Define final ReviewDecision protected-effect contract

[samovers]

Depends on: #12 and the Phase A semantic approval recorded on #11.

Outcome

Define the non-authoritative Phase A protected-effect contract for the three final review actions:

• REVIEW_ACCEPT;
• REVIEW_REJECT_OR_CONTEST; and
• REVIEW_SUPERSEDE.

The contract must prove before commit that the proposed immutable ReviewDecision faithfully implements the exact authorization-bound review intent.

Primary trust boundary

Final review-decision domain semantics and commit classification: exact intent-to-ReviewDecision mapping, permitted derivations, forbidden widening, GovernanceEvent / governance decision classification, postconditions, and validation evidence.

Intended PR boundary

One non-authoritative Phase A candidate document. No current schema, accepted RFC, active Event Grammar, currentness, runtime, authorization rule, grant/revocation, pack, output, sharing, transport, or retention change.

REVIEW_REQUEST is excluded because it is not a final governance decision and needs its own result/commit-class closure.

Acceptance criteria

• Inventory the exact capabilities and gaps of current ReviewDecision v0.1 against the approved review-intent profiles.
• Decide whether a minimal future ReviewDecision v0.2 carrier is required; do not edit or promote a schema in this Phase A PR.
• Define exact action/result constraints:
  • REVIEW_ACCEPT maps only to reviewAction: REVIEW_ACCEPT and decisionOutcomeState: ACCEPTED;
  • REVIEW_REJECT_OR_CONTEST maps only to reviewAction: REVIEW_REJECT_OR_CONTEST and an intent-bound closed outcome of REJECTED or CONTESTED;
  • REVIEW_SUPERSEDE maps only to reviewAction: REVIEW_SUPERSEDE and decisionOutcomeState: SUPERSEDED.
• Bind the proposed decision ID, exact reviewed artifact family/ref/immutable revision or digest, scopes, accountable human and represented Party posture, rationale, evidence revisions, decision time, and supersession inputs where applicable.
• Enumerate every permitted derived field and its authoritative source. Caller/result-local defaults are prohibited.
• Forbid target substitution, action/outcome mismatch, evidence or rationale substitution, unbound consequence creation, in-place target mutation, and silent current-state promotion.
• Fix the primary event family to GovernanceEvent and the commit class to governance decision; linked accepted consequences remain separate governed effects.
• Define a content-addressed contract identity and deterministic digest projection.
• Define an immutable validation trace with field-mapping and postcondition dispositions plus intent, result, result-schema, and contract digests.
• Require validation before the atomic commit. A mismatch aborts the protected effect without rewriting the authorization result.
• Add production-reachable hostile cases for wrong action/outcome pairs, changed target revision, changed rationale/evidence, fabricated accepted consequences, and supersession substitution.
• State how the reviewed binding will later enter AuthorizationPolicyBundle v0.2; do not create that bundle here.

Non-goals

• No REVIEW_REQUEST contract.
• No authorization-policy amendment or authority evaluation.
• No change to what review authority means or who may exercise it.
• No creation of accepted consequences, current-state materialization, or promotion shortcut.
• No active/current schema or Event Grammar edit.
• No runtime transaction-manager or persistence implementation.
• No other protected-effect family.

Scope-expansion rule

If the domain mapping cannot close without changing the semantically approved authorization intent or action meaning, stop before editing #10's boundary and open a separate prerequisite amendment.

What is next: write and review the one-file Phase A candidate before any schema, conformance, or promotion work.

[samovers]

Implementation discovery: #15 is blocked by the separate authorization-law prerequisite #16.

Active OFARM law and current ReviewDecision v0.1 permit final review of ACCEPTED_EVENT_CONSEQUENCE, including an existing REVIEW_SUPERSEDE example. The semantically approved authorization candidate's closed RP_REVIEW_TARGET_ONE omits that target. The candidate also does not bind the exact REJECTED versus CONTESTED posture for the combined REVIEW_REJECT_OR_CONTEST action.

The protected-effect contract cannot repair either point locally: adding the target would widen authority beyond the selected rule, and inventing the outcome input would change the approved effect-intent meaning. Issue #16 therefore owns the bounded authorization-candidate amendment and renewed semantic approval.

No #15 implementation file has been created. Its branch remains clean from main, and its final ReviewDecision domain boundary is unchanged.

What is next: resolve and re-approve #16 before writing the #15 Phase A candidate.

[samovers]

Phase A implementation is ready for steward review in draft PR #17 at head 0727957f22a22653145389db1824ef0599150edc.

The PR changes one non-authoritative candidate file inside the final ReviewDecision domain-semantics and commit-classification trust boundary. It does not edit authorization law, schemas, Event Grammar, runtime, accepted law, or currentness.

Local repository validation and all GitHub checks pass. Issue #15 remains open pending semantic review of the candidate's explicit approval card.

[samovers]

PR #17 has been revised at 975d48af0940485eddf2f434bf097c75ef9c2539 in response to the three-blocker review.

The new head preserves optional separately bound consequence links, separates the GovernanceEvent act from the governance-decision record, adopts the simpler deciding-Party/human/finalization-evidence carrier, and records the reopened issue #16 / PR #11 case-target amendment as an upstream prerequisite.

The candidate remains one non-authoritative ReviewDecision-domain file. It was reduced from 642 to 475 lines while retaining issue #15's required v0.1 inventory, exact target/action mappings, permitted derivations, stable mapping and postcondition dispositions, contract digest, validation payload, hostile cases, and later bundle binding.

Local validation passes and re-review is requested on PR #17. Semantic approval remains contingent on renewed approval of PR #11 head 5974bb9.

What is next: complete renewed review of PR #11, then re-review PR #17 at its new head.

[samovers]

PR #17 has been revised at d02a4815437b49f2ce428138dcbfd04e324664d3 in response to the three bounded current-head findings.

The candidate now:

• permits companion accepted-consequence bindings only for REVIEW_ACCEPT / ACCEPTED under an exact separately reviewed composition, with required absence for reject, contest, and supersede;
• binds the exact governing authority basis and permits a contract-defined derived companion without inventing a new consequence action;
• uses one logical reviewed-target ref plus exactly one immutable revision-ref or digest selector; and
• preserves valid EvidenceSufficiencyCase v0.1 compatibility alongside current/default v0.2 while rejecting draft, unknown, mutable, or unresolved carriers.

The PR description now names the section 18 approval card and the exact current head. The full local repository suite, generated-currentness, hygiene, structural checks, git diff --check, and all four GitHub checks pass.

Primary trust boundary remains final ReviewDecision domain semantics and commit classification. Scope stayed inside the one-file, non-authoritative candidate; authorization law, schemas, runtime, currentness, and OFARM2 remain unchanged. Issue #15 stays open pending semantic re-review and explicit approval.

What is next: complete semantic re-review of PR #17 at d02a4815437b49f2ce428138dcbfd04e324664d3.

[samovers]

PR #17 has been revised at 0cfd8066b0d09e84c474734e0e42f08cd8e09d99 to close the remaining section 16 blocker.

The future authorization bundle now binds the ReviewDecision protected-effect contract identity/ref/digest as one content-addressed unit. It no longer duplicates the result-schema binding or RD_* mapping selectors. Those semantics remain owned by the contract, and any change flows through contractDigest into the affected per-action ruleDigest values.

Only the existing non-authoritative candidate file changed. No PR #11 authorization rule, bundle, schema, runtime, currentness, or OFARM2 file changed. The full local validation set and all four GitHub checks pass.

Issue #15 remains open pending final semantic re-review and explicit steward approval of PR #17.

What is next: review PR #17 at 0cfd8066b0d09e84c474734e0e42f08cd8e09d99 for Phase A approval.

[samovers]

PR #17 has been revised at 81893d4ee7a54d27d70d2d99720a73470a987bce to close the final section 13 wording inconsistency.

The action rule now selects the effect-intent schema and protected-effect contract. The gate digest-verifies that contract and then verifies the result-schema binding owned by it before validation. This aligns section 13 with section 16 without adding a bundle-level result-schema authority surface.

Only the existing non-authoritative candidate file changed. The full local validation set and all four GitHub checks pass. Issue #15 remains open pending head-specific semantic approval review.

What is next: review PR #17 at 81893d4ee7a54d27d70d2d99720a73470a987bce for Phase A approval.

[samovers]

Phase A protected-effect candidate completed

Issue #15 is completed by the one-file ReviewDecision protected-effect candidate on draft PR #17 at exact head 9ef08030b25eb3db1c2da14d6595300198384ff2.

The exact-head re-review found no blocking findings, no scope drift, and no new over-design. Steward semantic approval is recorded for that exact head.

The completed work remains inside final ReviewDecision domain semantics and commit classification. It changes one non-authoritative candidate file and does not merge or promote the RFC, create schemas or machine contracts, change currentness, authorize runtime work, or absorb the separately governed transaction boundary.

PR #17 remains draft and open as the durable candidate and approval record. Parent issue #12 remains open for its other effect-family boundaries. Issue #19 remains the hard prerequisite before machine materialization, hostile conformance, or runtime implementation may rely on the shared atomic transaction and consumption gate.

What is next: develop issue #19 as its own runtime-transaction trust-boundary candidate.