Open decisions — awaiting user ruling
The 2026-07-21 investigation-wave decision set was ratified in full after adversarial correction — see ADR-023 and the repo's
plans/master-execution-plan.md(the execution registry: every ratified item is in-flight, NOW, or trigger-named). This page now holds ONLY items that still need a fresh human ruling when their trigger fires.
Trigger to outcome, at a glance
Trigger-armed rulings (decision point comes WITH the data)
- Orchestrata-shaped
pyrightdependency (run-12 trigger) — trigger: run-12 start. 7 registered skips + a 75%-covered backend retire with it; same shape as prior dep rulings (old tree pins it; GIL-off verification + janus-wheel survival check included). The 2026-09-20 "update all dependencies to latest" ruling RESOLVED the click/typer/psutil trio (all three landed at latest, session/cli + tools wave unblocked and complete). - Reranker permanent default — trigger: the 100-query goldset run
(W7). Interim default is already the measured-best no-rerank config
(wiki
7af2165). The goldset result picks the permanent default and the CI-ratchet threshold. - RTM citation expansion wave 2+ — trigger: wave-1 greenlight metrics (adjudicated-occurrences-per-cited-module + human-reject-rate, reported after the first 3-spec wave, W2 Phase 4). Continue / rescope / stop.
- cxp.send governance gating — trigger: the per-message Prolog-cost benchmark (threshold: added p50 ≤ 5 ms/message). Pass → gate it; fail → redesign (batched/journaled evaluation) before gating.
- Governance deny-flip execution check — the flip itself is ratified (ADR-023); the user gets one confirmation look at the P6 metric evidence (ERROR_ALLOW == 0, all POLICY_DENYs attributable) before it lands.
--toolkit-onlyinstaller profile — trigger: a named request for an infra-free install. Census EXECUTED (2026-07-21, code inspection of agents/tool_registry.py): exactly 12 of 17 volk tools are infra-free (read_file, write_file, list_dir, search_code, run_shell, ast_query, check_coverage, validate_mermaid, check_doc_links, web_search, web_fetch, design_patterns); the 5 fleet-bound ones all guard onpostman is None(message_volk, publish/subscribe/unsubscribe_topic, get_volk_status). The profile is viable; without a requester, fleet-connected-only stays the permanent shape.
Proposed ADRs awaiting a ruling (published 2026-10-23)
Each record carries the evidence, the options and one recommendation. Full entries: decisions.
| ADR | Question | Recommendation |
|---|---|---|
| ADR-0132 | Which tree is edited after the cut-over: src/ with packages/ generated from it (A), or packages/<c>/src with each package's built wheel as the deployment copy (B) |
B, the only option in which the cut-over completes |
| ADR-0133 | How orchestrata-mcp gets a gateway token: a one-hour token in the secrets file (A), the transport minting its own short-lived JWT from JWT_SECRET (B), or static auth with a non-expiring token (C) |
B |
| ADR-0123 | Register every host service in the runtime view with its purpose and component, or retire it | Proposed 2026-10-22 |
| ADR-0124 | Test and prod containers from one OpenMandriva image over always-on memgraph and Redis (two containers, the image and "cutover first" already ruled) | Open: push credentials, QA volks' reach, Claude credential method |
| ADR-0126 | A branch-aware kg: each synced branch is its own project | Direction ruled ("option b"); the naming is proposed |
Every Proposed ADR (generated)
27 ADRs are Proposed in both registers, oldest first; age in days as of 2026-10-23, the newest ADR date. Generated by scripts/gen-decision-pages.py; text between the markers is overwritten.
Back to the ADR index.
| ADR | title | date | age (days) | recorded |
|---|---|---|---|---|
| ADR-0034 | Governed-action classification is property-derived, not name-enumerated | 2026-07-24 | 91 | master |
| ADR-0035 | Authorization is a scoped grant matched to the action instance, from two sources | 2026-07-24 | 91 | master |
| ADR-0036 | Classification facts are stamped at creation under the trusted boundary | 2026-07-24 | 91 | master |
| ADR-0041 | Ruleset engine — per-surface immutable versions, named compositions (F1) | 2026-08-29 | 55 | master |
| ADR-0042 | Wiring-gate supersession by the ruleset engine's §5 (F4) | 2026-08-29 | 55 | master |
| ADR-0043 | Rollback window N + process-cap arithmetic (F8-cap) | 2026-08-29 | 55 | master |
| ADR-0044 | Registry entries self-admit via the ratify chain (r12-decision-1) | 2026-08-29 | 55 | master |
| ADR-0045 | Per-lineage bearer token for submitter continuity (r12-decision-2, refined) | 2026-08-29 | 55 | master |
| ADR-0048 | A ratified ADR is sufficient design authority for bounded implementation | 2026-08-29 | 55 | master |
| ADR-0049 | Adversarial-review evidence is repo-committed and enriches wiki + graph | 2026-08-29 | 55 | master |
| ADR-0050 | Amend F13(D) — target semantics, not current-CLI claims; correct the payload | 2026-08-29 | 55 | master |
| ADR-0051 | F13(A) decomposition map made total — buckets for §0, §1, §10 | 2026-08-29 | 55 | master |
| ADR-0052 | F13(C) bindings — wire the five unbound gates (recommended) or amend the clause | 2026-08-29 | 55 | master |
| ADR-0060 | The RUL-032 content key covers every edge the selector routes on, not only imports | 2026-09-22 | 31 | master |
| ADR-0061 | The one ADR-body bypass also covers an empty factory body, not only a register-less node | 2026-09-22 | 31 | master |
| ADR-0062 | Production runs from a pinned-ref git checkout under /opt/orchestrata | 2026-09-23 | 30 | master |
| ADR-0071 | REQ-110-135 amended: codemod daemon lifecycle is delegated to systemd user units | 2026-10-06 | 17 | master |
| ADR-0075 | The promote's infra stage proves the ADR-0066 secrets file holds every required env key before the tree moves | 2026-10-07 | 16 | master |
| ADR-0076 | The semantic/RAG ingest leaves the prod promote; readers check freshness at runtime and trigger refresh on demand | 2026-10-07 | 16 | master |
| ADR-0078 | The deployed codemod daemon reviews with every phase; the tools venv carries the free-threaded janus-swi | 2026-10-08 | 15 | master |
| ADR-0086 | Claude sessions get a project-scoped SPEC-106 context pack at SessionStart | 2026-10-11 | 12 | feat/session-ctx-inject@030a4ff64 |
| ADR-0090 | The git sentinel fails a test for its own mutations, not for sibling-worktree activity | 2026-10-11 | 12 | docs/adr-register-0080-0085@3f68a11a5 |
| ADR-0123 | Every host service is registered in the runtime view with its purpose and architecture component, or it is retired | 2026-10-22 | 1 | fix/ship-sanctioned-gate-pytest@8c7031c9a |
| ADR-0124 | Orchestrata runs in a test container and a prod container built from one OpenMandriva image, over always-on memgraph and Redis | 2026-10-22 | 1 | fix/ship-sanctioned-gate-pytest@8c7031c9a |
| ADR-0126 | The kg is branch-aware: each synced branch is its own project, serialized from a clean commit and checked after every sync | 2026-10-22 | 1 | fix/ship-sanctioned-gate-pytest@8c7031c9a |
| ADR-0132 | One tree is edited and the deployment copy is built from it at a pinned version — which tree is edited at the cut-over | 2026-10-23 | 0 | fix/ship-sanctioned-gate-pytest@8c7031c9a |
| ADR-0133 | orchestrata-mcp mints its own short-lived gateway token from the deployed JWT secret, and an exported GATEWAY_TOKEN still wins | 2026-10-23 | 0 | fix/ship-sanctioned-gate-pytest@8c7031c9a |
Questions raised by the 2026-10-23 wiki review
The wiki generators and the page reviews read the code, the ADR files and the gate scripts directly. These questions came out of that reading. Each was measured, and each needs a ruling or a go before anything changes.
ADR and ruling housekeeping
| Question | What was measured | Options | Recommendation |
|---|---|---|---|
| Copy the other stranded ADR records onto master? | Nine factory ADRs have docs files only on unmerged branches: ADR-0086 (feat/session-ctx-inject), ADR-0088 (feat/shared-ledger), ADR-0090..0095 (docs/adr-register-0080-0085, also on feat/adr-probes) and ADR-0104 (architecture/domain-model). On 2026-10-23 the 19 records from architecture/domain-model were copied to master byte-for-byte (9c90c0209) |
A: copy these nine the same way. B: merge their branches. C: leave them, labelled | A |
| ADR-0076 status | The docs file says Proposed (recommendation: Accept). The wiki register says Accepted. The README says 0076 "records Mohamed's 2026-10-07 ruling" |
A: flip the docs status to Accepted and put the 2026-10-07 ruling in Provenance. B: set the wiki back to Proposed until a fresh ruling | A, if the README's account of the ruling is right |
| Canon index vs ruling files | For nine rulings the file's Enforcement section names a mechanism, but the canon index says judgment or owed: RUL-004, 006, 007, 013, 018, 019, 032, 037, 038 (overview) | A: confirm each mechanism exists (rulings_lint does), then update only the index status cells. B: leave them |
A |
Gates and hooks
| Question | What was measured | Options | Recommendation |
|---|---|---|---|
| Wiring gate W1 | It expects hook registrations in the repo's .claude/settings.json, which RUL-035 / ADR-0070 forbid |
A: retarget W1 to the user-level and plugin registrations. B: retire W1 | A |
proportionate-test-scope.sh |
It reads an escalate field that the affected-test oracle has not emitted since 2669f4882, so it never fires |
Read verdict == named_full instead |
Fix it (needs a go) |
The context.md guard |
It refuses edits to any file named context.md, including the wiki page modules/context, which therefore stays unreviewed (the corrections are queued) |
A: match only a context.md beside a context.json at a project root. B: exempt the wiki repo. C: keep it as is |
A |
The gate pages carry the rest of the measured gate defects, each with its options.
Code that contradicts its own ADR or spec
| Question | What was measured (commit 8a2cb42ad) | Options | Recommendation |
|---|---|---|---|
| Governance fails open | PrologGate.may_execute returns allow when no rules are loaded, whatever ORCHESTRATA_GOVERNANCE_STRICT says. ADR-009 makes fail-closed the default (governance) |
A: deny when unloaded unless strict mode is explicitly off. B: stay permissive, but fail the boot when no rule file loads | A |
| Embeddings are not comparable across processes | memory/embedding places each word with hash(word) % 384. Python randomises str hashes per process, so a stored vector and a query vector from another process do not line up (memory) |
A: a stable hash (for example blake2b of the word), then re-embed the hot store. B: pin PYTHONHASHSEED in every unit and test |
A |
| Plugin governance is not wired | PluginGovernance.can_register_volk, can_register_tool, is_capability_granted and get_resource_limit have no callers, so SPEC-015's reserved-alias and reserved-tool protection is not enforced (plugin) |
A: call them from registration.py and PluginContext. B: amend SPEC-015 to make them advisory |
A |
| Specs vs code | Spec 068's overview says SQLite while its requirements say Redis. Spec 017's traces land in memory/* and llm/client although the spec has no Python backend. Spec 097 lists "Mocked" unit tests. Specs 052, 053, 060–062, 097–099, 101 and 108 say Complete with 0% source trace coverage (specs) |
A: amend each spec, the way ADR-0068 did. B: fix the traces or the code | Case by case, after a traceability audit of those specs |
| Diagrams that do not parse | 29 Mermaid diagrams in orchestrata's own sources have syntax errors, so the wiki shows them as source text. They are in 25 specs (016–020, 023, 024, 026, 027, 029–032, 050–053, 060, 061, 097–101), the architect prompts docstring and four plans. 20 of the specs contain classDiagram-direction LR, with the newline missing before direction (for example specs/016-vizint-command-center/spec.md line 1354). The rest use Python-style members (list[dict[str, Any]], = {} defaults), an unquoted |IN_THREAD (in)| edge label, or a classDef the parser rejects |
A: fix the sources on a branch off master and push them (needs a go). B: the wiki repairs only the missing newline as it renders, and leaves the rest as text. C: leave all 29 as text | A |
Deployment
The deployment hub and codetools deploy pages list the deployment gaps measured on 2026-10-23, each with its options:
- ship step 5b against ADR-0123 while the units stay disabled;
- two GitLab runners active;
- the test app container 546 commits behind, with the drift timer disabled;
/opt/codetoolsholding 52 releases against ADR-0035;ct-installskipping the verify gate;- three codetools MCP servers on an old release;
- the codetools plugin's broken verbs;
- the ADR-0020 layers gate absent;
- leftover test containers.
Waiting on a go (no question open, only the action)
- Enable the 16 user units (
systemctl --user enable --now …), plus test and dev autostart. - Push 8a2cb42ad (feat/maps-via-codetools) and 8c7031c9a (the ADR-0127..0133 records), then redeploy
/opt/orchestrata. - Commit the three hand-installed user hooks to
claude/hooks, so the config deploy stops deleting them. - Rule on ADR-0132 and ADR-0133 (table above).
Genuinely new-spend calls (no trigger yet — need a human "go")
- None currently. New investigation reports add their decision sections here; ratified outcomes move to decisions.md and the master plan.