follow through the workflow; full suites run in CI. The eventual PR title will use a valid fix: Conventional Commit subject.

  8. Brad-Edwards commented on Sep 24, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 24, 2026
    CollaboratorAuthor

    gc_codex_review — sanitized deferred publication for issue #1357, cycle 1 of 1
    Reviewed revision: bd3f2c199ceb40e20a45d880ecd8e712ca1ed3edc71221602cb570de12acaf48

    Architectural read

    The v2 entry point reuses shared submission options and ordinary admission, preserving the distinction between surface selection and caller authority. It keeps exact-cut validation and the mutation-time recheck. The targeted tests cover governed admission and rejection through the public API. No concrete security regression was found.

    Verdict: ship

    Findings

    • (none)

  9. Brad-Edwards commented on Sep 24, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 24, 2026
    CollaboratorAuthor

    gc_codex_review pre-push cycle 1 of 1 complete for issue #1357 on branch '1357-forward-governed-context'. Posted by the MCP server to enforce the pre-push hard-cap-1 contract (issues #796, #804, #906). Do not edit or delete — used by the next gc_codex_review (uncommitted) invocation to count cycles.

  10. Brad-Edwards commented on Sep 24, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 24, 2026
    CollaboratorAuthor

    Review decision record — codex cycle 1 (issue #1357)

    Reviewer: codex
    Cycle: 1
    Verdict: ship

    Architectural read:

    The v2 entry point reuses shared submission options and ordinary admission, preserving the distinction between surface selection and caller authority. It keeps exact-cut validation and the mutation-time recheck. The targeted tests cover governed admission and rejection through the public API. No concrete security regression was found.

    Blocking findings: 0 (clean run)

  11. Brad-Edwards commented on Sep 24, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 24, 2026
    CollaboratorAuthor

    Pre-PR base synchronization

    • Source: refs/remotes/origin/dev at b00aba06389ab75ffac3b3bdbd026a0dbecac487
    • Outcome: already_current
    • Published feature head: 3b7208b15f8dc29db8ad6d3b15bde792d79220b7
    • Synchronized tree: 1c8af59ad49c65e3fa825aa84be285b3f4c6896d

  12. Brad-Edwards commented on Sep 24, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 24, 2026
    CollaboratorAuthor

    Pre-PR base synchronization

    • Source: refs/remotes/origin/dev at b00aba06389ab75ffac3b3bdbd026a0dbecac487
    • Outcome: already_current
    • Published feature head: 97e4ecc673dfad849a7730b447dd813d5ed0a669
    • Synchronized tree: c425f1d6a8cd1ce07ee45a923d99bc97d57f5c1b

  13. Brad-Edwards commented on Sep 24, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 24, 2026
    CollaboratorAuthor

    Pre-PR base synchronization

    • Source: refs/remotes/origin/dev at b00aba06389ab75ffac3b3bdbd026a0dbecac487
    • Outcome: already_current
    • Published feature head: 764accface02435a33d4c48c76c506ab8ffded07
    • Synchronized tree: 07f6c617a573ab54cb0334d998d139160008cb5b

  14. Brad-Edwards commented on Sep 24, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 24, 2026
    CollaboratorAuthor

    Pre-PR base synchronization

    • Source: refs/remotes/origin/dev at b00aba06389ab75ffac3b3bdbd026a0dbecac487
    • Outcome: already_current
    • Published feature head: 3409a5ab3abdf515877e0950cd278b9a6302380f
    • Synchronized tree: 9f24b3a9331e115b2e0df9ca32bd4c740f0fb83f

  15. Brad-Edwards commented on Sep 24, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 24, 2026
    CollaboratorAuthor

    Pre-PR base synchronization

    • Source: refs/remotes/origin/dev at b00aba06389ab75ffac3b3bdbd026a0dbecac487
    • Outcome: already_current
    • Published feature head: 6dc9d034fa1f1ef5682917926ff7b9455ac479ec
    • Synchronized tree: d3a1288f6ccfd03e2824dcbdcef658e02192f3a8

  16. Brad-Edwards commented on Sep 24, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 24, 2026
    CollaboratorAuthor

    Pre-PR base synchronization

    • Source: refs/remotes/origin/dev at b00aba06389ab75ffac3b3bdbd026a0dbecac487
    • Outcome: already_current
    • Published feature head: 817c9661701a4d78c45faddee973f43f2d647bdd
    • Synchronized tree: 02369b84140bcc26a5671c10e4d57796cb9bc557

  17. Brad-Edwards commented on Sep 24, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 24, 2026
    CollaboratorAuthor

    Ready for review — issue #1357

    PR: #1384
    Plan: #1357 (comment)

    Outcome

    Operators can submit a v2 decision-surface selection with authenticated identity and crossing evidence to the governed action admission path. Missing, stale, mismatched, or unauthorized context is rejected before an action runs.

    Forward governed context from v2 decision-surface selection into ordinary action admission.

    Files changed

    Added:

    • docs/decisions/issue-1357-v2-governed-admission-preflight.md
    • docs/research/formal-semantic-validation/analysis-v45.json
    • docs/research/formal-semantic-validation/bundles/retest-v45.json
    • docs/research/formal-semantic-validation/execution-snapshot-v45.json
    • docs/research/specification-coverage/analysis-v45.json
    • docs/research/specification-coverage/bundles/raes-standardized-specification-coverage-issue-1357-v45.json
    • docs/research/specification-coverage/execution-snapshot-v45.json

    Modified:

    • docs/explain/reference/participant-decision-surface-v2-migration.md
    • docs/research/formal-semantic-validation/index.md
    • docs/research/specification-coverage/index.md
    • implementations/python/packages/raes_runtime/participant_decision_surface_control_v2.py
    • implementations/python/tests/test_formal_semantic_validation.py
    • implementations/python/tests/test_issue_989_versioned_evidence.py
    • implementations/python/tests/test_sem_220_participant_decision_surface_v2_runtime.py
    • implementations/python/tests/test_specification_coverage.py
    • tools/check_specification_coverage.py
    • tools/formal_semantic_validation/_baseline.py
    • tools/formal_semantic_validation/_loading.py
    • tools/formal_semantic_validation/_release_revisions.py
    • tools/formal_semantic_validation/_releases.py
    • tools/formal_semantic_validation/_retest.py

    Reviews

    • codex: Pre-push review was clean; no findings.

    Traceability reconciliation

    Proposed in this PR — verified against the merged tree in Phase E.

    • IMPLEMENTS / TESTS / DOCUMENTS added: 0
    • Links updated: 0
    • Stale links removed: 0

    Status

    • CI: ✅ green
    • SonarCloud: ✅ passed
    • PR ready for user review and merge. Phase E validates the merged requirement state, posts the final report, and closes the issue automatically once this PR merges.

  18. Brad-Edwards commented on Sep 24, 2026

    @Brad-Edwards
    Brad-Edwards
    on Sep 24, 2026
    CollaboratorAuthor

    Delivery readiness recorded — Phase E finalizes issue #1357 automatically when PR #1384 merges.

  19. github-actions commented on Sep 25, 2026

    @github-actions
    github-actionsbot
    on Sep 25, 2026 – with GitHub Actions
    Contributor

    Final report — issue #1357 complete

    PR: #1384
    Plan: #1357 (comment)

    Outcome

    Operators can submit a v2 decision-surface selection with authenticated identity and crossing evidence to the governed action admission path. Missing, stale, mismatched, or unauthorized context is rejected before an action runs.

    Forward governed context from v2 decision-surface selection into ordinary action admission.

    Files changed

    Added:

    • docs/decisions/issue-1357-v2-governed-admission-preflight.md
    • docs/research/formal-semantic-validation/analysis-v45.json
    • docs/research/formal-semantic-validation/bundles/retest-v45.json
    • docs/research/formal-semantic-validation/execution-snapshot-v45.json
    • docs/research/specification-coverage/analysis-v45.json
    • docs/research/specification-coverage/bundles/raes-standardized-specification-coverage-issue-1357-v45.json
    • docs/research/specification-coverage/execution-snapshot-v45.json

    Modified:

    • docs/explain/reference/participant-decision-surface-v2-migration.md
    • docs/research/formal-semantic-validation/index.md
    • docs/research/specification-coverage/index.md
    • implementations/python/packages/raes_runtime/participant_decision_surface_control_v2.py
    • implementations/python/tests/test_formal_semantic_validation.py
    • implementations/python/tests/test_issue_989_versioned_evidence.py
    • implementations/python/tests/test_sem_220_participant_decision_surface_v2_runtime.py
    • implementations/python/tests/test_specification_coverage.py
    • tools/check_specification_coverage.py
    • tools/formal_semantic_validation/_baseline.py
    • tools/formal_semantic_validation/_loading.py
    • tools/formal_semantic_validation/_release_revisions.py
    • tools/formal_semantic_validation/_releases.py
    • tools/formal_semantic_validation/_retest.py

    Reviews

    • codex: Pre-push review was clean; no findings.

    Traceability reconciliation

    • IMPLEMENTS / TESTS / DOCUMENTS added: 0
    • Links updated: 0
    • Stale links removed: 0

    Issue #1357 is a requirement-free bug fix. The PR body links the issue to the implementation and targeted tests.

    Status

    • CI: ✅ green
    • SonarCloud: ✅ passed
    • PR ready for user review and merge.
  20. github-actions
    closed this as completedon Sep 25, 2026
  21. github-actions
    removed
    in-progressAn agent is actively working this issue via /implement
    on Sep 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area:runtimeRuntime and control-plane codebugSomething isn't workingsecuritySecurity vulnerabilities and hardening issues

    Type

    No type

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions