[DESIGN] Decision Artifact v2 — freeze explicit cross-artifact bindings and evidence closure #38

Parent Epic: #3 · Roadmap: #2 · Cross-module dependencies: #4, #5, #6 · Linear CAS-9
Baseline confirmed 2026-10-23: main=37ec45997a62e4e2829f69e7384ed6f1a6c4447e, 0 open PR. Recheck both at implementation start.

Status: Design task started; no implementation/PR evidence yet. This Issue does not certify Rev4 acceptance.

0. Goal, authority and blocking reason

Freeze a versioned Decision Artifact v2 contract, making exact DomainProfile, PersonaSpec, ContextManifest, CandidateSnapshot, trustworthy final-shared delivery, ReadSetSnapshot and sealed ballot bindings explicit and non-circular. This is the design prerequisite to C1-C and new Decision Protocol Go/DB integration, not those implementations.

Sources (do not silently weaken or change): Rev4 §§2–4,6,9–14,17–19; docs/decision-protocol-contract.md (PR #32); docs/input-artifact-contract.md §6.2–6.5, §2.7 (PR #34); docs/canonical-encoding-contract.md; C0/C0-R (PR #33/#35); C1-B1/B2 (PR #36/#37); durable ExecutionGeneration #17, T1–T6.

Problem: v1 DecisionCharter has no domain_profile_id; v1 CandidateSnapshot has no case_id, round, context_manifest_id, shared final input package or trusted three-role delivery receipts. Candidate self-signing risks a digest cycle; mutable side lookups can silently substitute authoritative input versions. C1-A §6.5 already selects a subsequent explicit versioned contract revision.

1. Deliverables (one narrow Draft PR)

• D2-01 / Charter: add exact domain_profile_id to versioned Charter body. Freeze type/schema version, C0 domain-separated ID and external issuer/approval proofs. Correct legacy charter_id/charter_digest self-reference without breaking prior published C0 vectors.
• D2-02 / Candidate: versioned CandidateSnapshot body must include exact case_id, round, charter_id, domain_profile_id, context_manifest_id, final_shared_inputs (immutable ID/version/digest) and exactly three role-keyed final_shared_delivery_receipt_refs. Separate sealed body/ID from external confirmations of that ID and from later evidence closure. Distinguish in-body persona/spec declarations from signatures; no Candidate → signature → Candidate cycle.
• D2-03 / unique identity: freeze (case_id,round) → one Manifest, (case_id,round) → one committed Candidate, and (case_id,round,context_manifest_id,persona_id) → one seal/ballot identity. Same-key/same-ID retry is idempotent; conflicting ID is rejected; a new ExecutionGeneration is not a new decision round. No mutable latest lookups.
• D2-04 / trusted delivery: define mandatory receipt binding to JournalKey, persona/spec, experience/preference, controlled session/provider request, exact shared package, registered injection sequence, current generation and relevant epoch/scope, delivery verification and UTC-ms time. Three genuine checked receipts predate Candidate ID; a send ack or model self-report is not a receipt.
• D2-05 / evidence closure: freeze OPEN → QUIESCING → INPUT_CLOSED semantics; authoritative conditional single linearization point atomically makes exactly one Candidate consumable, emits EVIDENCE_CLOSED, closes 3 Journals and pins authority cutoff + each local high watermark. Define freshness at commit, generation/epoch checks, pending injection settlement, crash-after-commit reply loss, replay and dependent invalidation. evidence_closure_record_ref and three confirmations point to Candidate ID and remain outside its body.
• D2-06 / ReadSet and ballots: versioned ReadSetSnapshot semantics bind Manifest/Candidate, individual view/receipt, common shared package/closure/cutoff and actually observed reads, including post-cutoff admissible rereads. Bind each SealedBallot to exact persona/spec + ReadSet rset_ digest, Candidate, Manifest, AuthorityProof and Generation. Keep ABSENT distinct from ABSTAIN and VOTE-09/11/12 independent submit/aggregate/adjudicate checks; no self-issuing permission.
• D2-07 / compatibility: exact v1→v2 field diff; schema_version/capability negotiation, Golden/ID separation, explicit old-record rejection/read-only projection, legacy Generation 0, rollback boundaries. A v1 object missing v2 fields must not become v2 authoritative via defaults. Delineate decision round vs ExecutionGeneration vs context/authority/credential epochs.
• D2-08 / dependency map: producer→persistent authority→consumer→revocation trigger→test owner for each relevant ID/reference. Identify the C2/C3 VerifyAuthority / CommitIfCurrent interface requirements and all NOT RUN/BLOCKED real integration tests.

2. Independent acceptance / RED → GREEN

Provide executable contract-structure checks with positive and tampered fixtures where technically possible. At minimum create named negative checks proving rejection of:

1. Charter/Domain mismatch or missing Domain ID.
2. Candidate/Manifest mismatch, wrong case/round/domain and ambiguous default-version lookup.
3. Same (case,round) mapped to multiple Manifest/Candidate IDs.
4. Missing/wrong third trusted final-shared delivery receipt, forged model acknowledgement, or different shared package.
5. Candidate signed by a receipt/confirmation referring to its own not-yet-computed ID within hashed body (cycle).
6. Three confirmations referring to different Candidate IDs.
7. Half-committed Candidate/EVIDENCE_CLOSED/Journal closure, in-flight injection at cutoff, and missing shared cutoff (design trace/fault-model obligations only until DB exists).
8. Epoch/Generation change at conditional commit, stale owner, unknown delivery, commit reply loss/retry.
9. Legacy v1 missing fields silently upgraded to v2, digest/ID mismatches and mutated immutable fields.
10. Ballot using arbitrary read-set digest, wrong role view, cross-round/old-generation reference, or missing authority check.

Evidence taxonomy must distinguish: executable static/fixture gates actually passing, design-state-machine review only, and MySQL/session/C2-C3 fault injections explicitly NOT RUN / BLOCKED. No invented RED run, no claiming behavior from documentation or CI green.

Maintain all existing C0/C0-R, C1-A, DomainProfile and PersonaSpec Golden identities and CI. If schema changes affect canonical content, register a new version with independently verifiable vectors; do not rewrite legacy expected hashes.

3. Non-goals and dependencies

Not in this PR: Go implementation of new Decision Protocol or state machine, MySQL Journal/Closure transaction, live sessions/Agent Loop, Persona behavioral compliance, C2 governance root or AuthorityProof issuance, C3 ActionIntent/witness/Egress, protected sends, full k=1..4 voting logic, 4,800-round acceptance.

Blocked for authoritative integration by: #4 C1-C actual read-set/controlled sessions, #5 C2 authenticated roots/epochs, #6 C3 common order/egress. These interfaces may be designed in parallel; do not claim they exist.

No Rev4 change unless an independent Design Change is approved. Do not close any Epic or CAS-9 because this contract draft merges.

4. Definition of Done

• Independent Draft PR updating versioned decision contract, coherent links to C1-A §6.5, consumer/producer/epoch dependency DAG and backward compatibility matrix.
• Every added mandatory field has an unambiguous type, role, identity inclusion and provenance; no circular hashes or implicit mutable lookups.
• Three-role delivery/confirmation/evidence-closure state ordering is explicit; half-commit is forbidden by contract, not falsely marked runtime-tested.
• Static checks/fixtures with meaningful negative variants added and executed; exact-HEAD existing CI and cross-language Golden verified.
• A–F report: baseline, v1→v2 diff, test RED→GREEN, actual commands/CI, P0/P1/P2 findings, release boundary.
• Independent review approves scope; PR may become Ready only after review, not automatically. Actual PR merge is a separate decision.

2026-10-24 · Design-scope completion after PR #39 merge

Disposition: COMPLETE FOR DESIGN/OFFLINE CONTRACT ONLY (not an implementation or end-to-end release).

• Implementation evidence: PR #39, merged into main at f0277e15c356b426ee25be995d9f49c929534ec8, with final PR-head 0e9fea17cbd7415b5a5c54f099669f59a8f0176b.
• Independent read-only review: F39-01 (candidate risk classification input digest) and F39-02 (immutable version aliases) were addressed and reviewed closed before merge; no unresolved P0/P1/P2 found in final reviewed Head.
• Exact PR-head CI #40049521968: 6/6 success; 7 positive, 88 named negative, 9 full artifact Python/Go Golden, 1 risk-input Golden, 28 fixed-version parity cases. Existing MySQL CI jobs test old implementation, not v2 sessions/closure.
• Scope completed: versioned decision-charter/candidate/readset/ballot contract; closed Schema, v1→v2 field/identity and capability migration, acyclic delivery/confirmation/closure flow, dependency DAG, static tests, and risk-input / immutable-version fixes. Review report: docs/decision-artifact-v2-review.md.
• Not implemented / NOT RUN / BLOCKED: production Go Decision Protocol consumer, real ContextManifest+ReadSetJournal, provider delivery receipts, MySQL EVIDENCE_CLOSED atomic transaction, C2 AuthorityProof/epoch authority, C3 independent witness/Egress, true k=1..4 voting, Rev4 statistical/behavioral acceptance.
• The main merge-commit push workflow #40050376341 was in progress when this completion note was prepared. Its result must be checked independently; do not label it success based on successful PR-head CI.
• Next independently scoped implementation belongs to Epic #4: C1-C1 ContextManifest v1 offline semantic validation, with real delivery/Journal/Closure in a later blocked slice. Parent #3 and #2 remain Open; Linear CAS-9 remains In Progress. Closing this Issue only closes the agreed design deliverable.