Publish applicable-provider and dependency-evaluation contracts

[Brad-Edwards]

Publish the API-424 representation required for per-crossing applicability, provider dependency inputs, and composed effect decisions.

Acceptance criteria

• Represent the admitted apparatus and applicable subset separately while retaining profile obligations, configuration identity, provenance, and required-coverage checks.
• Provide predecessor-result and shared-state inputs for dependency evaluation at the exact state cut. Specify incomplete, invalid, optional, and mandatory results unambiguously.
• Encode the accepted parent/effect decisions, targets, phases, prerequisites, support strengths, and commit boundaries.
• Update public provider protocols, schemas, Python models, publication manifests, generated bundles, and migration rules. Include disjoint-sink, dependency-chain, missing-obligation, optional-failure, and later-phase denial examples.

Prerequisites: #1352.

References: Diagnosis, Public provider protocols.

Requirements

• API-424 — Participant-Control Provider, Composition and Effect Contracts

[Brad-Edwards]

🛠️ Picked up by /implement - driver codex, branch 1365-applicable-provider-contracts, 2026-09-27T05:49:49.285Z.

[Brad-Edwards]

gc workflow phase recorded: preflight (issue #1365). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

[Brad-Edwards]

gc workflow phase recorded: preflight (issue #1365). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

[Brad-Edwards]

gc workflow phase recorded: plan (issue #1365). Posted by the MCP server to enforce ordering between workflow steps (issue #794 MVP-2). Do not edit or delete — used by downstream tools to gate phase prerequisites.

Plan for #1365

Publish distinct participant-control-selection/v2, participant-control-evaluation/v2, and participant-control-provider/v2 contracts under API-424. Keep the v1 models, schemas, protocol and historical interpretation intact. The semantic pin is participant-control-applicability/rev1; exact schema content, provider protocol and reader support must be negotiated at admission.

• Apparatus and coverage (Path A): Add closed v2 selection and exact-cut coverage models in raes_contracts/contracts/participant_control_*.py. Preserve B, every binding's configuration/authority/provenance and profile-owned obligations. Record applies, proven-inapplicable or unresolved for every obligation, plus A(B,K) slot references and required-input closure. Reject missing coverage, impossible slot mappings, a filtered apparatus identity and vacuous success. Tests cover two disjoint sinks, empty valid A, and missing/unresolved obligations.
• Dependency and state inputs (Path A): Add slot/stage invocation DTOs with exact context, binding, requested slots, typed content-bound predecessor results, disclosure projection, pinned committed/tentative state scope/version and output-input identity. Publish a separate v2 provider protocol. Reject missing/mistyped/stale mandatory inputs, cycles, undeclared sharing and conflicting writes; normalize rejected optional work into safe lost-advice records without veto or state/effect contribution. Tests cover A.fact → B.assessment → A.rule, immutable input binding, mandatory loss, optional malformed/unsupported results, false trigger and state conflicts.
• Decisions, effects, support and commit (Path A): Add unscheduled parent decisions, closed non-parent effect targets, required-predecessor/success-dependent/independent phases, typed outcome prerequisites and a combined parent/effect graph. Encode support requirements against API-407 effective support, with bounded support accepted only against a compatible admitted constraint. Represent the expected-head transaction for coverage, results, decision, scoped state, intents/claims and budgets; failed commit authorizes no dispatch. Tests cover later-phase denial, audit on denial, parent-application prerequisites, phase cycles, support limits and commit boundaries.
• Publication and migration (Path A for schemas/fixtures; Path D for prose): Add normative v2 schemas, bundle mappings, explicit participant-runtime output routing, publication entries with content hashes and last_change, conformance registration, public exports, packaged valid/invalid/context-invalid examples, API docs and migration rules. Preserve v1 feature claims; allow v2 exact-contract negotiation without making a v1 declaration imply v2 support. Verify generated bundle identity, schema publication, old v1 fixtures/readers and targeted v2 cases. Reconcile API-424 IMPLEMENTS/TESTS traceability in the delivery diff. No changelog or version edits.

Security and whole-repo checks. Reuse bounded json_ingress, closed ContractModel shapes, control_digest, exact profile/configuration resolution, API-407 support authority and participant_control_resolution trusted joins. Provider data cannot self-certify role, authority, state or applicability; portable records carry bounded safe refs and value-independent errors. Existing control-plane authentication, target authorization, participant projection, final-sink checks and ADR-104 expected-head store remain the later runtime consumers. No new route, launcher, secret carrier, store, validator framework or backend installation is introduced. Check manifest_authority.py, conformance registry, corpus packaging, publication policy, concept/lineage governance and protocol package boundaries. A later independently installed provider can use the same admitted obligation and invocation seam without backend-name branches.

Verification. Use red-green cycles for each executable clause, then targeted API-424 pytest modules and schema/publication checkers with RAES_REQUIREMENT_UID=API-424. CI owns full suites. The pre-publish hook, review, hosted CI, Sonar and readiness gates remain in the /implement workflow.

[Brad-Edwards]

gc_codex_review — sanitized deferred publication for issue #1365, cycle 1 of 1
Reviewed revision: c7c52e3d038eff7055bd6138dc5765c021adc6cc53c8b4e2f33fd3f8fbbaab41

Architectural read

The v2 publication fits the versioned contract seam. Effect admission, tentative state accounting, and independent gate and effect authorization need repairs before delivery.

Verdict: don't-ship

Findings

core-F1 — Complete v2 effect admission checks

• Classification: class
• Decision: fix
• Location: implementations/python/packages/raes_contracts/contracts/participant_control_decisions_v2.py:121
• Rationale: Confirmed: restore lifecycle ordering and exact causal-root checks across v2 effect admission.

core-F2 — Bind consumed tentative state to a transaction proposal

• Classification: one-off
• Decision: fix
• Location: implementations/python/packages/raes_contracts/contracts/participant_control_evaluation_v2.py:309
• Rationale: Confirmed: every consumed tentative version must have a matching proposal in the committed evaluation.

core-F3 — Exercise the denied-parent state commit guard

• Classification: one-off
• Decision: fix
• Location: implementations/python/tests/test_issue_1365_applicable_contracts.py:649
• Rationale: Confirmed: rebuild the witness so earlier validation succeeds and the refused-parent commit guard is reached.

security-F1 — Verify incumbent gate from trusted v2 context

• Classification: one-off
• Decision: fix
• Location: implementations/python/packages/raes_contracts/contracts/participant_control_resolution.py:338
• Rationale: Confirmed: compare the recorded gate disposition with independently resolved owner evidence.

security-F2 — Bind effect authorization to payload and cut

• Classification: one-off
• Decision: fix
• Location: implementations/python/packages/raes_contracts/contracts/participant_control_resolution.py:353
• Rationale: Confirmed: authorize the complete effect content and originating principal at the exact request cut.

[Brad-Edwards]

gc_codex_review pre-push cycle 1 of 1 complete for issue #1365 on branch '1365-applicable-provider-contracts'. Posted by the MCP server to enforce the pre-push hard-cap-1 contract (issues #796, #804, #906). Do not edit or delete — used by the next gc_codex_review (uncommitted) invocation to count cycles.

[Brad-Edwards]

Review decision record — codex cycle 1 (issue #1365)

Reviewer: codex
Cycle: 1
Verdict: don't-ship

Architectural read:

The v2 publication fits the versioned contract seam. Effect admission, tentative state accounting, and independent gate and effect authorization need repairs before delivery.

Blocking findings: 5

Finding 1 — class (2 instances)

• ID: core-F1
• Title: Complete v2 effect admission checks
• Location: implementations/python/packages/raes_contracts/contracts/participant_control_decisions_v2.py:121
• Decision: fix
• Rationale: Confirmed: restore lifecycle ordering and exact causal-root checks across v2 effect admission.
• Instances:
  • implementations/python/packages/raes_contracts/contracts/participant_control_decisions_v2.py:121
  • implementations/python/packages/raes_contracts/contracts/participant_control_evaluation_v2.py:101

Finding 2 — one-off

• ID: core-F2
• Title: Bind consumed tentative state to a transaction proposal
• Location: implementations/python/packages/raes_contracts/contracts/participant_control_evaluation_v2.py:309
• Decision: fix
• Rationale: Confirmed: every consumed tentative version must have a matching proposal in the committed evaluation.

Finding 3 — one-off

• ID: core-F3
• Title: Exercise the denied-parent state commit guard
• Location: implementations/python/tests/test_issue_1365_applicable_contracts.py:649
• Decision: fix
• Rationale: Confirmed: rebuild the witness so earlier validation succeeds and the refused-parent commit guard is reached.

Finding 4 — one-off

• ID: security-F1
• Title: Verify incumbent gate from trusted v2 context
• Location: implementations/python/packages/raes_contracts/contracts/participant_control_resolution.py:338
• Decision: fix
• Rationale: Confirmed: compare the recorded gate disposition with independently resolved owner evidence.

Finding 5 — one-off

• ID: security-F2
• Title: Bind effect authorization to payload and cut
• Location: implementations/python/packages/raes_contracts/contracts/participant_control_resolution.py:353
• Decision: fix
• Rationale: Confirmed: authorize the complete effect content and originating principal at the exact request cut.

[Brad-Edwards]

gc_codex_review — sanitized deferred publication for issue #1365, cycle 2 of 1
Reviewed revision: c6aca12bf6f72f91e8b70731ba4b169493d56a17d463195daf17d0ac8371c6b9

Architectural read

The v2 publication shape is sound. The full composition must govern release and dispatch, and trusted validation must prove IFC fact ownership against incumbent crossing and flow records.

Verdict: don't-ship

Notes

• The exact-cut effect authorization note will be covered by a targeted regression assertion.

Findings

core-F1 — Gate release and dispatch on mandatory composition

• Classification: one-off
• Decision: fix
• Location: implementations/python/packages/raes_contracts/contracts/participant_control_evaluation_v2.py:388
• Rationale: Confirmed: bind parent-release state and dispatch to canonical mandatory blockers while retaining independent consequences.

security-F1 — Verify crossing and IFC fact owners in v2

• Classification: one-off
• Decision: fix
• Location: implementations/python/packages/raes_contracts/contracts/participant_control_resolution.py:347
• Rationale: Confirmed: reuse incumbent crossing and security relation owner checks through independent trusted records.

security-F2 — Reject dispatch after failed required composition

• Classification: one-off
• Decision: fix
• Location: implementations/python/packages/raes_contracts/contracts/participant_control_evaluation_v2.py:388
• Rationale: Confirmed: the same composition gap allows dispatch and parent-release state despite failed required work.